NSA Spied on Prominent Muslim Americans

The latest story from the Snowden documents is about five prominent Muslim Americans who were spied on by the NSA and FBI. It’s a good story, and I recommend reading it in its entirety. I have a few observations.

One, it’s hard to assess the significance of this story without context. The source document is a single spreadsheet that lists 7,485 e-mail addresses monitored between 2002 and 2008.

The vast majority of individuals on the “FISA recap” spreadsheet are not named. Instead, only their email addresses are listed, making it impossible in most cases to ascertain their identities. Under the heading “Nationality,” the list designates 202 email addresses as belonging to “U.S. persons,” 1,782 as belonging to “non-U.S. persons,” and 5,501 as “unknown” or simply blank. The Intercept identified the five Americans placed under surveillance from their email addresses.

Without knowing more about this list, we don’t know whether this is good or bad. Is 202 a lot? A little? Were there FISA warrants that put these people on the list? Can we see them?

Two, the 2008 date is important. In July of that year, Congress passed the FISA Amendments Act, which restricted what sorts of surveillance the NSA can do on Americans. So while this story tells us about what was happening before the FAA, we don’t know what—if anything—changed with the passage of the FAA.

Three, another significant event at the time was the FBI’s prosecution of the Holy Land Foundation on terrorism charges. This brought with it an overly broad investigation of Muslim Americans who were just associated with that charity, but that investigation came with approved warrants and all the due process it was supposed to have. How many of the Americans on this list are there as a result of this one case?

Four, this list was just the starting point for a much broader NSA surveillance effort. As Marcy Wheeler pointed out, these people were almost certainly associationally mapped. CAIR founder Nihad Awad is one of the NSA targets named in the story. CAIR is named in an EFF lawsuit against the NSA. If Awad had any contact with the EFF in 2008, then they were also being spied on—that’s one hop. Since I had lots of contact with the EFF in the affected time period, I was being spied on as well—that’s two hops. And if any of you e-mailed me around that time—well, that’s three hops. This isn’t “just metadata”; this is full-take content that’s stored forever. And, yes, the president instructed the NSA to only spy people up to two hops away this January, but that was just one program under one authority.

This is a hard story to analyze, because it’s more anecdote than data. I much preferred last Saturday’s story that tried to analyze broad trends about who the subjects of NSA surveillance are. But anecdotes are more persuasive than data, so this story might be more compelling to a mainstream audience.

Other commentary: EFF, Ben Wittes, the Director of National Intelligence. I’m curious to watch how this story unfolds in the media.

One final note: I just couldn’t think of a headline more sensationalist than the descriptive one.

Tags: Edward Snowden, EFF, FBI, FISA, national security policy, NSA, privacy, surveillance

Posted on July 9, 2014 at 12:39 PM • 29 Comments

Comments

drsjhdtw • July 9, 2014 1:11 PM

NSA Spied on Prominent Muslim Americans. What they discovered will blow your mind!

John • July 9, 2014 1:15 PM

NSA Spied on Prominent Muslim Americans. Carry on. Nothing to see here, move along.

Bob T • July 9, 2014 1:48 PM

NSA spied on millions of Americans… Carry on. Nothing to see here.

NSA spied on 5 Muslim Americans… Oh my God! Something must be done about this enormous abuse of power!

FYI • July 9, 2014 2:25 PM

The U.S. government issued about 150,000 requests for customer information from Verizon in the first half of 2014, most of them subpoenas, the country’s largest wireless carrier reported on Tuesday.

Not Bob T • July 9, 2014 2:38 PM

Bob T:

From the article.. there were multiple filters to get to 5. There were thousands of email addresses

a) From this large list, figure out who they were, in most cases only the personal email address (e.g. BobT@yahoo.com ) was listed, and you couldn’t fathom the name of the target from just the email address. So your tens of thousands goes down to a few hundred, maybe…

b) THEN you have to contact those hundreds, of the dozens who might respond (and not simply assume it was spam)…i.e. your sample goes to dozens

c) THEN from those you figure out who actually is willing to out themselves…looks like this was ~5

again 5 is not the number of people illegally spied on.

