Do the upstream v. Prism collection numbers from Judge Bates’ 2011 opinion add up?

Edit: Bottom line up front: Several widely cited numbers about the FISA Amendments Act warrantless surveillance program — that circa 2011 the NSA was collecting >250 million communications annually, of which 9 percent came from upstream and 91 percent came from Prism — may be inaccurate.

_________

On Medium, Beatrice Hanssen, a writer whom I have not encountered before, has published a lengthy and interesting essay taking a closer look at Judge John Bates’ October 2011 ruling about the FISA Amendments Act and upstream collection — the one about Multi-Communication Transactions (MCTs) which the government declassified in August 2013 after the Snowden leaks.

[Background: a MCT is when multiple messages are bundled together and transmitted over the Internet as a unit. If even one of them has a targeted selector, like the e-mail address of a foreign suspect, the NSA’s Upstream collection system will get a copy of all of them — even though the rest of the messages have nothing to do with the target.]

The Bates opinion, and coverage of it, focused on the issue of wholly domestic messages that got sucked in via MCTs – there were several thousand of them. But Hanssen argues that an element of this has been underappreciated: various figures in footnote 32 of the Bates opinion suggest that the NSA is taking in about 2.65 million MCTs a year. While most of them do not have wholly domestic messages, this is nevertheless a potentially huge amount of collection – depending in part on what the average number communications bundled together into a single MCT is, which we don’t know. She argues that this means upstream surveillance conducted under the FISA Amendments Act is bulkier than generally portrayed. She also complains that the judges who dismissed the two big legal challenges to upstream, Jewel and Wikimedia, have conflated the distinction between transactions and communications when citing the Bates opinion, obscuring the volume of messages the NSA is ingesting.

That seems right to me. Still, once you get away from the special legal problems raised by the warrantless collection of wholly domestic messages on domestic soil, it strikes me as a probably less voluminous parallel to the issues raised by Executive Order 12333-authorized bulk collection. (Indeed it is possible that many or most of the MCTs would be redundantly captured by both systems.) Both raise the question of how we think about the privacy rights of “innocent foreigners,” as she puts it, as well, I would add, about incidental collection of one-end-domestic communications.

Beyond that, though, in thinking about her essay, it also occurred to me that some widely cited numbers derived from Bates’ opinion in common circulation  may be questionable. Specifically, Bates wrote that the NSA had told him that it collects “more than 250 million Internet communications” a year via the FISA Amendments Act, of which about 91 percent came from the Prism system and about 9 percent came from upstream. (Page 30-31)

Those figures have been echoed in a lot of places. Here they are in a Washington Post article, citing the opinion. The 250 million figure also shows up in the Privacy and Civil Liberties Oversight Board report about the FISA Amendments Act, also citing the opinion. And I cited them on page 217 of my book.

But is it possible that Bates was mixing apples and oranges? Or, rather, conflating “communications” – meaning discrete messages – with “transactions” – which, in MCT form, each contain many messages?

When we look closer at the total number of MCTs Hanssen draws our attention to, these figures start to look dubious. The footnote suggests that the NSA collects 26.5 million upstream transactions a year, of which 10 percent are MCTs, hence 2.65 million of those. If we assume that Bates was counting every transaction, singular or MCT, as one communication, the math kind of works: 26.5 million messages contributed by upstream is fairly close to 9 percent of >250 million total messages.

But once you think about the 2.65 million MCTs as each contributing multiple messages, the math starts to break down fast. When I asked ODNI a question about this during a briefing call with reporters when the ruling was released, the briefer used an example in which one MCT contained 15 discrete e-mails. That example, as Hanssen notes, would transform the 2.65 million MCTs into 39.75 million communications. Add in the other 23.85 million upstream transactions that were  single messages, and upstream has contributed 63.6 million messages to the annual haul — in this hypothetical.

We don’t know what the right average multiplier is — 15 could be too high, but it could also be too low. Still, it sure looks reasonable to conclude that either there were significantly more than 250 million total communications collected annually under the FISA Amendments Act circa 2011, or that upstream’s contribution to the whole was significantly more than 9 percent. Or both.