The NSA Scandal Is All That: A Polite Rebuttal to Marc Ambinder

The backlash against the surveillance state is not overblown.

My former colleague Marc Ambinder is an honest, well-sourced reporter who has done his utmost to understand NSA surveillance and the controversy that surrounds it. His explanatory journalism is always informative, and it's useful to watch him thinking through the implications of his reporting, even though -- or perhaps especially because -- he and I have such different attitudes toward government. His latest is an intriguing devil's advocate exercise: one post makes the case that "the NSA scandal ain't all that," while another lays out "4 reasons why the NSA scandal is troubling."

They're both worth your while.

I'd like to persuade him that the case for the NSA scandal being overblown isn't at all compelling. And I hope he'll push back by telling me where he thinks my counterarguments go wrong. Hopefully we'll all learn something.

Let's begin where he does:

What NSA does with the metadata it collects on Americans is orders of magnitude less intrusive that what other government agencies do with what they collect, than what companies do with what we give them voluntarily and without our knowledge, or what political campaigns profess to know about you buying data you did not intend for them to see.

I see five problems with this argument.

1. This presumes that we know everything that the NSA does with the metadata it collects on Americans. Why? Perhaps it does things far more intrusive than we realize. That has turned out to be true over and over again in recent years. One cause for concern is that the NSA doesn't believe Americans have any right to know what it is doing, regardless of how intrusive it is. So long as that's true we can never know how intrusive NSA activities are, or will be a year out.

2. It may be that Americans are appropriately worried about the NSA and insufficiently worried about the information other people collect -- the fact that there are threats to privacy we ought to worry about more in no way demonstrates that we ought to worry about NSA surveillance less.

3. While other entities collect lots of sensitive data, the NSA is hoovering up data from everywhere, gathering it all together inside one institution, and marshaling software that permits it to be searched and analyzed with unprecedented sophistication, or stored indefinitely.

4. Abuses by other entities can be challenged in court. The NSA invokes standing and the state secrets privilege to shield itself from lawsuits.

5. Intrusiveness isn't the only relevant metric to consider here -- degree of violation is important too. I permit my doctor to touch me in maximally intrusive ways without feeling violated, because it is voluntary. If a priest tried to touch the same parts of me, but less intrusively, I would feel much more violated, largely because I wouldn't have consented to the act. Wisely or stupidly, Americans give their private information to Google voluntarily, and for that reason, they don't feel violated when Google scans it to sell them ads, or whatever. The NSA takes their data without their consent, and if they had any choice in the matter, they wouldn't consent.

It does matter that Americans have no way of knowing whether their number popped up during an analyst's call-chaining session. The daily flow of their lives does not intersect with the NSA's use of the data, so the only mechanism that connects NSA metadata collection with the "chilling" of free speech is the unreasonable expectation that it will, or that it might. Fear itself, in other words, is the biggest threat to our freedoms.

The NSA itself, and surveillance agencies all over the world, have long and well-documented histories of serious abuses. It may still be unlikely that the NSA's use of private data will ever affect, say, a Heathcliff Huxtable and his family, or the folks that gather at Cheers, or most Americans. But it is reasonable to suspect that journalists, or political dissidents, or ethnic minorities might find their speech chilled or their rights abused. To point out that the average person realistically has nothing to fear misunderstands that, while some abusive surveillance states, like the one run by the Stasi, affect almost everyone, others, including a bygone surveillance apparatus in the United States, does great harm by abusing a very small number of people.

Since it is hard to know in advance who the unlucky ones will be, it isn't irrational for many people to feel the chilling effect who won't ever themselves be subject to abuse. Who knows what group will be suspect after the next terrorist attack? America's Chechen community only recently found how quickly a group can find itself unexpectedly targeted by the national-security state. FBI Director Robert Mueller implied that NSA data collection led the FBI to Ibragim Todashev, who they subsequently shot and killed under circumstances that still haven't been explained.

The "privacy rights" that are being violated are very hard to describe in tangible terms. By comparison, when a person is stopped and frisked for no reason other than that he is black -- well, I've just described the rights violation and need not say more.

