[Editor’s note: This is the continuation of a developing story about AT&T’s clandestine surveillance service, Hemisphere, which they secretly sold and marketed to law-enforcement agencies. Read the breaking story at the Daily Beast here.]
AT&T tells people — its customers, the public and the media — that its clandestine work with national-security and law-enforcement agencies is about compliance with the law.
I published a story in the Daily Beast on Tuesday that demonstrates that AT&T’s claim of merely “complying” with the law is false; rather, AT&T’s for-profit surveillance platform, Hemisphere, went above and beyond in its capacity to harness customers’ personal data and social relationships. My story was the latest such demonstration in a long string of exposés that have led to the company attempting to exonerate its surveillance efforts as “compliance.”
In response to my exposé, AT&T issued a boilerplate statement, saying that it was doing only what all service providers by law must do — in other words, the compliance excuse. It did include a small addition to previous statements that was equally mendacious. We’ll unpack that statement in a moment, but first, here’s a shameful history of AT&T’s surveillance programs.
In 2003 AT&T ordered a technician named Mark Klein to help the National Security Agency install a bug into Worldnet, AT&T’s Internet service, splitting cables directly from the light beam at its San Francisco exchange and running them to a covert listening station within the building in the now-infamous “room 641A.”
The public did not learn about this NSA tap until 2006, when someone leaked Klein’s testimony from an Electronic Frontier Foundation lawsuit to WIRED. Even after his account was made public, the NSA spy-room tale was too X-Files for most people to believe. Klein was vindicated in 2013 when Edward Snowden gave details about many of the NSA’s secret projects to the world.
AT&T made it about a year and a half without another spying scandal, until the New York Times’ September 2007 report, “FBI Cast Broad Net in Secretly Tracking Americans’ Associates.” The “broad net” in question was, in fact, an AT&T design — known as “Communities of Interest.”
AT&T invented a metadata surveillance programming language named Hancock in 2001, a variation of C (also an AT&T invention). Hancock was originally for catching long-distance-call fraudsters, back when anyone knew what a “long-distance call” was, and was used to data-mine all AT&T’s call records, including historical and live data. Hancock automatically sorts the records of who called whom to create Communities of Interest — essentially, a two-generation map of callers’ personal associations consisting of every person a person has called, plus everyone those people have called.
AT&T had regularly been providing this business intelligence to the FBI through confidential requests called National Security Letters — no warrant involved — but we didn’t hear about it until Verizon told Congress. Verizon wrote a letter to members of the House in 2007, saying that while it had provided records to the FBI without a warrant, the FBI had also asked for something it didn’t have: Communities of Interest. It turned out that AT&T’s system had been spoiled.
We first heard about AT&T’s secretive program, Hemisphere, in 2013, when the New York Times revealed that Hemisphere was begun at about the same time Congress found out about the Communities of Interest. In between, luckily for AT&T (as Edward Snowden pointed out to me on Tuesday night), Bush pushed for and won qualified immunity for all telecom companies who’d illegally spied for his administration since 9/11 as part of the Protect America Act of 2008. In other words, despite the revelations, AT&T was protected against prosecution. Yep.
In 2013 AT&T pulled out that aforementioned boilerplate statement, similar if not exactly like the first paragraph of the one they sent me recently, which reads as follows:
“Like other communications companies, if a government agency seeks customer call records through a subpoena, court order or other mandatory legal process, we are required by law to provide this non-content information, such as the phone numbers and the date and time of calls. These types of legal demands are referenced in the law enforcement section of our Transparency Report.”
This last line was not in the 2013 statement, as AT&T did not issue a transparency report until the revelations of 2013 created pressure for it to do so.
Hemisphere — very briefly — is a service AT&T provides to law enforcement, mostly without a warrant, that includes searching trillions of call-detail records (the who-called-whom records and more, so long as it’s not the actual content of the call or text). AT&T analysts can potentially search the entire AT&T database — about a million gigabytes. The company saves the data from every call, text or VoIP chat that uses its network, not just from AT&T subscribers, and it’s been saving much of it for almost 30 years. When AT&T searches Hemisphere for the police, it is searching the history of millions of callers to see where one number might intersect with others in revealing patterns, ostensibly to provide the police with brand-new criminal leads and suspects.
Some of that we knew in 2013, but AT&T would not confirm its involvement, and the PowerPoint slides that were the core of the Times report were internal DEA documents that gave the company a deniability gap.
On Tuesday we published an AT&T document, a “Statement of Work” for Hemisphere services provided in Atlanta, proving that AT&T is not only involved with Hemisphere, but that it is its product for which it is paid millions of dollars.
When I reached out for comment to AT&T, I received the statement quoted above, along with the following “clarification”:
“For clarity, we retrieve legally-demanded records from the same corporate database that we use to respond to all law enforcement or civil legal demands for call records. There is no special database. Government personnel do not have access to the database. The very small number of our employees working these legal demands are not co-located with government personnel. We are not paid for the records, but we are compensated for having employees available to receive the legal demands and respond in a timely manner.”
A generous person might call this statement “literally accurate,” but then again they might not.
The claim that government personnel don’t have access to the database checks out with our documents, which say that AT&T will perform analysis at a separate, nearby location.
But the above statement makes it sound like the only difference from the routine is a few extra headset-wearing employees dedicated to taking calls from police.
Telcos must by law surrender data in their possession to law enforcement, and they must make their networks technologically accessible to lawful intercept. They don’t have to design networks and create data schemes to revolutionize metadata surveillance and make these obligations profitable.
AT&T’s own documentation also shows that they arranged for the IBM i2 component of the system to be used in Atlanta — the company was waiting on an IBM quote to provide its own exact figure, according to a margin note. [Editor’s note: IBM i2 is an information-analysis environment, which AT&T was ostensibly using for managing its surveillance programs.] Company documents also say AT&T will provide storage of records “for deconfliction purposes,” meaning they will compile a database of records already retrieved to avoid conflict or overlap with existing or future investigations.
But to give AT&T the benefit of the doubt for a moment, imagine that this database is not “special,” but a routine piece of AT&T. AT&T’s above statement would still be fundamentally misleading. The breadth of relationship tracking between callers goes beyond any “routine” surveillance aspects of running a telecom company, and can be described only as having been specially built for law-enforcement surveillance.
How AT&T Used Hemisphere
One of Hemisphere’s most useful features is supposed to be performing “dropped-phone analysis” or “new-phone analysis” — essentially, tracking a person over time through successive phone numbers on the basis of a calling pattern. It’s powerful technology but less complicated than it may sound.
Let’s say a narcotics task force is trying to maintain a wiretap on a drug dealer, but the drug dealer uses prepaid “burner” phones and is constantly changing his number.
However, from each new phone number, this drug dealer makes calls to many of the same people — his mom, girlfriend, a supplier — and also makes most of his calls from a limited range of locations. Because AT&T can analyze so many call-detail records with such well-developed custom software, it can easily track these patterns to infer which unknown number is really the suspect. Since it can do this in real time by mining its live data stream, by the time the suspect burns an old phone and makes a few calls from his new one, he’s back in the net.
AT&T provides this feature along with dozens of others designed to integrate with still other widely deployed surveillance products. The only way this could be reduced to “routine” data collection — generous hats, please — is if AT&T was doing all of this anyway, just because. Telcos must by law surrender data in their possession to law enforcement, and they must make their networks technologically accessible to lawful intercept. They don’t have to design networks and create data schemes to revolutionize metadata surveillance and make these obligations profitable.
Now that AT&T is asking us to trust it enough to grow bigger with an $85 billion acquisition of Time Warner, we should keep its treatment of “compliance” in mind.
