How NSA targeted the Venezuelan oil company PdVSA

There aren't many new revelations from the Snowden-documents anymore, but recently an NSA document was published telling how the agency prepared the interception of communications from the Venezuelan oil company Petróleos de Venezuela, S.A. (PdVSA).

It's not a very spectacular disclosure, but it gives a nice insight in what an NSA analyst actually does. The story was published on November 18 by the website The Intercept and the Latin-American broadcaster teleSUR.

Most people will have read The Intercept's report, but that misses one of the most interesting details of the story. Here, the disclosed NSA document will be discussed in full, with details explained based upon information from earlier disclosures.

Building of PdVSA in Maracaibo with on its facade Fidel Castro's motto
"Patria, Socialismo o Muerte" (Fatherland, Socialism or Death)
(Photo: Reportero24)

The document that was published is an excerpt from SIDtoday, the internal newsletter of the NSA's Signals Intelligence Division from March 23, 2011 (which was apparently accessed (by Snowden?) on Saturday, November 10, 2012). It contains a story that is told by a Signals Intelligence Development (SIGDEV) analyst from the NSA's Transnational & Strategic Partnerships SIGDEV branch.

A SIGDEV analyst is someone who looks for new targets or new means to access communications of existing targets. His unit S2C13 is part of the International Security Issues (ISI) Product Line, which is responsible for analysis and production of intelligence about countries in Europe, South-America and elsewhere.


Intelligence requirements

As the analyst recalls, a year-end review had shown that there was no progress on the "Venezuelan Energy target set" as most reporting came from warranted collection. That could refer to PRISM and Upstream collection under section 702 FAA, but that only requires annual certifications approved by the FISA Court. Strictly spoken, individual warrants are only needed for "traditional FISA" collection, like for example for eavesdropping on the Venezuelan embassy in Washington.

The analyst decided to do a "target reboot", which he describes as "taking a fresh look at opportunities for collection". He first looked at specific Information Needs (INs) and used SURREY, which is the main NSA requirements database.

These requirements are the outcome of an administrative process, that starts with the US president setting the highest priorities for foreign intelligence collection. These priorities are then translated into the National Intelligence Priorities Framework (NIPF) for the US Intelligence Community as a whole.


Strategic Mission List

For Signals Intelligence (SIGINT), it's the National Signals Intelligence Committee (SIGCOM) that collects the requests for information from the various intelligence "consumers", checks whether they are consistent with the NIPF and assignes them a priority. An overview of the SIGINT priorities can be found in the 2007 Strategic Mission List, which was published in November 2013.

This document lists Venezuela as one of six countries that are treated as "enduring targets". According to this document, NSA should "Provide U.S. decision makers with a holistic SIGINT perspective of regional trends and developments" and also "Provide indicators of regime stability, particularly in the energy sector":

Section about Venezuela in the 2007 Strategic Mission List
(Click to enlarge)

Economic or commercial espionage?

The Intercept makes a point out of NSA targeting a petroleum company "for economic espionage" - earlier disclosures had already brought up the names of the Brazilian company Petrobras and Gazprom from Russia. Why that should be a problem isn't explained however: all three companies are government-controlled and oil is an issue of strategic interest for almost any country.

The website also cites US Director of National Intelligence James Clapper, who explained the difference between gathering intelligence on economic issues for government policy makers (which the US admits doing), and stealing trade secrets of foreign companies to help individual American corporations (which the US strongly denies doing). And in this case, there's (again) no evidence for the latter.


Collaboration

The story of the analyst then continues with that he met with the Target Office of Primary Interest (TOPI) responsible for Venezuelan targets, in order to "re-assure myself that we were both on the same page in regards to our goals". A TOPI consists of analysts who analyse the communications that come in as a result of the collection process and who prepare the intelligence reports.

These first steps show that NSA analysts work within a bureaucratic framework that requires collaboration with colleagues and superiors who make sure their activities are in accordance with the goals set by the government - as a rule, they're not free to target anyone at will, which is the impression people can get when listening to Edward Snowden.


Get started

The TOPI analyst wanted information from the highest level of PdVSA, i.e. from the president and members of the Board of Directors, as much of it as possible in the form of internet communications, which, unlike phone calls, don't have to be transcribed. Also there was no time for "extensive target development".

Then the SIGDEV analyst started his work. He first visited the PdVSA website on the internet for the names of the Board of Directors. He put them into a new document in Analyst's Notebook, which is an analysis tool widely used by intelligence and law enforcement agencies all over the world.

Demonstration of a "Pattern-of-Life Analysis" using Analyst's Notebook

Sigint already-collected

The next step was looking at what had already been collected about his targets. For this he first accessed the PINWALE database, which is NSA's main repository for all kinds internet content that was collected by using specific selectors (i.e. no bulk content collection).

A few queries, using the names he had found on the website, returned not much of interest: a lot of e-mails in which these persons were "cc-ed", but hardly anything to or from them personally. This also provided some e-mail addresses, but the analyst already knew these.

He entered the mail addresses into CADENCE, which is NSA's tasking tool for internet communications, and also into the Unified Targeting Tool (UTT). This would show whether these e-mail addreses were already tasked, which means whether the actual collection facilities had been instructed to collect the related communications.


Finding new selectors

Apparently collection against PdVSA did take place in the past, as PINWALE kept providing documents containing the target's names. This weren't communications, but some kind of information forms with contact details and organizational information about PdVSA employees.

The analyst says that these forms were similar to what is in NSA's SEARCHLIGHT database, which is the agency's internal personnel information system. As these information forms mention who within PdVSA is somebody's supervisor, they resulted in a whole tree of entries and names:

Internal PdVSA information form which shows president of the board
Rafael Ramirez as supervisor of another board member, Luis Vierma

Lots of them

The new selectors include business and private e-mail addresses and work, home and cell phone numbers. The newly found e-mail addresses could again be entered into CADENCE and the UTT, while the phone numbers could be used to enter them in OCTAVE, which is NSA's tasking tool to initiate the interception of telephone conversations. It's not said whether this happened or not - the TOPI analyst at least didn't prefer phone calls.

The Intercept writes that NSA apparently "collects so much communications data from around the world that it often fails to realize what it has". This however applies to most intelligence and law enforcement agencies that conduct automated eavesdropping: there are often way too many phone calls to listen in to, let alone digital communications to translate, read and analyse.


Internal network

When the SIGDEV analyst was analysing the PdVSA forms (of which there were over 10.000 in the PINWALE database), he discovered that they all came from IP addresses starting with 10.x.x.x and 172.18.x.x, which are from address ranges that are reserved for use within private networks. The analyst now realised these entries came from the internal PdVSA network, and not from communications over the public internet.

One of the most interesting details of this whole story is how NSA had been able to get access to PdVSA's internal network - which isn't told in the report by The Intercept, but only in the one from teleSUR...

Front side of the US embassy in Caracas, Venezuela
(Photo: Yongo @ SkyScraperCity.com)

Special Collection Service

After the analyst discovered that he was looking at information from the internal PdVSA network, he "fired off a few emails to F6 here and in Caracas, and they confirmed it!"

F6 is the NSA's internal designator for the Special Collection Service (SCS) units in which specialists from NSA and CIA cooperate against targets that require "close access". These units operate out of some 80 US embassies all over the world.

