Digital capture and physical kill

Posted on June 10, 2015 by Derek Gregory

When he was the US Air Force’s deputy chief of staff for Intelligence, Surveillance and Reconnaissance (ISR) Lt Gen David Deptula frequently warned about the danger of ‘swimming in sensors and drowning in data‘. He was talking about crossing what he saw as the divide between ‘industrial age’ and ‘information age’ warfare, and specifically about the extraordinary volumes of data captured as full-motion video feeds from Predators and Reapers:

Dan Gettinger provides an excellent overview in ‘Drone geography: mapping a system of intelligence’ here. But there are other systems of intelligence involved in these strikes and other forms of what Deptula called ‘data crush’.

Operating in close concert with real-time ISR carried out from these remote platforms are other modes of digital data capture, not least the panoply of communications intercepts carried out by the National Security Agency. In many cases the targets Air Force crews are tasked to track and ultimately to kill by the CIA or the US military have been identified through SIGINT (signals intelligence) derived from ‘harvesting’ e-mails, text messages and cell phone calls.

These have become increasingly important in today’s wars where the targets are often mobile. E-mails can provide a vector of likely locations to be watched from the air, while call and messaging data reveal general vectors of movement:

(The tracks above are taken from an NSA report on ‘SKYNET: Courier detection by machine learning’ released by The Intercept).

But it’s important not to misrepresent this as system of total surveillance: as Grégoire Chamayou insists, ‘it matters less to the NSA to actively monitor the entire world than to endow itself with the powers to target anyone – or, rather, whomever it wishes’ (what he calls ‘programmatic surveillance’).

It’s programmatic in several senses beyond the legal-political armatures that Chamayou initially emphasizes: it also implies, crucially, algorithmic executions. The software programs used by the NSA and associated agencies to tunnel into this data and extract signals from the noise are myriad – see for example this NSA white paper on ‘co-traveller analytics‘ – but even armed with these deadly algorithms (see also here) there is a concern about data crunch.

Writing in the Washington Post Ashkan Soltani and Barton Gellman reported that in 2012 FASCIA, the NSA’s databank, was ingesting almost 5 billion records a day:

Hence, as Peter Maass reports in The Intercept, the NSA’s own officers have become alarmed at rising metadata levels. In 2011, for example, a deputy director in the Signals Intelligence Directorate was asked about ‘analytic modernization’ at the agency

“We live in an Information Age when we have massive reserves of information and don’t have the capability to exploit it… I was told that there are 2 petabytes of data in the SIGINT System at any given time. How much is that? That’s equal to 20 million 4-drawer filing cabinets. How many cabinets per analyst is that? By the end of this year, we’ll have 1 terabyte of data per second coming in. You can’t crank that through the existing processes and be effective.”

I’m working my way through these files as part of my ‘Deadly dancing’ essay on targeted killing in Pakistan’s Federally Administered Tribal Areas. I’m particularly interested in the ways in which these two systems of digital capture – signals intercepts and video-feeds – intersect. On occasion, the two systems even become one: for example, the NSA’s GILGAMESH program relies on sensors attached to a Predator to track a cell phone to within 30 feet of its location while SHENANIGANS similarly ‘vacuums up massive amounts of data from any wireless routers, computers, smart phones or other electronic devices that are within range’.

In any event these two, closely connected systems of digital capture are also often the harbingers of a physical kill. As Michel Hayden, former director of the NSA and the CIA, admitted to David Cole last year: ‘We kill people based on metadata.’

And the reliance on algorithms and the expert systems they animate ensures, as Louise Amoore insists, that ‘there is then nothing exceptional about the exception; they are derogated to and derive from “expert knowledges”.’

As Louise’s comment implies, all of this speaks directly to the FATA as a space of exception, and the first section of my essay treats its production in detail (you can find early sketches here and here); but in the second section I connect this to the FATA as a space of execution. Formally, I suppose this and its derivative expert knowledges parallel Stuart Elden‘s suggestion that territory be treated as a political technology, but the space of execution (like the space of exception) has a paradoxical topology since here and elsewhere its calculus enables the United States to enact an extra-territorial claim over the territory of another sovereign state.

Drone strikes in the FATA then appear as the deadly tip of an extended spear, the product of a dense network of collaboration and calculation between the CIA (which directs the strikes), the NSA and its associated agencies (which provide the geospatial intelligence), and the US Air Force (which executes them).

The intelligence component of the network is transnational. There is a long history of often fraught collaboration between the CIA and Pakistan’s Inter-Services Intelligence, and the NSA also derives what it calls ‘locational intelligence’ from its Five Eyes partners – the UK, Australia, Canada and New Zealand – and its Tier II partners which are contracted for specific projects and paid for their services: an NSA document for 2013 in the Snowden cache shows that this includes Pakistan, but it is impossible to know when this contractual relationship started and whether it has been discontinued.

