Newly revealed NSA surveillance program draws support, ire

WASHINGTON — The Obama administration secretly expanded the National Security Agency's warrantless surveillance of Americans' Internet traffic, according to a news report, drawing criticism and support from cybersecurity experts.

The administration widened the NSA's surveillance in an effort to combat foreign computer hacking, The New YorkTimes reported Thursday, citing documents provided to the paper and Pro Publica by former NSA contractor Edward Snowden.

The revelations come amid a growing number of high-profile hack attacks against the government and the private sector. On Thursday, government officials revealed that hackers breached the computer system of the Office of Personnel Management, compromising the data of up to 4 million current and former federal employees.

Hackers' past targets have included the IRS, the White House, the State Department, Sony Pictures, JPMorgan Chase, Target, and Home Depot.

"Hacking is a serious national security problem and the government should be able to take steps to prevent it," said Mark Bartholomew, a professor of law and a cybersecurity expert at the University at Buffalo. "But without a clear line preventing the data obtained from monitoring international cyberthreats from being used to prosecute unrelated offenses, this kind of surveillance creep poses a serious threat to American civil liberties."

But an expert at the conservative Heritage Foundation said the NSA isn't doing anything wrong.

"Hacking is illegal," said Steve Bucci, the thinktank's director of national security programs. "If the government catches hackers in the course of doing legitimate espionage using proper authorities, that's okay."

The news sparked a call from a key senator for more limits on government surveillance just two days after President Obama signed into law the USA Freedom Act, which Congress passed to end the NSA's controversial mass collection of Americans' phone data.

"Today's report that the NSA has expanded its warrantless surveillance of Internet traffic underscores the critical importance of placing reasonable and commonsense limits on government surveillance in order to protect the privacy of Americans," said Sen. Patrick Leahy, D-Vt., the senior Democrat on the Judiciary Committee. "Congress should have an open, transparent and honest debate about how to protect both our national security and our privacy."

The NSA directive reported on by the Times stemmed from two secret memos from Justice Department lawyers in 2012, the newspaper reported. Those memos allowed the NSA to search on Internet cables without warrants and on American soil for data linked to computers hacks originating in foreign countries, the Times reports.

The surveillance described in this most recent revelation consisted of the monitoring of addresses and so-called cybersignatures, according to the Times, which it described as "patterns associated with computer intrusions," that were linked to foreign powers. Those restrictions were imposed by the Justice Department.

Despite those provisions, the documents provided by Snowden showed the NSA set out to go after hackers even if there were no proven ties to a foreign government. In 2013, Snowden revealed the NSA's program of mass phone data collection.

"The Director of National Intelligence recently described the cyber threat facing the United States as 'increasing in frequency, scale, sophistication and severity of impact,' " said Brian Hale of the Office of the Director of National Intelligence in a written statement. "Against that backdrop, it should come as no surprise that the U.S. government gathers intelligence on foreign powers that attempt to penetrate U.S. networks and steal the private information of U.S. citizens and companies. These operations play a critical role in protecting U.S. networks from disruptive, and even destructive, cyber threats."

Bartholomew said one reason for the NSA to seek authority to conduct warrantless wiretaps would be "to avoid the hassle of having to ask a court to issue a warrant."

"But also, the warrant request must be reasonable and specific, usually targeted to a defined group or individual," he said. "It sounds like this surveillance program is more of a broad dragnet, searching for patterns across a wide variety of digital chatter, instead of identifying one particular, specific suspect."

Bucci said the government doesn't need a warrant to catch hackers because the NSA is finding the criminals in a way that is incidental to its other legitimate electronic searches.

"I don't see why this should upset anybody except criminals," he said.

Hale said the "U.S. government relies on a number of lawful authorities to gather intelligence about foreign powers engaged in hostile cyber activity." He said those authorities include Section 702 of the Patriot Act.

"Section 702 provides authority to target non-U.S. persons reasonably believed to be located outside the United States in order to acquire foreign intelligence information under court oversight," Hale said. "The government cannot target anyone under the court-approved procedures unless there is an appropriate, and documented, foreign intelligence purpose. As we've publicly stated, targeting overseas individuals engaging in hostile cyber activities on behalf of a foreign power is a lawful foreign intelligence purpose. Information acquired as a result of Section 702 targeting is subject to rigorous procedures designed to safeguard the privacy not only of U.S. persons, but also of foreigners abroad, as directed by the President in January 2014."

White House spokesman Josh Earnest cited the same authority when asked about the program by USA TODAY.

"That is a tool that, again, our national security officials have found valuable in order to protect the country from a variety of threats, particularly cyber threats," Earnest said at a news conference.

Bartholomew said the NSA's expansion of warrantless surveillance of Americans' online conduct is troubling in part because of its "intentional lack of transparency."

"We still don't know exactly how and why someone may become a target of the program," he said. "Even in the middle of an increasing public awareness and resistance to government surveillance...programs like this, which have the potential to pull in dramatic amounts of digital data on American citizens, have been kept under wraps."

Bucci said he believes the story won't have lasting ramifications.

"I think this will turn out to be a big nothing-burger," he said.

Contributing: David Jackson and Gregory Korte