Agencia de Seguridad Nacional

La Agencia de Seguridad Nacional ( NSA ) es una agencia de inteligencia del Departamento de Defensa de los Estados Unidos , bajo la autoridad del Director de Inteligencia Nacional (DNI). La NSA es responsable de la vigilancia global, la recopilación y el procesamiento de información y datos para fines de inteligencia y contrainteligencia extranjera , especializándose en una disciplina conocida como inteligencia de señales (SIGINT). La NSA también se encarga de la protección de las redes de comunicaciones y los sistemas de información de los Estados Unidos . ^{[8] [9]} La NSA se basa en una variedad de medidas para cumplir su misión, la mayoría de las cuales son clandestinas . ^[10] La NSA tiene aproximadamente 32.000 empleados. ^[11]

Originariamente como una unidad para descifrar comunicaciones codificadas en la Segunda Guerra Mundial , fue formada oficialmente como la NSA por el presidente Harry S. Truman en 1952. Entre entonces y el final de la Guerra Fría, se convirtió en la mayor de las organizaciones de inteligencia de Estados Unidos en términos de personal y presupuesto, pero la información disponible a partir de 2013 indica que la Agencia Central de Inteligencia (CIA) se adelantó en este sentido, con un presupuesto de $ 14.7 mil millones. ^{[6] [12]} La NSA actualmente lleva a cabo una recopilación masiva de datos en todo el mundo y se sabe que ha instalado micrófonos físicos en sistemas electrónicos como un método para este fin. ^[13] También se alega que la NSA ha estado detrás de software de ataque como Stuxnet , que dañó gravemente el programa nuclear de Irán . ^{[14] [15]} La NSA, junto con la CIA, mantiene una presencia física en muchos países de todo el mundo; el Servicio de Recopilación Especial conjunto CIA/NSA (un equipo de inteligencia altamente clasificado) inserta dispositivos de escucha en objetivos de alto valor (como palacios presidenciales o embajadas). Las tácticas de recolección de datos de la SCS supuestamente incluyen "vigilancia estrecha, robo, escuchas telefónicas y allanamiento de morada". ^[16]

A diferencia de la CIA y la Agencia de Inteligencia de Defensa (DIA), ambas especializadas principalmente en espionaje humano extranjero , la NSA no realiza públicamente la recopilación de inteligencia humana . La NSA está encargada de proporcionar asistencia y la coordinación de los elementos SIGINT para otras organizaciones gubernamentales, a las que la Orden Ejecutiva les impide participar en tales actividades por su cuenta. ^[17] Como parte de estas responsabilidades, la agencia tiene una organización ubicada en el mismo lugar llamada el Servicio Central de Seguridad (CSS), que facilita la cooperación entre la NSA y otros componentes de criptoanálisis de defensa de los EE. UU . Para garantizar aún más la comunicación optimizada entre las divisiones de la comunidad de inteligencia de señales, el Director de la NSA sirve simultáneamente como Comandante del Comando Cibernético de los Estados Unidos y como Jefe del Servicio Central de Seguridad.

Las acciones de la NSA han sido motivo de controversia política en varias ocasiones, incluyendo su espionaje a los líderes que se oponían a la guerra de Vietnam y la participación de la agencia en el espionaje económico . En 2013, Edward Snowden , un ex contratista de la NSA, reveló al público muchos de sus programas secretos de vigilancia . Según los documentos filtrados, la NSA intercepta y almacena las comunicaciones de más de mil millones de personas en todo el mundo, incluidos ciudadanos de los Estados Unidos. Los documentos también revelaron que la NSA rastrea los movimientos de cientos de millones de personas utilizando metadatos de teléfonos celulares . A nivel internacional, la investigación ha señalado la capacidad de la NSA para vigilar el tráfico de Internet interno de países extranjeros a través del " enrutamiento bumerán ". ^[18]

Los orígenes de la Agencia de Seguridad Nacional se remontan al 28 de abril de 1917, tres semanas después de que el Congreso de los Estados Unidos declarara la guerra a Alemania en la Primera Guerra Mundial . Se estableció una unidad de descifrado de códigos y cifras llamada Sección de Cable y Telégrafo, que también se conocía como Oficina de Cifrado. ^[19] Tenía su sede en Washington, DC, y era parte del esfuerzo de guerra bajo el poder ejecutivo sin autorización directa del Congreso. Durante el curso de la guerra, fue reubicada en el organigrama del ejército varias veces. El 5 de julio de 1917, Herbert O. Yardley fue asignado para dirigir la unidad. En ese momento, la unidad estaba compuesta por Yardley y dos empleados civiles . Absorbió las funciones de criptoanálisis de la Armada en julio de 1918. La Primera Guerra Mundial terminó el 11 de noviembre de 1918 , y la sección criptográfica del ejército de Inteligencia Militar (MI-8) se trasladó a la ciudad de Nueva York el 20 de mayo de 1919, donde continuó las actividades de inteligencia como la Compañía de Compilación de Códigos bajo la dirección de Yardley. ^{[20] [21]}

Después de la disolución de la sección criptográfica del ejército estadounidense de inteligencia militar conocida como MI-8, el gobierno estadounidense creó la Oficina de Cifrado, también conocida como Cámara Negra , en 1919. La Cámara Negra fue la primera organización criptoanalítica en tiempos de paz de los Estados Unidos. ^[22] Financiada conjuntamente por el ejército y el Departamento de Estado, la Oficina de Cifrado se disfrazó como una empresa de códigos comerciales de la ciudad de Nueva York ; en realidad produjo y vendió dichos códigos para uso comercial. Sin embargo, su verdadera misión era romper las comunicaciones (principalmente diplomáticas) de otras naciones. En la Conferencia Naval de Washington , ayudó a los negociadores estadounidenses proporcionándoles el tráfico descifrado de muchas de las delegaciones de la conferencia, incluida la japonesa . La Cámara Negra persuadió con éxito a Western Union , la compañía de telegramas estadounidense más grande en ese momento, así como a varias otras compañías de comunicaciones, para que le dieran acceso ilegal a la Cámara Negra al tráfico de cables de embajadas y consulados extranjeros. ^[23] Pronto, estas empresas interrumpieron públicamente su colaboración.

A pesar de los éxitos iniciales de la Cámara, fue clausurada en 1929 por el Secretario de Estado de los EE. UU. Henry L. Stimson , quien defendió su decisión afirmando: "Los caballeros no leen el correo de los demás". ^[24]

Durante la Segunda Guerra Mundial , se creó el Servicio de Inteligencia de Señales (SIS) para interceptar y descifrar las comunicaciones de las potencias del Eje . ^[25] Cuando terminó la guerra, el SIS se reorganizó como la Agencia de Seguridad del Ejército (ASA), y quedó bajo el liderazgo del Director de Inteligencia Militar. ^[25]

El 20 de mayo de 1949, todas las actividades criptológicas se centralizaron bajo una organización nacional llamada Agencia de Seguridad de las Fuerzas Armadas (AFSA). ^[25] Esta organización se estableció originalmente dentro del Departamento de Defensa de los EE. UU. bajo el mando del Estado Mayor Conjunto . ^[26] La AFSA tenía la tarea de dirigir las comunicaciones del Departamento de Defensa y las actividades de inteligencia electrónica, excepto las de las unidades de inteligencia militar de los EE. UU . ^[26] Sin embargo, la AFSA no pudo centralizar la inteligencia de las comunicaciones y no logró coordinarse con las agencias civiles que compartían sus intereses, como el Departamento de Estado , la Agencia Central de Inteligencia (CIA) y el Buró Federal de Investigaciones (FBI). ^[26] En diciembre de 1951, el presidente Harry S. Truman ordenó a un panel que investigara cómo la AFSA no había logrado sus objetivos. Los resultados de la investigación llevaron a mejoras y a su redesignación como Agencia de Seguridad Nacional. ^[27]

El Consejo de Seguridad Nacional emitió un memorando el 24 de octubre de 1952 que revisaba la Directiva de Inteligencia del Consejo de Seguridad Nacional (NSCID) 9 . El mismo día, Truman emitió un segundo memorando que exigía la creación de la NSA. ^[28] La creación real de la NSA se realizó mediante un memorando del 4 de noviembre de Robert A. Lovett , el Secretario de Defensa , cambiando el nombre de la AFSA a NSA y haciendo que la nueva agencia fuera responsable de toda la inteligencia de las comunicaciones. ^[29] Dado que el memorando del presidente Truman era un documento clasificado , ^[28] la existencia de la NSA no era conocida por el público en ese momento. Debido a su ultrasecreto, la comunidad de inteligencia estadounidense se refirió a la NSA como "No Such Agency" (No existe tal agencia). ^[30]

En la década de 1960, la NSA jugó un papel clave en la expansión del compromiso de Estados Unidos con la Guerra de Vietnam al proporcionar evidencia de un ataque norvietnamita al destructor estadounidense USS  Maddox durante el incidente del Golfo de Tonkín . ^[31]

La NSA organizó una operación secreta, cuyo nombre en código era « MINARET », para vigilar las comunicaciones telefónicas de los senadores Frank Church y Howard Baker , así como de los principales líderes del movimiento por los derechos civiles , incluido Martin Luther King Jr. , y destacados periodistas y deportistas estadounidenses que criticaron la guerra de Vietnam . ^[32] Sin embargo, el proyecto resultó ser controvertido y una revisión interna de la NSA concluyó que su programa Minaret era «deshonroso, si no directamente ilegal». ^[32]

La NSA realizó un gran esfuerzo para asegurar las comunicaciones tácticas entre las fuerzas estadounidenses durante la guerra, con resultados dispares. La familia NESTOR de sistemas de voz seguros compatibles que desarrolló se implementó ampliamente durante la guerra de Vietnam , con aproximadamente 30.000 equipos NESTOR producidos. Sin embargo, una variedad de problemas técnicos y operativos limitaron su uso, lo que permitió a los norvietnamitas explotar e interceptar las comunicaciones estadounidenses. ^{[33] : Vol I, p.79}

A raíz del escándalo Watergate , una audiencia del Congreso en 1975 dirigida por el senador Frank Church ^[34] reveló que la NSA, en colaboración con la agencia de inteligencia SIGINT de Gran Bretaña, Government Communications Headquarters (GCHQ), había interceptado rutinariamente las comunicaciones internacionales de destacados líderes anti-guerra de Vietnam como Jane Fonda y el Dr. Benjamin Spock . ^[35] La NSA rastreó a estos individuos en un sistema de archivo secreto que fue destruido en 1974. ^[36] Después de la renuncia del presidente Richard Nixon , hubo varias investigaciones sobre presunto mal uso de las instalaciones del FBI, la CIA y la NSA. ^[37] El senador Frank Church descubrió actividad previamente desconocida, ^[37] como un complot de la CIA (ordenado por la administración del presidente John F. Kennedy ) para asesinar a Fidel Castro . ^[38] La investigación también descubrió las escuchas telefónicas de la NSA a ciudadanos estadounidenses seleccionados. ^[39]

