Skating on Stilts

What the Prism Stories Tell Us About the Press

If you don't share my fascination with the journalistic ethics of the Snowden reporters, you can skip this long piece.  But both of the protagonists have now defended themselves, so I'm posting their messages, with commentary.  

I began the exchange when I questioned why Glenn Greenwald and the Guardian waited two weeks to release NSA's minimization procedures, which revealed extensive limitations on how NSA handles information about Americans. It seemed odd that Greenwald didn't tell us about those procedures in his original story about Prism, which after all quotes an intelligence community official who defends Prism by invoking the minimization procedures:

"The program is subject to oversight by the Foreign Intelligence Surveillance Court, the Executive Branch, and Congress. It involves extensive procedures, specifically approved by the court, to ensure that only non-US persons outside the US are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about US persons."

In Greenwald's first story, this passage just sits at the very end, like the warnings that follow an ad for Viagra.  There's no hint that Greenwald has copies of the minimization procedures and can confirm much of what the official says.

So why, I asked, did he wait two weeks before publishing the documents and providing much-needed context? To my mind, that was the act not of a journalist committed to informing his readers; it was more like the act of an advocate hoping to get a firestorm started before disclosing information that might give readers second thoughts.

Greenwald is nothing if not diligent in tracking his online reputation.  He tweeted a truculent defense a few hours after my post:

@stewartbaker The WashPost had the same docs, yet didn't publish it until we did. How do you explain that? Do they also hate America?

A fair question. The Post story was similar in many ways to the Guardian piece; it too included the "extensive procedures" quote, though a bit higher and with a smidgen of backhanded confirmation:

The Obama administration points to ongoing safeguards in the form of “extensive procedures, specifically approved by the court, to ensure that only non-U.S. persons outside the U.S. are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about U.S. persons.”

And it is true that the PRISM program is not a dragnet, exactly. From inside a company’s data stream the NSA is capable of pulling out anything it likes, but under current rules the agency does not try to collect it all.

But why did the Post stop with the vague reference to "current rules" when it could have confirmed the official's statement by releasing the minimization documents it already had? I still didn't have a better answer than the one I started with.  So I sent Bart Gellman an email asking for comment.  (He's asked me his share of tough questions over the years, so it seemed only fair.)

To his credit he gave me a thoughtful response, and I'm reprinting it full, with a bit of commentary. It begins with some reflexive High Journalism:

I can’t discuss when and from whom I obtained particular documents, other than what I have already reported. Your analysis relies pretty heavily on assumptions about the answers. Glenn Greenwald is right to say, on that basis, that your critique of the Guardian would apply to my coverage as well.

I have taken no position on whether the programs at issue are good or bad, properly tailored or overbroad. I am doing my best to unearth the facts that would enable such a debate. That is what journalism is supposed to do.

But he then gets down to talking about the minimization guidelines:

But Enough About You ...

More than two weeks ago, when the first Guardian/Greenwald leaks about NSA were appearing, I suggested that Americans would be a lot less exercised about the "collection first" approach to phone data if they understood how NSA's minimization procedures constrained the agency in dealing with US person data:

I would not be surprised to discover that minimization is the key to this peculiarly two-party, three-branch "scandal." That is, while the order calls for the collection of an enormous amount of data, much of it probably cannot actually be searched or used except under heavy restrictions. (If I'm right, the administration is likely to find itself forced quite quickly to start talking about minimization, perhaps in considerable detail.)

Today, more than two weeks after publishing a FISA court order calling for the collection of noncontent calling data for all US phone calls, the Guardian and Glenn Greenwald got around to proving me right. They finally published NSA's minimization procedures for handling records relating to US persons.

Assuming that the documents are genuine, they are broadly reassuring.  There are elaborate sections on making sure that attorney-client communications aren't retained, that inadvertent collections of Americans are destroyed as soon as possible, etc., etc.  I did an online debate with the ACLU just an hour or two after the guidelines were released, and even the ACLU rep had to grudgingly admit that there were a lot of appropriate restrictions in the document.  (He did complain that the agency allowed itself to retain certain encrypted communications, but this exception to the general rule applies only when the agency is trying to decrypt data reasonably believed to be related to foreign intelligence requirements.)

I said the documents were generally reassuring.  To be clear, they're generally reassuring about NSA's respect for the rights of Americans. They're not at all reassuring about the motivations of Glenn Greenwald or the Guardian.

