Deep State

by Marc Ambinder

  To quickly acquire communications inside the United States, the NSA needed the cooperation of U.S. telecommunications companies. The Stored Communications Act of 1986 (SCA) would not allow the provision of historical data without an order or warrant. The Electronic Crimes and Privacy Act (ECPA) banned real-time monitoring without an order or warrant. Furthermore, because the types of communications that the NSA wanted were considered “consumer proprietary information,” telecoms couldn’t turn them over to a third party for profit, law enforcement, or at the government’s request. (This latter point was rejected by the NSA’s lawyers, who said that the FCC, which enforced it, misread the statute.) But the SCA had language that seemed pretty clear: “[A] provider of remote computing service or electronic communication service to the public shall not knowingly divulge a record or other information pertaining to a subscriber to or customer of such service . . . to any governmental entity.”39

  The rest of the act basically adds “without a warrant.” So assuming that citizens of the United States count as customers, telecom companies are forbidden from voluntarily turning over records to the federal government. But what counts as a “record”? Anything the telecom keeps in storage and anything involving the customer’s past communications. In other words: everything it knows.

  One of the OIA authorized by President Bush seemed to provide a blanket feel-free-to-ignore-the-Stored-Communications-Act-and-ECPA card to telecom companies. It was a certification signed by the attorney general attesting that the government would not criminally prosecute the telecoms for their cooperation.

  So what did the telecoms turn over to the NSA?∗ Millions of transaction records that included millions of instances of domestic telephones dialing other domestic telephones. Other companies sent over tranches of email messages. The volume itself is material; the NSA would ask for telephone logs from a certain time at a certain place (that is, a company, a neighborhood, a mosque), and telecoms would transmit those records upon request.

  By law, the NSA had no right to do anything with such data at that point other than try to deduce their significance without reading them. (Again, reading them would be both illegal and time-consuming.) The agency used several computer programs to scan the pen register logs (the lists of phone numbers that called other numbers) and the metadata associated with emails (for example, To; From; subject lines; IP addresses; lengths; frequencies; and so on). If a group of people associated with an entity (like an Islamic charity) had (or appeared to have) a connection with an entity connected to foreign terrorism, all three were subject to the interception protocols.

  To go back to the example that leads this chapter, the NSA would have used this data and correlated it with the bulk radio data they intercepted from Yemen to see which calls overlapped. Then they could (and would) task an analyst with an interception of the U.S. end of the call. Mike McConnell, a former director of the NSA and the second director of national intelligence during the Bush administration, would later describe to a group of intelligence industry professionals what happened next: “If the U.S. end of the call was Grandma, and they were talking about cakes, we would minimize it. If it was operationally significant, we would keep it. If that U.S. number were to call another U.S. number, we would have to get a FISA warrant.”40

  At no point, so far as we can tell, did the NSA ever perform link analysis on a data set without having a specific target in mind. They did not use the data sets to discover “both” ends of a communication. In all instances—and the NSA’s inspector general would certify this—the NSA had a specific thing, such as a person, a telephone number, or an address, and used the data provided by the telecoms to figure out whether the thing was significant enough to warrant actual interception. Maybe two flashing red lights were linked, or maybe several numbers were associated with one person, but without synthesizing the data it was hard to tell.

  We are fairly certain that Comey was refusing to sign the authorization for these activities. The Stored Communications Act and the Electronic Crimes and Privacy Act had exceptions, but Comey didn’t think they applied.

  Initially, the White House was ready to have the president’s counsel, Alberto Gonzales, sign his name to it. They tried to use Congress as a lever. In a hastily organized briefing, a member asked whether any ongoing operations would be jeopardized if the telecoms refused to hand over data without a warrant. A senior NSC official brought up a major counterterrorism investigation code-named CREVICE. The United States, British MI5, and German intelligence were working closely together on the case, which involved al-Qaeda-linked jihadists in Europe who were communicating with Americans. One was caught on a wire musing about blowing up an airplane.41 At least some of their communication was transiting through the United States. Without the program, the White House insisted, the ability to disrupt CREVICE would be significantly reduced. The FBI and the Justice Department representatives in the room who had been working CREVICE for months knew that wasn’t true. FISA warrants had already been issued and MI5 had its own technical surveillance operation under way. The bulk provision of data was just not that necessary anymore.

  The White House really wanted to advance a practical argument to Congress but declined to do so. They want to say that the lawyers who handled the program for the telecoms would have panicked if, after months of seeing the signature of the attorney general—the nation’s top law enforcement officer—they saw instead the scribble of the president’s in-house guy. They not only would have questioned any past cooperation with the NSA but also probably would significantly curtail their cooperation in the future. Practically, even though Comey had signed off, certifying that it was legal to intercept the U.S. side of an international communication connected with terrorism, the companies might balk at providing even this basic service.

  This was why the White House changed course after the now-famous hospital room confrontation whereby Gonzales tried to persuade an ailing Attorney General John Ashcroft to affix his signature. The White House had to; it simply could not send a document to the telecoms with anyone else’s signature. It took six months before the NSA was able to develop procedures that fit the interpretation of the metadata provisions promulgated by Jack Goldsmith and his successor, Daniel Levin.

