Journalism in the Public Interest

Does the NSA Tap That? What We Still Don’t Know About the Agency’s Internet Surveillance

In a secret effort, the National Security Agency appears to be vacuuming up large swathes of the Internet.

The telecom consulting firm TeleGeography's 2013 map of 244 active and planned submarine cable systems (TeleGeography/

Among the snooping revelations of recent weeks, there have been tantalizing bits of evidence that the NSA is tapping fiber-optic cables that carry nearly all international phone and Internet data.

The idea that the NSA is sweeping up vast data streams via cables and other infrastructure — often described as the “backbone of the Internet” — is not new. In late 2005, the New York Times first described the tapping, which began after the Sept. 11, 2001 attacks. More details emerged in early 2006 when an AT&T whistleblower came forward.

But like other aspects of NSA surveillance, virtually everything about this kind of NSA surveillance is highly secret and we’re left with far from a full picture.

Is the NSA really sucking up everything?

It’s not clear.

The most detailed, though now dated, information on the topic comes from Mark Klein. He’s the former AT&T technician who went public in 2006 describing the installation in 2002-03 of a secret room in an AT&T building in San Francisco. The equipment, detailed in technical documents, allowed the NSA to conduct what Klein described as “vacuum-cleaner surveillance of all the data crossing the internet -- whether that be peoples' e-mail, web surfing or any other data.”

Klein said he was told there was similar equipment installed at AT&T facilities in San Diego, Seattle, and San Jose.

There is also evidence that the vacuuming has continued in some form right up to the present.

A draft NSA inspector’s general report from 2009, recently published by the Washington Post, refers to access via two companies “to large volumes of foreign-to-foreign communications transiting the United States through fiberoptic cables, gateway switches, and data networks.”

Recent stories by the Associated Press and the Washington Post also described the NSA’s cable-tapping, but neither included details on the scope of this surveillance.

Upstream slide (<a href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href='' _cke_saved_href=''>Washington Post)</a>A recently published NSA slide, dated April 2013, refers to so-called “Upstream” “collection” of “communications on fiber cables and infrastructure as data flows past.” 

These cables carry vast quantities of information, including 99 percent of international phone and Internet data, according to research firm TeleGeography.

This upstream surveillance is in contrast to another method of NSA snooping, Prism, in which the NSA isn’t tapping anything. Instead, the agency gets users’ data with the cooperation of tech companies like Facebook and Google.  

Other documents leaked by Edward Snowden to the Guardian provide much more detail about the upstream surveillance by the British Government Communications Headquarters (GCHQ), the NSA’s U.K. counterpart.

GCHQ taps cables where they land in the United Kingdom carrying Internet and, phone data. According to the Guardian, unnamed companies serve as “intercept partners” in the effort.

The NSA is listening in on those taps too. By May 2012, 250 NSA analysts along with 300 GCHQ analysts were sifting through the data from the British taps.

Is purely domestic communication being swept up in the NSA’s upstream surveillance?

It’s not at all clear.

Going back to the revelations of former AT&T technician Mark Klein — which, again, date back a decade — a detailed expert analysis concluded that the secret NSA equipment installed at an AT&T building was capable of collecting information “not only for communications to overseas locations, but for purely domestic communications as well."

On the other hand, the 2009 NSA inspector general report refers specifically to collecting “foreign-to-foreign communications” that are “transiting the United States through fiber-optic cables, gateway switches, and data networks”

But even if the NSA is tapping only international fiber optic cables, it could still pick up communications between Americans in the U.S.

That’s because data flowing over the Internet does not always take the most efficient geographic route to its destination.

Instead, says Tim Stronge of the telecom consulting firm TeleGeography, data takes “the least congested route that is available to their providers.”

“If you’re sending an email from New York to Washington, it could go over international links,” Stronge says, “but it’s pretty unlikely.”

That’s because the United States has a robust domestic network. (That’s not true for some other areas of the world, which can have their in-country Internet traffic routed through another country's more robust network.)                            

But there are other scenarios under which Americans’ purely domestic communication might pass over the international cables. Google, for example, maintains a network of data centers around the world.