This means it was the SCS unit from the US embassy in Caracas that had been able to get access to the internal network of PdVSA. The story doesn't tell how they did this, but probably they found a way to secretly tap a network cable or switch over which the oil company's computer network runs. If this access was still active, it has now has certainly been compromised.


SCS operations

From an earlier revelation we know that the SCS unit in the US embassy in Berlin was responsible for eavesdropping on the (non-secure) mobile phone of German chancellor Merkel. Maybe that was also done by tapping a local telephone network, or by just intercepting the cell phone's airwave signals.

For such wireless interception operations, many US embassies have a rooftop structure that conceals sophisticated antenna and other eavesdropping equipment. Such a structure is also clearly visible on the roof of the US embassy in Caracas:

Back side of the US embassy in Caracas, with the rooftop structure
(Photo: Carlos Garcia Rawlins/Reuters - Click to enlarge)

XKEYSCORE

After finding out the source of those PdVSA forms, the SIGDEV analyst started to coordinate his work with the F6 unit in Caracas. Apparently they fed data from their network access into XKEYSCORE, which is NSA's system to buffer, index and search internet communications, not only from large submarine cables, but also from smaller accesses, like from the SCS units.

This enabled the analyst at NSA headquarters to search through a rolling buffer of several days worth of content, which is especially useful to find files which aren't directly associated with hard selectors like e-mail addresses.

This resulted in "several juicy pdf documents" and one of them was eventually used for preparing a serialized report (number 3/OO/505480-11) dated January 2011 and titled "Venezuela State-Owned Oil Company Information Shows a Decrease in Overall Oil Thefts and Losses" - which doesn't sound like a trade secret that would benefit individual US oil companies, but on the other hand shows that such high-level accesses are also used for rather general intelligence information.


Hacking opportunities

Through XKEYSCORE, the analyst also found over 900 username and password combinations of PdVSA employees, which he handed over to NSA's hacking division, Tailored Access Operations (TAO). With a username and password one doesn't have to "break in" into a network, which makes the access almost impossible to detect.

The analyst also provided TAO with some other data along with a targeting request, especially aimed at getting access to the e-mail boxes of the PdVSA board members.


It is not known whether this was successful, but The Intercept and teleSUR mention that in May 2011, which is two months after the analyst's story in SIDtoday, the US State Department announced sanctions to be imposed on PdVSA because it had delivered at least two cargoes of reformate (used to produce gasoline) to Iran between December 2010 and March 2011, worth approximately $ 50 million.



> See also: An NSA eavesdropping case study about targeting the presidents of Mexico and Brazil.

Unnoticed leak answers and raises questions about operation Eikonal

(Last edited: November 23, 2015)

Almost unnoticed, the Austrian member of parliament Peter Pilz recently disclosed new information about operation Eikonal, under which NSA and BND cooperated in tapping some fiber-optic cables at a switching center of Deutsche Telekom in Frankfurt, Germany.

As part of the NSA umbrella program RAMPART-A, Eikonal was set up to gather intelligence about targets from Russia, the Middle East and North-Africa. Because the cables that were tapped came also from countries like Austria, Switzerland, France, Belgium and the Netherlands, there were fears that their communications were intercepted too.

Here, the newly disclosed information will be discussed and combined with things we learned from the hearings of the German parliamentary commission that investigates NSA spying, including operation Eikonal.

> See also: New details about the joint NSA-BND operation Eikonal

Overview of the joint NSA-BND operation Eikonal (2004-2008)
(Click to enlarge)

Leak

The new information comes from transcripts of some fax and e-mail messages from employees of BND, Deutsche Telekom and the federal Chancellery, which Peter Pilz published on his website on October 23, 2015.

He never told how he got these highly sensitive documents, but as they were made available to the parliamentary inquiry commission, it seems most likely someone from or very close to this commission must have leaked them to Pilz. Strangely enough, this leak was never investigated.


Media attention

Also remarkable is that the information and documents disclosed by Peter Pilz were almost completely ignored by mainstream German media like ARD and ZDF and the major newspapers. The latest disclosure was for example only reported by the Austrian paper Der Standard and the German tech website Heise.de.

By contrast, in neighbouring countries like Austria, Belgium and the Netherlands, the Pilz revelations were big news and led to official investigations. Through May and June of this year, he had published lists of communication links related to Switzerland, France, Luxembourg and Poland too, claiming they showed to what extent BND and NSA spied upon these countries.

First part of the list with communication links related to France
(Source: Peter Pilz - Click to enlarge)

Whose's links?

Initially, Peter Pilz claimed these links were from a priority list of the NSA, but neither he, nor the commission hearings could clearly confirm this. The Dutch website De Correspondent reported that there was even a much larger list of some 1000 transit links, of which ca. 250 were marked in yellow.

Now, Pilz confirms that there's indeed such a large list: it was prepared by Deutsche Telekom and contains all its 1028 transit links. Employees of BND had marked 256 of them in yellow, apparently the ones they were most interested in, and hence the list became known as the BND priority list. He doesn't mention an involvement of NSA at this stage anymore.

Now that we know the large list of over 1000 links isn't an even larger "wish list", but a list of all available transit links, it could well be that BND tried to select around 20% of them, as a rather strange provision in German law says that bulk collection is only allowed up to a maximum of 20% of a cable's capacity.

As Telekom Austria rented the channels to Vienna, we can assume that other national telecommunication providers also rented their links to Frankfurt, with Deutsche Telekom being the owner of the cables as part of their international backbone network.


Determining the access points

After BND selected the 256 channels, Deutsche Telekom had to look which of them ran through Frankfurt and could be intercepted there. For this purpose Harald Helfrich of the lawful interception unit of Deutsche Telekom AG (DTAG) sent his collegue mr. Tieger the following e-mail on September 16, 2003:

Hallo LK,

wie heute morgen besprochen übersende ich Ihnen die Liste der Transit-Leitungen der DTAG. Wir bitten Sie die gelb unterlegten Verbindungen bzgl. ihrer Führung (z.B. Ffm 21 oder Norden-Nordeich) und ob in der 2-Mb-Ebene greifbar, zu analysieren.

Anlage: Trans mit ausgesuchten Strecken

In this mail it is asked to analyse whether the transit channels marked in yellow can be intercepted at the 2 Mbit-level, either at Deutsche Telekom's Frankfurt am Main Point-of-Presence 21 (Ffm 21) or at Norden-Norddeich.

The latter is a town at the northern coast of Germany, where the SeaMeWe-3 and TAT-14 submarine cables land. For the parliamentary commission this was a reason to ask whether also cables where intercepted over there, but that was strongly denied by the witnesses involved.


Selecting individual channels?

Interestingly, the phrase "ob in der 2-Mb-Ebene greifbar" suggests that it could be possible to just intercept specific 2 Mbit/s channels while leaving the other ones untouched (one physical STM1-cable has a data rate of 155 Mbit/s and contains 63 virtual channels).

Whether this is possible is important for how focused such cable tapping can be. Isolating individual channels depends in the first place on where exactly the tapping takes place:

A. When the physical fiber is intercepted before it reaches the switch, it has to be bend in order to catch the light that leaks. Because this leaking signal is much weaker, it has to be amplified before it can be processed. In this way it's not possible to select individual channels: the eavesdropper gets everything that runs over the fiber, and has to demultiplex the channels himself to select the ones that contain traffic of interest.

