[Senate Hearing 113-879]
[From the U.S. Government Publishing Office]
S. Hrg. 113-879
CONTINUED OVERSIGHT OF
U.S. GOVERNMENT SURVEILLANCE AUTHORITIES
=======================================================================
HEARING
before the
COMMITTEE ON THE JUDICIARY
UNITED STATES SENATE
ONE HUNDRED THIRTEENTH CONGRESS
FIRST SESSION
__________
DECEMBER 11, 2013
__________
Serial No. J-113-42
__________
Printed for the use of the Committee on the Judiciary
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
U.S. GOVERNMENT PUBLISHING OFFICE
28-113 PDF WASHINGTON : 2018
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
COMMITTEE ON THE JUDICIARY
PATRICK J. LEAHY, Vermont, Chairman
DIANNE FEINSTEIN, California CHUCK GRASSLEY, Iowa, Ranking
CHUCK SCHUMER, New York Member
DICK DURBIN, Illinois ORRIN G. HATCH, Utah
SHELDON WHITEHOUSE, Rhode Island JEFF SESSIONS, Alabama
AMY KLOBUCHAR, Minnesota LINDSEY GRAHAM, South Carolina
AL FRANKEN, Minnesota JOHN CORNYN, Texas
CHRISTOPHER A. COONS, Delaware MICHAEL S. LEE, Utah
RICHARD BLUMENTHAL, Connecticut TED CRUZ, Texas
MAZIE HIRONO, Hawaii JEFF FLAKE, Arizona
Kristine Lucius, Chief Counsel and Staff Director
Kolan Davis, Republican Chief Counsel and Staff Director
C O N T E N T S
----------
DECEMBER 11, 2013, 2:02 P.M.
STATEMENTS OF COMMITTEE MEMBERS
Page
Grassley, Hon. Chuck, a U.S. Senator from the State of Iowa...... 3
Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont. 1
prepared statement........................................... 88
WITNESSES
Witness List..................................................... 39
Alexander, Hon. Keith B., Director, National Security Agency,
Fort Meade, Maryland........................................... 5
prepared joint statement..................................... 40
Black, Edward J., President and Chief Executive Officer, Computer
and
Communications Industry Association, Washington, DC............ 28
prepared statement........................................... 50
Cole, Hon. James M., Deputy Attorney General, U.S. Department of
Justice, Washington, DC........................................ 7
prepared joint statement..................................... 40
Cordero, Carrie F., Director, National Security Studies, and
Adjunct Professor of Law, Georgetown University Law Center,
Washington, DC................................................. 32
prepared statement........................................... 76
Litt, Hon. Robert S., General Counsel, Office of the Director of
National Intelligence, Washington, DC.......................... 9
prepared joint statement..................................... 40
Sanchez, Julian, Research Fellow, Cato Institute, Washington, DC. 30
prepared statement........................................... 66
QUESTIONS
Questions submitted jointly to Hon. Keith B. Alexander and Hon.
James M. Cole by Senator Klobuchar............................. 96
Questions submitted to Hon. Keith B. Alexander by Senator Leahy.. 91
Questions submitted to Edward J. Black by Senator Grassley....... 98
Questions submitted to Edward J. Black by Senator Klobuchar...... 97
Questions submitted to Hon. James M. Cole by Senator Leahy....... 92
Questions submitted to Carrie F. Cordero by Senator Grassley..... 99
Questions submitted to Hon. Robert S. Litt by Senator Leahy...... 94
Questions submitted to Julian Sanchez by Senator Grassley........ 100
ANSWERS
Responses of Hon. Keith B. Alexander and Hon. James M. Cole to
questions submitted jointly by Senator Klobuchar............... 101
[Note: At the time of printing, after several attempts to obtain
responses to the written questions, the Committee had not
received any communication from Hon. Keith B. Alexander to
questions submitted by Senator Leahy.]
Responses of Edward J. Black to questions submitted by Senator
Grassley....................................................... 107
Responses of Edward J. Black to questions submitted by Senator
Klobuchar...................................................... 105
[Note: Responses of Hon. James M. Cole to questions for the
record from Senator Leahy are classified and are, therefore,
provided separately.]
Responses of Carrie F. Cordero to questions submitted by Senator
Grassley....................................................... 110
[Note: Responses of Hon. Robert S. Litt to questions for the
record from Senator Leahy are classified and are, therefore,
provided separately.]
Responses of Julian Sanchez to questions submitted by Senator
Grassley....................................................... 114
MISCELLANEOUS SUBMISSIONS FOR THE RECORD
Access et al., a letter on surveillance practices, November 21,
2013, letter................................................... 118
AOL et al., a letter on the USA Freedom Act, October 31, 2013,
letter......................................................... 116
AOL et al., an open letter to Washington, December 9, 2013,
letter......................................................... 120
attachment: Surveillance Reform Principles................... 121
CONTINUED OVERSIGHT
OF U.S. GOVERNMENT
SURVEILLANCE AUTHORITIES
----------
WEDNESDAY, DECEMBER 11, 2013
United States Senate
Committee on the Judiciary
Washington, DC.
The Committee met, pursuant to notice, at 2:02 p.m., in
Room SD-226, Dirksen Senate Office Building, Hon. Patrick J.
Leahy, Chairman of the Committee, presiding.
Present: Senators Leahy, Whitehouse, Klobuchar, Franken,
Blumenthal, and Grassley.
OPENING STATEMENT OF HON. PATRICK J. LEAHY,
A U.S. SENATOR FROM THE STATE OF VERMONT
Chairman Leahy. Okay. We can get started because I know
with all the other things going on on the Hill, it is going to
be a tad busy today. But I appreciate General Alexander, Mr.
Cole, and Mr. Litt being here.
We are going to be renewing our examination of Government
surveillance activities, and it seems every time we have these,
there has been a series of new revelations. The latest
disclosures raise some significant questions about the scope
and wisdom of our surveillance activities both at home and
abroad. So it is clear that we have a lot more oversight work
to do.
In the last week, there have been press reports that the
NSA is collecting billions of records a day of cell phone
locations around the world and can track individuals and map
their relationships. There have also been reports that the NSA
is monitoring online video games, which just in the press
reports raises a question:
Because we can do something, does it really make sense to do
it?
Especially last month, the administration released a set of
documents revealing details about yet another massive dragnet
collection program in addition to the phone records program.
And this time the NSA was gathering in bulk an enormous amount
of Internet metadata under the pen register and trap and trace
device authority in FISA. Now, I would just note that, just
like Section 215, there is nothing in the pen register statute
that expressly authorizes the dragnet collection of data on
this scale.
Although the Internet metadata collection program we are
told is not currently operational, it resulted in a series of
major compliance problems--just like the Section 215 program.
According to the FISA Court, the NSA exceeded the scope of
authorized acquisition not just once or twice, but
``continuously'' during many of the years the program was in
operation. Again, another reason why we should have a lot more
oversight and a lot more open oversight than we do have.
The problems were so severe that the FISA Court ultimately
suspended the program entirely for a period of time before
approving its renewal. But once renewed, the Government
asserted that this bulk collection was an important foreign
intelligence tool--which is the claim it makes now about the
Section 215 phone records. But then in 2011 the Government
ended this ``valuable tool,'' as they called it, this Internet
metadata program because, as Director Clapper explained, it was
no longer meeting ``operational expectations.''
It is important to note that the administration does not
believe that there is any legal impediment to re-starting this
bulk Internet data collection program if it--or a future
administration--wanted to do so. The legal justification for
this Internet metadata collection is troubling. As with the
Section 215 program, the Internet metadata program was based on
a ``relevance'' standard. And as with the Section 215 program,
there is no adequate limiting principle to this legal
rationale. The American people have been told that all of their
phone records are relevant to counterterrorism investigations.
Now they are told that all Internet metadata is also relevant
and apparently fair game for the NSA to collect.
In any country, this legal interpretation would be
extraordinary. It goes beyond extraordinary in the United
States. And it is going to have serious privacy and business
implications in the future, particularly as new communications
and data technologies are developed.
So it should come as no surprise that the American
technology industry is greatly concerned about these issues. I
have heard from a number of companies who worry that their
global competitiveness has been weakened and undermined. They
say that American businesses stand to lose tens of billions of
dollars in the coming years, and we need to make substantial
reforms to our surveillance laws to rebuild confidence in the
U.S. technology industry. This confidence can be thrown away
very easily, and it is more difficult to get it back.
Earlier this week, eight major technology companies--
including Microsoft, Google, Apple, Facebook, and Yahoo--
released a set of five principles for surveillance reform.
Citing the ``urgent need to reform Government surveillance
practices worldwide,'' the companies call for greater oversight
and transparency, but they also advocate for limits that would
require the Government to rely on targeted searches about
specific individuals rather than the bulk collection of
Internet communications from all of us.
I have introduced the USA FREEDOM Act with Senator Lee here
in the Senate, and our bill takes many of these steps. So I
appreciate the support we have received from the technology
industry, and I look forward to hearing their perspective on
the second panel.
Without objection, I will place in the record the open
letter and reform principles from the technology companies, an
earlier letter from technology companies applauding the USA
FREEDOM Act, and a supportive letter from a coalition of civil
society organizations, companies, trade associations and
investors. And without objection, they will be part of the
record.
[The letters appear as submissions for the record.]
Chairman Leahy. Support from the technology industry is
representative of the broad-based, bipartisan support for our
legislation. Organizations across the spectrum have endorsed
the bill, from the ACLU to the NRA. I want to thank Senator
Lee, Senator Durbin, Senator Blumenthal, and Senator Hirono for
their cosponsorship.
This is bipartisan, it is also bicameral legislation. It is
a commonsense bill that makes real and necessary reforms. So I
want input on the legislation, and I look forward to working on
this in the coming months. I do want to thank our witnesses for
being here today, especially after we had the unexpected
cancellation in November.
[The prepared statement of Chairman Leahy appears as a
submission for the record.]
Senator Grassley, I know you have half a dozen conflicts on
your schedule. I thank you for being here.
OPENING STATEMENT OF HON. CHUCK GRASSLEY,
A U.S. SENATOR FROM THE STATE OF IOWA
Senator Grassley. Thank you. Of course, this is a very
important hearing, and you are doing the right thing by having
the hearing because this is a subject of ongoing media
attention and a lot of constituent interest.
We last held a hearing in early October. Since then,
reports have continued to surface in the media about possible
overreach on the part of Government. Some of the reports may be
more accurate than others, but I continue to believe that many
of them call into serious question whether the law and other
safeguards currently in place strike the right balance between
protecting our civil liberties and our national security. And
that balance is a very important balance, but it is a balance
that, for personal liberty as well as national security, both
have constitutional implications. You cannot forget one or the
other.
This is especially so concerning the public revelation that
under Section 215 of the PATRIOT Act, the Government is
collecting Americans' phone metadata in bulk.
Why are many Americans so concerned? Well, it is not hard
to find an example of what can happen to Americans' personal
information when the Government overreaches, mismanages, and
fails the American people.
It has been 2 months since the administration tried to
bring the Obamacare website online, and the American people are
suffering under that issue. Many are finding they cannot keep
the insurance plans they liked. Their premiums are rising, and
uncertainty is growing about which parts of the law the
President will decide to uphold.
But in just these few months, we have already seen reports
of incidents where Obamacare has not adequately protected
Americans' personal data. In one reported instance in
Minnesota, an insurance broker was accidentally provided the
personal information of 2,400 people. Moreover, there are many
unanswered questions about the website's ability to protect
privacy going forward.
Now, I expect--in fact, I understand that the standards of
the dedicated professionals in our intelligence community do
not compare to those of the contractors who failed to set up
the website that I have referred to. But it is easy to see why
many Americans tend to be skeptical then that the Government
can adequately maintain their privacy when it collects vast
amounts of information.
The President's disengagement on these important matters
does not help. He claims he was unaware of the problems with
the Obamacare website before it was launched. Now reports say
he was unaware of the reported surveillance of many world
leaders.