Bob T • July 9, 2014 3:12 PM

@Not Bob T

No kidding.

uh, Mike • July 9, 2014 6:55 PM

NSA_SPIED_ON_AMERICAN || NSA_SPIED_ON_PROMINENT || NSA_SPIED_ON_MUSLIM
|| SNOWDEN_STILL_AT_LARGE

Daniel • July 9, 2014 8:12 PM

How deep does this go, how many hops?

If the EFF is associated with Muslims and Bruce is associated with the EFF and if I read Bruce’s blog and click on a link to the EFF via Bruce’s blog does that mean I am now in the ring of fire? What if I had clicked on the EFF link via CNN? How about directly into the browser? How does all of this work, exactly?

Anura • July 9, 2014 9:28 PM

I’d imagine they populate a list, and then just add all acquaintences up to a fixed degree of separation so that you can be added to the list of you are, for example, no more than three degrees of separation from someone on the list.

void AddAcquaintancesToList(List<Person> suspects, int degrees, Person suspect)
{
    for (Uint64 i=0; i<suspect.Acquaintances.Count; i++)
    {
        suspects.Append(suspect.Acquaintances[i]);
        if (degrees < 3)
        {
            AddAcquaintancesToList(suspects, degrees+1, suspect.Acquaintances[i]);
        }
    }
}

And the loop on the initial list of suspects:

for (Uint64 i=0; i<Suspects.Count; i++)
{
    AddAcquaintancesToList(Suspects, 1, Suspects[i]);
}

Mr C • July 9, 2014 9:43 PM

And what if Kevin Bacon e-mailed the EFF?

Anura • July 9, 2014 9:44 PM

In school I was forced to write “I will not repeat myself.” 200 times on the blackboard. Apparently I didn’t learn anything from that lesson.

DB • July 9, 2014 10:42 PM

@ Anura: what? I didn’t hear you…

@ Daniel: if a target under surveillance emails the EFF and you do as well, you are 2 hops from the target: target (“terrorist”) -> eff (1 hop) -> you (2 hops). The same applies if you use the same doctor or lawyer as a target, you are 2 hops as well. If you use a doctor who knows another doctor who has a patient who is a target, then you are 3 hops. If you don’t want to be investigated, you should never use any doctors, lawyers, or anything else that might see lots of unsavory people, you must never go shopping or to the store, you must never go outside, or walk down the street, and you must never use a phone or the internet or snail mail. It’s way way too easy to get within 2 or 3 hops of a criminal.

Thoth • July 9, 2014 10:50 PM

Hmmm.. doesn’t it means if Bruce is being spied on, the counter on the hops are reset to 0 because Bruce is on the list and anyone 2 hops from Bruce are all within reach and that will mean you are in the list and anyone 2 hops away from you are in the list because you are now in the list and now the infinite ‘do-while’ or ‘for’ loop goes on forever.

Honestly, there is nothing preventing NSA or big budget peoples from not spying. The power is in the money/resources. Once you have too much to spend, you will definitely use whatever you have to get whatever you want without much thought on the price tag because you own the dollars and cents.

In simple, everyone’s already a target of NSA (readers of this blog or not) because everyone’s somehow connected to each other in just a few hops away.

There’s very little practical defense against NSA as most of the products out there are pretty much broken in one way or another.

The only way to mount a successful practical defense is major change in how things are done on a personal and interpersonal level.

Anura • July 9, 2014 11:03 PM

@Thoth

I was curious if anyone would notice that. Also, I just noticed I forgot to check if someone is on the list before adding them, so it might get caught in an infinite loop before everyone in the world gets added to the list (in other words, I repeated myself).

AnonymousBloke • July 9, 2014 11:20 PM

Unfortunately, a lot of Americans probably will go, “Oh, well, they are Muslim”.

They this means they could be treated the same way by their own beliefs does not figure into their calculations.

But, I have already seen some solid civil rights arguments here. Some down home condemnations for this atrocious behavior. So, looks like this does add some fuel to the fire.

America is the most diverse nation on the planet. There has been a lot of progress made here in the past fifty years towards getting people out of the gutter. I really hate these guys sending out the message that we are racist scumbags who are anti-liberty and justice.

Hypocrites against our own founding documents — that I happen to see as remarkably inspiring.

Snowden is not doing this anymore then a cop arresting a criminal is guilty of the criminal’s deeds. This is an exposed crime. Don’t shoot the messenger.