Because it seems almost certain that Greenwald and the Guardian had the minimization guidelines two weeks ago, and that they could have released the guidelines at the same time they released the order that started this flap.  The original order, out of context, was disturbing.  

The minimization documents provide context and make the naked order less troubling. So why did the Greenwald/Guardian team withhold documents that would provide important context for two full weeks as the controversy built?

This makes no sense if you're practicing journalism.

But it makes all the sense in the world if you're practicing advocacy, trying to hurt the side you hate by feeding a misimpression until the misimpression is self-sustaining.  

It also makes sense if you're practicing Breitbart-style advocacy, in which your first story is carefully limited and material is held back in the hopes that you'll be able to do followup stories, disclosing a second or third round of data that contradicts your enemy's effort to explain away the first story.  (Indeed, rather unpersuasively, the Guardian tries to frame its release as a rebuttal to US statements.)

At this point, Greenwald and the Guardian are emerging as a story that's at least as interesting as NSA. If I'm right about their motives, Greenwald and the Guardian are treating NSA -- or the United States government -- as the enemy they hope to harm, and they've abandoned ordinary journalistic standards in an effort to do their adversary as much harm as possible.  (Indeed, looking back, it's pretty clear that the "PRISM" slides seemed scandalous largely because the original FISA court order predisposed us to read them too broadly.  And, of course, I can't help wondering what other documents Greenwald and the Guardian are suppressing to advance their preferred narrative.)

In short, Greenwald and the Guardian are engaged in something closer to a lobbying campaign than to  journalism. I suppose that's their prerogative, but it surely should affect how we read (and reread) their stories.  

To my mind, their stories are starting to tell me a lot less about NSA and a lot more about how to read even the most respectable of newspapers as the last pretense of objectivity leaks away.

Using Attribution to Deter Cyberespionage

Foreign Policy has published my article on how attribution can be used to deter foreign governments'cyberespionage.  Excerpts below:

The Obama-Xi summit in Sunnylands ended without any Chinese concessions on cyber-espionage. This came as no surprise; cyber spying has been an indispensable accelerant for China's military and economic rise. And though Beijing may someday agree that international law governs cyberspace, that won't help the victims of espionage, which is not regulated by international law. So if negotiation won't work, what will? Not a strategy that relies entirely on defense. That's like trying to end street crime by requiring pedestrians to wear body armor.

The good news is that there has been a revolution in our ability to identify cyberspies. It turns out that the same human flaws that make it nearly impossible to completely secure our networks are at work in our attackers too. And, in the end, those flaws will compromise the anonymity of cyberspies...

But attribution is only half the battle if we want to deter cyber-espionage. The other half is retribution. Once we identify the attackers, we need to persuade them to choose another line of work. If we're serious about stopping cyberespionage, there are plenty of tools at our disposal ...

The government already uses classified information to label terrorist supporters and drug kingpins as "specially designated nationals" and to impose sanctions on them -- seizing their bank accounts and assets, for example, and prohibiting U.S. citizens from doing business with them. The United States even has such programs for sanctioning Belarusian kleptocrats and conflict diamond purveyors. Maybe it makes sense for Washington to use sanctions to punish misdeeds in Belarus or West Africa, but shouldn't it first use these measures to punish people who are invading homes and offices in, you know, the United States?

It's unclear why the president hasn't done this already -- he's already got all the authority he needs to impose sanctions on cyber spies and their enablers. Under the International Emergency Economic Powers Act, the president could determine that cyber spying poses "an unusual and extraordinary threat" to the United States and declare it a "national emergency." He could then publish a list of hackers who would be subject to sanctions. In keeping with past practice, he could rely heavily on classified data to make the designations -- without disclosing any of it....

But punishing individual hackers is only part of the story. What if the United States applied all of these measures not just to the hackers themselves but to companies that benefit from the data they filch from U.S. networks? There's no difference in criminal responsibility between a thief and the customer he's stealing for. But there could be all the difference in the world between hackers who do their work from the safe environs of a protective government and the hackers' customers, who can't be truly successful in today's world if they aren't part of the global marketplace. And going global means exposing their companies, executives, and assets to the legal systems of the United States, Europe, and a host of other countries that are furious at the wholesale espionage aimed at their companies. If a few big companies in China find that having a cozy relationship with hackers means criminal prosecutions and asset seizures, they're a lot more likely to say "Thanks, but no thanks" to offers of stolen data.