As I did back in October, I call on the President to lead.
Many of these programs are critical to our national security.
The President needs to contribute to the national debate by
publicly explaining and defending them. For instance, a visit
to Fort Meade would help the morale a great deal.
It is good that there are numerous reform proposals that
this Committee will have the opportunity to consider going
forward. I am convinced there is a role for greater
transparency, oversight, and accountability in the FISA
process. The public trust in our intelligence community must be
rebuilt. And, of course, we must ensure that intelligence
authorities are exercised in a manner consistent with our laws
and the Constitution.
These proposals should be subject to the same rigorous and
critical examination to which we are subjecting the
surveillance programs themselves.
These proposals should address the specific concerns that
have been brought to light, not relitigate old and irrelevant
legislative battles.
These proposals should not provide a terrorist abroad with
rights similar to those of a U.S. citizen here at home.
These proposals should not make it more burdensome for
authorities to investigate a terrorist than it is to
investigate a common criminal.
And these proposals should not return us to a pre-September
11th posture. Then we did not adequately weigh the dedication,
intelligence, and lethality of our foreign enemies, who are
undoubtedly watching the debate very closely.
The balance between protecting individual liberties and our
national security is a delicate one, and reasonable people can
disagree about precisely where that balance must be struck, and
that is our responsibility here in the Congress of the United
States.
Our witnesses on both panels today represent a wide range
of views, and I look forward to hearing their point of view.
And before you start, Mr. Chairman, I would like to explain
further something you brought up that I had a conflict. At
2:30, Secretaries Kerry and Lew are briefing Senators about the
classified details of the controversial nuclear agreement the
Obama administration has made with Iran. I am skeptical of that
agreement, but I have a responsibility to learn more about it.
But I have to weigh going to that hearing to be here because I
also, as leader of the Republicans, know the importance of FISA
and whatever work is done there for our national security as
well.
The Chairman did accommodate us to some extent by moving
this ahead by a half-hour. I am going to stay beyond that half-
hour anyway to ask questions, at least of the first panel. I
had asked the meeting to be rescheduled, and it is the
Chairman's prerogative to lead this Committee as he sees the
necessity to do it. But I think it is too bad that this could
not be worked out so that Senators could attend both of these
matters together.
Thank you, Mr. Chairman.
Chairman Leahy. Well, thank you, and I wish I could be at
the other hearing, too, but we have had to reschedule this once
already, and everybody has agreed to be here today, and I did
not think it was fair to our witnesses to reschedule again.
Besides, a lot of these classified briefings, like the one you
just referred to, I have had to miss in the past because of
conflicts, but I find I can usually read almost all of what was
said there in the paper the next day anyway, usually in more
detail.
Senator Grassley. I agree with you on that point. But also
it kind of makes a mockery of what they call ``secured.''
Chairman Leahy. Well, it depends upon whose ox is being
gored, I guess. It is more of a question of who can get it out
quickest. I do recall one of these very highly classified
matters that we had, and the very first thing that came up
marked top secret was a photograph of the cover of one of that
week's news magazines, and it went downhill from there.
Our first witness is General Keith Alexander, Director of
the National Security Agency and head of U.S. Cyber Command. He
began his service at the U.S. Military Academy at West Point,
previously served as the commanding general of the U.S. Army
Intelligence and Security Command, and Director of
Intelligence, U.S. Central Command. And, of course, one,
General, I thank you for being here. Your full statement will
be made part of the record, but in the time you have, please
feel free to hit any points you want or summarize in any way
you would like.
STATEMENT OF HON. KEITH B. ALEXANDER, DIRECTOR,
NATIONAL SECURITY AGENCY, FORT MEADE, MARYLAND
General Alexander. Chairman, thank you, and I will keep my
opening remarks short, but I would like to hit a few key
things.
First, NSA is a foreign intelligence agency. Those action
tools that we do are to connect what we know about foreign
intelligence to what is going on here in the United States. We
need tools to bring that together. I want to talk briefly about
some of those tools.
Some of those tools, like Section 215, in my opinion and I
think in the Court's, our community, were authorized by
Congress. They are legal, they are necessary, and they have
been effective.
From my perspective, the threats are growing. When we look
at what is going on in Iraq today, what is going on in Syria,
the amount of people killed from 1 September to 3 December is
over 5,000 from terrorist-related acts in Iraq, Syria, and
several other countries around the world.
In Iraq alone, in 2012 the total number killed were 2,400.
From 1 September to 3 December, that has risen to 2,200-plus in
a 3-month period. It is on the verge of a sectarian conflict.
The crisis in the Middle East is growing, and the threat to us
from terrorist activities, their safe havens, and those being
radicalized are growing.
What we found out in 9/11--and I go back, Senator Grassley,
to your comments--we cannot go back to a pre-9/11 moment. Sir,
I absolutely agree with that. So we have to find out what is
the right way for our Nation to defend ourselves and our allies
and protect civil liberties and privacy. I think the way we are
doing Section 215 is actually a good model, not just for our
country but for the rest of the world. It has the courts,
Congress, and the administration all involved.
Why do I say that? The reason is if you look at all the
information that is out there, the billions and billions of
books of information that are out there, there is no viable way
to go through that information if you do not use metadata. In
this case, metadata is a way of knowing where those books are
in the library and a way of focusing our collection, the same
that our allies do, to look at where are the bad books.
From our perspective, from the National Security Agency's
perspective, what we do is get great insights into the bad
actors overseas. Armed with that information, we can take the
information, the to-from--and what I did is I put that on a
little card. It says the from number, the to number, the date,
time group of the call, and the duration. That is the elements
of information we use in the 215. There is no content. There
are no names, no email addresses.
From my perspective, that is the least intrusive way that
we can do this. If we could come up with a better way, we ought
to put it on the table and argue our way through it.
The issue that I see right now is there is not a better
way. What we have come up with is can we change one.
But, Senator Grassley, you brought out a great point: 9/11,
we could not connect the dots because we did not have this
capability to say someone outside the United States is trying
to talk to someone inside the United States.
Chairman Leahy. We also had people in the administration
that refused to listen to FBI agents who had picked up on what
was happening here in the United States when they were told it
was not important, even though anybody with a brain in their
head would have known it was. But go ahead. I understand your
point. And let us stick to the facts. We are not talking about
a library. I had my first library card when I was 4 years old.
I understand libraries. Let us talk about the NSA.
General Alexander. Well, I think the important part for us,
Mr. Chairman, is: How do you bring information that you know
from outside the country to that which we have inside? How do
you connect the dots? And that is the issue with the metadata
program. There is no other way that we know of to connect the
dots.
And so that gets us back to, do we not do that at all.
Given that the threat is growing, I believe that is, an
unacceptable risk to our country. So what we have to do is can
we do more on the oversight and compliance? And there are
things that are being looked at. But taking these programs off
the table from my perspective is absolutely not the thing to
do.
I do agree with this discussion with industry, as well,
that you brought up, Chairman. Industry ought to be a player in
here. They have been hurt by this, and I think unfairly hurt.
We ought to put this on the table from two perspectives.
Industry has some technical capabilities that may be better
than what we have. If they have ideas of what we could do
better to protect this Nation and our civil liberties and
privacy, we should put it on the table. And I think we should
have a way of bringing Government and industry together for the
good of the Nation, and we ought to take those steps.
So, Mr. Chairman, I just want to end with this statement:
We are a foreign intelligence agency. Our job is to figure out
what is going on outside the United States and to provide that
level of information to the FBI and others who are operating
inside the United States. To date, we have not been able to
come up with a better way of doing it.
I am not wed, I do not think anybody at NSA or the
administration is wed to a specific program, but we do need
something to help connect the dots, something that could help
defend this country. And I think these programs have been
effective.
That is all I have, Mr. Chairman.
Mr. Cole. Thank you, Chairman Leahy, Ranking Member
Grassley----
Chairman Leahy. I should have done an introduction. I
apologize.
Mr. Cole. Quite all right.
Chairman Leahy. James Cole first joined the Department of
Justice in 1979, served for 13 years in the Criminal Division.
He later became Deputy Chief of the Division's Public Integrity
Section. Before entering private practice, he was sworn in as
the Deputy Attorney General on January 3, 2011.
Please go ahead, Mr. Cole.
STATEMENT OF HON. JAMES M. COLE, DEPUTY ATTORNEY GENERAL, U.S.
DEPARTMENT OF JUSTICE, WASHINGTON, DC
Mr. Cole. Thank you, Chairman Leahy, Ranking Member
Grassley, and distinguished Members of the Committee, for
inviting us here to talk about the Foreign Intelligence
Surveillance Act. I am going to focus my opening remarks just
on the 215 program.
As has been mentioned, it involves the collection of
metadata from telephone calls, including the number that was
dialed, the date, and the time of the call and the length of
the call. It does not include the content of any phone calls,
any names, addresses, or financial information of any party to
the call. And under 215 it does not include any cell site
location information.
The Government can search this data only if it has a
reasonable, articulable suspicion that the phone number being
searched is associated with certain terrorist organizations.
Only a small number of analysts can make that determination,
and that determination must be documented so it can be reviewed
by a supervisor and later reviewed for compliance purposes. And
only a small portion of these records actually end up being
searched.
This program is conducted pursuant to authorization by the
FISA Court. Since the Court originally authorized this program
back in 2006, it has been reapproved on 35 separate occasions
by 15 individual Article III judges on the FISA Court.
Oversight of the 215 program involves all three branches of
Government. Within the executive branch, numerous entities in
NSA, the Department of Justice, and the Office of the Director
of National Intelligence are involved in assessing compliance.
We report any compliance incidents to the FISA Court
immediately. With respect to Congress, we have reported any
significant compliance problems, such as those uncovered in
2009, to the Intelligence and Judiciary Committees of both
Houses. Documents related to those 2009 problems have since
been declassified and have been released by the DNI.
Over the past several months, we have also gone to great
lengths to better explain publicly why the program is lawful.
Under Section 215, there must be reasonable grounds to believe
that the records that are collected are relevant to an
authorized investigation to protect against international
terrorism.
As both the FISA Court's opinions and our own 22-page white
paper explain, ``relevant'' is a very broad term. In its
ordinary sense, information is relevant to an investigation if
it bears upon or is pertinent to that investigation. Courts
have held that large repositories of information can satisfy a
relevance standard where the search of the whole repository is
necessary in order to identify the critical documents. This is
precisely the rationale that underlies the 215 collection
program, and it was recognized by the FISA Court.
The Court found that the entire collection of bulk metadata
is relevant to an authorized international terrorism
investigation because it is necessary, a necessary part of the
process to allow NSA to identify phone calls between terrorists
and other persons.
As Judge Eagan's recent opinion reauthorizing the program
recognized, and I quote, ``Because the subset of terrorist
communications is ultimately contained within the whole of the
metadata produced but can only be found after the production is
aggregated and then queried using identifiers determined to be
associated with the identified international terrorist
organizations, the whole production is relevant to the ongoing
investigation out of necessity.''
In addition to complying with 215, NSA's program must also
comply with the Fourth Amendment of the Constitution. Here the
Supreme Court's decision in Smith v. Maryland is directly on
point.
In Smith, the Court held that telephone users who convey
information to phone companies for the purpose of routing their
calls have no reasonable expectation of privacy in that
information.
Now, the Smith case was a number of years ago, and some
have questioned the applicability of it because it did not
concern a situation where the Government collected and retained
the bulk metadata and aggregated it all in one place. However,
a recent opinion of the FISA Court addressed this specific
issue, and it noted, ``Where one individual does not have a
Fourth Amendment interest, grouping together a large number of
similarly situated individuals cannot result in the Fourth
Amendment interest springing into existence.''
I understand that there is interest in legislating reforms
to the 215 program and other aspects of FISA, including the
nature of the Court process itself. We welcome this public
debate and this public discussion about whether the current
version of 215 and other provisions of FISA strike the right
balance between our national security and the privacy of our
citizens, both of which are important and have to be honored.
