Deep State

by Marc Ambinder

  Quite often, as with the case of Mohamed Osman Mohamud, a Somali arrested in Portland, Oregon, the U.S. attorney and the intelligence community decided to obscure, not reveal, evidence they’d gathered about his alleged ties to al-Shabbab (a Somalia-based adjunct of al-Qaeda), because to do so might compromise the method that was used to identify him in the first place. It should be assumed in this case that other alleged terrorists who know Mohamud would change their communication methods if they knew that the NSA had been able to intercept their end of the conversation in Somalia.56 Officially, the FBI told reporters that Mohamud was not being directed by a foreign terrorist organization. That was a partial truth—he had not been ordered to perform this specific task. But the FBI was first alerted to him based on information derived from an NSA operation in Somalia.57 Mohamud’s status from person of interest to suspect changed when he allegedly raped an Oregon State University student. Still, the Bureau has concluded that the circles between domestic and international terrorism don’t overlap as much as it seemed they did after 9/11.

  A healthy 333 defendants arrested by the FBI have pleaded guilty. And though the FBI arrested more than 150 of them in sting investigations—the type where one might accuse the Bureau of pushing people over the edge—at least 243 were arrested based on dealings with FBI informants, according to a Mother Jones analysis of data collected through the middle of 2008.58 Many of the cases closed by the FBI seem quite small. How many actual threats has the FBI prevented? How many people would not have resorted to violence had the FBI not bothered them? Does the FBI, in aggressively using informants and sting operations, create a climate that allows a disaffected but otherwise harmless person to want to act on his impulses?

  ∗Narus, a company now owned by Boeing, sold AT&T several of its STA-6400 Semantic Traffic Analyzers, which AT&T used to detect worms and infections in data streams but which could also be used to search through the content of e-mail for keywords.

  ∗In 2010, an NSA manager, Thomas Drake, would be indicted for allegedly improperly storing classified information about the two systems and then giving information to a Baltimore Sun reporter. Drake has since become an active public critic of government secrecy and the NSA. Drake was never actually convicted of leaking.

  ∗The formal unclassified name for the presidential order as disclosed by the Justice Department in 2005.

  ∗In 2007, Yoo was asked by PBS whether the government could do “blanket surveillance” under FISA. Here is how he responded: “No. This is a good example of where existing laws were not up to the job, because under existing laws like FISA, you have to have the name of somebody, have to already suspect that someone’s a terrorist before you can get a warrant. You have to have a name to put in the warrant to tap their phone calls, and so it doesn’t allow you as a government to use judgment based on probability to say, ‘Well, 1 percent probability of the calls from or maybe 50 percent of the calls are coming out of this one city in Afghanistan, and there’s a high probability that some of those calls are terrorist communications. But we don’t know the names of the people making those calls.’ You want to get at those phone calls, those emails, but under FISA you can’t do that.”

  ∗The Senate Select Committee on Intelligence’s report concluded that “we have seen no evidence that Congress intended the AUMF [Authorization for Use of Military Force] to authorize a widespread effort to collect the content of Americans’ phone and e-mail communications,” implying that the NSA had done just that.

  ∗Abramson would not comment on the meeting.

  ∗The snipers who terrorized Virginia, D.C., and Maryland had their license plates run quite often during their spree, which allowed prosecutors to prove that their car had been close to the scene of several of their crimes.

  †Until 2011, the FBI could not run names through investigative databases without creating paperwork to do so during an assessment phase; the classified guidelines change this requirement.

  ∗Early on, the FBI and U.S. attorneys were loath to use any of the NSA-derived information because they didn’t know where it came from, and the secrecy associated with the program raised suspicions about the legality of the interception. This problem grew acute when an informal system emerged for segregating the regularly acquired NSA FISA data (which under the Patriot Act should have easily gone to the FBI) from data acquired through the PSP. There was contamination-enough, in the minds of some Justice Department officials, to not use the data at all. From the NSA’s perspective, the contamination was the inevitable consequence of the technical challenges associated with the program, and the idea wasn’t to prosecute terrorists, but rather to prevent terrorist acts.

  Notes

  1. Kurt Eichenwald, 500 Days: Secrets and Lies in the Terror Wars (New York: Touchstone, 2012), 98.

  2. Ibid, 96.

  3. National Security Agency, “American Cryptography during the Cold War 1945–1989,” declassified February 13, 2006.

  4. Matthew M. Aid, The Secret Sentry: The Untold History of the National Security Agency (New York: Bloomsbury, 2009), 196.

