NSA report indicates Internet firms may only be turning over emails from foreign targets, not all data as earlier thought
N.S.A. Gets Less Web Data Than Believed, Report Suggests — WASHINGTON — A newly declassified report by the National Security Agency's inspector general suggests … Tweets: @ridt Tweets: Thomas Rid / @ridt : Internet firms, not NSA, likely query more bulk data with selectors, report claims—thus bypassing common encryption http://www.nytimes.com/...
Context & Ripple Effects
This declassified inspector general report lands mid-arc in the post-Snowden restructuring of NSA collection. After the bulk email records program was shut down, documents showed the agency tapped networks abroad to replace it, while the Justice Department separately authorized expanding surveillance so NSA could search US Internet traffic for evidence of hacking originating overseas.
What changed today is the picture of where the data actually comes from: rather than pulling everything from Internet firms, the agency appears to receive only messages already tied to foreign targets — and, as Thomas Rid points out, the firms themselves are likely running more selector queries against bulk stores on NSA's behalf, a step that bypasses common encryption because it happens inside the providers.
First-order effects
- NSA's apparent footprint shrinks: the report suggests the agency gets less web data than widely believed, weakening the premise of court challenges premised on indiscriminate provider handovers.
- Internet firms bear more of the operational burden — they query their own bulk holdings with government-supplied selectors, meaning the surveillance work happens behind their encryption rather than through an NSA tap.
Second-order effects
- The legal fight migrates: with providers executing the queries, accountability questions center on company compliance and selector vetting rather than on what leaves their servers — a shift that fits Michael Hayden's later defense of stopping collection of Americans' emails about foreign targets.
- Downstream access grows even as intake narrows: the 2017 rules letting NSA share raw intercepts with 16 other agencies before privacy protections apply mean whatever does arrive spreads further across the intelligence community.
Third-order effects
- If the pattern holds, US signals intelligence consolidates around compelled provider-side querying instead of agency-held bulk repositories — concentrating power in whichever firms hold the data and complicating oversight of how selectors are chosen.
- That structure feeds the constitutional argument law experts flagged about the government seeking looser protection against arbitrary surveillance: distributed querying is harder to litigate than a single bulk database, even as the advisory panel's position that there is no potent substitute for bulk collection keeps the underlying demand intact.
The trend: US surveillance is migrating from centralized agency bulk collection toward compelled, selector-driven queries executed inside Internet firms — trading visible data volume for distributed, harder-to-oversee access.