We look forward to working with the Committee to address these
issues and to find the right balance.
Thank you, Mr. Chairman.
Chairman Leahy. Thank you. Thank you very much, Mr. Cole.
And our last witness on this panel will be Robert Litt,
confirmed by the Senate in 2009 to serve as General Counsel of
the Office of the Director of National Intelligence. Prior to
joining the ODNI, he was a partner with the law firm of Arnold
and Porter, worked at the Department of Justice, and has
testified before this Committee before. Welcome back, Mr. Litt.
STATEMENT OF HON. ROBERT S. LITT, GENERAL COUNSEL, OFFICE OF
THE DIRECTOR OF NATIONAL INTELLIGENCE, WASHINGTON, DC
Mr. Litt. Thank you, Mr. Chairman, Ranking Member Grassley,
Members of the Committee. We do appreciate the opportunity to
appear today to continue our discussions about the intelligence
activities that are conducted pursuant to the Foreign
Intelligence Surveillance Act.
It is critical to assume that the public dialogue on this
topic is grounded in fact rather than in misconceptions, and
we, therefore, understand the importance of helping the public
to understand how the intelligence community actually uses the
legal authorities provided by Congress to gather foreign
intelligence and the extent to which there is vigorous
oversight of those activities to ensure that they comply with
the law.
As you know, the President directed the intelligence
community to make as much information as possible available
about certain intelligence programs that were the subject of
unauthorized disclosure, consistent with protecting national
security and sensitive sources and methods. Since that time,
the Director of National Intelligence has declassified and
released thousands of pages of documents about these programs,
including court orders and a variety of other documents. We are
continuing to do so. These documents demonstrate both that the
programs were authorized by law and that they were subject to
vigorous oversight, as General Alexander said, by all three
branches of Government.
It is important to emphasize that this information was
properly classified. It has been declassified only because in
the present circumstances the public interest in
declassification outweighs the national security concerns that
originally prompted classification.
In addition to declassifying documents, we have taken
significant steps to allow the public to understand the extent
to which we use the authorities in FISA going forward.
Specifically, as we describe in more detail in the written
statement that we submitted for the record, the Government will
release on an annual basis the total number of orders issued
under various FISA authorities and the total number of targets
affected by those orders. Moreover, we recognize that it is
important for companies to be able to reassure their customers
about how often or, more precisely, how rarely the companies
provide information to the Government. And so we have agreed to
allow the companies to report the total number of law
enforcement and national security legal demands they receive
each year and the number of accounts affected by those orders.
We believe that these steps strike the proper balance between
providing the public relevant information about the use of
these legal authorities while at the same time protecting
important collection capabilities.
A number of bills that have been introduced in Congress,
including the USA FREEDOM Act, which you have sponsored, Mr.
Chairman, contain provisions that would require or authorize
additional disclosures. We share the goals that these laws and
bills provide of providing the public with greater insight into
the Government's use of FISA authorities. However, we are
concerned that some of the specific proposals raise significant
practical or operational concerns.
In particular, we need to make sure that any disclosures
are operationally feasible with a reasonable degree of effort,
and that they would provide meaningful information to the
public. We also need to make sure that the disclosures do not
compromise significant intelligence collection capabilities by
providing our adversaries information that they can use to
avoid surveillance.
But, Mr. Chairman, I do want to emphasize our commitment to
work with this Committee and others to ensure the maximum
possible transparency about our intelligence activities
consistent with national security. We are open to considering
any proposals so long as they are feasible and do not
compromise our ability to collect the information we need to
protect our Nation and its allies. And we have been in
discussion with the staff of this Committee and the
Intelligence Committee on some proposals and some alternate
means of trying to provide greater transparency while
protecting our critical sources and methods.
We look forward to continuing to work with you in this
regard. Thank you.
[The prepared joint statement of General Alexander, Mr.
Cole, and Mr. Litt appears as a submission for the record.]
Chairman Leahy. Thank you, Mr. Litt.
Normally I would ask questions at this point, but I am
going to yield first to Senator Grassley, who does want to make
the other briefing. Senator Grassley.
Senator Grassley. Yes, and I appreciate very much that
accommodation.
Mr. Cole, back on October 2nd, I wrote a letter to the
Attorney General requesting information about cases of willful
and intentional abuse of authority by NSA employees. Some of
them were referred to the Justice Department for prosecution. I
would like to know whether these cases were prosecuted and, if
not, why not. I asked for a response by December 1st. Do you
know the answers to these questions? And if not, when would I
be able to expect an answer?
Mr. Cole. I do not know the specific answers on each of the
ones you cited, Senator Grassley, but we are in the process of
collecting that information. A number of them were not
prosecuted. A number of them involved the risk of further
damaging the national security by having to release more
information. Other sanctions were found that were adequate in
those cases. But we are trying to put together that information
so that we can give you an assessment of what happened in those
cases.
Senator Grassley. I thank you for that courtesy.
Mr. Cole, I want to make sure that I understand the
administration's positions on the USA FREEDOM Act. In your
prepared testimony that bill is not specifically mentioned, but
in your testimony you state that the administration ``does not
support legislation that would have the effect of ending the .
. . 215 program'' because the administration maintained that it
is lawful and valuable to protect national security. The answer
may be obvious, but I want to be clear for the record. Do you
understand the USA FREEDOM Act to be ``legislation that would
have the effect of ending the Section 215 program'' that you
described in your testimony?
Mr. Cole. Senator, you have kind of asked me a legal
question. I am going to have to give you a bit of a lawyer's
answer. It is going to depend on how the court--if the USA
FREEDOM Act becomes law, it is going to depend on how the court
interprets any number of the provisions that are in it and any
number of the additional requirements that are contained in it
over what is here and now. I think it will have an impact on
what is currently done under 215, but 215 covers more than just
bulk data collection. It covers individualized Business Records
acquisition. And depending on what kinds of records are being
sought, what the facts and circumstances are, will depend on
the nature and extent of the FREEDOM Act's impact on it.
On the bulk data, I think it is going to be a question of
the court's interpretation. Right now the interpretation of the
word ``relevant'' is a broad interpretation. Adding
``pertinent'' to a foreign agent or somebody in contact with a
foreign agent could be another way of talking about relevance
as it is right now. We would have to see how broadly the court
interprets that, or how narrowly.
Senator Grassley. I appreciate your legal view. Just from
the standpoint of how our process of legislation works and
since the President is Commander-in-Chief, the number one
person in charge of our national security, I would hope that we
would have a firm statement from the administration of whether
or not this legislation is harmful or not, and it would be
better to know that before courts get a decision, which would
be years down the road, than it would be now. And I think that
the administration owes that to all of us, both proponents and
opponents, of what that situation is.
My other question to you as well, other than 215, the USA
FREEDOM Act would also make other significant changes to the
tools used to investigate terrorism and espionage cases. For
example, the bill would raise the legal standard to issue
national security letters to require that the information
sought be both relevant and material as well as the information
pertained directly or indirectly to a foreign power or an agent
of that power. This is a change from the current standard,
which is mere relevance.
Question: What operational effect, if any, will these
changes have on the ability of your Department and the FBI to
protect the Nation from terrorist attacks?
Mr. Cole. Senator Grassley, probably the largest effect
that it would have on the NSL situation is the addition of the
requirement that it be relevant to or there is information that
it is connected to a foreign power. Many times NSLs are used in
a very preliminary stage of an investigation in order to
determine if the person who is being looked at is, in fact, a
foreign power or an agent of a foreign power. And so the
question is sometimes being answered through the use of
national security letters. If you must answer that question
before you can get a national security letter, it would reduce
the availability of that tool in terrorism investigations.
Senator Grassley. Thank you, Mr. Chairman. And I have two
questions that I will submit for answer in writing--can I ask
one more?
Chairman Leahy. Certainly.
Senator Grassley. Mr. Litt, one of the issues this
Committee has been looking at is whether or how to add more of
an adversarial element in the FISA Court process. The Chairman
invited a former FISA Court judge to be a witness at our
hearing in July. Judge James Carr explained in his answers to
questions for the record that he did ``not believe that having
independent counsel review all Government applications before
the FISC would be necessary or desirable.'' This appears to be
an approach reflected in the legislation that was passed by the
Senate Intelligence Committee. In contrast, as I understand it,
the FREEDOM Act requires the Government to provide every
application to the advocate.
Question: Between the different advocates proposals in the
USA FREEDOM Act and the Senate Intelligence Committee bill,
which do you believe is a better approach to making the FISA
Court process more adversarial? And why?
Mr. Litt. So, Senator Grassley, since the Department of
Justice is the agency that really conducts the litigation
before the FISA Court, I am going to defer the answer to that
to Deputy Attorney General Cole, although I will say that there
has been a lot of interagency discussion about the appropriate
approach there, which I think he can lay out.
Senator Grassley. Okay.
Mr. Cole. Senator Grassley, as I think we have said on a
number of occasions, we find that there is a use and a value to
having an independent legal representative in the FISA Court
process in the appropriate circumstances. We would not advocate
or recommend having one for all of the procedures that go on
there. Many of them, like in normal criminal cases, are
routinely done in an ex parte basis. They are done usually with
a fair degree of expediency and efficiency, and we think a
permanent public advocate might impede that process some of it
is applying to every single thing that is there. There would
also be, I think, some constitutional issues of standing for a
public advocate on every single issue.
We would propose that it be an amicus appointed by the
Court. When the Court feels that they have the need for another
perspective and another point of view, when it is a significant
issue involving privacy issues, civil liberty issues that the
Court would like to have another view on, that would be a good
example of a time. Something like the bulk data collection
programs where somebody may want to have a view of what the law
is other than the Government's view, we think that would be a
good area.
But I think the Court is in the best position to determine
when and where it is going to need those kinds of things and do
it only for those issues.
Senator Grassley. General Alexander, it will take you 5
seconds to answer this question. At our hearing in July, your
Deputy Director testified that the NSA was conducting an
investigation into how so highly classified information was
compromised by a single contractor. He stated the NSA would
report back to Congress about individual and systemic
responsibilities of what occurred. When can we expect that
report?
General Alexander. We will send that up right away. We have
actually taken 41 different actions, and we will get you a
report on what those are.
Chairman Leahy. What is ``right away''?
General Alexander. Over the next week.
Chairman Leahy. Okay. So we will have it by Wednesday.
Senator Grassley. Thank you, Mr. Chairman.
General Alexander. Next Wednesday.
Chairman Leahy. By then. Thank you.
Senator Grassley. Thank you, Mr. Chairman.
Chairman Leahy. Thank you.
Going back to the penultimate question about 215 phone
records and FISA Courts or FISC courts and so on, it has been
said these have always been authorized, and they have never
been up on appeal. We have never had an appellate court rule on
them. The bill that I have does not require an advocate in
every FISA Court case. It would be only when the Court agreed
that it might be helpful.
We also have statements from judges that, if that was the
case, there may be more credibility with the courts, or at
least more of a willingness on the part of the public to accept
courts that operate in secret.
Would you agree with that, Mr. Cole?
Mr. Cole. I think that that would help the public have
better confidence. I think the Court does run well. I think
there is a great deal of independence from my experience with
the Court in its rulings. It is not by any means a rubber
stamp. But I think there is a value with the public to having
some other person, some other advocate in the appropriate kinds
of cases, and I think there is a value to that, Senator, Mr.
Chairman. So I think that is a good idea as long as we keep it
in the right matters. So I would agree with that.
Chairman Leahy. And Senator Klobuchar will submit her
questions for the record, and I would ask them to be answered
as quickly as possible.
[The questions of Senator Klobuchar appears as a submission
for the record.]
Chairman Leahy. Now, we get in these press accounts that
the NSA is collecting billions of cell phone location records
every day and is reportedly gathering information or
communications information from online gaming sites. The
stories suggest the activities are directed abroad. We know the
NSA was making plans to obtain cell site location information
under Section 215. We also know that the NSA engaged in bulk
collection of Internet metadata under the FISA pen register
statute. So it suggests to me that under that kind of a legal
interpretation of FISA, the NSA could collect the same massive
amounts of information domestically that these recent stories
suggest they are collecting abroad.
