The Government Is 'Incidentally' Sucking Up Tens of Millions of Americans’ Communications a Year, and It’s a Privacy Nightmare

There’s currently a lot in the news about “incidental” surveillance of American citizens, and even more confusion on what “incidental” means. During a hearing earlier this week on Russian interference in the recent presidential election, several members of the House Intelligence Committee questioned FBI Director James Comey and NSA Director Admiral Mike Rogerson whether existing national security surveillance authorities adequately protect Americans.

Director Comey and Admiral Rogers may have sounded reassuring to Americans worried about basic privacy, but there is a lot of reason to worry. The government potentially collects tens of millions of communications of Americans, even in cases where it is supposedly targeting foreign persons. These incidental communications can be disseminated and used by government officials for a wide variety of purposes.

At the hearing this week, Director Comey and Admiral Rogers strongly defended Section 702 of FISA and other authorities, and they asserted that there were strong protections for Americans. But their responses only told half the story. Here are three key issues that were missing from the hearing and help explain how the NSA and FBI end up surveilling Americans.

1. The NSA often knows and intends to capture the communications of Americans when they are “targeting” individuals abroad.

“Incidental collection is when we are targeting a valid foreign target, for example, in the course of that targeting we either get a reference to a U.S. person or suddenly a U.S. person appears as part of the conversation. That’s what we call incidental collecting.”
– Admiral Rogers

“702 is about targeting non-U.S. persons overseas.”
– Director Comey

The term “incidental” as it is used in the surveillance context is misleading. The term suggests that the NSA accidentally or inadvertently collects the information of Americans. The opposite is often true.

For instance, under Section 702, the government often knows at the time of collection that it is likely to sweep up Americans’ communications, such as when it intercepts a phone call with one end in the United States. In fact, mapping the connection between foreign targets and individuals in the U.S. is a primary purpose of the program. Nevertheless, the government performs a legal sleight of hand, defending its warrantless Section 702 surveillance under the theory that Americans are not the “target” of the spying. Regardless of the government’s intent, the Constitution protects Americans from unreasonable searches and searches, raising concerns regarding its practices under Section 702.

2. The vast majority of Americans’ private information is not “masked.”

“In our reporting then we will mask the identity of the individual. We use a phrase like U.S. person one or U.S. person two.”
– Admiral Rogers

In response to questions about whether Americans’ information collected for national security purposes could be disseminated, Admiral Rogers emphasized that Americans’ information is generally “masked” in intelligence reports. Some might infer from this statement that it would be rare for federal agencies to have access to personal information of Americans that is collected, including names, phone numbers, or e-mail addresses. Not true.

Rogers’s statements did not reflect two additional key facts. One, the masking procedures he referenced apply primarily to intelligence reports that are created by analyzing the information collected — not to the raw data itself. Thus raw data that is disseminated may still contain the personal details of Americans, including potentially the information of political officials. Two, agencies outside the NSA routinely access raw data collected for intelligence purposes. For example, in the case of Section 702, the FBI routinely searches through raw data using terms associated with Americans, even when investigating ordinary crimes with no connection to foreign intelligence. Also new NSA procedures allow over 15 other federal agencies to apply for access to data collected under Executive Oder 12333, which has been used by the NSA to collect information about millions of individuals with no court oversight.

3. Americans information is not automatically purged if it is “incidentally” collected.

“In some case, we will just purge the collect, make no reporting on it, not retain the data. It’s incidental collection, it has no intelligence value and it wasn’t the purpose of what we were doing.”
– Admiral Rogers

Some might assume that the government automatically purges Americans’ information, if those individuals were not the “target” of the surveillance. However, information about Americans is not automatically purged when it is collected. The sheer number of communications collected by the NSA makes reviewing them in real-time impossible. Thus many communications remain in the government’s databases for five years by default. During this time period, it can be used for purposes that are unrelated to national security or the purpose for which it was collected.

The timing of the current debate is critical. At the end of the year, Congress must vote on whether to extend Section 702, a surveillance authority reportedly used to collect hundreds of millions of communications per year, over half of which may contain information regarding a US resident. Regardless of whether the allegations of improper surveillance of the Trump transition team prove to be true, members of Congress should be concerned about surveillance abuse and take steps to reform our surveillance laws accordingly.