Safe and Free: comparing national legislation on electronic surveillance

A project called Safe and Free by the University of Texas now provides an overview of the legal framework for electronic surveillance by intelligence and law enforcement agencies in 12 democratic countries.

Here, I will introduce the project and discuss some general trends, as well as the different forms of prior approval of electronic surveillance operations.

Since the start of the Snowden revelations in June 2013, electronic surveillance has become a highly disputed topic. The controversy does not just concern the activities of the American signals intelligence agency NSA, but is also raised in European countries like Germany, The Netherlands and Denmark.

As the regulation of electronic surveillance is highly specialised, it's often difficult to judge whether certain measures are appropriate and effective. One way to improve them is by looking at solutions in other countries, preferably those with a similar rule-of-law tradition. This comparison is now provided by the Safe and Free project of the Strauss Center on International Security and Law at the University of Texas at Austin.


The project explores the variety of ways in which democratic states try to align surveillance for national security purposes with their values and laws. Safe and Free is an initiative of Adam Klein, director of the Strauss Center and former chairman of the Privacy and Civil Liberties Oversight Board (PCLOB), which oversees the civil liberty implications of US intelligence and counter-terrorism activities.

For Safe and Free a wide variety of surveillance experts, like think-tank members, academics, former government officials and journalists were asked to describe the legal framework for electronic surveillance in their country. This resulted in papers about the situation in Australia, Canada, France, Germany, The Netherlands, Poland, Romania, Sweden, the United Kingdom, and the United States.

Papers about Japan and South-Korea can be expected some time in the future. I had the honor of writing the paper about The Netherlands, describing the development of the legal framework for government interception from the 1960s until the current law from 2018 (which, quite unique, was subject to an advisory referendum).

Map showing the countries covered by the Safe and Free project
Click the map for a clickable map!

Reading all the papers shows how different national laws and regulations are, despite the fact that in practice, the technical methods are largely the same. All over the world, the telecommunications infrastructure for telephone and internet communications is very similar, as are the methods for interception. Hacking operations may require more creativity but have many tools and techniques in common as well.

Because states have different legal systems, institutional traditions and political constellations, the regulation of electronic surveillance methods differs from country to country. Nonetheless, some basic trends can be distinguished. An important one is the distinction between foreign and domestic, which affects many aspects.

First, most countries have separate agencies for foreign intelligence and domestic security, with signals intelligence traditionally being conducted by the military and domestic wiretapping sometimes by a national or federal police service.

In The Netherlands the civilian AIVD and the military MIVD both combine a foreign and a domestic mission, separated by their goals, instead of collection methods. Dedicated signals intelligence agencies are typical for the Five Eyes countries (the US, the UK, Canada, Australia and New Zealand), but Sweden has one as well, the FRA.


Usually, the domestic security agencies are governed by rather strict laws to safeguard the rights of their national citizens, while for foreign intelligence agencies we see more lax or even no regulations as monitoring foreign targets is considered "fair game".

Edward Snowden, however, considered this distinction very unfair and demanded equal protection for everyone. In some countries his view was picked up by the press, civil rights organizations and public opinion and eventually led to legal changes.

In the United States, presidents Obama and Biden implemented a range of constraints on the NSA's signals intelligence collection abroad, while in Germany the constitutional court ruled that fundamental rights restrict the BND's intelligence collection outside the country as much as they do inside German borders. In The Netherlands and Romania the law does not distinguish between foreign and domestic operations.

The building of the European Court of Human Rights (ECHR) in Strasbourg, France
(photo: CherryX/Wikimedia Commons)

Head of Danish military intelligence arrested but independent inquiry finds no wrongdoing

(Updated: November 13, 2023)

Unprecedented developments in Denmark: a former defense minister as well as the head of the military intelligence service FE have been charged for disclosing highly classified information, for which the latter has even been imprisoned.

Here I will provide more details about the arrest of FE head Lars Findsen and the charges against defense minister Claus Hjort Frederiksen, followed by a summary of how the crisis has developed, the recent conclusions of an independent investigation and finally the similarities to the Snowden case.

FE head Lars Findsen (left) and former defense minister Claus Hjort Frederiksen
(photos: Liselotte Sabroe/EPA-EFE & Johannes Jansson/Norden)

FE head Lars Findsen arrested and imprisoned

On January 10, the Danish broadcaster DR reported that Lars Findsen had been arrested on Copenhagen Airport on December 8, 2021, after he had been under surveillance by the Danish police intelligence service (Politiets EfterretningsTjeneste or PET).

It's a wry turn of fate as Findsen himself had been the head of the PET from 2002 to 2007. Since 2015 he led the Danish military intelligence service (Forsvarets Efterretningstjeneste or FE), before he was suspended in August 2020.

Update:
On April 4, 2022, DR reported that the PET had apparently bugged Findsen's house in order to find out whether he revealed classified information to family members, which is a very intrusive method that is only used in the most serious cases.

According to DR, the PET set up a special investigation after on September 30, 2020 the Danish newspaper Berlingske published a long piece with unprecedented details about the cooperation between the FE and the NSA. The investigation intensified when in May 2021 news media from several European countries provided additional details based upon nine sources with access to classified information (see below).

On the same day as Lars Findsen, the PET arrested three other current and former employees of the FE and the PET. Just like Findsen, they are accused of the unauthorized disclosure of highly classified information in violation of section 109(1) of the Danish criminal code, which is punishable with up to 12 years in prison.

This came quite unexpected because section 109 was only used once before, as it is meant for cases of treason and espionage, comparable to the American Espionage Act of 1917. In Denmark, leaks by government employees were usually charged under a much less strict law which can lead to imprisonment for only up to two years.

The headquarters of the Danish police intelligence service PET

The exact charges against Findsen haven't been made public, but according to DR News it's about leaking information to the press. Just before a hearing behind closed doors at Copenhagen magistrate's court on January 10, Findsen exclaimed to the press: "I want the charges brought forward and I plead not guilty. This is completely insane". Findsen has to stay in prison at least until February 4, the other three have been released on bail.

Updates:

On February 4, the court gathered behind closed doors again and decided that Findsen has to stay in custody for another four weeks. Highly unusual was the fact that it took some 8 hours to reach that decision. Findsen appeared in court carrying the 2017 war novel All the Light We Cannot See by Anthony Doerr.

