ABCDE www.washingtonpost.com | December 4, 2013

Online Story NSA tracking cellphone locations worldwide, Snowden documents show by Barton Gellman and Ashkan Soltani http://wapo.st/IIaYWp Copy the above URL into your web browser to view online

The is gath- amounts to a tool. ering nearly 5 billion records a day on the The NSA does not target Americans’ whereabouts of cellphones around the location data by design, but the agency ac- world, according to top-secret documents quires a substantial amount of information and interviews with U.S. intelligence of- on the whereabouts of domestic cellphones ficials, enabling the agency to track the “incidentally,” a legal term that connotes a movements of individuals — and map their foreseeable but not deliberate result. relationships — in ways that would have One senior collection manager, speak- been previously unimaginable. ing on the condition of anonymity but with The records feed a vast database that permission from the NSA, said “we are get- stores information about the locations of ting vast volumes” of location data from at least hundreds of millions of devices, ac- around the world by tapping into the cables cording to the officials and the documents, that connect mobile networks globally and which were provided by former NSA con- that serve U.S. cellphones as well as foreign tractor . New projects ones. Additionally, data are often collected created to analyze that data have provid- from the tens of millions of Americans who ed the intelligence community with what travel abroad with their cellphones every year. In scale, scope and potential impact on privacy, the efforts to collect and analyze lo- cation data may be unsurpassed among the NSA surveillance programs that have been disclosed since June. Analysts can find cell- phones anywhere in the world, retrace their movements and expose hidden relation- ships among the people using them. U.S. officials said the programs that collect and analyze location data are law- ful and intended strictly to develop intelli- gence about foreign targets. Robert Litt, general counsel for the Of- fice of the Director of National Intelligence, which oversees the NSA, said “there is no element of the intelligence community that under any authority is intentionally collect- ing bulk cellphone location information about cellphones in the United States.” The NSA has no reason to suspect that the movements of the overwhelming ma- jority of cellphone users would be relevant to national security. Rather, it collects lo- DECEMBER 4, 2013 www.washingtonpost.com PAGE 2

cations in bulk because its most powerful community has been collecting location analytic tools — known collectively as CO- data, particularly of Americans, has long TRAVELER — allow it to look for unknown concerned privacy advocates and some law- associates of known intelligence targets by makers. Three Democratic senators — Ron tracking people whose movements inter- Wyden (Ore.), Mark Udall (Colo.) and Bar- sect. bara A. Mikulski (Md.) — have introduced Still, location data, especially when an amendment to the 2014 defense spend- aggregated over time, are widely regarded ing bill that would require U.S. intelligence among privacy advocates as uniquely sen- agencies to say whether they have ever sitive. Sophisticated mathematical tech- collected or made plans to collect location niques enable NSA analysts to map cell- data for “a large number of United States phone owners’ relationships by correlating persons with no known connection to sus- their patterns of movement over time with picious activity.” thousands or millions of other phone users NSA Director Keith B. Alexander dis- who cross their paths. Cellphones broad- closed in Senate testimony in October that cast their locations even when they are not the NSA had run a pilot project in 2010 and being used to place a call or send a text 2011 to collect “samples” of U.S. cellphone message. location data. The data collected were never CO-TRAVELER and related tools re- available for intelligence analysis purposes, quire the methodical collection and stor- and the project was discontinued because it age of location data on what amounts to a had no “operational value,” he said. planetary scale. The government is track- Alexander allowed that a broader col- ing people from afar into confidential busi- lection of such data “may be something that ness meetings or personal visits to medical is a future requirement for the country, but facilities, hotel rooms, private homes and it is not right now.” other traditionally protected spaces. The number of Americans whose loca- “One of the key components of location tions are tracked as part of the NSA’s collec- data, and why it’s so sensitive, is that the tion of data overseas is impossible to deter- laws of physics don’t let you keep it private,” mine from the Snowden documents alone, said Chris Soghoian, principal technolo- and senior intelligence officials declined to gist at the American Civil Liberties Union. offer an estimate. People who value their privacy can encrypt “It’s awkward for us to try to provide their e-mails and disguise their online any specific numbers,” one intelligence of- identities, but “the only way to hide your ficial said in a telephone interview. An NSA location is to disconnect from our modern spokeswoman who took part in the call cut communication system and live in a cave.” in to say the agency has no way to calculate The NSA cannot know in advance such a figure. which tiny fraction of 1 percent of the re- An intelligence lawyer, speaking with cords it may need, so it collects and keeps his agency’s permission, said location data as many as it can — 27 terabytes, by one ac- are obtained by methods “tuned to be look- count, or more than double the text content ing outside the United States,” a formula- of the Library of Congress’s print collection. tion he repeated three times. When U.S. The location programs have brought cellphone data are collected, he said, the in such volumes of information, according data are not covered by the Fourth Amend- to a May 2012 internal NSA briefing, that ment, which protects Americans against they are “outpacing our ability to ingest, unreasonable searches and seizures. process and store” data. In the ensuing year According to top-secret briefing slides, and a half, the NSA has been transitioning the NSA pulls in location data around the to a processing system that provided it with world from 10 major “sigads,” or signals in- greater capacity. telligence activity designators. The possibility that the intelligence A sigad known as STORMBREW, for DECEMBER 4, 2013 www.washingtonpost.com PAGE 3

