The Intercept
May 28, 2015
AS MEMBERS OF CONGRESS struggle to agree on which surveillance programs to re-authorize before the Patriot Act expires, they might consider the unusual advice of an intelligence analyst at the National Security Agency who warned about the danger of collecting too much data. Imagine, the analyst wrote in a leaked document, that you are standing in a shopping aisle trying to decide between jam, jelly or fruit spread, which size, sugar-free or not, generic or Smucker’s. It can be paralyzing.
“We in the agency are at risk of a similar, collective paralysis in the face of a dizzying array of choices every single day,” the analyst wrote in 2011. “’Analysis paralysis’ isn’t only a cute rhyme. It’s the term for what happens when you spend so much time analyzing a situation that you ultimately stymie any outcome …. It’s what happens in SIGINT [signals intelligence] when we have access to endless possibilities, but we struggle to prioritize, narrow, and exploit the best ones.”
The document is one of about a dozen in which NSA intelligence experts express concerns usually heard from the agency’s critics: that the U.S. government’s “collect it all” strategy can undermine the effort to fight terrorism. The documents, provided to The Intercept by NSA whistleblower Edward Snowden, appear to contradict years of statements from senior officials who have claimed that pervasive surveillance of global communications helps the government identify terrorists before they strike or quickly find them after an attack.
The Patriot Act, portions of which expire on Sunday, has been used since 2001 to conduct a number of dragnet surveillance programs, including the bulk collection of phone metadata from American companies. But the documents suggest that analysts at the NSA have drowned in data since 9/11, making it more difficult for them to find the real threats. The titles of the documents capture their overall message: “Data Is Not Intelligence,” “The Fallacies Behind the Scenes,” “Cognitive Overflow?” “Summit Fever” and “In Praise of Not Knowing.” Other titles include “Dealing With a ‘Tsunami’ of Intercept” and “Overcome by Overload?”
The documents are not uniform in their positions. Some acknowledge the overload problem but say the agency is adjusting well. They do not specifically mention the Patriot Act, just the larger dilemma of cutting through a flood of incoming data. But in an apparent sign of the scale of the problem, the documents confirm that the NSA even has a special category of programs that is called “Coping With Information Overload.”
The jam vs. jelly document, titled “Too Many Choices,” started off in a colorful way but ended with a fairly stark warning: “The SIGINT mission is far too vital to unnecessarily expand the haystacks while we search for the needles. Prioritization is key.”
These doubts are infrequently heard from officials inside the NSA. These documents are a window into the private thinking of mid-level officials who are almost never permitted to discuss their concerns in public.
AN AMUSING PARABLE circulated at the NSA a few years ago. Two people go to a farm and purchase a truckload of melons for a dollar each. They then sell the melons along a busy road for the same price, a dollar. As they drive back to the farm for another load, they realize they aren’t making a profit, so one of them suggests, “Do you think we need a bigger truck?”
The parable was written by an intelligence analyst in a document dated Jan. 23, 2012 that was titled, “Do We Need a Bigger SIGINT Truck?” It expresses, in a lively fashion, a critique of the agency’s effort to collect what former NSA Director Keith Alexander referred to as “the whole haystack.” The critique goes to the heart of the agency’s drive to gather as much of the world’s communications as possible: because it may not find what it needs in a partial haystack of data, the haystack is expanded as much as possible, on the assumption that more data will eventually yield useful information.
The Snowden files show that in practice, it doesn’t turn out that way: more is not necessarily better, and in fact, extreme volume creates its own challenges.
“Recently I tried to answer what seemed like a relatively straightforward question about which telephony metadata collection capabilities are the most important in case we need to shut something off when the metadata coffers get full,” wrote the intelligence analyst. “By the end of the day, I felt like capitulating with the white flag of, ‘We need COLOSSAL data storage so we don’t have to worry about it,’ (aka we need a bigger SIGINT truck).” The analyst added, “Without metrics, how do we know that we have improved something or made it worse? There’s a running joke … that we’ll only know if collection is important by shutting it off and seeing if someone screams.”