On February 17, an appeals court ordered that Findsen had to be released from prison because although there's "a well-founded suspicion" that he violated Danish law by disclosing intelligence information, the court "didn’t find that the conditions for a pre-trial detention are met."

Already in December 2021, the head of the PET and the acting head of the FE visited the main Danish media outlets and warned that their editors could also be charged under section 109. On January 4, eight journalists from six media were summoned for questioning as part of the police investigation into the leaks about the FE.

A possible explanation for this intimidation could be that the Danish government wants to demonstrate that they will punish leakers severely and do everything to prevent any further leaks in an attempt to comfort the FE's foreign partners, especially the Americans, who are likely highly disturbed by the recent developments.

This could risk the continuation of the intelligence cooperation, for which mutual trust is the most important factor: intelligence agencies will only be willing to share their secret information when they are convinced that the other side will keep the information just as secret and will not misuse it in any way.

Lars Findsen in his office as head of the FE, with two Cisco 7900-series IP phones,
apparently one for secure and one for non-secure calls
(photo: Ritzau/Jens Dresling - click to enlarge)

Charges against former Defense minister Frederiksen

The current crisis didn't stop at the imprisonment of Lars Findsen though: on January 14, it was reported that Claus Hjort Frederiksen, who was defense minister from November 2016 to June 2019, is also charged under section 109. This was made public in a brief press release which the Liberal or Venstre Party sent to Danish media.

As a member of parliament, Frederiksen has immunity, but the Liberal Alliance party doesn't want to lift it unless the Danish parliament gets full insight into a possible criminal case against him. In the press release he said that he never had the intention to harm Denmark or Danish interests.

Update:
On February 4, 2022, Frederiksen issued a statement on Facebook in which he said that the day before he got insight into the charges against him and that they are only based on newspaper articles and public debates.

During two interviews in December 2021 (with the television programs Deadline and Lippert), Frederiksen had been remarkably talkative about the FE's cooperation with the NSA, but he was also angry about how his successor as defense minister, Trine Bramsen, handled the case by suspending Findsen and some other officials, including a general responsible for the relations with the Americans.

Just recently it was revealed that on February 28, 2019, Frederiksen had arranged a meeting with the Oversight Board to convince them to drop their investigation into the FE in order to not endanger the cooperation with the NSA - a controversial move given the independent position of the Oversight Board, which accordingly continued its investigation that eventually sparked the current intelligence crisis.

Current Danish defense minister Trine Bramsen (left) and her predecessor
Claus Hjort Frederiksen (photo: Linda Kastrup/Scanpix)

After the revelations in the media, Frederiksen apparently felt free to explain and stress that the FE did nothing wrong: that spying on European countries is common practice and that to protect Danish citizens (i.e. to keep within the law) the FE had installed filter systems.

He was especially concerned about the relationship with the NSA, because in recent years, Denmark had reached almost the same level as the Five Eyes partnership, an achievement that his successor had put at risk now, according to Frederiksen.

There are actually several countries that claim a position very close to the Five Eyes, but fact is that Denmark is a so-called Third Party partner of the NSA already since 1954 and, as such, a member of the SIGINT Seniors Europe (SSEUR) and, between 2009 and 2014, of the Afghanistan SIGINT Coalition (AFSC).



Development of the intelligence crisis

The Danish intelligence crisis started on August 24, 2020, when the ministry of Defense issued a short statement saying that Lars Findsen and two other officials of the military intelligence service had been suspended from duty until further notice.

The same day, the Intelligence Oversight Board (Tilsynet med EfterretningsTjenesterne or TET) issued a press release with the unclassified results of an investigation that had been initiated by information provided by one or more whistleblowers. The main accusations were:

- The FE withheld key and crucial information and provided the Oversight Board with incorrect information;
- There were risks that the FE's collection activities led to unlawful collection against Danish citizens;
- The FE failed to investigate indications of espionage within the Ministry of Defense;
- There's a culture of insufficient legal awareness within the FE's management;
- There were activities in violation of the Danish law, including obtaining and sharing information about Danish citizens;
- The FE has unlawfully processed information about an employee of the Oversight Board.

On December 21, 2020 the Danish justice minister established the FE Commission (FE-kommissionen) to further investigate the allegations against the FE and to present a report within a year.

> Read more: Head of Danish military intelligence suspended
after misleading the oversight board

The Kastellet fortress in Copenhagen, the workplace of most of the FE's employees
(photo: Danish Air Force Photo Service)

The FE uses XKEYSCORE to process data from the cable tap

Meanwhile, Danish media came with unprecedented disclosures: on September 13, the newspaper Berlingske revealed how in the mid-1990s the FE, in cooperation with the NSA, started to tap a backbone cable containing communications from countries like China and Russia - very similar to Operation Eikonal (2004-2008) in which the NSA cooperated with the German foreign intelligence servce BND.

According to Berlingske, the communications of interest were extracted from the cable in Copenhagen and were then sent to the Sandagergård complex of the FE on the island of Amager. Part of the agreement between the US and Denmark was that "the USA does not use the system against Danish citizens and companies. And the other way around".

On September 24, 2020, the Danish broadcaster DR reported that after 2008, NSA employees traveled to Denmark to build a data center for a new system to process the data from the cable tap. The heart of this system is formed by XKEYSCORE, the sophisticated processing and filtering system for internet data used by the NSA and GCHQ.

The Sandagergård complex of the FE on the island of Amager,
where a data center was built specifically to store data
from the joint NSA-FE cable tapping operation.
(Click to enlarge)

According to DR News, the FE tried to develop a number of filters to ensure that data from Danish citizens and companies is sorted out and not available for searches. Former defense minister Frederiksen confirmed the existence of such filters, but also admitted that there can be no 100% guarantee that no Danish information will pass through.

Berlingske had also identified the whistleblower as a young IT specialist of the FE, who in 2013 became increasingly concerned, after which then head of the FE Thomas Ahrenkiel ordered an internal investigation, which found no signs of abuse by the NSA. The IT specialist, however, was not satisfied with this result and informed the intelligence oversight board somewhere in 2018 and provided them with new information in November 2019.

