Security
Headlines
HeadlinesLatestCVEs

Headline

A Powerful Tool US Spies Misused to Stalk Women Faces Its Potential Demise

Though often viewed as the “crown jewel” of the US intelligence community, fresh reports of abuse by NSA employees and chaos in the US Congress put the tool’s future in jeopardy.

Wired
#google#intel#auth#ssh#ssl

A federal law authorizing a vast amount of the United States military’s foreign intelligence collection is set to expire in two months, pulling the plug on history’s most prolific eavesdropping operation and the primary means by which US spies intercept the private communications of people deemed threatening, or simply interesting, by the US government—the world’s foremost surveillant.

The US National Security Agency (NSA) relies heavily on the statute, Section 702 of the Foreign Intelligence Surveillance Act, when compelling the cooperation of communications giants that oversee huge swaths of the world’s internet traffic, intercepting hundreds of millions of phone calls and email messages each year, and eavesdropping on the personal conversations of targeted foreign individuals and anyone else, including Americans, unfortunate enough to be caught in their orbit.

As of now, members of Congress have introduced exactly zero bills to prevent Section 702 from sunsetting on January 1, 2024, even though many—perhaps a majority—view this intelligence “crown jewel” as fundamental to the national defense; a flawed but fixable law. The Democrats, who control the Senate, are not blameless in stalling the reauthorization, with more than a handful vying to ensure its renewal is contingent on new rules that force the government to get a warrant before weaponizing the data against its own citizens. The internal conflict roiling the Republican Party, many of whose members share in the desire to rein in the government’s domestic surveillance capabilities, is nevertheless the biggest factor forestalling a compromise, particularly following the removal of Kevin McCarthy as House speaker earlier this month.

The US intelligence community is not without blame. A litany of reported errors, ethical violations, and at least some criminal activity bearing the telltale signs of having been swept under the rug have gone a long way in validating the concerns of Section 702’s biggest detractors: Privacy defenders on both sides of the aisle who share common ground with political allies of Donald Trump, a wellspring of animosity when it comes to military and intelligence leaders—officials routinely peppered from the right with allegations of partisanship and other “treasonous things.”

A US report published in September by an independent government privacy watchdog describes a number of new “noncompliant” uses of raw Section 702 data by analysts at the NSA, an agency where military and civilian employees have been caught repeatedly abusing classified intel for personal, and even sexual, reasons. Issued by the Privacy and Civil Liberties Oversight Board (PCLOB), a body effectively commandeered by Congress in 2005 in an effort to help gauge the scope of the explosion in surveillance after 9/11, the report adds to a decade’s worth of documented surveillance abuses.

The Wall Street Journal first reported in 2013 amid the exploding Edward Snowden scandal that NSA staff had been caught on numerous occasions spying on what the paper called “love interests.” The phenomenon is common enough at the agency to receive its own internal designation: “LOVEINT,” a portmanteau of “love” and “intelligence,” abbreviated in the style of actual surveillance disciplines such SIGINT and HUMINT (“signals” and “human” intelligence, respectively.)

Senator Dianne Feinstein, who died who on September 29 at the age of 90, had defended the NSA following the report, referring to the violations as “isolated,” occurring only roughly, she said, once a year. The Journal noted, meanwhile, that nearly all of the known violations had been self-reported, likely by employees fearful of failing a polygraph exam.

The term “LOVEINT” implies a degree of harmlessness, the misguided acts of a hopeless romantic or a jilted lover. Yet it signifies behavior that is by any modern definition equivalent to stalking. That it received this designation at all seemingly suggests that the abuse is constant enough to border on systemic. The watchdog report released last month by the PCLOB notes that, in 2022, one NSA analyst twice conducted queries on people they’d met “through an online dating service,” showing that despite years of procedures developed to protect against such incidents, the temptation to abuse the most expansive surveillance tool in history for personal gain remains too enticing a prospect for some.

“The US government’s incredible surveillance powers are intended to keep Americans safe from global threats, but we’ve seen time and again how officials have misused this authority at the expense of Americans’ civil liberties,” US senator Chuck Grassley, a Republican from Iowa, tells WIRED. “Instead of aiming this tool at terrorists and international criminals, some have put their political rivals and even love interests in the crosshairs.” The intelligence community’s continued access to the 702 data hinges, in part, on its ability to demonstrate that it can cooperate with oversight attempts, Grassley says, and send an “unequivocal message that abuses will be met with steep consequences.”