Splitting a traffic from a fiber-optic cable by bowing it
(diagram: OSA Publishing, slightly simplified)

B. When the interception takes place at an optical switch itself, then it's possible to only grab the virtual channels you are interested in. A physical cable contains channels which have to be demultiplexed at the switch in order to be forwarded (switched) to the fiber that leads to the intended destination. When the switch converts the optical signals into electronic signals it is even more easy to duplicate only individual channels of interest.

Diagram showing (de)multiplexing at a fiber-optic switch
(diagram modified from Wikimedia Commons/Jflabourdette)

Different methods

During the commission hearing of March 26, 2015, Klaus Landefeld, board member of the DE-CIX internet exchange, indicated that at least since 2009, interception takes place at the switch. Also, the so-called G10-orders authorise interception based upon Autonomous System Numbers (ASN) which are used for logical paths, rather than by naming physical cables to or from a certain city.

However, it seems that under operation Eikonal, the fiber-optic cables were tapped by splitting the cable signal before it reached the switch. This was more or less clearly indicated by several witnesses heard by the parliamentary commission, and there are several other indications too.

In 2004, it was apparently not yet possible to establish a tap at the switch itself to get access to individual channels (although Deutsche Telekom could have demultiplexed the fiber and only forward the channels of interest to BND, but this wasn't the case).


Government authorisation

After BND had made clear what they wanted, the Deutsche Telekom management wasn't sure whether such cable access was legal. Therefore they wanted to be backed by the federal Chancellery. On December 30, 2003, the coordinator for the intelligence services at the Chancellery, Ernst Uhrlau, sent the following fax message to Kai-Uwe Ricke, then CEO of Deutsche Telekom, and Josef Brauner, head of the landline division T-Com:

Sehr geehrter Herr Ricke, sehr geehrter Herr Brauner,

das Bundeskanzleramt ist sehr interessiert, dass der Bundesnachrichtendienst im Rahmen seines gesetzlichen Auftrages kabelgestützte Transitverkehre aufklärt. Der vom Bundesnachrichtendienst in Ihrem Unternehmen geplante Aufklärungsansatz steht aus hiesiger Sicht in Einklang mit geltendem Recht.

Ich darf auf diesem Weg die Anregung des Bundesnachrichtendienstes weitergeben, in der Deutschen Telekom AG, T-Com, den Bereich RA 43 (Staatliche Sonderauflagen), zu dem bereits im Rahmen der Strategischen Fernmeldekontrolle Kontakte bestehen, mit der Durchführung der auf Seiten der Deutschen Telekom AG erforderlichen Maßnahmen zu beauftragen.

It says that in the opinion of the Chancellery, the proposed BND operation is according to German law. The Chancellery encourages Deutsche Telekom to instruct its lawful intercept unit RA 43 (which is one of four Regionalstellen für staatliche Sonderauflagen or ReSA) to start taking the necessary measures for the interception.


Transit Agreement

On behalf of the board of Deutsche Telekom, Josef Brauner answers the fax from the Chancellery on January 13, 2004. He says the T-Com division is aware of the importance of a well-functioning intelligence service, and will therefore support the interception of cable-bound transit traffic:

Sehr geehrter Herr Ministerialdirektor,

gerne bestätigen wir Ihnen den Erhalt Ihres Schreibens vom 30. Dezember des letzten Jahres.

Die T-Com ist sich der Bedeutung eines gut funktionierenden Nachrichtendienstes für das Gemeinwesen der Bundesrepublik Deutschland - insbesondere vor dem Hintergrund der terroristischen Angriffe des 11. September 2001 - bewusst und wird daher die geplanten Aktivitäten des Bundesnachrichtendienstes, die kabelgestützten Transitverkehre im Rahmen seines gesetzlichen Auftrages aufzuklären, unterstützen.

Entsprechend der Anregung des Bundesnachrichtendienstes wird diesseits unser Bereich RA43 (staatliche Sonderauflagen) beauftragt, die hierfür von unserer Seite erforderlichen Maßnahmen vorzunehmen

Then on March 1, 2004, the BND and Deutsche Telekom signed the so-called Transit Agreement (pdf), in which the latter agreed to provide access to its transit cables, and in return will be paid 6.500,- euro a month for the expenses. This agreement was also leaked to Peter Pilz, who published it on May 18, 2015 in the Austrian tabloid paper Kronen Zeitung.


Preparing for collection

After the agreement had been signed, BND sent an e-mail on March 9, 2004 to Wolfgang Alster, head of Deutsche Telekom's lawful interception unit RA 43 asking for the connection (schaltung) of the first communication links. He adds that he had ordered the payment of the first two monthly payments:

Schaltauftrag

DTAG RA 433

Hallo Herr Alster,

Der Geschäftsbesorgungsvertrag "Transit" ist ja jetzt von beiden Seiten unterzeichnet und gestern habe ich die beiden ersten Monatszahlungen veranlasst.

Daher erdreiste ich mich, Sie um die erste Schaltung von Leitungen zu bitten.

Realising the access was apparently not that easy, because it took until December 2004 before the first cable was connected. Then it appeared that it's signal was too weak, so in January 2005 an amplifier was installed - as the parliamentary commission was told by S.L., who was the BND project manager for Eikonal (note that the use of an amplifier indicates tapping the entire fiber-optic cable).

At this first stage of operation Eikonal, only circuit-switched (Leitungsvermittelte) telephone communications were intercepted. Collection of packet-switched (Paketvermittelte) internet communications started in 2006 (see below).


RUBIN

On February 3, 2005, mr. Knau mailed his colleague Harald Helfrich at the RA 43 unit that an STM1-link between switching center Frankfurt 21 and Luxembourg had been connected. Channels 2, 6, 14, and 50 contained the virtual channels that had Luxembourg as their endpoint:

Hallo Herr Helfrich,

Habe heute früh die o.g. Verbindung auf die Punkte 71/00/002/03 19 + 39 zugeschaltet. In der Anlage ist die Belegung lt. RUBIN ersichtlich.

Auf den Kanälen 2, 6, 14, 50 befinden sich die in der Liste markierten DSVn mit der Endstelle Luxembourg.

Bitte um Rückmeldung ob das ganze funktioniert.

Anlage: Belegung 7571 Luxbg

We also see the term RUBIN (German for ruby), and during the commission hearings it seemed that this was an alternate codename for operation Eikonal. But when heard on January 15, 2015, Harald Helfrich explained that RUBIN is actually a system that Deutsche Telekom uses to manage its communication links and cables - which perfectly fits how the term is used in this e-mail.


Channels of interest

The next e-mail is also from February 3, 2005, but was already published by Peter Pilz on May 15, 2015 and is the only one that is available in what seems to be its original form. It's from Harald Helfrich, who informs a mr. Siegert at the BND that mr. Knau had connected an STM1-link earlier that morning (see previous e-mail). He says it contains the channels that were on the BND priority list:

This e-mail says that BND was interested in the following 2 Mbit/s channels from the Transit STM1-cable "Ffm 21 - Luxembourg 757/1":

Channel 2: Luxembourg/VG - Wien/000 750/3
Channel 6: Luxembourg/CLUX - Moscow/CROS 750/1
Channel 14: Ankara/CTÜR - Luxembourg/CLUX 750/1
Channel 50: Luxembourg/VG - Prague/000 750/1

According to Peter Pilz, additional cables were connected on February 14 and 25, as well as on March 3, 2005. Unfortunately, he either doesn't possess or didn't disclose the related e-mails, so we still don't know how many and which channels have actually been intercepted.