> Read more: Danish military intelligence uses XKEYSCORE to tap
cables in cooperation with the NSA

The NSA tried to spy on Danish and other European targets

On November 15, 2020, the Danish broadcaster DR published a story about two internal assessments from the FE, one from 2012 and another one from 2015 (or 2014?), which contain an analysis of the phone numbers and e-mail addresses (also known as selectors) which the NSA sent to the FE for collecting information from the cable tap.

- According to the analysis from 2012, the NSA submitted selectors for Danish targets, including the ministry of Foreign Affairs and the ministry of Finance, as well as the Danish defense company Terma.

- The 2015 analysis of selectors showed that the NSA also used the cable tapping cooperation to spy on targets in European countries like Sweden, Norway, the Netherlands, Germany and France, according to DR News.

On May 30, 2021, joint reporting by DR, SVT, NRK, Süddeutsche Zeitung, NDR, WDR and Le Monde revealed that the internal investigation which FE boss Ahrenkiel initiated in 2014 was codenamed Operation Dunhammer and concluded in May 2015 that the NSA had provided telephone selectors for Norwegian, Swedish, German, Dutch and French politicians and officials, including former German chancellor Angela Merkel and then foreign minister Frank-Walter Steinmeier.

> Read more: The NSA tried to spy on Danish and other European
targets via cable tapping in Denmark

This outcome is actually not very surprising, because from the German parliamentary investigation (2014-2017) into the cooperation between the NSA and the BND it also became clear that, among hundreds of thousands of identifiers for legitimate targets, the NSA had provided the BND with thousands of selectors related to European and even German targets, which in 2015 resulted in the "Selector Affair".

> Read more: New details about the selectors NSA provided to BND

The FE Commission finds no wrongdoing

On December 13, 2021, the independent FE Commission finally presented its report about the accusations against the FE. Surprisingly, the commission found no evidence of wrongdoing by the FE and also found no basis to hold the former and current head of the FE, Ahrenkiel and Findsen, accountable.

The report from the FE Commission is classified, but its conclusion have been published on the commission's website. Because they are only available in Danish, I made a preliminary translation using Google Translate with some manual corrections, which can be found here.

Focusing on the most important accusations, the commission found no evidence that the FE provided incorrect information to the subsequent defense ministers nor to the Intelligence Oversight Board. The commission also found no basis for assuming that the FE has generally obtained and passed on information about Danish citizens in violation of the law.

Given everything that emerged from the various revelations by Danish media this conclusion came as a surprise, but it can probably be explained by the fact that spying on other European governments is not prohibited by Danish law, how embarrassing it may be when it becomes public.

And if the FE has a similar filter system as used by the German BND, then the Danish selectors which the NSA provided to the FE would have been blocked before they were entered into the actual collection system (see diagram below). This means no Danish data were selected and so there was also no violation of the law.

It's unclear whether the commission found any minor deficiencies at the FE. As we have seen during the German parliamentary investigation, employees of the BND's signals intelligence units often had little feeling with political sensitivities, while government officials didn't know about the complexities and limitations of the collection systems. Similar issues may have been the case at the FE.



Similarities to the Snowden case

Most recently, Edward Snowden also commented on the Danish intelligence crisis in an interview with the newspaper Politiken from January 22, 2022. In the interview, however, Snowden acted as if the cooperation between the NSA and the FE is a mass surveillance program that "violates the rights of hundreds of thousands, if not millions, of people every single day" while it's actually about selectors for individual and generally legitimate targets.

Snowden also seems convinced that "Danish communication will be intercepted in these programs. No country possesses the capabilities to filter out all the information of its citizens", but according to previous press reports, the controversial selectors were telephone numbers and those are quite easy to filter, because they include a country code. For internet communications this is much more difficult.

In the interview, Snowden said, again with maximum exaggeration, that he is impressed by the young IT specialist at the FE who started the current crisis: "it is hard not to be inspired by this person's courage and ability to do so. The person has investigated the investigators and caught them in breaking the law and the rights of everyone in Denmark and the whole world."

Edward Snowden during the interview with the
Danish newspaper Politiken, January 22, 2022

Unlike Snowden, the FE's IT specialist didn't go straight to the press when he became concerned about certain things at his work place, but initially followed the proper channels and addressed his concerns to the FE management. However, an internal investigation found no abuse of the cable tapping operation by the NSA.

Then the IT specialist acted very similar to Snowden: because he was not satisfied with this result he secretly started to gather internal information on his own: he "smuggled a recorder into his workplace, arranged meetings with colleagues and bosses for several months and recorded them in secret". In November 2019 he provided this to the intelligence oversight board, which also started an investigation.

Then defense minister Claus Hjort Frederiksen (now 74 and liberal conservative) tried to keep this behind closed doors in order not to endanger the longstanding cooperation with the NSA - which is the common way governments handle such intelligence issues.


What made the Danish case different is that his successor Trine Bramsen (40 and social democrat) followed the concerns of the oversight board and suspended FE chief Findsen. At that moment it seemed the IT specialist was right and that things were wrong at the FE.

But Frederiksen and maybe Findsen and other FE officials fought back by telling the press about the joint cable tapping operation in an apparent attempt to convince the public of the importance of the cooperation with the NSA.

Several months later it was revealed that the NSA had tried to spy on European and even on some Danish targets - highly classified information that may have been leaked by insiders hat shared the concerns of the IT specialist.

This fight through press leaks seriously threathened Denmark's intelligence position and therefore the government apparently saw only one option left, that of unprecedented tough measures against leakers, even when they defended the cooperation with the NSA.



Conclusion

Ultimately, the whole issue in Denmark boils down to the same positions we saw earlier in other countries that were affected by the Snowden revelations:

- People close to the intelligence agencies claim that their interception operations are strictly within the law, particularly by using filter systems to protect the communications of their own citizens.

- Outsiders usually think that bulk cable tapping is wrong anyway and that spying on governments and companies of friendly countries is also wrong, even when that's not prohibited by law.

Despite being seen as a former insider, Snowden represents the outsider position by claiming that cable tapping automatically means bulk collection and mass surveillance. In reality, bulk collection is usually limited to metadata, which are not used to monitor as many people as possible, but to find targets that were not yet known. Selectors for individual targets are then used to pick their communications from the cable just as targeted as a traditional wiretap.