Stop and frisk is itself a serious abuse of civil liberties, and I don't think its victims have suffered abuses less serious than NSA abuses. At the same time, it conceivable that a military man would feel less violated being stopped and frisked because of his race than he would upon discovering that an NSA employee had been listening in when he was talking dirty to his wife, and sharing a time-stamped recording of the call so that other NSA employees could get in on the fun. It's easy to imagine a Muslim American who'd prefer being stopped and frisked to knowing that, somewhere on an NSA server, there is a permanently stored email that he sent to his family in Yemen in the hours after the Boston bombing that says, "I can't condone what those boys did, but I understand their rage at drone strikes that kill Muslim children, and I confess I share that rage." Marc, if you were a Muslim in NSA-era America, would you send that email? And if you were Senator Ron Wyden (or his wife), wouldn't a small part of you think back on everything you've ever sent by email, and assess how damaging or embarrassing it could be if it came out?

I can succinctly describe the privacy rights being violated. The Fourth Amendment is supposed to guarantee that "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause." Yet Americans are being deprived of security in their papers and effects by the seizure of their private communications without probable cause or an individualized warrant. Admittedly, the NSA isn't the only problem here. It is perpetrating the abuses, but it's been enabled by out-of-date Supreme Court jurisprudence and a flawed "reasonable expectation" test.

The disinclination of critics to articulate the actual harm done by NSA collection, and the inclination to assume facts not in evidence and the worst possible motivations behind those facts, suggests that the scandal is being fed by (real but) disembodied outrage. And this has warped public opinion.

Critics of the NSA are not, in fact, assuming the worst possible motivations. Glenn Greenwald, perhaps its most staunch critic, is not alleging that the Obama Administration is attempting to seize permanent power in a coup, or to blackmail its political opponents into leaving Obamacare alone. The ACLU is not asserting that NSA analysts are nefarious people intent on abusing their fellow Americans. The Electronic Frontier Foundation has not asserted that the worst case scenario for abusing NSA data is already being realized. And in my own work, I've made it clear -- as have many others -- that serious abuses need not spring from malign motives.

Critics are worried because even a well-intentioned surveillance state can abuse the rights of Americans -- and because the people running things now won't be in charge forever, so even certain evidence of good motivations wouldn't tell us much about the long-term wisdom of the program.

I'd like to hear more about the "facts not in evidence" that he's observed NSA critics assuming. He may be right, and everyone ought to do their best to get the facts right. But it seems to me that the NSA itself, and the repeated lies and misleading statements it has put out, along with the fact that too much information is classified, are the factors overwhelmingly responsible for lack of factual clarity.

The NSA is NOT listening to your phone calls or reading your emails. To say "but they're doing other stuff with it" is a different point.

I'm at a loss for the factual basis of this claim. The NSA undeniably has the ability to listen to my phone calls and to read my email. There are rules against their doing so. Then again, NSA rules are often interpreted in dubious ways that I find incredible, and even when they're not twisted beyond reason, they are regularly broken. When they are broken no one seems to be disciplined. In fact, there is precedent for granting retroactive immunity when the rules are broken. No comprehensive audit of NSA violations has been made public, and no independent audit has ever been conducted. It isn't even clear that the NSA would have the capability to definitively determine whether the content of my email had ever been read.

It seems to me that at best, this assertion relies on trusting that the NSA is telling us the truth. But they've lied to us repeatedly. There is also the possibility that the NSA has not yet read my email, but will read my email in the future. Finally, I wonder what Ambinder makes of Ladar Levison's statement about how he's getting off email, and how lots of people would do the same if we knew what he did. I don't know what to make of it myself.

Terms that had meaning, like "dragnet surveillance," are deliberately made elastic to make Americans think that there is a good chance that some analyst somewhere is going to steal the script they've just submitted to an agent. The documents released by Snowden (!) provide ample evidence that this is just not so, almost cannot be so, and indeed, is unlikely to happen without a higher authority finding out about it.

