Dark Mirror

by Barton Gellman

  even from judges: When the domestic surveillance began under President George W. Bush, it was explicitly designed to operate without judicial or legislative review. Over time the White House agreed to provide limited briefings to the so-called Gang of Eight (the party leaders and the chairs and ranking members of the intelligence committees in each house of Congress) and to the chief judge, but not the other judges, of the Foreign Intelligence Surveillance Court. See Gellman, Angler, 143, 150–51. The government acknowledged an obligation to disclose to defense lawyers in a criminal case whether evidence against their clients derived from secret FISA surveillance. In 2012, Solicitor General Donald Verrilli Jr. assured the Supreme Court that federal prosecutors honored that obligation. See Verrilli’s brief in Clapper v. Amnesty International, 568 U.S. ___ (2013), at http://bit.ly/2bDj3vF. In fact, they did not, in part for fear that the secret surveillance could be subjected to constitutional challenge. See Charlie Savage, “Door May Open for Challenges to Secret Wiretaps,” New York Times, October 16, 2013, http://nyti.ms/2b3OacO. In November 2013, the government admitted having used FISA-derived evidence to convict Mohamed Osman Mohamud of plotting to set off a car bomb in Portland, Oregon. See the Government’s Supplemental FISA Notification: United States v. Mohamud, Case No. 3:10-cr-00475-KI (D. Ore. Nov. 19, 2013), at http://bit.ly/2b5UZQ2. Mohamud’s motion to vacate the conviction was denied. United States v. Mohamud, Case No. 3:10-cr-00475-KI-1, 2014 WL 2866749 (D. Or. June 24, 2014), at https://archive.is/YcCKE.

  skill set I had to teach myself: There are unlikely to be many kinds of hiding places that people who search for a living have not encountered. The challenge is to use methods, physical and virtual, that remain secure even if the other party knows the methods exist. Given a large enough forest, it may not help a searcher much to know that people sometimes hide things under trees.

  hide information in digital alcoves: Some of the physical space on a hard drive is typically invisible to, or disregarded by, an operating system like Windows, Apple OS X, or Linux. Examples include unassigned blocks or sectors, free space alongside the master boot record, and the “slack” that remains when a file or partition does not fill all its reserved space. A technically proficient person could put data in one of those places, which an ordinary copy would not reproduce. For an explanation of “digital warrens where data may go unnoticed,” see Hal Berghel, David Hoelzer, and Michael Sthultz, “Data Hiding Tactics for Windows and Unix File Systems,” Advances in Computers 74 (2008), www.berghel.net/publications/data_hiding/data_hiding.php.

  bit-by-bit clones: A computer bit, the smallest unit of data in digital form, is a binary number consisting of 0 or 1. All other units of data are based on that. (There are 8 bits in a byte, 1,024 bytes in a kilobyte, 1,024 kilobytes in a megabyte, and so on.) Ordinary backup copies include only the bits that are allocated, or mapped, by the operating system. They leave a lot of stray data behind. A clone, also known as a forensic image, captures the “digital warrens” described in the previous note. There are commercial software packages for making clones, but I did the job quick and dirty with a command-line tool (“dd”) built into Unix-based operating systems such as OS X. See the manual pages at http://apple.co/21rZMAm [inactive] and www.gnu.org/software/coreutils/manual/html_node/dd-invocation.html.

  they made the same request: The Washington Post general counsel, Jay Kennedy, and deputy general counsel, James McLaughlin, interviews with author, March 31, 2016.

  “I will confess”: Jay Kennedy, interview with author, March 31, 2016.

  metaphors of cryptography are stupid: In 2014, Princeton undergraduates in Arvind Narayanan’s Privacy Technologies seminar conducted a study to test whether better metaphors could improve the experience of nontechnical users with email encryption. See Wenley Tong et al., “Why King George III Can Encrypt,” June 6, 2014, http://randomwalker.info/teaching/spring-2014-privacy-technologies/king-george-iii-encrypt.pdf.

  opened the PRISM slide deck: National Security Agency, “PRISM/US-984XN Overview, or the SIGAD Used Most in NSA Reporting,” April 2013, on file with author in full and published in redacted form at www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/.

  starbursts, charts, tables, arrows: When the PRISM slide deck became public, it was widely mocked by graphic designers, at least three of whom offered their services, tongue in cheek, to the NSA. The substitute designs were pretty good, actually. See Holly Allen and Chad Lorenz, “Those PRISM Slides Are Hideous: Here, NSA. We Redesigned Them for You,” Slate, June 7, 2013, http://slate.me/1Qqnfd7; Victoria Nece, “PRISM PowerPoint Redesign,” June 8, 2013, http://victorianece.com/2013/06/prism-powerpoint-redesign/; Emiland, “Dear NSA, Let Me Take Care of Your Slides,” June 11, 2013, www.slideshare.net/EmilandDC/dear-nsa-let-me-take-care-ou.

