UNCLA3S I F I EC

NATIONAL SECURITY AGENCY OI'IICEOV niR 1NSPRCT0B G K N R R A J 11 September 2013

t'i;N~i'HAi.si-x'i'Rn'vsr.R\'ii"i-;

Sen. Charles L . Q r a w l t y Ranking Member Comniiltcc on the Judiciary United Stales Senate 152 Dirk sen Setuiie Office Building Washington. D C 20510 Senator Gnissicy: I write in response to your letter o f 27 August 201? requesting intentional and willful misuse o f surveillance million ties. infnrrndlirm about

Since I January 200."!, there h a w been 12 substantiated inslanees of intentional misuse o f the signals intelligence (SIG1NT) authorities o f the Director o f the National Security Agency, Ihe N S A Office of the Inspector General (OIG) eurrenllv has two open investigations into alleged misuse o f S1G1N I and is reviewing one allegation for possible investigation.

I. C i v i l i a n Employee, Foreign Location In 201 I, before an upcoming reinvestigation polygraph, the subject reported thai in 2004. "out of curiosity." be performed a SICiINIT query of his home telephone number and the telephone number of his girlfriend, a foreign national. The SIG1NT system prevented the query on ihe home number because it was made on a U S person I'he subject viewed the metadata returned by the query on his girlfriend's telephone. The appropriate O f G conducted an invesiigation. 't he subject's actions were found to be in violation o f United Slates Signals Intelligence Directive ( U S S I I 18' (Legal Compliance and L'.S. Person Minimization Procedures), The matter was referred lo Do.l in 2011 ['or possible violations o f 18 IjLS.C $H.1 (embezzlement and theft) and IK C . S . C . ^251! {interception and disclosure of electronic communications). In 2011. Do.l declined prosecution. The subjeel retired in 2<H2 before disctpHnarj action bad been taken.

U N C L A S P J h 'ltiL-

UNCLASSIfIED

2. C i v i l i a n E m p l o y e e . Foreign Location In 200?. (hiring a pre-retirement reinvestigation polygraph and interview, the subject reported ihat. in 200?. be tasked S K i I N T collection of dte telephone mmiU i o f his foreignnational gtrifncnd without an authorized purpose for approximately one month lo determine whether she was "involved with any |local j government officials or other activities that might get | It tin I in trouble." The N S A O K i determined lhat the subject's actions violated Executive Order 1 2 ^ 3 ^ . D e O Regulation 524<i. I-R. 5 C T . R . j 2&35.704. mid N S . V C S S P M M 30-2. Chapter 5*6. H W and 3- L Ihe O K I ' s report was shared with the N S A Office of General Counsel l O G C ) for tin assessment as to whether referral to Do.l was appropriate. Records are insufficient to determine whether a referral was made. The subject retired before the O K i investigation was finalized. 3. Civ ilian E m p l o y e e , F o r e i g n L o c a t i o n In 2004. upon her return from a foreign site, the subject reported to N S A Security that, in 201)4. she tasked a foreign telephone number she had discovered in her husband's cellular telephone because she suspected thai, her husband had been unfaithful. The tasking resulted in \ oice collection o f her husband. I be N S A O K i determined that the subject's actions violated USS1D 1 K. L'secutive Order 12333, 5 C . F . R . 3 6 3 5 . 7 0 4 . and D o D Regulation 5 2 4 0 . 1 - l i . and possibly IX I .S C . 52511 (interception and disclosure o f electronic communications). The O K i report was forwarded to N S A ' s O O C . which referred the matter to Do.l. Ihe subject of the investigation resigned before the proposed discipline of remov a! was administered 4. C i v i l i a n E m p l o y e e . Foreign Location In 2003. ihe appropriate O K i was notified that an employee U S S I D 18. A female foreign national emploved bv the I .S. government, was having sexual relations, told another government employee lhal subject was listening to her telephone calls. The other emplov ee reported had possibly violated with whom ihe subject she suspected thai the ihe incident,

Ihe investigation determined dial, from approximately | W K to 2003. the employee tasked nine telephone numbers of female foreign nationals, without a valid foreign intelligence purpose, and listened to collected phone conversations while assigned lo foreign locations. The subject conducted call chinning on one o f the numbers and tasked the resultant numbers, l i e also incidentally collected the communications of a U . S . person on two occasions. I he appropriate agency referred ihe matter to Do.l. The subject was suspended without pav pending the outcome s f t h f investigation and resigned before discipline had been proposed

U N C I

. A S S I F T

E P

5. Civ ilian E m p l o y e e , Foreign Loearkia I he employee's agency discovered that an etuptoyea had misused the S K J I N T collection system between 2001 and 2003 hy targeting three female foreign nationals; The appropriate O K i conducted an investigation. I he violations were referred lo DoJ. I he subject resigned before disciplinary action was taken.

6. ( ivilian E m p l o y e e , Foreign Location As the result o f a polygraph examination, it was discovered that an emplov cc had accessed the collection ol' communications on two foreign nationals. The employee's agency concluded its investigation in 2006. mid the subjeei received a one-year letter of reprimand (prohibiting promotions, awards, and within-grade increases) and a 10 day suspension without pay. ihe subject's pending pormancnt-change-ol-station assignment was cancelled, and his promotion recommendation was withdrawn.

