Data Pirates of the Caribbean
By Ryan Devereaux, Glenn Greenwald and Laura Poitras, The Intercept, May 19, 2014
The National Security Agency is secretly intercepting, recording, and archiving the audio of virtually every cell phone conversation on the island nation of the Bahamas.
According to documents provided by NSA whistleblower Edward Snowden, the surveillance is part of a top-secret system--code-named SOMALGET--that was implemented without the knowledge or consent of the Bahamian government. Instead, the agency appears to have used access legally obtained in cooperation with the U.S. Drug Enforcement Administration to open a backdoor to the country’s cellular telephone network, enabling it to covertly record and store the “full-take audio” of every mobile call made to, from and within the Bahamas--and to replay those calls for up to a month.
SOMALGET is part of a broader NSA program called MYSTIC, which The Intercept has learned is being used to secretly monitor the telecommunications systems of the Bahamas and several other countries, including Mexico, the Philippines, and Kenya. But while MYSTIC scrapes mobile networks for so-called “metadata”--information that reveals the time, source, and destination of calls--SOMALGET is a cutting-edge tool that enables the NSA to vacuum up and store the actual content of every conversation in an entire country.
All told, the NSA is using MYSTIC to gather personal data on mobile calls placed in countries with a combined population of more than 250 million people. And according to classified documents, the agency is seeking funding to export the sweeping surveillance capability elsewhere.
The program raises profound questions about the nature and extent of American surveillance abroad. The U.S. intelligence community routinely justifies its massive spying efforts by citing the threats to national security posed by global terrorism and unpredictable rival nations like Russia and Iran. But the NSA documents indicate that SOMALGET has been deployed in the Bahamas to locate “international narcotics traffickers and special-interest alien smugglers”--traditional law-enforcement concerns, but a far cry from derailing terror plots or intercepting weapons of mass destruction.
“The Bahamas is a stable democracy that shares democratic principles, personal freedoms, and rule of law with the United States,” the State Department concluded in a crime and safety report published last year. “There is little to no threat facing Americans from domestic (Bahamian) terrorism, war, or civil unrest.”
By targeting the Bahamas’ entire mobile network, the NSA is intentionally collecting and retaining intelligence on millions of people who have not been accused of any crime or terrorist activity. Nearly five million Americans visit the country each year, and many prominent U.S. citizens keep homes there, including Sen. Tom Harkin (D-Iowa), Bill Gates, and Oprah Winfrey.
In addition, the program is a serious--and perhaps illegal--abuse of the access to international phone networks that other countries willingly grant the United States for legitimate law-enforcement surveillance. If the NSA is using the Drug Enforcement Administration’s relationship to the Bahamas as a cover for secretly recording the entire country’s mobile phone calls, it could imperil the longstanding tradition of international law enforcement cooperation that the United States enjoys with its allies.
“It’s surprising, the short-sightedness of the government,” says Michael German, a fellow at New York University’s Brennan Center for Justice who spent 16 years as an FBI agent conducting undercover investigations. “That they couldn’t see how exploiting a lawful mechanism to such a degree that you might lose that justifiable access--that’s where the intelligence community is acting in a way that harms its long-term interests, and clearly the long-term national security interests of the United States.”
The NSA refused to comment on the program, but said in a statement that “the implication that NSA’s foreign intelligence collection is arbitrary and unconstrained is false.” The agency also insisted that it follows procedures to “protect the privacy of U.S. persons” whose communications are “incidentally collected.”
Informed about the NSA’s spying, neither the Bahamian prime minister’s office nor the country’s national security minister had any comment. The embassies of Mexico, Kenya, and the Philippines did not respond to phone messages and emails.
In March, The Washington Post revealed that the NSA had developed the capability to record and store an entire nation’s phone traffic for 30 days. The Post reported that the capacity was a feature of MYSTIC, which it described as a “voice interception program” that is fully operational in one country and proposed for activation in six others. (The Post also referred to NSA documents suggesting that MYSTIC was pulling metadata in some of those countries.) Citing government requests, the paper declined to name any of those countries.