I'm sure there are examples of NSA critics using elastic language to make aspects of what we can prove seem worse than it is. I don't know if "dragnet surveillance" is a good example or not, so I'll defer. But it seems to me that the NSA itself is far more guilty of stretching words far beyond their meaning (see the EFF for examples). And even though I don't think the NSA is stealing any Hollywood scripts, I don't see how the Snowden documents are ample evidence that doing so would be impossible. Can Ambinder say with confidence that Snowden himself couldn't have left the NSA with a screenwriter's script in his trove? Reports that the NSA intends to fire 90 percent of its systems administrators suggest that they're a weak link in the agency's security, and while I don't know exactly how, neither does any other outsider. (And my understanding is that if a screenwriter encrypted the email with his script before sending it to himself, then the NSA is permitted to store it and break the code if they're able. Is that in fact the case?)

Many other government agencies do much more to actively degrade American liberty, and they do so without nearly the degree of oversight that NSA subjects itself to internally and externally. There is no comparison: Getting detained at the border for being a hacker is more viscerally disturbing, and much more traumatic, than knowing that your phone records sit in a database somewhere (or another database, because they already sit in your phone company's database). Conflating the two makes the actual harm seem less harmful.

Four points:

1. The NSA operates with extraordinary secrecy, under a system of secret OLC and FISA court interpretations. So it seems strange to write as if it is subject to much more oversight than other agencies. The ability to classify almost everything about your agency reduces oversight. Working in a subject area lay members of Congress do not understand reduces oversight, especially when most of those members don't even have staff with the credentials to help. There is a compelling case to be made that much of the oversight, though not all, is oversight theater.

2. There are lots of threats to American liberty, as most prominent critics of the NSA will tell you. It isn't as if Glenn Greenwald or Julian Sanchez or Marcy Wheeler or the ACLU or the EFF is only concerned about the NSA. I think Americans ought to be more alarmed about a lot of federal agencies. But that doesn't mean they ought to be any less concerned about the NSA.

3. The stopped-at-the-border comparison Ambinder wants to make elides a couple of things. One is the scale of NSA intrusions. Hundreds of millions are affected. What's worse, a thief who steals $1,000 from one American at gunpoint, or a thief who steals $1 from every American electronically? The fact that the $1,000 victim suffered the most individually, and was robbed most intrusively, doesn't change the fact that the aggregate harm done by the thief who stole $300 million is almost certainly greater. I don't know how you compare the two, but I do know that just as the $300 million theft is a lot of money stolen, NSA surveillance is a lot of liberty lost.

For now, it is perhaps spread relatively evenly, but there is the downside risk of individuals suffering a lot.

4. Why is the downside risk of NSA abuses so big? As one of my readers noted, "because other government agencies are 'actively degrading American liberty,' the danger of NSA information being shared with and used by those agencies to degrade liberty further is much more severe than if the NSA were the most liberty-degrading agency .... If NSA information were to be shared with those agencies -- and we have no evidence that it is not, or will never be -- the consequences would be severe. The context of the NSA scandal makes the scandal worse. That context is: targeted killing of Americans overseas at the president's discretion; indefinite detention so long as the president claims you're a terrorist, torture of prisoners without accountability, etc. Into this environment of unaccountable power steps the NSA -- the effects are cumulative."

A corollary: The type of information collected by NSA is far less personal than the detailed financial accounting we must provide to the IRS, the medical histories that dozens of Medicare employees see, or even the toll records we provide to state governments when we go over a bridge.

I am not at all comfortable with the amount of financial and medical information Americans are required to disclose to the state. That said, I'd much rather make public my tax returns -- most people reading this article could pretty easily guess my approximate income -- or even my boring medical history, than a comprehensive list of everyone I called, texted, and emailed, and I'm sure millions of Americans feel the same way, even as millions of others would make a different choice. The NSA certainly has the capability to find out far more non-public information about me than the IRS or Medicare.

To object that metadata analysis could reveal a person's movements and associates in a way that if they knew they were being monitored, they would be less likely to freely associate, one should ground that fear in the reality of a policy or an institutional inclination or a financial incentive.

With NSA, these realities are fictitious.

This is written as if the NSA as an institution never engaged in widespread targeting of political dissidents and civil-rights activists. Come on. Of course the nation's surveillance agency has an "institutional inclination" toward abuse. That's why abuses keep recurring in different eras, with different humans in charge. Every clandestine agency on earth is institutionally inclined to abuse. That's just empirically true. And NSA contractors have a financial incentive to support the collection of ever more data. The NSA has institutional and political incentives to coverup abuse.