  Skype, YouTube: These two companies were brought into PRISM before Microsoft and Google, respectively, acquired them.

  Exabytes of user information: As far as I know, the big internet companies do not disclose the volumes of data they store. By one outside estimate, a single Google data center holds ten to fifteen exabytes. Given that Google has multiple data centers, and some of its rivals store comparable volumes, it is possible that their collective holdings encompass zettabytes of information, or thousands of exabytes. See Colin Carson, “How Much Data Does Google Store?,” Cirrus Insight, November 18, 2014, www.cirrusinsight.com/blog/how-much-data-does-google-store [inactive].

  thousands of millions of billions of bytes: See Roy Williams, California Institute of Technology, “Data Powers of Ten,” archived at https://web.archive.org/web/19990508062723/http://www.ccsf.caltech.edu/~roy/dataquan/.

  “the dawn of civilization”: Eric Schmidt, remarks at Techonomy conference, August 4, 2010, http://readwrite.com/2010/08/04/google_ceo_schmidt_people_arent_ready_for_the_tech/. His full quotation was “There was 5 exabytes of information created between the dawn of civilization through 2003, but that much information is now created every 2 days.”

  Some people questioned his numbers: Robert J. Moore, “Eric Schmidt’s ‘5 Exabytes’ Quote Is a Load of Crap,” R.J. Metrics, February 7, 2011, https://blog.rjmetrics.com/2011/02/07/eric-schmidts-5-exabytes-quote-is-a-load-of-crap/. Moore estimated that it would be more accurate to say the world produced as much information every seven days as it did in all of 2002.

  legal authority that Congress granted: In 2007, Congress passed the Protect America Act, S. 1927 (110th Cong., 1st sess., enacted August 5, 2007), www.govtrack.us/congress/bills/110/s1927/text. The following year it passed the FISA Amendments Act, H.R. 6304 (110th Cong., 2nd sess., enacted July 9, 2008), www.govtrack.us/congress/bills/110/hr6304/text. The statute, which rewrote major portions of the Foreign Intelligence Surveillance Act of 1978, was renewed in 2012. See especially Section 702.

  The court nearly always granted: See “Foreign Intelligence Surveillance Act Court Orders, 1979–2015,” Electronic Privacy Information Center, https://epic.org/privacy/wiretap/stats/fisa_stats.html#footnote21.

  Once a year: Ellen Nakashima and Barton Gellman, “Court Gave NSA Broad Leeway in Surveillance, Documents Show,” Washington Post, June 30, 2014, http://wapo.st/1MZVvkP.

  The first one laid out rules: See “Procedures Used by NSA to Target Non-US Persons: Exhibit A—Full Document,” Guardian, June 20, 2013, www.theguardian.com/world/interactive/2013/jun/20/exhibit-a-procedures-nsa-document. Original copy on file with author.

  The second one specified procedures: “Procedures Used by NSA to Minimize Data Collection from US Persons: Exhibit B—Full Document,” Guardian, June 20, 2013, www.theguardian.com/world/interactive/2013/jun/20/exhibit-b-nsa-procedures-document [inactive]. Original copy on file with author.

  The court would not know: One of my favorite colleagues confirmed this in a rare interview with the chief judge of the Foreign Intelligence Surveillance Court, who was then the U.S. district court judge Reggie Walton. See Carol Leonnig, “Court: Ability
to Police U.S. Spying Program Limited,” Washington Post, August 15, 2013, http://wapo.st/1WSZLVp.

  “Can I have a private word?”: I have not spoken before of this private meeting, which was exceptionally meaningful to me. I reconstruct the exchange from notes I took after the fact, using quotation marks only for the words I wrote down. The rest is paraphrased from my memory, checked against Baine’s and Baron’s.

  legal culture of twenty-first-century America: My friend Jack Goldsmith makes the point that our legal culture has all but ruled out the application of black letter law to national security journalism. I do not know whether he agrees with me that this constraint applies more strongly when mainstream news organizations test the legal limits. See Jack Goldsmith, Power and Constraint: The Accountable Presidency After 9/11 (New York: Norton, 2012), esp. chapter 3.