The Intercept has confirmed that as of 2013, the NSA was actively using MYSTIC to gather cell-phone metadata in five countries, and was intercepting voice data in two of them. Documents show that the NSA has been generating intelligence reports from MYSTIC surveillance in the Bahamas, Mexico, Kenya, the Philippines, and one other country, which The Intercept is not naming in response to specific, credible concerns that doing so could lead to increased violence. The more expansive full-take recording capability has been deployed in both the Bahamas and the unnamed country.
MYSTIC was established in 2009 by the NSA’s Special Source Operations division, which works with corporate partners to conduct surveillance. Documents in the Snowden archive describe it as a “program for embedded collection systems overtly installed on target networks, predominantly for the collection and processing of wireless/mobile communications networks.”
If an entire nation’s cell-phone calls were a menu of TV shows, MYSTIC would be a cable programming guide showing which channels offer which shows, and when. SOMALGET would be the DVR that automatically records every show on every channel and stores them for a month. MYSTIC provides the access; SOMALGET provides the massive amounts of storage needed to archive all those calls so that analysts can listen to them at will after the fact. According to one NSA document, SOMALGET is “deployed against entire networks” in the Bahamas and the second country, and processes “over 100 million call events per day.”
SOMALGET’s capabilities are further detailed in a May 2012 memo written by an official in the NSA’s International Crime and Narcotics division. The memo hails the “great success” the NSA’s drugs and crime unit has enjoyed through its use of the program, and boasts about how “beneficial” the collection and recording of every phone call in a given nation can be to intelligence analysts.
Rather than simply making “tentative analytic conclusions derived from metadata,” the memo notes, analysts can follow up on hunches by going back in time and listening to phone calls recorded during the previous month. Such “retrospective retrieval” means that analysts can figure out what targets were saying even when the calls occurred before the targets were identified. “[W]e buffer certain calls that May be of foreign intelligence value for a sufficient period to permit a well-informed decision on whether to retrieve and return specific audio content,” the NSA official reported.
“There is little reason,” the official added, that SOMALGET could not be expanded to more countries, as long as the agency provided adequate engineering, coordination and hardware. There is no indication in the documents that the NSA followed up on the official’s enthusiasm.
The documents don’t spell out how the NSA has been able to tap the phone calls of an entire country. But one memo indicates that SOMALGET data is covertly acquired under the auspices of “lawful intercepts” made through Drug Enforcement Administration “accesses”– legal wiretaps of foreign phone networks that the DEA requests as part of international law enforcement cooperation.
When U.S. drug agents need to tap a phone of a suspected drug kingpin in another country, they call up their counterparts and ask them set up an intercept. To facilitate those taps, many nations--including the Bahamas--have hired contractors who install and maintain so-called lawful intercept equipment on their telecommunications. With SOMALGET, it appears that the NSA has used the access those contractors developed to secretly mine the country’s entire phone system for “signals intelligence” –recording every mobile call in the country. “Host countries,” the document notes, “are not aware of NSA’s SIGINT collection.”
The DEA has long been in a unique position to help the NSA gain backdoor access to foreign phone networks. “DEA has close relationships with foreign government counterparts and vetted foreign partners,” the manager of the NSA’s drug-war efforts reported in a 2004 memo. Indeed, with more than 80 international offices, the DEA is one of the most widely deployed U.S. agencies around the globe.
But what many foreign governments fail to realize is that U.S. drug agents don’t confine themselves to simply fighting narcotics traffickers. “DEA is actually one of the biggest spy operations there is,” says Finn Selander, a former DEA special agent who works with the drug-reform advocacy group Law Enforcement Against Prohibition. “Our mandate is not just drugs. We collect intelligence.”
What’s more, Selander adds, the NSA has aided the DEA for years on surveillance operations. “On our reports, there’s drug information and then there’s non-drug information,” he says. “So countries let us in because they don’t view us, really, as a spy organization.”