Of course, to bring those cases, the government will have to have those companies dead to rights, and so far it doesn't. U.S. security researchers have done a great job of tracking the thieves back home. But they've had trouble identifying the companies who ultimately benefit from cyberspying.

That too is an attribution problem -- the next one we have to solve if we want to really discourage commercial cyber-espionage. It will be difficult, but no harder than the first attribution problem looked five years ago. Given the stakes, improving cyber-attribution should be at the top of U.S. intelligence priorities. And now that private researchers have demonstrated how much attribution can be accomplished without all the resources and authorities of the CIA and NSA, those agencies should be embarrassed by their poor record to date. And they may not have much time before someone -- Iran, North Korea, Hezbollah -- causes a power outage or other control system failure in the United States. If they can't tell the president who did that, the heads of those agencies will be looking for new jobs. As part of the attribution effort the United States needs for defense, it shouldn't be that hard to identify the customers who benefit from cyber-espionage....

In recent months, the Hill has been buzzing with new ideas for identifying and punishing cyberspies and the companies that benefit from them.

At a recent hearing before the Senate Judiciary Committee's Subcommittee on Crime and Terrorism, I testified about some of these ideas. Senators Sheldon Whitehouse (D-RI) and Lindsey Graham (R-SC) expressed particular interest in measures to impose sanctions on countries that support hackers as well as potential visa restrictions.

Another example is the Deter Cyber Theft Act (S. 884), which has been sponsored by a bipartisan group of senators, that includes Senators Carl Levin (D-MI), John McCain (R-AZ), Tom Coburn (R-OK), and Jay Rockefeller (D-WV). This bill would require intelligence agencies to annually report to Congress on countries and entities that engage in cyber-espionage as well as to identify intellectual property that has been stolen as a result of hacking. It further permits the president to prevent the importation into the United States of products that are linked to foreign cyber-espionage activities, such as articles that have been manufactured using stolen IP or that have been produced by companies that have benefited from it. In short, the bill would nudge the government towards broader attribution, greater naming and shaming, and some efforts to deny companies the fruits of using stolen information.

If these measures result in the punishment of Chinese companies, there is no doubt but that China will seek to reciprocate. But once again, asymmetry is likely to complicate their task. U.S. intelligence agencies do not steal commercial secrets for U.S. companies so it will be hard for China to mirror these measures without faking the evidence. In short, a focus on the beneficiaries of commercial espionage could cause real pain for cyber spies and their customers. 

 

 

 

Minimization and the "Collection First" Surveillance Model

The Director of National Intelligence issued a statement late last night about the NSA collection flap.  It's the smartest thing the government has released so far, and its justification for the program in question seems to confirm my speculation in Foreign Policy yesterday.

First, large-scale collections give the government a way to screen for patterns in communications that will bring to light terrorists who are unknown to the government. As the DNI puts it,  "The collection is broad in scope because more narrow collection would limit our ability to screen for and identify terrorism-related communications. Acquiring this information allows us to make connections related to terrorist activities over time."

Second, the government justifies collecting a reservoir of data because it is only allowed to consume the data a spoonful at a time. Here's the DNI:

• By order of the FISC, the Government is prohibited from indiscriminately sifting through the telephony metadata acquired under the program. All information that is acquired under this program is subject to strict, court-imposed restrictions on review and handling. The court only allows the data to be queried when there is a reasonable suspicion, based on specific facts, that the particular basis for the query is associated with a foreign terrorist organization. Only specially cleared counterterrorism personnel specifically trained in the Court-approved procedures may even access the records.
• All information that is acquired under this order is subject to strict restrictions on handling and is overseen by the Department of Justice and the FISA Court. Only a very small fraction of the records are ever reviewed because the vast majority of the data is not responsive to any terrorism-related query.

In short, there's less difference between this "collection first" program and the usual law enforcement data search than first meets the eye.  In the standard law enforcement search, the government establishes the relevance of its inquiry and is then allowed to collect the data.  In the new collection-first model, the government collects the data and then must establish the relevance of each inquiry before it's allowed to conduct a search.

