The NSA Publicly Releases Cache of Incident Reports to the President's Intelligence Operations Board
The NSA has reluctantly, after an ACLU lawsuit, released a heavily redacted document covering quarterly reports to the US Intelligence Operations Board. News agencies around the world are talking about some of the abuses in these reports.
There are a number of problems with these reports, that will in effect mask the size and scope of the problem of breaches in protocol in the NSA spying programs.
- These incidents are self-reported. This means that these items only get reported when people get caught by their peers or superiors, or the person turns themselves in. Nothing egregious is going to come to the surface in a system of self-regulation. No one is going to self-report a violation that will get them fired.
- Evidence of tampering may be destroyed. We know from some of the Snowden documents that the current implementation of many NSA systems requires them operating on a rolling cache. This means that data is collected and temporarily stored to be combed through for valuable data. If an improperly wide query, or spying on anything outside of the NSA's list of valid targets occurs, it will be destroyed when the rolling cache is deleted if it is not tasked to be saved. This means there would be no evidence of wrongdoing, and the data could still be viewed and collected.
- The system itself has no inherent protections from tampering. The Snowden revelations show us that the NSA has no idea what documents he stole, or even the quantity. The NSA has been quoted numbering the leak as possibly in the "tens of millions of documents" while Snowden has repeatedly asserted that he only took thousands. Such poor auditing measures would not allow the NSA to monitor what its employees are doing.
- Even these reports with all of their accuracy issues are heavily redacted, to the point where you cannot tell the type, size or scope of the incident.
- The number of incidents do not match with Snowden documents on the same data. The Snowden releases have a far greater number of incidents. The NSA needs to answer for the seemingly large omission of information.
The full report can be accessed here: https://www.nsa.gov/public_info/declass/IntelligenceOversightBoard.shtml
The ACLU plans to appeal the heavy redactions, and claims that known incidents are missing from the report.