Today, a spokesperson for the National Security Agency announced that the agency would end the practice of "upstream" collection of messages sent by American citizens—messages that were not directed to targets of NSA intelligence collection but referred to "selectors" for those targets in the body of the communications. According to the statement, the NSA has put an end to that practice, which has been authorized since 2008 under the agency's interpretation of Section 702 of the Foreign Intelligence Surveillance Act (FISA).

The announcement posted today states:

After a comprehensive review of mission needs, current technological constraints, United States person privacy interests, and certain difficulties in implementation, NSA has decided to stop some of its activities conducted under Section 702. These changes are designed to retain the upstream collection that provides the greatest value to national security while reducing the likelihood that NSA will acquire communications of U.S. persons or others who are not in direct contact with one of the Agency's foreign intelligence targets.

The changes have been made part of a new Federal Intelligence Surveillance Court order that has narrowed the authorized scope of NSA surveillance.

The "upstream" program has been under increasing scrutiny by Congress as it considers renewal of the Foreign Intelligence Surveillance Act. Upstream collection has been a sore point with the Federal Intelligence Surveillance Court as well, ever since the NSA revealed in 2011 that significant numbers of American citizens' e-mails were getting "incidentally collected" because of the way upstream collection works—and the way that Internet providers bundle e-mail traffic between each other.

The NSA says it has two ways of collecting intelligence from Internet communications. One is what the agency now refers to as "downstream"—which is the new branding of the PRISM program revealed in the documents leaked by former NSA contractor Edward Snowden. Downstream collection is accomplished by going to Internet providers and gaining direct access to the accounts belonging to targeted individuals. The other method of collection is "upstream," which is the term used to describe the direct collection of messages from Internet traffic using a deep packet inspection query system called Xkeyscore and other components of a platform known as Turbulence.



As Rachel Brand, a member of the independent intelligence community Privacy and Civil Liberties Oversight Board, told members of the Senate Judiciary Committee last May, upstream collection takes place through "the compelled assistance of the electronic communications providers that operate the 'Internet backbone.'"

Xkeyscore gets a duplicate stream of live Internet data flowing through these network nexus points, and it uses a collection of rules-based software workers to search through the Internet packets for selectors. Selectors are specific identifying data in Internet traffic that is associated with foreign individuals that NSA analysts have "tasked" the system to track. Those identifiers can include the target's name, known e-mail addresses, Internet Protocol addresses, some specific types of Web browser cookies, and other digital "fingerprints" associated with the targeted individuals' devices and Internet accounts. Xkeyscore's "worker" processes can search through traffic duplicated as it passes through these Internet nexus points, processing packets in real time to check for these bits of data.

Those selectors can be specifically in the address fields of a message, or—more controversially—they can be in the body of the message itself. While messages to and from targeted individuals more clearly fall under the permissions granted to the NSA under FISA, the other messages that contain the selectors in their contents (known as "about" messages) could more easily pull in communications between individuals that have nothing to do with the surveillance.

That's particularly true because of how large e-mail providers often "bundle" message traffic to send it between each other. Upstream selectors were not just grabbing messages that had selectors in them. They grabbed the whole bundle of messages included in the message stream that the selector was within. The NSA alerted the FISA court to this problem in 2011, and a FISA judge ruled that the collection violated the Fourth Amendment rights of those US citizens whose messages were being collected in error.

The NSA and the court reached an agreement that allowed the NSA to continue the collection while putting bundled messages aside in a special repository that analysts could search for specific messages without exposing the other content. But that didn't work because some analysts were searching the messages in a way that didn't comply with the spirit of the agreement.

The NSA further acknowledges:

NSA reported several inadvertent compliance incidents related to queries involving U.S. person information in 702 'upstream" internet collection. Although the incidents were not willful, NSA was required to, and did, report them to both Congress and the FISC. The court issued two extensions of the government's renewal application in order to receive additional information from the government about this issue and the government's plan to resolve it.

Now, with authorization for collection set to expire, the NSA is admitting that the problems have not been resolved to anyone's satisfaction. So they're dropping "about" collection involving US persons' message traffic. This may also mean the loss of some direct communications between intelligence targets, however, because of the limits on the NSA's interception technology.

The "NSA previously reported that, because of the limits of its current technology, it is unable to completely eliminate 'about' communications from its upstream 702 collection without also excluding some of the relevant communications directly 'to or from' its foreign intelligence target," the NSA statement noted. "That limitation remains even today. Nonetheless, NSA has determined that in light of the factors noted, this change is a responsible and careful approach at this time."

American Civil Liberties Union legislative counsel Neema Singh Guliani said that the change made by the NSA and the FISA court "underscores the need for Congress to significantly reform Section 702 of FISA, which will continue to allow warrantless surveillance of Americans." While the NSA's changes "will curb some of the most egregious abuses under the statute," Guliani noted, "it is at best a partial fix. Congress should take steps to ensure such practices are never resurrected."