NSA 'top secret' spying order affects millions of Americans: FAQ

NSA 'top secret' spying order affects millions of Americans: FAQ

Summary: The U.S. government is vacuuming up millions of Verizon customer records on a daily basis, according to a leaked "top secret" court order. Here's everything you need to know.

The National Security Agency's headquarters in Ft. Meade, Md., in an undated file photo. (Image: NSA)

The Guardian newspaper revealed exclusively on Wednesday that the U.S. National Security Agency (NSA) has and continues to vacuum up millions of Verizon customer details, including information on phone calls both within the U.S. and between the U.S. and other countries.

Under the order, Verizon is ordered on an "ongoing, daily basis" to hand the NSA information on all of the call data in its systems.

On Thursday, ZDNet obtained a copy of a note sent by Verizon chief counsel Randy Milch to employees. In the note, he did not confirm or deny the story, but in describing it as an "alleged" court order, he stressed that the text "forbids Verizon from revealing the order’s existence."

"If Verizon were to receive such an order, we would be required to comply," just as any other company would be forced to.

Milch added that the company "continually takes steps to safeguard its customers' privacy," but warned that the "law authorizes the federal courts to order a company to provide information in certain circumstances."

A Verizon spokesperson declined to comment when ZDNet contacted the company by phone on Thursday.

This is a developing story, and will be updated with notes below, when appropriate.

What is the deal here? Is the U.S. government spying on U.S. residents?

A "top secret" order by a U.S. secret court — known as the Foreign Intelligence Surveillance Court (FISC), which was set up in the Foreign Intelligence Surveillance Act (FISA) in 1978 following the Watergate scandal — forced Verizon to send the U.S. National Security Agency the records relating to tens of millions, if not all, of its customers' phone calls and text messages.

FISA has been amended numerous times since then, including the Patriot Act in 2001, following the September 11 terrorist attacks in New York City, and in 2008, with the FISA Amendments Act, following the NSA's widespread unwarranted wiretapping campaign.

This order, published by The Guardian, applies to all calls created by Verizon between the U.S. and abroad, or within the U.S., including local calls. Only Verizon calls that are located outside the U.S. and connected with a non-U.S. number are excluded from the order.

There is no doubt that this is a massive domestic spying campaign by the U.S. government — it's clear from the document — through its intelligence services. But unlike previous cases involving the NSA and AT&T, this time around it has been warranted by the aforementioned secret court.

Why has this order been issued?

That isn't clear. The FISC order itself does not state why. For good reason: If the document is leaked, at least it doesn't dish out any more secret intelligence than is necessary.

The White House said, via a Reuters wire, that the "ability to gather information has been critical tool in preventing terrorist threats." Officials also said there is a "need to balance security with civil liberties."

There may be something going on that we don't know about. An imminent terrorist threat, potentially something on a scale that requires everyone's civil liberties to be halted or diminished to save lives? It's speculative. That said, the U.K. government is actively pushing through this kind of surveillance into law — rather than using Patriot Act-like laws that it currently doesn't possess (see below).

What does the order actually say?

It says a number of things, most of which are described in this FAQ. Verizon is forced to hand over "on an ongoing daily basis", an electronic copy of "tangible things." This is a provision given to the FISC under Section 215 of the Patriot Act, otherwise known as 50 U.S.C. § 1861, which is commonly known as the "business records" section.

Verizon is also gagged from disclosing "to any other person that the FBI or NSA has sought or obtained tangible things" under the order. The order only permits Verizon to seek legal advice or assistance "with respect to the production of [tangible] things."

This is why Verizon is neither confirming nor denying the order, and is not commenting on the record. It simply isn't allowed to.

The cellular giant is not allowed to appeal. Such appeals are rare, anyway. The first appeal was in 2002, more than two decades after the introduction of the FISC.

What is Section 215 of the Patriot Act?

Section 215 of the Patriot Act relates to "business records." It also removes the normal requirement to meet the legal standard of what is known as "probable cause," according to the American Civil Liberties Union (ACLU) in a fact sheet [PDF].