So, Mr. Litt, maybe I should direct this first at you. I
know the program authorized the bulk collection of email and
other Internet metadata was shut down in 2011 because it was
not operationally useful. But under current law, would the NSA
be able to restart the bulk collection of Internet data?
Mr. Litt. I think that if the NSA and the Department of
Justice were able to make a showing to the FISA Court that the
collection of Internet metadata in bulk, which, of course, is a
category of information that is not protected by the Fourth
Amendment, that if it were relevant to an authorized
investigation and could convince the FISA Court of that, then,
yes, it would be authorized.
Chairman Leahy. It was shut down before because of not
being operationally useful. Would you have to go to the Court?
Mr. Litt. I believe we would have to----
Chairman Leahy. To restart the bulk collection of Internet
data, would you have to go to the Court?
Mr. Litt. I believe we would.
Chairman Leahy. Mr. Cole?
Mr. Cole. Yes, Mr. Chairman. Under the FISA statute, I
think you would have to get Court authority, just like you
would under 215, to be able to do that, and that would only
last for a period of time and have to be renewed periodically.
So there is no active authority for it right now.
Chairman Leahy. Thank you. And setting aside any
technological limitations, would the FISA pen register statute
authorize you to obtain all Internet metadata, not just email
metadata?
Mr. Cole. I think that is correct, but, again, it would be
limited to the metadata in that regard.
Mr. Litt. And if I could just add on that----
Chairman Leahy. If I can just make sure I understand Mr.
Cole's answer. So the only limitation would be that it be
metadata?
Mr. Cole. It cannot be content. It cannot be--and the
latest order of the FISA Court under 215, it specifically
excluded cell site location as well.
Chairman Leahy. Thank you.
Mr. Litt. I was going to add only that you would have to
show that the category of metadata that you are seeking was, in
fact, relevant to the authorized investigation.
Chairman Leahy. Okay. Well, Mr. Cole, you talked about the
legislation that Senator Lee and I have talked about to update
the Electronic Communications Privacy Act. We want to require
in criminal matters--I am talking about just criminal matters
now--that the Government obtain a probable cause warrant to
gain access to the contents of electronic communications that
are stored by a third-party provider. Section 215 of the USA
PATRIOT Act requires the Government to show only relevance to
an authorized intelligence investigation in order to obtain
records. I am not talking about bulk collection but the more
standard usage of 215.
Has Section 215 ever been relied upon to obtain the
contents of stored communications from a third-party provider?
Mr. Cole. Not that I am aware of, Mr. Chairman.
Chairman Leahy. Mr. Litt?
Mr. Litt. I am hesitant to give an answer to that just
because it is not a question I have ever asked. I would prefer
to get back to you on that, sir. I just do not know the answer
sitting here.
Chairman Leahy. Can you get back to me by the end of the
week?
Mr. Litt. I will try.
Chairman Leahy. If they have not, as a legal matter, could
Section 215 be used to obtain the contents of communication?
Mr. Cole. I would have to think about that, considering
that it is limited to the types of information you can get with
a grand jury subpoena. I would have to look--because of the
aspects of stored communication and things of that nature, I
would have to check. But I am not sure--I would have to go back
and look at that. So without a check of the legal authorities,
I will get back to you on that, Mr. Chairman.
Chairman Leahy. And I appreciate you checking those. I
think you understand by the question I----
Mr. Cole. Yes.
Chairman Leahy. There are some serious legal ramifications
to your answer.
Mr. Cole. I agree.
Chairman Leahy. Well, good.
Chairman Leahy. I am going to yield to Senator Franken,
but, General Alexander, you talked about using--and I will get
to you in my next round--about going to the private sector
looking for best practices from them. You can imagine I am
going to ask if those best practices had been used, would a 29-
year-old subcontractor have been able to walk away with all
your secrets like Mr. Snowden did.
Senator Franken.
Senator Franken. You are going to ask that in the next
round?
Chairman Leahy. Sure, but----
Senator Franken [continuing]. Do you want it answered now?
Chairman Leahy. No. That is okay. I do not want to take--
you have been waiting patiently. I will wait my turn.
Senator Franken. Well, okay. General, you will have plenty
of time to think about that, except I have a question for you,
so we will see if you can do both at the same time.
I have a bill, too, called the Surveillance Transportation
Act that I think you are all familiar with. Among other things,
General Alexander, the bill would require NSA to tell the
American people how many of them have had their communications
collected by the NSA. Do you think that the American people
have the right to know roughly how many of them have had their
information collected by the NSA?
General Alexander. I do, Senator. I think the issue is how
do you describe that. Those that are under a court order--so
under FISA, as you know, to collect the content of a
communication, we have to get a warrant. The issue would be
almost in the Title III court. Do you tell someone, a U.S.
person, who may not be a U.S. citizen, that we are tracking
them here in the United States or that we have identified that?
Senator Franken. I am not suggesting that you have to tell
people they are being surveilled, that they personally are a
suspect. What I am saying is, do the American people have a
right to know how many American people have had their
information collected? That is a different question. I was not
suggesting we tip people off that are suspects.
General Alexander. Yes. So I think in broad terms,
absolutely, and let me give you an example.
Senator Franken. In broad terms?
General Alexander. Yes. So, for example, under 215 today,
less than 200 numbers are approved for reasonable, articulable
suspicion, are being searched in that data base.
Senator Franken. Two hundred.
General Alexander. Numbers.
Senator Franken. People--that is 200 orders or 200 people?
General Alexander. Two hundred numbers. Some of those
numbers may be multiple numbers per person. Those numbers could
be both foreign and domestic. In fact, they are. But that is
the total number for that category for Section 215 today under
that program.
The other one that I think--and I think the Deputy Attorney
General mentioned, is we can also put out more about what we
are doing under the FAA 702 program, that we have compelled
industry to do in a more transparent manner. The issue is how
do we do that without revealing some of our own capabilities.
And we are working through the interagency to get resolution on
that.
Senator Franken. Okay. I am being told by staff that that
is actually the number of people that have had their phone
numbers searched, not collected. Right?
General Alexander. So under 215, all the data is going into
a repository.
Senator Franken. Metadata.
General Alexander. Metadata. So, if, for example, I am
talking to a foreign terrorist, my number would automatically
hit that link. In fact, you probably would want to know that.
Senator Franken. Right.
General Alexander. I know the White House would.
Senator Franken. We need to know that.
General Alexander. That is right. So the issue would be how
many of those. What we would do is we would look at those and,
based on our analysis, give those numbers that are appropriate
to the FBI for them to then go through their appropriate
process to look at those numbers.
Senator Franken. Okay. There is a difference between
collected and searched, but that is--okay. But let us talk
about 702. That is supposed to target non-Americans, right?
Foreign persons?
General Alexander. Reasonably believed to be outside the
United States.
Senator Franken. Right. Are Americans--shouldn't the
American people know how many Americans have gotten caught up
in that?
General Alexander. That again is--and I do not mean to
hedge. Let me just tell you the difficulty. If a terrorist that
we are going after is talking to another person, in that
communication there is nothing that says, ``I am an American,
and here is my Social Security number.'' So the fact is when we
are tracking a terrorist, if they are talking to five people
and one of those is American, chances of us knowing that are
very small.
If we find out that it is an American, then there are
procedures that the Attorney General and the courts have given
us that we have to do to minimize that data on that American.
Senator Franken. Okay. Well, I guess my question is that my
bill calls for the NSA to report how many Americans'
information has been searched, has been looked at by agents.
And I am not talking about necessarily a precise number, but
702 says that it can only look at non-Americans. And, look, my
feeling is this: that the American people are skeptical of
executive power.
General Alexander. Right.
Senator Franken. That when there is a lack of transparency,
they tend to suspect that something--they tend to be very
skeptical and suspect abuse. And part of the reason to have
transparency is for people to be able to make their decisions
based on some real information about whether or not this power
is being abused or not.
Now, I believe that you gentlemen have our national
security at interest--that is your interest. That is your
interest. But I also believe that--you know, you keep saying
there are three--there is oversight from all three branches of
Government. We are one of the branches, and we are doing the
oversight. Okay?
General Alexander. We are feeling it.
Senator Franken. And my feeling doing the oversight is that
I would be more comfortable and that the American people would
be more comfortable and feel that they can decide for
themselves, if they knew how many Americans were being caught
up in a program like 702 that is designed by law not to target
Americans.
General Alexander. So I think, Senator, absolutely. But I
would just put into this that what we are going to do is, if
asked to do that, we are going to give you faithfully and
truthfully that which we know. And my concern would be, 2 days
later, we find out that was also an American, so we could
report that later, but we are not going to--do you see what I
mean?
Senator Franken. Because what I am talking about in my
legislation is not a precise number. It is a range.
General Alexander. Yes.
Senator Franken. And what I have been told by ODNI is that
producing this estimate would be very difficult. But I do not
think it would be that difficult.
General Alexander. So it may be. I would just offer,
Senator, to have you come up and we could sit down and show you
this and then come up with perhaps a reasoned way to do that,
because I do think--actually, I agree with you. I think this is
the right thing to do, because the number is not that big. And
I think if we could explain it to the American people, and you
as one of our three elements of our Government could say,
``Here is what we see, and here is what the administration
sees, and here is what the courts and all three of us together
see, that is the best number we can come up with.'' When you
see that, when the American people understand that, they will
know we are doing this right. So I agree with you.
Senator Franken. I see Mr. Litt, whom I know quite well_we
have discussed this a lot--sort of jumping out of his seat.
Mr. Litt. No. I am firmly planted, sir.
Senator Franken. Okay. Well, eager to answer, and that is
why I am afraid I have run out of--no, I am sorry. Go ahead.
[Laughter.]
Senator Franken. Go ahead. I see that you are--I have never
seen him this eager, frankly.
Mr. Litt. Mr. Chairman, if I might for a minute, this is a
good example of the kind of thing I was talking about in my
opening remarks. I think we all agree that the question you
pose is a reasonable one, which is, How many Americans are
being caught up in this?
The problem is trying to find a way to provide that
information in a manner that is both operationally feasible and
does not compromise sources and methods. We have got some ideas
in that regard. They are not fully fleshed out yet. We do want
to work with your staff and see if there are ways we can arrive
at something that will give at least some sort of reasonable
proxy that gives Americans an idea of what the impact of this
surveillance is.
Senator Franken. Thank you. I am glad I have got this
answer today because this has been part of my discussions with
ODNI where you said that this may be too difficult to do. But
it sounds like we have got a little bit of movement on this.
I wanted to ask a question about what you were referring
to, Mr. Chairman, about location information. But I really am
way over my time.
Chairman Leahy. You may go ahead.
Senator Franken. Thank you for your indulgence.
This is on the capacity issue. General Alexander, in a
hearing--let me go beyond that. Last week, The Washington Post
asked an intelligence official speaking on the record to
estimate how many Americans had had their location information
collected by the NSA. The official answer: ``It is awkward for
us to try to provide any specific numbers.'' Right after he
said that, the article says that an NSA spokesman interrupted
the conversation to change that answer.
Do you believe it is difficult for this administration to
estimate how many Americans have had their information
collected, or do you think it is awkward?
General Alexander. I think it is difficult, but I think we
are walking by each other. If I might explain?
Senator Franken. Okay. Good.
General Alexander. Under the Business Records FISA, there
was a series of questions on cell site location information
that Senator Wyden and others had asked, and we have walked
down that road. As you know, that is one that the Court said,
``We are not doing that. We do not do that.'' There has been a
few records that were done to check to see if technically it
could be done. That was the first set of issues on the Business
Records FISA. So there is no cell site location data under
Business Records FISA that we are using today, period.