  5. Interview with former senior intelligence official.

  6. James Bamford, Body of Secrets: Anatomy of the Ultra-Secret National Security Agency (New York: Doubleday, 2001), 458.

  7. Michael V. Hayden, USAF, Director, National Security Agency, Address to Kennedy Political Union of American University, 17 February 2000, http://www.fas.org/irp/news/2000/02/dir021700.htm.

  8. CryptoKids: America’s Future Codemakers & Codebreakers, National Security Agency, http://www.nsa.gov/kids/home.shtml.

  9. Interview with a former senior official in the Justice Department, June 2011.

  10. Correspondence with General Michael Hayden.

  11. Interview with a government official who works on the program.

  12. Ellen Nakashima, “A Surveillance Story,” Washington Post, November 7, 2007; Barton Gellman, Dafna Linzer, and Carol D. Leonnig, “Surveillance Net Yields Few Suspects,” Washington Post, February 5, 2006.

  13. United States Signals Intelligence Directive 18; Executive Order 12333.

  14. Dahlia Lithwick, “Secrets and Lies,” Slate, August 29, 2002, http://www.slate.com/id/2070287/; United States Foreign Intelligence Surveillance Court, Memorandum Opinion, May 17, 2002, http://www.washingtonpost.com/wp-srv/onpolitics/transcripts/fisa_opinion.pdf

  15. A good description of the nexus of law enforcement cooperation with the telecom companies can be found in Susan Landau, Surveillance or Security (Cambridge: MIT Press, 2010), 80–95.

  16. A good guess at how the NSA does this part of the mission can be found in IXmpas: Intereactively Mapping NSA Surveillance Points in the Internet “Cloud,” http://ixmaps.ca/documents/interactively_mapping_paper.pdf.

  17. Barton Gellman, Angler: The Cheney Vice Presidency (New York: Penguin Press, 2008), pp. 144–145.

  18. Unclassified Report on the President’s Surveillance Program, Office of the Inspectors General of the Department of Defense, Department of Justice, Central Intelligence Agency, National Security Agency, Office of the Director of National Intelligence, 19–20, http://www.fas.org/irp/eprint/psp.pdf.

  19. 50 USC Chapter 36—Foreign Intelligence Surveillance, Sec.1803(c)

  20. Requirements for the TRAILBLAZER and THINTHREAD Systems, Deputy Inspector General for Intelligence, 28, 107, http://www.fas.org/irp/agency/dod/ig-thinthread.pdf.

  21. Siobahn Gorman, “NSA Killed System That Sifted Phone Data Legally,” Baltimore Sun, May 18, 2006.

  22. USC Title 50, Chapter 36, Subchapter I, § 1802. Electronic Surveillance Authorization without Court Order; Certification by Attorney General; Reports to Congressional Committees; Transmittal under Seal; Duties and Compensation of Communication Common Carrier; Applications; Jurisdiction of Court, http://www.law.cornell.edu/uscode/html/uscode50/usc_sec_50_00001802----000-.html#a_1_A.

  23. Ibid.

  24. “Spying on the Home Front,” Frontline, May 15, 2007, http://www.pbs.org/wgbh/pages/frontl
ine/homefront/interviews/yoo.html.

  25. Interview with a former senior intelligence official, August 9, 2011.

  26. James Bamford, The Shadow Factory (New York: Anchor Books), 117–118.

  27. Interview with a former senior intelligence official, August 9, 2011.

  28. Michael Isikoff, “The Fed Who Blew the Whistle,” Newsweek, December 12, 2008.

  29. TeleGeography, Global Internet Map 2011, http://www.telegeography.com/telecom-resources/map-gallery/global-internet-map-2011/; interview with Alan Mauldin, August 8, 2011.

  30. James Bamford, The Shadow Factory, 208–211.

  31. Ibid.

  32. Interview with a consultant for the National Security Agency.

  33. Rus Shuler, How Does the Internet Work, 2002, http://www.theshulers.com/whitepapers/internet_whitepaper/index.html

  34. Interview with Matthew Aid, September 2010.

  35. Aid, The Secret Sentry, 287.

  36. Ibid.

  37. Tash Hepting, Gregory Hicks, Carolyn Jewel, and Erik Knutzen, on Behalf of Themselves and All Others Similarly Situated, v. AT&T Corp., et al., Exhibits A–K, Q–T, and V–Y to Declaration of J. Scott Marcus in Support of Plaintiffs’ Motion for Preliminary Injunction, June 8, 2006, https://www.eff.org/sites/default/files/filenode/att/marcusa-k.pdf.