Google spokeswoman Nadja Blagojevic told ProPublica that, “Rather than storing each user's data on a single machine or set of machines, we distribute all data — including our own — across many computers in different locations.”

We asked Blagojevic whether Google stores copies of Americans’ data abroad, for example users’ Gmail accounts.  She declined to answer.  

Are companies still cooperating with the NSA’s Internet tapping?

We don’t know.

The Washington Post had a story earlier this month about agreements the government has struck with telecoms, but lots of details are still unclear, including what the government is getting, and how many companies are cooperating.

The Post pointed to a 2003 “Network Security Agreement” between the U.S. government and the fiber optic network operator Global Crossing, which at the time was being sold to a foreign firm.

That agreement, which the Post says became a model for similar deals with other companies, did not authorize surveillance. Rather, the newspaper reported, citing unnamed sources, it ensured “that when U.S. government agencies seek access to the massive amounts of data flowing through their networks, the companies have systems in place to provide it securely.”

Global Crossing was later sold to Colorado-based Level 3 Communications, which owns many international fiber optic cables, and the 2003 agreement was replaced in 2011.

Level 3 released a statement in response to the Post story saying that neither agreement requires Level 3 “to cooperate in unauthorized surveillance on U.S. or foreign soil.”

The agreement does, however, explicitly require the company to cooperate with “lawful” surveillance.

More evidence, though somewhat dated, of corporate cooperation with NSA upstream surveillance comes from the 2009 inspector general report.

“Two of the most productive [signals intelligence] collection partnerships that NSA has with the private sector are with COMPANY A and COMPANY B,” the report says. “These two relationships enable NSA to access large volumes of foreign-to-foreign communications transiting the United States through fiber-optic cables, gateway switches, and data networks.”

There’s circumstantial evidence that those companies may be AT&T and Verizon.

It’s also worth noting that the NSA might not need corporate cooperation in all cases. In 2005, the AP reported on the outfitting of the submarine Jimmy Carter to place taps on undersea fiber-optic cables in case “stations that receive and transmit the communications along the lines are on foreign soil or otherwise inaccessible.”

What legal authority is the NSA using for upstream surveillance?

It’s unclear, though it may be a 2008 law that expanded the government’s surveillance powers.

The only evidence that speaks directly to this issue is the leaked slide on upstream surveillance, and in particular the document’s heading: “FAA702 Operations.” That’s a reference to Section 702 of the 2008 FISA Amendments Act. That legislation amended the Foreign Intelligence Surveillance Act, the 1970s law that governs government surveillance in the United States.

Under Section 702, the attorney general and director of national intelligence issue one-year blanket authorizations to for surveillance of non-citizens who are “reasonably believed” to be outside the U.S. These authorizations don’t have to name individuals, but rather allow for targeting of broad categories of people.

The government has so-called minimization procedures that are supposed to limit the surveillance of American citizens or people in the U.S. Those procedures are subject to review by the FISA court.

Despite the procedures, there is evidence that in practice American communications are swept up by surveillance under this section.

In the case of Prism, for example, which is authorized under the same part of the law, the Washington Post reported that the NSA uses a standard of “51 percent confidence” in a target’s foreignness.

And according to minimization procedures dating from 2009 published by the Guardian, there are also exceptions when it comes to holding on to American communications. For example, encrypted communications — which, given the routine use of digital encryption, might include vast amounts of material — can be kept indefinitely.

The government also has the authority to order communications companies to assist in the surveillance, and to do so in secret.

How much Internet traffic is the NSA storing?

We don’t know, but experts speculate it’s a lot.

“I think that there’s evidence that they’re starting to move toward a model where they just store everything,” says Dan Auerbach, a staff technologist at the Electronic Frontier Foundation. “The Utah data center is a big indicator of this because the sheer storage capacity has just rocketed up.”

We know more details about how the GCHQ operates in Britain, again thanks to the Guardian’s reporting. A breakthrough in 2011 allowed GCHQ to store metadata from its cable taps for 30 days and content for three days. The paper reported on how the spy agency — with some input from the NSA — then filters what it’s getting:

The processing centres apply a series of sophisticated computer programmes in order to filter the material through what is known as MVR – massive volume reduction. The first filter immediately rejects high-volume, low-value traffic, such as peer-to-peer downloads, which reduces the volume by about 30%. Others pull out packets of information relating to "selectors" – search terms including subjects, phone numbers and email addresses of interest. Some 40,000 of these were chosen by GCHQ and 31,000 by the NSA.

