Home » Our Work » Privacy » NSA Spying

NSA Spying FAQ

  • FAQ on NSA spying (General Questions)
  • FAQ on EFF's case against NSA (Jewel v. NSA)
  • FAQ on EFF's Case against AT&T (Hepting v. AT&T)




    • FAQ on NSA Spying (General Questions)


    What is the NSA domestic spying program?

    In October 2001, President Bush issued a secret presidential order authorizing the NSA to conduct a range of surveillance activities inside of the United States without statutory authorization or court approval, including electronic surveillance of Americans’ telephone and internet communications. This program of surveillance continues through today and works with the cooperation of major telecommunications companies.

    In 2005, after the New York Times broke the story of the surveillance program, the President publicly admitted one portion of it -- warrantless surveillance of Americans believed to be communicating with people connected with terrorism suspects -- Senior Bush Administration officials later confirmed that the President’s authorization went beyond the surveillance of terrorists and conceded that the program did not comply with the Foreign Intelligence Surveillance Act (FISA). The President, invoking a theory of limitless executive power to disregard the mandates of Congress, has reauthorized this warrantless surveillance more than thirty times, including after the Department of Justice found the program to violate criminal laws, and has indicated that he intends to continue doing so.

    Shortly after the initial revelations, a whistleblower named Mark Klein came forward with evidence describing the specific AT&T facilities, including one on Folsom Street in San Francisco, where the handoff of customer communications is occurring. Mr. Klein's evidence confirmed what was already indicated by numerous newspaper reports and Congressional admissions — that the NSA is intercepting and analyzing millions of ordinary Americans' communications, with the help of the country's largest phone and Internet companies. EFF has brought two lawsuits to stop this illegal surveillance.


    What do the cases claim about the interception of domestic communications of millions of Americans?

    The cases allege that the government, in coordination with AT&T, intercepts communications (like phone calls and emails), and that AT&T illegally discloses communications records to the government.The core component of the surveillance is the government's nationwide network of sophisticated communications surveillance equipment, attached to the key facilities of telecommunications companies such as AT&T that carry Americans' internet and telephone communications.

    Through this shadow network of surveillance devices, the government has acquired and continue to acquire the content of the phone calls, emails, instant messages, text messages and web communications, both international and domestic, of practically every American who uses the phone system or the internet in an unprecedented suspicionless general search through the nation's communications networks.


    What do the cases claim about the communications records of millions of ordinary Americans?

    The government has unlawfully solicited and obtained from telecommunications companies such as AT&T the complete and ongoing disclosure of the private telephone and internet transactional records of those companies' millions of customers, communications records indicating who the customers communicated with, when and for long, among other sensitive information. This transactional information is analyzed by computers in conjunction with the vast quantity of communications content acquired by government's network of surveillance devices, in what has been described as a vast data-mining operation.


    How do the facts in EFF's Hepting v. AT&T and Jewel v. NSA cases relate to the warrantless spying that the President has admitted?

    The cases allege that, in addition to eavesdropping on or reading specific communications that has been admitted, the government has indiscriminately intercepted the communications and obtained the communications records of millions of ordinary Americans. The government has admitted that it is engaging in more warrantless surveillance than it has specifically admitted. While we do not know for sure, one leading theory is that first the government intercepts all communications — including yours — and then targets certain communications for more in-depth analysis.


    Is EFF challenging the surveillance of communications with members of Al Qaeda?

    No. None of the plaintiffs in either EFF lawsuit, Hepting v. AT&T or Jewel v. NSA, have communicated with members of Al Qaeda. Instead, the lawsuit is about the dragnet surveillance of millions of ordinary Americans, like the plaintiffs, who have the right to go about their daily lives without the government intercepting their communications or rifling through the records of their communications.


    Does the domestic spying program produce better results than FISA?

    No. Reports have shown that the data from this wholesale surveillance did little more than commit FBI resources to follow up leads, "virtually all of [which], current and former officials say, led to dead ends or innocent Americans."

    For instance:

    "We'd chase a number, find it's a school teacher with no indication they've ever been involved in international terrorism — case closed," said one former FBI official, who was aware of the program and the data it generated for the bureau. "After you get a thousand numbers and not one is turning up anything, you get some frustration."

    — Lowell Bergman, et al, Spy Agency Data After Sept. 11 Led F.B.I. to Dead Ends, NY Times, Jan. 17, 2005.

    Wasting counter-terrorism resources on innocent school teachers makes America less free and no safer.


    What's AT&T's role in the program?