The interception of telephony communications therefore started in the Spring of 2005, which means that collection under Eikonal only lasted for 3 years, and not 4 years, when one would count from signing the agreement in 2004 until the end of the operation in 2008.


Ending telephone interception

Peter Pilz published the transcripts of two more e-mails, which are about ending the telephone interception. On May 27, 2008, mr. Thorwald from Deutsche Telekom sent the following message to his colleague Harald Helfrich, informing him that fully circuit-switched transit traffic isn't supported anymore. Therefore, the extraction of transit traffic at the company's premises can be terminated:

Sehr geehrter Herr Helfrich,

Wie wir bereits telefonisch besprochen, teile ich Ihnen mit, dass die Verarbeitung von reinen leitungsvermittelten "Transit-Verkehren" von uns nicht mehr durchgeführt wird.

Aus diesem Grund kann die Ableitung der Transit-Verkehre in unseren Betriebsräumen eingestellt werden.

Im leitungsvermittelten Bereich (Ableitung auf höherer Ebene) besteht aktuell der Bedarf zur Ableitung von folgenden Verkehren:

+ 2 x STM-64
+ 4 x STM-16

After that, Thorwald writes that there's currently a need to extract the traffic of two STM-64 and four STM-16 cables, which have a data rate of ca. 10 Gbit/s and 2,5 Gbit/s respectively. This is also said to be circuit-switched, but "extraction at a higher level".


Anomalies

If we assume that Peter Pilz provided the correct date for this e-mail, it's strange that there was apparently a need for new cable accesses, hardly a month before operation Eikonal was officially terminated (June 2008).

Even more strange is that the e-mail says the new accesses are also circuit-switched (leitungsvermittelt), while during the hearings it was testified that the collection of such telephone communications ended in January 2007, after Deutsche Telekom fased-out its business model for dedicated transit cables. This e-mail brings that message almost 1,5 years later!


Internet access

From the commission hearings we also learned that BND wanted access to internet traffic too, which is packet-switched (Paketvermittelt). For this, the first cable became available by the end of 2005, but it took some months before the backlink was also connected. In the spring of 2006 a second cable was added, and the front-end system and the filters were tested until mid-2007.

Could it be that mr. Thorwald just made a mistake, and wrote "leitungsvermittelten" where he meant "paketvermittelten"? But even then, why add new internet cables, just before the operation was ended?


Another question

A similar anomaly can be found in an e-mail, that according to Peter Pilz, was sent one day later, on May 28, 2008. In it, mr. Knau informed Harald Helfrich and his superior Wolfgang Alster that the access to four STM1-cables can be terminated immediately.

Given what was said during the commission hearings, one would have expected that this also had happened already in January 2007, instead of May 2008. It seems some things don't add up here.

Wie bereits fernmündlich besprochen, können nachfolgende STM1-Zuschaltungen mit sofortiger Wirkung aufgehoben werden:

Ffm 21 - Stuttgart 10 757/22A
Ffm 21 - Paris 757/1
Ffm 21 - Reims 757/1
Ffm 21 - Luxembourg 757/1

Physical cables

Unlike the numerous virtual channels in the lists, this e-mail is about physical cables. "Ffm 21 - Luxembourg 757/1" is the one mentioned in the e-mail from February 3, 2005, containing 4 channels of interest to Luxembourg; the others are cables from Frankfurt (Ffm) to Reims, Paris, and Deutsche Telekom's Point-of-Presence in Stuttgart. With this, we now have proof of 3 other cables having been tapped.

According to a list (.docx) publiced by Peter Pilz, there are 29 channels to/from Reims and 22 channels to/from Paris, all of which could easily have been in the fiber-optic cable between Frankfurt and Reims, and Frankfurt and Paris, respectively, as one single STM1-cable contains 63 separate channels:

Frankfurt - Stuttgart: ? channels of interest
Frankfurt - Paris: 22 channels of interest
Frankfurt - Reims: 29 channels of interest
Frankfurt - Luxembourg: 11 channels of interest

Peter Pilz concludes that operation Eikonal was the start of NSA's illegal mass surveillance of European telecommunications. But that's not supported by evidence. After Eikonal, NSA continued joint cable tapping operations with BND and other European agencies, but as these programs are part of RAMPART-A, they are mainly aimed at specific targets in Russia, North-Africa and the Middle East.*


BND cable tapping

Operation Eikonal did start something else though: it provided BND with the knowledge and the experience for conducting cable tapping on its own: in 2009 they started intercepting cables from 25 internet service providers, this time at the DE-CIX internet exchange in Frankfurt - as was revealed by Der Spiegel on October 6, 2013.

Among these 25 providers are foreign companies from Russia, Central Asia, the Middle East and North Africa, but also 6 German providers: 1&1, Freenet, Strato AG, QSC, Lambdanet and Plusserver, who almost exclusively handle domestic traffic.

It appears that this interception takes place in cooperation with the DE-CIX Management and that the various providers themselves didn't knew that this was happening. A smart move, as this provides BND with just one single point-of-contact, while the indivual providers can honestly deny that their cables are being intercepted.



Links and sources
- Heise.de: BND-Operation Eikonal: "Freibrief" für die Telekom aus dem Kanzleramt
- DerStandard.at: Pilz: Berlin genehmigte NSA-Spionage gegen Österreich
- PeterPilz.at: "Ich darf die Anregung weitergeben..." Die Operation Transit in Europa

New details about the selectors NSA provided to BND

(Updated: December 7, 2020)

Since last Spring, the German parliamentary commission investigating NSA spying is trying to find out whether the Americans secretly tried to spy on German and European targets.

During the hearings it became clear that the German foreign intelligence service BND wasn't able to fully prevent that selectors, like e-mail addresses and phone numbers, provided by the NSA, were fed into the collection system.

A special investigator was allowed access to the lists of rejected selectors and he reported about his findings last week. Here follows the background of this affair and the most important and interesting details from the investigation report.

> Many more details pieced together from the commission hearings can be found here

The BND satellite intercept station at Bad Aibling, Germany
(Photo: AFP/Getty Images)

Satellite interception

The origins of the selector affair go back to 2004, when the Americans turned their satellite intercept station Bad Aibling over to German intelligence. In return, BND had to share the results from its satellite collection with the NSA, for which the latter provided selectors, like e-mail addresses, phone numbers, etc. of the targets they were interested in.

Besides the satellite interception, Bad Aibling was also involved in cable tapping, but only under operation Eikonal (2004-2008), which was limited to cables from Deutsche Telekom in Frankfurt.

Until 2013, NSA is said to have provided some 690.000 phone numbers and 7,8 million internet identifiers. As a foreign intelligence service, BND is not allowed to collect German communications, let alone hand them over to NSA. In order to prevent that, BND tried to check all these selectors, initially by hand, but since 2008 by using a automated filter system called DAFIS.


Blocking German selectors

During a number of tough and lengthy hearings of the parliamentary commission that investigates NSA spying, BND employees had to admit that DAFIS was only able to defeat selectors that were clearly recognizable as belonging to Germans, like mail addresses ending with .de or phone numbers starting with (00)49.