  It’s worth noting that it was President Bush himself who actually stopped the program. Bush felt he had been misled by his cabinet about the degree of support for it. As time went on, the president became convinced that the program had to be brought in from the cold and written into law. His next attorney general, Gonzales, would agree.42 Bush wrote in his memoirs:

  I had to make a big decision, and fast. Some in the White House believed I should stand on my powers under Article II of the Constitution and suffer the walkout. . . . I was willing to defend the powers of the presidency under Article II. But not at any cost. I thought about the Saturday Night Massacre in October 1973, when President Richard Nixon’s firing of Watergate prosecutor Archibald Cox led his attorney general and deputy attorney general to resign. That was not a historical crisis I was eager to replicate.

  As Bart Gellman, Vice President Cheney’s best biographer, would later write, “The Bush-Cheney relationship never fully recovered from that day. Bush wrote, without naming Cheney, that he ‘made clear to my advisers that I never wanted to be blindsided like that again.’ March 11, 2004, was the day the president of the United States discovered that the vice president’s zeal could lead him off a cliff.”43

  Comey was not beloved at the White House. Dick Cheney in particular was not a fan of his from the start. Comey first met the vice president the same day he appointed Patrick Fitzgerald to investigate the Valerie Plame leak—an investigation that would culminate with the indictment of Cheney’s chief of staff for lying for the government. When Comey introduced himself that day, Cheney replied, without looking back, “Oh, I know you from television.” He wasn’t smiling.

  But Comey would come to the rescue of the White House later that year, helping dissuade
the New York Times from publishing details about the special program before the 2004 election. He did so by keeping his mouth shut. In October of that year, Condoleezza Rice, the national security adviser, invited Phil Taubman, the New York Times’s Washington bureau chief, and Jill Abramson, the Times’s executive editor, to a private meeting in her office.∗ Hayden and Comey attended. On Rice’s cue, Hayden gave the two editors a fairly comprehensive briefing on the program—virtually the same briefing Comey received when he was read in.

  At one point, Abramson asked if the program was on a solid legal foundation. Rice said that some lawyers, including Comey, she said, gesturing, had expressed concerns, but the program was on solid footing now. Is this true? Abramson asked Comey. Comey replied that it was. The Times editors did not pursue the matter. Hayden invited Taubman to Fort Meade at one point, brought him to a conference room, sat him down with two SIGINT analysts who were part of the program, and then left the room. The idea was to give Taubman a chance to question these analysts without the boss present. Hayden was very aware of the way that journalists thought—and knew that the gesture would gain him credibility with the Times. He was right.

  A year later, Comey was not happy that the New York Times had disclosed the TSP’s existence. He believed that the paper’s reporting had also compromised the NSA’s capacity to conduct legal surveillance. Still, Comey did not feel particularly aggrieved for those who set up the programs—the good ones and the bad ones. They created the mess by refusing to do it properly in the first place.

  But where did the leaks come from?

  Some former Bush administration officials blame Comey (though Hayden explicitly does not). At least one Justice Department official, Terrence Tamm, and Russell Tice, a former NSA analyst, have admitted to talking about the program to the New York Times. Neither has been prosecuted. (A senior Justice Department official said that Tamm was considered a legitimate whistleblower and that he planned to use then senator Barack Obama’s declaration that the program was unconstitutional in his defense.)

  According to a report provided by the White House to the Justice Department’s inspector general, the Bush administration believed that as of 2005, fewer than a dozen people outside the NSA were read in. This satisfied Addington’s desire for strict compartmentalization. But the White House was delusional. It has never been harder to keep secrets than now. For example, Chuck Robinson, chief of staff to Comey, was never counted as having been read in, but he had been by the FBI—by a security officer named Mike Fedonchick. A senior FBI agent later estimated that as many as six hundred from the agency were briefed on some part of the special programs.

  True, most field FBI agents didn’t have a full handle on every detail, but more than enough special agents were sufficiently knowledgeable to talk. And inside the FBI, everyone talks to each other, and everyone assumes that everyone else knows about big programs. The FBI was getting lots of leads from the NSA. People heard things. There was plenty of noise getting out of the compartment. The tighter the White House tried to grip the water, the more easily it spilled from its hand.

  The White House tried to use the Times’s partial disclosure to publicly advance a theory of presidential power. Practically, though, it was only a matter of time before the rest of the program’s details leaked out in one form or another. The NSA had legitimate worries. If more details about the program were known, the bad guys might learn about how difficult it was to rapidly acquire a target and how the agency had solved that problem. The NSA’s liaison relationships with other governments might also be jeopardized. If derivative information was ever disclosed in a court, many of those governments would probably alter the degree to which they cooperated with the United States. The intelligence community did not want the press to disclose the degree to which the NSA monitored and was able to intercept virtually all telephone and email traffic originating from Afghanistan and later from Pakistan and Iraq. This might also compromise the technological methods that the NSA legally used overseas.

