How the NSA Almost Killed the Internet

Google, Facebook, Microsoft, and the other tech titans have had to fight for their lives against their own government. An exclusive look inside their year from hell—and why the Internet will never be the same.

On June 6, 2013, Washington Post reporters called the communications depart­ments of Apple, Facebook, Google, Yahoo, and other Internet companies. The day before, a report in the British newspaper The Guardian had shocked Americans with evidence that the telecommunications giant Verizon had voluntarily handed a database of every call made on its network to the National Security Agency. The piece was by reporter Glenn Greenwald, and the information came from Edward Snowden, a 29-year-old IT consultant who had left the US with hundreds of thousands of documents detailing the NSA’s secret procedures.
Greenwald was the first but not the only journalist that Snowden reached out to. The Post’s Barton Gellman had also connected with him. Now, collaborating with documentary filmmaker and Snowden confidante Laura Poitras, he was going to extend the story to Silicon Valley. Gellman wanted to be the first to expose a top-secret NSA program called Prism. Snowden’s files indicated that some of the biggest companies on the web had granted the NSA and FBI direct access to their servers, giving the agencies the ability to grab a person’s audio, video, photos, emails, and documents. The government urged Gellman not to identify the firms involved, but Gellman thought it was important. “Naming those companies is what would make it real to Americans,” he says. Now a team of Post reporters was reaching out to those companies for comment.
It would be the start of a chain reaction that threatened the foundations of the industry. The subject would dominate headlines for months and become the prime topic of conversation in tech circles. For years, the tech companies’ key policy issue had been negotiating the delicate balance between maintaining customers’ privacy and providing them benefits based on their personal data. It was new and contro­versial territory, sometimes eclipsing the substance of current law, but over time the companies had achieved a rough equilibrium that allowed them to push forward. The instant those phone calls from reporters came in, that balance was destabilized, as the tech world found itself ensnared in a fight far bigger than the ones involving oversharing on Facebook or ads on Gmail. Over the coming months, they would find themselves at war with their own government, in a fight for the very future of the Internet.

It wasn’t just revenue at stake. So were the very ideals that had sustained the TECH WORLD since the birth of the INTERNET.

But first they had to figure out what to tell the Post. “We had 90 minutes to respond,” says Facebook’s head of security, Joe Sullivan. No one at the company had ever heard of a program called Prism. And the most damning implication—that Facebook and the other companies granted the NSA direct access to their servers in order to suck up vast quantities of information—seemed outright wrong. CEO Mark Zuckerberg was taken aback by the charge and asked his exec­utives whether it was true. Their answer: no.
Similar panicked conversations were taking place at Google, Apple, and Microsoft. “We asked around: Are there any surreptitious ways of getting information?” says Kent Walker, Google’s general counsel. “No.”
Nevertheless, the Post published its report that day describing the Prism program. (The Guardian ran a similar story about an hour later.) The piece included several images leaked from a 41-slide NSA PowerPoint, including one that listed the tech companies that participated in the program and the dates they ostensibly began fully cooperating. Microsoft came first, in September 2007, followed the next year by Yahoo. Google and Facebook were added in 2009. Most recent was Apple, in October 2012. The slide used each company’s corporate logo. It was like a sales force boasting a series of trophy contracts. Just a day earlier, the public had learned that Verizon and probably other telephone companies had turned over all their call records to the government. Now, it seemed, the same thing was happen­ing with email, search history, even Instagram pictures.
The tech companies quickly issued denials that they had granted the US govern­ment direct access to their customers’ data. But that stance was complicated by the fact that they did participate—often unwillingly—in a government program that required them to share data when a secret court ordered them to do so. Google and its counterparts couldn’t talk about all the details, in part because they were legally barred from full disclosure and in part because they didn’t know all the details about how the program actually worked. And so their responses were seen less as full-throated denials than mealy-mouthed contrivances.
They hardly had the time to figure out how to frame their responses to Gellman’s account before President Obama weighed in. While implicitly confirming the program (and condemning the leak), he said, “With respect to the Internet and emails, this does not apply to US citizens and does not apply to people living in the United States.” This may have soothed some members of the public, but it was no help to the tech industry. The majority of Apple, Facebook, Microsoft, and Yahoo customers are not citizens of the US. Now those customers, as well as foreign regulatory agencies like those in the European Union, were being led to believe that using US-based services meant giving their data directly to the NSA.