It's likely that the NSA also acquired metadata from the cable tap in Copenhagen, but the Danish press reports didn't provide further information on this. During the similar operation Eikonal in Germany, the BND made sure the NSA only got 'technical metadata' and no 'personal metadata' like phone numbers and e-mail addresses (see diagram below).

All this shows once more that in order to make a good judgment about signals intelligence operations it's often necessary to look at even the smallest details of the technical systems that are involved.

Overview of the joint NSA-BND operation Eikonal (2004-2008)
(Click to enlarge)

UPDATE:

On November 1, 2023, the Danish prosecution service dropped its cases against the head of the FE Lars Findsen (59), former defense minister Claus Hjort Frederiksen (76) and a former employee of the police security service PET.

After the Danish Supreme Court had ruled that both cases should take place in public and sessions were only to be closed off whenever sensitive information was presented, the public prosecutor said that this would lead to the disclosure of highly classified information and was therfore not in the interest of national security.

In a reaction, the head of the PET Finn Borch Andersen noted that this is an unsustainable legal situation because it prevents the prosecution of cases in which state secrets are part of the evidence. He therefore called for new legislation for cases that include classified information.

Links and sources

- The Guardian: Scandinavian spy drama: the intelligence chief who came under state surveillance (Oct. 2, 2023)
- Politiken: Edward Snowden: Det, der foregår i Danmark lige nu, er en demokratisk skandale (Jan. 22, 2022)
- Peter Kofod: FindsenGate 1½ | Anbefaling & forbehold (Jan. 21, 2022)
- DR: Claus Hjort ville beskytte spionsamarbejde: Forsøgte at bremse kulegravning af Forsvarets Efterretningstjeneste (Jan. 21, 2022)
- Politiken: Eksperter: Claus Hjort afslørede meget dårligt bevarede statshemmeligheder (Jan. 19, 2022)
- De Volkskrant: Staat de veiligheid en geloofwaardigheid van Denemarken op het spel nu de inlichtingenchef in de cel zit? (Jan. 18, 2021)
- BBC: Danish spy scandal: Ex-minister accused of state secrets leak (Jan. 15, 2022)
- Intel News: Ex-director of Danish spy agency charged with treason in ‘unprecedented’ case (Jan. 12, 2022)
- DR: Hemmelig PET-taskforce aflyttede spionchef Lars Findsen i månedsvis for at afsløre læk til medierne (Jan. 10, 2022)
- DW: Danish spy chief detained over 'highly sensitive' leak (Jan. 10, 2022)
- Politiken: Kommission afviser alle anklager mod spiontjeneste og hjemsendte chefer (Dec. 13, 2021)
- DR: Forsvarets Efterretningstjeneste lod USA spionere mod Angela Merkel, franske, norske og svenske toppolitikere gennem danske internetkabler (May 31, 2021 - including timeline)

What the NSA provides to its foreign partners, and vice versa

(Updated: February 27, 2025)

The cooperation between (signals) intelligence agencies of different countries is strictly quid pro quo, which means what you get is equivalent to what you give. This is perfectly illustrated by a small series of documents from the Snowden trove, which summarize what the NSA provides to its foreign partners, along what they provide to the NSA.

Three of these documents are about the NSA's Second Party partners (better known as the Five Eyes): Canada, Australia and New Zealand, and six about Third Party partners: Germany, Israel, Norway, Saudi Arabia, Sweden and Turkey. Another NSA document provides some characteristics of these relationships.

The documents about the various NSA partners are information papers prepared by the Country Desk Officer (CDO) for the particular country at the NSA's Foreign Affairs Directorate (FAD). All but one date from April 2013, which is just a month before Snowden left the agency. It's not known whether there are also papers about other NSA partners among the Snowden files.

The information papers describe the relationship between the NSA and the foreign partner in a standardized way: they all start with an introduction, mention some "Key Issues", followed by "What NSA Provides to Partner" and "What Partner Provides to NSA". The papers end with "Success Stories" and "Problems/Challenges with the Partner".

For readability, the portion markings with the classification level for each paragraph have been removed and some abbreviations are written in full.

Second Party partners

The Second Party partners of the NSA are the signals intelligence agencies of the United Kingdom, Canada, Australia and New Zealand. These five countries are also known as the Five Eyes. Their SIGINT systems are highly integrated and the partners are not supposed to spy on each other.

Canada

Information paper: NSA Intelligence Relationship with Canada's CSEC, April 3, 2013

(Published by CBC on December 9, 2013; a slightly less redacted version is here)


What NSA provides to the Partner:

SIGINT: NSA and CSEC cooperate in targeting approximately 20 high-priority countries [two lines redacted]. NSA shares technological developments, cryptologic capabilities, software and resources for state-of-the-art collection, processing and analytic effots, and IA capabilities. The intelligence exchange with CSEC covers worldwide national and transnational targets. No Consolidated Cryptologic Program (CCP) money is allocated to CSEC, but NSA at times pays R&D and technology costs on shared projects with CSEC.

[two paragraphs redacted]


What the Partner provides to NSA:

CSEC offers resources for advanced collection, processing and analyss, and has opened covert sites at the request of NSA. CSEC shares with NSA their unique geographic access to areas unavailable to the U.S. [redacted], and provides cryptologic products, cryptanalysis, technology, and software. CSEC has increased its investment in R&D projects of mutual interest. [several lines redacted].

[at least two paragraphs redacted]

---

Australia

Information paper: NSA Intelligence Relationship with Australia, April 2013

(Published by The Intercept and ABC on August 18, 2017)


What NSA provides to the Partner:

NSA provides cryptologic products/services to the Government of Australia through DSD, on virtually all subjects, particularly those related to the Pacific Rim. NSA shares technology, cryptanalytic capabilities, and resources for state-of-the-art collection, processing and analytic efforts. NSA will continue to work closely with Australia to meet its commitments as the U.S reallocates efforts toward Asia and the Pacific.