How does the NSA do filtering of the data it gets off cables in the United States?

“I think that’s the trillion dollar question that I’m sure the NSA is working really hard at all the time,” Auerbach, the EFF expert. “I think it’s an incredibly difficult problem.”

And it’s all illegal-as under the Fourth Amendment to the United States Constitution.

No matter what ‘laws’ the government has in their hand, it’s still illegal.

Bruce J Fernandes

July 22, 2013, 3:45 p.m.

Like everything else that is going on in the Obama administration.  If the liberal media gets its way, we will never learn the entire story.

Why?  Because we have a POTUS claiming to be a constitutional scholar, who taught constitutional law, acting in ways that are as unconstitutional as we have seen in our lifetimes.  This is worst than Nixon because the checks and balances in the end arrived at the correct outcome which was a forced self-removal from the job by Nixon rather than face other constitutional options available to congress.

Here, we have a president deciding that the Fourth Amendment no longer has any meaning.  Furthermore, we have a president that has overridden congress’s right to tax.  Suspension of the employer mandate meant suspending collection of a tax.  Obama can call it a penalty but the supremes called it a tax.  Taxes are raised by congress; not the executive branch.  Tax suspensions should be done by congress; not the executive branch. 

Congress instead of playing politics should demand the president send legislation to them so the checks and balances between the branches of government remain in place.  The problem Obama faces in being forced to send legislation is clear evidence health reform is, has been, and always will be, a complete fraud.

We will have to wait for history in order to find out the true extent of Obama’s turning of the constitution on its head.  No one should be surprised if you truly believe Obama does not see the foundation of this nation as legitimate because the founders were all slaveholders.

I will remind all of us that one of our greatest presidents, Abraham Lincoln had to be slapped down by the supreme court over his suspension of habeas corpus.  FDR had to be put into his place by the supreme court of his era and FDR tried unsuccessfully to stack the court.  Now Obama in what can be called the third level of disrespect for our founding documents simply does whatever the hell he wants because he has the media on his side who will choose to ignore all of this in an effort to keep this sorry presidency afloat.

Joan Brannigan

July 22, 2013, 4:15 p.m.

Don’t blame Obama. He was only continuing the laws and procedures of the Bush administration.

The better angle, here, might be to go through what we do know, because the government is not going to put out a statement detailing the full innards of a series of classified, unconstitutional programs.  They’re just not.  When asked last week whether the NSA thought they could keep the program a secret from the people and its representatives forever, the response was “well, we tried.”  They’ll continue to try, because it’s their job.

You can see this in the three-card Monty game they play with programs.  PRISM doesn’t record your calls.  Does any program?  They can’t say.  I’d actually bet that nobody knows the full scope.  Just like terrorists only know a few people in their “cell,” it’s easier to hide secret surveillance programs if only a few people know about any given system.

Before that, Bush repeatedly claimed (and Obama has happily repeated the claim) that all three branches of government support this.  But they neglect to mention that it’s only eight legislators on a committee, sworn to secrecy, getting minimal briefings.  It neglects that FISA rarely rejects a claim and that there’s an appellate FISA to fix those decisions.  It neglects that other courts haven’t been allowed to get involved because proving standing would require access to classified information, which the government considers more illegal than violating the Constitution.

What I’d rather see is an annotated list of what we do know.  What statements have corroborated other statements (for example, other whistleblowers we previously dismissed)?  What half-truths and question-dodging have we seen in use, and what does it suggest?

Everybody already knows that we don’t know a lot, by contrast…

Susan Winchester

July 22, 2013, 4:26 p.m.

When Obama was elected, I had hopes that he would curtail the abuses under Bush. Clearly, that was a vain hope. I now wonder what his con law students learned from him.

As far as the tax penalty for not having medical insurance goes, that was the goofiest tax case I ever read. It either is a tax or it isn’t, but the Supremes decided it was and it wasn’t at the same time.

