The Guardian’s new revelations about the NSA spying program known as xkeyscore is a genuinely big deal, and seems to be getting less coverage than the earlier stories about PRISM.
Note the back-and-forth shuffle that the government employs when trying to limit the damage that these revelations do to its ability to spy with impunity. When PRISM was the story, one of the government’s defenses was, “Oh, sure, we vacuum up tons of data, but nobody actually sees it unless they’re actively pursuing legitimate foreign intelligence targets.” Now that xkeyscore is the story and we’re seeing how easy it is for analysts to make broad queries with “justifications” that come down to choosing an excuse from a drop-down menu (really! Literally! I am not making this up!), one of the responses is, “Xkeyscore is just a simple query interface into legally obtained information.”
Again, follow along, because it’s important. PRISM is okay because they’re taking the data but not really giving anyone access to it. Xkeyscore is okay because all it does it give broad access to existing data.
Also of note is the NSA’s non-denial denial of the key Guardian claims: The NSA claims, on its website,
Allegations of widespread, unchecked analyst access to NSA collection data are simply not true. Access to XKEYSCORE, as well as all of NSA’s analytic tools, is limited to only those personnel who require access for their assigned tasks. Those personnel must complete appropriate training prior to being granted such access – training which must be repeated on a regular basis. This training not only covers the mechanics of the tool but also each analyst’s ethical and legal obligations. In addition, there are multiple technical, manual and supervisory checks and balances within the system to prevent deliberate misuse from occurring.
Which is no doubt true. Note that while their tone of voice is all, “Hey, only a select few analysts can see this,” nothing about that statement contradicts the idea that vast thousands of analysts have jobs that “require access” to xkeyscore. (As to the training that includes the legal obligations of the analysts, come on.)