    EFF alleges that under the NSA domestic spying program, major telecommunications companies — and AT&T specifically — gave the NSA access to or information from their vast databases of communications records. This included information about their customers' calls and emails in the past, including all of those people who their customers have corresponded with. In addition, EFF alleges that AT&T gave the government unfettered access to its over 300 terabyte "Daytona" database of caller information — one of the largest databases in the world.


    Are ordinary American's communications included in the surveillance?

    Yes. The lawsuit alleges that AT&T's has provided the government with unfettered access to the communications records of ordinary Americans whose communications go through the AT&T network. This includes AT&T customers, anyone who communicates with an AT&T customer, and individuals whose messages are simply carried over AT&T's networks.


    Is the fight against warrantless spying on ordinary Americans a partisan issue?

    No. EFF is a non-partisan organization and has consistently opposed illegal surveillance efforts, regardless of which party held the presidency. Indeed, the opposition to the domestic surveillance program has come from not just Democrats, but also leading conservatives. As David Keene, chairman of the American Conservative Union said, "This is not a partisan issue; it is an issue of safeguarding the fundamental freedoms of all Americans so that future administrations do not interpret our laws in ways that pose constitutional concerns."

    Other leading conservatives who have spoken out on the domestic surveillance include:


    What is AT&T's Daytona technology?

    Daytona is a database management technology originally developed and maintained by the AT&T Laboratories division of AT&T, and used by AT&T to manage multiple databases. Daytona was designed to handle very large databases and is used to manage "Hawkeye," AT&T's call detail record (CDR) database. Daytona is also used to manage AT&T's huge network-security database, known as "Aurora." As of September 2005, all of the CDR data managed by Daytona, when uncompressed, totaled more than 312 terabytes.


    What is AT&T's Hawkeye database?

    Hawkeye is AT&T's call detail record (CDR) database, which contains records of nearly every telephone communication carried over its domestic network since approximately 2001. The records include the originating and terminating phone numbers and the time and length for each call.


    What is AT&T's Aurora database?

    Aurora is a network-security database that had been used to store Internet traffic data since approximately 2003. The Aurora database contains huge amounts of data acquired by firewalls, routers, honeypots and other devices on AT&T's global IP (Internet Protocol) network and other networks connected to AT&T's network.


    How many calls go through AT&T?

    By the end of 2004, on an average business day, AT&T Corp.'s network handled over 300 million voice calls as well as over 4,000 terabytes (million megabytes) of data. That's approximately 200 times the amount of data contained in all the books in the Library of Congress.


    Where can I read more about the NSA surveillance program?


    What is the National Security Agency?

    The National Security Agency is a United States government intelligence agency that is responsible for the collection and analysis of foreign communications. According to the NSA site, it "coordinates, directs, and performs highly specialized activities to protect U.S. government information systems and produce foreign signals intelligence information."


    What can I do to help?

    Lawsuits take a tremendous amount of time, energy, and financial resources. The only way non-profits such as EFF can afford to pursue them are through the kind and generous donations of individuals such as you. If you believe in what we are fighting for, please consider donating to support our efforts.




    FAQ on EFF's case against NSA (Jewel v. NSA)


    What is Jewel v. NSA about?

    Jewel v. NSA challenges an illegal and unconstitutional program of dragnet communications surveillance conducted by the National Security Agency (NSA) and others in concert with major telecommunications companies like AT&T.


    What is the goal of the Jewel v. NSA lawsuit?

    The most important goal is to end the illegal surveillance, and to have it declared illegal and unconstitutional. The suit also seeks to further insure against future lawbreaking by seeking an award of damages for the five individual plaintiffs--not only from the government but also from the individual government officials responsible for creating and implementing the surveillance.


    What legal claims are being raised in the Jewel v. NSA lawsuit?

    • Violation of the Fourth Amendment to the Constitution
    • Violation of the First Amendment to the Constitution
    • Unlawful electronic surveillance or disclosure or use of information obtained by electronic surveillance in violation of 50 U.S.C. §1809.
    • Unlawful interception, use or disclosure of Class communications in violation of 18 U.S.C. § 2511
    • Unlawful solicitation and obtained disclosure of the contents of communications in violation of 18 U.S.C. § 2702(a)(1) or (a)(2)
    • Unlawful solicitation and obtained disclosure of non-content records or other information in violation of 18 U.S.C. § 2702(a)(3)
    • Violation of the Administrative Procedures Act
    • Violation of the constitutional principle of separation of powers


    Who is bringing the Jewel v. NSA lawsuit?

    The lawsuit is brought by five people. The plaintiffs are ordinary Americans who all use AT&T as their communications provider, some for phone, some for internet. They bring some of their claims as individuals and others on behalf of all AT&T customers.


    Who is being sued?

