by Shane Harris
In order to build an early-warning system, the NSA would need access to the customer records of the phone companies, Internet service providers, and other purveyors of electronic communications. In the case of the phone companies, call detail records—or logs that showed who called whom; from where to where; when; and how often—constituted a valuable potential resource.
They also would need access to a source that the NSA had not been collecting systematically in the past: e-mail. Despite the agency’s reputation for collecting anything and everything electronic, the agency had shied away from this increasingly common medium. One reason was parochial—the agency’s terrorist hunters simply didn’t believe their targets were using e-mail. They were holed up in caves and dusty campsites, after all, and had seemed to get by just fine with telephones.
But there was also a legal rationale. E-mails, unlike phone calls, were not transmitted point-to-point between two parties. Instead, an e-mail message was broken up into pieces called “packets,” each of which traveled different routes through the Internet before being reassembled at a destination. Most packets traveled through the United States, home of most of the world’s Internet infrastructure. So the NSA could not be sure that even a foreign e-mail wasn’t passing through America. Furthermore, the agency couldn’t know for sure whether the sender or receiver was a protected U.S. person. In the face of these uncertainties, the NSA left e-mail alone.
In early 2001, the NSA had begun experimenting with e-mail as an intelligence source, but not against Arab terrorists. Wertheimer had led an exercise to find out whether Russian mobsters were supplying weapons of mass destruction to Iran. He told his team to pull in a variety of data sources, including e-mail, from different agencies. Here too the analysts weren’t sold on the idea that Russian organized crime figures were logging on to the Internet to send messages. After 9/11 he told his team to operate as if the terrorists were doing just that. “You are now to presume they use e-mail. Find it,” he instructed.
As Hayden set up the new surveillance program, it was increasingly clear to NSA officials that e-mail, not phone calls, would constitute the bulk of their collection. It made sense. Terrorists had to presume that their phone calls were being tapped, or could be easily. But e-mail allowed for a certain amount of stealth. One could open a new account, use it to send a few messages, and then never return to it again. An Al Qaeda operative could log on from different Internet cafés so that he never used the same service provider. He could mask his physical location by using an Internet address that was actually based on a server in another country. As analysts began to study terrorist e-mailing habits more closely, they came to believe that members of a cell actually were sharing a single e-mail account and writing all of their messages to one another as “drafts,” which were actually stored in a folder within the account and never sent over the Internet. It was the electronic version of a drop site.
But no communications system, no matter how complex, offered total anonymity. The NSA hunters understood, as did Poindexter’s team, that terrorists were susceptible to detection every time they used a phone, sent an e-mail, or made a credit card purchase. Every move left a trace, and though it might be hard to find, it wasn’t impossible. But Hayden’s system lacked a key component of Poindexter’s brainchild—privacy protection. The NSA had no appliance of the kind Poindexter envisioned. No agency did. In this new and treacherous realm of domestic communications, the best assurance that Hayden could provide that he was playing by the rules was his word.
Hayden had come up with a plan, and Bush personally felt it was a good idea. The NSA director’s system was technologically feasible. He felt it would produce useful intelligence—perhaps the most useful intelligence the government could expect, since it had so few human spies on the ground in Afghanistan and throughout the Middle East. One question remained: Was Hayden’s system legal?
The crux of the answer actually preceded Hayden’s pitch. Yes. The president of the United States had the authority to order electronic surveillance of foreign terrorists. And he didn’t need a court’s permission.
That was the conclusion of John Yoo, an expert on presidential war powers who found himself in high demand after the terrorist attacks. Yoo worked as a politically appointed attorney in the Justice Department’s Office of Legal Counsel, the font of wisdom to which all presidents turned when they needed to know if a particular course of action was, in fact, legal. On September 25, Yoo sent a memo to a senior official in the Justice Department, who had asked whether the administration might change some language in FISA in such a way that made it easier for the government to secure warrants in terrorism cases. (That question was up for public debate as Congress and the administration hammered out major changes to surveillance rules in the USA PATRIOT Act.)
Yoo, who had no experience arguing cases before the court that granted FISA warrants, determined that it was not unconstitutional to change the wording of the law. The administration could propose that “a purpose” of surveillance was to collect foreign intelligence, as opposed to “the purpose,” which was what the law required. The administration wanted to lower the bar, and Yoo said that was fine.
But then Yoo offered an unsolicited assessment. The president didn’t really need to go through FISA at all. The nation was at war, and the president had to gather intelligence to fight that war. “The Fourth Amendment declares that ‘[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures shall not be violated.’ ” The emphasis was Yoo’s own.
“Thus, the touchstone for review is whether a search is ‘reasonable,’” he continued. And the Supreme Court had made clear that the government didn’t always need a warrant in order to conduct a reasonable search, Yoo noted. Quoting a case that upheld the constitutionality of an Oregon school district’s program of random drug testing, Yoo wrote that “a warrantless search can be constitutional ‘when special needs, beyond the normal need of law enforcement, make the warrant and probable-cause requirement impracticable.’”