There was hardly any effort to sort out selectors related to other European countries. Also the foreign e-mail addresses, like from Hotmail or Google, used by Germans were only blocked when someone at BND stumbled upon them. Although these kind of selectors could have been blocked more systematically, it's impossible to enter all relevant ones into the DAFIS filter.

This means, when NSA targeted such foreign addresses, the chances they were rejected by DAFIS are not very high and will therefore have been activated on the collection system. Such selectors went into the tasking database, without practicable or reliable means to identify and block them.


Rejected selectors

When the DAFIS system found recognizable German selectors, they were marked as disapproved and not entered into the collection system, so they could not lead to any results.

Initially it seemed that these rejected selectors were put into a separate repository (German: Ablehnungsdatei, also Ausschussliste), but actually they stayed in the tasking databases and were only extracted for the purpose of the parliamentary inquiry.

This resulted in a list of almost 40.000 rejected selectors. An investigation by BND employee Dr. T. in August 2013, revealed almost 2000 e-mail selectors that had been activated, but now seemed politically sensitive. A simultaneous investigation by W.O. resulted in over 10.000 e-mail selectors belonging to European government agencies.

Overview of the dataflow for the NSA-BND cooperation at Bad Aibling
(Click to enlarge)

Special investigator

Members of the parliamentary investigation commission were eager to see those selectors, but they are sensitive and classified, so the government denied them access. Finally, a compromise was made, under which an independent special investigator was allowed to examine the lists of rejected and suspicious selectors and report back to the commission, without disclosing individual targets.

The coalition parties agreed upon Dr. Kurt Graulich, a former judge at the Federal Administrative Court, for this job. During the past 4 months he examined the selector lists and finished his investigation on October 23 with a report, which was presented in three versions on October 29:

- A classified report for the federal government
- A classified report for the commission
- A public report (263 pages pdf)

Report by special investigator Dr. Kurt Graulich
(Click for the full report in .pdf)

Selector lists

Special investigator Graulich examined the following lists (German: Liste) of selectors that had been rejected by the DAFIS filter, or sorted out by hand because they were considered politically sensitive:

a. The Ablehnungsliste, containing 39.082 selectors (2.918 from the telephony and 36.164 from the internet tasking database) from 2005 till March 2015.

Including most parts of:

b. The 2000er-Liste, containing 1.826 e-mail selectors, which were found in August 2013 by Dr. T. and subsequently marked as disapproved.

c. The 2005er-Liste, containing 74 telephone selectors (52 belonging to EADS, 22 to Eurocopter), which were found by the end of 2005 and were marked as disapproved in January 2006.

d. The Nachfund 1, containing several lists with a total of 444 telephone selectors that were found by semi-manual checks in 2007 and were all marked as disapproved.

e. Not available anymore were between 10.000 and 12.000 e-mail selectors that were found by BND employee W.O. when he checked the tasking database for terms related to European government agencies. He found results for 18 EU member countries and these selectors were marked as disapproved.

Types of selectors

By examining the largest list of rejected selectors (Ablehnungsliste), Dr. Graulich found that it contains the following types of selectors:

For telephony:
- IMSI: Numbers of cell phone SIM cards
- IMEI: Numbers of cell phone devices
- SCREENNAMES: User names or numbers, mainly used for VoIP calls.
- EMAIL_ID: E-mail addresses, mainly used for VoIP calls
- PSTN: Phone and fax numbers

For internet:
- EMAIL_ID: E-mail addresses without permutations
- IMEI: Numbers of cell phone devices
- IMSI: Numbers of cell phone SIM cards
- IPV4: IP addresses
- PSTN: Phone numbers
- OTHER: For example user names, messenger or social network identifiers, cookies, login-data, phone numbers, hashes, etc.

In the tables that contain telephone selectors there's also a field for a description, like a text explaining the reason for targeting, a code or an abbreviation like CT for Counter-Terrorism.

For internet selectors, these descriptions were only visible for NSA personnel, but due to technical reasons not for BND and are therefore not available anymore. Because they lacked justifications, BND stopped using NSA provided internet selectors for the time being as of May 2015.

Keywords were also used as selectors, but according to the report, they are rarely used, because they have to be very specific. Generic words like "bomb" would produce way too many irrelevant results.

It's not clear whether PSTN only applies to traditional land line phone numbers, or also includes mobile phone numbers (known as MSISDN).


Telephone selectors

Together with experts from BND, special investigator Graulich examined all the selectors on these lists and tried to determine the reason for which they were originally rejected. Most important is the Ablehnungsliste, with the selectors that had been filtered out by the DAFIS system.

Most of the telephone selectors appeared to have been rejected because they belonged to German persons or companies and/or contained .de or (00)49. The e-mail addresses for VoIP calls were all blocked because they had no top-level domain - selectors that could not be attributed to a country were rejected.

Update:
On the website Netzpolitik.org it was noticed that for VoIP, one doesn't use e-mail addresses, but SIP addresses, which do have a similar format, like 3246697@voipprovider.com, but which are often under generic top-level domains. Also, blocking IMEI addresses containing "49" wouldn't be very effective, as there are other codes used for Germany, and phones may be sold throughout the European Union.

Some telephone selectors were also not activated because the description field contained terms like for example "German", "Germany" and "Europe".


Permutations

For one internet identifier, like for example an e-mail address, there are multiple permutations, each of which is counted as a separate selector. There can be up to 20 different permutations for one identifier, which explains the very high total number of internet selectors (7,8 million), compared to those for telephony (690.000).

Such a permutation is used to address the various encoding protocols used on the internet. The report gives the following examples:

mustermann@internet.org
mustermann%40internet%2Eorg (HTML-Hex)
mustermann\&\#37;2540internet.org (multiple encodings)
mustermann\\U0040internet.org (UTF-16)

Taken together, all permutations of an internet address are called a Telecommunications Identifier (German: TeleKommunikationsMerkmal or TKM). For telephony, the TKM equals the selector, in other words, there are no permutations for phone numbers.


Internet identifiers

Many internet selectors were rejected by the DAFIS filter system because they belonged to German persons or companies, contained German codes like .de and (00)49, or names of German companies. Also a number of IP addresses had been rejected, but it wasn't possible to determine why. They now belong to providers outside Europe.

The investigator could also not determine what the reasons had been for blocking the remaining internet identifiers, like user names, messenger or social network identifiers, cookies and login-data. NSA provided them combined with other selectors in a so-called equation, but BND separated these for DAFIS filtering, which makes it impossible now to relate them to identifiable selector types.


Numbers

Of the Telecommunications Identifiers (TKMs) found in the main Ablehnungsliste with the rejected selectors, 62% belong to government agencies of EU member states, 19% to Germans outside Europe, 7% to EU institutions, 6% to Germans, 4 to foreigners abroad, 1% to Germans in Europe and 1% to German embassies.

For all selector lists, the reasons why the selectors were apparently rejected can be found in this table:

Table with the reasons why BND rejected certain NSA selectors
(Table: Graulich report; Translation: Electrospaces.net; Click to enlarge)

German targets

The examination of the selector lists revealed that NSA provided several hundred selectors related to Germans, but most of them were blocked by the DAFIS filter. Around 250 had been active for a shorter or longer period of time, but it is not known whether this resulted in communications being collected.