Read this

Microsoft admits Patriot Act can access EU-based cloud data

Microsoft admits Patriot Act can access EU-based cloud data

Microsoft's U.K. head admitted today that no cloud data is safe from the Patriot Act, and the company can be forced to hand EU-stored data over to U.S. authorities.

Section 215 supersedes any legally binding privacy guarantees between businesses and their clients or customers, such as a privacy policy or a contract. If a company is served with a court order under Section 215, they are not allowed to contest the order, or even disclose the order to a lawyer — unless legal counsel is used to help hand over the "things" that the U.S. government wants.

Such things are anything "tangible." This includes business, financial, and even medical records, as well as papers, documents, and books — or anything you can physically hold.

But "tangible" is a broad term that has been interpreted by the U.S. government, which now allows it to include company databases, computers, hard drives, and, in some cases, cloud-stored files.

How long has this been going on for? Is the Verizon order indicative of an ongoing practice?

According to the Associated Press, the Senate Intelligence committee chairperson Senator Dianne Feinstein (D-CA) said the "top secret" court order for telephone records of millions of U.S. customers of Verizon is a three-month renewal of an "ongoing practice."

What can be collected under the order?

Communications data, dubbed "metadata," can be collected under the order. The actual contents of the calls are not available to the U.S. government — that would require a different warrant that enables wiretapping. That uses a different section of the law.

The sort of data collected includes "call data," such as the caller's and the recipient's phone number. Also, routing data, such as the IMEI unique device identifier and the IMSI number used to identify calls on cell networks, will be recorded. The time, date, and duration of the call is also recorded.

It's also possible for the NSA to collect location data of Verizon customers, following a 2005 court ruling that determined that cell site location is also considered as being "metadata."

This effectively means that foreign nationals and non-U.S. residents are being specifically targeted for widespread warranted domestic surveillance.

Is this order in breach of Fourth Amendment rights to "unreasonable" searches?

This one is tricky. Arguably, yes, but also perhaps not. The Fourth Amendment protects U.S. residents from the U.S. government — not private companies — conducting "unreasonable" searches.

However, the FISC has ruled before that similar NSA surveillance violated the Fourth Amendment. According to Senator Ron Wyden (D-OR), the court ruled that the intelligence it collected was "unreasonable" under the law.

Despite being held in secret, the FISC is accountable, albeit to a small number of select politicians on the Senate Intelligence Committee. No records are kept, and the ones that are will be treated with the highest security classification possible.

Can the U.S. government use the order to listen in on calls, or read my text messages?

Related story

Yes, the FBI and CIA can read your email. Here's how

Yes, the FBI and CIA can read your email. Here's how

"Petraeus-gate," some U.S. pundits are calling it. Here's how the head of the CIA (and you) can have his emails read by a friendly U.S. intelligence agency, which led to his resignation.

Communications data does not include the contents of phone calls or text messages, such as emails or the recordings of phone conversations; rather, it instead includes all of the details about everything that's sent and received online.

Names, addresses, and financial data are also not collected. With inter-agency cooperation, it would not be difficult for the NSA or the FBI to work out who is who.

Are consumers affected, or businesses, or both?

A person familiar with the matter, who declined to be named, told ZDNet on Thursday that business and enterprise customers are the most affected. Consumers are also affected, because the division of Verizon, known as Verizon Business Network Services, serves residential and business customers, as well as local, state, and federal government entities.

What can the NSA do with this collected "metadata"?

The U.S. government doesn't believe metadata, the collected information, is private or sensitive in nature. The U.K. government used a similar analogy, which explained that while the contents of such communications are the "letter," the metadata is the "envelope."

The NSA could do almost anything it likes with the data it receives. It can work out who you're contacting, when you're likely to contact them, links with other people, and a "social networking analysis" that determines who may know other people via a mutual friend. The government agency can also determine where you've been.

Above all else, it can be used to spot what the NSA would consider "suspicious" activity. Considering it's already used the law to scrap the legal standard of what is considered "probable cause," it could probably widen the scope of what it would consider "suspicious" in the first place.