    The lawsuit is against the United States government itself, a number of government agencies, as well as a number of current and former agency officials who participated in or ordered the illegal surveillance. The claims on behalf of all AT&T customers seek a declaration that the surveillance is illegal and an injunction to stop it, while the individual plaintiffs also seek damages against all the defendants (except for the President, who the courts have ruled has absolute immunity against civil damages claims). The specific defendants are the United States, the National Security Agency, the Department of Justice, President George W. Bush, Vice President Dick Cheney, Cheney's Chief of Staff David Addington, NSA Director Keith B. Alexander, CIA Director Michael V. Hayden, Attorney General Michael B. Mukasey, former Attorneys General Alberto Gonzales and John D. Ashcroft, Director of National Intelligence Michael McConnell and former DNI John Negroponte.


    Why are the individuals being sued?

    The individuals are the architects and the operators of a massive illegal domestic surveillance program. Each of them swore to uphold the law and the constitution upon taking office, and had a responsibility to defend ordinary Americans from illegal surveillance, not perpetrate it.

    Moreover, the Patriot Act made it more challenging to sue the government itself for past violations of the law, basically encouraging such suits to be brought against individual governmental officials rather than the government itself. Since the warrantless surveillance has now been going on for many years and may have changed in some ways over time, the claims against the individuals are the best way to ensure that the court rules on the legality of any past surveillance as well as ruling on the current surveillance. The damages claims against the individual government officials are only brought on behalf of the five individual plaintiffs, instead of the class.


    How is this case different from the lawsuits that are challenging the surveillance of people who are believed to be communicating with members of Al Qaeda, like the one brought by the ACLU?

    This lawsuit arises from the untargeted, warrantless surveillance of millions of ordinary Americans. The ACLU lawsuits challenge the targeted warrantless surveillance of specific individuals. Both the untargeted surveillance and the targeted surveillance are part of the same overall program. While portions of the warrantless wiretapping have been called the Terrorist Surveillance Program for public relations purposes, the government has admitted that this is not the full extent of the warrantless surveillance program authorized by the President.


    How does this case relate to the case against AT&T or any of the other cases against telecommunications carriers?

    These cases are two sides of the same coin. Jewel v. NSA is only against the government, not the telecommunications carriers. As a society built upon the rule of law, both the government and the carriers must be held responsible for the illegal program.


    Does telecom immunity affect Jewel v. NSA case?

    No. The immunity Congress passed only applies to telecommunications carriers, not the government. EFF believes that the immunity is unconstitutional and is fighting it in Hepting v. AT&T and the other telecommunications cases..


    Why didn't you sue the government until now?

    In 2006, suing AT&T looked like the fastest way to halt the illegal surveillance. Unfortunately, Congress interfered with the judicial process in our case by granting immunity to telecoms that participated in the warrantless wiretapping program. In response, we are opening up a new front in this battle. Our top priority is to stop the ongoing illegal surveillance as soon as possible, and to hold those responsible for the program to account.



    FAQ on EFF's Case Against AT&T (Hepting v. AT&T)


    What is EFF's lawsuit against AT&T, called Hepting v. AT&T, about?

    EFF filed a class-action lawsuit against AT&T, accusing the telecom giant of violating the law and the privacy of its customers by collaborating with the National Security Agency (NSA) in its massive and illegal domestic spying program to wiretap and data-mine Americans' communications.


    What is the lawsuit seeking?

    EFF, on behalf of a nationwide class of AT&T customers, is suing to stop this illegal conduct and hold AT&T responsible for its illegal collaboration in the government's domestic spying program, which has violated the law and damaged the fundamental freedoms of the American public. The lawsuit requests an injunction and damages under the statute.


    If the NSA did the illegal wiretapping and data-mining, why are you suing AT&T?

    AT&T also violated the law, and the rights of its customers, by allowing and assisting with the illegal wiretapping and data-mining. The government's spying program would not be possible without AT&T's collaboration. AT&T should have been standing up for you and your privacy. In this country, we follow the law, we don't just follow orders.

    EFF also has a case against the government, called Jewel v. NSA.


    Why has EFF brought a class action against AT&T?

    We believe that all AT&T customers have had their privacy violated by AT&T's actions. And importantly, bringing the case as a class action is the only sure way to make sure AT&T is prohibited from continuing these illegal actions. A class action ensures that an injunction against AT&T would apply throughout the country, not simply in the district in which the lawsuit was filed. Finally, we hope that the risk of serious statutory damages ($1,000 per subscriber under the ECPA and up to $10,000 per subscriber under the Telecom Act) will provide sufficient incentives for AT&T and the other telcos to push back on the feds with respect to this illegal program and in the future.


    Who exactly is the case against?

