NSA Worked Out Deal With GCHQ To Spy On UK Citizens, Secretly Expanded It

from the funny-how-that-works dept

Early on in the Snowden leaks, it became clear that the NSA and its UK equivalent, GCHQ, had a very close relationship, sharing lots of data with each other. We noted a convenient potential byproduct of this collaboration: while, technically speaking, NSA isn't supposed to spy on Americans and GCHQ isn't supposed to spy in UK citizens, if they spy on the others' citizens and then share the results, they can get around that loophole. In response to that, the NSA, GCHQ and the three other signals intelligence agencies that make up the so-called "Five Eyes" surveillance collaboration between the US, UK, Canada, Australia and New Zealand, suggested that they had "minimization" procedures in place not to actually spy on "non-target" citizens of each members' countries.

But, of course, that's not what's actually happening. The latest Snowden document published by The Guardian reveals two important, but related things. First, the GCHQ and the NSA worked out a deal to let the NSA spy much more broadly on UK citizens, allowing them to build a database of previously "restricted" materials on UK citizens. Second, the NSA appears to have taken this small opening by the GCHQ to spy on the UK citizens under certain circumstances and massively expanded it, without telling GCHQ. First, the NSA and GCHQ decreased the rules for "minimization" on "incidentally collected" information, allowing it to be "unminimized" (which most people would call "maximized"), in 2007. Basically, the GCHQ allowed the NSA to do pattern analysis on all that data from UK persons, which had previously been off limits. The idea was to try to piece together connections to suspected terrorists, drug dealers and criminals. Technically, the new "agreement" barred targeting UK citizens to look at the content of their communications. However, as another revealed memo also shows, the NSA took this small opening to conclude that it can basically surf through GCHQ data at will -- something it purposely chose not to inform GCHQ about -- so long as it was good for the US.

The document, titled 'Collection, Processing and Dissemination of Allied Communications', has separate classifications from paragraph to paragraph. Some are cleared to be shared with America's allies, while others – marked "NF", for No Foreign – are to be kept strictly within the agency. The NSA refers to its Five-Eyes partners as "second party" countries.

The memo states that the Five-Eyes agreement "has evolved to include a common understanding that both governments will not target each other's citizens/persons".

But the next sentence – classified as not to be shared with foreign partners – states that governments "reserved the right" to conduct intelligence operations against each other's citizens "when it is in the best interests of each nation".

"Therefore," the draft memo continues, "under certain circumstances, it may be advisable and allowable to target second party persons and second party communications systems unilaterally, when it is in the best interests of the US and necessary for US national security."

Basically, GCHQ agreed to share more data on UK persons under the understanding that it wouldn't be abused, and the NSA took the opportunity to tell NSA folks "feel free to abuse it" so long as you can claim "it's in the best interests of the US." And they didn't let anyone in the UK know about that part. In other parts of the document -- which are shared with the Five Eyes partners, the NSA makes it sound like it will work collaboratively with those agencies when it comes up with important terrorist/criminal information.

Of course, you also have to assume that this original deal was not one-sided. It almost certainly involved the NSA telling GCHQ that it could also collect data and "unminimize" information it collected on US persons as well. And, it wouldn't be surprising to find out that the GCHQ has similar procedures in place that give it "for the good of the UK" exceptions to whatever limits the NSA tried to place on such data.