NSA MASS-SURVEILLANCE STACK (FISA §702 / PRISM–UPSTREAM / FIVE EYES)

Institutional Archetype

THE FOUNDATION LAYER — The archetype is the substrate: the layer beneath the layer everyone argues about. The observatories map influence operations, the standards bodies grade the models, the labs train them — all of it on networks whose fiber the agency taps, whose platforms it compels, and whose stored take it keeps in exabytes against the possibility of future use. The instrument is not a report or a benchmark; it is collection itself — “nearly everything a typical user does on the internet,” in the agency’s own training-slide phrasing. The leverage is that the substrate outlives every argument conducted on top of it: programs get renamed, authorities get reauthorized, and the take keeps flowing. The finding is the shape of the stack and the compliance record it generated.

Mandate & Origin

The stack is a legal sediment, laid down in layers. FISA (1978) created the Foreign Intelligence Surveillance Court in response to the Church Committee’s findings on warrantless wiretapping and surveillance of domestic dissenters — the court that was supposed to say no. Executive Order 12333 (Reagan, December 4, 1981) became the primary authority for collection outside the United States: no judicial oversight, no warrants, no congressional reporting for routine overseas collection — and, per the Privacy and Civil Liberties Oversight Board, activity that has “never been subject to meaningful oversight by either courts or Congress.” After September 11, Stellar Wind ran warrantless wiretaps of Americans’ international communications outside FISA entirely; when the program surfaced, Congress responded with the FISA Amendments Act of 2008, which legalized the model going forward as Section 702 and granted the cooperating telecoms retroactive immunity. In April 2024, Congress passed RISAA (H.R. 7888; House 273–147, Senate 60–34, at midnight before expiration), reauthorizing §702 and expanding the definition of “electronic communications service provider” so broadly that critics argued it could compel almost any business operating Wi-Fi. Senator Ron Wyden called it “one of the most dramatic and terrifying expansions of government surveillance authority in history.” President Biden signed it the same day.

The machinery the stack authorizes, per the agency’s own leaked documents: PRISM — collection from nine US technology companies (Microsoft joined September 2007, then Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL, Apple by October 2012), accounting for 91% of the internet traffic NSA acquired under §702. Upstream — fiber-optic taps on the backbone itself, exemplified by Room 641A at AT&T’s Folsom Street facility (installed 2003, revealed by technician Mark Klein in 2006). MUSCULAR — a joint NSA/GCHQ tap on the unencrypted links between Google’s and Yahoo’s own data centers, placed overseas to fall under EO 12333 rather than FISA; 181 million records in one thirty-day window, commemorated internally by a slide reading “SSL Added and Removed Here” with a hand-drawn smiley face. XKeyscore — the search layer, 700+ servers at roughly 150 sites, at least 41 billion records collected in a single thirty-day period, queryable by name, phone, IP, or keyword on an analyst’s form with no warrant. Utah Data Center (Bluffdale, completed 2014, $1.5 billion) — exabyte-scale storage, built to keep the take indefinitely.

Funding & Backers

For the commercial firms in this drawer the question is who pays them; for the agency the question runs the other way — whom it pays, and what the payment bought. The documented ledger: AT&T’s cooperation under the FAIRVIEW program ran at $188.9 million in a single year, per ProPublica and The New York Times. GCHQ’s Tempora — 200+ transatlantic cable taps whose take flowed to NSA under Five Eyes — paid BT and Vodafone tens of millions of pounds annually in secret. RSA Security received a $10 million NSA contract to make Dual_EC_DRBG — an algorithm the Snowden documents showed the NSA had backdoored — the default random-number generator in its BSAFE toolkit; RSA denied knowingly weakening its products. The contractor layer completes the diagram: Edward Snowden held his system-administrator access as a Booz Allen Hamilton employee, and Palantir — founded 2003 with initial CIA funding through In-Q-Tel, government contracts around 55% of revenue — now holds a Project Maven contract expanded past $1 billion. The funding model is the finding inverted: a substrate so entrenched that the private sector is paid to be part of it, indemnified when caught, and contracted to process the take.

Actions & Leadership Choices

The adjudicated record. This is the section where the file needs no characterization, because the courts supplied their own. A 2011 FISA Court opinion by Judge John Bates — classified until Snowden’s leaks surfaced it two years later — found that NSA’s collection of domestic internet communications under §702 violated the Fourth Amendment; the program continued in modified form. The FBI ran more than 278,000 queries of §702 data later found non-compliant with the court’s own standards — including searches on 100+ Black Lives Matter protesters, January 6 suspects, journalists, and a sitting member of Congress — over 8,000 improper queries in 2022 alone, against a 2021 baseline of 3.4 million warrantless US-person searches per the ODNI’s own transparency reporting. The FISA Court issued opinions in 2018, 2019, 2020, and 2022 decrying “persistent and widespread” violations. The compliance cycle is itself the finding: improper queries, discovery, new procedures, new violations, newer procedures, newer violations — at no point the suggestion that a warrantless database of Americans’ communications, queryable by thousands of federal employees on an unaudited form, is the problem.

