Beyond Snowden

Privacy, Mass Surveillance, and the Struggle to Reform the NSA

Timothy H. Edgar

• Verlag: Brookings Institution Press
• Jahr: 2017
• ISBN:
  9780815730644
• Thema: Politics & International Relations
• Thema: Intelligence & Espionage

Safeguarding Our Privacy and Our Values in an Age of Mass Surveillance

America’s mass surveillance programs, once secret, can no longer be ignored. While Edward Snowden began the process in 2013 with his leaks of top secret documents, the Obama administration’s own reforms have also helped bring the National Security Agency and its programs of signals intelligence collection out of the shadows. The real question is: What should we do about mass surveillance?

Timothy Edgar, a long-time civil liberties activist who worked inside the intelligence community for six years during the Bush and Obama administrations, believes that the NSA’s programs are profound threat to the privacy of everyone in the world. At the same time, he argues that mass surveillance programs can be made consistent with democratic values, if we make the hard choices needed to bring transparency, accountability, privacy, and human rights protections into complex programs of intelligence collection. Although the NSA and other agencies already comply with rules intended to prevent them from spying on Americans, Edgar argues that the rules—most of which date from the 1970s—are inadequate for this century. Reforms adopted during the Obama administration are a good first step but, in his view, do not go nearly far enough.

Edgar argues that our communications today—and the national security threats we face—are both global and digital. In the twenty first century, the only way to protect our privacy as Americans is to do a better job of protecting everyone’s privacy. Beyond Surveillance: Privacy, Mass Surveillance, and the Struggle to Reform the NSA explains both why and how we can do this, without sacrificing the vital intelligence capabilities we need to keep ourselves and our allies safe. If we do, we set a positive example for other nations that must confront challenges like terrorism while preserving human rights. The United States already leads the world in mass surveillance. It can lead the world in mass surveillance reform.

1

INTRODUCTION: MAKING A DIFFERENCE

Around the time Edward Snowden began working for the Central Intelligence Agency in 2006, I decided to leave my position as a lawyer for the American Civil Liberties Union in the hope I could make a difference by going inside America’s growing surveillance state.¹ Surprisingly, senior intelligence officials took a chance on hiring me in a unique new office safeguarding civil liberties and privacy. My job was to advise the director of national intelligence, who oversees the seventeen agencies of the U.S. intelligence community.

Before I joined the government, I had testified before Congress as an ACLU lawyer, arguing against expanded surveillance in the “war on terror.” Since information on national security surveillance was secret, my arguments were based on hypothetical scenarios about how intelligence agencies might use their new powers.² After joining the government I learned the truth—about bulk collection of data, the weakening of internet security, and other intrusive surveillance activities. The imaginative ways intelligence agencies were using their legal authorities exceeded the most alarming visions I had conjured up in my years as a privacy and civil liberties activist. The government was collecting immense volumes of data both inside and outside the United States, including data pertaining to Americans, creating serious privacy risks.

For the next seven years, I worked with a growing team of internal privacy watchdogs inside the intelligence community. We reviewed the U.S. government’s most secret surveillance programs. Our job was to ensure these programs had a firm basis in law and included safeguards to protect privacy and civil liberties. As surprised as I had been by the breadth of surveillance, I was just as surprised by how seriously everyone inside the government took the rules that governed it. We brought the legally questionable surveillance policies of the Bush administration under the supervision of Congress and the judiciary, and devised new oversight mechanisms to ensure compliance with the rules. Our efforts put the U.S. government’s mass surveillance programs on a stronger legal basis, helping the intelligence community weather the storm when these programs became public in 2013.

While I am proud of the work I did to keep intelligence agencies in bounds, it is fair to say my success in protecting privacy as an insider was limited. In retrospect, my focus on ensuring that the intelligence agencies were true to the complex and sometimes arbitrary legal rules that govern surveillance caused me to miss the broader impact of the U.S. government’s programs on the privacy of all the world’s data, and what this meant for the privacy of Americans. The rules that guided my work were designed to prevent “spying on Americans.” They were mostly written in the 1970s. They depended on geography and borders in a way that the internet and globalization had made largely obsolete. The digital data, communications, and personal lives of Americans now transcended national boundaries. Compounding the problem, the rules were based on analog technology. They made distinctions that no longer made much sense between types of data, offering inadequate protection in an age of digital surveillance. Inside the intelligence community, these problems were well understood, and many shared my concerns. Our efforts to start a meaningful public dialogue about privacy were largely frustrated by the decisions of top officials to keep modern programs of mass surveillance a secret.