Every president has an incentive to target his political enemies. Richard Nixon gave in to it. Will we never have another Nixon?

Finally, Americans who don't want their private communications swept up in an NSA dragnet already have reason to stop freely associating with certain people, like people (including U.S. citizens) living abroad.

Signals intelligence collection is hard to understand, and many, many news outlets, including some of the ones that revealed the documents, came to conclusions that have not stood the test of even a short period of time. No, the NSA does not filter a majority, or even a plurality, or even two percent of the world's internet traffic.

The Wall Street Journal reports: "The National Security Agency -- which possesses only limited legal authority to spy on U.S. citizens -- has built a surveillance network that covers more Americans' Internet communications than officials have publicly disclosed, current and former officials say. The system has the capacity to reach roughly 75% of all U.S. Internet traffic in the hunt for foreign intelligence, including a wide array of communications by foreigners and Americans."

That figure is easily high enough to justify alarm. I'd like to better understand why Ambinder thinks it's an established fact that the NSA doesn't filter even 2 percent of the world's Internet traffic. How does he know?

The 51 percent relevance test for foreignness does not mean that there is a 49 percent chance that the target might be a U.S. person; it is simply an add-on mechanism to determine where the lines are, precisely so that NSA can stay away from them.

It's true: The 51 percent standard doesn't mean that there is a 49 percent chance the target might be a U.S. person -- but as an add on mechanism, the threshold is lower than I would hope, and suggests to me the NSA doesn't think it's a very big deal to snag U.S. communications.

Yes, NSA actively audits every search.

This is going to get complicated fast. But as best I can tell, NSA analyst searches of data that has already been collected via three-hop analysis and resides in the "corporate store" is, in fact, exempt from audit requirements, per footnote six here, as the ACLU explains in greater detail. As Ambinder said, this is complicated stuff, so maybe I am understanding it wrong. But my understanding is that the NSA does not, in fact, actively audit every search. And it is certainly true that there are lots of NSA audits -- for whole facilities -- that we have never actually seen.

It is eye-raising to base one's objection to NSA's self-reporting on the idea that there is no way to independently check what the NSA says. Well, of course. There is a logical problem here because someone or some entity will be at the bottom of the chain. It has always been difficult to establish transparent legal and formal mechanisms to make sure that agencies that secretly collect secrets don't abuse their power. But it is easier now than it has ever been. The evidence suggests that NSA has MORE checks on its power now than ever before.

It's true that "It has always been difficult to establish transparent legal and formal mechanisms to make sure that agencies that secretly collect secrets don't abuse their power." The fact that it has always been true doesn't make it less alarming or problematic today, given the horrific abuses perpetrated in the past. My guess is that the biggest real checks on the NSA's power occurred while it was under intense scrutiny by the Church Committee, though I am speculating on that point. It is definitely true that the NSA has more money and more powerful technology at its disposal now than ever before; that would be whistleblowers have more reason to be intimidated now than at times in the past; and that executive power is presently nearer a peak than a valley. Finally, notice that lots of Bush-era NSA abuses happened with significant checks in place -- significant, but as it turns out, insufficient. And we didn't know about them for years.

The reason why Sens. Ron Wyden and Mark Udall know so much about NSA activities is not because of a whistle-blower. It is because of NSA's evolving self-disclosure.

They know more than their colleagues in part because the NSA presents materials to its overseers in misleading ways, and they've developed the expertise and persistence to ferret out the truth. Along with their staffs, they've spent thousands of hours in pursuit of it, and even when they ascertained the truth, they were severely constrained in the way that they could use it to inform legislative debate. Also, unless I missed something, it isn't factually established one way or the other that they did or did not learn anything new from Edward Snowden's revelations. It is certainly true that other members of Congress know more due to Snowden's revelations. (If you believe Senator Dianne Feinstein, chair of the Senate intelligence committee, she is one of them!)