“Every time we spoke it seemed to make matters worse,” one tech executive says. “We just were not believed.” Zohar Lazar

The hard-earned trust that the tech giants had spent years building was in danger of evaporating—and they seemed powerless to do anything about it. Legally gagged, they weren’t free to provide the full context of their cooperation or resistance. Even the most emphatic denial—a blog post by Google CEO Larry Page and chief legal officer David Drummond headlined, “What the …”—did not quell suspicions. How could it, when an NSA slide indicated that anyone’s personal information was just one click away? When Drummond took questions on the Guardian website later in the month, his interlocutors were hostile:
“Isn’t this whole show not just a face-saving exercise … after you have been found to be in cahoots with the NSA?”
“How can we tell if Google is lying to us?”
“We lost a decade-long trust in you, Google.”
“I will cease using Google mail.”
The others under siege took note. “Every time we spoke it seemed to make matters worse,” an executive at one company says. “We just were not believed.”
“The fact is, the government can’t put the genie back in the bottle,” says Face­book’s global communications head, Michael Buckley. “We can put out any statement or statistics, but in the wake of what feels like weekly disclosures of other government activity, the question is, will anyone believe us?”
At an appearance at a tech conference last September, Facebook’s Zuckerberg expressed his disgust. “The government blew it,” he said. But the consequences of the government’s actions—and the spectacular leak that informed the world about it—was now plopped into the problem set of Zuckerberg, Page, Tim Cook, Marissa Mayer, Steve Ballmer, and anyone else who worked for or invested in a company that held customer data on its servers.
Not just revenue was at stake. So were ideals that have sustained the tech world since the Internet exploded from a Department of Defense project into an interconnected global web that spurred promises of a new era of comity. The Snowden leaks called into question the Internet’s role as a symbol of free speech and empowerment. If the net were seen as a means of widespread surveillance, the resulting paranoia might affect the way people used it. Nations outraged at US intelligence-gathering practices used the disclosures to justify a push to require data generated in their countries to remain there, where it could not easily be hoovered by American spies. Implementing such a scheme could balkanize the web, destroying its open essence and dramatically raising the cost of doing business.
Silicon Valley was reeling, collateral damage in the war on terror. And it was only going to get worse.

Telecom Believed to Be at Center of Government Court Fight Files Surveillance Transparency Report

A small telecom believed to be at the center of a historic court battle over government surveillance published its first transparency report on Thursday, noting that it had received 16 government requests for customer data in 2013. But the report may be most significant for what it doesn’t say.
Credo Mobile, the first telecom to release a transparency report, received just 15 requests for customer data pursuant to subpoena, summons or court order and one emergency request for data. But the most significant part of the report may be the government requests it doesn’t list.
A press release accompanying the report notes that it may be incomplete because legal restrictions prevent companies like Credo from disclosing certain kinds of government requests for customer data, such as those requested with a so-called National Security Letter or NSL.
“[D]ue to existing U.S. surveillance statutes that Credo is on the record opposing, such as the USA PATRIOT Act and the FISA Amendments Act, this report and those of other service providers may fall short of full transparency,” the note reads.
The report and statement are significant because Credo is believed to be the anonymous plaintiff at the heart of a historic legal battle over NSLs — a fight that began before documents leaked by Edward Snowden revealed the extent of the government’s sweeping surveillance programs. That legal battle resulted in a court ruling last year saying that NSLs, and the mandatory gag orders that accompany them, are unconstitutional.