Second, if an American travels overseas and his
communications are collected, the chances are in that
collection we may not know that that has been collected, that
it was an American person; but the chances are if you collect
A, you will probably get the cell site location with that
because that is something that is also collected. The issue
would be how many of those have been collected, and the answer
is we are really not looking for that. It may have been
collected because they talk to--you know, as we use--and I do
not mean any of these people are bad. I am just using this----
Senator Franken. You seem to point to them a lot.
[Laughter.]
General Alexander. I just want you to be careful because
they are right behind you. But I am concerned, Senator, that in
that case we will not know at all who are the Americans and who
are not in those issues for the same reasons as before. But
what we can tell you is I think good numbers on those that we
target overseas that are Americans under those procedures that
we have. We can give you those numbers, 703, -4, and -5 that
fall into that. And I think that is perhaps what we are really
looking for. Does that make sense?
Senator Franken. Yes. Thank you. And, Mr. Chairman, thank
you for your indulgence. I also want to go down to the
briefing. Thank you, gentlemen.
Chairman Leahy. Say hello to everybody for me.
Senator Franken. I will.
Chairman Leahy. General, to go back to the question I
asked, and not facetiously, I assure, when you said that your
work with private industry on proving techniques and so forth,
and I assume you would. Let us go back to the Snowden case. As
you know, I have expressed grave concerns about how a 29-year-
old subcontractor can come walking in and that your system of
checks and balances and all was not good enough to stop him
from walking out with a huge amount of data. I see something
similar, although a different type of data, when our own State
Department and Department of Defense put huge numbers of highly
classified and highly sensitive cable traffic from some of our
embassies into one location where a private first class, I
believe he was, was able to go in and take it all out on a Lady
Gaga CD. And we know the enormous, enormous problems caused to
our diplomacy and the security of a lot of Americans and our
allies because of that situation. I have never found anybody to
say what we ever gain by putting all that material in one
place.
So now we go to the Snowden case. Whether somebody thinks
he is a hero or a villain is not so much the question as it is,
I think we can all agree, that a lot of the material that has
been released because of him has been very damaging to the
United States. It has certainly been damaging to our allies,
our relationships with our allies.
I realize, as you and others do, that some of our allies
have said how terrible it is we are doing this. It has to make
one think of the scene in the movie, ``Casablanca'': ``I am
shocked, shocked, to see this going on,'' knowing that they are
doing very similar things. But having said that, there were
things that created grave problems for us.
So my question is: First, can you say with confidence that
you now have checks and balances at NSA to stop something like
this happening again? And, second, has anybody been disciplined
at NSA for dropping the ball so badly?
General Alexander. So, first, Chairman, on the checks and
balances and the things that we have done, that is the 41
different actions that I discussed for Senator Grassley that
our technology director is using. That does employ best
industry and best practices that we have and has drastically
improved that capability.
Chairman Leahy. These are subsequent to the Snowden----
General Alexander. That is correct. This is all since the
Snowden thing. This gets into compartmentalizing and encrypting
data to creating communities of interest. And we do have three
cases that we are currently reviewing, working our way through,
that I do not want to prejudge given my position.
Chairman Leahy. I understand.
General Alexander. That we will fully inform this Committee
of action that we have taken once that action is complete. So
we are doing that.
Chairman Leahy. Now, first off, whether it is 41 steps or
35 or whatever, I would hope that this makes it better. The
obvious question comes up: Why were these steps not taken
before? Was it because there is a sense of confidence that we
are the NSA, we will not make a mistake? Or was it just--well--
--
General Alexander. Well, actually, Chairman, the reason it
happened is his job was to move data. He was the person who was
to move the books from Point A to Point B. He was the
SharePoint server, Web server administrator. His job was, in
fact, to do what he did. And therein lies part of the problem.
We had one individual who has the responsibility to move
that data who betrayed that trust. We believed that they would
execute that duty faithfully and in a manner that everybody had
agreed should be done.
Chairman Leahy. To use your analogy, General, let us say I
run a company that sells millions of dollars worth of diamonds,
and I am going to have to transfer them from my warehouse in
this State to my warehouse in this State. Now, am I negligent
if I say, well, look, we have got this 29-year-old
subcontractor, here are the keys to the car, the truck that
carries all these diamonds, get them there safely; by the way,
here is a map? Or is it better off that I have two or three
people who check on how it gets there?
General Alexander. So prior to this event, it was standard
that one person would do one job, and he would have back-up
help, and you would have oversight of that. But in doing that
job, it is very difficult, if not impossible, to see that
person replicates a copy of what he took. A little bit
different than in the diamond case, but your point is well
taken. You would not give the guys the key to the car to drive
your diamonds across State--especially when you did not know.
In this case what we have done is we have input a two-person
rule just like you would for that for these specific issues,
and you will see that in parts of the write-up.
I would also point out one of the notes I got, from the
WikiLeaks we were already implementing the WikiLeaks issues
that had been found through the interagency process. So we were
implementing that. This specific vulnerability that he
exploited was not found in the WikiLeaks area. And there were
some specific things that I would prefer not to go into here
because----
Chairman Leahy. Can I suggest that there are still going to
be people out there who are going to want to find more things?
Would we both agree on that?
General Alexander. Absolutely.
Chairman Leahy. I think we would also agree that the vast
majority of people who work with you--and I do believe this--
are very honest and would not want to do anything to betray the
country they serve. Is that correct?
General Alexander. Absolutely, Chairman.
Chairman Leahy. Thank you.
We talked about the legal standard for bulk collection
programs, and that is one thing. The other thing is, do we
really need to be collecting massive amounts of data on
innocent Americans to keep us safe? Just simply because you can
do something, does it make sense to do it?
We had a question on an entirely different matter before
this Committee once when I had raised the question about road
blocks being set up by our border people in Vermont on one of
our interstate highways about 40 or 50 miles from the Canadian
border. And they said with great enthusiasm, well, over a
period of X amount of time, they found four or five illegal
immigrants and collected X amounts of marijuana and some
cocaine. I said, ``Wonderful.'' They spent a huge amount of
money and set up this road block, inconveniencing everybody. I
said, ``Look how much more you could collect if we set up those
road blocks on every single bridge coming into Washington, DC,
in the morning. A couple hundred thousand, 100,000, 200,000
people come in from Maryland, same number from Virginia and
West Virginia, unless we have something, a cataclysmic thing
like 2 inches of snow, and then, of course, we have to close.''
In Vermont, anything under 5 inches of snow is called a
``dusting.'' But I digress. But the fact it----
[Laughter.]
Chairman Leahy. But not much. The fact is if we set up
those kind of road blocks, we would collect hundreds of illegal
immigrants. We would collect huge amounts of illegal drugs and
probably other contraband. Would we do it? No. I mean, the
place would come to a screaming halt, and there would be those
people who are totally innocent and all who might be screaming
about it, including Chairs of various oversight committees.
But my point is we have already established that the
Section 215 phone records collection program was uniquely
valuable in just one terrorism-related cases, not the 54 that
have been talked about before. The NSA shut down a bulk
collection program related to Internet metadata because it was
not meeting operational expectations. And I was concerned to
learn that the NSA has never done an assessment of the
effectiveness about collection under Section 702 despite the
fact the program mistakenly led to the warrantless collection
of thousands of domestic emails, including their contents. We
can do a huge amount, but then at some point you have to ask,
What do we get out of it?
So, General, I would ask you this: Shouldn't the NSA assess
the utility of its various collection methods in a systematic
way, especially if they pose a risk of obtaining Americans'
communications? The question would be very simple if we were
talking about going into everybody's home to look at their
letters and their files and their most personal things. But
somehow we are looking at it differently because it is out
there electronically.
General Alexander. Senator, Chairman, that was exactly why
under the Pen Register/Trap and Trace the email metadata
program, when we looked at that, we--and I was the key NSA
official to say this program does not meet the operational
requirements for the amount that we are putting in, and we
recommended to the DNI and the White House that we stop that
and inform Congress. So we made that operational decision based
on what we got for what we put into it to what it cost us.
We did the same, we are doing the same on the Business
Records FISA, the metadata program, and we looked at that. Here
is the issue, quite candidly, that I am wrestling----
Chairman Leahy. You are doing that now in the PRTT?
General Alexander. We did the PRTT back in 2011 when we
stopped that program, and that was based on my recommendation
based on working with our people to look at what we are doing.
Chairman Leahy. Did you find any terrorism plots it helped
thwart?
General Alexander. With the Pen Register/Trap and Trace? I
will have to go back and get you the specifics on that. That
will take more than Wednesday, though, but I will get you that
answer.
Chairman Leahy. Okay, because I am thinking, when Deputy
Director Inglis testified, there was only one time where
Section 215----
General Alexander. Right, so that is Section--now we are
going to 215. The issue that I have on 215 and why I am so
concerned, I agree that what Congress, the courts, and the
administration have given us here is extremely intrusive taken
in its whole. But the way we have put the oversight and
compliance and the regimen that we have around it and the
oversight by the courts, the administration, and Congress
ensure that we are doing this right. And the frequency that we
look at that, less than 200 numbers now approved, and less than
300 for all of 2012, from my perspective that shows that we are
being judicious in how we do it, there is oversight by all
three branches of the Government, and complete auditability on
every action that we do.
We do not have a better way of doing this, so that goes
into that question of industry. So my question is: I do not
know a better way to do it, and I am being completely candid. I
am concerned with all that our country is going to face that we
will have failed the Nation if an attack gets through.
And so you have asked us to do that. I cannot think of a
better way. I think this is where industry--do they have a
better way of doing it? We ought to put it on the table and
argue that through all branches of the Government. Nobody has
come up with a better way.
And so that is my concern with the metadata program that we
have today. I cannot think of a better way. It is like holding
on to a hornet's nest. You know, we are getting stung. You have
asked us to do this for the good of the Nation, to defend the
Nation, to get the intelligence we need. Nobody has come up
with a better way. If we let this down, I think we will have
let the Nation down. So that is why I am concerned.
Chairman Leahy. General, I realize the world changes, but I
think back to my days as a young prosecutor, and without going
into war stories, I remember when as a member of the Executive
Board of the National DA's Association, we had a meeting with
J. Edgar Hoover, and four or five of us there, we went across
the spectrum politically. We were all chilled by what we heard
from him: his disregard of the Constitution, his willingness to
do things--he explained to us there was no such thing as
organized crime in America, even though, of course, there was a
massive organized crime operation at that time. But we had to
fear Communists. He even suggested to us that The New York
Times and its editorial policy was very close to becoming a
Communist newspaper and he was about to investigate it as such.
I am serious. I am always thinking what it would have been like
if he had had the power that you and the NSA have.
I had a friend who died in the Towers on 9/11. I think
about that all the time. I think of my wife, who was a medical-
surgical nurse at Arlington Hospital, going there, even though
she had retired, to volunteer to help with any wounded coming
from the Pentagon and being told there were no wounded. You
were either alive and walking or you were dead. There was
nothing in between. These things sear in your mind. You do not
want this to ever happen again.
But I also think of the J. Edgar Hoover type thing, and I
think as an American it is very easy to go to another country
and complain to them about their police state--and I am not
suggesting that that is what you are, but their ability to go
and listen in on everybody, search everybody. We give up a lot
of our privacy in this country, and frankly I worry about
giving up too much. And can we be totally secure? Of course we
cannot. You cannot be totally secure going out to dinner in the
evening from some random shooter who is not even aiming for
you.
So, I mean, I look at the administration declassifying a
number of FISA Court opinions, and they get credit for doing
that, but there has been no release of any FISA Court opinion
from the 2006 time period containing legal and constitutional
analysis of the Section 215 phone records program. Is that
because it did not exist or it has not been declassified? And I
ask this question--and I will let Mr. Cole give me an answer to
that at some appropriate point. But I really feel that our
oversight has not been adequate or that so much of it is done
secretly that it is too easy to say if you knew what we knew,
you would not ask us questions. And I worry as technology gets
greater and greater, the temptation, whether it is this
administration or the next administration or the administration
after that, to people to misuse it.