In 2009 I was detailed to the White House national security staff to serve a stint as its first-ever director of privacy and civil liberties. Barack Obama had won election as president with a promise to review the surveillance programs initiated by President George W. Bush after the events of September 11, 2001. I had high hopes that Obama’s fresh approach would force needed reforms that would protect privacy. But after Obama took office, he continued and even expanded mass surveillance programs. Despite my lofty White House perch, my broader hopes for reform proved elusive. Obama’s top aides showed little interest in reforming mass surveillance until after I left, when Edward Snowden forced them to confront the issue.

In 2013 I left government to pursue research and teaching. As my work to provide privacy and civil liberties safeguards for mass surveillance programs had been highly classified, I expected I would never speak or write publicly about it. Instead, much to my surprise, I found myself thrust into a global conversation about privacy and mass surveillance. Only a few days after my formal resignation in June, the first stories based on secret documents leaked by Snowden appeared in the press. They described surveillance programs on which I had worked. That summer the Obama administration confirmed these programs and declassified details about the rules that governed them, including some of the safeguards I had helped devise.

The Snowden revelations concerned the operations of the largest of the secret “three-letter” intelligence agencies, the National Security Agency. The NSA collects “signals intelligence,” which means it scoops up the world’s communications, processes them into intelligible form, and turns them into intelligence reports. NSA operations are essential to national security and to international stability, but it is a challenge to reconcile them with the values of a free society. The Snowden revelations forced the NSA to take painful steps to open up. Before Snowden, basic information such as the number of targets affected by court-ordered surveillance was a closely guarded secret, obscuring important facts such as how much surveillance could be authorized by a single court order. Today the head of the intelligence community publishes an annual transparency report, revealing that one such order authorized surveillance of more than 100,000 foreign targets, and that data about Americans collected under that order were queried more than 30,000 times, among other details.³

This new transparency would not have happened without Snowden. “Where you’re in positions of privileged access,” Snowden said, “you see things that may be disturbing.” During this interview from a hotel in Hong Kong, Snowden revealed himself to the world as the source of ongoing leaks of classified information. “This is something that’s not our place to decide,” Snowden said, explaining his decision. “The public needs to decide if these programs and policies are right or wrong.”⁴ Without a basic level of transparency about mass surveillance programs, the NSA’s operations lack democratic legitimacy. The most secret of the government’s secret agencies will never be a model of transparency. Still, it has never been more transparent than it is today.

Thanks to Snowden, the government has also been forced to become more accountable for mass surveillance. Before Snowden, the NSA used a secret interpretation of the Patriot Act, the antiterrorism law passed in 2001, to amass a nationwide database of telephone records from American companies of calls to, from, and within the United States. In 2015 a federal appeals court declared this program of bulk collection unlawful.⁵ Less than a month later Congress passed the Freedom Act, which replaced this program with an alternative one that leaves the data with the telephone companies.⁶ Before passage of the Freedom Act, the secret court that authorizes intelligence surveillance almost never heard more than the government’s side of the argument. Now, outside lawyers routinely appear to argue the case for privacy.⁷

More fundamentally, the Snowden revelations have enlarged the way the U.S. government thinks about privacy. Before Snowden, there was no written order, directive, or policy that gave any consideration to the privacy of foreign citizens who live outside the borders of the United States. When intelligence officials asked lawyers like me about privacy, it went without saying that we were talking about American citizens and residents. In 2014 President Obama signed a directive reforming signals intelligence collection, requiring that some privacy protections apply to the personal information that agencies collect about foreigners outside the United States. By 2015 all agencies had issued new procedures, or revised existing procedures, to fulfill this requirement.⁸ Today, for the first time in history, it is the policy of the United States that the privacy and civil liberties of everyone in the world must be taken into account when agencies collect signals intelligence.

The Snowden revelations have also helped the public better understand how the NSA’s programs targeting foreigners affect the privacy of Americans. At the end of the Bush administration, Congress gave the government broad power to compel American companies to assist in surveillance of foreign targets with a secret court order. Section 702 of the Foreign Intelligence Surveillance Act (FISA) allows collection of data inside the United States belonging to foreign citizens outside the United States. While the law itself was no secret, Snowden leaked the existence of two programs authorized by section 702, the Prism program and “upstream collection.” Prism, also known as “downstream collection,” allows the NSA to obtain stored e-mails and other communications from American technology companies. Upstream collection gives the NSA access to data in transit across the internet backbone facilities of American telecommunications companies.⁹ Both programs permit what critics call a backdoor search: routine queries by other agencies about Americans who may be in contact with the NSA’s foreign targets or who may be mentioned in e-mails or other communications. This practice has now been limited, although critics would like stricter limits, including warrants.¹⁰ Such privacy issues used to be known only to people like me: those privileged to attend classified briefings or to participate in the secret proceedings of the Foreign Intelligence Surveillance Court.

