The NSA: From Signal Intelligence to Global Surveillance

The National Security Agency is the largest and most technologically sophisticated intelligence organization in the United States, and almost certainly in the world. Its budget dwarfs that of the CIA; its workforce of mathematicians, linguists, and engineers numbers in the tens of thousands; its physical infrastructure spans a campus the size of a small city in Fort Meade, Maryland, and extends to listening posts, satellite ground stations, and data collection facilities on every inhabited continent. Yet for most of its existence, the NSA operated with such secrecy that intelligence professionals inside the U.S. government joked that its initials stood for “No Such Agency.” Understanding how the NSA grew from a modest postwar signals intelligence unit into a global surveillance apparatus requires examining both its technical achievements and the legal and political controversies those achievements generated.

Origins: From Armed Forces Security Agency to NSA

The NSA’s institutional lineage runs through the Second World War’s code-breaking community, which had achieved extraordinary successes against both German and Japanese communications. The Army’s Signal Intelligence Service, under William Friedman, and the Navy’s OP-20-G cryptanalytic unit had broken Japanese diplomatic codes before Pearl Harbor and worked alongside British counterparts at Bletchley Park to exploit German Enigma communications throughout the war.^[1]

After the war, these capabilities were consolidated into the Armed Forces Security Agency (AFSA), established in 1949. AFSA proved organizationally dysfunctional: interservice rivalries between Army, Navy, and Air Force units prevented effective coordination, and signals intelligence product was inconsistently distributed to policymakers. A 1952 review by intelligence scholar George Brownell concluded that AFSA had failed its mission and recommended comprehensive reorganization.^[2]

President Harry Truman acted on the Brownell Report by signing a classified presidential memorandum on October 24, 1952, creating the National Security Agency under that name for the first time. The memorandum established NSA outside the normal chain of military service commands, placing it under the Secretary of Defense but giving it authority over signals intelligence collection and cryptanalysis across all military services and, critically, with access to civilian communications as well.^[3] The NSA’s founding charter remained classified until 1984 — the agency’s existence was itself treated as classified information for years after its creation.

SIGINT Architecture: How the NSA Collects Intelligence

The NSA’s core mission is signals intelligence (SIGINT) — the collection and analysis of foreign communications and electronic emissions. SIGINT divides into two principal disciplines: COMINT (communications intelligence, derived from intercepted communications) and ELINT (electronic intelligence, derived from electronic emissions such as radar signatures).^[4]

Collection operates through multiple technical means. Ground-based listening stations intercept radio and microwave communications; undersea cables carry taps on fiber optic infrastructure; satellite collection systems monitor communications from orbit; and since the digital era, network-based collection reaches directly into internet infrastructure. The NSA operates a global network of collection facilities under its own name and through the UKUSA Agreement partners — the Five Eyes alliance comprising the United States, United Kingdom, Canada, Australia, and New Zealand — which divides collection responsibilities across geographic regions.^[5]

The Five Eyes arrangement, formalized through the UKUSA Communications Intelligence Agreement of 1946 and expanded over subsequent decades, allows partner agencies to share raw collection data and finished intelligence products on terms that individual bilateral agreements could not achieve. Britain’s GCHQ, Canada’s CSE, Australia’s ASD, and New Zealand’s GCSB each contribute collection from their geographic positions and technical capabilities, creating a collection architecture with genuine global reach. The historical development of this partnership is documented in our analysis of MI6 and Britain’s signals intelligence establishment at Bletchley Park, which laid the foundations for the postwar sharing relationship.