What the Partner provides to NSA:

NSA and DSD have agreed to specific divisions of effort, with the Australians solely responsible for reporting on multiple targets in the Pacific area, including Indonesia, Malaysia, and Singapore, based on their unique language capabilities and geographic accesses. In addition, DSD has primary reporting responsibility [redacted] regardless of geographic region. DSD provides access to commercial and foreign/domestic satellites from sites in Geraldton and Darwin, High Frequency (HF) collection and Direction Finding (DF) from three sites; and, manning of the operations floor at Joint Defense Facility at Pine Gap (RAINFALL), a site which plays a significant role in supporting both intelligence activities and military operations. In addition, DSD provides NSA with access to terrorism-related communications collected inside Australia.

---

New Zealand

Information paper: NSA Intelligence Relationship with New Zealand, April 2013

(Published by NZ Herald on March 11, 2015)


What NSA provides to the Partner:

NSA provides raw traffic, processing, and reporting on targets of mutual interest, in addition to technical advice and equipment loans.


What the Partner provides to NSA:

GCSB provides collection on China, Japanese/North Korean/Vietnamese/South American diplomatic communications, South Pacific Island nations, Pakistan, India, Iran, and Antarctica; as well as, French police and nuclear testing activities in New Caledonia [two lines redacted].

Third Party partners

The Third Party partners of the NSA are the signals intelligence agencies of some 33 countries. Cooperation is based on formal, bilateral agreements, but the actual scope of the relationship varies from country to country and from time to time. Unlike the Second Party partners, Third Party partners do spy on each other.

Germany

Information paper: NSA Intelligence Relationship with Germany, January 17, 2013

(Published by Der Spiegel on June 18, 2014)


What NSA provides to the Partner:

NSA has provided a significant amount of hardware and software at BND expense, as well as associated analytic expertise to help the BND independently maintain its FORNSAT [Foreign Satellite collection] capability. NSA also exchanges intelligence reporting on both military and non-military targets.


What the Partner provides to NSA:

NSA is provided access to FORNSAT communications supporting counter-narcotics (CN), counter-terrorism (CT), [redacted], and Weapons of Mass Destruction (WMD) missions and is an important source of information on drug trafficking and force protection in Afghanistan. The BND provides Igbo language support by translating NSA collection of a high-value, time-sensitive [redacted] target. NSA is seeking the proper approvals to accept BND language support in [one line redacted]. In addition to the day-to-day collection, the Germans have offered NSA unique accesses in high interest target areas.

---

Israel

Information paper: NSA Intelligence Relationship with Israel, April 19, 2013

(Published by The Intercept on August 4, 2014)


What NSA provides to the Partner:

The Israeli side enjoys the benefits of expanded geographic access to world-class NSA cryptanalytic and SIGINT engineering expertise, and also gains controlled access to advanced U.S. technology and equipment via accomodation buys and foreign military sales.


What the Partner provides to NSA:

Benefits to the U.S. include expanded geographic access to high priority SIGINT targets, access to world-class Israeli cryptanalytic and SIGINT engineering expertise, and access to a large pool of highly qualified analysts.

---

Norway

Information paper: NSA Intelligence Relationship with Norway, April 17, 2013

(Published by Dagbladet on December 17, 2013)


What NSA provides to the Partner:

- Daily TS//SI-level counter-terrorism (CT) reports shared multilaterally;
- Frequent exchanges of technical data and analytic expertise on CT targets, [one line redacted] and other threats to Norway's national security;
- Daily force protection support in Afghanistan and technical expertise to support target development of Afghan insurgent targets;
- Regular reporting on counter-proliferation (CP) topics [redacted]
- Ad-hoc reporting and analytic expertise on [redacted]
- Exchanges of reporting, tech data and analytic expertise on [redacted]
- Tech data and expertise on cryptanalytic topics of mutual interest; and
- FORNSAT communications metadata


What the Partner provides to NSA:

- SIGINT analysis as well as geolocational and communications metadata specific to Afghan targets of mutual interest (this analysis also supports Norwegian Special Operations Forces (when deployed);
- All-source analysis specific to Afghan targets of mutual interest. The analysis is based on operations conducted jointly between Norway and local and/or coalition authorities;
- Potential to leverage NIS [Norwegian Intelligence Service] FORNSAT capabilities to augment NSA collection against high priority CP SIGINT targets;
- Potential to leverage NIS unique access to SIGINT on high priority CT targets; [redacted]
- SIGINT reports on Russian civil targets of mutual targets, particularly Russian energy policy;
- FORNSAT communications metadata; and
- [one line redacted]

---

Saudi Arabia

Information paper: NSA Intelligence Relationship with Saudi Arabia, April 8, 2013

(Published by The Intercept on July 25, 2014)


What NSA provides to the Partner:

NSA/CSS provides technical advice on SIGINT topics such as data exploitation and target development to TAD [Technical Affairs Directorate of the Ministry of Interior] as well as a sensitive source collection capability.

NSA/CSS provides a sensitive decryption service to the Ministry of Interior against terrorist targets of mutual interest.


What the Partner provides to NSA:

NSA leverages MOD RRD [Ministry of Defense Radio Reconnaissance Department] access to remote geography in the Arabian Gulf but provides no finished SIGINT reporting to NSA/CSS, however; they have provided unencrypted collection against the IRGC QODS Maritime Force targets of mutual interest from their collection system [redacted].

TAD provides sensitive access to unique collection containing AQAP terrorist targets of mutual interest.

---

Sweden

Information paper: NSA Intelligence Relationship with Sweden, April 18, 2013

(Published by SVT Nyheter on December 5, 2013)


What NSA provides to the Partner:

- Technical support, collection, processing equipment and training
- NSA accepts selectors from FRA and tasks them to approved NSA collection sites
- [one line redacted]
- [one line redacted]
- Accomodation purchases of equipment
- Membership in multinational forums


What the Partner provides to NSA:

- Unique intelligence on Russia, the Baltic, Middle East, and counter-terrorism (CT)
- Outstanding and unique input of ELINT signals
- Access for special collection initiatives
- Collaboration on cryptanalytic issues

---

Turkey

Information paper: NSA Intelligence Relationship with Turkey, April 15, 2013

(Published by Der Spiegel on August 31, 2014)


What NSA provides to the Partner:

- NSA provides equipment, technology, training, and U.S. SIGINT requirements and reporting to the Turkish partner to better assist NSA in fulfilling U.S. intelligence requirements.