In short, the Snowden revelations have made the NSA more transparent, more accountable, and more protective of privacy. Surprisingly, the reforms have also made the NSA more effective. Jack Goldsmith, a former Justice Department official in the George W. Bush administration, marveled in June 2016 that “the intelligence community, and especially the NSA, have emerged in astonishingly good shape” in the aftermath of the Snowden revelations.¹¹ For example, the system Congress created to end the NSA’s bulk collection of telephone records from American companies actually gave NSA analysts access to a broader volume of data than before. This allowed the agency to collect more than 151 million records in 2016, without the NSA having the responsibility for storing the billions of records it used to collect each day under the old program.¹²

Former attorney general Eric Holder has offered warm words for Snowden. “We can certainly argue about the way in which Snowden did what he did, but I think that he actually performed a public service by raising the debate that we engaged in and by the changes that we made,” he said in May 2016.¹³ Holder’s praise raised eyebrows. After all, he was the attorney general when Snowden was charged with serious felonies, including theft of government property and disclosure of classified communications intelligence. I found Holder’s views less surprising than many did. I had heard similar views expressed privately by several of my colleagues in the national security community.

WHEN I JOINED THE INTELLIGENCE community, I wondered if I would be able to make a difference. My hope was that my position of privileged access would allow me to argue for privacy in a way I never could have done as an outside advocate. The post-Snowden reforms described in this book are more significant than any my colleagues and I achieved during my time in public service. That it took a Snowden to force these changes made me question whether I had done the right thing by working within the system. While I kept my promise not to spill the government’s secrets, Snowden’s strategy proved more effective than mine. Snowden explained his decision to leak classified information as an act of self-sacrifice, motivated by patriotism. Many do not believe Snowden’s claims about why he did what he did, regarding him as an attention-seeking opportunist. Some even speculate (without much evidence, it should be said) that he acted in concert with Russian or other foreign intelligence services.¹⁴ Whatever Snowden’s true motives, it is undeniable that he made a difference. Snowden has said that his greatest fear when he decided to give his purloined documents to journalists was not that he would be imprisoned but that no one would care, and “nothing will change.”¹⁵ That fear has not been realized. The post-Snowden reforms represent the first real step toward addressing the privacy issues posed by mass surveillance.

Of course, Snowden’s strategy also resulted in substantial costs—to Snowden himself and to American national security. Snowden not only told the world about the NSA’s impact on global privacy, he also compromised many legitimate programs focused on China and other potential adversaries of the United States, and in some cases compromising these programs lacked any obvious privacy or civil liberties benefits, even for foreign citizens.¹⁶ Many of these revelations caused the NSA relatively little embarrassment but did result in damage to national security. They received little attention, at least in the American press, but were carefully noted by foreign governments. For reasons involving national security—but also because of excessive secrecy and bureaucratic inertia—it has been difficult for officials to make this case in public in a compelling way, but that does not make the damage from Snowden’s disclosures less real.

Was the damage worth it? Geoffrey Stone, a law professor at the University of Chicago and a former colleague of President Obama, served on a review group Obama appointed in 2013 to scrutinize NSA programs and recommend reforms. “To say I was skeptical about the NSA is, in truth, an understatement,” he told the NSA in a speech to its employees after the review was complete. To his surprise he found, as I had, that the NSA “operates with a high degree of integrity and a deep commitment to the rule of law.” The NSA was doing what it had been told to do: the agency’s employees were being “demonized” unfairly for decisions made “not by them, but by Presidents, the Congress, and the courts.”¹⁷ These decisions, Stone and his colleagues found, had resulted in unacceptable privacy risks, requiring significant reforms.

The fact that a series of massively damaging leaks was needed to achieve such sensible reforms can only be described as a failure of leadership. For me, that failure is at least in part a personal one. As a privacy and civil liberties official inside the intelligence community and later at the White House, I was supposed to provide top officials with confidential advice about how to ensure that intelligence programs protected our liberties. In essence, I was to be an authorized whistleblower for classified programs—a sort of official Snowden. In performing that role, I tried to make just the kind of arguments about privacy and NSA surveillance that many have said Snowden should have raised internally instead of compromising classified information. Unlike Snowden, I had direct access to the officials who could have made surveillance reform a reality—and who did so, after ...