Después de las audiencias del Comité Church, se aprobó la Ley de Vigilancia de Inteligencia Extranjera de 1978, diseñada para limitar la práctica de la vigilancia masiva en los Estados Unidos . ^[37]

En 1986, la NSA interceptó las comunicaciones del gobierno libio inmediatamente después del atentado en la discoteca de Berlín . La Casa Blanca afirmó que la interceptación de la NSA había proporcionado pruebas "irrefutables" de que Libia estaba detrás del atentado, lo que el presidente estadounidense Ronald Reagan citó como justificación del bombardeo estadounidense de Libia en 1986. [ ^{40] [41]}

En 1999, una investigación de varios años del Parlamento Europeo destacó el papel de la NSA en el espionaje económico en un informe titulado 'Desarrollo de la tecnología de vigilancia y riesgo de abuso de la información económica'. ^[42] Ese año, la NSA fundó el Salón de Honor de la NSA , un monumento en el Museo Criptológico Nacional en Fort Meade, Maryland. ^[43] El monumento es un "tributo a los pioneros y héroes que han hecho contribuciones significativas y duraderas a la criptología estadounidense". ^[43] Los empleados de la NSA deben estar jubilados durante más de quince años para calificar para el monumento. ^[43]

La infraestructura de la NSA se deterioró en los años 90, ya que los recortes del presupuesto de defensa dieron lugar a aplazamientos de tareas de mantenimiento. El 24 de enero de 2000, la sede de la NSA sufrió una interrupción total de la red durante tres días debido a una sobrecarga de la misma. El tráfico entrante se almacenaba con éxito en los servidores de la agencia, pero no se podía dirigir ni procesar. La agencia llevó a cabo reparaciones de emergencia con un coste de 3 millones de dólares para que el sistema volviera a funcionar (algo del tráfico entrante también se dirigía al GCHQ británico por el momento). El director Michael Hayden calificó la interrupción como una "llamada de atención" sobre la necesidad de invertir en la infraestructura de la agencia. ^[44]

En la década de 1990, el brazo defensivo de la NSA, la Dirección de Seguridad de la Información (IAD), comenzó a trabajar de manera más abierta; la primera charla técnica pública de un científico de la NSA en una conferencia importante sobre criptografía fue la presentación de J. Solinas sobre algoritmos eficientes de criptografía de curva elíptica en Crypto 1997. ^[45] El enfoque cooperativo de la IAD con la academia y la industria culminó en su apoyo a un proceso transparente para reemplazar el obsoleto Estándar de cifrado de datos (DES) por un Estándar de cifrado avanzado (AES). La experta en políticas de ciberseguridad Susan Landau atribuye la colaboración armoniosa de la NSA con la industria y la academia en la selección del AES en 2000, y el apoyo de la Agencia a la elección de un algoritmo de cifrado fuerte diseñado por europeos en lugar de estadounidenses, a Brian Snow , quien era el Director Técnico de la IAD y representó a la NSA como copresidente del Grupo de Trabajo Técnico para la competencia AES, y a Michael Jacobs, quien dirigió la IAD en ese momento. ^{[46] : 75}

Después de los ataques terroristas del 11 de septiembre de 2001 , la NSA creyó que tenía apoyo público para una expansión dramática de sus actividades de vigilancia. ^[47] Según Neal Koblitz y Alfred Menezes , el período en el que la NSA era un socio de confianza de la academia y la industria en el desarrollo de estándares criptográficos comenzó a llegar a su fin cuando, como parte del cambio en la NSA en la era posterior al 11 de septiembre, Snow fue reemplazado como Director Técnico, Jacobs se retiró y la IAD ya no pudo oponerse eficazmente a las acciones propuestas por el brazo ofensivo de la NSA. ^[48]

Tras los ataques del 11 de septiembre , la NSA creó nuevos sistemas informáticos para hacer frente a la avalancha de información procedente de nuevas tecnologías, como Internet y los teléfonos móviles. ThinThread contenía capacidades avanzadas de extracción de datos . También tenía un "mecanismo de privacidad"; la vigilancia se almacenaba cifrada; para descifrarla se necesitaba una orden judicial. La investigación realizada en el marco de este programa puede haber contribuido a la tecnología utilizada en sistemas posteriores. ThinThread se canceló cuando Michael Hayden eligió Trailblazer , que no incluía el sistema de privacidad de ThinThread. ^[49]

El proyecto Trailblazer se puso en marcha en 2002 y en él trabajaron Science Applications International Corporation (SAIC), Boeing , Computer Sciences Corporation , IBM y Litton Industries . Algunos denunciantes de la NSA se quejaron internamente de los grandes problemas que rodeaban a Trailblazer. Esto dio lugar a investigaciones por parte del Congreso y de los inspectores generales de la NSA y del Departamento de Defensa . El proyecto se canceló a principios de 2004.

Turbulence comenzó en 2005. Se desarrolló en pequeñas y económicas piezas de "prueba", en lugar de un gran plan como Trailblazer. También incluía capacidades ofensivas de guerra cibernética, como la inyección de malware en computadoras remotas. El Congreso criticó a Turbulence en 2007 por tener problemas burocráticos similares a los de Trailblazer. ^[50] Se suponía que sería la realización de un procesamiento de información a mayor velocidad en el ciberespacio. ^[51]

El enorme alcance del espionaje de la NSA, tanto en el extranjero como en el país, se reveló al público en una serie de divulgaciones detalladas de documentos internos de la NSA a partir de junio de 2013. La mayoría de las revelaciones fueron filtradas por el ex contratista de la NSA Edward Snowden . El 4 de septiembre de 2020, el programa de vigilancia de la NSA fue declarado ilegal por el Tribunal de Apelaciones de Estados Unidos . El tribunal también añadió que los líderes de inteligencia estadounidenses, que lo defendieron públicamente, no estaban diciendo la verdad. ^[52]

La misión de espionaje de la NSA incluye transmisiones de radio, tanto de organizaciones como de individuos, Internet, llamadas telefónicas y otras formas de comunicación interceptadas. Su misión de comunicaciones seguras incluye comunicaciones militares, diplomáticas y todas las demás comunicaciones gubernamentales sensibles, confidenciales o secretas. ^[53]

Según un artículo de 2010 publicado en The Washington Post , "cada día, los sistemas de recopilación de datos de la Agencia de Seguridad Nacional interceptan y almacenan 1.700 millones de correos electrónicos, llamadas telefónicas y otros tipos de comunicaciones. La NSA clasifica una fracción de ellos en 70 bases de datos independientes". ^[54]

Debido a su tarea de escucha, la NSA/CSS ha estado muy involucrada en la investigación criptoanalítica , continuando el trabajo de agencias predecesoras que habían descifrado muchos códigos y cifras de la Segunda Guerra Mundial (ver, por ejemplo, Purple , el proyecto Venona y JN-25 ).

En 2004, el Servicio de Seguridad Central de la NSA y la División Nacional de Seguridad Cibernética del Departamento de Seguridad Nacional (DHS) acordaron ampliar el Programa de Educación en Seguridad de la Información de los Centros de Excelencia Académica de la NSA. ^[55]

Como parte de la Directiva Presidencial de Seguridad Nacional 54/Directiva Presidencial de Seguridad Nacional 23 (NSPD 54), firmada el 8 de enero de 2008 por el Presidente Bush, la NSA se convirtió en la agencia líder para monitorear y proteger todas las redes informáticas del gobierno federal del ciberterrorismo . ^[9]

Una parte de la misión de la NSA es servir como agencia de apoyo de combate para el Departamento de Defensa. ^[56]

Las operaciones de la Agencia de Seguridad Nacional se pueden dividir en tres tipos:

• Recolección en el extranjero, que está bajo la responsabilidad de la división Global Access Operations (GAO).
• Recolección doméstica, que es responsabilidad de la división de Operaciones de Fuentes Especiales (SSO).
• Operaciones de piratería, que son responsabilidad de la división Tailored Access Operations (TAO).

"Echelon" fue creado en la incubadora de la Guerra Fría . ^[57] Hoy es un sistema heredado , y varias estaciones de la NSA están cerrando. ^[58]

Se informó que la NSA/CSS, en combinación con las agencias equivalentes en el Reino Unido ( Government Communications Headquarters ), Canadá ( Communications Security Establishment ), Australia ( Australian Signals Directorate ) y Nueva Zelanda ( Government Communications Security Bureau ), también conocida como el grupo UKUSA , ^[59] estaba al mando de la operación del llamado sistema ECHELON . Se sospechaba que sus capacidades incluían la capacidad de monitorear una gran proporción del tráfico de teléfono, fax y datos civiles transmitidos en el mundo. ^[60]

A principios de los años 1970, se instaló en Menwith Hill la primera de las más de ocho grandes antenas parabólicas de comunicaciones. ^[61] El periodista de investigación Duncan Campbell informó en 1988 sobre el programa de vigilancia " ECHELON ", una extensión del Acuerdo UKUSA sobre inteligencia de señales globales (SIGINT) , y detalló cómo funcionaban las operaciones de espionaje. ^[62] El 3 de noviembre de 1999, la BBC informó que tenían confirmación del Gobierno australiano de la existencia de una poderosa "red de espionaje global" con el nombre en código Echelon, que podía "espiar cada llamada telefónica, fax o correo electrónico, en cualquier lugar del planeta" con Gran Bretaña y Estados Unidos como principales protagonistas. Confirmaron que Menwith Hill estaba "vinculado directamente a la sede de la Agencia de Seguridad Nacional de Estados Unidos (NSA) en Fort Meade en Maryland". ^[63]

La Directiva de Inteligencia de Señales de los Estados Unidos 18 (USSID 18) de la NSA prohibía estrictamente la interceptación o recopilación de información sobre "... personas , entidades, corporaciones u organizaciones estadounidenses..." sin el permiso legal explícito por escrito del Fiscal General de los Estados Unidos cuando el sujeto se encuentra en el extranjero, o del Tribunal de Vigilancia de Inteligencia Extranjera cuando se encuentra dentro de las fronteras de los Estados Unidos. Las supuestas actividades relacionadas con Echelon, incluido su uso por motivos distintos a la seguridad nacional, incluido el espionaje político e industrial , recibieron críticas de países fuera de la alianza UKUSA. ^[64]

La NSA también participó en la planificación de chantajear a personas con " SEXINT ", información obtenida sobre la actividad y preferencias sexuales de un objetivo potencial. Los objetivos no habían cometido ningún delito aparente ni estaban acusados ​​de ninguno. ^[65]

Para apoyar su programa de reconocimiento facial , la NSA está interceptando "millones de imágenes por día". ^[66]