- In terms of equipment and technology NSA provides both collection and cryptographic equipment. A Cryptographic Modernization program is under way with both partners [MIT and SIB] to upgrade encryption on all shared and some non-shared communications links. A High Frequency Direction Finding (HFDF) collection site is [two line redacted] NSA also provides decryption of DHKP/C internet traffic the Turks collect.

- U.S. SIGINT requirements and reporting cover military and paramilitary targets in [redacted] and the KGK [Kurdistan Workers' Party]. This reporting is a mixture of near-real time and product "Tear Line" reports and analysis.

- NSA provides daily interaction and actionable intelligence on foreign fighter Sunni extremists, against both Turkish and non-Turkish individuals. NSA provides regional Tactical [redacted] reporting in two hour increments.


What the Partner provides to NSA:

- The partner provides near real time reporting on military air, naval, ground, and paramilitary targets in Russia, [redacted] Georgia, Ukraine, and on KGK targets, as well as daily summary reporting of Black Sea and CIS Naval and Air activity and [redacted]

[one paragraph redacted]

- NSA enjoys joint operational access to the HFDF site in [redacted] which, in turn, functions as a node on NSA's world-wide CROSSHAIR HFDF geolocation service. The U.S. and 2nd Parties receive approximately 400,000 fixes yearly utilizing Lines-of-Bearing from the [redacted] site while the Turks receive approximately 5000 fixes yearly from its regional usage of CROSSHAIR, an 80 to 1 ratio in FVEY's favor.

- NSA receives Turkish transcripts of KGK voice collection. Cooperation on the KGK target by the U.S. Intelligence Community in Ankara has increased across the board since the May 2007 DNI Memorandum encouraged all to do so.

Section from the information paper about the NSA's relationship with Turkey

---

Some characteristics

According to the quid pro quo-principle, we see that for each of these foreign partners, the things that NSA provides to the partner roughly equal what the partner provides to the NSA - at least according to the length of the sections in the information papers. The actual content of what each party provides is often very different, as was described in an internal interview from 2009 about the nature of the NSA's Third Party relationships:

"Generally speaking, our Third Party partners want access to our technology, as well as our regional/global reach. In exchange for providing unique accesses, regional analytical expertise, foreign language capabilities and/or I&W [Indications & Warning] support, we provide them with technical solutions (e.g., hardware, software) and/or access to related technology." The partners usually "know their regional hoods better than we do and they exponentially add to our foreign language capability."

When the information papers speak about providing data about "targets of mutual interest", the interview explains: "We must keep in mind that our partners are attempting to satisfy their own national intelligence requirements; with the exception of the assistance we provide during crises, we can only move our SIGINT relationships forward, when U.S. requirements intersect with theirs." This also depends on how long and deep such a relationship is:

"Many of our relationships have, indeed, spanned several decades, allowing us to establish higher degrees of trust with and reliance on one another. This, in turn, has led to greater levels of cooperation, where, for instance, NSA might be willing to share advanced techniques with a proven and reliable partner, in return for that partner's willingness to do something politically risky. Trust requires years to build up but can be lost in a very short period of time."

And finally, the interview also explains: "For a variety of reasons, our intelligence relationships are rarely disrupted by foreign political pertubations, international or domestic. First, we are helping our partner address critical intelligence shortfalls, just as they are assisting us. Second, in many of our foreign partners' capitals, few senior officials outside of their defense-intelligence apparatuses are witting to an SIGINT connection to the U.S./NSA."

> See also: NSA's Foreign Partnerships

Update:
PhD research by Pepijn Tuinier found that in the context of the EU, increasing intelligence cooperation "is more due to interaction than transaction. It is not so much states and organisations that make cooperation possible, but people. In addition to the prevailing thought that there are no friends in intelligence, Tuinier's research suggests that - from a sociological perspective - if intelligence services have any friends at all, it is other intelligence services. It turned out that having the same values plays a big role and that granting - and the perception that another also grants you something - comes back very strongly."

Head of Danish military intelligence suspended after misleading the oversight board

The Danish military intelligence service (Forsvarets Efterretningstjeneste or FE), which is also responsible for signals intelligence, has been accused of unlawful activities and deliberately misleading the intelligence oversight board.

After the oversight board (Tilsynet med Efterretningstjenesterne or TET) received information from a whistleblower, the head of the FE, Lars Findsen, and three other senior officials of the intelligence service were suspended.

Here, I will provide a translation of the press release of the oversight board, as well as details from its earlier reports, showing that there were problems at the FE for years. An overview of the international cooperation between the FE and foreign partner agencies provides a context for what likely went wrong at the Danish service.

Lars Findsen, head of the FE from 2015 to 2020 and the
FE's satellite intercept station in North Jutland

Press release of the Oversight Board

The affair came to light when on August 24, the Danish Ministry of Defense issued a short statement saying that the head of the FE and two other officials were suspended from duty until further notice. Svend Larsen, the chief of Central and West Zealand Police, was appointed as acting chief of the FE. Later, a third official was also suspended.

The same day, the Danish Intelligence Oversight Board published a press release with the unclassified results of its investigation into the issues that led to Findsen's suspension. Because the press release is only available in Danish, I made a preliminary translation using Google Translate with manual corrections to make it more readible:

---

PRESS RELEASE

The Intelligence Oversight Board completed a special investigation into the Defense Intelligence Service (FE) on the basis of material submitted by one or more whistleblowers.

In November 2019, one or more whistleblowers provided the Intelligence Oversight Board with a significant amount of material relating to the FE, which the Board has not hitherto been aware of or able to acquire. The material is of such a nature that the Board decided to focus its oversight of the FE in order to carry out an in-depth investigation of the present situation. With this announcement, the Board publishes the unclassified results of the investigation.

On the basis of the Board's investigation of the submitted material, the Board sent an analysis in four volumes to the Minister of Defense containing the Board's conclusions and recommendations on 21 August 2020.

Throughout the process of the special investigation of the FE, the Board has held the Minister of Defense informed. The Minister of Defense has regularly expressed support for the Board's in-depth examination of the material.