So I know I have been critical of these things. I hope none
of you take it personally. But as a Vermonter, I am very
concerned about my privacy and everybody else's.
Did you want to add anything, Mr. Cole or Mr. Litt or
General?
Mr. Cole. Mr. Chairman, you know, I think that we are all
concerned to make sure that we get this balance right and that
an important part of that balance is transparency to the
American public, keeping their trust in what we are doing,
making sure that while doing that we do not compromise our
abilities to be able to use classified techniques that will
help keep them safe. But that is--there is a tension between
those two, and there always has been. And finding that right
balance is always something that is difficult, but it is our
job. And it is our collective job in all three branches of
Government, including with oversight from the U.S. Congress as
a very important part of that.
So I think the path that we are on now is very much the one
that you are describing of trying to make sure that we find
that line and find that balance of giving the information that
we can give, providing the transparency while maintaining the
operational integrity of what we are doing. We should not be
saying to you, particularly from an oversight function, if you
only knew what we knew, you would say we are doing fine. We
should be in a position to be able to tell you what we are
doing.
Mr. Litt. Mr. Chairman, if I can just add a couple of
points there. The first is that, as I am sure you know, there
is nobody in the intelligence community today who operates on
the assumption that you ascribed to J. Edgar Hoover before, ``I
do not care what the Constitution says.'' Everybody is
singularly focused on ensuring that we comply with the
Constitution and the law. And as you know, in all the material
that has come out, there has been no suggestion of any willful
abuse or violation of privacy of people. The compliance
violations that have occurred have been technical, they have
been unintentional, but nobody has been out there attempting to
illegally spy on Americans or anything else.
But the other point I want to make is sort of a more
philosophical one, because the point you raise about worrying
about the next person is, of course, something that was a
concern all the way back to the Framers of the Constitution,
which is why they set up the Constitution with checks and
balances, to try to ensure that the innate tendency of human
beings with power to seek to abuse that power is checked. And
that is what we have tried to accomplish within the
intelligence community with the degree of oversight that we
have, the number of people who are looking over other people's
shoulders, the number of reports that have to be done, the
technological controls that we have in place.
As General Alexander said earlier, if there are ways we can
do that better, we are open to that. We would like to ensure
that there is oversight that is sufficient to persuade the
American people that we are doing the right thing on their
behalf. But we do think it is important that in considering
what to do, we do not throw out the baby of national security
with the bath water of oversight.
Chairman Leahy. And if there are better ways of doing
things, if there is any silver lining in the Snowden matter, I
understand from General Alexander's testimony that you are
taking the steps to make sure that colossal mistake would not
happen again.
Mr. Litt. We are going to do our best.
Chairman Leahy. General. And then after you speak, General,
I am going to turn the gavel over to Senator Whitehouse because
he is a nicer person than I am. Go ahead.
General Alexander. Chairman, first, two things. As you
correctly stated, there was one unique case under 215 where the
metadata helped. There were seven others where it contributed
and four where it did not find anything of value, and we were
able to tell the FBI that.
Now, that last part, ``of value,'' I want to point that
out. This summer there was a big issue on terrorism that we all
went through. This program actually helped us understand was
that focused on the United States or elsewhere? We used that
program to determine none of those leads were coming into this
country, and we were able to focus our efforts elsewhere, which
really helped both the intelligence community and the FBI in
that case.
The second part, you know, I have been in this job for a
little over 8 years, and my experience from dealing with the
people that we have, dealing with Congress, the courts, and the
administration on this, is our folks take the Constitution to
heart. We see this as two roles: defend the Nation and protect
our civil liberties and privacy. Everybody at NSA, including
myself, takes an oath to that Constitution, that we will
support and defend the Constitution. And you know the rest of
that.
And I would tell you that the oversight we have, especially
by the courts, ensures that what happened that you brought up
will not happen here. From my perspective, we have great
oversight in this program, and at times I complained that the
oversight was so robust that it was crippling. But now you can
see that everything that we have done, all the things that have
come out were either self-reported or brought out. They were
not revealed by Snowden. We had already reported those
incidents. I think you can see that we are acting well and
faithfully to discharge those duties.
Just to correct one thing, to add to what Bob said, there
have been no willful or intentional violations under the 215 or
702. As you do know, there were 12 under Executive Order 12333.
In both cases, all the violations that we know about we have
self-reported. Some of those we knew would be significant. We
brought them up to the White House, to the DNI, to the
Department of Justice, to the courts, and to Congress. We made
a mistake. These were not intentional. They were significant.
And you have read the court things and you have read some of
those. But from my perspective, I think what we should take
great pride in the fact is this agency in every case reports on
itself, tells you what it did wrong, and does everything we can
to correct it.
Chairman Leahy. Thank you.
Senator Whitehouse, would you take it from here? And I
apologize to the next panel that I am going to--I may not be
able to get back. I am going to try to--do you want to take
this seat here?
Senator Whitehouse [presiding]. Sure. I will do that when
the panels shift, but let me just take a little bit of time
myself right now with this panel before they are excused.
First of all, we are at a time where we have entered a new
technological era, the era of big data, and I will loosely and
unprofessionally define ``big data'' as the ability to
aggregate enormous amounts of information that do not get
looked at and then figure out ways, once they are aggregated,
to search for things in that big heap of data. And that raises
questions about whether the aggregation is a search or whether
it is not a search until a human being actually asks a question
and actually the information gets to another human mind. And
some of these are pretty difficult questions that we have to
work our way through, and so I think the attention that the
Committee is paying to this is a very sensible attention.
But our national intelligence establishment is not the only
group that is playing in this big data area. We all know that
Google and other private sector providers are very, very
actively in big data, data mining, and doing things like that.
What can you tell me about what other governments are doing
without specifying names and releasing any national security
information? I take it that other foreign sovereigns are doing
very aggressive things in this space to try to pull as much
information as they can as well out of the cloud and out of the
capacities of big data. Who would like to take that? General.
General Alexander. Senator, I have some experience in that.
In my opinion, none of them have the oversight by all three
branches like we do, either their parliaments, congress, their
courts, and their administration.
Senator Whitehouse. Understood, but my point is they are
all out there doing it.
General Alexander. They do.
Senator Whitehouse. And that if we were to--well, of the
ones who have capability, a lot--the most powerful ones all do.
General Alexander. That is right.
Senator Whitehouse. And if we were to pass a law that
prevented our intelligence and defense establishment from
operating in that big data atmosphere, we would be essentially
unilaterally disarming in an arena in which other governments
are very active. Is that true?
General Alexander. That is true. In fact, I think some have
likened it to, because we have a powerful intel community or
powerful Navy, we would tell our submarines to surface in those
areas where people do not--their subs are not as good.
Senator Whitehouse. And the actual collection of data in
the sense that it is brought to the awareness of a human mind
somewhere has to be overseen very scrupulously. And as I
understand it, this operation is overseen by multiple
inspectors general, multiple general counsels, multiple Federal
executive agencies. NSA connects in ways that provide varying
levels of visibility, but in most cases complete visibility to
our Department of Defense; to the FBI, to the Department of
Justice, Jim; to the ODNI, the Office of the Director of
National Intelligence; to the President; to the National
Security Council. So there is considerable attention that is
being dedicated to this. We have a court that is dedicated to
this that reports to the Supreme Court. We have this
legislative Committee, the Senate Intelligence Committee, and
the House Committees.
So it is hard for me to think of whatever we might do to
add to the level of oversight, I think we may make it more
efficient and effective. But I do not want anybody to leave
this hearing thinking that we kind of just leave this question
to the NSA. We have built a system in which every branch of
Government and within those branches of Government in many
cases multiple different agencies, and in some cases within
those agencies multiple different and in some cases independent
sectors, all compete to have a look and to make sure that the
right things are being done.
So I will let you all go. I appreciate what you are doing.
I understand that we need to get this right. But I think it
would be a mistake to unilaterally walk away from the realm of
big data to protect our national security when we are perfectly
comfortable with private companies doing that to make money and
to find out more about us so they can market to us better, and
when foreign governments are energetically penetrating this
space in order to accomplish similar results. And I think
nobody should leave this hearing not aware that the layers of
oversight and checking and double-checking and triple-checking
that are done here are very, very rigorous and considerable. I
know you have to live with that all the time. If you would like
to make any closing comment to that, I will let you do that.
But otherwise I will let you go.
Mr. Cole. I think you have summarized it very well,
Senator.
Senator Whitehouse. All right. Well, we will leave it with
that, and I appreciate very much you all being here. Thank you
for your service to our country.
General Alexander. Thank you, Senator.
Senator Whitehouse. And we will take a minute and call up
the next panel.
It was hard to get Bob Litt out of here, Professor. He
loves it so much being in front of us.
All right. Let me ask the panel to stand to be sworn. Do
you affirm that the testimony you are about to give to this
Committee will be the truth, the whole truth, and nothing but
the truth, so help you God?
Mr. Black. I do.
Mr. Sanchez. I do.
Professor Cordero. I do.
Senator Whitehouse. Please be seated. I am delighted to
welcome our second panel on this important issue, and I will go
right across the table and ask each of you to make your opening
statements, and we will do collective questions at the end. We
may be rejoined by a number of my colleagues. This is the time
that the administration briefing on Iran is taking place in the
classified area, and so obviously that is of interest.
We will start with Ed Black, who has been the president and
CEO of the Computer and Communications Industry Association
since 1995. He previously served as Chairman of the State
Department's Advisory Committee on International Communications
and Information Policy, and he worked as chief of staff and
legislative director for two Members of Congress.
Mr. Black, welcome. Please proceed.
STATEMENT OF EDWARD J. BLACK, PRESIDENT AND CHIEF EXECUTIVE
OFFICER, COMPUTER AND COMMUNICATIONS INDUSTRY ASSOCIATION,
WASHINGTON, DC
Mr. Black. Thank you very much for the opportunity to be
here. Thank you, Senator Whitehouse.
This is an important subject. I want to start out by just
pointing out that 16 years ago the White House charted a course
for a vibrant Internet economy in the perceptive Magaziner
Report, the first U.S. Government policy statement addressing
the needs of Internet commerce. That policy statement correctly
identified user trust as the foundation of Internet commerce.
It noted: ``If Internet users do not have confidence that their
communications and data are safe from unauthorized access or
modification, they will be unlikely to use the Internet on a
routine basis for commerce.''
That may sound rudimentary today, but we should not take
for granted decades of progress in creating security and
fostering user trust, and we should not discount how easily
that foundation can be damaged.
The broad NSA surveillance regime and the way it has been
received internationally has harmed U.S. companies, U.S.
competitiveness, and the Internet itself. The U.S. Government
must be proactive in addressing these concerns. The status quo
is no longer an option. If we do not act, we will put at risk
our economic security and undercut our diplomatic ability to
influence the future of the Internet. Therefore, Mr. Chairman,
CCIA supports the USA FREEDOM Act, and we look forward to
working with the Committee and staff on this important piece of
legislation.
A healthy global Internet is a source of American
competitive advantage. The U.S. ITC has documented a growing
digital trade surplus. Our global competitiveness is not just
good for commerce, it is an essential component of our long-
term national security.
The Internet does not only benefit the U.S., however. The
open Internet provides great global commercial benefits. The
Internet economy in G-20 countries is expected to reach $4.2
trillion by 2016. Estimates show that 21 percent of economic
growth in mature economies over the past 5 years is
attributable to the Internet.
Traditional industries are the beneficiary of 75 percent of
the economic value derived from the Internet. Thus, we should
not underestimate the Internet's role in global economic
development, which in turn has its own security benefits for
the United States and the rest of the world.
The NSA's practices clearly impact the business of U.S.
Internet companies. So much of online commerce today is
fundamentally based on trust. If users are going to turn over
very sensitive personal and confidential information to a
company providing online email or other cloud services, they
need to believe that the company will act as a responsible
steward of their data. Although traditional debate on the
utility of overbroad NSA surveillance has focused on hard-power
arguments, one must not overlook the effect on soft power.
