US intelligence agencies have violated federal surveillance laws hundreds of times over the past decade, a painstaking analysis of declassified reviews, opinions, and documents has shown.
New research by the Open Tech Institute has found over 200 violations by the NSA and the FBI since the introduction of a controversial surveillance provision designed to collect foreign intelligence. Violations include over-collecting data, violating attorney-client privilege, and conducting unlawful surveillance of Americans, who are generally protected from spying under the constitution.
The research is the first comprehensive, compiled list of violations of the provision, known as section 702 of the Foreign Intelligence Surveillance Act (FISA), which is designed to collect data on foreign persons overseas, but also incidentally collects a large amount of data on Americans. The statute is the legal basis for the PRISM program and the tapping of global undersea fiber optic cables.
While the research shows the violations are inadvertent, it reveals a pattern of systematic problems about the scale of the US government's sprawling and complex surveillance program, said the project's lead.
"The real threat to privacy isn't that an individual person is engaging in intentional wrongdoing, it's that lots of people are accidentally breaking the rules, or that the surveillance and data retention systems aren't built to follow the rules in the first place," Robyn Greene, policy counsel and government affairs lead at the Open Technology Institute, told ZDNet.
According to the data, the majority of violations occurred in 2014 and 2015, with most relating to running unlawful searches of data and improperly targeting a person or account for surveillance.
That has impacted the privacy of "countless" Americans, she said.
Greene notes that the violations are not willful. "They are inadvertent or unintentional," she said. "However, they are of the most concern because they represent systemic problems that result from the scope and complexity of the Section 702 surveillance program."
"As such, and as many of the reports acknowledge, the impact of these unintentional violations on Americans' privacy can be significant and prolonged," she said.
One of the most striking points to come out of the research, Greene noted, was how long it took for the government to report violations to the FISA Court, which authorizes and oversees the government's surveillance powers.
One of the most egregious cases of unlawful surveillance, she explained, was revealed in a declassified ruling by the FISA Court, which found the NSA had unlawfully spied on Americans. The government stopped a secret form of wiretapping after the NSA realized analysts had been intercepting content on its "upstream" internet data collection, which collects data entering and leaving the US from telecom partners like AT&T and Verizon, that merely mentioned a target of surveillance.
"It took over five years for the NSA to figure out that it had been searching for Americans' communications in upstream collection, which it wasn't allowed to do," Greene said.
One overseeing surveillance judge called the searches a "very serious Fourth Amendment issue," and criticized the NSA for an institutional "lack of candor" for not disclosing the conduct sooner.
"Even after an Inspector General pointed out the problem, it took [the NSA] another year to notify the FISA Court, even though they're supposed to file a notice of compliance incident immediately, and then it took five more months to finally admit there was no reasonable solution, so they had to stop the collection and delete the previously collected data so that it couldn't be improperly accessed," Greene said.
The research comes shortly before the section 702 provision is set to expire.
Congress has until the end of the year to pass a bill that puts the section 702 statute back in the law books, or the NSA risks losing those powers at the end of the annual intelligence cycle. US intelligence chiefs are pushing for a permanent reauthorization of the surveillance powers, while privacy groups are fighting for greater transparency.
Several members of Congress have vowed to fight the reauthorization until they learn how many Americans are swept up in section 702 surveillance. The government's spy chief has so far refused to say what the number is.
"Proponents of a clean, permanent reauthorization of Section 702 are playing a game of misdirection when they focus on the idea that there have been no identified cases of intentional abuse," Greene said.
"It's not the story that supporters of Section 702 want you to hear, but it's the story that every American deserves to know," she said.