El Real Time Regional Gateway es un programa de recopilación de datos introducido en 2005 en Irak por la NSA durante la guerra de Irak que consistía en reunir todas las comunicaciones electrónicas, almacenarlas, buscarlas y analizarlas. Fue eficaz para proporcionar información sobre los insurgentes iraquíes que habían eludido técnicas menos exhaustivas. ^[67] Glenn Greenwald de The Guardian cree que esta estrategia de "recopilarlo todo" introducida por el director de la NSA, Keith B. Alexander , es el modelo para el archivo masivo y exhaustivo de comunicaciones a nivel mundial en el que participa la NSA desde 2013. ^[68]

Una unidad especializada de la NSA localiza objetivos para la CIA con fines de asesinato extrajudicial en Oriente Medio. ^[69] La NSA también ha espiado ampliamente a la Unión Europea, las Naciones Unidas y numerosos gobiernos, incluidos aliados y socios comerciales en Europa, Sudamérica y Asia. ^{[70] [71]}

En junio de 2015, WikiLeaks publicó documentos que mostraban que la NSA espiaba a empresas francesas . ^[72]

En julio de 2015, WikiLeaks publicó documentos que mostraban que la NSA había espiado a los ministerios federales alemanes desde los años 1990. ^{[73] [74]} Incluso los teléfonos móviles de la canciller alemana, Angela Merkel, y los de sus predecesores habían sido interceptados. ^[75]

Edward Snowden reveló en junio de 2013 que entre el 8 de febrero y el 8 de marzo de 2013, la NSA recopiló alrededor de 124.800 millones de elementos de datos telefónicos y 97.100 millones de elementos de datos informáticos en todo el mundo, como se muestra en los gráficos de una herramienta interna de la NSA con el nombre en código Boundless Informant . Inicialmente, se informó de que algunos de estos datos reflejaban escuchas clandestinas a ciudadanos de países como Alemania, España y Francia, ^[76] pero más tarde, quedó claro que esos datos fueron recopilados por agencias europeas durante misiones militares en el extranjero y posteriormente fueron compartidos con la NSA.

En 2013, los periodistas descubrieron un memorando secreto que afirma que la NSA creó e impulsó la adopción del estándar de cifrado Dual EC DRBG que contenía vulnerabilidades integradas en 2006 ante el Instituto Nacional de Estándares y Tecnología de los Estados Unidos (NIST) y la Organización Internacional de Normalización (también conocida como ISO). ^{[77] [78]} Este memorando parece dar crédito a especulaciones previas de los criptógrafos de Microsoft Research . ^[79] Edward Snowden afirma que la NSA a menudo elude el cifrado por completo al levantar información antes de que se cifre o después de que se descifre. ^[78]

Las reglas de XKeyscore (como se especifica en un archivo xkeyscorerules100.txt, obtenido por las estaciones de televisión alemanas NDR y WDR , que afirman tener extractos de su código fuente) revelan que la NSA rastrea a los usuarios de herramientas de software que mejoran la privacidad, incluido Tor ; un servicio de correo electrónico anónimo proporcionado por el Laboratorio de Ciencias de la Computación e Inteligencia Artificial del MIT (CSAIL) en Cambridge, Massachusetts; y los lectores del Linux Journal . ^{[80] [81]}

Linus Torvalds , el fundador del kernel de Linux , bromeó durante una conferencia de LinuxCon el 18 de septiembre de 2013, diciendo que la NSA, que es la fundadora de SELinux , quería una puerta trasera en el kernel. ^[82] Sin embargo, más tarde, el padre de Linus, un miembro del Parlamento Europeo (MEP), reveló que la NSA en realidad hizo esto. ^[83]

Cuando a mi hijo mayor le hicieron la misma pregunta: "¿La NSA se ha puesto en contacto con él para hablar de puertas traseras?", dijo "No", pero al mismo tiempo asintió. Entonces se encontró en una especie de libertad legal. Había dado la respuesta correcta, todo el mundo comprendió que la NSA se había puesto en contacto con él.

—  Nils Torvalds , Comisión de Investigación de la LIBE sobre vigilancia electrónica masiva de ciudadanos de la UE – 11.ª audiencia, 11 de noviembre de 2013 ^[84]

IBM Notes fue el primer producto de software ampliamente adoptado que utiliza criptografía de clave pública para la autenticación cliente-servidor y servidor-servidor y para el cifrado de datos. Hasta que las leyes estadounidenses que regulaban el cifrado se cambiaron en 2000, IBM y Lotus tenían prohibido exportar versiones de Notes que admitieran claves de cifrado simétrico de más de 40 bits. En 1997, Lotus negoció un acuerdo con la NSA que permitía la exportación de una versión que admitiera claves más fuertes con 64 bits, pero 24 de los bits estaban cifrados con una clave especial e incluidos en el mensaje para proporcionar un "factor de reducción de carga de trabajo" para la NSA. Esto reforzó la protección de los usuarios de Notes fuera de los EE. UU. contra el espionaje industrial del sector privado , pero no contra el espionaje del gobierno estadounidense. ^{[85] [86]}

Aunque se supone que las transmisiones extranjeras que terminan en los EE. UU. (como un ciudadano no estadounidense que accede a un sitio web estadounidense) someten a los ciudadanos no estadounidenses a la vigilancia de la NSA, investigaciones recientes sobre el enrutamiento boomerang han suscitado nuevas preocupaciones sobre la capacidad de la NSA para vigilar el tráfico de Internet interno de países extranjeros. ^[18] El enrutamiento boomerang se produce cuando una transmisión de Internet que se origina y termina en un solo país transita por otro. Las investigaciones de la Universidad de Toronto han sugerido que aproximadamente el 25% del tráfico interno canadiense puede estar sujeto a actividades de vigilancia de la NSA como resultado del enrutamiento boomerang de los proveedores de servicios de Internet canadienses . ^[18]

Un documento incluido en los archivos de la NSA publicados con el libro No Place to Hide de Glenn Greenwald detalla cómo las Operaciones de Acceso a Medida (TAO, por sus siglas en inglés) de la agencia y otras unidades de la NSA obtienen acceso al hardware. Interceptan enrutadores , servidores y otro hardware de red que se envía a organizaciones que son objeto de vigilancia e instalan en ellos un firmware de implante encubierto antes de que se entreguen. Esto fue descrito por un gerente de la NSA como "una de las operaciones más productivas en TAO porque preposicionan puntos de acceso en redes de objetivos difíciles en todo el mundo". ^[87]

Los ordenadores que la NSA incauta para fines de interceptación suelen estar modificados con un dispositivo físico conocido como Cottonmouth. ^[88] Cottonmouth es un dispositivo que se puede insertar en el puerto USB de un ordenador para establecer acceso remoto al equipo en cuestión. Según el catálogo de implantes del grupo Tailored Access Operations (TAO) de la NSA, después de implantar Cottonmouth, la NSA puede establecer un puente de red "que le permite cargar software de explotación en ordenadores modificados, así como transmitir comandos y datos entre implantes de hardware y software". ^[89]

La misión de la NSA, tal como se establece en la Orden Ejecutiva 12333 de 1981, es recopilar información que constituya "inteligencia o contrainteligencia extranjera", pero no "obtener información sobre las actividades internas de personas de los Estados Unidos ". La NSA ha declarado que confía en el FBI para recopilar información sobre actividades de inteligencia extranjera dentro de las fronteras de los Estados Unidos, mientras que limita sus propias actividades dentro de los Estados Unidos a las embajadas y misiones de naciones extranjeras. ^[90]

La aparición de una "Dirección de Vigilancia Nacional" de la NSA pronto fue expuesta como un engaño en 2013. ^{[91] [92]}

Las actividades de vigilancia interna de la NSA están limitadas por los requisitos impuestos por la Cuarta Enmienda de la Constitución de los Estados Unidos . Por ejemplo, el Tribunal de Vigilancia de Inteligencia Extranjera sostuvo en octubre de 2011, citando múltiples precedentes de la Corte Suprema, que las prohibiciones de la Cuarta Enmienda contra registros e incautaciones irrazonables se aplican al contenido de todas las comunicaciones, cualquiera sea el medio, porque "las comunicaciones privadas de una persona son similares a los documentos personales". ^[93] Sin embargo, estas protecciones no se aplican a las personas no estadounidenses ubicadas fuera de las fronteras de los Estados Unidos, por lo que las iniciativas de vigilancia extranjera de la NSA están sujetas a muchas menos limitaciones bajo la ley estadounidense. ^[94] Los requisitos específicos para las operaciones de vigilancia interna están contenidos en la Ley de Vigilancia de Inteligencia Extranjera de 1978 (FISA), que no extiende la protección a los ciudadanos no estadounidenses ubicados fuera del territorio estadounidense . ^[94]

George W. Bush , presidente durante los ataques terroristas del 11 de septiembre , aprobó la Ley Patriota poco después de los ataques para tomar medidas de seguridad antiterroristas. Los títulos 1 , 2 y 9 autorizaban específicamente las medidas que tomaría la NSA. Estos títulos otorgaban una mayor seguridad interna contra el terrorismo, procedimientos de vigilancia y una mejor inteligencia, respectivamente. El 10 de marzo de 2004, hubo un debate entre el presidente Bush y el abogado de la Casa Blanca Alberto Gonzales , el fiscal general John Ashcroft y el fiscal general interino James Comey . Los fiscales generales no estaban seguros de si los programas de la NSA podían considerarse constitucionales. Amenazaron con dimitir por el asunto, pero finalmente los programas de la NSA continuaron. ^[95] El 11 de marzo de 2004, el presidente Bush firmó una nueva autorización para la vigilancia masiva de registros de Internet, además de la vigilancia de registros telefónicos. Esto permitió al presidente poder anular leyes como la Ley de Vigilancia de Inteligencia Extranjera , que protegía a los civiles de la vigilancia masiva. Además de esto, el Presidente Bush también firmó que las medidas de vigilancia masiva también entrarían en vigor de forma retroactiva. ^{[96] [97]}

Uno de esos programas de vigilancia, autorizado por la Directiva de Inteligencia de Señales de los Estados Unidos 18 del presidente George Bush, fue el Proyecto Highlander llevado a cabo para la Agencia de Seguridad Nacional por la 513.ª Brigada de Inteligencia Militar del Ejército de los Estados Unidos . La NSA transmitió conversaciones telefónicas (incluso de teléfonos celulares) obtenidas desde estaciones de monitoreo terrestres, aéreas y satelitales a varios Oficiales de Inteligencia de Señales del Ejército de los Estados Unidos, incluido el 201.º Batallón de Inteligencia Militar . Se interceptaron conversaciones de ciudadanos de los Estados Unidos, junto con las de otras naciones. ^[98]

Los defensores del programa de vigilancia sostienen que el Presidente tiene autoridad ejecutiva para ordenar tales acciones ^{[ cita requerida ]} , argumentando que leyes como la FISA quedan anuladas por los poderes constitucionales del Presidente. Además, algunos argumentaron que la FISA fue implícitamente anulada por una ley posterior, la Autorización para el Uso de la Fuerza Militar , aunque el fallo de la Corte Suprema en Hamdan v. Rumsfeld desaprueba esta opinión. ^[99]

En el marco del programa PRISM , que comenzó en 2007, ^{[100] [101]} la NSA recopila comunicaciones de Internet de objetivos extranjeros de nueve importantes proveedores de servicios de comunicación basados ​​en Internet de Estados Unidos: Microsoft , ^[102] Yahoo , Google , Facebook , PalTalk , AOL , Skype , YouTube y Apple . Los datos recopilados incluyen correo electrónico, vídeos, fotos, chats de VoIP como Skype y transferencias de archivos.

