According to newly published documents, the National Security Agency has built a “Google-like” search interface for its vast database of metadata, and the agency shares it with dozens of other American intelligence agencies. The new documents are part of the Snowden leaks and were first published on Monday by The Intercept.
The new search tool, called ICREACH, is described in an internal NSA presentation as a “large scale expansion of communications metadata shared with [intelligence community] partners.” That same presentation shows that ICREACH has been operational since the pilot launched in May 2007. Not only is data being shared to more agencies, but there are more types of such data being shared—ICREACH searches over 850 billion records.
New data types being shared include IMEI numbers (a unique identifier on each mobile handset), IMSI (another unique identifier for SIM cards), GPS coordinates, e-mail address, and chat handles, among others. Previously, such metadata was only limited to date, time, duration, called number, and calling number.
One 2005 document describes the predecessor to ICREACH, known as CRISSCROSS, as having notable success in rendition, the controversial practice of secretly spiriting away terrorism suspects from capture point to prison.
“It is safe to say that it has been a contribution to virtually every successful rendition of suspects and often, the deciding factor,” the memo states. “Hence the benefit to the intelligence and law enforcement communities of any [signals intelligence]-augmented inputs could be considerable, as [signals intelligence] has the potential to access a broad range of targets.”
Executive Order 12333 strikes again
In a statement provided to Ars, Michael Halbig, an NSA spokesman, said that such data sharing is exactly what was recommended by the 9/11 and Weapons of Mass Destruction commissions.
“By allowing other IC organizations to query legally collected foreign-intelligence repositories of appropriately minimized data, analysts can develop vital intelligence leads without requiring access to raw intelligence collected by other IC agencies,” he wrote. “In the case of NSA, access to raw [signals intelligence] is strictly limited to those with the training and authority to handle it appropriately. The highest priority of the Intelligence Community is to work within the constraints of law to collect, analyze, and understand information related to potential threats to our national security."
Halbig noted that this practice of data sharing is governed by Executive Order 12333 (EO 12333), the 1981 document instituted by President Ronald Reagan as a way to strengthen the power of US intelligence agencies. Executive orders are rarely overturned unless subsequent presidents take action.
"The interesting thing is that [executive orders] do have a legal status that is all other things equal is equal to a statute, permitting and prohibiting certain sorts of things, but the consequences for violating them are unclear," Kenneth Mayer, a professor of political science at the University of Wisconsin, Madison, told Ars.
Recently, former State Department official John Tye told Ars he has serious reservations about EO 12333. Tye believes it provides the high potential for vast warrantless data collection that is dismissed as “incidental.”
“12333 is used to target foreigners abroad, and collection happens outside the US," Tye said. "My complaint is not that they’re using it to target Americans, my complaint is that the volume of incidental collection on US persons is unconstitutional.”
Ars has a forthcoming feature on the history and effects of EO 12333.
“It makes the abuses exponential”
Civil liberty experts tell Ars that this new revelation is particularly troubling. Fred Cate, a law professor at Indiana University, was troubled that EO 12333 is acting as the governing document here.
“12333 is a much broader authority,” he told Ars by e-mail. “Because it is supposed to be focused on non-US person communications, it is the subject of almost no meaningful oversight, but we are learning exactly how much US person data the NSA can collect under non-US person authorities. People familiar with the NSA and leakers in addition to Snowden have suggested that we have only seen the tip of the iceberg to date, and today’s revelation is a potent reminder of how right they appear to be."
“The nation would be far better served by the [intelligence community] being more forthcoming with the public, in general terms, about the scope of its activities, the evidence as to their success, and the oversight mechanisms in place, rather than to keep on the defense more than 14 months after the Snowden revelation began,” Cate said.
Other experts are worried because of the August 2013 revelation concerning the practice of “parallel construction” as used by the Drug Enforcement Administration (DEA) and perhaps other law enforcement agencies. The idea is that the origin of information obtained by the NSA and then handed off to the DEA and others is usually concealed from defense lawyers—and sometimes even prosecutors and judges. This essentially provides an end-run around the normal court procedures for a criminal defendant’s right to discovery.
"A big problem here is that the NSA is an agency that is authorized by Congress to engage in surveillance," said Brian Owsley, a law professor at Indiana Tech, and a former federal district court judge in Texas.
"One assumes that the gathering of that intelligence is legal and within constitutional limits, then such surveillance is presumably permissible. However, the problem is that even if the surveillance gathering is appropriate, sharing it with other governmental agencies is not. The DEA or the FBI should not be able to circumvent the Fourth Amendment by obtaining personal information about United States citizens or residents from the NSA. To allow otherwise would enable the DEA or FBI to spy on individuals that the Constitution would not allow."
Nadia Kayyali, an activist at the Electronic Frontier Foundation, agreed.
“The more that NSA data is getting filtered to domestic law enforcement, it makes the abuses exponential,” Kayyali said. “We know how important metadata is and we know how revealing it is. If this information is going to DEA and FBI, it means that NSA metadata is significantly affecting actions of domestic law enforcement.”