Only by exposing wrongdoing can it be found, condemned, and corrected.

My very old fashioned take, anyway.

aaaa • July 10, 2014 2:32 AM

@AnonymousBloke “Unfortunately, a lot of Americans probably will go, “Oh, well, they are Muslim”.”

Sure they will. And once NSA advocates settle on that, Greenwald will release another article with another 5 persons who will not be Muslim. And once they settle on some other excuse, there will be another 5 persons to prove them wrong.

That is how leaks were orchestrated so far, so there is no reason to think it will be different this time.

RonK • July 10, 2014 3:00 AM

I just couldn’t think of a headline more sensationalist than the descriptive one.

I can’t wait to see what you’re going to do with the Friday squid post, Bruce. 🙂

65535 • July 10, 2014 3:44 AM

“Is 202 a lot? A little? [Out of a list of 7,485 email accounts] Were there FISA warrants that put these people on the list?” – Bruce S.

That is a good question. With 5,501 “unknown” we don’t know. These two posts [Both Bruce’s and The Intercept] raise more questions than answers.

The NSA is playing word games. We don’t know the real extent of their surveillance.

“…this list was just the starting point for a much broader NSA surveillance effort. As Marcy Wheeler pointed out, these people were almost certainly associationally mapped. CAIR founder Nihad Awad is one of the NSA targets named in the story. CAIR is named in an EFF lawsuit against the NSA. If Awad had any contact with the EFF… then they were also being spied on — that’s one hop. Since I had lots of contact with the EFF in the affected time period, I was being spied on as well — that’s two hops. And if any of you e-mailed me around that time — well, that’s three hops. This isn’t “just metadata”; this is full-take content that’s stored forever. And, yes, the president instructed the NSA to only spy people up to two hops away this January, but that was just one program under one authority.” – Bruce S.

We simply don’t know what a “hop” constitutes. We don’t know what other programs like the Section 702 “backdoor” and other loopholes in FISA legal framework allow.

Greenwald notes “activities that “involve or may involve” criminal activity…” Those loopholes are large enough to drive an eighteen wheel truck through [These loopholes appear to trickle down to the average citizen. We know that the USA police are using the “Stingray” cell tower impersonators to track citizen in the USA – the “Stingray” will be discussed in another post].

See 702 backdoor:
http://www.thedailybeast.com/articles/2014/07/03/it-s-time-to-shut-the-nsa-s-backdoor-used-to-spy-on-americans.html

It’s creepy that people on this blog probably are being monitored and their IP addresses and computers are probably being tagged – just for reading this site.

The NSA’s slide of “RAGTIME/SQF partition” shows FISA accounts have a unique case notation of xx.SQFxxx. And, below that is PALMCARTE with a Duplicate Feed to the NAC, TRAFFIC THIEF and LOCATION DATA BASE.

See slide:
https://firstlook.org/theintercept/document/2014/07/08/fisa-dataflow/

We don’t know what is in those data bases and who authorizes that data. We need more information.

We know that the FBI can issue a NSL with a gag order [without a judges signature].

It is possible that there is very little other legal oversight on those individuals listed on that spread sheet [the spread sheet is highly redacted and we don’t know if the NSA or the FISC constructed it]. There is too little information to make a determination.

As Greenwald notes:

“In its 35-year history, the court has approved 35,434 government requests for surveillance, while rejecting only 12.”

Yet, the “Verizon disclosure” shows that a single warrant can be a “bulk” warrant for an entire data base. Thus, the actual number of individuals caught in the drag net is probably much higher.

Greenwald shows Alexander to be less than truth full regarding attorney – client communications:

‘…in response to revelations that the NSA had monitored the communications of a U.S. law firm representing the government of Indonesia, then-NSA chief Keith Alexander assured the American Bar Association that the “NSA has afforded, and will continue to afford, appropriate protection to privileged attorney-client communications acquired during its lawful foreign intelligence mission.”’

Yet, is clear that lawyer-client conversation were recorded, analyzed and loaded into a database(s). Alexander was not telling the whole story.

