NSA under renewed fire after report finds it violated its own privacy rules

The NSA serially violated its own restrictions on bulk surveillance, according to a report that puts further pressure on beleaguered intelligence chief James Clapper and strengthens claims by a leading Senate critic that a "culture of misinformation" exists at the agency.

The Washington Post reported, with information provided by whistleblower Edward Snowden, that internal NSA audits found thousands of instances where the powerful surveillance agency collected, stored and possibly searched through vast swaths of information it is not permitted to acquire.

The revelations contradict repeated assurances this summer from senior Obama administration and intelligence officials that the NSA's programs to collect Americans' phone records and foreigners' communications in bulk contain adequate privacy protections.

Such inappropriate or unlawful retention ranged from what an administration official told the Post was human error, to seeming technological flaws, to collection efforts that inherently involved transgressing the few boundaries that have existed on NSA bulk collection since 2008, when Congress broadened a basic law of surveillance, the Foreign Intelligence Surveillance Act.

In one such case, an unspecified "incident" led to the retention of 3,032 files that the secret Fisa court had ordered NSA to destroy. Another involved the diversion of international communications traffic passing over through fiber-optic cables in the United States into a "repository" for temporary "processing and selection" – something that the Fisa court in 2011 ruled a violation the fourth amendment of the US constitution.

A third involved the interception of an unspecified "large number" of phone records from the Washington DC 202 area code in 2008, when an NSA "programming error" improperly entered 202 instead of 20, the country code for Egypt. The Post reported that the NSA did not report that improper interception of American communications to Congress or the Fisa court.

The overcollection revelations follow earlier disclosures by the Guardian last week that the NSA has the authority to conduct searches for Americans' identifying information in databases intended for surveillance on foreigners.

On the few occasions when intelligence officials have publicly discussed the impact their broad surveillance powers have on Americans, they have affirmed that all problems are mere accidents and are often promptly corrected.

A July 26 letter by James Clapper, the director of US national intelligence, to senator Ron Wyden, a member of the Senate intelligence committee, discussing the NSA's bulk collection of Americans phone records assured that "safeguards and controls" provide "reasonable assurance that NSA's activities are consistent with law and policy and help detect when mistakes do occur, as they inevitably do in activities this complex."

Those mistakes, Clapper continued, amounted to "a number of compliance problems that have been previously identified and detailed in reports to the court and briefings to Congress as a result of Department of Justice reviews and internal oversight. However, there have been no findings of any intentional or bad-faith violations."

Numerous intelligence and administration officials have made similar statements in congressional testimony and public speeches.

Wyden, a persistent critic of the bulk phone records collection, responded on the Senate floor that "these violations are more serious than those stated by the intelligence community, and are troubling." Wyden did not specify what he meant, citing classification restrictions, but urged senators to read NSA's secret compliance reports in designated congressional chambers.

"The violations I've touched on tonight are a lot more serious than [senators] have been told," Wyden said in his July 31 floor speech.

In an earlier speech, to the Center for American Progress, Wyden said a "culture of misinformation" exists inside the US intelligence agencies – directed not just at US adversaries, but the US legislators that are designed to oversee them and the US public in whose name they act.

"When did it become all right for government officials' public statements and private statements to differ so fundamentally?" Wyden asked. "The answer is that it is not all right, and it is indicative of a much larger culture of misinformation that goes beyond the congressional hearing room and into the public conversation writ large."

Clapper is perhaps the most prominent public example of that culture.

In March, the director of national intelligence testified to Wyden that the NSA does "not wittingly" collect any type of data on millions of Americans, a statement proven untrue by the Guardian's June publication of a Fisa court order for ongoing, bulk surveillance of Americans' phone records.

Clapper has since apologized to Wyden, saying first that it was the "least untruthful answer" he could give publicly and later that he made a good-faith error, having "forgotten" momentarily the NSA program, conducted ostensibly under the Patriot Act, that collected precisely such data.

Civil liberties organizations reacted with outrage to the latest disclosure.

"The number of 'compliance incidents' is jaw-dropping. The rules around government surveillance are so permissive that it is difficult to comprehend how the intelligence community could possibly have managed to violate them so often," Jameel Jaffer, the ACLU's deputy legal director, said in a statement.

"Obviously it's important to know what precisely these compliance incidents involved, and some are more troubling than others. But at least some of these incidents seem to have implicated the privacy of thousands or millions of innocent people."

The Post's report underscored the structural advantages the NSA possesses over the institutions that ostensibly oversee it.

The NSA is an organization that exploits a level of technical sophistication that most legislators, bureaucrats and judges do not possess. Accordingly, oversight of the NSA is frequently a matter of the NSA telling judges and lawmakers what its actions are.

Those assurances apply to the secret court that Justice Department and intelligence officials hold out as a critical, rigorous and independent check on the NSA's power.

"The FISC is forced to rely upon the accuracy of the information that is provided to the Court," the presiding judge of the Foreign Intelligence Surveillance Court, or Fisa court, told the Post.

The secret committees in Congress that the administration and the intelligence agencies portray as a check on the NSA are in a similarly subservient position.

The Post reported that Dianne Feinstein, the California Democrat who chairs the Senate intelligence committee, did not even receive a 2012 NSA "compliance" reports until the Post brought it to her attention. It is unclear if the House intelligence committee did, but that committee's leadership is under fire from their colleagues in the House for withholding critical documents about NSA bulk collection on Americans ahead of a critical vote on surveillance law.

The NSA also instructs its officials to leave out collection of Americans' data in its reports.

A training slide published by the Post says that so-called "incidental" collection – in which Americans' communications data is swooped up by the NSA's activities surveilling foreigners – "does not constitute a … violation, so it does not have to be reported in the IG [inspector general] quarterly."

Yet administration officials have publicly testified to the rigor of their notifications to Congress and the Fisa court.

"If there are any significant issues that arise with the 215 [bulk phone records] program, those would be reported to the two committees [Judiciary and Intelligence] right away," deputy attorney general James Cole testified on July 31 to the Senate judiciary committee.

"Any significant interpretations of Fisa by the court would likewise be reported to the committees under our statutory obligation to provide copies of any Fisc opinion or order that includes a significant interpretation of Fisa, along with the accompanying court documents. All of this reporting is designed to assist the two committees in performing their oversight role with respect to the program."

Private US citizens have far less access to even basic information about surveillance. When Julian Sanchez, a privacy researcher at the Cato Institute, filed a Freedom of Information Act request for a congressionally mandated NSA compliance report, he was told in September 2012 "we can neither confirm nor deny the existence of records in these files responsive to your request." Sanchez noted: "The 'existence' of the reports I asked for is required by federal law."

Feinstein and her counterpart in the House, Mike Rogers of Michigan, have vowed that their committees will conduct thorough investigations of the NSA bulk surveillance activities. Both are vocal supporters of the programs, and their inquiries come as many of their colleagues in both political parties are agitating to vastly constrain and even end some of the NSA efforts.

The Office of the Director of National Intelligence and the White House did not immediately respond to a request for comment.