America's Global Surveillance Record

III. America's unscrupulous secret surveillance programs

The revelations about PRISM and other programs demonstrate that the US has mounted the most wide-ranging, costly, long-term surveillance operation in the history of the Internet. The seamless cooperation among the intelligence agencies, government and the private sector, with their big-data processing capabilities, allows the surveillance to extend in scope, seemingly without limit.

1. The world's largest, longest, most costly and wide-ranging surveillance operation

US intelligence has set up a number of programs that are directly linked to cyberspace surveillance, covering both the Internet and telecommunications networks, targeting telephone calls and Internet information, and including the major Internet service providers.

The Utah Data Center set up by the NSA is the world's largest data center, costing 2 billion dollars to build. It uses secret surveillance systems to collect vast amounts of data which is then processed by code-breaking experts, data-mining professionals and intelligence analysts to obtain useful information.

An article in the Washington Post on Aug. 30, 2013, reported that the budget request of the National Intelligence Program for fiscal 2013 had doubled to US$52.6 billion, of which spending on cyber operations accounted for US$4.3 billion, nearly 8 percent of the total. Surveillance cooperation between US intelligence and private companies, especially Internet service providers, is increasing. Microsoft was the first to sign up to collect data on September 11, 2007, and Apple the most recent in October, 2012.

German newspaper Der Spiegel reported on a surveillance program codenamed Stateroom, in which the United States, the UK, Australia, and Canada installed surveillance facilities in their embassies to intercept information. The four nations have also signed an intelligence sharing agreement with New Zealand.

2. Secret cooperation among intelligence agencies, government and the private sector is increasing

The nine major US software and hardware providers offer core technology support to US intelligence. Microsoft, the earliest to work with the NSA, opened its Outlook and Hotmail systems to the agency, going so far as to show intelligence agencies how to circumvent encryption of Outlook chat messages before the product was officially launched. Skype, which used to claim that its encryption technology and P2P system could prevent governments from eavesdropping, offered a "backdoor” to the NSA after being bought by Microsoft. Microsoft also worked with US intelligence to help crack the security systems of major companies in order to keep a watch on their customers. It also informed intelligence agencies before publishing details of bugs, so as to give them the opportunity to launch remote attacks.

3. Ramping up the range and depth of surveillance through big-data processing capabilities

The Obama administration made big data strategy a national priority in March 2012. It argued that "big data is the new oil”, and that domination and control of data would become a national core capacity, alongside land, sea and air power. The PRISM project is closely associated with big data. The NSA also has a system codenamed Boundless Informant, which collects 97 billion Internet data records during each 30-day period and can track anyone's activity in real time and match it against credit card records and other communications.

4. US intelligence is seeking legal loopholes to overcome legal restraints and take full control of Internet information

The United States used presidential decrees to authorize additional information collection in the wake of the 9/11 terrorist attacks. On October 4, 2001, President George W. Bush signed a memorandum to authorize specific surveillance actions over a limited period. Since then, "domestic collection” - that is, gathering information from US citizens and people inside the United States - has become a controversial topic. But although debates have subsequently arisen concerning the legitimacy, scope and legal basis of presidential executive orders, the White House, NSA, FBI, and the Department of Defense have reached a consensus on the legality of gathering information on foreign targets.

On May 24, 2006, the secret Foreign Intelligence Surveillance Court completely redefined the interpretation of Section 215 of the Patriot Act, allowing the FBI and the NSA to share "business records" relevant to terrorist attacks, including the calls databases of telephone companies. Since then, the US government has demanded data from major telephone companies every three months.

In October 2012, President Obama signed Presidential Policy Directive 20, ordering America's national security and intelligence officials to draw up a list of potential overseas targets for US cyber-attacks. The directive also stated that what it called Offensive Cyber Effects Operations (OCEO) offered unique, unconventional capabilities to advance US national objectives around the world, giving little or no warning to potential adversaries or targets.

The Dutch newspaper NRC Handelsblad reported that leaks by Snowden show the NSA collects intelligence around the world in five ways. A document dating from 2012 lists the collection approaches as: data provided by the third-parties, i.e. international partners of the NSA in more than 30 countries; regional collection by Special Collection Service (SCS) installations that gather intelligence in more than 80 regions, and are part of a joint CIA-NSA program funded by a secret budget; computer network hacking carried out by a special NSA department that implants malicious software to steal sensitive information from 50,000 computers worldwide - the major targets being China, Russia, Brazil, Egypt, India, Mexico, Saudi Arabia and countries in Eastern Europe; tapping into the fiber optic cables that transport Internet traffic between continents at 20 major locations, mostly inside the United States; and finally, intercepting data from foreign satellite communications in countries such as Britain, Norway and Japan. The PRISM scandal revealed that intelligence agencies, led by the NSA in the United States, use three major approaches to Internet surveillance and data collection. - Obtaining data worldwide from fiber optic cables. Most data flows pass through the United States, so targeting data streams is a simple matter. The NSA, the Department of Defense and other departments signed a "Network Security Agreement" in 2003 with the telecommunications company Global Crossing. Over the following decade, the United States signed similar agreements with other telecommunications operators. The agreements required the companies to build "Network Operations Centers" on the US soil that could be visited by government officials with 30 minutes of warning. Allies such as Britain and Canada also agreed to provide the United States with fiber optic cable intelligence.

- Getting direct access to Internet companies' servers and databases to retrieve intelligence. The PRISM program cooperated with nine internet companies - Microsoft, Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL and Apple. The companies normally delivered data to the government electronically. Some companies established independent security access to make it easier for government agencies to extract intelligence. The intelligence agents would access the companies' servers and databases to collect emails, instant messages, videos, photos, stored data, voice chat, file transfers, video conferences, login times and social network profiles. They were even able to monitor users' Internet searches. - An NSA special unit was able to obtain intelligence secretly and remotely by hacking. The agency created the Office of Tailored Access Operations (TAO) as early as 1997. Its main task is to clandestinely hack target computers and telecommunication systems, crack passwords and security systems, steal data from the target computers, copy information from email systems and acquire intelligence on foreign targets by tracking data flows. The NSA refers to these activities using the technical term "Computer Network Exploitation" (CNE), but they boil down to cyber-attacks and theft of secrets.