WASHINGTON — After President Barack Obama delivered a speech in January endorsing changes to surveillance policies, including an end to the National Security Agency's bulk collection of Americans' domestic calling records, John Napier Tye was disillusioned.
A State Department official, Tye worked on Internet freedom issues and had top-secret clearance. He knew the Obama administration had also considered a proposal to impose what an internal White House document, obtained by The New York Times, portrayed as "significant changes" to rules for handling Americans' data the NSA collects from fiber-optic networks abroad. But Obama said nothing about that in his speech.
So in April, as Tye was leaving the State Department, he filed a whistle-blower complaint arguing that the NSA's practices abroad violated Americans' Fourth Amendment rights. He also met with staff members for the House and Senate intelligence committees. Last month, he went public with those concerns, which have attracted growing attention.
When operating abroad, the NSA can gather and use Americans' phone calls, emails, text messages and other communications under different — and sometimes more permissive — rules than when it collects them inside the United States. Much about those rules remains murky. The executive branch establishes them behind closed doors and can change them at will, with no involvement from Congress or the intelligence courts that are charged with protecting Americans' privacy.
"It's a problem if one branch of government can collect and store most Americans' communications, and write rules in secret on how to use them — all without oversight from Congress or any court, and without the consent or even the knowledge of the American people," Tye said. "Regardless of the use rules in place today, this system could be abused in the future."
Tye, 38, is speaking out as Congress considers amending the Foreign Intelligence Surveillance Act, which governs how the NSA operates domestically. The legislation resulted from the uproar over leaks by Edward J. Snowden, a former agency contractor.
But the proposed changes would not touch its abilities overseas, which are authorized by Executive Order 12333, a Reagan-era presidential directive. The administration has declassified some rules for handling Americans' messages gathered under the order, but the scope of that collection and some details about how the messages are used remain unclear.
"The debate over the last year has barely touched on the executive order," said Jameel Jaffer, an American Civil Liberties Union lawyer. "It's a black box."
The Times interviewed nearly a dozen current and former officials about EO 12333 rules for handling communications involving Americans, bringing further details to light.
By law, the NSA cannot deliberately intercept an American's messages without court permission. But it can "incidentally" collect such private communications as a consequence of its foreign surveillance.
The volume of incidental collection overseas is uncertain.
Officials, speaking on the condition of anonymity because of the
delicate nature of the topic, said the NSA has never studied the matter
and most likely could not come up with a representative sampling. Tye
called that "willful blindness."
Still, the number of Americans swept up could be sizable. As the
NSA collects content in bulk overseas from fiber-optic hubs and
satellite transmissions for later analysis, Americans' messages within
the mix can be vacuumed up. By contrast, when operating domestically
under FISA, the agency may engage only in targeted, not dragnet,
collection and storage of content.
Congress left the executive branch with a freer hand abroad
because it was once rare for Americans' communications to go overseas.
But in the Internet era, that is no longer true.
Large email companies like Google and Yahoo have built data
centers abroad, where they store backups of their users' data. Snowden
disclosed that in 2012, the NSA, working with its British counterpart,
GCHQ, penetrated links connecting the companies' overseas data centers
and collected 181.3 million records in 30 days.