The NSA also conducts a version of ‘remote split’ operations. Just as Predators and Reapers are controlled from the United States via satellite link and fiber-optic cable (once forward deployed crews have handled the take-off) – see the slide above – so much of the NSA’s interception and analysis of global communications takes place in the United States, harvesting data through two overarching systems:

1 Intercepts of foreign communications from submarine fiber-optic cables, the physical channels of the web; these are UPSTREAM intercepts conducted ‘as data flows past’ under legal authorizations that flow from Section 702 of the Foreign Intelligence Surveillance Act (FISA: passed under Bush and extended under Obama and permits the monitoring of electronic communications of foreigners abroad); some take place at more than a dozen switching stations within the US, exploiting its pole position within the web, while the rest take place overseas, often in conjunction with other intelligence services (FVEY and Tier II ‘Third Parties’); multiple software programs [FAIRVIEW, BLARNEY, STORMBREW, OAKSTAR] are used to harvest the data, which together amount to c. 9 per cent of Internet traffic collected under S702.

You can also find a stunning interactive map that attempts to annotate the submarine cable intercepts based on the Snowden cache here.

2 Direct collection of data from servers of major Internet companies and corporations (Google, Microsoft, AOL, Skype etc) in response to demands under S702 that requires ISP to turn over any data matching court-approved search terms; these are DOWNSTREAM intercepts because the data has already been collected by the companies (un)concerned; the data include e-mails and social network activity, and together these intercepts are the major source of raw intelligence, accounting for 91 per cent of Internet traffic collected under S702. The chart below from The Verge refers to the NSA collecting ‘your’ data but the ‘you’ is a global collective. PRISM – ‘the code name for a data-collection effort known officially by the SIGAD US-984XN…. that collects stored Internet communications based on demands made to [US] Internet companies’ started in 2007; this too exploits what the NSA calls the US’s position as ‘the world’s telecommunications backbone.’

1 and 2 provide DNI data [Digital Network Intelligence]; but 1 also allows the harvesting of DNR data [Dialed Number Recognition] and, according to a PRISM briefing slide dated April 2013, is ‘coming soon’ to 2 (PRISM).

According to Boundless Informant, an NSA collection visualisation tool, during a 3-day period ending in March 2013 DNI intercepts from Pakistan accounted for 13.9 per cent of global DNI intercepts (#2 after Iran, which accounted for 14.5 per cent) and 11.1 per cent of global DNR intercepts (#2 after Afghanistan, which accounted for 17.6 per cent). Aggregating the two – shown on the map below – Pakistan was the state subject to the most intense interception during that period (12.3 per cent of all global DNI and DNR intercepts).

DNR is vital for drone strikes, since these so often depend on tracking cell-phones to identify the target in motion — see my post here — and for this reason the NSA has also forward deployed tactical cells working in close concert with military SIGINT units at (for example) Bagram Air Base in Afghanistan. In short, its operations are not only ‘remote’ and are clearly ‘split’. These intercepts are often of direct and immediate utility, but bulk collections of call data records from (for example) Pakistan Telecom providers are also mined via SKYNET to identify suspects and convert them into targets via ‘Joint Enterprise Modelling and Analytics’ (JEMA) [AOI in the slide below refers to Area/Actor of Interest].

It is this combination of the transnational and the local – which parallels the network in which those flying the Predators and Reapers are embedded – that characterises what Rob Kitchin and Martin Dodge call code/space:

‘Given that many of these code/spaces are the product of coded infrastructure, their production is stretched out across extended network architectures, making them simultaneously local and global, grounded … in certain locations, but accessible from anywhere across the network, and linked together into chains that stretch across space and time to connect start and end nodes into complex webs of interactions and transactions. Any space that has the latent capacity to be transducted by code constitutes a code/space at the moment of that transduction.’

As you can see from the subtitle, their primary interest is everyday life. But in the cases that most concern me, the conversion of everyday life into code/space is a precursor to everyday death.

In the FATA and elsewhere code/space is clearly a highly asymmetric field, as it is intended to be, but those who are summoned into presence within the space of execution – a process that Louise Amoore calls ‘the appearance of an emergent subject’, of ‘pixelated people’ that emerge on screens scanning databanks but who also appear in the crosshairs of a video display – are not wholly ignorant of what is taking place, of the ‘coding’ of their space. It is of course the case that crews can see without being seen, and Grégoire Chamayou has argued that ‘the fact that the killer and his victim are not inscribed in “reciprocal perceptual fields” facilitates the administration of violence’ because it ruptures what psychologist Stanley Milgram in his experiments on Obedience to authority called ‘the experienced unity of the act.’ And yet those who are living under drones have developed their own apprehensions; they have learned, in some small measure, how to counter their digital capture and to reduce their physical vulnerability.