Another document, while not mentioning the dangers of collecting too much data, expressed concerns about pursuing entrenched but unproductive programs.
“How many times have you been watching a terrible movie, only to convince yourself to stick it out to the end and find out what happens, since you’ve already invested too much time or money to simply walk away?” the document asked. “This ‘gone too far to stop now’ mentality is our built-in mechanism to help us allocate and ration resources. However, it can work to our detriment in prioritizing and deciding which projects or efforts are worth further expenditure of resources, regardless of how much has already been ‘sunk.’ As has been said before, insanity is doing the same thing over and over and expecting different results.”
Many of these documents were written by intelligence analysts who had regular columns distributed on NSANet, the agency’s intranet. One of the columns was called “Signal v. Noise,” another was called “The SIGINT Philosopher.” Two of the documents cite the academic work of Herbert Simon, who won a Nobel Prize for his pioneering research on what’s become known as the attention economy. Simon wrote that consumers and managers have trouble making smart choices because their exposure to more information decreases their ability to understand the information. Both documents mention the same passage from Simon’s essay, Designing Organizations for an Information-Rich World:
“In an information-rich world, the wealth of information means a dearth of something else: a scarcity of whatever it is that information consumes. What information consumes is rather obvious: it consumes the attention of its recipients. Hence a wealth of information creates a poverty of attention and a need to allocate that attention efficiently among the overabundance of information sources that might consume it.”
In addition to consulting Nobel-prize winning work, NSA analysts have turned to easier literature, such as Malcolm Gladwell’s best-selling Blink: The Power of Thinking Without Thinking. The author of a 2011 document referenced Blink and stated, “The key to good decision making is not knowledge. It is understanding. We are swimming in the former. We are desperately lacking in the latter.” The author added, “Gladwell has captured one of the biggest challenges facing SID today. Our costs associated with this information overload are not only financial, such as the need to build data warehouses large enough to store the mountain of data that arrives at our doorstep each day, but also include the more intangible costs of too much data to review, process, translate and report.”
Alexander, the NSA director from 2005 to 2014 and chief proponent of the agency’s “collect it all” strategy, vigorously defended the bulk collection programs. “What we have, from my perspective, is a reasonable approach on how we can defend our nation and protect our civil liberties and privacy,” he said at a security conference in Aspen in 2013. He added, “You need the haystack to find the needle.” The same point has been made by other officials, including James Cole, the former deputy attorney general who told a congressional committee in 2013, “If you’re looking for the needle in the haystack, you have to have the entire haystack to look through.”
THE OPPOSING VIEWPOINT was voiced earlier this month by Snowden, who noted in an interview with the Guardian that the men who committed recent terrorist attacks in France, Canada and Australia were under surveillance—their data was in the haystack yet they weren’t singled out. “It wasn’t the fact that we weren’t watching people or not,” Snowden said. “It was the fact that we were watching people so much that we did not understand what we had. The problem is that when you collect it all, when you monitor everyone, you understand nothing.”
In a 2011 interview with SIDtoday, a deputy director in the Signals Intelligence Directorate was asked about “analytic modernization” at the agency. His response, while positive on the NSA’s ability to surmount obstacles, noted that it faced difficulties, including the fact that some targets use encryption and switch phone numbers to avoid detection. He pointed to volume as a particular problem.
“We live in an Information Age when we have massive reserves of information and don’t have the capability to exploit it,” he stated. “I was told that there are 2 petabytes of data in the SIGINT System at any given time. How much is that? That’s equal to 20 million 4-drawer filing cabinets. How many cabinets per analyst is that? By the end of this year, we’ll have 1 terabyte of data per second coming in. You can’t crank that through the existing processes and be effective.”
