Edgar Timothy H. - Beyond Snowden: privacy, mass surveillance, and the struggle to reform the NSA

BEYOND SNOWDEN

Privacy, Mass Surveillance, and the Struggle to Reform the NSA

TIMOTHY H. EDGAR

BROOKINGS INSTITUTION PRESS

Washington, D.C.

Copyright 2017

THE BROOKINGS INSTITUTION

1775 Massachusetts Avenue, N.W., Washington, D.C. 20036

www.brookings.edu

All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means without permission in writing from the Brookings Institution Press.

The Brookings Institution is a private nonprofit organization devoted to research, education, and publication on important issues of domestic and foreign policy. Its principal purpose is to bring the highest quality independent research and analysis to bear on current and emerging policy problems. Interpretations or conclusions in Brookings publications should be understood to be solely those of the authors.

Library of Congress Cataloging-in-Publication data are available.

ISBN 978-0-8157-3063-7 (cloth : alk. paper)

ISBN 978-0-8157-3064-4 (ebook)

9 8 7 6 5 4 3 2 1

Typeset in Sabon and Trade Gothic

Composition by Elliott Beard

To Anna

who believes in impossible things

CONTENTS

INTRODUCTION: MAKING A DIFFERENCE

Around the time Edward Snowden began working for the Central Intelligence Agency in 2006, I decided to leave my position as a lawyer for the American Civil Liberties Union in the hope I could make a difference by going inside Americas growing surveillance state. Surprisingly, senior intelligence officials took a chance on hiring me in a unique new office safeguarding civil liberties and privacy. My job was to advise the director of national intelligence, who oversees the seventeen agencies of the U.S. intelligence community.

Before I joined the government, I had testified before Congress as an ACLU lawyer, arguing against expanded surveillance in the war on terror. Since information on national security surveillance was secret, my arguments were based on hypothetical scenarios about how intelligence agencies might use their new powers.legal authorities exceeded the most alarming visions I had conjured up in my years as a privacy and civil liberties activist. The government was collecting immense volumes of data both inside and outside the United States, including data pertaining to Americans, creating serious privacy risks.

For the next seven years, I worked with a growing team of internal privacy watchdogs inside the intelligence community. We reviewed the U.S. governments most secret surveillance programs. Our job was to ensure these programs had a firm basis in law and included safeguards to protect privacy and civil liberties. As surprised as I had been by the breadth of surveillance, I was just as surprised by how seriously everyone inside the government took the rules that governed it. We brought the legally questionable surveillance policies of the Bush administration under the supervision of Congress and the judiciary, and devised new oversight mechanisms to ensure compliance with the rules. Our efforts put the U.S. governments mass surveillance programs on a stronger legal basis, helping the intelligence community weather the storm when these programs became public in 2013.

While I am proud of the work I did to keep intelligence agencies in bounds, it is fair to say my success in protecting privacy as an insider was limited. In retrospect, my focus on ensuring that the intelligence agencies were true to the complex and sometimes arbitrary legal rules that govern surveillance caused me to miss the broader impact of the U.S. governments programs on the privacy of all the worlds data, and what this meant for the privacy of Americans. The rules that guided my work were designed to prevent spying on Americans. They were mostly written in the 1970s. They depended on geography and borders in a way that the internet and globalization had made largely obsolete. The digital data, communications, and personal lives of Americans now transcended national boundaries. Compounding the problem, the rules were based on analog technology. They made distinctions that no longer made much sense between types of data, offering inadequate protection in an age of digital surveillance. Inside the intelligence community, these problems were well understood, and many shared my concerns. Our efforts to start a meaningful public dialogue about privacy were largely frustrated by the decisions of top officials to keep modern programs of mass surveillance a secret.

In 2009 I was detailed to the White House national security staff to serve a stint as its first-ever director of privacy and civil liberties. Barack Obama had won election as president with a promise to review the surveillance programs initiated by President George W. Bush after the events of September 11, 2001. I had high hopes that Obamas fresh approach would force needed reforms that would protect privacy. But after Obama took office, he continued and even expanded mass surveillance programs. Despite my lofty White House perch, my broader hopes for reform proved elusive. Obamas top aides showed little interest in reforming mass surveillance until after I left, when Edward Snowden forced them to confront the issue.

In 2013 I left government to pursue research and teaching. As my work to provide privacy and civil liberties safeguards for mass surveillance programs had been highly classified, I expected I would never speak or write publicly about it. Instead, much to my surprise, I found myself thrust into a global conversation about privacy and mass surveillance. Only a few days after my formal resignation in June, the first stories based on secret documents leaked by Snowden appeared in the press. They described surveillance programs on which I had worked. That summer the Obama administration confirmed these programs and declassified details about the rules that governed them, including some of the safeguards I had helped devise.

The Snowden revelations concerned the operations of the largest of the secret three-letter intelligence agencies, the National Security Agency. The NSA collects signals intelligence, which means it scoops up the worlds communications, processes them into intelligible form, and turns them into intelligence reports. NSA operations are essential to national security and to international stability, but it is a challenge to reconcile them with the values of a free society. The Snowden revelations forced the NSA to take painful steps to open up. Before Snowden, basic information such as the number of targets affected by court-ordered surveillance was a closely guarded secret, obscuring important facts such as how much surveillance could be authorized by a single court order. Today the head of the intelligence community publishes an annual transparency report, revealing that one such order authorized surveillance of more than 100,000 foreign targets, and that data about Americans collected under that order were queried more than 30,000 times, among other details.

Without a basic level of transparency about mass surveillance programs, the NSAs operations lack democratic legitimacy. The most secret of the governments secret agencies will never be a model of transparency. Still, it has never been more transparent than it is today.

Thanks to Snowden, the government has also been forced to become more accountable for mass surveillance. Before Snowden, the NSA used a secret interpretation of the Patriot Act, the antiterrorism law passed in 2001, to amass a nationwide database of telephone records from American companies of calls to, from, and within the United States. In 2015 a federal appeals court declared this program of bulk collection unlawful.

More fundamentally, the Snowden revelations have enlarged the way the U.S. government thinks about privacy. Before Snowden, there was no written order, directive, or policy that gave any consideration to the privacy of foreign citizens who live outside the borders of the United States. When intelligence officials asked lawyers like me about privacy, it went without saying that we were talking about American citizens and residents. In 2014 President Obama signed a directive reforming signals intelligence collection, requiring that some privacy protections apply to the personal information that agencies collect about foreigners outside the United States. By 2015 all agencies had issued new procedures, or revised existing procedures, to fulfill this requirement. Today, for the first time in history, it is the policy of the United States that the privacy and civil liberties of everyone in the world must be taken into account when agencies collect signals intelligence.