Black Hat 2013: NSA Director Says Surveillance Programs Prevent Terrorist Attacks

Photo credit: All rights reserved by Black Hat Events
Photo credit: All rights reserved by Black Hat Events

“Defending our nation while protecting our civil liberties and privacy is one of the biggest issues affecting our country today”, Alexander said in opening. “The reputation of the NSA has been tarnished because all the facts aren’t on the table.”

The four-star US Army general set his objective of the keynote to put the facts on the table, but clarified: “There are good reasons why some information is classified. Terrorists are among us and they use our communications.”

“The tools we use are the same tools you use”, he said to the audience, “the difference is the oversight and compliance we have in these programs – this part is missing from most discussions.”

Failing to Connect the Dots

Alexander presented a timeline showing that the intelligence community “failed to connect the dots”, in the cases of the 1993 World Trade Center Bombing and subsequent 9/11 attacks, in addition to other terrorist plots. “Now we’re connecting them”, he said, referring to the NSA’s metadata collection program under section 215 of the USA PATRIOT Act and Section 702 of the Foreign Intelligence Surveillance Act (FISA). “These programs help us to collect the dots in an unobtrusive way”, he added.

“There’s an assumption that the government are out there wheeling and dealing your data, but nothing could be further from the truth”, Alexander said. “We have oversight and compliance. We’re not collecting everything. Our collection is focused and purely about counter-terrorism. We can’t afford to – and don’t want to – collect everything”, he insisted.

Section 215

Section 215 of the PATRIOT Act is a counter-terrorism program designed to identify the communications of people suspected to be associated with terrorist organizations communicating with individuals inside the US. “NSA only obtains the date and time of call, calling number, called number, duration of call and origin of the metadata record.” NSA does not, he reported, collect names, addresses, credit card data, or SMS texts.

The intent of the program, he said, is to find a terrorist actor and identify them to the FBI. Only 22 staff at the NSA can approve a number with a terrorist connection to go on its database. “The FBI does tremendous work for this country. Our job is to help them focus on the right numbers.”

Alexander also confirmed that “industry” (telecommunication companies, ISPs, search engines, etc.) “are compelled by law to comply with request for data. The court is overseeing it, Congress is overseeing it, the Administration is overseeing it”, he confirmed.

Section 702

Section 702 of the FISA, of which PRISM is part of, is “purely for foreign intelligence purposes. It does not target US people, but threats overseas. It may not target any US person anywhere in the world and it does not authorize us to listen to all of your conversations”, he said.

“Congress reviewed this program over four years. They found no wilful or knowledgeable violations of the law or intent of the law in this program. No-one at NSA had ever gone outside of the boundaries that they had been given”.

Admittedly, Alexander said, “Yes they could, but the fact is they don’t. If they did, auditing tools would detect them and they would be held accountable. [NSA staff] have made a pledge to this nation.”

The intent of Section 702 is “to find the terrorist that walks among us”, he commented. “We do this with the least obtrusive actions that we can. This is the right thing to do, and the nation needs to know we do the right thing. We comply with court orders and if we make a mistake we hold ourselves accountable and report it to everyone.”

Disrupting Terrorist Activity

Sections 215 and 702 have helped disrupt 54 terror-related activities, including 13 in the US and 25 in Europe. “These programs helped disrupt a plot to bomb the New York City subway system. The initial tip came from the PRISM section 702 data”, Alexander reiterated.

Referring undoubtedly to the Edward Snowden case, the NSA director said: “People who are revealing sensitive information that can hurt our country and its citizens are irresponsible and pose significant damage to this country. We take an oath to the constitution to defend this country.

“We are trying to defend the country and protect civil liberties and privacy”, he concluded. In a call to the industry, Alexander said “be constructive, help us get this right, and put the facts on the table. We need to hear your ideas.”


Audience Reaction

When NSA Director Gen. Keith Alexander told attendees of Black Hat USA 2013 that the NSA “stands for freedom" – a member of the audience immediately shouted, "Bullshit!"

The heckle was received by the crowd with intermittent applause. The general acknowledged the comment and response, and moved on to continue telling the hackers and security professionals that the NSA's surveillance programs had prevented multiple terrorist attacks around the world.


What’s hot on Infosecurity Magazine?