As the 2002 Memorandum of Agreement (MoA), under which the cooperation at Bad Aibling was established, prohibits targeting Germans, the German selectors that had been activated are a violation of the agreement, and moreover also a violation of German law.

The rejected selectors are mainly about German companies, both inside Germany and outside Europe. Without knowing the reasons for targeting these companies, it cannot be said whether this would constitute economical espionage. Construction companies for example can be involved in both civilian and military projects (so-called dual-use).


WikiLeaks' lists

It is interesting to see that there are no rejected selectors that belong to German cabinet ministers. This means, NSA wasn't so stupid to send BND the list of selectors that contains the phone numbers of chancellor Merkel, several ministers and high-level federal government officials - a list that was published by WikiLeaks last July.

Even more interesting would be to know whether the rejected selectors contain the phone numbers of the French prime minister and his cabinet ministers, which were on a similar tasking database list that was published by Wikileaks in June. Special investigator Graulich wasn't able to determine this, because Wikileaks redacted the last four digits of the phone numbers.

> About this list: Wikileaks published some of the most secret NSA reports so far

European targets

The biggest number of rejected selectors are e-mail addresses (and some other internet identifiers) of European government agencies: 22.024 selectors, being the permutations of 2195 telecommunication identifiers (TKMs).

The overwhelming majority of them was only blocked after August 2013, when the public outrage over NSA spying began. First, selectors were disapproved after the investigations by Dr. T. and W.O., and in November, BND president Schindler ordered all e-mail addresses with a European Top-Level Domain (TLD) to be removed from the BND and NSA tasking database.

Before that new directive, the DAFIS filter wasn't configured to block these European selectors:

- Stage 1 of this system only blocked things like the German TLD .de, the telephone country code (00)49 and the IMSI country code 262;
- Stage 2 blocked foreign identifiers when BND noticed that they were used by German citizens or German companies;
- Stage 3 blocked an initially small number of foreign identifiers that should not be activated because that would be against "German interests".

This means that until the end of 2013, the e-mail addresses belonging to European governments had been active in the collection system: 12% of them for up to 100 days and 87% for an even longer period of time.


Violation

Foreigners and especially foreign government agencies, have no right to privacy under the German constitution, so the collection of their communications is not a violation of German law. But investigator Graulich does consider the targeting of European governments a violation of the Memorandum of Agreement, which allows collection against European targets only for a very few specific topics.

Although the reasons why NSA was interested in these subjects are not known, the investigator judges that the broad targeting of European governments (like e-mail addresses of all members of government staff bureaus) is far beyond what the memorandum allows, and therefore this constitutes a severe violation of the agreement.


Embarrassment

Graulich also says that NSA apparently misused the Bad Aibling satellite station to spy on other European countries - risking an embarrassment for Germany in its relationship with EU and NATO partners.

However, BND itself also targeted for example the British embassy in India and the French embassy in Mali, and eavesdropped on the US Defense and Foreign secretaries as well as senators, when they used non-secure phone lines while traveling.

When in November 2013, BND searched through its own tasking database (PersonenBezogene DatenBestände, or PBDB), it came out that it too contained some 2800 selectors belonging to friendly nations. They were subsequently deleted, but this was kept quiet for almost 2 years.

Updates:

On November 11, 2015, it was reported that a preliminary report by the investigation team of the parliamentary intelligence oversight committee says that among BND's own selectors, there were ones belonging to the FBI, the Voice of America, French foreign minister Fabius and the interior departments of EU member states like Poland, Austria, Denmark and Croatia. Also targeted were international organizations like the ICC, the WHO and UNICEF. The selectors also included e-mail addresses, phone and fax numbers of the diplomatic representations of the US, France, Great Britain, Sweden, Portugal, Greece, Spain, Italy, Austria, and Switzerland, as well as European and US companies like for example Lockheed.

On November 26, 2015, Albert Karl, an official from the federal Chancellery, testified that European governments are not among the official goals which the government set for BND's intelligence mission (German: AufgabenProfil der Bundesregierung or APB). It's of course possible that European citizens are targeted because they are involved in terrorism or weapon proliferation.

On December 16, 2015, German media reported that at least 3 BND-employees, including SIGINT-director Hartmut Pauland, will have to resign. This after the regular parliamentary intelligence oversight committee found that BND had some 3300 targets, including EU institutions and governments, that were not according to the goals set by the government and therefore illegal. In the future, politically sensitive selectors will have to be approved by the BND leadership.

Crisis regions

One last thing that should be mentioned is that at Bad Aibling, the collection effort is directed at (the downlinks of) satellite links from crisis regions like the Middle East, Afghanistan and Africa. This means, that if NSA deliberately provided BND all those selectors of European government officials, they should have known that they couldn't result in their day-to-day business communications.

This is also described in the Graulich report: selectors for targets in Europe will only result in the actual interception of communications when they come from one of the satellite links from those crisis regions. This provides only a small number of intercepts compared to tappping the backbone cables through which the communications for these selectors usually travel.*

The interception of the satellite links in Bad Aibling would probably only provide content when European government officials communicate with their counterparts or other people in the aforementioned crisis regions. And maybe it was just that what NSA was after - an option that was not considered in the report though.


Reactions

In a first reaction on the report, the German government said that there will be stricter guidelines for the cooperation between BND and NSA, and also that oversight by the federal Chancellery will be increased. Opposition party members of the commission aren't fully satisfied with the report and still want access to the rejected selectors, as well as an examination of all 8 million selectors that NSA provided to BND.

Hearings

On Thursday, November 5, special investigator Dr. Kurt Graulich was heard by the parliamentary investigation commission about his findings. This hearing didn't provide any significant new insights.

The other witness that day, BND lawyer Dr. Werner Ader, revealed that at Bad Aibling, there's highly sophisticated equipment, which allows the interception of satellites even under difficult circumstances, like coping with atmospheric disturbances and following non-geostationary satellites. The equipment "can follow what happens at the satellite".

Update
In the German magazine Der Spiegel from April 2, 2016, it was explained on page 33 that selectors used by BND have the following format: they start with an e-mail address, a phone number or a similar designator, followed by the intelligence topic, with WPR for Waffenproduktion, LAP for Landwirtschaftspolitik, TEF for Terrorfinanzierung and ISG for Islamistische Gefährder, then the country which is spied upon, designated by 3 letters, and finally a Sperrvermerk for those foreign intelligence agencies that should not see the results for this selector. They are designated with a 4-letter abbreviation of their codename, like HORT for HORTENSIE (United States) or BEGO for BEGONIE (Denmark).

Links and sources
- Yahoo News: Germany reins in spy service over NSA report
- Netzpolitik.org: Kein Ersatz für Selektorenliste: Abgeordnete Renner und von Notz über Graulich-Bericht
- Spiegel.de: Geheimdienstaffäre: Sonderermittler spricht von klarem Vertragsbruch der NSA

NSA's Legal Authorities

(Updated: May 22, 2026)

Since the start of the Snowden-revelations, we not only learned about the various collection programs and systems of the National Security Agency (NSA), but also about the various legal authorities under which the agency collects Signals Intelligence (SIGINT).

