NSA Data Fight Could Signal Privacy War

Richard Satran

Congress put a big scare last week into the agency that frightens privacy advocates and U.S. enemies throughout the world - and sent up a shot heard everywhere that an infowar is breaking out that could have a far-reaching impact on people's lives.

Angered by revelations of the National Security Administration's vast telephone and email tracking apparatus, Congress fell just short of winning a vote to de-fund the spying program. But technology experts say the global reaction to the NSA's widespread tracking of people in the United States and abroad is likely to be the first of many battles over privacy and oversight as the government uses more invasive technology and new data scandals come to light.

"Technology is changing the capability of government agencies dramatically, and the law is not keeping up," says privacy advocate and security technology expert Bruce Schneier. "Things are being done in our name, with our funding, that we have no idea about. Secret courts are making secret rulings about secret laws. That cannot be good."

While the proposal failed in Congress, the near shutdown of the broadest individual surveillance ever by a government succeeded in elevating the clandestine NSA surveillance to a national debate. While the debate heats up, privacy experts say there will be many more cases spurring controversy in the future as the extent of data tracking becomes known.

The NSA surveillance is just one of a growing number of programs in which government is pressing forward with new technology to compile immense amounts of new data on individuals. In two recent developments, the Internal Revenue Service has vastly expanded its data mining of private financial transactions for tax enforcement. And trade reports said the CIA is spending $600 million to ramp up its cloud data network to capture vastly more information, the use of which remains classified. The CIA's mission ends at U.S. borders, but the data it will begin to use knows no boundaries.

[Read: How IRS Data Tools Track Your Digital Footprints.]

The government began stepping up its surveillance of individuals here and abroad in the aftermath of the Sept. 11 attacks on New York and Washington, as the Patriot Act eliminated some legal barriers on monitoring people and groups. The government gained more access to private data under measures following the financial crisis of 2008, which expanded the reach of the IRS to gather virtually all credit card and electronic transactions. Initially used for tax purposes, that data may also used by other branches of law enforcement in many cases.

The NSA's widespread snooping on individuals, disclosed when private contractor Edward Snowden left the country with four laptops of data downloaded from the agency, has turned two of the staunchest supporters of a stronger intelligence capability into critics. The two top members of the 9/11 Commission, Chairman Thomas Kean, ex-New Jersey governor, and Vice Chairman Lee Hamilton, a former Indiana Congressman, this week made a joint statement calling for a national debate on the NSA surveillance.

"Authorized and monitored surveillance is necessary," they said, but "It is the sheer magnitude of the [NSA] program and the lack of debate that worry us."

The NSA leaks are the first confirmation that the government was using sophisticated methods to track individuals. But there have been many hints that it is more widespread than people knew. "You are a walking sensor," said the CIA's chief technology officer Ira "Gus" Hunt at a tech industry conference in New York earlier this year. "You are aware of the fact that somebody can know where you are at all times, because you carry a mobile device, even if that mobile device is turned off," he said. "You know this, I hope? Yes? Well, you should."

Considering the ubiquity of cell phones, it's a big footprint, Hunt said. But with geolocators often embedded in cars, cameras, iPads, laptops, measuring devices, home appliances, automated toll booths, cash registers and store scanners, the data collection is even broader. Satellite and land-based cameras expand that footprint even further.

In the past, the piles of data such tools collect would have had only fleeting significance to government, and would have been mainly used as a warning sign of illicit activity or threats or dismissed as mere "noise." The ability to collect and analyze the information by connecting the dots changes that equation, Hunt said. "We fundamentally try to collect everything and hang onto it forever," he said.

Such sentiments are not new, but the scope of such programs are. The ability to store and retrieve terabytes of data was not an issue when the legal justification for the government surveillance was established back in the telegraph era. Telegraphers used "pen registers" to log incoming and outgoing messages, and the Supreme Court has long held that communications records are open books for law enforcement.

And there is a obvious need for law enforcement to access data, as writer David Simon, who termed the NSA disclosures a "faux scandal," noted. "There has always been a stage before the wiretap, a preliminary process involving the capture, retention and analysis of raw data. It has been so for decades now in this country," he wrote in his personal blog.

But surveillance on a massive scale turns the use of an individual's "metadata" into "another thing entirely," says Harry Surden, a University of Colorado-Boulder Law School associate professor and a former computer programmer who has published research on the topic. The biggest fundamental change may be the hardest to notice: The linking of data networks that leap across multiple signal carriers in even a simple telephone call. Such metadata paints a picture even if the messages themselves are not read.

[Read: What Does the IRS Know About You?]

"That's what we are seeing now," Surden says. "The structures that kept data apart historically are breaking down in all kinds of dimensions. Government is using it more and more, and they will keep doing it because tech advances have made it more feasible and less expensive."

Privacy advocate and Silicon Valley entrepreneur Mark Weinstein says the high-tech industry ushered in the loss of privacy by compiling immense amounts of user data that "the government can just come in and grab." The Guardian newspaper journalist Glenn Greenwald, using information from Snowden, reported that the NSA got access to data through telecoms, Internet providers and social networks, all of which have publicly defended users' privacy rights but complied with government demands for cooperation.

"Democracy depends on privacy," Weinstein says. "We live in an imperfect world with ethnic cleansing and religious and political persecution. Democracy and privacy have protected us from unscrupulous government."

The Obama administration has argued persuasively that it needs enhanced technology to fight terrorism. But the work needs to be done in a transparent and open environment, Schneier says. Without oversight, the potential grows for overzealous officials to engage in the kind of moves seen in the IRS's profiling of Tea Party organizations and other political groups.

While the IRS used only basic spreadsheet screening of computer data in those cases, the agency has launched a huge rollout of new data-mining technology and used it in error-prone robo-audits that yielded mixed results. Still it is pressing forward with much more use of technology without publicly unveiling how it is used.

[Read: Taxing Days Ahead for Everyone in Wake of IRS Scandal.]

"Private industry would be envious if they knew what our models are," boasted Dean Silverman, the IRS's high-tech top gun at a trade gathering last year. But he gave no details.

"The real issue the NSA and other cases bring up is not really just loss of privacy. It is more about a government with an agency out of control," Schneier says. "We already give law enforcement the ability to invade in personal lives. Because it helps them solve crimes, it's a good thing. But that comes with a lot of legal procedure and process. When you do things without transparency and accountability, it's an abuse of power."

He says it's a mistake to give the government technology tools just because they are being used in private enterprise. Weinstein agrees that government should not follow the private sector down the "slippery slope" in privacy invasion. Schneier argues vehemently that government needs to follow a higher standard because of its pervasive role and power over people's lives.

"If Google makes a mistake, you get a wrong car ad for a new Ford flashed on your computer screen," Schneier says. "If government makes a mistake, you can get a drone dropped on your front lawn."