The backdoor ledger. Under BULLRUN, documented in the Snowden files, the agency worked to insert vulnerabilities into commercial encryption. Its showpiece, the Dual_EC_DRBG standard, carried NSA-chosen curve points that let the holder of the secret relationship predict output and derive keys. In 2012 an unknown third party — widely attributed in Bloomberg reporting and by security researchers to Chinese intelligence, never officially confirmed — modified the parameters in Juniper Networks’ implementation, locking the NSA out of its own backdoor while opening the traffic to someone else. When Senator Wyden’s staff asked in 2018 for the agency’s “lessons learned” report on the incident, the NSA said it could not locate it. The deed pattern: weaken the commons, lose control of the weakness, lose the paperwork.

The continuity ledger. Four administrations, one direction. Bush launched Stellar Wind; Congress legalized it retroactively. Obama campaigned on reform, tripled NSA searches of Americans’ communications after 2011 rule changes, and — in January 2017, his final days — authorized sharing of raw, unminimized signals intelligence with all sixteen other intelligence agencies, where the prior procedure masked American identities first. Trump signed the 2018 reauthorization eight days after tweeting, the morning of the House vote, that FISA had been used against his own campaign. Biden signed the 2024 expansion after the ACLU noted he had previously said §702 would violate civil liberties. Electoral politics changed the signatures, not the trajectory.

The whistleblower ledger. Three routes, one destination. Mark Klein revealed Room 641A in 2006; Congress answered with retroactive telecom immunity — his disclosure was not disproven but immunized. Edward Snowden (timeline: copying began April 2012; first publication June 5, 2013; Espionage Act charges June 14; Moscow June 23 after passport revocation; Russian citizenship September 2022) still faces charges under a statute that recognizes no public-interest defense — he could not argue at trial that what he revealed was unconstitutional, even where a court later found exactly that. Daniel Ellsberg, who beat the same statute in 1973 only through government misconduct, called him a patriot; the disclosures won the 2014 Pulitzer and produced the one statutory rollback (USA FREEDOM) and encrypted data-center links across the industry. The apparatus charged the messenger, immunized the carrier, and kept the take.

CONDUCT verdict: ADJUDICATED — “PERSISTENT AND WIDESPREAD” (the court’s words, not ours). Scoped precisely: the adjudication attaches to the documented §702 compliance record and the 2011 Fourth Amendment finding — not to every program, not to every employee, and not to the stated foreign-intelligence mission, whose defenders’ case is presented above at full strength. What the verdict covers, it covers on the surveillance court’s own repeated findings; no file in this drawer carries heavier paper.

Sources: PRISM (Wikipedia); PCLOB 2023 Report on Section 702 (PDF); EFF: Upstream vs. PRISM; XKeyscore training slides (Guardian, archived); The Intercept: XKEYSCORE; H.R.7888 (Congress.gov); ACLU: Senate Reauthorizes and Expands Section 702; EFF: Senate and Biden Shamefully Renew and Expand 702; EPIC: FISA Court Statistics 1979–2022; Stanford Law Review: Is the FISC Really a Rubber Stamp?; CDT: FBI’s Misuse of FISA 702; ACLU: NSA Documents Released Since June 2013; Washington Post: NSA Infiltrates Links to Yahoo, Google Data Centers (Oct 30, 2013); Room 641A (Wikipedia); MUSCULAR (Wikipedia); Tempora (Wikipedia); NSA Spying Relies on AT&T’s “Extreme Willingness to Help” — ProPublica, Aug 2015; EO 12333 Full Text (ODNI, PDF); PCLOB: EO 12333 Public Capstone Report (PDF); EPIC: Executive Order 12333; Yale Law School: Newly Disclosed Documents on Five Eyes; Privacy International: Five Eyes; EFF: Obama Expands Surveillance Powers on His Way Out (Jan 2017); The Intercept: Obama Opens NSA’s Vast Trove to Entire Intelligence Community; ACLU: Biden Knows 702 Is Unconstitutional Yet Defends It; Dual_EC_DRBG (Wikipedia); James Clapper (Wikipedia); Keith B. Alexander (Wikipedia); Utah Data Center (Wikipedia); NSA: Artificial Intelligence Security Center; Memorandum on AI and National Security (Oct 2024, archived); DefenseScoop: DOD Raises Palantir Maven Contract to $1B+; Snowden Surveillance Archive (York University).