Bceause these rules are rather complex, the following overview will show which laws and regulations govern the operations of the NSA, showing what they are allowed to collect where and under which conditions. Also mentioned are various collection programs that run under these authorities.

The overview provides a general impression of the most important elements of the various laws and regulations and does not pretend to be complete in every detail. For example, provisions for emergency collection are not included. Also, some of these laws and regulations govern the work of other US intelligence agencies too, but here the focus is on the NSA.

Collection INSIDE the US:

Targeted collection - US persons & foreigners:

- Section 105 FISA

- Section 703 FISA Amendments Act (FAA)

Targeted collection - Foreigners:

- Transit Authority

- Section 702 FISA Amendments Act (FAA)

- Downstream Collection (PRISM)
- Upstream Collection

Bulk collection - US persons:

- Section 402 FISA (PR/TT)

- Section 215 USA PATRIOT Act (BR FISA)

- USA FREEDOM Act (USAFA or UFA)

Collection OUTSIDE the US:

Targeted collection - US persons:

- Sections 704 & 705 FISA Amendments Act (FAA)

Targeted & Bulk collection - Foreigners:

- Executive Order 12333

- Classified Annex Authority (CAA)
- Special Procedures governing Communications Metadata Analysis (SPCMA)
- Raw SIGINT Availability Procedures

Diagram with a decision tree showing the various legal authorities
under which NSA can collect Signals Intelligence (SIGINT)
(Click to enlarge)

Inside the US - Targeted collection - US persons

 

Section 105 FISA

- Effective since October 25, 1978.
- For communications of US citizens and foreigners, whether through a "facility" or individually, inside the US, for which there's a probable cause that they are agents of a foreign power or connected to an international terrorist group. Initially also for foreigners outside the US using an American webmail provider.
- Collection takes place at telephone and internet backbone switches, wireless networks, Internet Service Providers and data centers at over 70 locations inside the United States.
- Requires an individualized warrant from the FISA Court (which takes between four and six weeks), but if no US person will likely be overheard, only a certification by the Attorney General is required.
- Collection programs: BLARNEY, COWBOY (under FAIRVIEW), PERFECTSTORM (under STORMBREW)
 

Section 703 FISA Amendments Act (FAA)

- Effective since July 10, 2008; expired on December 31, 2017.
- For communications of a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court.
- Collection takes place inside the United States (see Section 105 FISA).
- In practice, NSA apparently uses section 704 instead of 703 for collection against US persons overseas.

Inside the US - Targeted collection - Foreigners

 

Transit Authority

- Effective since 1988.*
- Based upon an extra measure contained in EO 12333.
- For the content and metadata of communications with both ends foreign: originating and terminating in foreign countries, but transiting US territory.
- Collection takes place inside the US, at major fiber-optic cables and switches operated by American telecommunication providers.
- Data may apparently be shared with other US intelligence agencies.
- Collection programs: FAIRVIEW, STORMBREW, SILVERZEPHYR (under OAKSTAR), ORANGEBLOSSOM (under OAKSTAR)

 

Section 702 FISA Amendments Act (FAA)

- Effective since July 10, 2008; expired on December 31, 2017; reauthorized in January 2018 for 6 years; reauthorized by the RISAA in April 2024 for 2 years.
- For communications to or from foreigners who are reasonably believed to be outside the United States.
- Requires an annual certification by the Attorney General (AG) and the Director of National Intelligence (DNI), which has to be approved by the FISA Court. Certifications have been approved for:

A. Counter-Terrorism (CT, since 2007)
B. Foreign Government (FG, since 2008; including some cyber threats since 2012)
C. Counter-Proliferation (CP, since 2009)
D. Counternarcotics (since 2025)*
In 2012 a Cyber Threats certification was planned,* but now, cybersecurity-related targets may fall under any of these four certifications.*

- Companies get a directive ordering them to cooperate. In return they are granted legal immunity and are compensated for reasonable expenses.
- Dissemination rules differ slightly per certification. Ordinarily, US person identifiers have to be masked, but unevaluated data may be shared with FBI and CIA, and foreign data may be shared with the 5 Eyes partners.
- Unencrypted data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director.

Section 702 FAA has two components, each with slightly different rules:
 

Downstream Collection (PRISM)
- Only internet communications "to" and "from" specific e-mail addresses or other types of identifiers. Filtering only allowed for selectors, not for keywords.
- Collection is done by the FBI's DITU, which acquires the data from at least 9 major American internet companies. This results in both stored and future communications.
- Raw (unminimized) data may be shared with FBI and CIA.
- Data are retained for a maximum of 5 years.
- NSA is permitted to use US person identifiers for querying already-collected data when there's a reasonable expectation that this will return foreign intelligence.*
- Collection program: PRISM

 
Upstream Collection
- Both internet and telephone communications. The internet communications may be "to", "from" and "about" specific e-mail addresses or other types of identifiers, including IP addresses and cyber threat signatures. The "about" collection of one end foreign e-mails and texts was halted on April 28, 2017 as this pulled in purely domestic e-mails as well.
- Collection takes place inside the US, at major telephone and internet backbone switches. This only results in future communications.
- Raw (unminimized) data may not be shared outside NSA.
- Data are retained for a maximum of 2 years.
- Collection programs: FAIRVIEW, STORMBREW

Inside the US - Bulk collection - US persons

 

Section 402 FISA (PR/TT)

- Effective since October 25, 1978.
- Since July 14, 2004, orders from the FISA Court allowed the NSA to collect domestic internet metadata in bulk under this authority. These metadata included the "to", "from", and "cc" lines of an e-mail, as well as the e-mail’s time and date.
- Only for Counter-Terrorism purposes.
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Query results could only be accessed by specially trained NSA analysts, and could only be shared for a counter-terrorism purpose.
- Data were being retained for a maximum of 5 years.
- Collection terminated in December 2011 for "operational and resource reasons" and all data were deleted, as the requirements could also be fulfilled under 702 FAA and SPCMA authorities.*
- Collection programs: FAIRVIEW

 

Section 215 USA PATRIOT Act (BR-FISA)

- Effective since October 26, 2001; expired as of May 31, 2015.
- Since 2006, orders from the FISA Court allowed the NSA to collect domestic telephone metadata in bulk under this authority. These metadata included the originating and receiving phone number, the date, time and duration of the call, and, since 2008, the IMEI and IMSI number.
- Only for Counter-Terrorism purposes: there must be a Reasonable and Articulable Suspicion (RAS) that the query term belongs to a foreign terrorist organization. The Emphatic Access Restriction (EAR) tool ensured that analysts only did queries on RAS-approved selectors.*
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Query results could only be accessed by specially trained NSA analysts, and could only be shared when a manager certifies the data are for a counter-terrorism purpose.
- Data were retained for a maximum of 5 years. Remaining data will be deleted after receiving direction from the appropriate court.
- Collection programs: FAIRVIEW, STORMBREW

During a 180-day transition period, the NSA continued the collection of bulk telephony metadata under section 215 USA PATRIOT Act, which was until November 29, 2015. In this period, telephony metadata could only be queried after a judicial finding that there is a Reasonable, Articulable Suspicion (RAS) that the selector is associated with an international terrorist group. The results had to be limited to metadata within 2 (instead of 3) hops of the seed term.