  CHAPTER FOUR: PRISM

  five thousand miles away: I have taken a small liberty in rounding. According to a standard online reference, the distance between the nearest civilian airports serving Fort Meade and the Kunia facility is 4,853 miles. See Air Miles Calculator, www.airmilescalculator.com/distance/hnl-to-bwi/.

  three intelligence reports: Slide 16, “# of End Product Reports Citing US-984XN/PRISM (Sept 2007 to Feb 2013),” in “PRISM/US-984XN Overview, or, The SIGAD used Most in NSA Reporting,” April 2013, on file with author. Selections have been published in the Post, the Guardian, and independent news sites. Much of the presentation remains unavailable to the public.

  wire diagram of the NSA: The agency has never released an organizational chart of any detail in unclassified form. Over many months I assembled my own chart from fragments I came across in memos and briefings. In late 2015, the NSA director tore up the map and announced a reorganization plan called “NSA21.” See Jane Edwards, “Adm. Michael Rogers: NSA to Undergo Reorganization in January,” ExecutiveGov, December 17, 2015, www.executivegov.com/2015/12/adm-michael-rogers-nsa-to-undergo-reorganization-in-january/, archived at https://archive.fo/hU4cr.

  a lesser federal agency: Among the eighty members of the association for small federal agencies, the average employee roster is said to number 625. See “About the Small Agency Council,” www.sac.gov/about/.

  defend and attack: There are NSA directorates, such as Research (R), Technology (T), and Legal (OLC), that support both missions. A third major element at Fort Meade, the Central Security Service, oversees the cryptologic organizations of each branch of the armed services.

  A classified introduction to the NSA, prepared for new members of the House and Senate intelligence committees and their staffs, provided capsule definitions of the information assurance mission (“Protect U.S. Telecommunications and Computer Systems Against Exploitation”) and the signals intelligence mission (“Intercept and Exploit Foreign Signals”). Mark Young, then chief of legislative affairs, described the two missions as complementary. “Of course, lessons learned in protecting U.S. information systems feeds NSA’s ability to perform its SIGINT mission,” he told legislators, according to his speaker’s notes. “The cryptologic effort comes full circle as NSA uses its understanding of the vulnerabilities within foreign information systems to help secure classified national security and sensitive U.S. government information systems.” Mark D. Young, “National Security Agency / Central Security Service Overview Briefing,” 2006, classified SECRET//NOFORN//X1, on file with author.

  “Swallowing the sea”: Joel F. Brenner, “Information Oversight: Practical Lessons from Foreign Intelligence,” Heritage Lecture #851, delivered at the Heritage Foundation in Washington, D.C., September 30, 2004, on file with author.

  “Fetch It, Etch It and Retch It”: A longtime colleague, who worked with Cotter on the NSA’s senior technical review panel, credited him with that phrase. Bill Binney, interview with author, summer 2013. When asked about it, Cotter described the quotation as “a variation of many heard over the years.” Cotter to author, email, December 1, 2016. Cotter retired in 2009. For his official biography, see the National Aeronautics and Space Administration conference notes for “Security in the National Grid,” October 10, 2012, https://istcolloq.gsfc.nasa.gov/fall2012/speaker/cotter.html [inactive].

  “serialized reports”: A good explanation of this term: “Serialized intelligence reports are distinguished from both raw intelligence reports and special intelligence reports. Raw intelligence is immediately reported by the collector and serves as the basis for serialized reporting (daily, weekly, monthly, etc.) by subject or geographic location. Special intelligence reports are those reports—like National Intelligence Estimates or individual subject reports—that are produced on request or as needed. Both serialized and special reports are considered finished intelligence (and often referred to as FINTEL).” See Dana Priest and William M. Arkin, Top Secret America: The Rise of the New American Security State (New York: Little, Brown, 2011).

  “PRISM is one of”: Slide 41, “PRISM/US-984XN Overview.”

  the project’s deepest secret: As Rick put it, “The PRISM project is not protected under an ECI [for exceptionally compartmented information]. Project details are handled at the TS//SI//NF level. However, the sensitivity of the project details requires enhanced OPSEC in which only those with a need to know will have access to these details. The sensitive details are the identification of PRISM providers and details of our relationship with them through the FBI.” Speaker’s notes, slide 11, “PRISM/US-984XN Overview.”

