CIA confirms agency obliged to follow federal surveillance law

The CIA has confirmed that it is obliged to follow a federal law barring the collection of financial information and hacking into government data networks.

But neither the agency nor its Senate overseers will say what, if any, current, recent or desired activities the law prohibits the CIA from performing – particularly since a section of the law explicitly carves out an exception for “lawfully authorized” intelligence activities.

The murky episode, arising from a public Senate hearing on intelligence last week, illustrates what observers call the frustrations inherent in getting even basic information about secret agencies into public view, a difficulty recently to the fore over whistleblower Edward Snowden’s revelations about the National Security Agency (NSA) and its surveillance partners.

Last Wednesday, in a brief exchange at the hearing, Senator Ron Wyden, an Oregon Democrat, asked CIA director John Brennan if the agency is subject to the Computer Fraud and Abuse Act, a three-decade-old law intended to protect computer systems, like those of financial and government networks, from unauthorized access.

Brennan demurred, citing the need to check on the legal complexities posed by Wyden’s question, and pledged to give the senator an answer within a week.

The answer, agency spokesman Dean Boyd told the Guardian, is: “Yes, the statute applies to CIA.”

Wyden gave no indication of what prompted his query. His office would not elaborate, citing classification rules, and neither would the CIA.

While Brennan affirmed to Wyden in an unclassified letter dated 3 February that the Computer Fraud and Abuse Act covers the CIA, he also noted that the act provides considerable leeway to the intelligence agencies.

“This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States,” a section of the act reads.

Wyden has a history of asking intelligence officials public questions about their operations that follow efforts in private to get them to open up more to the public about controversial practices. For years, he obliquely referred to secret government interpretations of the Patriot Act that permitted widespread data collection, a charge only given substance by Snowden’s leaks.

In the absence of additional disclosures, the colloquy has prompted speculation among intelligence watchers about what the CIA might be doing that would potentially violate the computer-fraud act.

In November, the Wall Street Journal and the New York Times reported that the CIA was amassing a substantial database of financial transactions, including some that involved Americans, ostensibly under Section 215 of the Patriot Act, the same statute cited by the NSA to collect the phone data of Americans in bulk.

A Senate report from 1986, when the Computer Fraud and Abuse Act was amended, noted that the “premise” of the amendment was “the protection, for privacy reasons, of computerized credit records and computerized information relating to customers’ relationships with financial institutions. This protection is imperative in light of the sensitive and personal financial information contained in such computer files”.

John Prados, author of the The Family Jewels: The CIA, Secrecy, and Presidential Power, said he suspected the agency was exploring ways to add data layers on to images captured by its surveillance drones to provide financial and other data “on an instantaneous basis or near-real time basis” about individuals it tracked – something that military contractors have experimented with for years.

Beyond speculation, close observers of the CIA said that the carve-out for “lawfully authorized” intelligence activities made it difficult to know whether the agency is substantively constrained by the act at all.

Steve Aftergood, an intelligence expert at the Federation of American Scientists, said there was a “deliberate murkiness surrounding this question”.

“CIA’s evasiveness on these matters may serve the agency’s short-term interest in deflecting unwanted attention, but it contributes to an atmosphere of distrust and cynicism that makes it harder to sustain intelligence operations in the long term,” Aftergood continued.

The NSA revelations are not the only backdrop for the colloquy between the Senate intelligence committee and the CIA, nor are they the only recent case that emphasizes the difficulty committee members face in conducting public oversight of the intelligence agencies.

The committee is also in a bitter dispute with the CIA over the declassification of a 6,000-page investigation into the agency’s Bush-era torture of detainees, which members say shows the agency misled the committee about the practice. The CIA disputes the investigation’s findings, but the panel argues that preventing a public release of the report undermines the committee’s ability to perform its oversight role.

At the hearing last Wednesday, Senator Mark Udall, a Colorado Democrat and frequent Wyden ally on surveillance issues, seemed to follow up Wyden’s question by referring to a seminal executive order, known as EO 12333, that blocks the CIA from much domestic activity.

“Can you assure the committee that the CIA does not conduct such domestic spying and searches?” Udall asked Brennan.

“I can assure the committee that the CIA follows the letter and the spirit of the law in terms of what CIA’s authorities are, in terms of its responsibilities to collect intelligence that will keep this country safe,” Brennan replied.