NSA Maps Secret Documents to Hunt Sources Who Risk Human Life
By Miriam Adler ·
Sources who jeopardize covert operations or risk human life are hunted through a clinical process of mirroring public words against secret files before the agency notifies the Department of Justice.
NSA/CSS Policy 1-27, dated March 20, 2006, does not concern itself with the legality of the information being leaked, but with the efficiency of the response. The document, mirrored by the FAS Intelligence Resource Program, establishes a clinical, step-by-step procedure for how the National Security Agency identifies and reports "unauthorized media disclosures of classified NSA/CSS information."
At the time this policy was revised, the agency was operating in the shadow of the Terrorist Surveillance Program, a period of warrantless surveillance of persons within the United States that the public record establishes as a sweeping collection of phone calls and internet activities. Policy 1-27 provides the internal plumbing for the agency's reaction when those secrets escaped into the public eye.
"Actively Monitor Media"
The document mandates a state of constant vigilance. Under the "Responsibilities" section, all NSA/CSS components—including "Extended Enterprise Organizations"—are ordered to ensure their workforce knows how to report leaks. More tellingly, the policy requires these components to "actively monitor media for the purpose of identifying unauthorized disclosures."
This monitoring is not left to chance or the occasional news alert. The policy designates the Corporate Communications Strategy Group (DC6) as the agency's official media organization, tasked specifically to scan the landscape for leaks and notify the Office of Information Policy (DC32). In a detail that reflects the digital shift of the mid-2000s, the agency's definition of "Media" is expansive, covering any print, electronic, or broadcast outlet, and explicitly including "blogs."
Risk to Human Life
Not every leak is treated with the same intensity. The policy creates a binary: a disclosure is either a standard unauthorized leak or it is a "Significant Disclosure." The determination of which is which is stripped away from the organizations that actually own the leaked information and handed to the Office of Policy and Records (DC3) and the Office of General Counsel (D2).
According to the document, a disclosure becomes "significant" if it is extensive in scope, indicates a "pervasive breach of security procedures," or is likely to have a "serious effect on national security interests." The examples provided read like a checklist of catastrophes: the loss of information that "could pose a risk to human life," the compromise of "covert or clandestine U.S. or liaison partner's intelligence operations," or disclosures that could "seriously impair foreign relations."
For the medical ethicist, the phrase "risk to human life" is the most haunting. In the context of an agency conducting warrantless surveillance, the document does not specify whose life is at risk—the agents, the sources, or the subjects of the surveillance whose privacy was breached. The priority is the protection of the "intelligence activities, sources, or methods," not the individuals caught in the machinery.
Tabs A and B
Once a potential leak is spotted, the agency initiates a process of forensic mirroring. The organization with purview over the leaked information is issued a tracking number. Within two weeks, they must submit a Staff Processing Form (SPF) to the lawyers and policy officers.
This form requires two specific attachments that turn a news article into a map of a crime. "Tab A" is a copy of the media item where the classified information is "bracketed," numbered, and assigned a classification level. "Tab B" is the corresponding internal NSA/CSS source document. In Tab B, the agency brackets the same information and places the numbers from Tab A next to the passages, "indicating clearly the suspected origin of the information in the media item."
This is the process of the hunt: lining up the public word against the secret word until the gap closes and the source is identified. Once this mapping is complete, if the leak is deemed "significant," the Office of General Counsel prepares correspondence to the Department of Justice "and any other appropriate law enforcement organizations."
The document ends with a series of questions the agency asks itself when a leak occurs. It asks if the information is accurate, if it had previously appeared in an open source publication, and if a FOIA request had been made for it. It asks, with clinical detachment, "What are the potential short-term and long-term impacts of the unauthorized disclosure?"
Policy 1-27 does not mention the public's right to know or the legality of the programs being leaked. It treats the truth as a contaminant and the journalist as a symptom of a security failure. While related files on the Northern District of Illinois court cases exist in the NSArchive, the specific outcomes of the leak hunts initiated under Policy 1-27 remain largely obscured.