If we let this stand we can no longer claim to be the Land of the Free.  Time for the paranoia to end.  Time for the Patriot Act to go.  Time for NSA to be put back under strict control.  TIme for us to be able to fly without invasive security ‘frisks’.  Time to demilitarize our Police. 

We have slowly but surely become a Police State.  First it was the War on Drugs, then the Patriot Act ramped up the War on Terror.  Is it any wonder that many countries are up in arms about both Wars we are fighting and how we are fighting them? 

But, nothing will happen because too many people are still in the grip of government induced hysteria.  In the War on Drugs we have had 70 years of government funded propaganda, huge financial grants to any who would fight the War, militarizing the Police, and a rewriting of laws that take away our Constitutional Freedoms and Rights.  In the War on Terror there has been even more of those same tactics.  But the uninformed in this country, those who depend on FOX for their news and views, are under the delusion that all this is not only needed, but also that it works.  It doesn’t work, never has and never will. 

Both our Wars are hyped by Contractors who are making vast amounts of money from the prosecution of these Wars.  Those Contractors write the laws (ALEC) that our Congress Critters pass without reading, much less thinking about, them.  WHy?  Because those same Contractors contribute to their campaigns.  So this is a cycle that is not likely to be broken any time soon. 

Until we get the money out of politics nothing will get done on either War, much less on any meaningful control of Contractors, Bankers, Polluters, and Corporate Tax Cheats.  It just won’t happen.

Bruce J Fernandes

July 22, 2013, 5:22 p.m.

With regard for Supreme Court and Obamacare it was thought that Roberts changed the penalty to a tax in order to rule on it in a way that would make ObamaCare constitutional.  Therefore, the penalty is really a tax and congress should exercise its prerogative with regard for revenue measures.  Think about it.  Obama has included revenue from the penalty or tax in his budget projections.  He has now undone his own budget projections and congress’s own expectations of revenue raising over the next ten years.  I believe the budgeted amount of revenues expected are in the range of $56B.  If we have to raise an additional $56B over ten years we have a right to know whose ox is going to be gored I mean whose taxes have to be raised in orer to give Obama a pass on implementation of ObamaCare employer mandate penalty-tax. 

Regardless of how anyone feels about ObamaCare the rule of law is much more important in the here and now.  Revenue raising is done by congress and only congress should be allowed to suspend this particular penalty via legislation.

As far as the NSA program starting under Bush I had always heard the program was limited to Americans making calls overseas or receiving calls from overseas.  I don’t make or receive many calls from overseas and there is a point where we have to perhaps give up some of our freedom…. However, if we are getting the straight skinny now there is some level of monitoring of substantially all calls made by all Americans and that violates privacy and no just because we are all on camera everywhere we go does not mean the government has some new right to conduct surveillance on all of us.

This goes to the Fox News reporter and Holder signing a subpoena suggesting the reporter may have been part of a crime.  Holder comes out later on and says we never would have prosecuted the reporter.  Holder has NO right to go on fishing expeditions and BTW the judge who signed that subpoena is pissed off that he was made a party to a subpoena issuance that had no validity in the law.

For those of you who believe the government should be doing all this by the time something is done that finally offends your sensibilities it will be too late and we will have given up far too many rights.  We have to stand against all of this right now.

lainie rullo

July 22, 2013, 7 p.m.

‘But, nothing will happen because too many people are still in the grip of government induced hysteria.”

@peter boyle

Before the war on drugs, our elected representatives thoroughly hoodwinked us with their Cold War.  The Red Scare manipulated us into hysteria because of all the money that could be vacumned up by corporate cronies, and because it made us docile obeyors.

Eisenhower famously warned us, but we ignored him.

My mother said that Eisenhower couldn’t be trusted because he had seen so much war that it made him an appeaser.  Sounds like the Frank Lutz’s of the day were very persuasive.

Guillermo Patino

July 22, 2013, 7:10 p.m.

Guys: if you aren’t doing something wrong, just Don’t worry about

@Guillermo Patino

There is so much wrong with what you are suggesting that it’s hard to know where to start.

This should not be the relations that we have with our government.  Currently, our government treats us as though we are all guilty.  We are all the enemy.

