The US National Security Agency (NSA) and Federal Bureau of Investigation (FBI) have been secretly spying on millions of Verizon wireless customers in the US for at least several months — and likely the customers of additional companies for longer, going back seven years. The revelation, detailed in a classified court document published yesterday in The Guardian by journalist Glenn Greenwald, has sparked outrage among citizens and civil rights advocacy groups. On Thursday evening, The Washington Post broke the news that the NSA and FBI had also been spying on customers of some of the largest technology companies, including Google, Microsoft, and Apple, in real time, also for years.

The reports have raised serious questions about the scope of the surveillance powers granted to US intelligence agencies following the September 11th, 2001 terror attacks. Namely: how long has the US government been doing this? How many ordinary citizens have been surveilled? And, perhaps most important: why didn’t the American people know anything about these efforts until now, and what should be done to curtail them going forward? When it comes to spying on phone records at least, there are a few answers, none of them comforting.

"We have reports dating back to 2006 that this was taking place."

"We have reports dating back to 2006 that this was taking place," said Amie Stepanovich, director of domestic surveillance review at the Electronic Privacy Information Center (EPIC), a nonprofit advocacy group dedicated to protecting user privacy. She pointed to an article published by USA Today that year that was widely circulated Wednesday on social media after Greenwald’s story broke. Citing anonymous sources, the 2006 piece describes an NSA surveillance program covering "tens of millions" of American customers of Verizon, AT&T, and BellSouth, a company acquired by AT&T later that year. "When that story broke, a lot of people looked at it and said, ‘Okay, well you can’t prove it, there’s not that much information here" Stepanovich said. "But fast forward to 2013, it turns out, that report was basically correct."

What we know

Indeed, Senator Diane Feinstein (D-CA), chair of the Senate Intelligence Committee, openly acknowledged the program for the first time on Thursday, but downplayed it as business-as-usual. Feinstein said it was "lawful," and had been renewed every three months for the past seven years. She was just one of several prominent lawmakers who admittedly knew about and signed off on the effort, without disclosing the full details to constituents until now.

requires Verizon to turn over all metadata

What had been missing from the original 2006 USA Today story, and likely prevented the story from gaining more traction at the time, was a trail of documents — specifically a court order authorizing the surveillance operation described in the story. Greenwald obtained such an order, signed by US Judge Roger Vinson, which was requested by the FBI and which requires Verizon to turn over all metadata on its customers’ telephone calls to the NSA beginning April 25th and going through July 19th of this year. Considering the apparent longstanding history of this program and the support some congressional leaders have given it, there’s every reason to expect it will be again renewed by the court for another three months before it expires, ad infinitum.

Verizon-payphone-stock_1020-inline

That customer metadata doesn’t include voice recordings or the contents of the calls themselves, but it does sweep in many other identifying and revealing details about customers and their communications, including callers' phone numbers, their device ID numbers (IMEI), subscriber IDs, calling card numbers, and the length and dates of the calls. The "top secret" order, which was not supposed to be made public until 2038, was issued through a Foreign Intelligence Surveillance Court (FISC), a special type of US court whose proceedings are classified, and which was first set up under the Foreign Intelligence Surveillance Act of 1978 (FISA).

"requesting production of any tangible thing, such as business records, if the items are relevant."

That law was passed initially to allow US intelligence agencies to spy on foreign communications, while restricting their surveillance of people inside the US. But FISA was amended by the controversial PATRIOT Act of 2001, passed right after the September 11th, 2001 terror attacks, to allow intelligence agencies to obtain secret court orders like the one delivered to Verizon. Such orders can be issued "requesting production of any tangible thing, such as business records, if the items are relevant to an ongoing authorized national security investigation," as the Bush administration described them when defending the amendments back in 2005. The specific section of the PATRIOT Act allowing these orders was 215, so the orders have become known as "215 orders."

"Hopefully, this will cause a new push for congressional oversight of these 215 orders," Stepanovich told The Verge. "We still don’t know how this section is being interpreted by courts, because their proceedings are secret. It’s never been revealed what the NSA believes it can do under this order."

What can be done about it

"There are three ways this could stop."

"There are three ways this could stop," said Cindy Cohn, a legal director at the Electronic Frontier Foundation, an advocacy group focusing on the rights of internet and electronic device users. "The executive branch could say, ‘We’re done, we’re stopping this.’ Congress could make them stop one way or another, either by passing a law against it or defunding it. Or the third way is for the courts to issue an order saying this is illegal or unconstitutional."

But Congress is not showing anything close to the near-uniform outrage that advocates and citizens have expressed toward the surveillance program. On the contrary, lawmakers appear — not atypically — fiercely divided on the question of whether such broad surveillance efforts are deplorable invasions of privacy, or necessary tools for thwarting terror.

Several lawmakers did take strong stances against the Verizon surveillance effort. "Seizing phone records of millions of innocent people is excessive and un-American," wrote Rep. Jim Sensenbrenner (R-WI), one of the co-authors of the original PATRIOT Act, in a press statement released Thursday. "The National Security Agency's seizure and surveillance of virtually all of Verizon's phone customers is an astounding assault on the Constitution," wrote Senator Rand Paul (R-KY) in his response. Lawmakers on the Senate Judiciary and House Judiciary committees said Thursday they would launch hearings investigating the phone surveillance program.

Emergency-dial-9111_2040

"Seizing phone records of millions of innocent people is excessive and un-American."

But other lawmakers, in keeping with Senator Feinstein’s stance, defended the effort. House Intelligence Committee chair Rep. Mike Rogers (R-MI), author of the controversial cybersecurity bill CISPA, went even further, saying, "Within the last few years, this program was used to stop a terrorist attack in the United States," but declined to provide further specifics, saying he was working to get them unclassified.

"If the government can make the case to the American people that spying on everyone helps them find the 0.0001 percent of people who are involved in terrorist activity, then I welcome them to do that," Cohen said. "Put up or shut up."

What could happen next

Still, the Electronic Frontier Foundation is not waiting around for Congress to take action. It’s taking the third route to end surveillance — the courts. In fact, on this issue the EFF has been ahead of the curve for many years, filing a lawsuit against AT&T in federal court in 2006 based on preliminary data indicating a mass phone surveillance effort. That was months before the USA Today story was published. The lawsuit has suffered numerous setbacks and was eventually dismissed outright in 2008, after Congress granted retroactive immunity to phone companies allowing wireless wiretapping of customers under FISA. But it survives today in the form of another ongoing lawsuit against the NSA itself, this one in a California federal district court.

"We’re waiting for the judge’s decision," Cohen told The Verge, noting that EFF would bring the recent Verizon surveillance order to the judge’s attention. "Hopefully the court will issue an injunction to stop the program." Even if that happens, surveillance won’t stop right away, as the US government will have a chance to appeal the ruling. "It may go all the way to the Supreme Court," Cohen said. "The American people deserve their day in court."

Blind-justice3-1-inline

"The American people deserve their day in court."

So for now at least, the answers to the "who", "what," and "why" behind the FBI's and NSA’s newly revealed Verizon surveillance operation remain largely shrouded in secrecy. It’s highly unlikely the executive branch, which has been authorizing such activities for the entirety of Obama’s terms and his predecessor’s, will suddenly pull the plug. And it’s unclear that there are enough willing lawmakers in Congress to exercise their oversight authority to stop it, or to bring further details to light. That leaves the EFF’s lawsuit and others like it to try and halt mass surveillance, or at least, shed more light on it.