NSA Isn’t the Going Dark Solution, Part III: “Beat Me If You Can”

In the first two parts of this series, I noted the general tendencies of the FBI’s critics to assume away the problems posed by Going Dark by insisting that the NSA—or the intelligence community more broadly—can and will find methods of exceptional access when the police really need them to. In part two, I examined how this presumption has negative consequences for an important nation debate. And further, I posited the significant problems that would arise, even if the IC actually lacked a given capability, from a legal obligation that the FBI consult with intelligence agencies before compelling non-party assistance to effectuate a criminal warrant.

Here, for argument sake, let’s assume the converse: that the NSA can unlock the phone. In order to take the spell of this magical thinking even further, let’s presume that NSA can unlock all phones everywhere and will be able to unlock all phones in the future. Before going down this path, it is worth pausing here to note that while the NSA is very good at its job, it remains bound by both the laws of math and engineering, as well as the practical limitations of the discipline. While it surely has capabilities the outside world lacks, those capabilities do not involve suspending proven mathematical theorems. But never mind all that for now. It’s fun to imagine the NSA as all-powerful, either for good or for ill. So let’s run with that for a moment.

In this hypothetical, NSA can unlock all devices “dark” to ordinary law enforcement now and in perpetuity. Should it do so on behalf of Jim Comey for the purpose of domestic investigations? Do we want a rule of law in which, as Richard Clarke suggests, Comey is expected to pick up the phone each time he confronts a device he can’t handle himself and ask Admiral Rogers to wave his magic wand? Is this really the path we want to go down?

Consider the cascading consequences. If NSA provides this kind of forensic assistance, what now are its obligations under the Confrontation Clause? Does NSA also have to explain in court exactly how it achieved the goal, or provide its experts for cross-examination? What about if it developed a capability together with a foreign government ally or just received the capability from that ally; how would the executive reconcile international agreements or obligations? And would this type of assistance to law enforcement be sufficient to constitute alignment between law enforcement and the IC for purposes of discovery, disclosure of Brady material, and the like?

None of this is to say the branches could not conceivably resolve these questions, which are only a few among the many. But it illustrates the astonishing complexities at play in the blithe assumption that NSA can simply solve the problem and highlights that there is nothing “simple” about this solution at all.

Introducing classified materials into a criminal justice system based on transparency is always dicey. The division of these worlds serves an important civil liberties function. A complex structure has developed to accommodate the relatively limited instances in which classified information does interact with prosecutions—primarily based on the Classified Information Procedures Act. And while these mechanisms are critical to preserve the balance of constitutional rights, they fall short of the ideal. CIPA hearings, as they are known, take place ex parte between the government and the magistrate. And while ex parte procedures are necessary, they are a necessary evil. As a baseline proposition, a defendant in a criminal trial should have the right to have visibility into the case against him. The circumstances in which that right is constrained should be limited as narrowly as possible, and some would argue far more tightly constrained than they are now.

Turning to the intelligence community as a solution to the Going Dark problem increases the interaction between the classified world and the criminal justice system at a time when there are good reasons to support more separation, not less.

There’s another big reason not to turn to NSA: We shouldn’t want NSA’s legal tools at play in these cases. The question of the intelligence community’s ability to unlock a phone was posed to former NSA Deputy Director Chris Inglis at a recent panel he and I appeared on together at the Bipartisan Policy Center. Inglis noted:

The authorities … of the National Security Agency and the Federal Bureau of Investigation are different. They are distinguished authorities. They may use oftentimes the same techniques. But I don’t think you want the same relationship between the FBI and the private sector within the United States that NSA might have with some entity operating north of Pyongyang, North Korea. I don’t think you want the private sector saying to the FBI “Beat me if you can.”

If there is a collaborative arrangement that allows us to essentially, at once, protect the distinguished interests of individuals and collections of individuals and the vitality of the private sector, we ought to find that. We ought to do that such that everyone understands precisely how that works.

Inglis’s point is critical—and consistently missed by the Richard Clarkes of the world: Do we actually want a system wherein the US intelligence community adopts an adversarial posture towards US companies? It is not simply NSA’s technical capabilities that make it effective; it is also its legal authorities in the environments in which it operates, which permit far more than we allow the FBI domestically.

I’m neither permitted nor inclined to link to the copious leaked documents and news reports regarding the various capabilities and activities of our intelligence agencies overseas. But let your imagination run wild. Assume that even some fraction of these reports are true about what NSA is allowed to do abroad. There are activities we expect and authorize the intelligence community to undertake in gaining intelligence against foreign adversaries that would be unthinkable, both legally and as a policy matter, within the United States. In other words, if you want the NSA to work its hypothesized magic, it’s not enough to have all the mathematicians, nerds, and engineers. It’s also a question of legal powers and an assigned mission the FBI does not have and, everyone should agree, should not have.

Think about Inglis’s comments as you read this statement by Susan Landau before the House Judiciary Committee the other day:

The FBI needs to take a page from the NSA. You may recall that in the late 1990s, the NSA was complaining it was going deaf from encrypted calls? Well, they've obviously improved their technology a great deal. According to Mike McConnell, from that time until now, NSA had better SIGINT than any time in history. What we need is law enforcement to developed 21st century capabilities for conducting electronic surveillance. Now, the FBI already has some excellent people and expertise, but FBI investment and capacity is not at the scale and level necessary. Rather than asking industry to weaken protections, law enforcement must instead develop a capability for conducting sophisticated investigations themselves.

Landau’s comments demonstrate a widely-held corollary which is related to, but distinct from, the Clarke “just ask NSA” view: that the fundamental difference between the capabilities of the FBI and the NSA are those of funding and technology and that FBI should simply develop those capabilities.

But this too misses the critical reality: though capabilities certainly differ, the fundamental difference between the FBI and NSA is one of legal authorities, not technology or expertise. If we want our government to undertake the job of preserving the capability—without assistance—to access content held on devices manufactured by American companies in order to obtain such content for domestic law enforcement purposes, then this requires changes in law and in mission.

When Clarke casually asserts that “all experts” he knows believe that NSA can unlock the phone, the confidence he is describing is confidence of a specific sort: that in a world of no rules, of limitless funding, and of world-class technical expertise, there is surely some mechanism to access the data on any phone. In our hypothetical—though not in reality—NSA occupies precisely such a world. But the real world of foreign signals intelligence is certainly a lot closer to that one than the one FBI occupies in domestic law enforcement. What Clarke isn’t telling you is that the part of “no rules”—which translates in reality to a world of “fewer constraints”—is very important to mission success in projects like this one.

Do we really want the “fewer constraints” model applied for domestic law enforcement purposes? The question answers itself. And without it, NSA’s magic—to whatever extent it exists at all—will surely disappoint.

So remember: When Clarke talks about assigning this task to NSA, he is either talking about expanding NSA’s mission to include routine elements of domestic law enforcement forensics or he is talking about removing the legal constraints that currently prevent the FBI from obtaining said capacity. And Landau's solution of making the FBI more NSA-capable, requires more than funding and technical expertise.

There is no way to ask NSA to solve our Going Dark problem without profoundly eroding the notion that spies and cops do not operate the same domain, that the domain of domestic law enforcement is no place for a signals intelligence agency, and that any interactions should be limited and tightly controlled. Unless we are prepared to genuinely confront the tradeoffs necessary to make this a meaningful solution, it’s time to move on from a diversionary narrative designed to falsely reassure that, yes, we really can have it all.