El ex director de la NSA, el general Keith Alexander, afirmó que en septiembre de 2009 la NSA impidió que Najibullah Zazi y sus amigos llevaran a cabo un ataque terrorista. ^[103] Sin embargo, no se ha presentado ninguna prueba que demuestre que la NSA haya contribuido alguna vez a prevenir un ataque terrorista. ^{[104] [105] [106] [107]}

FASCIA es una base de datos creada y utilizada por la Agencia de Seguridad Nacional de los Estados Unidos que contiene billones de registros de ubicación de dispositivos que se recopilan de una variedad de fuentes. ^{[108] Su existencia fue revelada durante la} divulgación de vigilancia global de 2013 por Edward Snowden . ^[109]

La base de datos FASCIA almacena varios tipos de información, incluidos códigos de área de ubicación (LAC), identificadores de torres de telefonía celular (CeLLID), registros de ubicación de visitantes (VLR), identidad de equipo de estación móvil internacional (IMEI) y MSISDN (números de red digital de servicios integrados de abonado móvil). ^{[108] [109]}

Durante un período de aproximadamente siete meses, se recopilaron y almacenaron en la base de datos más de 27 terabytes de datos de ubicación. ^[110]

Además de las formas más tradicionales de espionaje para recopilar señales de inteligencia, la NSA también participa en el pirateo de ordenadores, teléfonos inteligentes y sus redes. Una división que lleva a cabo este tipo de operaciones es la división Tailored Access Operations (TAO), que lleva activa al menos desde 1998. ^[111]

Según la revista Foreign Policy , "... la Oficina de Operaciones de Acceso Personalizado, u OAT, ha penetrado con éxito los sistemas informáticos y de telecomunicaciones chinos durante casi 15 años, generando parte de la mejor y más fiable información de inteligencia sobre lo que está sucediendo dentro de la República Popular China". ^{[112] [113]}

En una entrevista con la revista Wired , Edward Snowden dijo que la división Tailored Access Operations causó accidentalmente el apagón de Internet en Siria en 2012. ^[114]

La NSA está dirigida por el Director de la Agencia de Seguridad Nacional (DIRNSA), que también se desempeña como Jefe del Servicio Central de Seguridad (CHCSS) y Comandante del Comando Cibernético de los Estados Unidos (USCYBERCOM) y es el oficial militar de mayor rango de estas organizaciones. Cuenta con la asistencia de un Director Adjunto , que es el civil de mayor rango dentro de la NSA/CSS.

La NSA también tiene un Inspector General , jefe de la Oficina del Inspector General (OIG); ^[115] un Asesor General , jefe de la Oficina del Asesor General (OGC); y un Director de Cumplimiento, jefe de la Oficina del Director de Cumplimiento (ODOC). ^[116]

A diferencia de otras organizaciones de inteligencia como la CIA o la DIA , la NSA siempre ha sido particularmente reticente respecto de su estructura organizativa interna. ^{[ cita requerida ]}

A mediados de la década de 1990, la Agencia de Seguridad Nacional estaba organizada en cinco Direcciones:

• La Dirección de Operaciones, que era responsable de la recopilación y procesamiento de SIGINT.
• La Dirección de Tecnología y Sistemas, que desarrolla nuevas tecnologías para la recolección y procesamiento de SIGINT.
• La Dirección de Seguridad de los Sistemas de Información, responsable de las misiones de seguridad de la información y las comunicaciones de la NSA .
• La Dirección de Planes, Políticas y Programas, que proporcionó apoyo de personal y dirección general a la Agencia.
• La Dirección de Servicios de Apoyo, que prestaba actividades de apoyo logístico y administrativo. ^[117]

Cada una de estas direcciones estaba formada por varios grupos o elementos, designados con una letra. Por ejemplo, existía el Grupo A, que era responsable de todas las operaciones SIGINT contra la Unión Soviética y Europa del Este, y el Grupo G, que era responsable de la SIGINT relacionada con todos los países no comunistas. Estos grupos se dividían en unidades designadas con un número adicional, como la unidad A5 para descifrar códigos soviéticos, y la G6, que era la oficina para Oriente Medio, el norte de África, Cuba, América Central y del Sur. ^{[118] [119]}

A partir de 2013 ^[update], la NSA tiene alrededor de una docena de direcciones, que se designan mediante una carta, aunque no todas son conocidas públicamente. ^[120]

In the year 2000, a leadership team was formed consisting of the director, the deputy director and the directors of the Signals Intelligence (SID), the Information Assurance (IAD) and the Technical Directorate (TD). The chiefs of other main NSA divisions became associate directors of the senior leadership team.^[121]

After president George W. Bush initiated the President's Surveillance Program (PSP) in 2001, the NSA created a 24-hour Metadata Analysis Center (MAC), followed in 2004 by the Advanced Analysis Division (AAD), with the mission of analyzing content, Internet metadata and telephone metadata. Both units were part of the Signals Intelligence Directorate.^[122]

A 2016 proposal would combine the Signals Intelligence Directorate with the Information Assurance Directorate into a Directorate of Operations.^[123]

NSANet stands for National Security Agency Network and is the official NSA intranet.^[124] It is a classified network,^[125] for information up to the level of TS/SCI^[126] to support the use and sharing of intelligence data between NSA and the signals intelligence agencies of the four other nations of the Five Eyes partnership. The management of NSANet has been delegated to the Central Security Service Texas (CSSTEXAS).^[127]

NSANet is a highly secured computer network consisting of fiber-optic and satellite communication channels which are almost completely separated from the public Internet. The network allows NSA personnel and civilian and military intelligence analysts anywhere in the world to have access to the agency's systems and databases. This access is tightly controlled and monitored. For example, every keystroke is logged, activities are audited at random and downloading and printing of documents from NSANet are recorded.^[128]

In 1998, NSANet, along with NIPRNet and SIPRNet, had "significant problems with poor search capabilities, unorganized data and old information".^[129] In 2004, the network was reported to have used over twenty commercial off-the-shelf operating systems.^[130] Some universities that do highly sensitive research are allowed to connect to it.^[131]

The thousands of Top Secret internal NSA documents that were taken by Edward Snowden in 2013 were stored in "a file-sharing location on the NSA's intranet site"; so, they could easily be read online by NSA personnel. Everyone with a TS/SCI-clearance had access to these documents. As a system administrator, Snowden was responsible for moving accidentally misplaced highly sensitive documents to safer storage locations.^[132]

The NSA maintains at least two watch centers:

• National Security Operations Center (NSOC), which is the NSA's current operations center and focal point for time-sensitive SIGINT reporting for the United States SIGINT System (USSS). This center was established in 1968 as the National SIGINT Watch Center (NSWC) and renamed into National SIGINT Operations Center (NSOC) in 1973. This "nerve center of the NSA" got its current name in 1996.^{[citation needed]}
• NSA/CSS Threat Operations Center (NTOC), which is the primary NSA/CSS partner for Department of Homeland Security response to cyber incidents. The NTOC establishes real-time network awareness and threat characterization capabilities to forecast, alert, and attribute malicious activity and enable the coordination of Computer Network Operations. The NTOC was established in 2004 as a joint Information Assurance and Signals Intelligence project.^[133]

The NSA has its own police force, known as NSA Police (and formerly as NSA Security Protective Force) which provides law enforcement services, emergency response and physical security to the NSA's people and property.^[134]

NSA Police are armed federal officers. NSA Police has a K9 division, which generally conducts explosive detection screening of mail, vehicles and cargo entering NSA grounds.^[135]

NSA Police use marked vehicles to carry out patrols.^[136]

The number of NSA employees is officially classified^[4] but there are several sources providing estimates. In 1961, NSA had 59,000 military and civilian employees, which grew to 93,067 in 1969, of which 19,300 worked at the headquarters at Fort Meade. In the early 1980s, NSA had roughly 50,000 military and civilian personnel. By 1989 this number had grown again to 75,000, of which 25,000 worked at the NSA headquarters. Between 1990 and 1995 the NSA's budget and workforce were cut by one third, which led to a substantial loss of experience.^[137]

In 2012, the NSA said more than 30,000 employees worked at Fort Meade and other facilities.^[2] In 2012, John C. Inglis, the deputy director, said that the total number of NSA employees is "somewhere between 37,000 and one billion" as a joke,^[4] and stated that the agency is "probably the biggest employer of introverts."^[4] In 2013 Der Spiegel stated that the NSA had 40,000 employees.^[5] More widely, it has been described as the world's largest single employer of mathematicians.^[138] Some NSA employees form part of the workforce of the National Reconnaissance Office (NRO), the agency that provides the NSA with satellite signals intelligence.

As of 2013 about 1,000 system administrators work for the NSA.^[139]

The NSA received criticism early on in 1960 after two agents had defected to the Soviet Union. Investigations by the House Un-American Activities Committee and a special subcommittee of the United States House Committee on Armed Services revealed severe cases of ignorance in personnel security regulations, prompting the former personnel director and the director of security to step down and leading to the adoption of stricter security practices.^[140] Nonetheless, security breaches reoccurred only a year later when in an issue of Izvestia of July 23, 1963, a former NSA employee published several cryptologic secrets.