A specific Verizon division is named in the order. What is Verizon Business Network Services?

When Verizon acquired MCI Network Services in May 2007, the company was spun into the telecoms giant's business unit. It was renamed Verizon Business Network Services. It provides local and long-distance voice and messaging services, as well as Internet and data access.

For business clients, Verizon offers virtual private network (VPN) services and firewall technology. According to Bloomberg, the division also provides "network infrastructure, including network design, implementation, and customer management solutions; and data, dial, asynchronous transfer mode, digital subscriber line, and dedicated and bundled services, as well as security products."

If Verizon has been slapped with a "top secret" order, have others also?

AT&T, Sprint, and T-Mobile may have been hit with the same order, or one with almost exactly the same wording. It's possible and likely, but we cannot confirm that. It's safer to assume that if the U.S. government has forced Verizon to hand over the data of more than 98 million wireless customers and around 21 million residential and commercial lines — if not more — then other cellular firms may have been, as well.

What does "top secret" actually mean?

The document markings at the top of the document say: "TOP SECRET//SI//NOFOR," which likely means very little to the vast majority of readers.

Breaking this down, it means that the document is of the highest level of security clearance in the U.S., and also fellow allied countries, such as the U.K.

The term "SI" relates to sensitive compartmented information relating to communications intercepts, such as wiretapping.

"NOFORN" essentially means "no foreign nationals" are allowed to view the document, such as allied nations with which the U.S. government shares intelligence.

For this reason, The Guardian, based in London, U.K., may evade U.S. sanctions or prosecution as a result. It's certainly safer for a U.K.-based publication than a U.S.-based one.

Isn't this "communications data" collection similar to what the U.K. government is currently trying to push into law?

Very much so. The U.K. government is struggling to get this into a debate stage, let alone law and signed by Royal Assent, due to opposition in the Cabinet of the Conservative-led coalition government.

The government wants its intelligence agencies to be able to tap into, in near-real time, the communications data of any given person in the U.K. at any time. This involves forcing the Internet providers in the country to install "black boxes" to enable the server-side data collection.

Topics: Privacy, Government US, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
      • Say the cold truth.

        Today we dare not profile anyone by ethnic or religious factors, so NSA "had to" hoover up millions of records instead of the relatively few truly dangerous ones.

        Now they must either (covertly) filter them internally by those factors, or subject millions of people highly loyal to the USA to equal IT-wasting scrutiny.

        Remember, only the IRS may profile by political persuasion.
  • data collection

    it's not "other carriers may have been"; to get results requires all or nothing.
  • It's not abou the political party, it's about totalitarianism

    I'm not a big fan of this guy, but in the first few minutes he shows interesting white board presentation about why party doesn't matter any more (on YouTube):

    Tomas M.
  • Sorry, I just don't have a problem with this 'snooping'

    We don't live in normal times. Terrorism is a threat that affects us all globally. Terrorists use the internet and electronic communication often, and there is no way to catch them without monitoring it all.

    I don't consider monitoring a violation of my freedom in any way. It's only MONITORING, and so long as I'm not a terrorist, I have nothing to worry about. I am still free to speak my mind, write whatever I want on the internet, etc. So what if 'they' know who I am? So what if they know what I think? If I write in public, or speak in public, then I've forfeited my privacy by free will, and there's a responsibility going with that. YOU are reading my comment, so I am responsible for how I make it. So if YOU can read what I say or monitor, why should I care of the government does, too?

    Facebook is public to everyone. We know that. So why any angst over a government anywhere in the world, which monitors internet, email, etc. to catch terrorists?

    We should be saying THANK YOU, not qvetching.
    • Define Terrorist

      The problem is the definition of terrorist. What if a banker that defrauds someone is labeled a terrorist, are they going to use these methods to start tracking our spending. Are the banks going to be ordered to divulge all of our spending?

      What if you read an anarchist book? Or a Christian book? Or an atheist book? And someone from said ideology blows up something. Are we going to be ok with that ideology being labeled as terrorist, and allow the government to order Amazon to divulge what pages we are reading out of our e-books?