In media res

Posted on April 22, 2014 by Derek Gregory

Two short essays that address the public circulation of supposedly secret information. The first, “Collateral Murder and the After-Life of Activist Imagery”, is by Christian Christensen, and concerns the video clip released by Wikileaks as Collateral Murder in April 2010. I’ve discussed this edited video of a US Apache helicopter attack in New Baghdad in 2007 before, together with the two documentary films that it provoked, and it forms part of my ‘Militarized Vision’ project (you can find links to the clip and to subsequent commentary in that original post).

Christian doesn’t explore the content of the video so much as its inscription and re-inscription within public debates, part of the mediatization of later modern war. He does make a sharp point about the status of the imagery:

One could argue that the repeated use of this imagery (and corresponding audio) has created an entirely new genre of military reporting. It is a genre with specific, often disturbing conventions: the grainy images of those on the ground, the flat, bland coloring, the “narration” of the aircraft operators which swings between the clinical and the cynical, the silence of those under surveillance or attack, the sound of the weaponry as it is discharged, and, importantly, the “overtness” of the technology, by which I mean the way in which the screen is filled with evidence of the technology being used in the form of the cross-hairs in the middle and data visible at the top and the bottom of the screen…

The Collateral Murder video not only shatters the mythology of humane warfare and benevolent US power, but also causes us to question the notion of neutral technology at the service of human development: a theme which has regained a central space in public debate in recent years.

But he also thinks there is another, no less sharp point to be made about the very act of reporting:

Within this context, the killing of two Reuters employees by the US military was particularly poignant. At the most basic level, this was the symbolic killing of Journalism (with a capital “J”) by a military unaccustomed to critical coverage or investigation at home. The killings, of course, then went unreported until Manning leaked the material and WikiLeaks published it: itself an act of journalism. With Collateral Murder, there is a layering and re-layering of meaning, and, for me, journalism lies at the heart of the clip. These are humans first, of course, and most of those killed or wounded in the attack were not journalists. But, in addition to the tragedy of human death, there is also the tragedy of what is symbolically destroyed: Transparency. Democracy. Knowledge. Critical thinking. And it took an act of journalism to bring these tragedies to light, an act of which has now itself been subjected to the full force of the state via the imprisonment of Manning, and the threat of criminal charges being brought against Assange in the US.

Incidentally, the essay is the text of Christian’s presentation to the ‘Image Operations‘ conference held at the Institute of Cultural Inquiry (ICI) in Berlin earlier this month; the program is here.

The second essay is Adam Morris‘s wide-ranging review of ‘The geopolitics of the Snowden Files‘ at the Los Angeles Review of Books. Its immediate provocation is the publication of the Obama administration’s self-serving ‘NSA Report’:

The NSA Report — commissioned by the White House in August, published on its website in December, and now available in print via Princeton University Press— was authored by the President’s Review Group on Intelligence and Communications Technologies. As suggested by its official title, “Liberty and Security in a Changing World,” the Report was intended to advise President Obama on how to reform the data collection practices of the Intelligence Community (IC), in particular the NSA. Its authors include such veterans of the US security sector as Richard A. Clarke, Michael J. Morrell, and Peter Swire. This insiders’ perspective, in theory, is balanced by the addition to the group of constitutional lawyers Geoffrey R. Stone and Cass Sunstein. The unofficial purpose of the Report, however, was the Obama administration’s attempt to put a lid on the NSA scandal by pretending to be interested in reform. As Luke Harding points out in The Snowden Files, the Review Group was working out of the offices of the Director of National Intelligence, currently occupied by the felonious General James Clapper, w _ho knowingly lied in Congressional testimony about the bulk collection of Americans’ communication data.

The essay provides a fine, critical reading of the Report –

‘The anodyne language of these and other recommendations signals the imperial agenda out of which they are born: The NSA Report is obsessed with framing the debate over surveillance around the neopositivist vocabulary of “risk management,” but we know from history that political liberty will always suffer when a dominant regime deems a nation, its leadership or its population a “national security threat”…’

– but it also spirals off into a vigorous mapping of the context in which the NSA set about its covert operations and Edward Snowden‘s principled decision to go public (Adam also provides a commentary on Luke Harding‘s The Snowden Files: for another review, see Daniel Soar at the London Review of Books here). And here too, of course, investigative journalism is a vital, enabling and even empowering practice.

Boundless Informant and the everyware war

Posted on October 31, 2013 by Derek Gregory

As part of my presentation on “Drones and the everywhere war” at York, I decided to unpack this extraordinary claim made by John Nagl, one of the architects of the US military’s revised counterinsurgency doctrine:

We’re getting so good at various electronic means of identifying, tracking, locating members of the insurgency that we’re able to employ this extraordinary machine, an almost industrial-scale counterterrorism killing machine that has been able to pick out and take off the battlefield not just the top level al Qaeda-level insurgents, but also increasingly is being used to target mid-level insurgents.

