Wikipedia announced last week that it is suing NSA over the agency’s upstream collection program. It has alleged “that the N.S.A.’s mass surveillance of Internet traffic on American soil — often called “upstream” surveillance — violates the Fourth Amendment, which protects the right to privacy, as well as the First Amendment, which protects the freedoms of expression and association.”
Wikipedia’s lawsuit is based on a significant mischaracterization of this NSA program. It has overstated the scope and civil liberties implications of upstream collection.
The upstream program sifts through and collects communications on the Internet backbone (“the network of high-capacity cables, switches, and routers” that carry the world’s Internet traffic, according to Wikipedia’s complaint) that reference NSA targets. The program is conducted under Section 702 of the Foreign Intelligence Surveillance Act (FISA). It is separate from NSA’s now well-known PRISM program, which is also carried out under Section 702 and which involves NSA actually requesting targets’ communications from companies like Google.
For those not familiar with these programs, here is a very simple illustration of how they are generally understood to work. Imagine that firstname.lastname@example.org is the email address of an NSA target. Using PRISM, NSA may ask Google for all of the email sent to and from email@example.com. Alternatively, using the upstream program, NSA can search Internet traffic for reference to firstname.lastname@example.org. So if I send an email to a friend and type email@example.com in the body of that email, NSA may identify and collect that email. For more background on the upstream and PRISM programs, check out the PCLOB’s report and my comments to the PCLOB.
So here is the problem. In a New York Times op-ed that also ran last week, Wikipedia stated that, “whenever someone overseas views or edits a Wikipedia page, it’s likely that the N.S.A. is tracking that activity — including the content of what was read or typed, as well as other information that can be linked to the person’s physical location and possible identity.”
This is simply not true. While many of the details about this program remain classified, Wikipedia’s characterization here is inconsistent with the details that have been declassified and provided to the public. And this sweeping characterization is the basis of Wikipedia’s constitutional claims. NSA isn’t tracking the activity of Wikipedia editors. This is a targeted program that uses specific selectors (see my PCLOB submission for an in depth discussion of selectors).
Moreover, the characterization shows a basic misunderstanding of what intelligence agencies do and why they do it. It reflects the NSA is spying on grandma misperception that has plagued so much of the debate about surveillance since the Snowden disclosures began. NSA isn’t listening to grandma’s phone calls (unless grandma is a member of al-Qaeda or the FSB). It isn’t reading your emails. And it isn’t spying on Wikipedia. Intelligence agencies have better things to do and limited resources to do to them.
To be clear, what NSA is in fact doing under the upstream program is certainly worthy of greater public scrutiny. That program is inconsistent with my plain reading of the FISA statute. Moreover, depending upon how broadly NSA defines the term selector, the upstream program could result in huge amounts of over collection. I also question whether the upstream program provides sufficient national security benefits that are beyond those already provided by the PRISM program and that are large enough to justify the invasive nature of the collection.
But the Wikipedia lawsuit isn’t based on an accurate account of the upstream program or its real civil liberties implications. These types of allegations against what critics call the “surveillance state” actually make surveillance reform harder by polarizing a debate around false premises the get privacy advocates up in arms while forcing intelligence officials into a defensive crouch. If we really want to reform the county’s surveillance apparatus, we need to start with a sound understanding of what surveillance programs are and what they are not.