      The constitution is there so that we do not get judged based on these type of things.
      • A terrorist is...

        Without going to the dictionary I'm going to give my definition of terrorist. A terrorist is someone who uses planned acts of violence against others at random intervals and unexpected locations with the hope of creating fear and terror in an even greater population than those directly impacted by their actions. This is typically done as an attempt to achieve some sort of ideological goal. In recent months, anyone who does not agree with the ideology of the person speaking may be labeled as a "terrorist", however the label rarely is accurate in describing a group of individuals.
        number cruncher
        • So your list includes

          Your list includes..

          Nelson Mandela (never renounces violence)
          PLO leader Yasser Arafat (Nobel peace prize winning)
          Former Israeli leaders Simon Peres/Yitzahk Rabin (also Nobel winning)
          Drone Firing lunatic Barak Obama (again Nobel winning)
          Former Yugoslavia intervening EU member countries (again Nobel peace winning)
          Former Egyptian president Anwar Sadat (also Nobel winning, but Head of state during Yom Kippur War)
          Former Israeli leader Menachem Begin (also Nobel winning)

          ...ones man's terrorist is another mans freedom fighter, just depends on perspective. I'd imagine half of the Moslem world thing GW Bush and Tony Blair are evil terrorists.
    • Run and hide under your bed

      Those who sacrifice freedom for safety deserve neither.
      • You do not sacrifice freedom by gov't MONITORING communications

        Freedom to speak or move or act is not sacrificed, if merely watched. Policemen stand at corners or cruise in cars and watch. That fact doesn't diminish the freedom of people. Same, for monitoring communications.

        Let's not get paranoid about what freedom is and is not, nor about the definition of a terrorist. Governments are FAR LESS INTERESTED in your activity than you are. The people in government, are just like you. Do you work in customer service? Well, that's just like being a policeman, except that the latter has to be readily able to physically defend the public, as well.
        • One more thing needs to be said

          The police departments of the world are already hampered enough by too many laws in the name of civilian protection. If they can't monitor the public in order to defend that public from harm, then you pay taxes for protection, in vain.

          I'm not sure why, but it's always film fodder to talk about the corrupt cop, the cop who wants to lord it over people. But in point of fact, such 'cops' are so few and far between, that fearmongers profit, and so does crime.

          Let's return to sanity, okay?
        • Monitoring communications or recording content of communicationS

          I believe that the content of those communications are protected by the Forth Amendment whch "Prohibits unreasonable searches and seizures and sets out requirements for search warrants based on probable cause." After all, they have their "Secret Court" to provide search warrants which we must assume would require "probable Cause." We must question, however, who is policing our "Right to privacy?"
      • Excellent Quote

        Here are some more quotes that are famous and still true today.....

        “The descent to Hell is easy and those who begin by worshiping power soon worship evil.” -- C.S. Lewis

        "The more corrupt the state, the more it legislates." - Tacitus

        "All tyranny needs to gain a foothold is for people of good conscience to remain silent." - Thomas Jefferson

        This is unacceptable. How much of my tax money is it costing me so the government can spy on me ? If they have to trample on my fourth and fifth amendment rights to "protect me" then I no longer want their protection nor do I need them.

        This is all under the guise of protecting us. Anyone notice who the new terrorists are ? That's right.....American citizens now.....and we have a president who is not American and not born here.

        Anyone notice that the FAA is approving the flying of drones in this country ?

        The bigger the government the less freedoms you will enjoy.....now with the NDAA that they put into law a couple years ago you can be labeled a "terrorist" without even so much of a trial.

        I love the idiots here defending this. Keep being politically correct and accepting of these policies.....just like in Germany in the 1930's they will eventually come after you.

        I can't recall so many scandals with our government all at the same time but we have a government now selectively discriminating against certain groups of people and spying on journalists and claiming that the journalists are breaking the law when they are supposed to be watchdogs for us. I can hardly wait until the IRS dispenses Obamacare.....are they going to deny me healthcare due to my beliefs ? Of course I can't afford the "Affordable Healthcare Act" anyway.