The very same day, an NSA clerk-messenger committed suicide as ongoing investigations disclosed that he had sold secret information to the Soviets on a regular basis. The reluctance of congressional houses to look into these affairs had prompted a journalist to write, "If a similar series of tragic blunders occurred in any ordinary agency of Government an aroused public would insist that those responsible be officially censured, demoted, or fired." David Kahn criticized the NSA's tactics of concealing its doings as smug and the Congress' blind faith in the agency's right-doing as shortsighted, and pointed out the necessity of surveillance by the Congress to prevent abuse of power.^[140]

Edward Snowden's leaking of the existence of PRISM in 2013 caused the NSA to institute a "two-man rule", where two system administrators are required to be present when one accesses certain sensitive information.^[139] Snowden claims he suggested such a rule in 2009.^[141]

The NSA conducts polygraph tests of employees. For new employees, the tests are meant to discover enemy spies who are applying to the NSA and to uncover any information that could make an applicant pliant to coercion.^[142] As part of the latter, historically EPQs or "embarrassing personal questions" about sexual behavior had been included in the NSA polygraph.^[142] The NSA also conducts five-year periodic reinvestigation polygraphs of employees, focusing on counterintelligence programs. In addition the NSA conducts periodic polygraph investigations in order to find spies and leakers; those who refuse to take them may receive "termination of employment", according to a 1982 memorandum from the director of the NSA.^[143]

There are also "special access examination" polygraphs for employees who wish to work in highly sensitive areas, and those polygraphs cover counterintelligence questions and some questions about behavior.^[143] NSA's brochure states that the average test length is between two and four hours.^[144] A 1983 report of the Office of Technology Assessment stated that "It appears that the NSA [National Security Agency] (and possibly CIA) use the polygraph not to determine deception or truthfulness per se, but as a technique of interrogation to encourage admissions."^[145] Sometimes applicants in the polygraph process confess to committing felonies such as murder, rape, and selling of illegal drugs. Between 1974 and 1979, of the 20,511 job applicants who took polygraph tests, 695 (3.4%) confessed to previous felony crimes; almost all of those crimes had been undetected.^[142]

In 2010 the NSA produced a video explaining its polygraph process.^[146] The video, ten minutes long, is titled "The Truth About the Polygraph" and was posted to the Web site of the Defense Security Service. Jeff Stein of The Washington Post said that the video portrays "various applicants, or actors playing them—it's not clear—describing everything bad they had heard about the test, the implication being that none of it is true."^[147] AntiPolygraph.org argues that the NSA-produced video omits some information about the polygraph process; it produced a video responding to the NSA video.^[146][148] George Maschke, the founder of the Web site, accused the NSA polygraph video of being "Orwellian".^[147]

A 2013 article indicated that after Edward Snowden revealed his identity in 2013, the NSA began requiring polygraphing of employees once per quarter.^[149]

The number of exemptions from legal requirements has been criticized. When in 1964 Congress was hearing a bill giving the director of the NSA the power to fire at will any employee, The Washington Post wrote: "This is the very definition of arbitrariness. It means that an employee could be discharged and disgraced on the basis of anonymous allegations without the slightest opportunity to defend himself." Yet, the bill was accepted by an overwhelming majority.^[140] Also, every person hired to a job in the US after 2007, at any private organization, state or federal government agency, must be reported to the New Hire Registry, ostensibly to look for child support evaders, except that employees of an intelligence agency may be excluded from reporting if the director deems it necessary for national security reasons.^[150]

When the agency was first established, its headquarters and cryptographic center were in the Naval Security Station in Washington, D.C. The COMINT functions were located in Arlington Hall in Northern Virginia, which served as the headquarters of the U.S. Army's cryptographic operations.^[151] Because the Soviet Union had detonated a nuclear bomb and because the facilities were crowded, the federal government wanted to move several agencies, including the AFSA/NSA. A planning committee considered Fort Knox, but Fort Meade, Maryland, was ultimately chosen as NSA headquarters because it was far enough away from Washington, D.C. in case of a nuclear strike and was close enough so its employees would not have to move their families.^[152]

Construction of additional buildings began after the agency occupied buildings at Fort Meade in the late 1950s, which they soon outgrew.^[152] In 1963 the new headquarters building, nine stories tall, opened. NSA workers referred to the building as the "Headquarters Building" and since the NSA management occupied the top floor, workers used "Ninth Floor" to refer to their leaders.^[153] COMSEC remained in Washington, D.C., until its new building was completed in 1968.^[152] In September 1986, the Operations 2A and 2B buildings, both copper-shielded to prevent eavesdropping, opened with a dedication by President Ronald Reagan.^[154] The four NSA buildings became known as the "Big Four."^[154] The NSA director moved to 2B when it opened.^[154]

Headquarters for the National Security Agency is located at 39°6′32″N 76°46′17″W / 39.10889°N 76.77139°W / 39.10889; -76.77139 in Fort George G. Meade, Maryland, although it is separate from other compounds and agencies that are based within this same military installation. Fort Meade is about 20 mi (32 km) southwest of Baltimore,^[155] and 25 mi (40 km) northeast of Washington, D.C.^[156] The NSA has two dedicated exits off Baltimore–Washington Parkway. The Eastbound exit from the Parkway (heading toward Baltimore) is open to the public and provides employee access to its main campus and public access to the National Cryptology Museum. The Westbound side exit, (heading toward Washington) is labeled "NSA Employees Only".^[157][158] The exit may only be used by people with the proper clearances, and security vehicles parked along the road guard the entrance.^[159]

NSA is the largest employer in the state of Maryland, and two-thirds of its personnel work at Fort Meade.^[160] Built on 350 acres (140 ha; 0.55 sq mi)^[161] of Fort Meade's 5,000 acres (2,000 ha; 7.8 sq mi),^[162] the site has 1,300 buildings and an estimated 18,000 parking spaces.^[156][163]

The main NSA headquarters and operations building is what James Bamford, author of Body of Secrets, describes as "a modern boxy structure" that appears similar to "any stylish office building."^[164] The building is covered with one-way dark glass, which is lined with copper shielding in order to prevent espionage by trapping in signals and sounds.^[164] It contains 3,000,000 square feet (280,000 m²), or more than 68 acres (28 ha), of floor space; Bamford said that the U.S. Capitol "could easily fit inside it four times over."^[164]

The facility has over 100 watchposts,^[165] one of them being the visitor control center, a two-story area that serves as the entrance.^[164] At the entrance, a white pentagonal structure,^[166] visitor badges are issued to visitors and security clearances of employees are checked.^[167] The visitor center includes a painting of the NSA seal.^[166]

The OPS2A building, the tallest building in the NSA complex and the location of much of the agency's operations directorate, is accessible from the visitor center. Bamford described it as a "dark glass Rubik's Cube".^[168] The facility's "red corridor" houses non-security operations such as concessions and the drug store. The name refers to the "red badge" which is worn by someone without a security clearance. The NSA headquarters includes a cafeteria, a credit union, ticket counters for airlines and entertainment, a barbershop, and a bank.^[166] NSA headquarters has its own post office, fire department, and police force.^{[169][170][171]}

The employees at the NSA headquarters reside in various places in the Baltimore-Washington area, including Annapolis, Baltimore, and Columbia in Maryland and the District of Columbia, including the Georgetown community.^[172] The NSA maintains a shuttle service from the Odenton station of MARC to its Visitor Control Center and has done so since 2005.^[173]

Following a major power outage in 2000, in 2003, and in follow-ups through 2007, The Baltimore Sun reported that the NSA was at risk of electrical overload because of insufficient internal electrical infrastructure at Fort Meade to support the amount of equipment being installed. This problem was apparently recognized in the 1990s but not made a priority, and "now the agency's ability to keep its operations going is threatened."^[174]

On August 6, 2006, The Baltimore Sun reported that the NSA had completely maxed out the grid, and that Baltimore Gas & Electric (BGE, now Constellation Energy) was unable to sell them any more power.^[175] NSA decided to move some of its operations to a new satellite facility.

BGE provided NSA with 65 to 75 megawatts at Fort Meade in 2007, and expected that an increase of 10 to 15 megawatts would be needed later that year.^[176] In 2011, the NSA was Maryland's largest consumer of power.^[160] In 2007, as BGE's largest customer, NSA bought as much electricity as Annapolis, the capital city of Maryland.^[174]

One estimate put the potential for power consumption by the new Utah Data Center at US$40 million per year.^[177]

In 1995, The Baltimore Sun reported that the NSA is the owner of the single largest group of supercomputers.^[178]

NSA held a groundbreaking ceremony at Fort Meade in May 2013 for its High Performance Computing Center 2, expected to open in 2016.^[179] Called Site M, the center has a 150 megawatt power substation, 14 administrative buildings and 10 parking garages.^[169] It cost $3.2 billion and covers 227 acres (92 ha; 0.355 sq mi).^[169] The center is 1,800,000 square feet (17 ha; 0.065 sq mi)^[169] and initially uses 60 megawatts of electricity.^[180]

Increments II and III are expected to be completed by 2030, and would quadruple the space, covering 5,800,000 square feet (54 ha; 0.21 sq mi) with 60 buildings and 40 parking garages.^[169] Defense contractors are also establishing or expanding cybersecurity facilities near the NSA and around the Washington metropolitan area.^[169]

The DoD Computer Security Center was founded in 1981 and renamed the National Computer Security Center (NCSC) in 1985. NCSC was responsible for computer security throughout the federal government.^[181] NCSC was part of NSA,^[182] and during the late 1980s and the 1990s, NSA and NCSC published Trusted Computer System Evaluation Criteria in a six-foot high Rainbow Series of books that detailed trusted computing and network platform specifications.^[183] The Rainbow books were replaced by the Common Criteria, however, in the early 2000s.^[183]

As of 2012, NSA collected intelligence from four geostationary satellites.^[177] Satellite receivers were at Roaring Creek Station in Catawissa, Pennsylvania and Salt Creek Station in Arbuckle, California.^[177] It operated ten to twenty taps on U.S. telecom switches. NSA had installations in several U.S. states and from them observed intercepts from Europe, the Middle East, North Africa, Latin America, and Asia.^[177]

NSA had facilities at Friendship Annex (FANX) in Linthicum, Maryland, which is a 20 to 25-minute drive from Fort Meade;^[184] the Aerospace Data Facility at Buckley Space Force Base in Aurora, Colorado; NSA Texas in the Texas Cryptology Center at Lackland Air Force Base in San Antonio, Texas; NSA Georgia, Georgia Cryptologic Center, Fort Gordon (now Fort Eisenhower), Augusta, Georgia; NSA Hawaii, Hawaii Cryptologic Center in Honolulu; the Multiprogram Research Facility in Oak Ridge, Tennessee, and elsewhere.^[172][177]

On January 6, 2011, a groundbreaking ceremony was held to begin construction on NSA's first Comprehensive National Cyber-security Initiative (CNCI) Data Center, known as the "Utah Data Center" for short. The $1.5B data center is being built at Camp Williams, Utah, located 25 miles (40 km) south of Salt Lake City, and will help support the agency's National Cyber-security Initiative.^[185] It is expected to be operational by September 2013.^[177] Construction of Utah Data Center finished in May 2019.^[186]

In 2009, to protect its assets and access more electricity, NSA sought to decentralize and expand its existing facilities in Fort Meade and Menwith Hill,^[187] the latter expansion expected to be completed by 2015.^[188]

The Yakima Herald-Republic cited Bamford, saying that many of NSA's bases for its Echelon program were a legacy system, using outdated, 1990s technology.^[58] In 2004, NSA closed its operations at Bad Aibling Station (Field Station 81) in Bad Aibling, Germany.^[189] In 2012, NSA began to move some of its operations at Yakima Research Station, Yakima Training Center, in Washington state to Colorado, planning to leave Yakima closed.^[190] As of 2013, NSA also intended to close operations at Sugar Grove, West Virginia.^[58]

Following the signing in 1946–1956^[191] of the UKUSA Agreement between the United States, United Kingdom, Canada, Australia and New Zealand, who then cooperated on signals intelligence and ECHELON,^[192] NSA stations were built at GCHQ Bude in Morwenstow, United Kingdom; Geraldton, Pine Gap and Shoal Bay, Australia; Leitrim and Ottawa, Ontario, Canada; Misawa, Japan; and Waihopai and Tangimoana,^[193] New Zealand.^[194]

NSA operates RAF Menwith Hill in North Yorkshire, United Kingdom, which was, according to BBC News in 2007, the largest electronic monitoring station in the world.^[195] Planned in 1954, and opened in 1960, the base covered 562 acres (227 ha; 0.878 sq mi) in 1999.^[196]

The agency's European Cryptologic Center (ECC), with 240 employees in 2011, is headquartered at a US military compound in Griesheim, near Frankfurt in Germany. A 2011 NSA report indicates that the ECC is responsible for the "largest analysis and productivity in Europe" and focuses on various priorities, including Africa, Europe, the Middle East and counterterrorism operations.^[197]

In 2013, a new Consolidated Intelligence Center, also to be used by NSA, is being built at the headquarters of the United States Army Europe in Wiesbaden, Germany.^[198] NSA's partnership with Bundesnachrichtendienst (BND), the German foreign intelligence service, was confirmed by BND president Gerhard Schindler.^[198]

Thailand is a "3rd party partner" of the NSA along with nine other nations.^[199] These are non-English-speaking countries that have made security agreements for the exchange of SIGINT raw material and end product reports.