If you trust the government to follow the rules, both models end up in much the same place.  I realize that some folks simply will not trust the government to follow those rules, but it's hard to imagine a system with more checks and restrictions and doublechecks than one that includes all three branches and both parties looking over NSA's shoulder. 

In theory, you could add the check of exposing the system to the light of day, but that means wrecking much of its intelligence value. Or you could simply prohibit the collection-first model (and lose the ability to spot terrorism patterns by matching disparate bits of data). I doubt that those "solutions" are worth the price.

 

 

 

The FISA Court Order Flap: Take a Deep Breath

There may be a lot less to the NSA “scandal” than meets the eye.  In an article for Foreign Policy, I explain why I am quite confident that the program underlying the FISA court order is lawful:

[T]his is not some warrantless or extra-statutory surveillance program.  The government had to persuade up to a dozen life-tenured members of the federal judiciary that the order is lawful. You may not like the legal interpretation that produced this order, but you can’t say it’s lawless.

 In fact, it’s a near certainty that the underlying program has been carefully examined by all three branches of government and by both parties.  As the Guardian story makes clear, Senator Ron Wyden has been agitating for years about what he called an interpretation of national security law that goes beyond anything the American people understood or would support.  He could easily have been talking about orders like this. So it’s  highly likely that the law behind this order was carefully vetted by both intelligence committees, Democrat-led in the Senate and Republican-led in the House. (Indeed, today the leaders of both committees gave interviews defending the order.) And in the executive branch, any legal interpretations adopted by the Bush administration would have been carefully scrubbed by President Obama’s Justice Department.

The two other questions about the program are why such a sweeping collection and how can something that broad be lawful.  Here's my guess about answers to the first question:

Imagine that the United States is intercepting al Qaeda communications in Yemen.  Its leader there calls his weapons expert and says, “Our agent in the U.S. needs technical assistance constructing a weapon for an imminent operation.  I’ve told him to use a throw-away cell phone to call you tomorrow at 11 a.m. on your throw-away phone.  When you answer, he’ll give you the number of a second phone. You will buy a phone in the bazaar, and call him back on the second number at 2 p.m.”

 Now, this is pretty good improvised tradecraft, and it would leave the government with no idea where or who the U.S.-based operative is or what phone numbers to monitor. It doesn’t have probable cause to investigate any particular American.  But it surely does have probable cause to investigate any American who makes a call to Yemen at 11 a.m., Sanaa time, hangs up after a few seconds, and then gets a call from a different Yemeni number three hours later. Finding that person, however, isn’t easy, because the government can only identify the suspect by his calling patterns, not by his name. 

 So how does the NSA go about finding the one person in the United States whose calling pattern matches the terrorists’ plan?  Well, it could ask every carrier to develop the capability to store all of their calls and to search them for patterns like this. But that would be very expensive, and its effectiveness is really only as good as the weakest, least cooperative carrier.  And even then it wouldn’t work without massive, real-time information sharing -- any reasonably intelligent U.S.-based terrorist would just buy his first throwaway phone from one carrier and his second phone from a different carrier.

 The only way to make the system work, and the only way to identify and monitor the one American who is plotting with al Qaeda’s operatives in Yemen, is to pool all the carriers’ data on U.S. calls to and from Yemen and to search it all together -- and for the costs to be borne by all of us, not by the carriers. 

 In short, the government has to do it.

And here's my guess about how to answer the second question:

The technique that squares that circle is minimization.  As long as the minimization rules require that all searches of the collected data must be justified by probable cause, Americans are protected from arbitrary searches.  In the standard law enforcement model that we’re all familiar with, , privacy is protected because the government doesn’t get access to the information until it presents evidence to the court sufficient to identify the suspects. In the alternative model,  the government gets possession of the data but but is prohibited by the court and the minimization rules from searching it until it has enough evidence to identify terror suspects based on their patterns of behavior. 

That’s a real difference. Plenty of people will say that they don’t trust the government with such a large amount of data, that there’s too much risk that it will break the rules, even reules enforced by a two-party, three-branch system of checks and balances. Even I, when I first read the order, had a moment of chagrin and disbelief at its sweep.  

But for those who don’t like the alternative model, the real question is “compared to what?”   Those who want to push the government back into the standard law enforcement approach will have to explain how it will allow us to catch terrorists who use half-way decent tradecraft -- or why sticking with the standard approach is  so fundamentally important that we should do so even if it means more acts of terror at home.