7. C i v i l i a n Employ ee, Foreign Location In 201 I. the N S A O I G was notified thai, in 201 1, the subject had tasked the telephone number of her loreign-naiionu! boyfriend and other foreign nationals and thai she reviewed the resultant collection. The subject reported this activity during an investigation into another mailer. The subject asserted that it was her practice to enter foreign national phone numbers she obtained in social sellings into the S I G I N T system lo ensure that she was not talking to "shad> characters" and to help mission. The appropriate O K i found thai the subject's actions polenliallv violated Executive Order l . 7 ( c H O . and Dot) Regulation 5240.ML. I'rocedure 14.

12333, Part

I he appropriate O K i referred the matter to D i d in 2 0 1 I as a possible violation o f IS U . S . C , $251! (interception and disclosure of electronic communications). Ihe resigned before disciplinarv action had been imposed.

subject

X. M i l i t a r y M e m b e r , ( O N U S Site In 20115. the N S A O I G was notified thai, on the subject's first day o f access to the S I O I N I collection system, lie o,ueried six e-mail addresses belonging to a former girlfriend, a U . S . person, wilhout authori/mion. A site review o f S I G I N T audit discovered Ihe queries four dtivs after thev had occurred.

uwnAssjpiEn

The subject testified that he warned to practice oh die system and had decided to use this former girlfriend's e-mail addresses. Me also testilicri thai he received no information as a remit of his queries and had not read 80$ I .S. persons e-mail. the N S A OICi concluded that the subject's actions violated I SSI!) 18. IxeCLilivc Order 12335. 5 C F R &26M.7G4. and Dot) Regulation 5240.1-R. The O K I report was forwarded to the site command and the O G O A s a result o f a I inform Code of Military Justice Article 15 proceeding, ihe subject received a reduction in gnidc. 45 davs restriction. 45 days of extra duly, and half pa) for two months, li was recommended that ihe subject nol be given a security clearance.
!

9. C i v i l i a n E m p l o y e e , C O N US SiteIn 2006. the Office o f Oversight and Compliance within N S A ' s Signals Intelligence Directorate informed N S A O K i that, between 2005 and 2006. the subject had without authorization queried in two SIGIN'T svsteius the telephone numbers o f two foreign nationals, one of whom was his girlfriend, f >n one occasion, the subject performed a text query o f his own name in a SIC i l N T system. Ihe O K I investigation found that the subject queried his girlfriend s telephone number on main occasions and her name on [wo. Me testified that he received only one "hit" from Ihe queries on the girlfriend. Another number he queried, that of a foreign national language instructor, returned "insignificant information.'" The subject claimed thai he queried his name to see i f anyone was discussing his travel and the lelephnne numbers lo ensure that there were no security problems Ihe O K i concluded that Ihe suhjeci's actions violated Executive Order 12333. 5 C.I-.R. S2635.704. D o D Regulation 5240.1 -R. and N S A C S S P M M , < 'hapier 36d i General Principles foi on the job conduct; 1 se of Government Resources, and insubordination).
;

1 he Agency has been unable lo locale records as to whether a referral was made lo DoJ. Hie subject resigned from the Agency helbrc ihe proposed discipline o f removal had been administered. 1(1. C i v i l i a n Employee, ( O N U S Site In 200S. Ihe N S A O l d was notified lhal a S I G I N T audii had discovered a possible v iolation o f USS1D IX. A n investigation revealed that, while reviewing the communications o f a valid intelligence targe;. Ihe subject determined that the intelligence target had a relative in the U.S. I he subjeei queried the S I G I N I system for the e-mail address of the intelligence target in 200S! and used other search terms In obtain information about the target's relative.

U N C L A S P f P I ED

The DIG concluded thai the subject's actions violated I SSID i s . Executive order 12333. and D o O Regulation S240.I-R. ! he OIG report was Forwarded lo N S A ' s OGO. 1 he suhjeci received a whiten reprimand.

II. M i l i t a r y M e m b e r , Foreign L o c a t i o n In 2i)W. Ihe N S A Old was notified that, in 20UV. a BtiuUf) member assigned Ui a military laetiea! intelligence unit queried ihe communications o f his wife, who' was also a m i l i i a n niemher Stationed in a foreign location. Ihe misuse was discovered hv a review o f SIGINT audi! lugs. The investigation IJJ his miliian. unit substantiated the misuse. I hrnugh a I inform Code o f M i l i i a n lustice Article I 5 proceeding, the memher received a reduction in rank. 45 days extra duty, and hall" pay tor two months. The member's access lo classified information was revoked. In 2iW-> this matter was referred lo D o J .

!2. M i l i t a r y M e m b e r , Foreign L o c a t i o n In 20(1'). a militar> unit at a foreign location notified the N S A O K I that, in 2W >. a inililarv member had queried a country's telephone numbers to aid in learning that country's language, the misuse was discovered b> a re\ iew o f S I G I N T audit logs
l

The appropriate branch o f the military determined that the analyst's queries were not in support o f his official duties and \ iolated U S S I D [

The member's database access and access to classified information were suspended.

I hope that this information satisfies > our request. Sincerely.

|>r. George M l ard Inspector General

cc: Sen. Patrick I eah\