Thailand is the site of at least two US SIGINT collection stations. One is at the US Embassy in Bangkok, a joint NSA-CIA Special Collection Service (SCS) unit. It presumably eavesdrops on foreign embassies, governmental communications, and other targets of opportunity.^[200]

The second installation is a FORNSAT (foreign satellite interception) station in the Thai city of Khon Kaen. It is codenamed INDRA, but has also been referred to as LEMONWOOD.^[200] The station is approximately 40 hectares (99 acres) in size and consists of a large 3,700–4,600 m² (40,000–50,000 ft²) operations building on the west side of the ops compound and four radome-enclosed parabolic antennas. Possibly two of the radome-enclosed antennas are used for SATCOM intercept and two antennas used for relaying the intercepted material back to NSA. There is also a PUSHER-type circularly-disposed antenna array (CDAA) just north of the ops compound.^[201][202]

NSA activated Khon Kaen in October 1979. Its mission was to eavesdrop on the radio traffic of Chinese army and air force units in southern China, especially in and around the city of Kunming in Yunnan Province. In the late 1970s, the base consisted only of a small CDAA antenna array that was remote-controlled via satellite from the NSA listening post at Kunia, Hawaii, and a small force of civilian contractors from Bendix Field Engineering Corp. whose job it was to keep the antenna array and satellite relay facilities up and running 24/7.^[201]

According to the papers of the late General William Odom, the INDRA facility was upgraded in 1986 with a new British-made PUSHER CDAA antenna as part of an overall upgrade of NSA and Thai SIGINT facilities whose objective was to spy on the neighboring communist nations of Vietnam, Laos, and Cambodia.^[201]

The base apparently fell into disrepair in the 1990s as China and Vietnam became more friendly towards the US, and by 2002 archived satellite imagery showed that the PUSHER CDAA antenna had been torn down, perhaps indicating that the base had been closed. At some point in the period since 9/11, the Khon Kaen base was reactivated and expanded to include a sizeable SATCOM intercept mission. It is likely that the NSA presence at Khon Kaen is relatively small, and that most of the work is done by civilian contractors.^[201]

NSA has been involved in debates about public policy, both indirectly as a behind-the-scenes adviser to other departments, and directly during and after Vice Admiral Bobby Ray Inman's directorship. NSA was a major player in the debates of the 1990s regarding the export of cryptography in the United States. Restrictions on export were reduced but not eliminated in 1996.

Its secure government communications work has involved the NSA in numerous technology areas, including the design of specialized communications hardware and software, production of dedicated semiconductors (at the Ft. Meade chip fabrication plant), and advanced cryptography research. For 50 years, NSA designed and built most of its computer equipment in-house, but from the 1990s until about 2003 (when the U.S. Congress curtailed the practice), the agency contracted with the private sector in the fields of research and equipment.^[203]

NSA was embroiled in some controversy concerning its involvement in the creation of the Data Encryption Standard (DES), a standard and public block cipher algorithm used by the U.S. government and banking community.^[204] During the development of DES by IBM in the 1970s, NSA recommended changes to some details of the design. There was suspicion that these changes had weakened the algorithm sufficiently to enable the agency to eavesdrop if required, including speculation that a critical component—the so-called S-boxes—had been altered to insert a "backdoor" and that the reduction in key length might have made it feasible for NSA to discover DES keys using massive computing power. It has since been observed that the S-boxes in DES are particularly resilient against differential cryptanalysis, a technique which was not publicly discovered until the late 1980s but known to the IBM DES team.

The involvement of NSA in selecting a successor to Data Encryption Standard (DES), the Advanced Encryption Standard (AES), was limited to hardware performance testing (see AES competition).^[205] NSA has subsequently certified AES for protection of classified information when used in NSA-approved systems.^[206]

The NSA is responsible for the encryption-related components in these legacy systems:

• FNBDT Future Narrow Band Digital Terminal^[207]
• KL-7 ADONIS off-line rotor encryption machine (post-WWII – 1980s)^[208][209]
• KW-26 ROMULUS electronic in-line teletypewriter encryptor (1960s–1980s)^[210]
• KW-37 JASON fleet broadcast encryptor (1960s–1990s)^[209]
• KY-57 VINSON tactical radio voice encryptor^[210]
• KG-84 Dedicated Data Encryption/Decryption^[210]
• STU-III secure telephone unit,^[210] phased out by the STE^[211]

The NSA oversees encryption in the following systems that are in use today:

• EKMS Electronic Key Management System^[212]
• Fortezza encryption based on portable crypto token in PC Card format^[213]
• SINCGARS tactical radio with cryptographically controlled frequency hopping^[214]
• STE secure terminal equipment^[211]
• TACLANE product line by General Dynamics C4 Systems^[215]

The NSA has specified Suite A and Suite B cryptographic algorithm suites to be used in U.S. government systems; the Suite B algorithms are a subset of those previously specified by NIST and are expected to serve for most information protection purposes, while the Suite A algorithms are secret and are intended for especially high levels of protection.^[206]

The widely used SHA-1 and SHA-2 hash functions were designed by NSA. SHA-1 is a slight modification of the weaker SHA-0 algorithm, also designed by NSA in 1993. This small modification was suggested by NSA two years later, with no justification other than the fact that it provides additional security. An attack for SHA-0 that does not apply to the revised algorithm was indeed found between 1998 and 2005 by academic cryptographers. Because of weaknesses and key length restrictions in SHA-1, NIST deprecates its use for digital signatures, and approves only the newer SHA-2 algorithms for such applications from 2013 on.^[216]

A new hash standard, SHA-3, has recently been selected through the competition concluded October 2, 2012 with the selection of Keccak as the algorithm. The process to select SHA-3 was similar to the one held in choosing the AES, but some doubts have been cast over it,^[217][218] since fundamental modifications have been made to Keccak in order to turn it into a standard.^[219] These changes potentially undermine the cryptanalysis performed during the competition and reduce the security levels of the algorithm.^[217]

Because of concerns that widespread use of strong cryptography would hamper government use of wiretaps, NSA proposed the concept of key escrow in 1993 and introduced the Clipper chip that would offer stronger protection than DES but would allow access to encrypted data by authorized law enforcement officials.^[220] The proposal was strongly opposed and key escrow requirements ultimately went nowhere.^[221] However, NSA's Fortezza hardware-based encryption cards, created for the Clipper project, are still used within government, and NSA ultimately declassified and published the design of the Skipjack cipher used on the cards.^[222][223]

NSA promoted the inclusion of a random number generator called Dual EC DRBG in the U.S. National Institute of Standards and Technology's 2007 guidelines. This led to speculation of a backdoor which would allow NSA access to data encrypted by systems using that pseudorandom number generator (PRNG).^[224]

This is now deemed to be plausible based on the fact that output of next iterations of PRNG can provably be determined if relation between two internal Elliptic Curve points is known.^[225][226] Both NIST and RSA are now officially recommending against the use of this PRNG.^[227][228]

Perfect Citizen is a program to perform vulnerability assessment by the NSA on U.S. critical infrastructure.^[229][230] It was originally reported to be a program to develop a system of sensors to detect cyber attacks on critical infrastructure computer networks in both the private and public sector through a network monitoring system named Einstein.^[231][232] It is funded by the Comprehensive National Cybersecurity Initiative and thus far Raytheon has received a contract for up to $100 million for the initial stage.

NSA has invested many millions of dollars in academic research under grant code prefix MDA904, resulting in over 3,000 papers as of October 11, 2007.^[update] NSA/CSS has, at times, attempted to restrict the publication of academic research into cryptography; for example, the Khufu and Khafre block ciphers were voluntarily withheld in response to an NSA request to do so. In response to a FOIA lawsuit, in 2013 the NSA released the 643-page research paper titled, "Untangling the Web: A Guide to Internet Research",^[233] written and compiled by NSA employees to assist other NSA workers in searching for information of interest to the agency on the public Internet.^[234]

NSA has the ability to file for a patent from the U.S. Patent and Trademark Office under gag order. Unlike normal patents, these are not revealed to the public and do not expire. However, if the Patent Office receives an application for an identical patent from a third party, they will reveal NSA's patent and officially grant it to NSA for the full term on that date.^[235]

One of NSA's published patents describes a method of geographically locating an individual computer site in an Internet-like network, based on the latency of multiple network connections.^[236] Although no public patent exists, NSA is reported to have used a similar locating technology called trilateralization that allows real-time tracking of an individual's location, including altitude from ground level, using data obtained from cellphone towers.^[237]

The heraldic insignia of NSA consists of an eagle inside a circle, grasping a key in its talons.^[238] The eagle represents the agency's national mission.^[238] Its breast features a shield with bands of red and white, taken from the Great Seal of the United States and representing Congress.^[238] The key is taken from the emblem of Saint Peter and represents security.^[238]

When the NSA was created, the agency had no emblem and used that of the Department of Defense.^[239] The agency adopted its first of two emblems in 1963.^[239] The current NSA insignia has been in use since 1965, when then-Director, LTG Marshall S. Carter (USA) ordered the creation of a device to represent the agency.^[240]

The NSA's flag consists of the agency's seal on a light blue background.