  “The internet is on principle”: Snowden to author, May 31, 2013.

  mostly listened in on telephone calls: Sometimes, of course, the fictional NSA did other things like dispatching assassins to track down political enemies. See Tony Scott’s classic Enemy of the State (Touchstone Pictures, 1998). My friend Barry Eisler, a CIA officer turned thriller writer, takes some liberties along these lines in The God’s Eye View (Seattle: Thomas & Mercer, 2016). For the record, the NSA does not have death squads and does not control live video feeds from space.

  the project’s Skype interface: The “User’s Guide for Skype PRISM Collection,” dated August 2012, is on file with author. In 2014, Der Spiegel published the guide with light redactions at www.spiegel.de/media/media-35530.pdf [inactive].

  Analysts could ask for instant notifications: The presentation alluded to these as RTN, which stands for “real-time notification.” Slide 34, “PRISM/US-984XN Overview.”

  could monitor keystrokes: This was not a capability built into PRISM. The NSA accomplished this form of live surveillance by other methods, including exploitation of the Remote Desktop Service built into Microsoft Windows. Then deputy director Chris Inglis told me on June 14, 2013, that PRISM, by contrast, offered “replay” of conversations rather than live monitoring. “It’s a packetized world,” he said. “If you recorded the session you could play it back later and you could get it in a streamed way, but . . . you don’t have the opportunity to see this in real time.”

  a total of 8,233 articles: The statistics for the President’s Daily Brief come from the speaker’s notes for slide 18, “PRISM/US-984XN Overview.”

  “much of the world’s communications”: All direct quotations here are from the speaker’s notes for slide 4, “PRISM/US-984XN Overview.”

  overseen by Vice President Cheney: See Gellman, Angler, chapters 6, 11, and 12.

  cover name WHIPGENIE: According to the NSA’s internal classification guide for the warrantless surveillance, “Information that would provide an understanding of the partnership/location for the program is covered by the ECI WPG SSO compartment.” ECI means “exceptionally compartmented information,” the WPG trigraph is a short form of WHIPGENIE, and SSO stands for Special Source Operations, which refer in this context to “corporate partnerships” with large telephone and internet companies. “STELLARWIND Classification Guide (2-400),” January 21, 2009, on file with author. The New York Times posted this document, which it obtained under a sharing agreement with the Guardian, at http://n
yti.ms/2gqIfHt.

  “in briefings and declarations”: “STELLARWIND Classification Guide.”

  A rebellion in the Justice Department: Gellman, Angler, chapters 11 and 12.

  Protect America Act of 2007: Public Law 110-55, 121 Stat. 552, at http://legislink.org/us/pl-110-55.

  FISA Amendments Act of 2008: Formally it was the Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008, Public Law 110-261, at https://archive.is/4YMNx. See also www.law.cornell.edu/topn/fisa_amendments_act_of_2008.

  “The [United States] overwhelmed”: Speaker’s notes, slide 5, “PRISM/US-984XN Overview.”

  “PRISM access is 100% dependent”: Speaker’s notes, slide 10, “PRISM/US-984XN Overview.”

  “NSA can’t simply walk up”: Intelligence source, interview with author, summer 2013.

  Unified Targeting Tool: Slides 30 and 31, “PRISM/US-984XN Overview.”

  Bystanders filled its data repositories: I return to this later in the book. See Barton Gellman, Julie Tate, and Ashkan Soltani, “In NSA-Intercepted Data, Those Not Targeted Far Outnumber the Foreigners Who Are,” Washington Post, July 5, 2014, http://wapo.st/1Mvootx; and Barton Gellman, “How 160,000 Intercepted Communications Led to Our Latest NSA Story,” Washington Post, July 11, 2014, http://wapo.st/1Mq04zI.

  LOVEINT: Short for “love intelligence,” the term refers to rogue NSA employees who “channeled their agency’s enormous eavesdropping power to spy on love interests,” according to the news story that popularized it. “The practice isn’t frequent—one official estimated a handful of cases in the last decade—but it’s common enough to garner its own spycraft label: LOVEINT.” See Siobhan Gorman, “NSA Officers Spy on Love Interests,” Wall Street Journal, August 23, 2013, http://on.wsj.com/19NGBbE.