While any substantive detail about past 702 violations remains obscured by conditions of secrecy, what can be gleaned from unclassified reports about the “consequences” facing NSA staff for stalking is not encouraging. A 2013 letter from the NSA’s then-top internal watchdog, George Ellard, for instance, described years’ worth of abuses that coincide and even predate the existence of Section 702, which Congress passed in 2008 in an effort to legalize the widespread wiretapping of calls already going in and out of the US, as well as immunize telecommunications companies like AT&T, which was revealed early on to be eagerly cooperating with the government’s demands.

Ellard’s letter, combined with more recent abuse disclosures, paints a picture of an agency that discovers surveillance abuses mainly when its employees self-report them, often to avoid trouble during or in advance of a polygraph test. Violators are often on their way out the door, presumably bound for the private sector, or are otherwise given the option to retire rather than face any real consequences for their actions. Numerous civilian employees at the NSA have admitted to wiretapping the phones of romantic partners, yet it’s clear that many escaped punishment by quitting the agency before investigations into their conduct were earnestly underway.

In one of the most egregious cases, predating the 702 program by several years, an NSA employee admitted to wiretapping nine phone numbers belonging to women. Like with other offenses, Ellard noted in his letter—made public by Grassley several years ago—that the employee had “resigned before discipline had been proposed.” (Incidentally, Ellard’s decade as the NSA inspector general came to an unceremonious end following allegations that he’d retaliated against an agency whistleblower.)

Only US service members with access to raw 702 data appear to have been held accountable to some degree, almost certainly because they were unable, due to the terms of their service, to walk away from their jobs. A member of a “tactical military unit,” for instance, was demoted and docked one month’s pay after searching the classified database for communications belonging to his wife, while another’s access was cut after the NSA discovered they’d been eavesdropping on random people’s phone calls, purportedly to learn the language the victims were speaking.

Section 702, which last year targeted more than 246,000 “non-US persons,” permits the NSA to collect both text and audio of communications belonging to Americans, even when they are not the target of an investigation or suspected of foreign or criminal ties. These communications are “highly personal and sensitive, capturing exchanges with loved ones, friends, medical providers, academic adviseors, lawyers, or religious leaders,” according to the oversight authorities; capable of providing “great insight into an individual’s whereabouts, both in a given moment and in patterns over time.” While the communications of Americans captured as part of Section 702 surveillance may be subject to “minimization” procedures down the line, they are nevertheless stored in a “raw” or unredacted format and can be viewed with the help of a Google Search-like interface.

It’s unclear how many government employees can access Section 702 data, but US lawmakers have offhandedly estimated the figure to be upwards of 10,000 people. This includes many employed by the Federal Bureau of Investigation, where the process of accessing the database remains practically free from judicial review. Under its own procedures, the FBI may conduct searches of the 702 database without probable cause so long as it believes it is “reasonably likely” to retrieve evidence of a crime—the legal equivalent of a hunch. According to a 2016 memorandum authored by the secretive Foreign Intelligence Surveillance Court, the FBI has at times failed to abide by what are already notably loose restrictions on using 702 for the purpose of acquiring communications protected by attorney-client privilege. The FBI’s own procedures have long permitted agents to search the 702 database for correspondence between US citizens and their attorneys, as well as disseminate that information internally, provided the target of the search has not been charged with a crime.

While the NSA refers to the communications of Americans captured under Section 702 as having been collected “incidentally”—the statute authorizes only the “targeting” of “non-US persons reasonably believed to be located outside the United States”—it is important to note that the word “incidental” does not mean “by mistake.” It is merely accepted that each year, as a cost of doing business, the NSA will “inevitably” intercept the calls and messages of an unknown but “substantial” number of Americans.

This collection may be best understood as occurring not in error but as collateral surveillance, defended by the government under an ever-expanding list of national security threats: terrorism, first and foremost; then cyberattacks launched by hostile foreign actors; and today, finally, the illicit trafficking of fentanyl from sources in China.

Since the enactment of Section 702 some 15 years ago, US intelligence chiefs have claimed that it would be impossible to provide any clear metrics regarding just how many Americans are “incidentally” eavesdropped on each year. Ironically, it is the sheer amount of surveillance conducted by the NSA that is blamed for obscuring its impact on Americans’ civil liberties. “We do not yet know the scope of incidental collection,” this year’s PCLOB report states. But it should not be understood as “occurring infrequently,” it says, nor as an “inconsequential part of the Section 702 program.”

Wired: Latest News

Internet Archive Breach Exposes 31 Million Users