Crews associated with NSA missions have been involved in a number of dangerous and deadly situations.^[241] The USS Liberty incident in 1967 and USS Pueblo incident in 1968 are examples of the losses endured during the Cold War.^[241]

The National Security Agency/Central Security Service Cryptologic Memorial honors and remembers the fallen personnel, both military and civilian, of these intelligence missions.^[242] It is made of black granite, and has 171 names carved into it, as of 2013.^{[update][242]} It is located at NSA headquarters. A tradition of declassifying the stories of the fallen was begun in 2001.^[242]

In the United States, at least since 2001,^[243] there has been legal controversy over what signal intelligence can be used for and how much freedom the National Security Agency has to use signal intelligence.^[244] In 2015, the government made slight changes in how it uses and collects certain types of data,^[245] specifically phone records. The government was not analyzing the phone records as of early 2019.^[246] The surveillance programs were deemed unlawful in September 2020 in a court of appeals case.^[52]

On December 16, 2005, The New York Times reported that, under White House pressure and with an executive order from President George W. Bush, the National Security Agency, in an attempt to thwart terrorism, had been tapping phone calls made to persons outside the country, without obtaining warrants from the United States Foreign Intelligence Surveillance Court, a secret court created for that purpose under the Foreign Intelligence Surveillance Act (FISA).^[97]

Edward Snowden is a former American intelligence contractor who revealed in 2013 the existence of secret wide-ranging information-gathering programs conducted by the National Security Agency (NSA).^[247] More specifically, Snowden released information that demonstrated how the United States government was gathering immense amounts of personal communications, emails, phone locations, web histories and more of American citizens without their knowledge.^[248] One of Snowden's primary motivators for releasing this information was fear of a surveillance state developing as a result of the infrastructure being created by the NSA. As Snowden recounts, "I believe that, at this point in history, the greatest danger to our freedom and way of life comes from the reasonable fear of omniscient State powers kept in check by nothing more than policy documents... It is not that I do not value intelligence, but that I oppose . . . omniscient, automatic, mass surveillance. . . . That seems to me a greater threat to the institutions of free society than missed intelligence reports, and unworthy of the costs."^[249]

In March 2014, Army General Martin Dempsey, Chairman of the Joint Chiefs of Staff, told the House Armed Services Committee, "The vast majority of the documents that Snowden ... exfiltrated from our highest levels of security ... had nothing to do with exposing government oversight of domestic activities. The vast majority of those were related to our military capabilities, operations, tactics, techniques, and procedures."^[250] When asked in a May 2014 interview to quantify the number of documents Snowden stole, retired NSA director Keith Alexander said there was no accurate way of counting what he took, but Snowden may have downloaded more than a million documents.^[251]

On January 17, 2006, the Center for Constitutional Rights filed a lawsuit, CCR v. Bush, against the George W. Bush presidency. The lawsuit challenged the National Security Agency's (NSA's) surveillance of people within the U.S., including the interception of CCR emails without securing a warrant first.^[252][253]

In the August 2006 case ACLU v. NSA, U.S. District Court Judge Anna Diggs Taylor concluded that NSA's warrantless surveillance program was both illegal and unconstitutional. On July 6, 2007, the 6th Circuit Court of Appeals vacated the decision on the grounds that the ACLU lacked standing to bring the suit.^[254]

In September 2008, the Electronic Frontier Foundation (EFF) filed a class action lawsuit against the NSA and several high-ranking officials of the Bush administration,^[255] charging an "illegal and unconstitutional program of dragnet communications surveillance,"^[256] based on documentation provided by former AT&T technician Mark Klein.^[257]

As a result of the USA Freedom Act passed by Congress in June 2015, the NSA had to shut down its bulk phone surveillance program on November 29 of the same year. The USA Freedom Act forbids the NSA to collect metadata and content of phone calls unless it has a warrant for terrorism investigation. In that case, the agency must ask the telecom companies for the record, which will only be kept for six months. The NSA's use of large telecom companies to assist it with its surveillance efforts has caused several privacy concerns.^{[258]: 1568–69}

In May 2008, Mark Klein, a former AT&T employee, alleged that his company had cooperated with NSA in installing Narus hardware to replace the FBI Carnivore program, to monitor network communications including traffic between U.S. citizens.^[259]

NSA was reported in 2008 to use its computing capability to analyze "transactional" data that it regularly acquires from other government agencies, which gather it under their own jurisdictional authorities.^[260]

A 2013 advisory group for the Obama administration, seeking to reform NSA spying programs following the revelations of documents released by Edward J. Snowden,^[261] mentioned in 'Recommendation 30' on page 37, "...that the National Security Council staff should manage an interagency process to review on a regular basis the activities of the US Government regarding attacks that exploit a previously unknown vulnerability in a computer application." Retired cybersecurity expert Richard A. Clarke was a group member and stated on April 11, 2014, that NSA had no advance knowledge of Heartbleed.^[262]

In August 2013 it was revealed that a 2005 IRS training document showed that NSA intelligence intercepts and wiretaps, both foreign and domestic, were being supplied to the Drug Enforcement Administration (DEA) and Internal Revenue Service (IRS) and were illegally used to launch criminal investigations of US citizens. Law enforcement agents were directed to conceal how the investigations began and recreate an apparently legal investigative trail by re-obtaining the same evidence by other means.^[263][264]

In the months leading to April 2009, the NSA intercepted the communications of U.S. citizens, including a Congressman, although the Justice Department believed that the interception was unintentional. The Justice Department then took action to correct the issues and bring the program into compliance with existing laws.^[265] United States Attorney General Eric Holder resumed the program according to his understanding of the Foreign Intelligence Surveillance Act amendment of 2008, without explaining what had occurred.^[266]

Polls conducted in June 2013 found divided results among Americans regarding NSA's secret data collection.^[267] Rasmussen Reports found that 59% of Americans disapprove,^[268] Gallup found that 53% disapprove,^[269] and Pew found that 56% are in favor of NSA data collection.^[270]

On April 25, 2013, the NSA obtained a court order requiring Verizon's Business Network Services to provide metadata on all calls in its system to the NSA "on an ongoing daily basis" for a three-month period, as reported by The Guardian on June 6, 2013. This information includes "the numbers of both parties on a call ... location data, call duration, unique identifiers, and the time and duration of all calls" but not "[t]he contents of the conversation itself". The order relies on the so-called "business records" provision of the Patriot Act.^[271][272]

In August 2013, following the Snowden leaks, new details about the NSA's data mining activity were revealed. Reportedly, the majority of emails into or out of the United States are captured at "selected communications links" and automatically analyzed for keywords or other "selectors". Emails that do not match are deleted.^[273]

The utility of such a massive metadata collection in preventing terrorist attacks is disputed. Many studies reveal the dragnet like system to be ineffective. One such report, released by the New America Foundation concluded that after an analysis of 225 terrorism cases, the NSA "had no discernible impact on preventing acts of terrorism."^[274]

Defenders of the program said that while metadata alone cannot provide all the information necessary to prevent an attack, it assures the ability to "connect the dots"^[275] between suspect foreign numbers and domestic numbers with a speed only the NSA's software is capable of. One benefit of this is quickly being able to determine the difference between suspicious activity and real threats.^[276] As an example, NSA director General Keith B. Alexander mentioned at the annual Cybersecurity Summit in 2013, that metadata analysis of domestic phone call records after the Boston Marathon bombing helped determine that rumors of a follow-up attack in New York were baseless.^[275]

In addition to doubts about its effectiveness, many people argue that the collection of metadata is an unconstitutional invasion of privacy. As of 2015^[update], the collection process remained legal and grounded in the ruling from Smith v. Maryland (1979). A prominent opponent of the data collection and its legality is U.S. District Judge Richard J. Leon, who issued a report in 2013^[277] in which he stated: "I cannot imagine a more 'indiscriminate' and 'arbitrary invasion' than this systematic and high tech collection and retention of personal data on virtually every single citizen for purposes of querying and analyzing it without prior judicial approval...Surely, such a program infringes on 'that degree of privacy' that the founders enshrined in the Fourth Amendment".

As of May 7, 2015, the United States Court of Appeals for the Second Circuit ruled that the interpretation of Section 215 of the Patriot Act was wrong and that the NSA program that has been collecting Americans' phone records in bulk is illegal.^[278] It stated that Section 215 cannot be clearly interpreted to allow government to collect national phone data and, as a result, expired on June 1, 2015. This ruling "is the first time a higher-level court in the regular judicial system has reviewed the NSA phone records program."^[279] The replacement law known as the USA Freedom Act, which will enable the NSA to continue to have bulk access to citizens' metadata but with the stipulation that the data will now be stored by the companies themselves.^[279] This change will not have any effect on other Agency procedures—outside of metadata collection—which have purportedly challenged Americans' Fourth Amendment rights,^[280] including Upstream collection, a mass of techniques used by the Agency to collect and store American's data/communications directly from the Internet backbone.^[281]

Under the Upstream collection program, the NSA paid telecommunications companies hundreds of millions of dollars in order to collect data from them.^[282] While companies such as Google and Yahoo! claim that they do not provide "direct access" from their servers to the NSA unless under a court order,^[283] the NSA had access to emails, phone calls, and cellular data users.^[284] Under this new ruling, telecommunications companies maintain bulk user metadata on their servers for at least 18 months, to be provided upon request to the NSA.^[279] This ruling made the mass storage of specific phone records at NSA datacenters illegal, but it did not rule on Section 215's constitutionality.^[279]

In a declassified document it was revealed that 17,835 phone lines were on an improperly permitted "alert list" from 2006 to 2009 in breach of compliance, which tagged these phone lines for daily monitoring.^{[285][286][287]} Eleven percent of these monitored phone lines met the agency's legal standard for "reasonably articulable suspicion" (RAS).^[285][288]

The NSA tracks the locations of hundreds of millions of cellphones per day, allowing it to map people's movements and relationships in detail.^[289] The NSA has been reported to have access to all communications made via Google, Microsoft, Facebook, Yahoo, YouTube, AOL, Skype, Apple and Paltalk,^[290] and collects hundreds of millions of contact lists from personal email and instant messaging accounts each year.^[291] It has also managed to weaken much of the encryption used on the Internet (by collaborating with, coercing or otherwise infiltrating numerous technology companies to leave "backdoors" into their systems), so that the majority of encryption is inadvertently vulnerable to different forms of attack.^[292][293]

Domestically, the NSA has been proven to collect and store metadata records of phone calls,^[294] including over 120 million US Verizon subscribers,^[295] as well as intercept vast amounts of communications via the internet (Upstream).^[290] The government's legal standing had been to rely on a secret interpretation of the Patriot Act whereby the entirety of US communications may be considered "relevant" to a terrorism investigation if it is expected that even a tiny minority may relate to terrorism.^[296] The NSA also supplies foreign intercepts to the DEA, IRS and other law enforcement agencies, who use these to initiate criminal investigations. Federal agents are then instructed to "recreate" the investigative trail via parallel construction.^[297]

The NSA also spies on influential Muslims to obtain information that could be used to discredit them, such as their use of pornography. The targets, both domestic and abroad, are not suspected of any crime but hold religious or political views deemed "radical" by the NSA.^[298]

According to a report in The Washington Post in July 2014, relying on information provided by Snowden, 90% of those placed under surveillance in the U.S. are ordinary Americans and are not the intended targets. The newspaper said it had examined documents including emails, text messages, and online accounts that support the claim.^[299]