        How does a UK newspaper put this story out.....where are the American sources ? Oh....they were busy at Biden's pool party at his home....laughing it up and smooching with the Democrats.

        This government is completely out of control. They have no respect for the taxpayers. The IRS has no business making Star Trek spoofs and incredibly bad at it. The Dept of Injustice is a complete joke.

        Contact your representatives. This can't keep going on like this.
    • Fishing expedition

      If it stopped there - I could side with you. My problem is - what if I dialled a wrong number, and got someone I didn't intend. I leave a voicemail. The person calls back. Unbeknownst to me, the person is a "person of interest" to the government. Now I have had "a conversation" with a terrorist.

      What if my call pattern makes me a person of interest - and they get a wiretap order, and they discover that I buy pot, or evade taxes, or run an unlicensed sports pool (gambling). Who is then to say they can't pass this information on to another organization, and that orgnization uses the facts obtained a-priori, to do a separate investigation and charge me - all without me ever knowing that the Verizon metadata was behind the original tip-off.

      This would clearly be illegal - yet I would never know - and my lawyer would never know to use this in defense.
      • Bravo


        An excellent point and a very plausible scenario.
      • So you think a simple wrong number can put you in jail? Think AGAIN

        You've been watching too much TV. EVIDENCE is the cardinal principle behind criminal law. Just because someone dials your phone number who might be suspected of terrorism, doesn't mean YOU will be. More has to be furnished as EVIDENCE, for you to even be questionned.

        Police don't have all day long to chase down every single contact. So they look for other things, to whittle down the job of searching. Why don't you know this? Even a terrorist might call non-terrorist phone numbers, as he has to wash, dress, eat, like everyone else.

        So, one of the key features a policeman seeks, is REPETITION. A wrong number dialed would not be repeated; or, if repeated, then repeated the same day, and then no more. Additionally, the number dialed would have to have some other evidentiary connection, in order to become suspect.
        • You have a truely niave opinion of government & police behavior

          And maybe I have a truely cynical view. But, were that ALL government officals and ALL law enforcement were all 100% hoenst, you might have a point. They are not, and that is not from watching TV - well ok, from watching NEWS on TV, not tv shows. I've heard about far far more corrupt officials & cops than I have terrorist acts.

          And I'm NOT trying to lump all gov't employees & LEO's in the same pot. I know MOST are honest hard working folks that mean the best, and I personally know several.

          But I will always beleive in 'power corrupts, and absolute power corrupts absolutely'. It's an unaviodable fact of human nature. And I will always want my personal private dealings kept personal & private, no matter how boring they me be, unless I make the decision to make them public.
          • If you are just watching the news...

            ...then you are not informed at all. The news only reports sensational stories that they are allowed to obtain -- clandestine anti-terrorist activity occurs daily but is reported rarely because reporters are not privvy to these actions. When things are going to come up in a public hearing, such as a case involving corrupt law enforcement, there is usually proactive PR on behalf of the government and police department to announce the criminal activity has been discovered and the perpetrators apprehended...it provides more consumer confidence in the agencies without inviting media to put their own spin on events as they unfold in the courtroom.

            You can be certain that nearly everything you hear on the news regarding government agencies is carefully managed and if that is your main source of information, then you only know what they want you to know, which is usually not a whole lot.
      • So you're

        objection is that because you are a criminal and might get caught you don't like this.
    • Shame

      Well, then, shame on you. You're more dangerous to more people in more ways, by far, than any "terrorist".
    • Slowly but Eventually

      Because their terminology of "Terrorist" or "Monitor" has evolved so much. When does it end? At this rate, you will slowly be brainwashed to NOT speak your mind on certain topics without a court date. Wether on the phone, email, or Facebook. Every day they're in the process of making new, minute laws which take away our freedoms. These laws stay on the books and keep stacking up. Maybe we should stop patrolling these countries decade after decade and pissing people off from birth so they dedicate their life to hating America. Another topic though.
      Anti Fanboy