According to files that Edward Snowden provided to the Washington Post, NSA agents recorded and retained the private data of tens of thousands of American citizens—including emails and other online communications—even though they were not the target of any official investigation.
The Post reports that nine out of 10 account holders in a large cache of intercepted communications were not the actual target sought by the NSA, but were essentially bystanders caught in a massive net the agency had cast in an attempt to catch someone else. Many of these bystanders were Americans, and nearly half of the files contained names, email addresses, and other personal information. While many had been redacted (or “minimized”), almost 900 files contained full email addresses.
Many other files, described as useless by the analysts but nonetheless retained, have a startlingly intimate, even voyeuristic quality. They tell stories of love and heartbreak, illicit sexual liaisons, mental-health crises, political and religious conversions, financial anxieties and disappointed hopes. The daily lives of more than 10,000 account holders who were not targeted are catalogued and recorded nevertheless.
Legally, the NSA is only allowed to target non-U.S. citizens unless it obtains a warrant from a special surveillance court. Such a warrant must be based on a reasonable belief that the target possesses information about a foreign government or terrorist organization.
The government has previously admitted that American citizens can be (and are) caught in these nets, but the scale at which ordinary citizens were included was not known prior to this report.
The NSA also appears to hold onto this information even though it holds minimal strategic value and compromises the privacy of thousands of American citizens.
According to the Post story, participants in email or chat conversations are considered to be “foreign” if they use a language other than English or have an IP address that appears to come from outside of the U.S.
If a target entered an online chat room, the NSA collected the words and identities of every person who posted there, regardless of subject, as well as every person who simply “lurked,” reading passively what other people wrote.
“1 target, 38 others on there,” one analyst wrote. She collected data on them all.
In other cases, the NSA designated as its target the Internet protocol, or IP, address of a computer server used by hundreds of people.
The NSA treats all content intercepted incidentally from third parties as permissible to retain, store, search and distribute to its government customers. Raj De, the agency’s general counsel, has testified that the NSA does not generally attempt to remove irrelevant personal content, because it is difficult for one analyst to know what might become relevant to another.
The Snowden documents come from a cache of retained information gathered under the Foreign Intelligence Surveillance Act—despite the government’s statements that the NSA contractor had no access to FISA records.