example, relies on two unnamed corporate able to render most efforts at communica- partners described only as ARTIFICE and tions security effectively futile. WOLFPOINT. According to an NSA site Like encryption and anonymity tools inventory, the companies administer the online, which are used by dissidents, jour- NSA’s “physical systems,” or interception nalists and terrorists alike, security-mind- equipment, and “NSA asks nicely for task- ed behavior — using disposable cellphones ing/updates.” and switching them on only long enough to STORMBREW collects data from 27 make brief calls — marks a user for special telephone links known as OPC/DPC pairs, scrutiny. CO-TRAVELER takes note, for which refer to originating and destination example, when a new telephone connects points and which typically transfer traffic to a cell tower soon after another nearby from one provider’s internal network to an- device is used for the last time. other’s. That data include cell tower identi- Side-by-side security efforts — when fiers, which can be used to locate a phone’s nearby devices power off and on together location. over time — “assist in determining whether The agency’s access to carriers’ net- co-travelers are associated . . . through be- works appears to be vast. haviorally relevant relationships,” accord- “Many shared databases, such as those ing to the 24-page white paper, which was used for roaming, are available in their developed by the NSA in partnership with complete form to any carrier who requires the National Geospatial-Intelligence Agen- access to any part of it,” said Matt Blaze, an cy, the Australian Signals Directorate and associate professor of computer and infor- private contractors. mation science at the University of Penn- A central feature of each of these tools sylvania. “This ‘flat’ trust model means that is that they do not rely on knowing a par- a surprisingly large number of entities have ticular target in advance, or even suspect- access to data about customers that they ing one. They operate on the full universe never actually do business with, and an in- of data in the NSA’s FASCIA repository, telligence agency — hostile or friendly — which stores trillions of metadata records, can get ‘one-stop shopping’ to an expansive of which a large but unknown fraction in- range of subscriber data just by compro- clude locations. mising a few carriers.” The most basic analytic tools map the Some documents in the Snowden ar- date, time, and location of cellphones to chive suggest that acquisition of U.S. loca- look for patterns or significant moments tion data is routine enough to be cited as of overlap. Other tools compute speed and an example in training materials. In an trajectory for large numbers of mobile de- October 2012 white paper on analytic tech- vices, overlaying the electronic data on niques, for example, the NSA’s counterter- transportation maps to compute the likely rorism analysis unit describes the chal- travel time and determine which devices lenges of tracking customers who use two might have intersected. different mobile networks, saying it would To solve the problem of un¬detectable be hard to correlate a user on the T-Mobile surveillance against CIA officers stationed network with one on Verizon. Asked about overseas, one contractor designed an ana- that, a U.S. intelligence official said the ex- lytic model that would carefully record the ample was poorly chosen and did not rep- case officer’s path and look for other mobile resent the program’s foreign focus. There devices in steady proximity. is no evidence that either company coop- “Results have not been validated by erates with the NSA, and both declined to operational analysts,” the report said. comment. The NSA’s capabilities to track loca- Julie Tate contributed to this report. Soltani is an tion are staggering, based on the Snowden independent security researcher and consultant. documents, and indicate that the agency is