 

USA FREEDOM Act (USAFA or UFA)

- Effective since June 2, 2015, expired on March 15, 2020.
- Allows the NSA to request metadata from telephone companies based upon specific selection terms for which there's a Reasonable, Articulable Suspicion (RAS) that they are associated with a foreign power or an international terrorist group. These metadata may consist of "session-identifying information", like originating and receiving numbers, IMSI, IMEI and telephone calling card numbers, and the date, time and duration of the call. Collection of, and contact chaining on location data is prohibited.
- Requires a warrant from the FISA Court approving specific telephone numbers or other identifying selectors.
- NSA provides these selectors to the telecommunication providers, who have to produce the results of their queries (one or two hops from the initial selector) in a useful format, on a daily basis, and for a period of up to 180 days.
- Companies providing these data are granted legal immunity and will be compensated for reasonable expenses.
- All records that are not foreign intelligence information have to be destroyed promptly.
- Query results may be fully shared with CIA and FBI.
- Also, foreign terrorists may be tracked for up to 72 hours when they enter the US, with authorization by the Attorney General.
- In the Summer of 2019, the NSA suspended the program and subsequently deleted all the data collected under this authority.

Outside the US - Targeted collection - US persons

 

Section 704 & 705 FISA Amendments Act (FAA)

- Effective since July 10, 2008; expired on December 31, 2017.
- Collection takes place outside the United States.
- Data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director. Inadvertent collection of US data has to be destroyed upon recognition, but the Attorny General can authorize exceptions.

The differences for these sections are:

Section 704 FAA
- For collection against a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court, for a period of up to 90 days.
 

Section 705(a) FAA
- For communications of a US person reasonably believed to be outside the United States.
- Requires an individualized warrant from the FISA Court.
- Collection may take place both inside and outside the United States.


Section 705(b) FAA
- For communications of a US person reasonably believed to be outside the US, when there is already an existing FISA Court order for collection against this person inside the US under section 105 FISA.
- Requires authorization by the Attorney General.

Outside the US - Targeted & Bulk collection - Foreigners

 

Executive Order 12333

- Effective since December 4, 1981.
- For communications between foreigners outside the US.
- Requires no external approvals, except for fitting NSA's mission as set by the US government and prioritized by the National SIGINT Committee.
- Collection takes place outside the US and for all foreign intelligence purposes. However, Presidential Policy Directive 28 (PPD-28) from January 17, 2014, limits bulk collection to the following 6 purposes:

- Espionage and other threats by foreign powers
- Threats from terrorism
- Threats from weapons of mass destruction
- Cybersecurity threats
- Threats to US or allied armed forces
- Threats from transnational crime

- Data may be shared with other US intelligence agencies, as well as with foreign partner agencies.
- Dissemination of US person identifiers is only allowed when necessary and personal information should not be inappropriately included in intelligence reports.
- Unencrypted data from targeted collection are retained for up to 5 years, unless it is determined that continued retention is required; encrypted data are retained for an unlimited period of time.
- Any incidentally collected communications have to be deleted after five years, unless they meet a number of exceptions.*
- Collection programs: OAKSTAR, WINDSTOP (incl. INCENSER, MUSCULAR, etc), RAMPART-A (incl. SPINNERET, MOONLIGHTPATH, AZUREPHOENIX, etc), DANCINGOASIS, MYSTIC, and many more.

Under EO 12333, there are several additional authorizations:
 

Classified Annex Authority (CAA)
- Effective since 1988.
- For communications of US persons outside the US, for whom there's probable cause that they are agents of a foreign power or engaged in international terrorism.
- Requires prior approval by the Attorney General, limited to a period of time of up to 90 days.
- Also for communications of a US person who is held captive by a foreign power or a terrorist group, which requires approval of the Director of NSA.
 

Special Procedures governing Communications Metadata Analysis (SPCMA)
- Effective since January 2011
- Allows contact chaining and other analysis on metadata already-collected under EO 12333, regardless of nationality and location, including US person identifiers.
- For the purpose of following or discovering valid foreign intelligence targets (i.e. not restricted to counter-terrorism).
- Only covers analytic procedures and does not affect existing collection, retention or dissemination (including minimization) procedures for US person information.
- SPCMA-enabled tools: ICREACH, Synapse Workbench, CHALKFUN
 

Raw SIGINT Availability Procedures
- Effective since January 2017
- Allows other US intelligence agencies to request access to content and metadata of US persons from already-collected raw SIGINT data sets from the NSA.
- Only for foreign intelligence or counterintelligence purposes and the requesting agencies may not use selectors or key word queries that will result in domestic communications (contact-chaining is not limited).
- In general, raw SIGINT obtained in this way may be retained for up to 5 years, but foreign communications may be retained permanently if US person information is minimized. Domestic communications have to be destroyed promptly upon recognition, except when they provide significant intelligence value. Further dissemination is only allowed after approval by NSA.
- Sharing tools: ICREACH

Information Assurance

Besides collecting Signals Intelligence (SIGINT), the NSA is also responsible for Information Assurance (IA). The latter mission is conducted under the following legal authorities:

National Security Directive 42
("National Policy for the Security of National Security Telecommunications and Information Systems", 1990)

Executive Order 13587
("Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information", 2011)

Computer Network Operations

The latest field in which the NSA is operating, Computer Network Operations (CNO), better known as hacking, is not governed by new legal authorities. Instead, the existing authorities for SIGINT and IA are used, ideally in a more effective way to "take advantage of the same expertise (analytical and technical) that is used to defend and exploit".*

- . - . - . - . - . - . - . - . -

Links and sources
- NSA OGC presentation: CNO Legal Authorities
- Paper by Mark M. Jaycox: No Oversight, No Limits, No Worries: A Primer on Presidential Spying and Executive Order 12,333 (2019)
- Emptywheel.net: 12333 info sharing working thread
- The New York Times: N.S.A. Gets More Latitude to Share Intercepted Communications
- Emptywheel.net: The Yahoo Scan: On Facilities and FISA
- Emptywheel.net: While It Is Reauthorizing FISA Amendments Act, Congress Should Reform Section 704
- IC on the Record: FACT SHEET: Implementation of the USA FREEDOM Act of 2015
- Emptywheel.net: Internet Dragnet Timeline - Phone Dragnet Timeline - 10 Goodies USA Freedom Act Gives the Intelligence Community
- Webpolicy.org: Executive Order 12333 on American Soil, and Other Tales from the FISA Frontier
- IC on the Record: Transition from the USA PATRIOT Act to the USA FREEDOM Act
- DNI.gov: Documents Regarding the Now-Discontinued NSA Bulk Electronic Communications Metadata
- Americanbar.org: Section 214 and Section 215 FISA
- National Research Council: Bulk Collection of Signals Intelligence: Technical Options (pdf) (2015)
- NSA Civil Liberties and Privacy Report about Targeted SIGINT Activities under EO 12333 (pdf) (2014)
- Privacy and Civil Liberties Oversight Board report about the Surveillance Program Operated Persuant to Section 702 FISA (pdf) (2014)
- Legal fact sheet: Executive Order 12333 (pdf) (2013)
- The Department of Defense Directive about NSA/CSS (pdf) (2010)
- NSA OGC: Course on legal compliance and minimization procedures (pdf)
- Memo about Reauthorization of the FISA Amendments Act (pdf)
- NSA OGC: FISA Amendments Act of 2008 - Section 702 - Summary Document (pdf)