It is important to recognize the dramatic effect these
revelations have had on our international diplomatic authority,
particularly in regard to the future of Internet governance.
Last year's WCIT conference showed us that there was deep
international division over whether to subordinate the open
Internet to the political machinations of world governments,
including repressive regimes. The U.S. needs to be a beacon for
freedom and openness in this battle.
Given these risks, we propose: enhanced transparency and
procedural reform; clearer protection for Americans; and
baseline protections for international users.
With regard to transparency and procedural reform, we think
all governments should share with citizens meaningful
information about their surveillance laws, their legal
interpretations, and the judicial procedures that govern the
exercise of this powerful authority. Of course, the U.S. cannot
demand this from others until it leads by example.
Furthermore, companies should be permitted to disclose
publicly to their users the precise volume of requests from
governments. Businesses should not only be permitted to release
transparency reports but encouraged to do so. We categorically
reject the notion that open government will cause undue damage
to security. Transparency in criminal surveillance has been the
norm for years and does not appear to have materially affected
law enforcement.
In order to present a robust check on the Government, the
FISC must also evolve to include a committed and well-resourced
advocate to provide an alternative viewpoint, particularly in
situations involving novel questions of law.
Second, focusing on protections for Americans, Federal laws
addressing the circumstances in which the Government may
collect Americans' data for national security purposes are
badly in need of reform. Bulk collection of metadata is one
area where that is most obvious, as it reveals a great deal of
sensitive private information. Furthermore, important First
Amendment rights of association are implicated by the
Government assembling its own version of your social network
for their own analysis. The USA FREEDOM Act addresses this
problem by explicitly prohibiting this type of bulk collection
both on the Internet and on telephone networks, and that is one
of the reasons we are supporting it.
Third, and finally, protections for foreigners. A difficult
subject to deal with, but despite the global interconnected
nature of the Internet, U.S. national security policy continues
to presume U.S. citizens deserve protection from unwanted
surveillance, while others do not. If foreigners lack baseline
privacy assurances, foreign competitors will supplant U.S.
leadership in Internet innovation and digital commerce, thus
undermining strategic economic and other security interests.
This is especially true going forward, as foreign markets are
increasingly important.
Thank you very much for the opportunity to testify. I look
forward to your questions.
[The prepared statement of Mr. Black appears as a
submission for the record.]
Senator Whitehouse. Thank you very much, Mr. Black.
Our next witness is Julian Sanchez, who is currently a
research fellow at the Cato Institute focusing on the
intersection of technology, privacy, and civil liberties, with
a focus on national security and surveillance issues. He
previously served as the Washington editor for a technology
news site and has written for a wide array of publications.
Mr. Sanchez, welcome.
STATEMENT OF JULIAN SANCHEZ, RESEARCH
FELLOW, CATO INSTITUTE, WASHINGTON, DC
Mr. Sanchez. Thank you, Senator Whitehouse. It is a
privilege to address this Committee.
I want to begin by suggesting that if we step back from the
details of the disclosures of recent months, we find a
disturbing pattern across multiple programs and authorities
emerges. I will focus in particular on the telephony metadata
program, the now defunct Internet metadata program under the
pen/trap authority of the PATRIOT Act, and upstream collection
under Section 702 of the FISA Amendments Act.
In each of these cases, what we see is that extraordinary
but nevertheless limited authorities were secretly interpreted
in ways that permitted far more extensive collection than
certainly members of the general public and even, I think, many
legislators believed at the time of passage had been
authorized. This was done in part because the FISA Court, which
was established on the premise that it would be authorizing and
find probable cause in cases of specific and traditional
targeted surveillance, instead found itself in the position of
addressing broad programs of surveillance, often involving
novel legal or technological issues that it is not clear that
body was well established to consider.
In the metadata cases, these interpretations took the form
of an unprecedented reading of relevance that held entire
databases containing information about millions of admittedly
innocent Americans to be relevant on the grounds that a fishing
expedition through those records might ultimately turn up
evidence that would not otherwise be detected in the absence of
some specific grounds for suspicion that is probably true, but
it is, of course, true of any fishing expedition and defeats, I
think, the purpose of the relevance requirement if that
argument is allowed to go through.
There is no real limiting principle in that argument for
any type of records, and I was particularly disturbed to hear
earlier Mr. Litt refuse to reassure us that the scope of the
records obtainable under Section 215 does not exclude the
contents of digital communications or cloud-stored documents.
It is also particularly troubling to see this applied in
the case of the Internet metadata program because in that case
the, in my view, shortsighted holding of Smith v. Maryland was
applied as it referred to metadata generally, which is
certainly not a term we find in the 1975 decision, when in this
case it involved email metadata that is not ever stored as
Business Records or usually even processed by the Internet
backbone providers from whom it was presumably obtained. So
there is kind of an additional constitutional question in that
case, I think.
In the case of 702, we know the Supreme Court relied on a
recent ruling in Amnesty v. Clapper on representations that
only communications to or from specific overseas targets were
being intercepted. We have now learned, of course, that also
communications referring to overseas targets would be
intercepted, and that in many cases for technical reasons a
single email meeting selection criteria would lead to the
entire inbox of the communicant being obtained, including,
again, potentially entirely domestic emails on what the Court
believed could be a scale of many tens of thousands per year
under that one collection program.
In each case, additionally we learned that for months or
years, the actual technical details of how these programs
operated were misrepresented to the FISA Court, which was, of
course, therefore not able to effectively conduct oversight;
and that in each case, again, elaborate safeguards and
restrictions imposed by the FISA Court as a condition of
authorizing those programs were effectively neglected because
of the vast scale and complexity of those programs.
Additionally, in many cases we found that the claims of
efficacy made at the time do not appear to have held up well
over scrutiny from many dozens of foiled terror plots we have
gotten down, in the case of the telephony metadata case, to
really one instance involving funding and material support
where it appears to have played some uniquely valuable role.
Given the limitations again imposed by the FISC, it is not
clear why more traditional targeted orders could not have been
used without incidentally sweeping in millions of innocent
persons' records.
We are assured that the problems detected with these
programs have not been willful or intentional. This is not
especially comforting to me for several reasons.
The first is that if we look to history, we find that, in
general, abuses of intelligence powers were committed by people
who were well aware of the oversight mechanisms in place who
often took elaborate steps to game those restrictions. In the
cases of Bradley Manning and Edward Snowden, we know that it
was--you know, steps were taken to evade oversight mechanisms
in the case. We know that certainly happened many times in the
past. And it is why abuses went undetected for so long.
Additionally, the scale of collection itself makes abuse
more difficult to detect and less likely to be detected when it
does occur. I think of the case of illegal wiretaps of the
Southern Christian Leadership Conference's office. That at
least was halted by an Attorney General who found the
suspicious fact that the wiretap existed and there was a record
of it. When you are doing collection on this scale, the mere
existence of communications or records about an innocent party
are not themselves that kind of essential indicator.
Finally, and most generally, I would just encourage the
Committee to think architecturally. We should not authorize
extraordinary architectures of surveillance on the basis that
we now have great confidence in the probity of the persons
controlling the levers. James Otis, whose condemnation of the
Writs of Assistance was part of the inspiration for the Fourth
Amendment, condemned those writs, saying that it is ``from
their mere existence that every householder in the province
becomes less secure.'' And there is a sense in which, while
they may serve some role in protecting us against foreign
attacks, we are less secure when the Government maintains vast
databases on Americans without particularized suspicion.
I thank you and I look forward to your questions.
[The prepared statement of Mr. Sanchez appears as a
submission for the record.]
Senator Whitehouse. Thank you, Mr. Sanchez.
Our final witness is Professor Carrie Cordero--whose bio I
have just mislaid, but I am sure you can get me another one
very quickly. Thank you.
She is an adjunct professor of law and the director of
National Security Studies at the Georgetown University Law
School. She has previously held several national security-
related positions with the Department of Justice and the Office
of the Director of National Intelligence, and she has also
testified before this Committee before.
So welcome back, Professor, and please proceed.
STATEMENT OF CARRIE F. CORDERO, DIRECTOR, NATIONAL SECURITY
STUDIES, AND ADJUNCT PROFESSOR OF LAW, GEORGETOWN UNIVERSITY
LAW CENTER, WASHINGTON, DC
Professor Cordero. Mr. Chairman, thank you very much.
Thanks for the opportunity to return to the Committee.
Since the October hearing, the conversation, I would
suggest, has shifted somewhat from where it first was. First, I
would suggest that the conversation has evolved from objections
to specific programs to a discussion of our understanding of
and tolerance for foreign intelligence surveillance activities
more broadly.
Second, the legislative proposals are coming closer to
scaling back national security legal authorities in a way that
might make the country back to pre-9/11 standards.
And, third, the path forward on authorized public
disclosure in a way that is responsive to the concerns of the
private sector remains a worthy goal, but still a significant
challenge.
With respect to the telephony metadata collection under the
Business Records provision of FISA, an argument increasingly is
regarding the power of metadata, and basically this argument is
that metadata is a very powerful tool and can reveal an awful
lot about us, and there should be limits on the Government's
collection and use of it.
I do not disagree with the general proposition, but the
problem with the argument made in the context of the debate on
215 is that the worrisome assemblage of Americans' metadata
bears no relation to the existing 215 program that Congress is
currently considering. The 215 program does collect an enormous
volume of Americans' telephone call detail records, but the
collected information does not appear to include content of
phone calls, names of subscribers, payment information, or
location information. The vast majority of it is never viewed
by human eyes and the records are handled under court order
rules.
So of the arguments that Congress should outlaw bulk
collection altogether, for better or for worse, everyday
Americans use the Internet to communicate. We all, regular
people, Government leaders, as well as those who are national
security threats, use the Internet, computers, and smartphones
to communicate. And so just as everyday citizens should not be
expected to revert to using only the Postal Service and
landlines, neither should the intelligence community or law
enforcement have to resort to pen, paper, and index cards to
conduct national security collections or investigations. It is
just as unrealistic to expect citizens to unplug as it is to
expect or require the NSA or the FBI to use 20th century
collection, analytic, or investigative techniques to protect
the Nation from 21st century threats.
A few observations on S. 1599, the USA FREEDOM Act that has
been submitted. Sections 101 and 201, which change the legal
standards in FISA to obtain Business Records and implement pen
register/trap and trace devices by requiring a connection to a
foreign power, to an agent of a foreign power.
The sections also add a materiality requirement. The likely
intended effect of these provisions is to eliminate the 215
bulk telephony metadata program. But the proposed changes would
likely have far more reaching consequences for traditional,
day-to-day investigations. The standards are currently aligned
on the national security side with investigative authorities in
the criminal context, which operate on a relevance standard. By
raising the standard, these sections would render these
investigative techniques nearly useless in the early stages of
an investigation, which is precisely when they are most useful.
These changes could return us to the days prior to September
11th, when it was harder to conduct a national security or
international terrorism investigation than it was to conduct an
everyday drug or fraud case.
Similarly, Section 501 would amend the collection of
statutory authorities known as ``national security letters'' by
requiring the requested records to also have a connection to an
agent of a foreign power. This would have a similar effect in
terms of severely limiting the FBI's ability to conduct timely
and thorough national security investigations.
Another section, Section 301, would appear to prohibit the
intelligence community from querying data acquired pursuant to
Section 702 of FISA to search for U.S. person communications.
Under the current minimization procedures approved by the
Court, the NSA can query the communications already acquired
under 702 for U.S. person communications. The proposed
legislation would only allow the same query to take place if
the U.S. person is a current target of a criminal wiretap or
FISA coverage, which would require prior judicial approval
based on probable cause. This proposal could arguably prohibit
the intelligence community from querying already lawfully
acquired data to search for the methods of communication of a
valid target who happens to be also American. And in my written
statement, I give an example of how I think this could
potentially play out in practice.