  Finally, the holiest of holies: a large percentage—one former intelligence community lawyer put the figure at 90 percent—of international telephone and email traffic passed through a server or node associated with an American-owned telecommunications company. If terrorists had known this, they could have tried to use those rare networks that were entirely geographically constrained. But the bigger fear, which proved to be entirely valid, was that disclosure of this would lead companies and countries to demand that their communications pipes not pass through the United States. These entities were worried not about terrorism but about geopolitics: the NSA easily intercepting their diplomatic and industrial communications and the reaction of their citizenry to the fact.

  The scene at the hospital marked a turning point for the program but did so in a way that may well have hastened the day that Congress would officially deem it sound and legitimate. Immediately after he became attorney general in early 2005, Alberto Gonzales asked the new head of the OLC, Steve Bradbury, to reexamine whether there might be a different legal approach to the NSA activities authorized by the president that would put those activities on a stronger legal footing (even though all aspects of the program as then conducted had been approved in a comprehensive legal opinion issued by Jack Goldsmith and the OLC in May 2004). Starting in March 2005, Bradbury crafted a novel legal analysis that, if approved by the FISA court, would permit much of the NSA program to be based on the FISA statute. Bradbury presented his new approach to the White House in the late spring of 2005, and the White House approved without hesitation the Justice Department’s proposal to move forward with the concept, provided that the director of national intelligence and the NSA were confident that the new approach would not materially compromise the value and effectiveness of the program. The DNI and the NSA expressed support, and over the next several months, the OLC, working with the Office of Intelligence Policy and Review, developed a detailed analysis and proposal intended to be submitted to the FISA court in late 2005 or early 2006.

  The New York Times article in December 2005 sidetracked the legal effort that the OLC was pursuing under FISA. Bradbury and others in the DOJ spent much of their time and attention in 2006 explaining to the public (and in private to Congress) the legal basis for the NSA activities, which were now publicly acknowledged by the president following the Times article, as well as addressing other alleged activities and rumors swirling around those allegations. As a consequence of the catastrophic distraction, it wasn’t until January 2007 that Gonzales told Congress that the DOJ had succeeded in obtaining from the FISA court an order authorizing under a novel interpretation of FISA.

  Then, just as quickly, it went away. A FISA judge refused to sustain the same legal approval in its full scope. In late spring or early summer of 2007, this new legal hurdle in the application of FISA became a serious impediment to the continued effectiveness of the surveillance activities, and thus spurred Congress to enact substantial FISA reform legislation, which occurred first in the form of stopgap legislation in 2007 and in 2008 as a permanent and fundamental restructuring of FISA.

  This drove Mike McConnell, the DNI at the time, crazy. He told members of Congress that if he had been the director of the NSA on 9/11 he would have asked Congress to simply change the FISA law. He disagreed with Hayden that doing so would have made it easier for terrorists to communicate.

  Although President Bush could have ordered the program’s continuation under his signature alone, Congress would doubtless have responded in a way that might have precipitated a constitutional crisis. Bush was convinced by Bradbury, Gonzales, and Stephen Hadley, his national security adviser, that the best way to make sure the program lasted was to allow Congress to rewrite the FISA law. That the entire program was nonfunctional remained a secret until John Boehner, then the minority whip, told Fox News that “there’s been a ruling, over the last four or five months, that prohibits the ability of our intelligence services and our counterintelligence people from listen
ing in to two terrorists in other parts of the world where the communication could come through the United States.”44 Republicans had at the ready expansive legislation that Democrats wouldn’t accept—this the public knew. But no one outside government knew that the program had ended. Regardless of whether one views Congressman Boehner’s revelation as a kind of whistleblowing or a partisan leak, one year later Congress passed the FISA Amendment Acts.

  Hayden, now the director of the CIA, found himself delighted and felt vindicated. The FISA Amendments Act allowed the president to do more than ever before. Now anyone associated with terrorism could be subject to surveillance. For the most part, the only restriction placed on the NSA was that they could not surveil Americans overseas without an order. The telecoms had their official congressional writ of immunity. Bulk collection began to flow again, as did NSA access to real-time telecom data. The big difference? More people knew the secret.

  Presently, the executive branch is not (that we know of) hiding anything from Congress, the judiciary branch, or (more weirdly) itself. Everyone has been read in to the program. And Congress moved to align the law with the president’s exercise of executive power. The courts, by and large, have not objected. And most details about the current program remain classified.

  But the question remains: Does the NSA read my email? Based on what Hayden, Yoo, and others have said publicly, as well as confidential information provided to the authors and verified independently by officials read in to the programs:

  If you regularly call people in Afghanistan, Pakistan, or Yemen, your telephone records have probably passed through an NSA computer. Most likely, however, if you’ve been calling rug merchants or relatives, no one at the NSA knew your name. (A computer program sanitizes the actual identifying information.) Depending on the time, date, location, and contextual factors related to the call, a record may not have been created.