I’ve been working through the NSA’s reports to the Intelligence Oversight Board. Given that we know so much about the phone and Internet dragnets, I have been particularly interested in how they got reported to the IOB.
By and large, though, they didn’t. Even though we know there were significant earlier violations (some of the phone dragnet violations appear in this timeline; there was an Internet violation under the first order and at least one more of unknown date), I believe neither gets any mention until the Q1 2009 report. These are on the government’s fiscal year calendar, which goes from October to September, so this report covers the last quarter of 2008. The Q1 2009 reports explains a few (though not the most serious) 2008-related phone dragnet problems and then reveals the discovery of the alert list, which technically happened in Q2 2009.
Now, it may be that the IOB received other notice of the earlier violations. Or it may be that the NSA still treated them under the “reported to the President” loophole created for Stellar Wind. (That loophole was still in the reports in 2013, so they could still be using it today!)
In any case, with the notice of the phone dragnet orders in Q1 2009, NSA also listed the Internet dragnet, but said it had nothing to report.
Before its discussion of the known systemic phone dragnet problems, the Q2 2009 report includes this violation which doesn’t appear in this form (it may well be described in different fashion) in the other phone dragnet discussions.
On 7 January 2009, while searching collection [redacted] NSA analysts found BR FISA data included in the query results. Of the [redacted] selectors used in queries, only [redacted] had been approved under the reasonable articulable suspicion (RAS) standard. Although the numbers were associated with a foreign target, the selectors had not been approved for call chaining in the BR FISA data. The analyst did not know that approval must be sought for BR FISA[redacted–note, not space] call chaining. No data was retained, and no reports were issued.
I find it interesting because that’s precisely where the problem with the phone dragnet stemmed from: BR FISA data had gotten thrown into the EO 12333 data without any technical controls or markings. Indeed, it’s possible this is how the phone dragnet problems were first discovered.
It then has a 3 paragraph description of the phone dragnet problems. Read more