  38. Unclassified Report on the President’s Surveillance Program, Office of the Inspectors General of the Department of Defense, Department of Justice, Central Intelligence Agency, National Security Agency, Office of the Director of National Intelligence, 22, http://www.fas.org/irp/eprint/psp.pdf.

  39. USC Title 18, Part I, Chapter 121, § 2702. Voluntary Disclosure of Customer Communications or Records, http://www.law.cornell.edu/uscode/18/usc_sec_18_00002702----000-.html.

  40. An account confirmed by two who were present.

  41. Thomas Hennessey and Claire Thomas, Spooks: The Unofficial History of MI5 (Stroud, UK: Amberley, 2011), 233.

  42. Interviews with several Bush Justice Department officials and one White House colleague of Gonzales who spoke with the president after the Comey incident.

  43. Barton Gellman, “In New Memoir, Dick Cheney Tries to Rewrite History,” Time, August 29, 2011, http://swampland.time.com/2011/08/29/in-new-memoir-dick-cheney-tries-to-rewrite-history/#ixzz1WfMmWiow.

  44. Television: “Cavuto,” Fox Business, July 7, 2007.

  45. Marc Ambinder, “Pentagon Wants to Secure Dot-Com Domains of Contractors,” The Atlantic, August 13, 2010, http://www.theatlantic.com/politics/archive/2010/08/pentagon-wants-to-secure-dot-com-domains-of-contractors/61456/.

  46. Congressional Record, August 3, 2007 (Senate), S10866, https://www.fas.org/irp/congress/2007_cr/s080307.html; Public Law 110–55, August 5, 2007, Protect America Act of 2007; Hugh D’Andrade, New NSA Whistleblowers Say NSA Spied on US Service Members and Aid Workers, Electronic Frontier Foundation, October 10, 2008, https://www.eff.org/deeplinks/2008/10/new-nsa-whistleblowers.

  47. James Risen and Eric Lichtblau, “E-Mail Surveillance Renews Concerns in Congress,” New York Times, June 17, 2009, A1, http://www.nytimes.com/2009/06/17/us/17nsa.html?_r=2&hp=&pagewanted=all; Interview with current National Security Agency official.

  48. Tim Weiner, Enemies: A History of the FBI (New York: Random House, 2012), 420–422; interviews with current and former FBI officials.

  49. Interview with a current National Security Agency official.

  50. E-mail from Vannee M. Vines, NSA spokesperson, October 15, 2012.

  51. Much of the information about the types of data associated with the database names comes from LinkedIn and by cross-referencing the résumés of analysts, the job functions they had, and the database they say they used at the time. The names of the databases are not classified.

  52. David Kaplan, “Nuclear Monitoring of Muslims Done without Search Warrants,” U.S. News & World Report, December 22, 2005, http://www.usnews.com/usnews/news/articles/nest/051222nest.htm.

  53. A Review of the Federal Bureau of Investigation’s Use of Exigent Letters and Other Informal Requests for Telephone Records, Oversight and Review Division Office of the Inspector General, January 2010, 63; interview with a current Federal Bureau of Investigation official.

  54. Federal Bureau of Investigation, Domestic Investigations and Operations Guide, December 16, 2008, 56

  55. Federal Bureau of Investigation, Domestic Investigations and Operations Guide, December 16, 2008, 74.

  56. Tim Fought and Nedra Pickler, “Mohamed Osman Mohamud Arrested in Portland Car Bomb Plot,” Huffington Post, November 27, 2010, http://www.huffingtonpost.com/2010/11/27/mohamed-osman-mohamud-portland-car-bomb_n_788695.html.