Yoo was going well beyond the question that had first been posed—whether or not FISA could be amended. Now he was articulating a basis for warrantless surveillance conducted “beyond the normal need of law enforcement” because the Fourth Amendment’s requirement of probable cause to search was “impracticable.”
The president could decide whether those conditions existed, Yoo determined. And the commander in chief should rest comfortably in his authorities: “[T]he Court has found warrantless searches reasonable when there are ‘exigent circumstances,’ such as threat to the safety of law enforcement or third parties.”
Yoo was a scholar, and had pulled only a few previous stints in Washington—in the midnineties, as a general counsel to the Senate Judiciary Committee, and in a clerkship for appeals court judge Lawrence Silberman, who happened to be the presiding judge on John Poindexter’s appeal of his Iran-Contra convictions. Yoo had come to Justice shortly before the 9/11 attacks. But in this memo and others he wrote in coming weeks, he laid the foundation for a sweeping new regime of warrantless electronic surveillance. From these memoranda, President Bush justified his decision to grant Hayden the authority for his new mission.
The key question hanging over Hayden’s surveillance system was whether or not it touched the arch of FISA. Yoo had concluded that that didn’t matter. Even if the NSA’s surveillance targeted U.S. persons, including those inside the United States, the administration decided that any communication involving foreign parties made the entire communication “foreign intelligence.” The president’s authority here was unchallenged, Yoo concluded in a later memo. “Unless Congress made a clear statement in the Foreign Intelligence Surveillance Act that it sought to restrict presidential authority to conduct warrantless searches in the national security area—which it has not—then the statute must be construed to avoid [such] a reading.”
Yoo apparently had overlooked both law and the legisla
tive history of FISA, which clearly established that Congress had intended the law to be a check on the president’s surveillance powers. A separate wiretapping statute declared that when it came to foreign intelligence gathering, FISA was in control. Transcripts of the debates about the law, as well as statements by lawmakers at the time, affirmed this was their intention. Whether or not Yoo grasped this history, or whether he was acting as a zealous attorney looking for the narrowest and still reasonable interpretation of the law for his client, the White House determined that Bush had the authorities he needed.
That fit squarely in the worldview of both Dick Cheney, the vice president, and his chief legal adviser, David Addington. Both men believed that since the Watergate scandal, Congress had slowly but successfully chiseled away the president’s most fundamental powers. They’d nurtured that view throughout the crucible of the Reagan years, when Congress and the executive had gone toe to toe in that most sanctified of presidential domains, national security. Addington, then a congressional staffer, and Cheney, a congressman from Wyoming, articulated their philosophy in the “minority report” of the congressional Iran-Contra commission, of which they were among the principal authors. Both men believed that lawmakers once again had strayed well beyond their brief in trying to micromanage the executive: Deeper than the specifics of the Iran-Contra Affair lies an underlying and festering institutional wound these committees have been unwilling to face. In order to support rhetorical overstatements about democracy and the rule of law, the committees have rested their case upon an aggrandizing theory of Congress’s foreign policy powers that is itself part of the problem.
President Bush didn’t need FISA, and he didn’t need Congress. The FISA warrants process would impede the swift, hot pursuit approach that Hayden had laid out. The NSA would be bogged down in paperwork while potential terrorists slipped through their digital nets. They would bob and weave through the network, switching phones, using different e-mail accounts to cover their tracks. If the agency had to wait for a federal judge to issue a warrant for each and every suspect who appeared, the NSA might as well just stop trying to track them at all and devote its resources to more productive ends.
On October 4, just three days after Hayden appeared before Pelosi and the House Intelligence Committee, Bush granted the authority for the NSA to design the surveillance system Hayden had described. The NSA now had the power to target anyone it reasonably suspected was a terrorist, or their associates, regardless of their location. One rule applied: At least one party to the communication must be located outside the United States. Under these new orders the NSA had the power to target Americans inside the country without warrants. The lines on the field had just been redrawn. The definition of foreign intelligence now encompassed Americans’ phone calls and e-mails.
Hayden had gotten what he asked for. The three pillars were aligned. The math added up. He had a chance to say no, to send the authorities back. It was his call. But given the stakes, and the backing he’d received, he decided to proceed.
Hayden was a Catholic, and he believed in the proportionality of war. There was a balance to strike between force and the good that could come of it. He laid the facts as he knew them on the table. The United States had been savagely attacked. He believed he could take reasonable action to stop another atrocity. And the president had given him the authority to act.
I can’t not do this, Hayden told himself.
Whether he needed the commander in chief ’s blessing or could have continued working under his existing authorities, probably only a judge could decide. But that was a question Hayden didn’t need to answer. The president of the United States had just given him the ultimate cover.