The ability to record and replay the phone calls of an entire country appears to be a relatively new weapon in the NSA’s arsenal. None of the half-dozen former U.S. law enforcement officials interviewed by The Intercept said they had ever heard of a surveillance operation quite like the NSA’s Bahamas collection.
“I’m completely unfamiliar with the program,” says Joel Margolis, a former DEA official who is now executive vice president of government affairs for Subsentio, a Colorado-based company that installs lawful intercepts for telecommunications providers. “I used to work in DEA’s office of chief counsel, and I was their lead specialist on lawful surveillance matters. I wasn’t aware of anything like this.”
For nearly two decades, telecom providers in the United States have been legally obligated under the 1994 Communications Assistance for Law Enforcement Act to build their networks with wiretapping capabilities, providing law enforcement agencies with access to more efficient, centrally managed surveillance.
Since CALEA’s passage, many countries have adopted similar measures, making it easier to gather telecommunications intelligence for international investigations. A 2001 working group for the United Nations Office on Drugs and Crime went so far as to urge countries to consider permitting foreign law enforcement agencies to initiate international wiretaps directly from within their own territories.
Beyond a desire to bust island pot dealers, why would the NSA choose to apply a powerful collection tool such as SOMALGET against the Bahamas, which poses virtually no threat to the United States?
The answer may lie in a document that characterizes the Bahamas operation as a “test bed for system deployments, capabilities, and improvements” to SOMALGET. The country’s small population--fewer than 400,000 residents--provides a manageable sample to try out the surveillance system’s features. Since SOMALGET is also operational in one other country, the Bahamas may be used as a sort of guinea pig to beta-test improvements and alterations without impacting the system’s operations elsewhere.
Beyond the Bahamas, the other countries being targeted by MYSTIC are more in line with the NSA’s more commonly touted priorities. In Kenya, the U.S. works closely with local security forces in combating the militant fundamentalist group Al-Shabab, based in neighboring Somalia. In the Philippines, the U.S. continues to support a bloody shadow war against Islamist extremists launched by the Bush administration in 2002.
Mexico, another country targeted by MYSTIC, has received billions of dollars in police, military, and intelligence aid from the U.S. government over the past seven years to fight the war on drugs, a conflict that has left more than 70,000 Mexicans dead by some estimates. Attorney General Eric Holder has described Mexican drug cartels as a U.S. “national security threat,” and in 2009, then-CIA director Michael Hayden said the violence and chaos in Mexico would soon be the second greatest security threat facing the U.S. behind Al Qaeda.
SOMALGET operates under Executive Order 12333, a Reagan-era rule establishing wide latitude for the NSA and other intelligence agencies to spy on other countries, as long as the attorney general is convinced the efforts are aimed at gathering foreign intelligence. In 2000, the NSA assured Congress that all electronic surveillance performed under 12333 “must be conducted in a manner that minimizes the acquisition, retention, and dissemination of information about unconsenting U.S. persons.” In reality, many legal experts point out, the lack of judicial oversight or criminal penalties for violating the order render the guidelines meaningless.
“I think it would be open, whether it was legal or not,” says German, the former FBI agent. “Because we don’t have all the facts about how they’re doing it. For a long time, the NSA has been interpreting their authority in the broadest possible way, even beyond what an objective observer would say was reasonable.”
“An American citizen has Fourth Amendment rights wherever they are,” adds Kurt Opsahl, an attorney with the Electronic Frontier Foundation. “Nevertheless, there have certainly been a number of things published over the last year which suggest that there are broad, sweeping programs that the NSA and other government agencies are doing abroad that sweep up the communications of Americans.”
“It’s almost like they have this mentality--if we can, we will,” says German. “There’s no analysis of the long-term risks of doing it, no analysis of whether it’s actually worth the effort, no analysis of whether we couldn’t take those resources and actually put them on real threats and do more good.”