If we allow this relationship to continue, they will truly forget just who is the boss around here.  They are our employees, we are not their subjects.


Red Neckerson

July 23, 2013, 6:26 a.m.

Gee, you reckon they know that I’m right on the verge of advocating the overthrow of this gummint? I think it’s time for an American spring!

Bruce and Susan, it’s worth reading the ObamaCare opinion on the Supreme Court’s website, but the short version is that the majority of current justices somehow believe that laws should be given the benefit of all possible doubt as to their Constitutionality.  Since a penalty would have been unconstitutional and a tax not, the most liberal interpretation is that it’s a tax.

To me, it’s less a sign of anything to do with ObamaCare (which I think, generally speaking, is the worst possible attempt at solving the problem of people unable to get medical care—insurance isn’t care, for starters) than a sign that large chunks of the government don’t even feel beholden to the people anymore.  When the Supreme Court assumes Congress is right, they’re by definition not doing their jobs.

As to how this all worked under the Bush administration, Bruce, listen to what the NSA says today, and you can see what’s happened since the Patriot Act, and possibly earlier.  They consistently still claim that no Americans are spied on intentionally, but elsewhere consistently point out that they have no way of telling (obviously) who’s who until after they’re done spying.

As for the “I have nothing to hide” argument, I don’t, myself.  Anything I’d say in private, I’d say in public to people in authority, and often have.  However, I still reject a government that spies, because there are people who do, legitimately, have things to hide.  Reporters have an obligation to protect their sources.  Whistle-blowers often need to hide a lot to avoid persecution.  People leaving abusive relationships with people in power generally need to hide their locations.  I don’t have anything to hide, but people far more vulnerable than I am do.

Similarly, I don’t envision a scenario where I need a specific right to practice a religion as I want to practice it, but I support the right for the people who do need it.  Everybody should.

The thing that should deeply concern every American is the degree to which al Qaeda won, twelve years ago.  They may not have destroyed many landmarks or killed many people, but that was never the point.  The point of terrorism is to destroy from within.

Military strategy since before WWII has included the idea of a “morale war,” the idea that you hit civilians hard so that the survivors force a surrender.  Here, a much smaller attack has created a government here that has more in common with al Qaeda’s leadership than any formal state has come.

They also want people to sacrifice freedom for security.  They preach that a religion of peace gives them the responsibility to exterminate people who believe otherwise.  They murder civilians to make a point and under the pretext that they might one day be enemies.  They torture those they capture.  They celebrate the deaths of their enemies.  And the ends always justify the means.  It’s telling that our government’s response to fight this was to become more like it, and it should make it clear that what has happened is 100% wrong.

When the NSA or CIA talks about what it needs to do to keep American’s safe—when an American teenager is killed in a drone strike or a whistle-blower goes on trial for treason—the question we need to ask ourselves is whether that statement sounds more like Thomas Jefferson (or pick your favorite American leader or even religious figure) or Osama bin Laden.  If it’s the latter, what we’re doing is pretty much by definition un-American and contrary to our values.

It’s funny…you could wipe out tens out thousands of deaths every year in this country with a stroke of a pen, and save billions of dollars along the way.  But if you suggested making the maximum speed limit forty miles an hour, there’d be an open revolt because that would infringe on people’s freedom.  A similar argument could be made for banning alcohol, which we did and we all know how that ended.

Yet storing everything a reporter has ever said or done in case someone needs to find an excuse to prosecute her in a few years’ time, to save a hypothetical few thousand people total?  Oh, no, that’s fine.  We’re totally willing to give up some freedom for security, as long as the freedom doesn’t involve booze or speeding…

I think this fits:

  When the Nazis came for the communists,
  I remained silent;
  I was not a communist.

  When they locked up the social democrats,
  I remained silent;
  I was not a social democrat.

  When they came for the trade unionists,
  I did not speak out;
  I was not a trade unionist.

  When they came for the Jews,
  I remained silent;
  I wasn’t a Jew.

  When they came for me,
  there was no one left to speak out.

