The National Security Agency destroyed surveillance data it pledged to preserve in connection with pending lawsuits and apparently never took some of the steps it told a federal court it had taken to make sure the information wasn’t destroyed, according to recent court filings.
Word of the NSA’s foul-up is emerging just as Congress has extended for six years the legal authority the agency uses for much of its surveillance work conducted through U.S. internet providers and tech firms. President Donald Trump signed that measure into law Friday.
Since 2007, the NSA has been under court orders to preserve data about certain of its surveillance efforts that came under legal attack following disclosures that President George W. Bush ordered warrantless wiretapping of international communications after the 2001 terrorist attacks on the U.S. In addition, the agency has made a series of representations in court over the years about how it is complying with its duties.
However, the NSA told U.S. District Court Judge Jeffrey White in a filing on Thursday night and another little-noticed submission last year that the agency did not preserve the content of internet communications intercepted between 2001 and 2007 under the program Bush ordered. To make matters worse, backup tapes that might have mitigated the failure were erased in 2009, 2011 and 2016, the NSA said.
“The NSA sincerely regrets its failure to prevent the deletion of this data,” NSA’s deputy director of capabilities, identified publicly as “Elizabeth B.,” wrote in a declaration filed in October. “NSA senior management is fully aware of this failure, and the Agency is committed to taking swift action to respond to the loss of this data.”
In the update Thursday, another NSA official said the data were deleted during a broad, housecleaning effort aimed at making space for incoming information.
“The NSA’s review to date reveals that this [Presidential Surveillance Program] Internet content data was not specifically targeted for deletion,” wrote the official, identified as “Dr. Mark O,” “but rather the PSP Internet content data matched criteria that were broadly used to delete data of a certain type … in response to mission requirements to free-up space and improve performance of the [redacted] back-up system. The NSA is still investigating how these deletions came about given the preservation obligations extant at the time. The NSA, however, has no reason to believe at this time that PSP Internet content data was specifically targeted for deletion.”
An NSA spokesman declined to comment on Friday.
Defiance of a court order can result in civil or criminal contempt charges, as well as sanctions against the party responsible. So far, no one involved appears to have asked White to impose any punishment or sanction on the NSA over the newly disclosed episodes, although the details of what happened are still emerging.
“It’s really disappointing,” said David Greene, an attorney with the Electronic Frontier Foundation, which has been leading the prolonged litigation over the program in federal court in San Francisco. “The obligation’s been in place for a really long time now. … We had a major dust-up about it just a few years ago. This is definitely something that should’ve been found sooner.”
The last legal showdown over the issue may have actually compounded the NSA’s problems. In May 2014, an NSA official known as “Miriam P.” assured the court that the data were safe.
The NSA is “preserving magnetic/digital tapes of the Internet content intercepted under the [PSP] since the inception of the program,” she wrote, adding that “the NSA has stored these tapes in the offices of its General Counsel.”
The agency now says, “regrettably,” that the statement “may have been only partially accurate when made.”
The latest NSA filing says the ongoing investigation indicates that officials did a “physical inspection” in 2014 to confirm the tapes’ presence in the counsel’s office storage space. However, “those tapes largely concerned metadata,” not the content of communications the NSA intercepted.
The NSA says the impact of the misstatement and the deletion on the litigation should be “limited” because it has found back-ups of some content from about four months in 2003 and because it has a larger set of metadata from 2004 to 2007. That metadata should give a strong indication of whether the plaintiffs in the suits had their communications captured by the NSA, even if the communications themselves may be lost, the filings indicate. The NSA is also using “extraordinary” efforts to recover the data from tapes that were reused, it said.
Asked why the Electronic Frontier Foundation hasn’t publicized the episode, Greene said his group was waiting for the NSA to turn over data that the plaintiffs in the suits have demanded before considering next steps regarding the spy agency’s failure to maintain the records it said it was keeping.
“We don’t know exactly how bad it is,” the lawyer said, adding: “Even if you take them at their word that this was just an honest mistake, what it shows is despite your best intention to comply with important restrictions, it can be really difficult to implement. … It shows that with the really tremendous volume of information they’re vacuuming up, it is impossible to be meticulous.”