The Board's assessments and recommendations deal with matters that are fully or partially within its legal supervision authority according to the FE Act and the rules and conditions based on it, which the Minister, in the opinion of the Board, should have knowledge of, cf. § 16, stk. 2. of the FE Act.

Based on a source-critical examination of the submitted material, the Board assesses, among other things, the following:

- That since the establishment of the Board in 2014 and until the summer of 2020, the FE has, among other things, on several occasions during the Board's inspections and meetings with the head of the FE, withheld key and crucial information and provided the Board with incorrect information regarding the service's collection and disclosure of information.

The Board is of the opinion that the statutory duty to provide information is absolutely necessary for functional oversight and that it is based on trust by the legislator that the FE complies with this obligation in all respects. The result of these repeated breaches of the statutory duty to provide information is that the legality check that the Board is required to carry out under the FE Act, and which contributes to the legitimacy of the FE's work, does not work out as intended.

- That at central parts of the FE's collection capabilities there are risks that can lead to unlawful collection against Danish citizens.

- That the submitted material indicates that the FE's management has failed to follow up on, or further investigate indications of espionage within the Ministry of Defense.

- That there is a culture of insufficient legal awareness within the FE's management and parts of the service, which results in unlawful activities or inappropriate situations within the service to be shelved, including not informing the Oversight Board about matters relevant to its supervision.

- That the submitted material indicates that the FE, prior to the establishment of the Board in 2014, initiated operational activities in violation of the Danish law, including obtaining and passing on a significant amount of information about Danish citizens.

- That the FE has unlawfully processed information about an employee of the Oversight Board.

Against this background, the Board recommends that a political position be taken on the following:

- Whether there should be an investigation into whether the FE has carried out and is carrying out its task as a national security authority within ​​the Ministry of Defense in accordance with § 1, stk. 2 of the FE Act.

- The need to uncover whether the FE has adequately informed policy makers about all relevant issues concerning key parts of the service's collection capabilities.

Given the options of the FE Control Act, the Board does not have the possibilities to further uncover specific matters that emerge from the submitted material. Therefore, the Board generally recommends the following:

- That an early evaluation of the FE Act will be carried out to determine whether the Board has the necessary legal authorities and resources to carry out an effective legal oversight of the FE, including whether the Board must have the authority to conduct interrogations of the FE's employees as witnesses.

- That, based on of the circumstances of the Board's receipt of the submitted material, an external whistleblower scheme for the FE is established, which can best be placed under the auspices of the Board.

Such a scheme should improve the ability of current and former FE employees to comment on controversial issues without fear of retaliation, including employment or criminal consequences. Furthermore, such a scheme would allow classified information to be passed on in a secure environment. The scheme must also ensure that an external whistleblower body has the necessary resources and instruments to protect the persons who submit information according to this scheme.

The Board had thorough considerations regarding the publication of the conclusions and recommendations of the investigation. It is crucial for the oversight that the public has as much insight as possible. However, in the view of the extremely sensitive circumstances surrounding the submission of the material to the Board and its classified content, the Board may not provide further information to the public.

Facts about the Intelligence Oversight Board

The Intelligence Oversight Board is a special independent monitoring body that supervises that the PET processes information about natural and legal persons in accordance with the law, and that the FE processes information about natural and legal persons domiciled in Denmark in accordance with the law. The Board was established by the Act on the Police Intelligence Service (PET), which, like the Act on the Defense Intelligence Service (FE), entered into force on 1 January 2014.

Following the entry into force on 1 July 2014 of the Center for Cyber ​​Security (CFCS) Act, the Board has also monitored that CFCS processes information about natural persons in accordance with the legislation.

The Board consists of five members appointed by the Minister of Justice after consultation with the Minister of Defense. The chairman, who has to be a High Court judge, is appointed on the recommendation of the Presidents of the Danish Eastern and Western High Courts, while the other members are appointed after consultation with the Parliamentary Committee for the Intelligence Services.

The members are:

- Michael Kistrup, High Court Judge, High Court of Eastern Denmark (Chairman)
- Erik Jacobsen, Chairman of the Board of Directors, Roskilde University
- Pernille Christensen, Legal Chief, National Association of Local Authorities
- Professor Henrik Udsen, University of Copenhagen
- Professor Rebecca Adler-Nissen, University of Copenhagen

Read more about the audit at www.tet.dk

---

The Kastellet fortress in Copenhagen, the workplace of most of the FE's employees
(photo: Danish Air Force Photo Service)

Problems in earlier reports

The FE's unauthorized and illegal activities described in the press release of the Oversight Board may actually not have come as a complete surprise.

Already in several earlier reports, the Oversight Board noticed that the FE conducted quite a large number of unlawful "raw data searches", which is the term used for untargeted interception. This method enables the FE to "obtain very large amounts of information (several hundred million communications per year)" - according the Annual Report 2018.

In the English version of its Annual Report 2017, in which the FE is mentioned as the Danish Defense Intelligence Service or DDIS, the oversight board says:

"the checks showed that in four instances DDIS engaged in unlawful targeted procurement of information about persons resident in Denmark for a total of 20 days in 2014, eight months in 2014-2015, four days in 2016 and 17 months in 2016-2017. The checks further showed that in 20 percent of the samples drawn DDIS made unlawful searches in raw data.
In the Oversight Board’s opinion, the unlawful instances of procurement, including searches in raw data, were in the nature of negligent actions in all cases. Similarly, the Oversight Board notes that since the publication of the Oversight Board’s annual report for 2016 DDIS has taken a number of measures to reduce the number of errors. For one thing, DDIS has intensified its internal controls in the area and strengthened and targeted its staff training."

Regarding the issue of sharing data and information with the Danish domestic security service (Politiets Efterretningstjeneste, or PET) as well as with foreign partner agencies, the board noticed:

"that in a few instances DDIS was not in possession of documentation of the reason underlying the legal approval of a disclosure of information about persons resident in Denmark. The Oversight Board encouraged DDIS to ensure that documentation is obtained in all cases.
Furthermore, the check showed that DDIS did not carry out logging of a system sampled for disclosure of information. The Oversight Board encouraged DDIS to implement system logging, which was soon implemented by DDIS."