[The NSA PR agents]

Greenwald hints that he and his sources are being spied upon and the NSA’s PR agents are spinning his story before it is released:

“Justice Department did not respond to repeated requests for comment on this story, or for clarification about why the five men’s email addresses appear on the list. But in the weeks before the story was published, The Intercept learned that officials from the department were reaching out to Muslim-American leaders across the country to warn them that the piece would contain errors and misrepresentations, even though it had not yet been written. Prior to publication, current and former government officials who knew about the story in advance also told another news outlet that no FISA warrant had been obtained against Awad during the period cited. When The Intercept delayed publication to investigate further, the NSA and the Office of the Director of National Intelligence refused to confirm or deny the claim, or to address why any of the men’s names appear on the FISA spreadsheet. Prior to 2008… FISA required only an authorization from the attorney general—not a court warrant—for surveillance against Americans located overseas.”

See the intercept approximately 75% down article:
https://firstlook.org/theintercept/article/2014/07/09/under-surveillance/

It would be nice to know how many other NSA stories are “spun” by NSA PR agents before the stories come to light.

jbmoore61 • July 10, 2014 7:58 AM

I was already being spied on because I was a Linux Journal subscriber and had been for years. This new revelation is just icing on the cake. I’m sure Bruce has been spied on for other reasons and any one reading this blog is likely also spied on. Bruce didn’t need to be associated with the EFF for scrutiny.

David Leppik • July 10, 2014 11:08 AM

WTF? No clickbait in the title? Here I thought this was All Clickbait All The Time Week.

Benni • July 10, 2014 1:33 PM

Bruce Schneier wrote:
“I much preferred last Saturday’s story that tried to analyze broad trends about who the subjects of NSA surveillance”

whilst this may be the case for academic purposes if a historian wants to write a history of NSA’s surveillance, I think the new story on NSA spying on prominent muslims is also extremely important.

It shows that the NSA is spying on prominent, comparably wealthy people and even on lawyers. And lawyers are the parts of the population that is usually the fastest in suing anyone, if they get a chance.

I think greenwald should now make up a website, where you can enter your email adress in order to find out if it is targeted by NSA.

The more lawyers know that they were spied on by NSA, the better it is. I hope that there is a file in Snowden’s cache saying NSA spied on each individual eff lawyer. Or lawyer organizations, or judges, or policemen and so on…

By the way, after a second NSA/CIA mole was found in germany, the CIA’s chief of station in berlin now has to move to another country:

http://www.spiegel.de/international/germany/germany-asks-top-cia-official-to-leave-country-a-980372.html

http://www.spiegel.de/international/germany/arrest-of-bnd-employee-strains-ties-between-germany-and-us-a-979738.html

Interesting is how the white house reacts to this. CIA boss Brennan phoned the state secretary responsible for secret services in Berlin. Brennan only talked about the importance of the trans-atlantic friendship and the “bad press” they have gotten recently. With no excuse, and no sorry.

http://www.spiegel.de/politik/deutschland/spionage-bundesregierung-fordert-cia-vertreter-zur-ausreise-auf-a-980342.html

the white house says:
http://www.spiegel.de/politik/ausland/us-geheimdienste-weisses-haus-vermeidet-statement-zur-spionageaffaere-a-980395.html

They can not give any statements to activities of secret services. Instead Caitlin Hayden says “our security partnership with germany is of high importance. It guarantees the security of germans and americans. It is mandatory that the high degree of cooperation continues in all areas”

How arrogant are they? They place moles at german authorities to spy on germany’s parliament and they place antennas and bugs to spie on the german parliament, tapping the mobile of the german chancellor. And now they say that this guarantees the security of “germans and americans”?

I think that BND really should stop sharing the data it gathers from the de-cix fulltake.

Whistleblower binney said that in his time, NSA was at 10 Gbit/s in fiber tapping. No wonder they call de-cix 3 Tbit/s “project wharpdrive”. I guess cutting that access off would hurt them a bit.

For now, BND is just practicing a bit zoology by searching for other NSA moles:

http://www.spiegel.de/politik/deutschland/spionageverdacht-bnd-will-nach-weiteren-maulwuerfen-suchen-a-980412.html

Robert.Walter • July 10, 2014 4:48 PM

“They can not give any statements to activities of secret services. Instead Caitlin Hayden says “our security partnership with germany is of high importance. It guarantees the security of germans and americans. It is mandatory that the high degree of cooperation continues in all areas””

Excuse me Caitlin, but “mandatory”? From whom and to whom issues such a mandate?

