Warrantless wiretapping is back in the news, thanks largely to Michael Isikoff's cover piece in the December 22 issue of Newsweek. We now know that the principal source for James Risen and Eric Lichtblau's Pulitzer Prize winning article that broke the story three years ago in the New York Times was a Justice department official named Thomas M. Tamm. Most of the current attention, naturally, has focused on Tamm and on whether, as Newsweek's tagline put it, he's "a hero or a criminal". Having never in my life faced an ethical dilemma on the magnitude of Tamm's -- weighing betrayal of one trust against the service of another -- I can't help but wonder what I'd have done in his shoes. Whistleblowing is inherently difficult, morally ambiguous territory. At best there are murky shades of gray, inevitably viewed through the myopic lenses of individual loyalties, fears, and ambitions, to say nothing of the prospect of life-altering consequences that might accompany exposure. Coupled with the high stakes of national security and civil liberties, it's hard not to think about Tamm in the context of another famously anonymous source, the late Mark Felt (known to a generation only as Watergate's "Deep Throat").

But an even more interesting revelation -- one ultimately far more troubling -- can be found in a regrettably less prominent sidebar to the main Newsweek story, entitled "Now we know what the battle was about", by Daniel Klaidman. Put together with other reports about the program, it lends considerable credence to claims that telephone companies (including my alma matter AT&T) provided the NSA with wholesale access to purely domestic calling records, on a scale beyond what has been previously acknowledged.

The sidebar casts new light on one of the more dramatic episodes to leak out of Washington in recent memory; quoting Newsweek:

It is one of the darkly iconic scenes of the Bush Administration. In March 2004, two of the president's most senior advisers rushed to a Washington hospital room where they confronted a bedridden John Ashcroft. White House chief of staff Andy Card and counsel Alberto Gonzales pressured the attorney general to renew a massive domestic-spying program that would lapse in a matter of days. But others hurried to the hospital room, too. Ashcroft's deputy, James Comey, later joined by FBI Director Robert Mueller, stood over Ashcroft's bed to make sure the White House aides didn't coax their drugged and bleary colleague into signing something unwittingly. The attorney general, sick and pain-racked from a rare pancreatic disease, rose up from his bed, gathering what little strength he had, and firmly told the president's emissaries that he would not sign their papers.

White House hard-liners would make one more effort -- getting the president to recertify the program on his own, relying on his powers as commander in chief. But in the end, with an election looming and the entire political leadership of the Justice Department poised to resign rather than carry out orders they thought to be illegal, Bush backed down. The rebels prevailed.

Like most people, I had assumed that the incident concerned the NSA's interception (without the benefit of court warrants) of the contents of telephone and Internet traffic between the US and foreign targets. That program is at best a legal gray area, the subject of several lawsuits, and the impetus behind Congress' recent (and I think quite ill-advised) retroactive grant of immunity to telephone companies that provided the government with access without proper legal authority.

But that, apparently, wasn't was this was about at all. Instead, again quoting Newsweek:

Two knowledgeable sources tell NEWSWEEK that the clash erupted over a part of Bush's espionage program that had nothing to do with the wiretapping of individual suspects. Rather, Comey and others threatened to resign because of the vast and indiscriminate collection of communications data. These sources, who asked not to be named discussing intelligence matters, describe a system in which the National Security Agency, with cooperation from some of the country's largest telecommunications companies, was able to vacuum up the records of calls and e-mails of tens of millions of average Americans between September 2001 and March 2004. The program's classified code name was "Stellar Wind," though when officials needed to refer to it on the phone, they called it "SW." (The NSA says it has "no information or comment"; a Justice Department spokesman also declined to comment.)

While it may seem on the surface to involve little more than arcane and legalistic hairsplitting, that the battle was about records rather than content is actually quite surprising. And it raises new -- and rather disturbing -- questions about the nature of the wiretapping program, and especially about the extent of its reach into the domestic communications of innocent Americans.

 

---

The issue has to do with a peculiarity of US surveillance law. There are generally stricter requirements for wiretaps that intercept call content than for those that record only transactional data (who called whom and when). The legal rationale for this distinction is complex but has its origins in how wireline telephones worked and were used in the last century. There is a theory that while a telephone call's audio is intended only for other party, the numbers dialed have already been given voluntarily to a third party -- the phone company -- and thus are legally less "private". And there is a basic assumption about the kinds of privacy we value most. Being listened in on has been thought to be inherently more invasive than having one's calling records examined. So the government can obtain transactional records relatively easily, under a lower legal standard than what is required for a full content tap.