In time, the NSA’s surveillance system went by various names within the tiny circle of officials who knew it existed. Officially, it was code named Stellar Wind. Some just called it the president’s program. But inside the labs and idea factories of the agency’s formidable technology team, the terrorist hunting machine had another name.
They called it the Big Ass Graph.
CHAPTER 14
ALL HANDS ON DECK
Bob Popp had always wanted to work for DARPA, but the right job had yet to come along. In January 2001 he joined a smaller version of the futuristic brain trust—the Pentagon’s Advanced Systems and Concepts Office. It was full of big thinkers, people of outsized intellectual ambition, like him. But they set their sights on more practical ideas than their fellows at DARPA. More near-term payoff, less pie in the sky.
For Popp, a thirty-eight-year-old technologist and freshly minted civil servant, it was a respectable position with a résumé-burnishing title—assistant deputy undersecretary. In Washington, that counted for something.
Popp’s new job put him at the center of the action. Each year the advanced systems office vetted roughly a hundred new research proposals for concepts and technologies that needed Defense Department funding. Popp was asked to “rack and stack” the proposals, vetting and ranking them to help his bosses decide on a final list of candidates that should be considered for precious dollars. But to his great disappointment, the current stack was bland and conventional.
Popp saw plans for making airplanes fly faster and for making tanks more rugged. But there was no novelty to any of it. He had spent the past three years with a defense contractor, helping the Air Force develop new tracking methods for ground targets, creating “situational awareness,” in military parlance, for airborne missions. Far more ambitious stuff, he thought. Just making things go boom and bang gave him limited satisfaction.
As Popp read the hundred or so proposals, he also saw nothing that rose to the challenge just put forward on January 31 by a blue-ribbon panel of experts. The group had been convened to draft a road map for national security in the twenty-first century. Chaired by former senators Gary Hart and Warren Rudman, it bleakly concluded that the country had overlooked the dangers to the American “homeland” in the fallout of the cold war.
“The combination of unconventional weapons proliferation with the persistence of international terrorism will end the relative invulnerability of the U.S. homeland to catastrophic attack,” they wrote. “A direct attack against American citizens on American soil is likely over the next quarter century.” Their italicized emphasis was a clarion call: If you read nothing else in the report, read this.
The authors recommended that the recently inaugurated President Bush create a national homeland security agency to harness the nearly two dozen federal entities that played a role in domestic protection. Popp thought it was a brilliant idea, and something that his office should pay attention to. Finding nothing with a homeland angle in the pile of proposals on his desk, he decided to write one himself.
Popp took his cues from the Hart-Rudman commission, dubbing his idea “Homeland Security Command and Control.” He had three goals, all aimed at deficiencies the commissioners had identified: expand the flow of security information between foreign and domestic counterterrorism agencies, especially the FBI and the CIA; create better command and control systems for federal, state, and local governments, since the latter two were really the front lines of domestic defense; and beef up communications for so-called first responders—police, fire, and rescue personnel who’d be sent into the breach during an emergency.
Popp was a systems thinker, and he intuitively grasped that all those moving parts had to move together. He thought that one new tool, or an improvement on an existing technology, would yield but incremental progress. What the world needed now was a big step forward. He threw his proposal into the mix. And after others winnowed down the list to about twenty ideas worthy of funding, his ranked near the top.
In early September 2001, near the end of the government’s fiscal year, the candidate proposals were circulated among potential sponsoring organizations throughout the Defense Department. Only a few days later Popp’s idea looked eerily prescient. After the disaster of 9/11, the phrase homeland security quite suddenly was
in vogue.
A few weeks later, in mid-October, Popp showed up for work one morning and found an e-mail from a name he vaguely recognized—John Poindexter. Why did it sound so familiar? he wondered. Popp searched his memory; the best he could recall was something about a political scandal. Years ago, maybe.
In his e-mail Poindexter explained that he had read Popp’s proposal. He was setting up a new program at DARPA that would be involved in similar research, and he needed a deputy. Someone to help him run the office. If Popp was interested in the job, they should meet.
Before he responded Popp tapped Poindexter’s name into a search engine. He tried “Poindexter and Watergate,” and although that string came up empty, he eventually landed on the correct inglorious chapter of history.
In 1981, the year Poindexter went to the White House, Popp was nineteen years old. He joined the Air Force, and while the admiral was fighting for his future in a congressional hearing room, Popp was repairing airplanes. He was a kid at the beginning of his career, with a blossoming family. Looking back on Iran-Contra, Popp only recalled seeing some of the hearings on television, and he couldn’t remember many of the details.
Popp replied to Poindexter’s e-mail. “I’d love to meet.”
Mary McCarthy told Poindexter he was nuts. In the kindest way she knew how, of course. But what was he thinking?
McCarthy was one of the first to hear of Poindexter’s return to government, after so many years on the outside. He was going to DARPA, he said, to lead a new group called the Information Awareness Office. TIA would be the centerpiece but not the only research thrust.