August 8, 2015

The Christie - Paul clash: some clarification for the Senator

Governor Chris Christie and Senator Rand Paul

For the most part, I try to avoid politics in this forum, and I will try to do so here - I am not advocating for or against any candidate in the Republican race.

At the August 6 debate the topic of privacy and the collection of what Senator Rand Paul of Kentucky believes is protected information was raised. The senator was challenged on his views by New Jersey Governor Chris Christie.

On this particular topic, Governor Christie seems to understand the issue and the danger posed by well-meaning critics of bulk meta data collection. That is what the two candidates were arguing, although neither of them clarified it sufficiently. Had Director of National Intelligence Jim Clapper been a bit more articulate in the Senate hearings on this topic in 2013, this might not be an issue today.

The director needed to distinguish between storage of meta data versus the intelligence exploitation of that data. He failed to do so, leaving the senators with the impression that intelligence analysts are poring through Americans' phone calls.

Meta data is the term used to describe information about communications rather than the content of those communications - we old-timers in the signals intelligence business used to call these data "message externals." Using phone calls as the example, it would be information such as time of call, length of call, originating number and receiving number - basically the information on your telephone bill or online via your cell phone provider. You have heard references to "LUDs" (local usage details) on police shows - this is meta data.

In the world of domestic law enforcement, a court order is required to have a telephone company provide this information to the police. There must be a reason for that request, made to a judge who then authorizes the police to acquire the meta data on a particular phone line. In the era of online phone calls (like voice over internet protocol, VOIP) and services such as Skype, it becomes a bit more difficult, but the data is there if you know how to access it (we do).

This is predicated on the availability of the data, the meta data that is maintained by the phone providers. It is how they bill consumers. At one point, this information was also being provided to the intelligence community - specifically the National Security Agency (NSA) - and stored. Commercial communications companies cannot be expected to store meta data indefinitely. Here is the key point - the data was stored in massive servers to be available to intelligence analysts if it was ever needed.

Perhaps a scenario would be helpful - this particular scenario is loosely based on actual events.

The Central Intelligence Agency (CIA) chief of station in Islamabad, Pakistan is called to a meeting with the Pakistani Inter-Services Intelligence Directorate, or ISI. The ISI officer provides the station chief a stack of materials seized in an ISI raid of an al-Qa'idah safehouse in Quetta, a city near the border with Afghanistan. In that stack of materials are several laptop computers and a few cellphones.

The materials are forwarded to CIA headquarters where all the information is downloaded from each of the devices. Key intelligence information can be found in the call logs on the phones, as well as the email addresses in the laptops. The phone numbers are important in determining who else is involved in this particular al-Qa'idah cell. Several of the numbers are located in the United States.

In order to fully exploit this information, NSA officers, operating under a Foreign Intelligence Surveillance Act - more commonly known by its acronym FISA - warrant, access the stored meta data to determine not only who is associated with the phone numbers recovered from the seized laptops and cellphones, but also what numbers were called from those phones, and further what numbers were called from that second set of phone numbers.

This is called network analysis, and is critical in determining al-Qa'idah members (or other group) or sympathizers present in the United States. Again, this is predicated on the availability of historic meta data - it is essential that analysts be able to "go back in time" to uncover these contacts. Only when there is such a requirement is the meta data accessed, and then only with a warrant. Intelligence analysts are not sifting through meta data on a routine basis - imagine the volume of data on the servers.

Senator Paul and others believe that intelligence community storage of this meta data is an invasion of privacy and illegal under the Constitution. They often say that if there is suspicion that someone is involved in illicit or terrorist activities, law enforcement agencies should obtain a warrant and then proceed to monitor the communications of that individual.

That sounds good, but to adequately and effectively analyze these terrorist organizations, you need historical data. Whenever there is an arrest of a key individual or a takedown of a cell in a terrorist or criminal organization, one of the first things these groups do is completely change their communications methods. The phone number on a newly issued wiretap warrant will likely be dead before the ink is dry on the warrant. We need access to the historical meta data to determine the extent of the network.

This access is a key analytical tool in the war on terrorism. Well-intentioned officials like the senator have passed legislation that restricts the intelligence community's storage of this information. The next time there is an attack on the United States, these same people will be blaming the same intelligence community whose hands they have tied. Senator Paul wants the intelligence community to connect the dots - the analysts must first have the dots to connect. Meta data are dots....

Sorry, Senator Paul. Governor Christie gets it - you don't.