Modern computing and communications technology may make these assumptions less valid than they were when the legal theories of wiretapping were developed. As electronic communication pervades more of our daily lives, transaction records -- metadata -- can reveal quite a bit about us, indeed often much more than a few out-of-context conversations might. Aggregated into databases with other people's records (or perhaps everyone's records) and analyzed by powerful software, metadata by itself can paint a remarkably detailed picture of connections, relationships, and other patterns that could never be recovered simply from listening to the conversations themselves. Metadata can also be analyzed retrospectively, since calling records are now kept by phone companies for every customer, not just the suspects. And the very distinction between content and metadata defies easy translation into the Internet, where whether something is content or not can depend entirely on where in the network the question is being asked.

But that's beside the point here. Rightly or wrongly, current law treats metadata differently from content. In particular, it's legally simpler under the Foreign Intelligence Surveillance Act (FISA) for the government to obtain telephone records than it is to intercept actual telephone call audio. All that is required, in general, is an assertion that the specific records involved are likely to be germane to a investigation, a relatively undemanding standard to meet. Content taps, on the other hand, require evidence of probable cause and are subject to more judicial scrutiny.

So how could it have been on that night in 2004 that these officials were comfortable with the legality of intercepting trans-border call content without a FISA warrant -- something apparently expressly forbidden under the law -- and yet drew the line when it came to collecting call records? That would seem, based on longstanding principles of surveillance law, to get it backwards. What kind of records could have provoked such a reaction, and did their collection and use violate the privacy of ordinary Americans in ways that go beyond what is already known about the program?

The Newsweek sidebar raises more questions than it answers here, but piecing together various details from previous reports about the program suggests likely possibilities.

NSA mining of traffic metadata obtained directly from US telephone switches appears to have first been reported by the New York Times in December, 2005 (two weeks after they broke the story of the wiretap program itself). However, that article focused primarily on trans-border traffic on switches at the edge of the US, the very same traffic from which call audio was also being intercepted. So it seems unlikely that collecting call records exclusively from those switches would raise special concerns for officials who believed that they were permitted to collect the content without warrants.

Two years later, in 2007, the Times reported that the FBI had been asking US telephone companies for extended "community of interest" data about various terrorism suspects. That is, the FBI obtained not just calling records of their suspects, but also the calling patters of everyone they communicated with, even those not suspected of wrongdoing. However, there are several differences between the kind of large-scale metadata collection suggested by Newsweek and the FBI program described by the Times. In the Times article, the FBI used secret "National Security Letters" to obtain data from telephone companies about the communities of specific targets, which implies a more limited scope, involving far fewer people's records, than an NSA program of the kind described by Newsweek would have had.

However, still another Times piece, written by John Markoff in 2006, reported that law enforcement officers with subpoenas were sometimes been given restricted access to data mining software on AT&T's Daytona database of domestic and international call records. And an article by Leslie Cauley in USA Today later that year suggested that the NSA was mining domestic call detail records provided by several carriers. More specifically, the Electronic Frontier Foundation has alleged in a lawsuit that the NSA had been given relatively unrestricted access, without subpoenas, to all or most of the AT&T Daytona database as part of the warrantless wiretap program,

Notably, the large-scale domestic metadata collection that made Comey and Mueller so uneasy is strikingly consistent with the 2006 news reports and the EFF lawsuit's claims about NSA access to Daytona, since AT&T's call database captures a substantial fraction of US citizens' domestic, and not just international, traffic. If the NSA made use of unrestricted access to this database (and perhaps of analogous databases maintained by other carriers), this would be cause for precisely the kinds of legal concerns described by Newsweek. While the law puts fewer restrictions on metadata collection than on content tapping, it still requires that records requests be focused on specific targets, and definitely does not allow the NSA to have wholesale access to databases of every telephone user's domestic calls.

If this was indeed what was going on -- and the recent Newsweek sidebar seems to corroborate it -- it would represent a much more invasive reach into the private lives of innocent Americans by the NSA than previous reports about the program have been able to confirm. And if AT&T really provided the government with sweeping access to the calling records of all its customers, that would be a huge personal disappointment -- not only a violation of the law, but a betrayal of the fundamental privacy values instilled into me from my very first day at Bell Labs, and that, I had genuinely believed, were embedded in the core of the company's culture.

So I hope I'm wrong. But at the very least, the Newsweek piece underscores the importance of investigating just what happened. We all deserve to know.