The process of “unmasking,” or revealing the true identities of U.S. persons who unexpectedly figure into conversations picked up by National Security Agency (NSA) foreign intelligence collection efforts, has been the subject of much discussion this week in the continuing controversy over Russian interference in last year’s elections.
The issue came up during Monday’s House Intelligence Committee hearing on the Russian controversy, as well as during the White House press briefing, in relation to former Trump administration National Security Advisor Michael Flynn. Flynn resigned after admitting he had lied to Vice President Mike Pence about his phone calls with Russian Ambassador Sergey I. Kislyak.
In the White House briefing, Trump spokesman Sean Spicer told reporters that before President Obama left office, “Michael Flynn was unmasked, and then illegally his identity was leaked out to media outlets.”
The issue arose again Wednesday when House intelligence chairman Devin Nunes (R-CA) called a surprise news conference to announce that he had seen U.S. intelligence agency intercepts that showed that legal foreign intelligence gathering had “incidentally collected” information about U.S. citizens involved in the Trump transition. He maintained that details about U.S. persons associated with the Trump administration had little or no apparent foreign intelligence value but were widely disseminated throughout the intelligence community. He asserted that “additional names of Trump transition team members were unmasked.”
So what are the legal procedures for handling unintended interception of U.S. persons during a foreign intelligence surveillance operation? Under the Foreign Intelligence Surveillance Act, the intelligence community seeks warrants to enable the NSA to conduct electronic surveillance on foreign entities, including foreign diplomats and agents of foreign powers. Warrants attained under the law’s Section 702 cover only those conversations between, and pertaining to, non-U.S. persons located outside of the United States. However, while 702 collection is intended to be foreign-focused, the advent of global communications and borderless data storage systems often means that the communications of U.S. persons are unintentionally gathered. These events are commonly referred to as incidental collection.
Due to civil liberties and privacy concerns, intelligence agencies implement minimization procedures to prevent the dissemination of information on U.S. persons that is not of direct foreign intelligence value.
When a U.S. person is unexpectedly referred to, or participates in, a monitored conversation under a 702 warrant, the information about the U.S. person must be destroyed unless it contains something of foreign intelligence value or evidence of a crime. If it is found to be of legitimate intelligence value in line with standard minimization procedures, it is retained. However, before further dissemination, the identity of the U.S. person must be disguised – the technical term is “masked” – using an identifier such as “[U.S. person 1].”
If an agency within the Intelligence Community needs to know the precise name of the person for intelligence purposes or a criminal investigation, there are strict procedures for making and granting such a request.
If an agency seeks to intentionally conduct surveillance on a U.S. person scooped up during foreign intelligence gathering, whether the U.S. person is inside the U.S. or abroad, the agency must obtain a separate FISA warrant from the Foreign Intelligence Surveillance Court (FISC).
According to Robert Eatinger, former Senior Deputy CIA General Counsel, FISA-collected information is initially put into a system to which a very limited number of people have access; those people are specifically trained “in minimizing out, removing, or not disseminating U.S. persons’ information and searching for information that is of intelligence value.”
A number of officials at the NSA, FBI, CIA and other U.S. agencies have at least some authority to request the unmasking of these U.S. persons, but the actual procedures for the unmasking are strict, as Rhea D. Siers, former NSA Deputy Associate Director for Policy, points out.
“As I recall,” she notes, “the process was rigorous and in writing – the identity had to be necessary to understand the foreign intelligence in a report and the rationale had to be recorded before a senior NSA official would agree to release. Other agencies obviously have different decision-makers, but the key is that unmasking is not automatic, and just because someone reading the report later decides they ‘want it’ – that is not sufficient to unmask the identity.”
Eatinger struck a similar chord, saying that a request for unmasking a U.S. person’s identity has to be unambiguous.
If, for example, FBI officials read a report referring to an unnamed U.S. person and decide they need to know his or her identity, Eatinger says ”they have to go back to whoever issued the report in the first place – NSA or CIA – and make a specific ask that they be told the name of that U.S. person.”
Both Siers and Eatinger said that it is hypothetically possible that a U.S. political figure’s communications could be retained and unmasked if collected incidentally – if, for example, a foreign intelligence official were in communication with a U.S. person, including a political figure or U.S. official.
Eatinger stressed, though, that without a legitimate intelligence connection, the U.S. official’s name would not be released. For example, he said, if a Russian intelligence officer being monitored for counterintelligence purposes indicated in a call that he was disguising his true identity in trying to gain information from a U.S. senator, and the FBI wanted to warn the senator, it could not do so without knowing who the senator was.
“But if there was no foreign intelligence connection at all, and it was a call that was wholly official and appropriate, then that senator’s name should never be released,” Eatinger said. “In fact, that call would probably not be considered foreign intelligence value, and never released to begin with, it would just stay in raw data.”
If the U.S. person were a campaign advisor, Eatinger said, a separate warrant would not be required for the first instance of incidental collection, but if more phone calls were expected, the collecting agency would have to get a separate FISA warrant on that person, making the case in court that the campaign advisor, for example, was of legitimate foreign intelligence interest for specific reason, with a certification from the FBI or CIA director or the Director of National Intelligence.
“Then it’s up to the court to determine whether you’ve met the standard of probable cause to believe that this overseas campaign advisor is an agent of a foreign power in order to collect his phone calls in the future.” Eatinger said.
The issue of unmasking has not received a great deal of public attention in the past, but that may change as the probe of Russian involvement in last year’s elections unfolds.
Steve Hirsch is the senior national security editor and Levi Maxey (@lemax13) is the cyber and technology producer at The Cipher Brief
