X

NSA surveillance programs live on, in case you hadn't noticed

Lawmakers renew spy programs that collect massive amounts of global communications with little fuss. Privacy advocates say secrecy led to limited debate.

Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce, Amazon, earned wage access, online marketplaces, direct to consumer, unions, labor and employment, supply chain, cybersecurity, privacy, stalkerware, hacking. Credentials
  • 2022 Eddie Award for a single article in consumer technology
Laura Hautala
5 min read
Illustration of light passing through a prism.

The Prism and Upstream programs made it through Congress without much fuss.

Colin McDonald/CNET

For all the controversial issues US lawmakers have debated lately, there was one bill that made it through both houses of Congress and on to President Donald Trump with little fanfare.

There was so little fuss around its passing, you might be surprised to hear the law renews two government surveillance programs that less than five years ago caused public outcry and panic.

They're the US National Security Agency's Prism and Upstream programs, both of which former NSA contractor Edward Snowden revealed to journalists in 2013. The law that authorizes those programs were set to expire Friday, but Congress renewed them with little difficulty.

Did privacy advocates put up a fight? Yes. But what debate there was focused on reforming a narrow aspect of the programs, and that effort made too few inroads in Congress to get results.

It almost seems like mass global surveillance of the internet isn't controversial in the US anymore.

So here's what got renewed: The Prism and Upstream programs exist to collect online communications of foreigners outside the US. Prism takes the communications directly from internet services like email providers and video chat programs, and Upstream taps into the infrastructure of the internet to pull in the communications while they're in transit.

The programs collect the communications of Americans "incidentally," such as when Americans communicate with targeted foreigners overseas. For technical reasons, the NSA also scoops up Americans' internet traffic that can't be separated from the bits and bytes that contain the communications of intended spy targets. 

The programs are authorized by Section 702 of the FISA Amendments Act, and the NSA gets approval to conduct this surveillance from a warrant through the Foreign Intelligence Surveillance Act court. The deliberations are secret.

Last week, the House of Representatives considered an amendment to the bill that would have required that the FBI get a warrant to query the NSA's database of communications collected under Section 702. The amendment failed, and the House approved renewal. On Thursday, the Senate also approved the bill.

Sen. Richard Burr, a Republican from North Carolina, said the programs are some of the most vital tools in the NSA's arsenal for fighting foreign terrorism.

Trump hasn't said whether he'll sign the bill -- his public statements have focused on the looming government shutdown. What's more, he's at loggerheads with the FBI as it investigates possible ties between his election campaign and a Russian effort to influence the 2016 election. However, he's made no indication he intends to diminish the NSA's spy powers.

The bill does require the FBI to get a warrant to look at Americans' data in the NSA's database if the investigation isn't related to national security.

The public cared

When the programs first became public, outcry wasn't focused solely on the information of Americans, said Timothy Edgar, a fellow at the Watson Institute for Public Affairs at Brown University. Edgar worked on privacy issues at the ACLU until taking a job with the Office of the Director of National Intelligence. His role was to make sure the government's spy programs complied with US laws, and that's what he was doing when Snowden leaked information on Prism and Upstream.

"It was really a conversation about global mass surveillance and the fact that the NSA has the ability to collect data on people around the world," Edgar said. "We had known that for years in general terms," he said, "and suddenly in 2013 people cared."

But Robert Litt thinks now that the public knows more details about the NSA's surveillance programs, the controversy has died down. Litt served as general counsel for the ODNI when Snowden's disclosures became news, and testified before Congress and made public speeches in the aftermath.

Since releasing the details of the program, leaders from the intelligence community have emphasized that the program is crucial to ferreting out terrorist plots. What's more, they've said the programs aren't a dragnet for the communications of Americans, as initial reports had suggested.

"I think as people learned more and more about Section 702, they became more and more comfortable with the overall nature of the program," Litt said.

It's true that things have changed since Snowden's disclosures made the news in 2013.

In response to outcry, the government declassified documents about the programs, as well as the bulk collection of US phone records that Snowden had also revealed. Talk of reform also resulted in the government ending the phone records collection program in 2015.

What's more, tech companies like Apple, Twitter, Google, Microsoft and Facebook challenged US intelligence agencies in court, seeking to fight secrecy requirements that prevented them from saying more about the user data the government demanded from them, and trying to keep the NSA from collecting data stored in servers outside the US.

But by and large, the Prism and Upstream programs have weathered public scrutiny in the US. Litt says this might because the reality of the programs wasn't as sensational as reported at first. "I attribute it in part to the fact that the initial stories that came out about this program were wrong in some respects, and sort of hyperventillating in others," he said.

Privacy advocates still have concerns, but currently they focus on the incidental collection of Americans' data. The ACLU, joined by privacy-oriented groups like Fight for the Future, argued that the FBI needs a warrant before taking a look at Americans' communications collected by the NSA as part of its foreign surveillance.

Neema Singh Guliani, a legislative counsel at the ACLU, said the organization is still concerned about about the program itself. "Obviously there are broader human rights and international interests at stake," she said.

However, lawmakers didn't bring these issues to the public before voting on the bills, Guliani said, adding, "There were a larger set of reforms that weren't considered in the debate and it was a function of not having much of a debate."

Privacy-oriented lawmakers didn't argue was that the NSA shouldn't collect that data on Americans to begin with. What's more, there was no debate over the NSA maintaining a dragnet that can collect communications on any non-US persons outside the country (as in, most people in the world) with impunity.

Edgar, who used to work under Litt at the ODNI, thinks the conversation should continue.

"It's not the main issue," he said of the FBI accessing information on Americans without a warrant. "The main issue is the legitimacy of mass online surveillance."

The Smartest Stuff: Innovators are thinking up new ways to make you, and the things around you, smarter.

iHate: CNET looks at how intolerance is taking over the internet.