On the ‘saving lives’ part, we could save more lives if we limited, at the factory, all motor vehicles to a top speed of 70mph.  But no one would go for that.  Eisenhower warned us.  We didn’t listen.  Today the Contractors write the laws (ALEC) and their paid for politicians pass those laws.  Adding on unrelated items on bills passed is both dishonest and immoral.  We are in a mess and this NSA spying is just the current breaking news.

@john and peter boyle,

thank you for understanding what i was trying to say, and for explaining the dilemma so much clearer.

bravo to both of you.


Of course the government is “vacuuming up” every availble piece of metadata and storing it. And, of course, this includes “domestic only” metadta. Since it only becomes RELEVANT AND SUBJECT TO QUERY when and if there is a contact WITH KNOWN FOREIGN TERRORIST NUMBERS, the program does not violate the Constitution. This legal authority was reauthorized in late 2012.

In all of 2012, there were fewer than 300 queries of the billions of communications! I calculated the percentage the other day and found your are more likely to see 2 unassisted triple plays at the next baseball game than get your email queried. Every one of these queries was secured by a warrant just like your local police department gets every day. Edward Snowden is not the second coming! He’s just an ideological and naive former citizen of the greatest country on Earth.

I understand why people are upset at waking up to learn this some 33 years after these types of programs started, some people just don’t pay attention to the World around them. What I don’t understand is how anyone could think they have ABSOLUTE AND COMPLETE PRIVACY IN PUBLIC, ON THE PHONE OR ONLINE SINCE 9/11?

SeattleGuy, I feel like you’re avoiding reading anything on the topic that happened…well, at any time.  You seem to be relying entirely on the NSA’s initial denial, as if no conversation has happened since, and as if the leaked documents have somehow been proven fraudulent.

The “warrants” are dragnets (as in “all metadata on all Verizon customers for three months”), and the Congressional hearings made it clear that few in Congress knew about this, let alone intended it.  The warrants are issued by a secret court that have their own interpretation of “relevance,” as Ron Wyden has said repeatedly for years.

Contact with known foreign terrorists?  Sort of, as long as contact is defined liberally as within “three hops” (you’ve contacted someone who contacted someone who contacted a terrorist), which is an NSA statement of policy.  If everybody only knows ten people, that’s around a thousand people who might get you classified as “subject to query.”

Even the NSA has backed off on its insistence of purity.

For you to repeat it, and further to insist that your vague sense of safety requires all of us to give up our Constitutional rights…well, I’m not sure what you mean by “greatest country in the world,” if not the protections of the Constitution.  Without a respect for a country’s people or its philosophies, it’s hard to imagine what’s left.  It all makes it hard to take anything you say as anything but authoritarian damage control.

And did anybody here mention Snowden outside of mentioning him as the whistle-blower?  He’s not important, but the fact that he’s provided evidence of all these long-term rumors is.  It’s hard to stand up to something when you’re dismissed as one of the tinfoil hat crowd, but when you can show the NSA’s own data retention policy (which has been published) that says clearly that they monitor Americans until they can prove we’re definitely American, and that they monitor anyway if there’s any evidence of possible crime or secrecy…well, that’s a lot harder to hand-wave away.

How could anyone think they have privacy?  Nobody does.  We believe the Constitution prevents the government from invading that privacy, the same way it prevents the government from torturing a confession out of a suspect or censoring a newspaper’s coverage of a critical issue.  We insist the government do it’s damned job of defending the Constitution, especially when they take the following oath of office:

“I do solemnly swear (affirm) that I will support and defend the Constitution of the United States against all enemies, foreign and domestic; that I will bear true faith and allegiance to the same; that I take this obligation freely, without any mental reservation or purpose of evasion; and that I will well and faithfully discharge the duties of the office on which I am about to enter: So help me God.”

Any official who has taken this or a comparable oath of office and tells us that we need to give up Constitutionally-protected freedoms for any reason that isn’t demonstrably and immediately saving lives (i.e., taking a gun from someone who fired said gun) has violated their core promise to the population and failed at their job.  Asking them to fix it isn’t the same as imagining that it never happened; quite the contrary, in fact.

This article is part of an ongoing investigation:

Dragnets: Tracking Censorship and Surveillance

ProPublica investigates the threats to privacy in an era of cellphones, data mining and cyberwar.

Get Updates

Our Hottest Stories