Due to non existent separation of powers, and just plain “let’s do it because we can” dunderheaded agency overreach, the spooks have set the constitution alight, yet the PR-department seems content in playing their tone-deaf fiddle.

Dumpfbacke Affenschwanz • July 10, 2014 10:12 PM

NATO Charter Article 13

P/K • July 10, 2014 10:49 PM

Well, actually the headline of this blog post is not correct at all. If you look at the spreadsheet excerpts, there’s not a single bit that points to NSA. The “Responsible Agency” for all five Muslim-American leaders is the FBI, and also the case notation starting with XX.SQF means that it’s data collected by the FBI, which is correct, as it’s the FBI which is responsible for domestic investigations related to national security and counter terrorism.

CallMeLateForSupper • July 11, 2014 8:28 AM

@65535
“Greenwald shows Alexander to be less than truth full regarding attorney – client communications:”

I don’t see definite untruthfulness. Misdirection? Likely. Partial disclosure? Almost certainly.

The statement in question: (Greenwald article extract) “.. Keith Alexander assured […] that the ‘NSA has afforded, and will continue to afford, appropriate protection to privileged attorney-client communications acquired during its lawful foreign intelligence mission.'”

@65535 responded: “Yet, is clear that lawyer-client conversation were recorded, analyzed and loaded into a database(s). Alexander was not telling the whole story.”

I agree. I believe that no string of words Alexander builds comprises “the whole story”, Having said that, I hasten to add that the same applies to certain other players in the fed. arena.

But there’s something else. It is important to understand the definition of “protection” as Alexander used it (above). While most everyone outside NSA probably understands it to mean “not vacuum up” (because we want that), it does not, in fact,mean that. It means that NSA did, – and will continue to – use some unspecified degree of discretion in its handling of attorney-client communications. Had he loosened up and spolen candidly, he might have said something like, “Make no mistake: NSA is gonna vacuum up whatever we can, be it attorney-client ot other, but. regarding the former, we will not release it to just any Tom, Dick and Harry.”

CallMeLateForSupper • July 11, 2014 8:57 AM

@Benni “I think greenwald should now make up a website, where you can enter your email adress in order to find out if it is targeted by NSA.”

That thought occurred to me too. About two milliseconds later I reined up hard when I realized that it is a bad idea, for several reasons. The greatest reason by far is that little would prevent a TLA from monitoring the IP of such a web site and grabbing every visitor’s IP and every queried addy.

Once could argue that using Tor + TLS when querying would make TLA’s task expensive. I would agree, then counter that most people don’t use Tor.

Skeptical • July 11, 2014 5:44 PM

The “hops” analysis applies to the telephone metadata collection program, I believe. It would not apply to “full take” surveillance targeted at US persons.

I have to say that this story from Greenwald is neither good nor bad news. It doesn’t tell us anything about whether the US is abusing its surveillance powers. If a warrant was obtained for surveillance in these cases, then there is no problem. But we don’t know if a warrants were obtained; if they were, we don’t know what was in the application.

Even the statement from the EFF on the story, on my reading, is rather mild and cautious, as though they were attempting to walk a fine line between advocating for their client and not straying from what little the facts reported would support.

P/K • July 11, 2014 11:44 PM

Yes, the “hops” are only used for analysing the telephony metadata that NSA collects from US telecoms. That is: only for the domestic metadata there’s a restriction to 2 or 3 hops. The hops are of course also used for foreign metadata, but for that the number if hops isn’t legally restricted (only by practical reasons).

Brian Dell • July 12, 2014 9:08 PM

“officials from the department were reaching out to Muslim-American leaders across the country to warn them that the piece would contain errors and misrepresentations”

Erik Wemple of the Washington Post was skeptical of Greenwald’s claim here and fact-checked it. The party doing the spinning here is Greenwald.

People seem to be ignoring the fact that with these five the FBI is involved. The difference between the FBI and the NSA is enormous. A huge number of Americans are behind bars because of FBI surveillance. Is there even one who has been incarcerated solely based on NSA surveillance?

I don’t much care if the NSA is watching me. So U.S. foreign policy is more informed, big deal. The FBI? That is totally different, and has to be taken very very seriously. FBI surveillance has consequences.

Schneier on Security