cryptogon.com

By Ellen Nakashima
Washington Post Staff Writer
Wednesday, November 7, 2007; D01

His first inkling that something was amiss came in summer 2002 when he opened the door to admit a visitor from the National Security Agency to an office of AT&T in San Francisco.

“What the heck is the NSA doing here?” Mark Klein, a former AT&T technician, said he asked himself.

A year or so later, he stumbled upon documents that, he said, nearly caused him to fall out of his chair. The documents, he said, show that the NSA gained access to massive amounts of e-mail and search and other Internet records of more than a dozen global and regional telecommunications providers. AT&T allowed the agency to hook into its network at a facility in San Francisco and, according to Klein, many of the other telecom companies probably knew nothing about it.

Klein is in Washington this week to share his story in the hope that it will persuade lawmakers not to grant legal immunity to telecommunications firms that helped the government in its anti-terrorism efforts.

The plain-spoken, bespectacled Klein, 62, said he may be the only person in the country in a position to discuss firsthand knowledge of an important aspect of the Bush administration’s domestic surveillance program. He is retired, so he isn’t worried about losing his job. He did not have security clearance, and the documents in his possession were not classified, he said. He has no qualms about “turning in,” as he put it, the company where he worked for 22 years until he retired in 2004.

“If they’ve done something massively illegal and unconstitutional — well, they should suffer the consequences,” Klein said. “It’s not my place to feel bad for them. They made their bed, they have to lie in it. The ones who did [anything wrong], you can be sure, are high up in the company. Not the average Joes, who I enjoyed working with.”

In an interview yesterday, he alleged that the NSA set up a system that vacuumed up Internet and phone-call data from ordinary Americans with the cooperation of AT&T . Contrary to the government’s depiction of its surveillance program as aimed at overseas terrorists, Klein said, much of the data sent through AT&T to the NSA was purely domestic. Klein said he believes that the NSA was analyzing the records for usage patterns as well as for content.

He said the NSA built a special room to receive data streamed through an AT&T Internet room containing “peering links,” or major connections to other telecom providers. The largest of the links delivered 2.5 gigabits of data — the equivalent of one-quarter of the Encyclopedia Britannica’s text — per second, said Klein, whose documents and eyewitness account form the basis of one of the first lawsuits filed against the telecom giants after the government’s warrantless-surveillance program was reported in the New York Times in December 2005.

Claudia Jones, an AT&T spokeswoman, said she had no comment on Klein’s allegations. “AT&T is fully committed to protecting our customers’ privacy. We do not comment on matters of national security,” she said.

The NSA and the White House also declined comment on Klein’s allegations.

Klein is urging Congress not to block Hepting v. AT&T, a class-action suit pending in federal court in San Francisco, as well as 37 other lawsuits charging carriers with illegally collaborating with the NSA. He was accompanied yesterday by lawyers for the Electronic Frontier Foundation, which filed Hepting v. AT&T in 2006. Together, they are urging key U.S. senators to oppose a pending White House-endorsed immunity provision that would effectively wipe out the lawsuits. The Judiciary Committee is expected to take up the measure Thursday.

In summer 2002, Klein was working in an office responsible for Internet equipment when an NSA representative arrived to interview a management-level technician for a special job whose details were secret.

“That’s when my antennas started to go up,” he said. He knew that the NSA was supposed to work on overseas signals intelligence.

The job entailed building a “secret room” in an AT&T office 10 blocks away, he said. By coincidence, in October 2003, Klein was transferred to that office and assigned to the Internet room. He asked a technician there about the secret room on the 6th floor, and the technician told him it was connected to the Internet room a floor above. The technician, who was about to retire, handed him some wiring diagrams.

“That was my ‘aha!’ moment,” Klein said. “They’re sending the entire Internet to the secret room.”

The diagram showed splitters, glass prisms that split signals from each network into two identical copies. One fed into the secret room, the other proceeded to its destination, he said.

“This splitter was sweeping up everything, vacuum-cleaner-style,” he said. “The NSA is getting everything. These are major pipes that carry not just AT&T’s customers but everybody’s.”

One of Klein’s documents listed links to 16 entities, including Global Crossing, a large provider of voice and data services in the United States and abroad; UUNet, a large Internet provider in Northern Virginia now owned by Verizon; Level 3 Communications, which provides local, long-distance and data transmission in the United States and overseas; and more familiar names such as Sprint and Qwest. It also included data exchanges MAE-West and PAIX, or Palo Alto Internet Exchange, facilities where telecom carriers hand off Internet traffic to each other.

“I flipped out,” he said. “They’re copying the whole Internet. There’s no selection going on here. Maybe they select out later, but at the point of handoff to the government, they get everything.”

Qwest has not been sued because of media reports last year that said the company declined to participate in an NSA program to build a database of domestic phone-call records out of concern about its legality. What the documents show, Klein contends, is that the NSA apparently was collecting several carriers’ communications, probably without their consent.

Another document showed that the NSA installed in the room a semantic traffic analyzer made by Narus, which Klein said indicated that the NSA was doing content analysis.

Steve Bannerman, Narus’s marketing vice president, said in an interview that the NarusInsight system is “the world’s most powerful Internet traffic processing engine.” He said it is used to detect worms, as well as to capture information to help authorities stop criminal activity. He said it can track a communication’s origin and destination, as well as its content. He declined to comment on AT&T’s use of the system.

Klein said he decided to go public after President Bush defended the NSA’s surveillance program as limited to collecting phone calls between suspected terrorists overseas and people in the United States. Klein said the documents show that the scope was much broader.