It’s a remark I’ve discussed several times before. Nagl’s ‘killing machine’ is not limited to drone strikes, of course, but subsumes the ‘night raids’ and other Special Forces operations detailed in Jeremy Scahill‘s Dirty Wars. But at York I wanted to explore how those ‘electronic means of identifying, tracking and locating’ fed into drone strikes in Pakistan: and, thanks to Edward Snowden and Glenn Greenwald, I was able to get much closer to the belly of the beast.

I’d started the presentation with a riff on Josh Begley‘s attempt to persuade Apple to include his Drones+ app in the App store. Apple decided, for several contradictory and spurious reasons, to reject the app, and at his thesis defence Josh asked:

‘Do we really want to be as connected to our foreign policy as we are to our smart phones… Do we really want these things to be the site of how we experience remote war?’

Apple’s answer was ‘no’, clearly, but it turns out that others are intimately connected to drone strikes through their phones and e-mails, and it was this that I fastened on.

Josh, undeterred by Apple, went on to launch the Dronestream platform, from which he tweeted details of every known US drone strike. I combined one of Josh’s tweets for 1 October 2012 with a version of James Bridle‘s Dronestagram, which uses Instagram to post images of the location of drone strikes (I say ‘a version’ because Dronestagram was launched too late for this particular strike, so this is a mock-up; in any case, it’s difficult to pinpoint the locations from available reports with much precision, but the details for this strike are available via the Bureau of Investigative Journalism, as the second slide below shows):

We now know that this strike was made possible as a result of interceptions made by the National Security Agency’s Counter-Terrorism Mission-Aligned Cell (CT-MAC). Writing in the Washington Post on 16 October 2013 Greg Miller, Julie Tait and Barton Gellman explained how this strike had targeted Hassan Ghul:

Not quite ‘any doubt’; as they went on to note, ‘Although the attack was aimed at “an individual believed to be” the correct target, the outcome wasn’t certain until later, when “through SIGINT [signals intelligence] it was confirmed that Hassan Ghul was killed.”‘

So how did the intercept work? Not surprisingly, we don’t know for sure; but the map below of NSA’s ‘Boundless Informant‘ – another dimension of what I’ve been calling ‘the everywhere war’ – offers some clues. I’ve taken it from a report in the Guardian by Glenn Greenwald and Ewen MacAskill:

This is six months later, but it shows that Pakistan was, after Iran, the major focus of NSA’s surveillance and data mining operations (Miller and his colleagues had noted that “NSA threw the kitchen sink at FATA’, the Federally Administered Tribal Areas). It would be wrong to assume that the targeted killing of Ghul was the result of a simple hack into hotmail, and the Post report details the multiple methods used by NSA.

Still, the geography of covert surveillance shown on the map is revealing. Yesterday Greenwald returned to Boundless Informant and rebutted the charge that he had misinterpreted the meaning of this and other slides, and in doing so quoted from NSA’s own explanation of the system:

BOUNDLESSINFORMANT is a GAO [Global Access Operations, a branch of the NSA] prototype tool for a self-documenting SIGINT system. . . BOUNDLESSINFORMANT provides the ability to dynamically describe GAO’s collection capabilities (through metadata record counts) with no human intervention and graphically display the information in a map view, bar chart, or simple table. . . .
By extracting information from every DNI and DNR metadata record, the tool is able to create a near real-time snapshot of GAO’s collection capability at any given moment. The tool allows users to select a country on a map and view the metadata volume and select details about the collection against that country. The tool also allows users to view high level metrics by organization and then drill down to a more actionable level – down to the program and cover term.

It’s not too difficult to connect the dots and draw two more general conclusions. The first is that this is another, darker dimension to the ‘code/space’ and ‘everyware’ discussed in such impressive detail by Rob Kitchen and Martin Dodge:

My slide is just short-hand, of course, but you can see where I’m going, I hope – and, as we know from this week’s harrowing testimony on Capitol Hill about the murder of Mamana Bibi in Waziristan and Amnesty International’s report, Will I Be Next?, these operations and their algorithms work to turn ‘everyday life’ into everyday death. So I’ll be thinking more carefully about code/space and its implication in the individuation of later modern war, paying closer attention to the technical production of ‘individuals’ as artefacts and algorithms as well as the production of the space of the target: more to come.

The second general conclusion I leave to Peter Scheer, who provides a more refined (and critical) gloss on John Nagl’s comment with which I began:

I’m incorporating these and other developments into the revised and extended version of “Moving targets and violent geographies” which will appear in The everywhere war, but I hope this bare-bones account (and that first draft, available under the DOWNLOADS tab) shows that my posts are more connected than they must sometimes appear… The slides were pulled together on the day I gave the presentation, so forgive any rough edges.