The documents noted the difficulty of sifting through the ever-growing haystack of data. For instance, a 2011 document titled “ELINT Analysts – Overcome by Overload? Help is Here with IM&S” outlined a half dozen computer tools that “are designed to invert the paradigm where an analyst spends more time searching for data than analyzing it.” Another document, written by an intelligence analyst in 2010, bluntly stated that “we are drowning in information. And yet we know nothing. For sure.” The analyst went on to ask, “Anyone know just how many tools are available at the Agency, alone? Would you know where to go to find out? Anyone ever start a new target…without the first clue where to begin? Did you ever start a project wondering if you were the sole person in the Intelligence Community to work this project? How would you find out?” The analyst, trying to encourage more sharing of tips about the best ways to find data in the haystack, concluded by writing, in boldface, “Don’t let those coming behind you suffer the way you have.”
The agency appears to be spending significant sums of money to solve the haystack problem. The document headlined “Dealing With a ‘Tsunami’ of Intercept,” written in 2006 by three NSA officials and previously published by The Intercept, outlined a series of programs to prepare for a near future in which the speed and volume of signals intelligence would explode “almost beyond imagination.” The document referred to a mysterious NSA entity–the “Coping With Information Overload Office.” This appears to be related to an item in the Intelligence Community’s 2013 Budget Justification to Congress, known as the “black budget”—$48.6 million for projects related to “Coping with Information Overload.”
The data glut is felt in the NSA’s partner agency in Britain, too. A slideshow entitled “A Short Introduction to SIGINT,” from GCHQ, the British intelligence agency, posed the following question: “How are people supposed to keep on top of all their targets and the new ones when they have far more than [they] could do in a day? How are they supposed to find the needle in the haystack and prioritise what is most important to look at?” The slideshow continued, “Give an analyst three leads, one of which is interesting: they may have time to follow that up. Give them three hundred leads, ten of which are interesting: that’s probably not much use.”
These documents tend to shy away from confrontation—they express concern with the status quo but do not blame senior officials or demand an abrupt change of course. They were written by agency staffers who appear to believe in the general mission of the NSA. For instance, the author of a “SIGINT Philosopher” column wrote that if the NSA was a corporation, it could have the following mission statement: “building informed decision makers — so that targets do not suffer our nation’s wrath unless they really deserve it — by exercising deity-like monitoring of the target.”
On occasion, however, the veil of bureaucratic deference is lowered. In another “SIGINT Philosopher” column, “Cognitive Overflow?,” the author offered a forthright assessment of the haystack problem and the weakness of proposed solutions:
“If an individual brain has finite ‘channel capacity,’ does the vast collective of SID, comprised of thousands of brilliant, yet limited, brains also have a definite ‘channel capacity’? If so, what is it? How do we know when we’ve reached it? What if we’ve already exceeded it? In essence, could SID’s reach exceed its grasp? Can the combined cognitive power of SID connect all the necessary dots to avoid, predict, or advise when the improbable, complex, or unthinkable happens?”
The column did not offer an optimistic view.
“Take for example the number of tools, clearances, systems, compliances, and administrative requirements we encounter before we even begin to engage in the work of the mission itself,” the column continued. “The mission then involves an ever-expanding set of complex issues, targets, accesses, and capabilities. The ‘cognitive burden,’ so to speak, must at times feel overwhelming to some of us.”
The analyst who wrote the column dismissed, politely but firmly, the typical response of senior officials when they are asked in public about their ability to find needles in their expanding haystack.
“Surely someone will point out that the burgeoning amalgam of technological advances will aid us in shouldering the burden,” he noted. “However, historically, this scenario doesn’t seem to completely bear out. The onslaught of more computer power—often intended to automate some processes—has in many respects demanded an expansion of our combined ‘channel capacity’ rather than curbing the flow of the information.”
______
Documents published with this article:
• Too Many Choices
• Cognitive Overflow?
• Summit Fever
• Do We Need a Bigger SIGINT Truck?
• Overcome With Overload? Help is Here with IM&S
• In Praise of Not Knowing
• The Fallacies Behind the Scenes
• Leave Bright Pebbles, Not Breadcrumbs, for Those Coming After You
• ‘Data Is Not Intelligence’
• Is There a Sustainable Ops Tempo in S2? How Can Analysts Deal with the Flood of Collection?
• Dealing With a ‘Tsunami’ of Intercept
• SIGINT Mission Thread 3
