AT&T leaks sensitive info in NSA suit

AT&T lawyers publish confidential document that's not properly redacted: Simple copy-paste operation makes it readable.

Declan McCullagh
Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
4 min read
Lawyers for AT&T accidentally released sensitive information while defending a lawsuit that accuses the company of facilitating a government wiretapping program, CNET News.com has learned.

AT&T's attorneys this week filed a 25-page legal brief striped with thick black lines that were intended to obscure portions of three pages and render them unreadable (click here for PDF).

But the obscured text nevertheless can be copied and pasted inside some PDF readers, including Preview under Apple Computer's OS X and the xpdf utility used with X11.

AT&T switching<br /> center in downtown San Francisco" border="0" style="border:1px solid #000;" />
Credit: Declan McCullagh/CNET News.com
A room in this AT&T switching
center in downtown San Francisco
at 611 Folsom St. is alleged to
be a place where the National
Security Agency taps Internet and
telephone communications. AT&T
has neither confirmed nor denied
these allegations, which surfaced
in a lawsuit filed by the
Electronic Frontier Foundation.

The deleted portions of the legal brief seek to offer benign reasons why AT&T would allegedly have a secret room at its downtown San Francisco switching center that would be designed to monitor Internet and telephone traffic. The Electronic Frontier Foundation, which filed the class-action lawsuit in January, alleges that the room is used by an unlawful National Security Agency surveillance program.

"AT&T notes that the facts recited by plaintiffs are entirely consistent with any number of legitimate Internet monitoring systems, such as those used to detect viruses and stop hackers," the redacted pages say.

Another section says: "Although the plaintiffs ominously refer to the equipment as the 'Surveillance Configuration,' the same physical equipment could be utilized exclusively for other surveillance in full compliance with" the Foreign Intelligence Surveillance Act.

The redacted portions of AT&T's court filing are not classified, and no information relating to actual operations of an NSA surveillance program was disclosed. Also, AT&T's attorneys at the law firms of Pillsbury Winthrop Shaw Pittman and Sidley Austin were careful not to explicitly acknowledge that such a secret room actually exists.

A representative for AT&T was not immediately available to comment.

Although EFF's lawsuit was filed before allegations about the room surfaced, reports of its existence have become central to the nonprofit group's attempts to prove AT&T opened its network to the NSA. A former AT&T employee, Mark Klein, has released documents alleging the company spliced its fiber optic cables and ran a duplicate set of cables to Room 641A at its 611 Folsom Street building.

This is hardly the first time that PDF files have leaked embarrassing or sensitive information. In an ironic twist, the NSA published a 13-page paper in January describing how redactions could be done securely.

A similar problem has arisen with metadata associated with Microsoft Office files. In March 2004, a gaffe by the SCO Group revealed which companies it had considered targeting in its legal campaign against Linux users. Microsoft Office 2003/XP even offers a way to "permanently remove hidden data and collaboration data" from Word, Excel and PowerPoint files.

Documents that EFF filed, including a redacted version (click here for PDF) of a sworn statement by Klein released this week, were properly redacted. Instead of including the underlying text and layering a black rectangle on top, the San Francisco-based civil liberties group saved those pages as image files.

EFF did experience its own blunder earlier in the case, though, in which it accidentally placed sealed documents on the court's public Web site. They were visible for about an hour--a situation that U.S. District Judge Vaughn Walker dubbed "a mishap" during a hearing last week.

'State secrets' invoked
Also this week, the Bush administration submitted a 29-page brief that elaborates on its argument that the case should be tossed out of court because of the "state secrets" privilege.

Lawyers for the Justice Department have offered to fly a courier from Washington to San Francisco with classified documents that Walker could review in private--documents that, in the eyes of the government, will convince him to dismiss the lawsuit. (The Bush administration also argues that EFF lawyers should not be permitted to see the classified information.)

"No aspect of this case can be litigated without disclosing state secrets," the government said in its brief this week. "The United States has not lightly invoked the state secrets privilege, and the weighty reasons for asserting the privilege are apparent from the classified material submitted in support of its assertion."

It also pointed to a May 12 ruling from a federal judge in Virginia who dismissed a case against Khaled El-Masri, a German citizen of Lebanese descent. (El-Masri had claimed to have been abducted and tortured by the CIA in an "extraordinary rendition.")

The Bush administration said the case must be dismissed on "state secrets" grounds, and U.S. District Judge T.S. Ellis reluctantly agreed. Ellis wrote that "any answer to the complaint by the defendants risks the disclosure of specific details about the rendition argument."

In addition, Wired News filed a brief written by Tim Alger at Quinn Emanuel asking Walker to unseal Klein's formal declaration. (Wired News has published other documents that Klein has written.)