A few words just on a particular proposal to enhance
transparency that is in the bill. In my view, there is
substantial value in Congress continuing to work with the
executive branch and the private sector to rebuild confidence
between them and for the Government to help the private sector
restore confidence with consumers, customers, and investors.
But a particularly problematic proposal is Section 602 of
the bill. It proposes that the Government disclose the number
of persons subject to electronic surveillance. I believe that
this is intended to include not only targets but persons whose
communications are incidentally collected. If that is the
intent, in my view this provision would actually degrade
privacy protections because a requirement to report on the
numbers of persons collected would require that the
intelligence community personnel look at, read, review, count,
and keep records about and report on information that they
otherwise would disregard in pursuit of their actual mission of
discovering, analyzing, and reporting on foreign intelligence
information.
So again, thank you for the opportunity to be here today,
and I look forward to your questions.
[The prepared statement of Professor Cordero appears as a
submission for the record.]
Senator Whitehouse. Thank you very much.
Let me start with a question for Mr. Black. There is
legitimate concern that the knowledge of our national security
activities casts a shadow on the ability of American companies
to compete internationally. That was the basis of your
testimony. Do you believe that foreign customers believe that,
for instance, if they sign up for a service with Huawei that
the Chinese Government is not looking into this data or the
Russian Government, if they sign up in areas under its
jurisdiction, or the French Government, for that matter, do you
think that the U.S. Government is actually the only government
that is trying to take advantage of big data?
Mr. Black. I hope our standard is not just to meet Huawei,
but I do think the reality is that governments in general are
inclined to want more and more information. Too much. That is
why what we address in our testimony is, in fact, standards
that all governments should be asked to undertake in terms of
disclosure, in terms of limits.
The difficulty is that the United States is in a very
difficult position in credibility when we are seen to have an
extremely pervasive, effective, widespread, and some would say
not effectively limited process. No, by no means do we want----
Senator Whitehouse. Do you think that--hold on--the Chinese
and the Russians actually are more effectively limited by the
government performing----
Mr. Black. No, I am not suggesting that at all.
Senator Whitehouse [continuing]. Surveillance activity than
the United States is?
Mr. Black. No, I am not suggesting--I am not doing a
comparison. First of all, I believe we do have some checks and
balances that have some effectiveness. Do not get me wrong. You
asked a question is the perception of the world----
Senator Whitehouse. Indeed they are far better than any
other country's checks and balances that are engaged in this
kind of behavior, correct?
Mr. Black. I am not going to talk to all of the countries.
I certainly hope we have better ones----
Senator Whitehouse. Are you aware of any other country that
has a better----
Mr. Black. I think there are many other countries that do
not probably do as much collection as we do.
Senator Whitehouse. I can name some. There are some very
tiny little countries that probably barely run a phone system.
But in terms of our major competitors, in terms of the major
economic and political actors on the world stage, the ones----
Mr. Black. I think that----
Senator Whitehouse [continuing]. That we are all thinking
of----
Mr. Black. I guess the question----
Senator Whitehouse [continuing]. None of whom have more
robust protection----
Mr. Black. We are trying to say, what kind of future do we
want, what kind of Internet do we want? Do we want an open
Internet, an Internet which provides tremendous economic
growth, tremendous empowerment, tremendous diplomatic and
political opportunities around--for billions of people around
the world? Do we want one where people can have association
with other people without being spied on by their government or
our Government or any other government? Is that a desirable
outcome? If so, how do we take steps to move in that direction?
Or do we accept the reality that all governments are going to
do a maximum collection and go in the Big Brother direction as
far as they can go and we are just in an arms race to do that?
I do not think that is a future I look forward to.
It is difficult to want to restrain a government's desire
for more information, especially I think our Government, where
we have well-motivated people who care about national security,
who really do believe in the motivation of what they are doing.
But they are zealous and effective, and they are, in fact, in a
position where they are able to gather a great deal of
information.
Senator Whitehouse. So you think our Government's security
services are more dangerous to civil liberties than the
government security services of China and Russia?
Mr. Black. Are they more interested? Absolutely. Much more
interested in protecting civil liberties, absolutely.
Senator Whitehouse. No, no. More----
Mr. Black. No doubt about it.
Senator Whitehouse [continuing]. Intruding into civil
liberties. You agree that our Government oversight of our
national security establishment is far more interested in
protecting civil liberties----
Mr. Black. I think it attempts----
Senator Whitehouse [continuing]. Of those of competitors
like China and Russia?
Mr. Black. Well, again, I cannot compare to other people. I
do not know the details. I certainly have a presumption about
how ineffective any controls they would have. I would hope----
Senator Whitehouse. You put it----
Mr. Black. I would hope that with our Constitution we would
have a really effective system. Do I think we have lived up to
the best intent and good faith of our Constitution with the
legal structures we have created that allow their surveillance?
No, I do not think we have lived up to the principles, the core
principles of the First Amendment and Fourth Amendment as
faithfully as we could. Are we better than totalitarian
regimes? Of course. That is not a question that I think is
fair.
Senator Whitehouse. You take a different view, I guess,
than the courts that have overlooked this which have not found
Fourth Amendment violations in any of this?
Mr. Black. I think some of those decisions have historical
positions that are based--I mean, Business Records, for
example----
Senator Whitehouse. But there is no present decision----
Mr. Black. When the Business Records----
Senator Whitehouse [continuing]. That supports your legal
point of view?
Mr. Black. Excuse me?
Senator Whitehouse. There is no present decision by any
court that suggests that there has been--that this has operated
in violation of the Fourth Amendment. It would take a new
decision to make that conclusion that has not yet been rendered
by any court. Is that not correct?
Mr. Black. I would suggest that various efforts to get
those questions raised----
Senator Whitehouse. Well, you are the one----
Mr. Black. In the courts have been denied.
Senator Whitehouse. You are the one who said that this was
being operated in violation of the Fourth Amendment. I am
asking you if you can cite a case that supports that
proposition.
Mr. Black. I believe the FISA Court made a ruling that
certain practices had violated their----
Senator Whitehouse. Orders.
Mr. Black. The orders. Well, I think the orders----
Senator Whitehouse. But not the Fourth Amendment----
Mr. Black. Were based on the Constitution.
Senator Whitehouse. Professor Cordero, for how long has
incidental collection of communications with people who are not
the subject of the warrant been a fact of life in law
enforcement?
Professor Cordero. Well, both on the criminal side and on
the national security side, there always is going to be
incidental collection. So the criminal Title III wiretaps
handle it in one way. On the national security side, it is
handled through minimization procedures for U.S. person
communication. So it has always been a factor. The minimization
procedures particularly on--well, any of the FISA minimization
procedures are approved by the Court, including on the 702
collection.
Senator Whitehouse. So for as long as there has been any
authorized Government interception of communications,
incidental collection has always been a part of that
necessarily.
Professor Cordero. That is right.
Senator Whitehouse. I have gone over my time. Senator
Blumenthal is here. Let me yield to the distinguished Senator
from Connecticut.
Senator Blumenthal. Thank you, Mr. Chairman, and thank you
all for being here.
Let me focus on FISA Court reforms. Mr. Sanchez, I wonder
if you could tell me your position on implementing some kind of
adversarial process as I have advocated be done through a
constitutional advocate and other reforms in the FISA Court
that might be feasible.
Mr. Sanchez. I would step back from that for a moment and
just say that in cases where you have something that is an
authority that was clearly, I think, envisioned as something
relatively targeted to acquisition of records with some nexus
to terror or espionage suspects, the appropriate move at that
point, if it is believed that some kind of bulk collection is
necessary, some kind of more programmatic use of that authority
is necessary, is to return to Congress and not to, in fact,
leave that decision in the hands of the FISA Court. One
suggested approaching this with a rule of----
Senator Blumenthal. In other words, the FISA Court should
not be making law.
Mr. Sanchez. When a request is so broad as to effectively,
I think, exceed what anyone conceived as the authority, it
would be better to have congressional authorization. In closer
cases, I think what we can see from some of the opinions that
have now been released first is that it would, I think, benefit
the Court's proceeding when novel questions of law are present
to have some kind of adversarial--or I guess to raise opposing
arguments, but also I think in particular to have technical
expertise. I alluded briefly earlier to a kind of tricky
constitutional wrinkle with respect to the use of pen register
authority to intercept metadata where you do not just have, as
with a phone call, the number and the content, but layers of
metadata and content with----
Senator Blumenthal. Do you think, though, that we ought to
have a constitutional advocate?
Mr. Sanchez. I think that would be extraordinarily helpful,
but also I think a technical advisory capacity of some kind
would be useful, because sometimes I think the most difficult
questions turn not just on the abstruse details of law or
technology, but about the ways they intersect in surprising
ways where often there is not precedent directly on point.
Senator Blumenthal. Thank you.
Professor Cordero, I gather you feel there is no need for a
constitutional advocate or some kind of adversarial process,
but you would be willing to support some kind of amicus curiae
process?
Professor Cordero. Thank you, Senator. Well, certainly
since the October hearing, this conversation has evolved, and
so, you know, there are different proposals. In my view, as we
discussed at the prior hearing, based on the current procedures
that take place within--between the Department of Justice and
the intelligence community and the Court, in my view there does
not--I think that the current process is sufficient that facts
from the other side are presented to the Court, the Court has
independent legal advisers. These are independent Article III
judges who make judgments on their own. So, in my view, there
actually does not need to be an adversarial process, and I
think the current process is sufficient.
However, between the competing legislative proposals,
between establishing an Office of Special Advocate versus the
proposal to enable the Court to call upon an amicus if the
Court believes it needs it, I believe that the second option
would be the better of the two options.
Senator Blumenthal. And that is because you are loath to
create a ``bureaucracy''? Or what is the reason?
Professor Cordero. Sure. Several reasons. So one is yes, I
think that the FISA process already is very heavily
bureaucratic, it is heavily layered. There are multiple offices
and legal offices and different layers of management that are
involved in reviewing FISA matters. So I think it already is
very bureaucracy heavy, and I think that the way that the
Office of Special Advocate is described in this legislative
proposal, it would simply add to that process.
I also am concerned that over time there has been a
relationship of trust and a very constructive relationship
between the executive branch and the FISA Court, and I actually
worry that an Office of Special Advocate would in some way harm
that sort of established relationship of trust by being in the
middle.
With respect to the proposals to add an amicus, you know,
again, if the Court----
Senator Blumenthal. Isn't the problem that this
relationship of trust has actually undermined trust in the
American public and really threatens to completely eviscerate
confidence in a system that operates in secret, makes secret
law, and in the end the relationship of trust may undermine the
whole system?
Professor Cordero. Well, although, Senator, I would say
that actually a concern about the Office of Special Advocate is
that it will have to operate in secret, too. And so just as the
creation of the FISA Court in 1978 and the creation of the
office that worked in the Justice Department that was an
independent, non-political office at the time was created in
order to establish trust and be sort of this independent
participant in the process, now people do not--you know, they
are questioning the FISA Court. And so I do not know that over
time--although in the sort of immediate future I can see how
the Office of Special Advocate might be appealing, I do not
actually think in the long term, because it will operate in
secret, because it will sort of become part of this whole
process, that in the long term it really will restore that----
Senator Blumenthal. Well, it would operate in secret, but
it could be combined with other reforms that would provide for
some greater measure of transparency to the FISA Court's
opinions when it makes new law that affects Americans around
the world or at least in our country. Perhaps there ought to be
more of these rulings and opinions that are made public.
But at any rate, my time has expired. I thank you, Mr.
Chairman, and thank each of the witnesses for being here today.
Senator Whitehouse. Thank you, Senator Blumenthal. I am
also grateful to the witnesses for the trouble that they have
taken to come in and help inform this Committee as we go about
our decisions, and I welcome them.
We will hold the record of this hearing open for 1
additional week for any further materials anybody wishes to
submit, and with that, we will adjourn the hearing.
[Whereupon, at 4:07 p.m., the Committee was adjourned.]
[Additional material submitted for the record follows.]
A P P E N D I X
Additional Material Submitted for the Record
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[all]