By law, gag orders can be imposed on telecom companies prohibiting them from disclosing requests for customer information that are issued under an NSL or under Section 215 of the PATRIOT Act. The gag order also prohibits companies from disclosing whether they have complied with the order or challenged it in court.
Last year, after one telecom challenged the NSL it received, U.S. District Judge Susan Illston in San Francisco ruled ultra-secret National Security letters are an unconstitutional impingement on free speech, and ordered the government to stop issuing NSLs, a stunning defeat for the Obama administration’s surveillance practices. She also ordered the government to cease enforcing the gag provision in any other cases. However, she stayed her order for 90 days to give the government a chance to appeal to the Ninth Circuit Court of Appeals, which it did.
The telecom, which is not identified in court documents but is believed to be Credo, received an NSL in 2011 from the FBI. The company took the extraordinary and rare step of challenging the underlying authority of the NSL, as well as the legitimacy of the gag order accompanying it. Both challenges are allowed under a federal law that governs NSLs, a power greatly expanded under the Patriot Act that allows the government to get detailed information on Americans’ finances and communications without judicial oversight. The FBI has issued hundreds of thousands of NSLs over the years and has been reprimanded for abusing them, though few requests have been challenged by the recipients.
After the telecom challenged the NSL, the Justice Department made the extraordinary move of suing the company, arguing in court documents that the company was violating the law by challenging its authority. That stunned the Electronic Frontier Foundation, which is representing the anonymous telecom.
“It’s a huge deal to say you are in violation of federal law having to do with a national security investigation,” EFF’s Matt Zimmerman told WIRED at the time. “That is extraordinarily aggressive from my standpoint. They’re saying you are violating the law by challenging our authority here.”
In her ruling, Judge Illston said the NSL nondisclosure provisions “significantly infringe on speech regarding controversial government powers.” She noted that the telecom had been “adamant about its desire to speak publicly about the fact that it received the NSL at issue to further inform the ongoing public debate” on the government’s use of the letters. Illaston also said the review process for challenging an order violated the separation of powers. Because the gag order provisions cannot be separated from the rest of the statute, Illston ruled that the entire statute was unconstitutional.
The judge found that although the government made a strong argument for prohibiting the recipients of NSLs from disclosing to the target of an investigation or the public the specific information being sought by an NSL, the government did not provide compelling argument that the mere fact of disclosing that an NSL was received harmed national security interests. A blanket prohibition on disclosure, she found, was overly broad and “creates too large a danger that speech is being unnecessarily restricted.” She noted that 97 percent of the more than 200,000 NSLs that have been issued by the government were issued with nondisclosure orders.
Although the telecom was not identified in court documents that were released publicly, the Wall Street Journal used details that were revealed in them to narrow the likely plaintiffs to Credo in a story published in 2012. The company’s CEO, Michael Kieschnick, didn’t confirm or deny his company was the unidentified recipient of the NSL, but did release a statement following Illston’s ruling.
“This ruling is the most significant court victory for our constitutional rights since the dark day when George W. Bush signed the Patriot Act,” Kieschnick said. “This decision is notable for its clarity and depth. From this day forward, the U.S. government’s unconstitutional practice of using National Security Letters to obtain private information without court oversight and its denial of the First Amendment rights of National Security Letter recipients have finally been stopped by our courts.”
The redacted documents don’t indicate the exact information the government was seeking from the telecom, and EFF won’t disclose the details. But by way of general explanation, Zimmerman said at the time that the NSL statute allows the government to compel an ISP or website to hand over information about someone who posted anonymously to a message board or to compel a phone company to hand over “calling circle” information — that is, information about who has communicated with someone by phone.
An FBI agent could give a telecom a name or a phone number, for example, and ask for the numbers and identities of anyone who has communicated with that person. “They’re asking for association information – who do you hang out with, who do you communicate with, [in order] to get information about previously unknown people.
“That’s the fatal flaw with this [law],” Zimmerman told WIRED last year. “Once the FBI is able to do this snooping, to find out who Americans are communicating with and associating with, there’s no remedy that makes them whole after the fact. So there needs to be some process in place so the court has the ability ahead of time to step in [on behalf of Americans].”
The company said in its statement Thursday that it supports the full repeal of the USA PATRIOT Act and the FISA Amendments Act and is working to pass Rep. Rush Holt’s Surveillance State Repeal Act.
“Credo, which supports the repeal of the USA PATRIOT Act and FISA Amendments Act, a plea bargain or clemency for Edward Snowden, and an end to the retroactive immunity granted to protect telecom companies from facing charges for colluding with the NSA in the illegal wiretapping of Americans, is releasing the report to increase transparency around governmental requests for customer information,” the company said in a statement.
Credo’s transparency report follows in the tradition begun by Google and other internet service providers to release transparency reports about the number of government requests they receive for customer data. Google and other companies have been battling the government to be able to release more information than their transparency reports currently cover. Late last year, Verizon and AT&T announced that they would be releasing a transparency report in 2014 — their first.
But Credo took a swipe at its fellow telecoms in its statement on Thursday, saying that it had opposed the immunity granted by Congress to telecoms like Verizon and AT&T after previous revelations that the companies cooperated with the Bush administration’s illegal wiretapping program without trying to fight it.
“During the Bush Administration, Credo fought against the unprecedented federal wiretapping of American citizens without any court order and the cover up that followed, including the granting of retroactive immunity to large telecom companies that made the warrantless wiretapping possible,” the company noted in its statement.
“Credo has a decades-long record fighting for the civil liberties, not just of our phone customers, but of all Americans,” Kieschnick was quoted in the statement saying. “Despite the shocking revelations of NSA abuses, the U.S. government continues to defend unconstitutional programs to systematically spy on Americans. So it’s up to companies like ours to lift the curtain to the extent allowed by law and fight for our customers’ constitutional rights.”