The Intelligence Committees of US House and Senate exercise primary oversight over the NSA; other members of congress have been denied access to materials and information regarding the agency and its activities.^[300] The United States Foreign Intelligence Surveillance Court, the secret court charged with regulating the NSA's activities is, according to its chief judge, incapable of investigating or verifying how often the NSA breaks even its own secret rules.^[301] It has since been reported that the NSA violated its own rules on data access thousands of times a year, many of these violations involving large-scale data interceptions.^[302] NSA officers have even used data intercepts to spy on love interests;^[303] "most of the NSA violations were self-reported, and each instance resulted in administrative action of termination."^{[304][attribution needed]}

The NSA has "generally disregarded the special rules for disseminating United States person information" by illegally sharing its intercepts with other law enforcement agencies.^[305] A March 2009 FISA Court opinion, which the court released, states that protocols restricting data queries had been "so frequently and systemically violated that it can be fairly said that this critical element of the overall ... regime has never functioned effectively."^[306][307] In 2011 the same court noted that the "volume and nature" of the NSA's bulk foreign Internet intercepts was "fundamentally different from what the court had been led to believe".^[305] Email contact lists (including those of US citizens) are collected at numerous foreign locations to work around the illegality of doing so on US soil.^[291]

Legal opinions on the NSA's bulk collection program have differed. In mid-December 2013, U.S. District Judge Richard Leon ruled that the "almost-Orwellian" program likely violates the Constitution, and wrote, "I cannot imagine a more 'indiscriminate' and 'arbitrary invasion' than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying and analyzing it without prior judicial approval. Surely, such a program infringes on 'that degree of privacy' that the Founders enshrined in the Fourth Amendment. Indeed, I have little doubt that the author of our Constitution, James Madison, who cautioned us to beware 'the abridgement of freedom of the people by gradual and silent encroachments by those in power,' would be aghast."^[308]

Later that month, U.S. District Judge William Pauley ruled that the NSA's collection of telephone records is legal and valuable in the fight against terrorism. In his opinion, he wrote, "a bulk telephony metadata collection program [is] a wide net that could find and isolate gossamer contacts among suspected terrorists in an ocean of seemingly disconnected data" and noted that a similar collection of data prior to 9/11 might have prevented the attack.^[309]

At a March 2013 Senate Intelligence Committee hearing, Senator Ron Wyden asked Director of National Intelligence James Clapper, "does the NSA collect any type of data at all on millions or hundreds of millions of Americans?" Clapper replied "No, sir. ... Not wittingly. There are cases where they could inadvertently perhaps collect, but not wittingly."^[310] This statement came under scrutiny months later, in June 2013, when details of the PRISM surveillance program were published, showing that "the NSA apparently can gain access to the servers of nine Internet companies for a wide range of digital data."^[310] Wyden said that Clapper had failed to give a "straight answer" in his testimony. Clapper, in response to criticism, said, "I responded in what I thought was the most truthful, or least untruthful manner." Clapper added, "There are honest differences on the semantics of what—when someone says 'collection' to me, that has a specific meaning, which may have a different meaning to him."^[310]

NSA whistle-blower Edward Snowden additionally revealed the existence of XKeyscore, a top secret NSA program that allows the agency to search vast databases of "the metadata as well as the content of emails and other internet activity, such as browser history," with capability to search by "name, telephone number, IP address, keywords, the language in which the internet activity was conducted or the type of browser used."^[311] XKeyscore "provides the technological capability, if not the legal authority, to target even US persons for extensive electronic surveillance without a warrant provided that some identifying information, such as their email or IP address, is known to the analyst."^[311]

Regarding the necessity of these NSA programs, Alexander stated on June 27, 2013, that the NSA's bulk phone and Internet intercepts had been instrumental in preventing 54 terrorist "events", including 13 in the US, and in all but one of these cases had provided the initial tip to "unravel the threat stream".^[312] On July 31 NSA Deputy Director John Inglis conceded to the Senate that these intercepts had not been vital in stopping any terrorist attacks, but were "close" to vital in identifying and convicting four San Diego men for sending US$8,930 to Al-Shabaab, a militia that conducts terrorism in Somalia.^{[313][314][315]}

The U.S. government has aggressively sought to dismiss and challenge Fourth Amendment cases raised against it, and has granted retroactive immunity to ISPs and telecoms participating in domestic surveillance.^[316][317]

The U.S. military has acknowledged blocking access to parts of The Guardian website for thousands of defense personnel across the country,^[318][319] and blocking the entire Guardian website for personnel stationed throughout Afghanistan, the Middle East, and South Asia.^[320]

An October 2014 United Nations report condemned mass surveillance by the United States and other countries as violating multiple international treaties and conventions that guarantee core privacy rights.^[321]

An exploit dubbed EternalBlue, created by the NSA, was used in the unprecedented worldwide WannaCry ransomware attack in May 2017.^[322] The exploit had been leaked online by a hacking group, The Shadow Brokers, nearly a month prior to the attack. A number of experts have pointed the finger at the NSA's non-disclosure of the underlying vulnerability, and their loss of control over the EternalBlue attack tool that exploited it. Edward Snowden said that if the NSA had "privately disclosed the flaw used to attack hospitals when they found it, not when they lost it, [the attack] might not have happened".^[323] Wikipedia co-founder, Jimmy Wales, stated that he joined "with Microsoft and the other leaders of the industry in saying this is a huge screw-up by the government ... the moment the NSA found it, they should have notified Microsoft so they could quietly issue a patch and really chivvy people along, long before it became a huge problem."^[324]

Former employee David Evenden, who had left the NSA to work for US defense contractor Cyperpoint at a position in the United Arab Emirates, was tasked with hacking UAE neighbor Qatar in 2015 to determine if they were funding terrorist group Muslim Brotherhood. He quit the company after learning his team had hacked Qatari Sheikha Moza bint Nasser's email exchanges with Michelle Obama, just prior to her visit to Doha.^[325] Upon Evenden's return to the US, he reported his experiences to the FBI. The incident highlights a growing trend of former NSA employees and contractors leaving the agency to start up their own firms, and then hiring out to countries like Turkey, Sudan and even Russia, a country involved in numerous cyberattacks against the US.^[325]

In May 2021, it was reported that Danish Defence Intelligence Service collaborated with NSA to wiretap on fellow EU members and leaders,^[326][327] leading to wide backlash among EU countries and demands for explanation from Danish and American governments.^[328]

• Bamford, James. Body of Secrets: Anatomy of the Ultra-Secret National Security Agency, Random House Digital, Inc., December 18, 2007. ISBN 0-307-42505-3. Previously published as: Doubleday, 2001, ISBN 0-385-49907-8.
• Bauer, Craig P. Secret History: The Story of Cryptology (Volume 76 of Discrete Mathematics and Its Applications). CRC Press, 2013. ISBN 1-4665-6186-6.
• Weiland, Matt and Sean Wilsey. State by State. HarperCollins, October 19, 2010. ISBN 0-06-204357-9.

• Adams, Sam, War of Numbers: An Intelligence Memoir Steerforth; new edition (June 1, 1998).
• Aid, Matthew, The Secret Sentry: The Untold History of the National Security Agency, 432 pages, ISBN 978-1-59691-515-2, Bloomsbury Press (June 9, 2009).
  • Mandatory Declassification Review Archived 2024-05-12 at the Wayback Machine – Interagency Security Classification Appeals Panel
• Bamford, James, The Puzzle Palace, Penguin Books, 1982, ISBN 0-14-006748-5.
• Bamford, James, "The Agency That Could Be Big Brother Archived 2015-03-02 at the Wayback Machine", The New York Times, December 25, 2005.
• Bamford, James, The Shadow Factory, Anchor Books, 2009, ISBN 978-0-307-27939-2.
• Budiansky, Stephen (2017). Code Warriors: NSA's Codebreakers and the Secret Intelligence War Against the Soviet Union. ISBN 978-080-417-097-0.
• Hanyok, Robert J. (2002). Spartans in Darkness: American SIGINT and the Indochina War, 1945–1975. National Security Agency. Archived from the original on January 11, 2009. Retrieved November 16, 2008.
• Jackson, David (June 18, 2013). "Obama: NSA surveillance programs are 'transparent'". USA Today. Archived from the original on June 18, 2013. Retrieved June 18, 2013.
• Johnson, Thomas R. (2008). American Cryptology during the Cold War. National Security Agency: Center for Cryptological History. Archived from the original on December 24, 2008. Retrieved November 16, 2008.
• Radden Keefe, Patrick, Chatter: Dispatches from the Secret World of Global Eavesdropping, Random House, ISBN 1-4000-6034-6.
• Kent, Sherman, Strategic Intelligence for American Public Policy.
• Kahn, David, The Codebreakers, 1181 pp., ISBN 0-684-83130-9. Look for the 1967 rather than the 1996 edition^[why?].
• Laqueur, Walter, A World of secrets.
• Liston, Robert A., The Pueblo Surrender: A Covert Action by the National Security Agency, ISBN 0-87131-554-8.
• Levy, Steven, Crypto: How the Code Rebels Beat the Government—Saving Privacy in the Digital Age, Penguin Books, ISBN 0-14-024432-8.
• Prados, John, The Soviet estimate: U.S. intelligence analysis & Russian military strength, hardcover, 367 pages, ISBN 0-385-27211-1, Dial Press (1982).
• Perro, Ralph J. "Interviewing With an Intelligence Agency (or, A Funny Thing Happened on the Way to Fort Meade)". (Archive) Federation of American Scientists. November 2003. Updated January 2004. – About the experience of a candidate of an NSA job in pre-employment screening. "Ralph J. Perro" is a pseudonym that is a reference to Ralph J. Canine (perro is Spanish for "dog", and a dog is a type of canine)
• Shaker, Richard J. "The Agency That Came in from the Cold." (Archive Notices. American Mathematical Society. May/June 1992 pp. 408–411.
• Tully, Andrew, The Super Spies: More Secret, More Powerful than the CIA, 1969, LC 71080912.
• Church Committee, Intelligence Activities and the Rights of Americans: 1976 US Senate Report on Illegal Wiretaps and Domestic Spying by the FBI, CIA and NSA, Red and Black Publishers (May 1, 2008).
• "Just what is the NSA? Archived 2014-10-22 at the Wayback Machine" (video). CNN. June 7, 2013.
• "The NSA Files". The Guardian. London. June 8, 2013. Archived from the original on October 3, 2014. Retrieved June 7, 2024.
• "National Security Agency Releases History of Cold War Intelligence Activities Archived 2008-12-24 at the Wayback Machine." George Washington University. National Security Archive Electronic Briefing Book No. 260. Posted November 14, 2008.
• "The Snowden Archive". The Intercept. London. June 8, 2013. Archived from the original on May 12, 2024. Retrieved June 7, 2024.

• Official website
• National Security Agency – 60 Years of Defending Our Nation
• Records of the National Security Agency/Central Security Service Archived 2006-10-14 at the Wayback Machine
• The National Security Archive at George Washington University Archived 2015-03-19 at the Wayback Machine
• "United States Intelligence Community: Who We Are / NSA section". Archived from the original on September 25, 2006.
• National Security Agency (NSA) Archive on the Internet Archive