The Freedom Act, signed into law by the president on Tuesday, was heralded as the first major reform of US intelligence practices in decades. While supporters insisted it placed restrictions on the government’s ability to collect bulk metadata, it actually extends the surveillance powers of the National Security Agency which had already expired.
But even if the Freedom Act accomplished what its backers claimed, it still fell drastically short of limiting the agency’s domestic — and warrantless — Internet surveillance program, newly revealed by whistleblower Edward Snowden.
According to the documents, the Justice Department authored two memos in 2012 which secretly authorized the National Security Agency to begin digging through Internet cables. While the NSA has long had the ability to target specific emails of suspects, Obama expanded the Agency’s power, allowing it to search the web for any suspicious activity. Scanning for "cybersignatures," the NSA was looking for any signs of cyberattacks by foreign governments.
One problem here arises from the fact that determining the source of cyberattacks can be notoriously difficult. Shortly after the FBI penned blame for last year’s hacks into Sony Pictures on the North Korean government, a number of security experts immediately called the accusation into doubt.
"It’s clear to us, based on both forensic and other evidence we’ve collected, that unequivocally [North Korea is] not responsible for orchestrating or initiating the attack on Sony," said Sam Glines, the head of the cybersecurity company Norse, according to CNN.
The lesson: even if the US government was only interested in targeting foreign hackers, it would have no way of guaranteeing that such a policy was being upheld.
But while the NSA was supposed to provide evidence that any cyber activity it monitored was linked to a foreign government, officials soon found that restriction too limiting. According to internal memos, the NSA complained that the need for evidence left a "huge collection gap against cyberthreats to the nation."
Citing that undue burden, the Agency began pushing for permission to monitor international communications for any "malicious cyberactivity."
Another problem arises from the fact that monitoring hacker signatures automatically collects the user data of any system being breached by the cyberactivity. In order to monitor a hacker’s activity, the NSA has to copy information as it’s being stolen, meaning that even in the name of protection, the process still collects vast amounts of information on American citizens.
According to Jonathan Mayer, a cybersecurity scholar at Stanford Law School, the NSA is meant to focus on foreign threats, and its Internet surveillance program appears closer to domestic law enforcement.
"That’s a major policy decision about how to structure cybersecurity in the US and not a conversation that has been had in public," Mayer told Pro Publica.
But not to be outdone, domestic law enforcement has also taken advantage of warrantless Internet surveillance. One memo reads that the FBI negotiated to use the NSA’s Internet surveillance system in 2012, to monitor "chokepoints operated by US providers through which international communications enter and leave the United States."
Brian Hale, spokesman for the Office of the Director of national Intelligence, said "It should come as no surprise that the US government gathers intelligence on foreign powers that attempt to penetrate US networks and steal the private information of US citizens and companies," according to Propublica.
A former NSA contractor, Edward Snowden revealed the extent of the US government’s domestic spying apparatus in 2013. Currently living in exile in Russia, this latest batch of documents was provided to Propublica and the New York Times.
