Why AT&T's Surveillance Report Omits 80 Million NSA Targets

By David Kravets, Wired

22 February 14

T&T this week released for the first time in the phone company's 140-year history a rough accounting of how often the U.S. government secretly demands records on telephone customers. But to those who've been following the National Security Agency leaks, Ma Bell's numbers come up short by more than 80 million spied-upon Americans.

AT&T's transparency report counts 301,816 total requests for information - spread between subpoenas, court orders and search warrants - in 2013. That includes between 2,000 and 4,000 under the category "national security demands," which collectively gathered information on about 39,000 to 42,000 different accounts.

There was a time when that number would have seemed high. Today, it's suspiciously low, given the disclosures by whistleblower Edward Snowden about the NSA's bulk metadata program. We now know that the secretive Foreign Intelligence Surveillance Court is ordering the major telecoms to provide the NSA a firehose of metadata covering every phone call that crosses their networks.

An accurate transparency report should include a line indicating that AT&T has turned over information on each and every one of its more than 80 million-plus customers. It doesn't.

That's particularly ironic, given that it was Snowden's revelations about this so-called "Section 215″ metadata spying that paved the way for the transparency report. In Snowden's wake, technology companies pushed President Barack Obama to craft new rules allowing them to be more transparent about how much customer data they're forced to provide the NSA and other agencies. In a Jan. 17 globally televised speech, Obama finally agreed.

But when the new transparency guidelines came out on Jan. 27, the language left it unclear whether discussing bulk collection was allowed, says Alex Abdo, an American Civil Liberties Union staff attorney. AT&T on Monday became the first phone company to release a transparency report under the new rules, and the results seem to confirm that the metadata collection is still meant to stay secret.

"This transparency report confirmed our fear that the DOJ's apparent concession was carefully crafted to prevent real transparency," Abdo says. "If they want real transparency, they would allow the disclosure of the bulk telephone metadata program."

WIRED asked AT&T about the omission of the metadata spying.

The response, which arrived by email from AT&T spokeswoman Claudia Jones: "Please see footnote #1."

Legal experts, though, say that the footnote has nothing to do with with whether bulk collection activities carried out in the past could be disclosed. It merely notes that plans are in place to reform the metadata collection program in the future.

"That's mealy-mouthed. Footnote 1 is talking about future reporting, not reporting about already received orders," says Nate Cardozo, a staff attorney with the Electronic Frontier Foundation.

(AT&T's Jones did not return repeated calls seeking more comment on the company's report. The Department of Justice neither returned e-mails nor telephone calls seeking comment.)

But Cardozo believes that AT&T is correct that it is barred from disclosing the metadata numbers, because of the Obama administration's careful choice of language in the section relating to orders from the Foreign Intelligence Surveillance Court.

The guidelines allow for the disclosure, in chunks of 1,000, of "the number of customer selectors [phone numbers] targeted under FISA non-content orders." Since the bulk metadata collection doesn't "target" any "selectors" it is, by definition, not subject to disclosure.

This loophole is no accident of phrasing. In other sections of the guidelines covering National Security Letters - a type of subpoena that doesn't require a judge's signature - Obama allows disclosure of the "number of customer accounts affected." If the guidelines used that same language for the FISA disclosures, AT&T's transparency report would presumably disclose that more than 80 million customers - that would be all of AT&T's customers - had been spied upon.

The end result, observes Kevin Bankston, the policy director of the New America Foundation's Open Technology Institute, is that Obama's so-called reform has spawned a misleading report that provides false comfort to AT&T customers - and all Americans.

"Not only is this a complete failure when it comes to providing transparency around bulk data being handed over," Bankston says, "it is affirmatively misleading to the average reader of the transparency report who would conclude that no bulk data handover ever happened."