Report: NSA Collects Millions of Email Address Books and Buddy Lists

According to the latest revelation by the Washington Post, the NSA isn't just tracking what you're doing on the internet. It's also cataloging who you know, at a scope so expansive that it can barely find a way to store it all.

The latest WP report, spurred by documents provided by Edward Snowden and corroborated by senior intelligence officials, is one of the most astonishing insights into NSA activities yet. Not only does the NSA collect the contact lists and email address books of internet users—including many Americans—it does so at a rate that boggles the mind. According to the report:

During a single day last year, the NSA’s Special Source Operations branch collected 444,743 e-mail address books from Yahoo, 105,068 from Hotmail, 82,857 from Facebook, 33,697 from Gmail and 22,881 from unspecified other providers...

And that's a typical day. Which comes out to about 250 million email address books every single year. Which is to say nothing of the 500,000 instant messaging contact lists the NSA culls daily.

How It Happens

The NSA manages to acquire such voluminous records by cutting secret deals with foreign telcos, although that doesn't mean that only non-US citizens are targeted. The Post puts the number of Americans caught in the sweeping action as high as in the tens of millions. The amount of data is enough, in total, that it "has occasionally threatened to overwhelm storage repositories," according to the Post.

The NSA also skirts its legal obligation to target only non-US targets by collecting contact lists in bulk from international internet access points. And because the agency isn't lifting the information directly from corporate servers, but instead intercepts it as it passes from one internet weigh station to the next, it doesn't need to ask for the company's permission. It's easier to rob a Brinks truck than it is to pry open a bank vault.

That also may explain why Yahoo has such a higher proportion of contacts being lifted; unlike most of the other services the NSA targets, the Post points out, Yahoo does not offer encrypted connections to its users by default.

Why It Matters

Contact lists might at first blush seem less intrusive than phone or email metadata. But in practice, you can potentially glean far more about a person from their network of acquaintances than you can from those.

Knowing with whom someone is in contact allows the NSA to chart their entire lives, and those of the people they know. Email address books aren't just Hotmail addresses. They're phone numbers, home addresses, family members, aliases. It's not just your information. It's the information of everyone you've ever known.

And even more disturbing than the fact of it might be the scope; the NSA's approach has always been quite openly to collect as much information as possible, but this new report gives new definition to those possibilities. At 250 million people per year, it would take the NSA less than a decade to capture the contact information of every single person on the internet. [Washington Post]