  57. Interview with a senior U.S. counterterrorism official in Washington, D.C.

  58. Dave Gilson et al., “Terror Trials by the Numbers,” Mother Jones, September/October 2011, 36–37.

  CHAPTER 18

  Olympic Games

  In June 2012, the New York Times published an article by journalist David Sanger unequivocally stating that the National Security Agency, with Israeli assistance, created Stuxnet, the Internet virus that disrupted operation of nuclear centrifuges in Iran. The article’s sourcing was an all but official confirmation that the United States had preemptively attacked critical Iranian infrastructure with a sophisticated cyber weapon. The article came in advance of a book by Sanger that contained a granular, step-by-step account of how the United States and Israel pulled the operation off. Sanger even had the program’s unclassified nickname: OLYMPIC GAMES.

  Congressional response to the story was swift and angry. Members of Congress accused the Obama administration of leaking the story and promised investigative hearings and new legislation. Dianne Feinstein, senator from California, compared the cyber attack to the German invasion of Austria in 1938.1 John Kerry, senator from Massachusetts, called it “amazing” that journalists like Sanger “get a lot of people talking about things they shouldn’t be talking about.” He specifically objected to the level of detail that Sanger published—too much “nitty-gritty,” he said.2 Interestingly, the intensity of congressional outrage served as further confirmation of Sanger’s account.

  Regardless, because of the credibility of the New York Times, the Stuxnet story was assumed to be true anyway. Iran certainly wouldn’t need better confirmation; nor would China or Russia, both of whom are aggressively testing America’s cyber defenses on a daily basis. Ironically, most of Sanger’s disclosures were already public knowledge. When Stuxnet moved from the Iranian uranium refinement network and onto the Internet, experts quickly determined its purpose and noted that its complexity suggested authorship by a nation-state. A very detailed account of precisely how the program worked had been published in Vanity Fair more than a year earlier.3 Internet security firms Symantec and Kaspersky Lab reverse-engineered the virus and figured out how it worked; that there were two variants; that it targeted SCADA systems built by the German company Siemens (which supplied the software for the Iranian nuclear program); that it exploited a vulnerability in Microsoft Windows 7; and that it was introduced to Iran’s system by way of a thumb drive. Wired later published the entire code with annotations.4

  The Sanger story declared that the United States and Israel developed the code. Well, yes. Given that it was designed to disrupt Iranian centrifuges, and only Iranian centrifuges, who else would Iran think was behind it—Bangladesh? In short, the secrets disclosed by the New York Times were secrets in name only. The “nitty-gritty” that so concerned Senator Kerry was not in fact a consequence of Sanger’s story. When is a secret not really a secret? Is it when everyone assumes something to be true, and that assumption is already priced in to the way states conduct their affairs? What is the value of authoritative confirmation when all it does is tell us that what we think we know is indeed what we know?

  A U.S. official who was read in to OLYMPIC GAMES told us that only about thirty people had access to all of the program’s compartments. Of the thirty, few would have had any reason whatsoever t
o brag to Sanger—that few, however, had motive and opportunity.

  Confirming that the United States helped create the Stuxnet virus had several downstream effects on policy that are hard to extricate from politics. In an election year, President Barack Obama had a reason to show that his Iran policy had teeth. In building the argument for a “muscular” Obama policy, an overzealous senior American official might have let it slip that President George W. Bush authorized the initial creation of the program and that President Obama ordered its expansion in spite of the dangers associated with discovery by Iran. Sanger, who specializes in counterproliferation, has enough sources to go from there. It’s also possible that the official was acting in accordance with the president’s objectives. A legitimate argument can be made that it’s important for the world to know about America’s incredible cyber warfare capability. From that standpoint, there might be policy justification for relaxing internal executive checks on the release of classified information.

  But there are risks to this strategy. Privately, U.S. officials insist that for years now, China has aggressively probed U.S. cyber infrastructure for weaknesses and exploited those “holes in the fence.” Most of China’s penetrations have been passive—whatever bots the Chinese have planted inside American computer networks seem to be just sitting there, collecting data (maybe) or waiting for some signal to do whatever they are supposed to do. At this stage, it seems China is gathering intelligence. Alternately, perhaps the software is waiting for a signal—it’s conceivable that a major cyber attack is part of China’s contingency plans in the event of a war with the United States. Such are the scenarios that U.S. war planners must now game, just as they planned for nuclear exchanges with the Soviet Union.

  Both China and Russia have gone on the record saying that they would view an operation like OLYMPIC GAMES—a military-led cyber attack against another country—as an aggressive act. (The NSA is a defense intelligence agency; the CIA, which is a civilian agency, almost certainly played a role in introducing the weapon into the Iranian centrifuge processing system.)