    Both AT&T Inc. and AT&T Corp. AT&T Inc. is the new name of SBC Communications, which acquired AT&T Corp. in November 2005. At closing, a wholly owned subsidiary of SBC merged with and into AT&T Corp., and thus AT&T Corp. became a wholly owned subsidiary of SBC. SBC adopted AT&T, Inc. as its name following completion of its acquisition of AT&T Corp.


    Why is the case against both AT&Ts?

    While the case focuses on the acts of AT&T Corp. (pre-merger), AT&T Inc. has begun a transition process designed to integrate the former SBC's telecommunications network with AT&T Corp.'s network, ultimately leading into unified networks. The lawsuit alleges that the facilities and technologies of the former SBC are being or will imminently be used to transmit the communications of AT&T Corp. customers, and will continue the violation of the privacy of its customers.


    If the lawsuit succeeds, will the government still be able to surveil terrorists?

    Yes. Wiretaps on terrorists are allowed under the law, and this lawsuit is not challenging the wiretap laws.

    We have sued AT&T for breaking those laws — the telecommunications giant gave the government access to its communications switches and its huge databases of information on millions of ordinary Americans.

    Those surveilled are AT&T customers who have not even been accused of affiliations with terrorists.

    Americans can be both safe and free: if the government truly believes it has cause to wiretap a suspect, it can order AT&T to provide information under FISA for up to 72 hours before going to the court. But AT&T has no business providing direct access to the communications of millions of ordinary Americans, without the checks and balances of Congress or the courts.


    How many customers did AT&T have?

    By the end of 2004, AT&T Corp. provided long distance service (including both stand-alone and bundled) to approximately 24.6 million residential customers, dropping from approximately 34.4 million customers at the end of 2003. Before the acquisition, AT&T Corp.'s bundled local and long distance service was available in 46 states, covering more than 73 million households.


    How big is the new AT&T Inc.?

    The new AT&T Inc. constitutes the largest telecommunications provider in the United States and one of the largest in the world. AT&T Inc. is the largest U.S. provider of both local and long distance services, serving millions of customers nationwide. AT&T Inc.'s international voice service carries more than 18 billion minutes per year, reaching 240 countries, linking 400 carriers and offering remote access via 19,500 points of presence in 149 countries around the globe. A point of presence is a facility where a long-distance carrier connects to a local telephone network.


    Why are the first and fourth amendments at issue for AT&T?

    Because AT&T is acting as the government's agent in the government's violation of the Bill of Rights. Accordingly, the lawsuit makes Constitutional claims in addition to alleging that AT&T violated the wiretap and telecommunications laws.


    What about telecom immunity?

    In response to the cases seeking to hold the telecoms accountable for their actions, the Bush Administration demanded that Congress give the telecoms retroactive immunity.

    In July of 2008, Congress gave in to the president's demand, passing the FISA Amendments Act (FAA). In addition to expanding the executive's spying powers, the unconstitutional law allowed the Attorney General to file a certification designed to give immunity to the telecoms, and thereby to keep the courts from ruling that the warrantless wiretapping program was illegal. EFF is challenging the immunity law as unconstitutional.


    Why are the FAA immunity provisions unconstitutional?

    The FAA unconstitutionally attempts to take the factual and legal decisionmaking away from the courts for both statutory and constitutional claims. To the extent that the FAA purports to retain the court’s role in these cases, it does so only by turning the Court, and the process of adjudication, into a shadow-play of empty gestures hidden by Executive-controlled secrecy.


    Could you be more specific?

    While a full recital of the flaws in the FAA is beyond the scope of this FAQ, many of them are readily apparent:

    1. Congress violated the separation of powers by attempting to usurp judicial authority to decide the Fourth Amendment claims of millions of ordinary Americans who have been, and continue to be, subjected to dragnet surveillance for the past 7 years;
    2. Congress exceeded its constitutional authority by passing legislation that grants to the Executive the discretion to essentially dictate the outcome of specific, pending litigation;
    3. The statute improperly requires dismissal of claims of illegal surveillance between September 11, 2001 and January 17, 2007, based not on a judicial finding about the facts of the surveillance or the legality or constitutionality of the surveillance, but instead merely based on a “certification” from the Attorney General that that some unknown member of the Executive branch told the carriers that some undescribed surveillance was “lawful”;
    4. The FAA denies due process to the plaintiffs by granting to the Executive, rather than the courts, the essential decisionmaking about their constitutional and statutory rights; and
    5. The FAA purports to grant to the Executive a unilateral right to require that the court keep secret not only the evidence, but its own decisions.

    Subscribe to EFFector

    [our free email newsletter]

    (optional)
    » EFFector Archive