Lars Findsen in his office, with two Cisco 7900-series IP phones, apparently one for
secure and one for non-secure calls, as indicated by the colored labels
(photo: Ritzau/Jens Dresling)

Work station searches

Also interesting is that the Danish Intelligence Oversight Board checks individual computers of FE employees:

"Within two DDIS departments, the Oversight Board’s secretariat checked a number of randomly chosen work stations, including their drives, Outlook folders, external storage devices and documents in hard copy.
In connection with the check performed of the information held on each of the work stations, the secretariat asked questions to the individual staff members in question about their knowledge of the rules on processing, including erasure, of information about persons resident in Denmark.
When asked, a majority of the staff informed the secretariat that they had erased information from their work stations before the check."

As a result of this work station check in 2017, there appeared to be one case in which a "staff member processed information about persons resident in Denmark in violation of DDIS’s internal guidelines as the staff member in question retained information which he or she believed was no longer relevant to process there."


Backdoor searches

In its Annual Report 2018 the Oversight Board addressed an interesting aspect of the cooperation between the FE and the domestic security service PET. When the PET requests the FE to use its (untargeted) collection systems to obtain future communications of someone resident in Denmark, then the PET has to obtain a court order beforehand.

However, it was "an established practice" that no court order was required when the PET asked the FE to conduct a search in raw data that had already been obtained (note the similarity with the controversial "backdoor searches" which the NSA conducts on data that it has already lawfully collected).

After a critical opinion of the Oversight Board from June 2018, the PET agreed that in the future it will obtain a court order before requesting the FE to perform a raw data search concerning persons resident in Denmark. This because the PET "does not wish for a situation where it could be called into question whether it has the authority required for its activities".

The FE's satellite interception station near Hjørring in North Jutland

International cooperation

Although being just a small organization, the Danish FE was always part of various international signals intelligence alliances. Already in 1954, it became a third party partner of the NSA and, as such, a member of the multilateral SIGINT Seniors Europe (SSEUR) group that was established in 1982.

In 1976, the FE took the initiative to set up a purely European signals intelligence group codenamed Maximator, which includes Sweden, Germany, the Netherlands and France. The FE was also part of a parallel military intelligence alliance, which was created in the early 1980s and is known as the Club of Five.

The data and information that Denmark contributes to these multilateral exchange groups comes from the various collection systems operated by the FE. Most visible are its two satellite interception stations: one close to Sandagergård on Amager and one near Hjørring in North Jutland.

Additionally, the Danish military probably has mobile interception units to be used during operations abroad. In Afghanistan for example, Danish forces were part of the Afghanistan SIGINT Coalition (AFSC) and used DRT equipment to collect cell phone metadata that was fed into the NSA's Real Time-Regional Gateway (RT-RG) system.

The FE's satellite interception station on Amager, close to Sandagergård

Based on documents from the Snowden revelations, the Danish newspaper Information reported in June 2014, that Denmark is most likely cooperating with the Americans for access to fiber-optic cables under the NSA's umbrella program RAMPART-A. The NSA also provided the FE with collection and processing equipment.

Data "collected from cable taps in Denmark are filtered in order to eliminate Danish data before handing them over to NSA. The filters, however, do not remove all Danish data, since this is not technically feasible" - according to Information. This is similar to what happened to the data the German BND shared with the NSA under operation Eikonal, which was also part of RAMPART-A.

Denmark was also mentioned in Edward Snowden's written testimony for the European Parliament from March 2014, in which he came up with the following accusation:

“The result is a European bazaar, where an EU member state like Denmark may give the NSA access to a tapping center on the (unenforceable) condition that NSA doesn't search it for Danes, and Germany may give the NSA access to another on the condition that it doesn't search for Germans.
Yet the two tapping sites may be two points on the same cable, so the NSA simply captures the communications of the German citizens as they transit Denmark, and the Danish citizens as they transit Germany, all the while considering it entirely in accordance with their agreements.
Ultimately, each EU national government's spy services are independently hawking domestic accesses to the NSA, GCHQ, FRA, and the like without having any awareness of how their individual contribution is enabling the greater patchwork of mass surveillance against ordinary citizens as a whole.”

It should be noted that this theory is not supported by original documents from the Snowden collection. Also, a thorough German investigation into the prohibited data the NSA was interested in during its cooperation with the BND for satellite interception revealed that the NSA mainly tried to target various European government agencies and German companies.

This was in violation of the Memorandum of Agreement (MoA) with the Germans, but in general, spying on foreign governments is considered fair game - and it turned out that the BND was doing exactly the same. There are no indications that these kind of cooperations were used for the surveillance of ordinary citizens.



Conclusion

Meanwhile, additional reporting by the Danish broadcaster DR says that the FE allegedly shared large amounts of raw data from a fiber-optic cable access with the NSA, "which could have included Danish citizens' private personal information and communications". DR couldn't clarify whether this cooperation with the NSA was legal or illegal.

This could be a confirmation of Information's reports from 2014 about a joint cable access operation, but it could also be that the FE shared (meta)data from its own cable access with the NSA. It's assumed that the FE can legally intercept cable traffic in bulk, but as a foreign intelligence service, it has to make sure that no data of Danish residents are collected.

We know that both the NSA and the BND had great difficulties with filtering out data of their citizens and residents, so the least that can be expected is that the FE has the same problem, apparently didn't care much about it and deliberately misled the Oversight Board about the extent of this issue.

The Danish prime minister, Mette Frederiksen, has announced an investigation into the unlawful activities of the FE.



Links & sources
- Information: Når man samarbejder med NSA om masseovervågning, er det langtfra risikofrit (Sept. 12, 2020)
- The Local: Danish intelligence scandal related data sharing with US agency, according to media (August 28, 2020)
- The Register: The Viking Snowden: Denmark spy chief 'relieved of duty' after whistleblower reveals illegal snooping on citizens (August 25, 2020)
- BBC: Danish military intelligence head Lars Findsen suspended (August 24, 2020)
- Information: German disclosure raises questions about Danish NSA-partnership (October 20, 2014)
- Information: NSA ‘third party’ partners tap the Internet backbone in global surveillance program (June 19, 2014)

- English homepage of the Danish Defence Intelligence Service (DDIS)