The National Security Agency could use traffic shaping, rerouting Internet traffic to a location better suited for surveillance, The Century Foundation found in a report last month.
Under the Foreign Intelligence Surveillance Act (FISA), the NSA has the power to conduct surveillance abroad but can’t target U.S. citizens. The report said that the modern Internet landscape blurs the lines between spying within the United States and spying abroad.
“Internet traffic travels along the cheapest or least-congested route, not the shortest route,” said Sharon Goldberg, contributor to The Century Foundation. “It is commonplace for purely domestic communications to cross international boundaries. An email sent from San Jose to New York may be routed through Internet devices located in Frankfurt, or be backed up on computers located in Ireland.”
These rerouting methods happen automatically, without any human interaction. The report found that the NSA could take advantage of this system or shape the traffic to allow domestic messages to pass through foreign channels in order to intercept them without violating FISA law.
“Given the classified nature of the agency’s work, and even of its interpretations of the law, it is impossible to categorically determine if the NSA is currently using traffic shaping for this purpose,” Goldberg said.
The surveillance measures outlined in FISA are up for renewal in December. Many privacy advocates and members of the intelligence community have advocated for what they think the new law should look like.
“Americans’ Internet traffic should enjoy the same legal protections, regardless of whether it is intercepted on U.S. territory, or intercepted abroad,” Goldberg said. “There is evidence that indicates that if authorities have the option to collect the same Internet traffic in the United States (under FISA) or abroad (under EO 12333), they may opt to collect the traffic abroad under the more permissive EO 12333 rules.”
Goldberg said that the definition of “electronic surveillance” in the FISA law should be changed so that it is neutral on the geographic location of the traffic and type of technology used to intercept traffic.
“Congress should not miss this opportunity to consider revising FISA’s definition of ‘electronic surveillance’ in order to eliminate loopholes that allow the executive branch to unilaterally conduct surveillance of American Internet traffic,” Goldberg said. “Undertaking this revision is a crucial step toward ensuring that legislative and judiciary branches have a firm hand at protecting the privacy of American communications.”
