Luke Harding - The Snowden Files

George Tenet, the CIA director and nominal head of all 16 intelligence agencies, therefore had a question for Hayden. It was really Vice President Dick Cheney’s question, and Tenet was merely the messenger. The query was simple: could Hayden do more? Tenet and Cheney wondered if it was possible for the general to be more aggressive with the NSA’s extraordinary powers to vacuum up vast amounts of electronic communications and telephone information, and turn them against the terrorists.

For five decades, since its founding in 1952, the NSA has accumulated almost mythical technical and mathematical expertise. So much so that in the 1970s, the reformist senator Frank Church had warned that the NSA had the power ‘to make tyranny total in America’.

Its neighbours in Maryland include a number of secret or sensitive US military sites, such as Fort Detrick, the home of the US bioweapons programme, and Edgewood Arsenal, where the US developed chemical weapons. But the NSA was the most secret of the lot. Its budget and personnel are a state secret too.

The NSA’s mission is to collect signals intelligence from around the globe. This means anything electronic: radio, microwave, satellite intercepts. And internet communications. This clandestine monitoring is done without the target finding out. The agency has intercept stations around the world – in US military bases, embassies and elsewhere.

Its capabilities are boosted by a unique intelligence-sharing arrangement dating back to just after the second world war, known as ‘Five Eyes’. Under Five Eyes, the NSA shares its intelligence product with four other Anglophone nations: the UK, Canada, Australia and New Zealand. In theory, these allies don’t spy on each other. In practice, they do.

Legally, the NSA cannot just do as it pleases. The fourth amendment to the US constitution prohibits unreasonable searches and seizures against American citizens. Searches, which include communications intercepts, are only legal against a specific suspect, backed by ‘probable cause’ and the issue of a judicial warrant.

These safeguards are not just irrelevant or antiquarian restrictions. In the 1970s, President Nixon demonstrated how such power could be abused, by ordering the NSA to tap the phones of several fellow Americans he didn’t like, under the notorious MINARET program. The NSA’s illegal domestic targets included some US senators themselves, plus the boxer Muhammad Ali, the writer Benjamin Spock, the actress Jane Fonda, the black activists Whitney Young and Martin Luther King, and other critics of the misbegotten Vietnam war.

The MINARET scandal brought about the Foreign Intelligence Surveillance Act (FISA), a seminal 1978 law. Under it, the NSA was supposed to steer clear of communications inside the US or involving Americans, unless it had a warrant.

Life was easier for the NSA’s smaller UK partners at GCHQ, who faced no written constitution, and who could pressurise government ministers to give them what they wanted under a cosy British blanket of secrecy. Britain’s RIPA (the 2000 Regulation of Investigatory Powers Act) was soon to be ‘interpreted’ to give GCHQ legal carte blanche to carry out mass surveillance on British soil, and pass on the results to the NSA – provided only that one end of a communications link was foreign.

As GCHQ boasted internally, in documents later to be revealed: ‘We have a light oversight regime compared with the US.’

That was certainly true in 2001. Within 72 hours of the devastating 9/11 attacks, Hayden had already taken the agency to the outer limits of its existing legal authorities.

In the midst of the emergency, Hayden secretly allowed his agency to match known terrorist phone numbers with US communications involving international calls. ‘Mission Creep’ rapidly occurred; within two weeks, the NSA was also cleared to give the FBI any US telephone number that contacted any Afghan telephone number. An internal NSA history would later call this ‘a more aggressive use’ of Hayden’s powers than his predecessors tolerated.

And so, under questioning from Cheney and Tenet in 2001, Hayden had to provide an answer that his bosses would find unsatisfying. What more can you do? Nothing. Nothing more can be done within the NSA’s existing authorities.

Later, Tenet asked Hayden a follow-up question over the phone. What could you do if you had more authorities?

As it happened, the NSA could do a tremendous amount.

Prior to the 9/11 attacks, the NSA had already been working on one experiment, which it had had to abandon because of FISA legal constraints. The idea was to perform something called ‘contact chaining’ on the records of communications, or metadata, it received. Contact chaining is a process of establishing connections between senders and recipients and their contacts. Done rigorously, it establishes a map of connections between people that doesn’t involve actually listening to their phone calls or reading the contents of their emails. Long before Facebook ever existed, the NSA was toying with what the social network would later unveil as a ‘social graph’.

But there was a problem. The Justice Department’s intelligence policy branch determined in 1999 that metadata was covered under FISA’s definition of electronic surveillance. That meant that contact chaining was kosher for non-American communications, but if it ensnared Americans, the NSA would be breaking the law.

Adding complexity, the transmission of electronic communications even between foreigners overseas could transit through the US, since the data splits apart into digital ‘packets’ rather than travelling from point to point over a telephone line. FISA protects transits inside the US. Yet, increasingly, that was how global telecommunications occurred.

There was, however, one avenue open to Hayden, Tenet, Cheney and George W Bush in the days after 9/11. They could go to Congress, which was rabid for war, and ask for more power by amending FISA. Congress was feeling generous to executive authority while the Twin Towers and the Pentagon still smouldered. In early October, representatives overwhelmingly passed the Patriot Act, granting federal investigators more authority to conduct searches in terrorism cases. Surely they would also wave through an amendment to the FISA regulations?

But the Bush administration decided against openly asking for more power. Instead, the White House simply instructed Hayden to go ahead in secret with more surveillance. The NSA’s official history hazards a guess why. ‘Anecdotal evidence suggests that government officials feared the public debate surrounding any changes to FISA would compromise intelligence sources and methods.’

So Hayden’s NSA began preparing a new program, one that would be kept in the strictest confidence while transgressing traditional NSA boundaries. It had four aspects: telephone communications, telephone metadata, internet communications like emails and web searches, and internet metadata. The NSA would collect as much of it as it could. Contact chaining from foreigners to Americans was back on, and the NSA could scoop up foreign communications even when they traversed the USA. The program received the elegant codename STELLAR WIND, although some of the NSA’s technologists took to calling it the Big Ass Graph. On 4 October 2001, STELLAR WIND began – the official covername would follow on the 31st, Halloween – thanks to an authorisation signed by President Bush and an initial outlay of $25 million.

Not many people knew about STELLAR WIND. Hayden kept Bush’s directive in a safe. The NSA’s top lawyer knew – along with approximately 90 NSA staff who implemented the program – and blessed it as legal. But there was no initial court approval: it would not be until January 2002 that the chief of the secret FISA court even heard of the effort; his colleagues, except for one, would not know about it for another four years. Even the NSA’s internal watchdog, the inspector general, would not learn about STELLAR WIND until August 2002, nearly a year into the program’s existence.