The reason why the intelligence committees defend the programs is because they know how they work, what happens when they don't, and how NSA polices itself. This is not an example of a government agency lacking accountability. This IS accountability. If you begin your assessment of the NSA collection activities with the assumption that all government power is inherently corrosive, you will find ways to describe NSA collection in ways that advance and reify your assumptions.

This is just too credulous. Am I really to believe that the intelligence committees defend NSA surveillance for entirely substantive reasons? Politics, ideology, and deference to folks in national security has nothing to do with it? Come on. Next you'll tell me that Feinstein said that only 10 civilians per year were killed by American drones because she's better informed than the rest of us. Look, there are recent examples of congressional intelligence overseers credulously believing national-security officials even when outsiders warn that they're lying.

In reality, there is no one reason why intelligence committee members support or oppose a program. It's very complicated.

But I'll tell you this. When I see Director of National Intelligence James Clapper lying to Congress about the NSA without consequences; a chair of the Senate oversight committee who hadn't seen an audit documenting thousands of abuses per year until the press contacted her; a Patriot Act author who says he was shocked to discover the way the law had been interpreted; repeated NSA successes avoiding legal challenges on their merits; and an agency where no one ever seems to be fired for violating rules, the law, or the Constitution, I don't see accountability; I see lack of accountability. One needn't think "all government power is inherently corrosive" to reach that conclusion.

NSA collects foreign intelligence. Its consumers expect to receive such intelligence. 2010 is not 1970. There just simply isn't a good reason why the NSA would waste its resources on fruitless and voyeuristic domestic collection.

What was the "good reason" for the abuses documented in the mid-1970s? Then, as now, people find reasons to behave unreasonably. Are the Americans of 2010 somehow different in character and less prone to abuses than the Americans of an earlier era? I see no reason to believe that they are.

From the documents, we learn that the NSA has built in many mechanisms to avoid as much domestic traffic as is technologically feasible.

That is factually inaccurate. It would be technologically feasible to avoid lots of domestic traffic that has been collected. For example, when an analyst types in the area code for Washington, D.C. (202), rather than the country code for Egypt (20), the NSA's software could say, "Hey, you're not allowed to collect communications en masse from the 202 area code," rather than delivering the data. The NSA could set a 75 percent threshold rather than a 51 percent threshold when determining if something is domestic communications. The term "technologically feasible" is being used in a bizarre way, where it really means, "technologically feasible while still permitting the NSA to do whatever it deems imperative." So defined, it is meaningless. If Congress forced the NSA to collect 10 percent less domestic traffic starting next week, or else to shut down entirely, does anyone doubt that they could find a way to comply?

The nut of the case for the NSA's malfeasance is that Americans could be discomforted by the scope of the surveillance state if there were no laws, if American politicians acted like movie politicians, and if NSA employees, many of them active duty members of the military, were inclined to spend time figuring out what their neighbors are doing.

I have as much respect for active-duty members of the military as anyone, but they are not incapable of perpetrating serious abuses. Abu Ghraib was run by active members of the U.S. military.

As noted, NSA analysts were recently reported for listening in on the sex calls of their fellow citizens, so it seems as though at least some of them are tempted to figure out what their neighbors are doing. And whether or not there are laws constraining surveillance is just one of many relevant factors. How easily can the laws be broken in secret? When the law is broken, are there consequences? How easily can the laws be reinterpreted? Do we even know what the law really is?

The discombobulation we feel in an age where all of us are electromagnetic emitters has nothing to do with NSA, which has to figure out how to decipher it all, but with the evolution of technology and our interactions with it, a state of being that would exist even if the NSA did not.

NSA critics are not trying to mitigate "the discombobulation we feel." The goal is to remedy serial violations of the law, internal NSA rules, and the Fourth Amendment. Doing so certainly won't solve all the problems of the digital era. But it would check an entity that cannot be trusted.

* * *

I want to remind readers that Ambinder himself wrote a companion piece exploring why "the NSA scandal is troubling," in which he himself raises some of the objections that I noted above. And I want to thank him again for his "devil's advocate" posts, which are a service to public discourse. Perhaps he'll be persuaded by some of the arguments I've made; and perhaps he'll spot some error in my analysis or understanding of the facts that he'll be kind enough to correct.