VENONA: The NSA’s First Great Success

The NSA’s most consequential early cryptanalytic achievement was the VENONA project: the long-running effort to decrypt Soviet intelligence cables transmitted between Moscow and its residencies in the United States during the 1940s. Soviet intelligence had used one-time pad encryption for these communications, a theoretically unbreakable system, but wartime expediency led Soviet cryptographers to reuse pad key material — a fatal error that created exploitable patterns.^[6]

Army cryptanalysts began working the Soviet cables in 1943; the project was transferred to NSA’s predecessor and eventually to NSA itself. Over decades of painstaking work, analysts partially decrypted thousands of cables that identified dozens of Soviet agents operating within the U.S. government, military, and atomic weapons program. VENONA confirmed the Rosenbergs’ involvement in atomic espionage, identified State Department official Alger Hiss as a Soviet source, and revealed the scope of Soviet penetration of the Manhattan Project.^[6]

The project’s existence remained classified until 1995, when NSA declassified 2,900 VENONA translations. The declassification resolved decades of historical debate about the guilt of individuals accused of Soviet espionage during the McCarthy era — in many cases confirming that the accusations, however delivered through illegitimate processes, had identified real Soviet agents. VENONA remains the NSA’s most publicly discussed Cold War achievement and is the subject of the agency’s most extensive historical declassification program.

Cold War SIGINT: From Korea to Vietnam

The Korean War tested the fledgling NSA’s operational capabilities in a shooting conflict for the first time. NSA provided tactical signals intelligence to U.S. forces, intercepting Chinese People’s Volunteer Army communications with results that were sometimes consequential and sometimes frustrated by language and translation limitations. The conflict revealed both the value of signals intelligence at the operational level and the persistent challenge of providing timely intelligence to tactical commanders.^[3]

The Cold War’s central SIGINT challenge was Soviet strategic communications — monitoring Soviet military activities, missile tests, nuclear weapons programs, and leadership communications to provide warning of potential attack. The NSA’s work in this domain was largely invisible to the public but profoundly consequential: the agency provided the technical intelligence that allowed American analysts to assess Soviet strategic nuclear capabilities, monitor Soviet compliance with arms control agreements, and detect Soviet military preparations during crises including the 1962 Cuban Missile Crisis and the 1973 Yom Kippur War.

The NSA’s signals intelligence capabilities also supported the CIA’s human intelligence operations against the Soviet Union — intercepts could corroborate or contradict what human sources reported, and NSA technical collection often provided the context that allowed CIA analysts to interpret what their agents were seeing on the ground.

Vietnam brought the NSA into a controversial operational role. The agency was deeply involved in the Gulf of Tonkin incident of August 1964, which provided the legal basis for dramatic U.S. military escalation. NSA intercepts were used to support the Johnson administration’s claim that North Vietnamese naval vessels had attacked U.S. destroyers in unprovoked assaults on August 2 and 4, 1964. Subsequent declassification of NSA records revealed that the agency’s analysts had serious doubts about whether the second attack on August 4 had actually occurred, doubts that were not fully communicated to policymakers — a case study in the politicization of intelligence with consequences measured in tens of thousands of American lives.^[7]

Legal Framework: Executive Order 12333 and FISA

The NSA’s legal authorities were essentially undefined in statute for most of its early history. The agency operated under classified presidential directives and National Security Council intelligence directives, without the congressional authorization or judicial oversight that governed domestic law enforcement. This created a persistent tension between the NSA’s operational ambitions and constitutional constraints on government surveillance of American citizens.

The Church Committee investigations of 1975-1976 exposed programs in which NSA had intercepted communications of American citizens without legal authorization, including a program called Operation SHAMROCK that had collected international telegrams from major U.S. companies since 1945, and Operation MINARET, which maintained watch lists of American citizens whose international communications were flagged for NSA attention.^[3] The revelations were damaging enough that they prompted fundamental legislative reform.

The Foreign Intelligence Surveillance Act of 1978 (FISA) established the first statutory framework governing NSA surveillance of persons within the United States and established the Foreign Intelligence Surveillance Court (FISC) to provide judicial authorization for certain collection activities. FISA created a category of “foreign intelligence” surveillance that operated under different rules than criminal investigation, allowing collection against foreign powers and their agents with judicial oversight but without the probable cause standard required for criminal wiretaps.^[8]

Executive Order 12333, signed by President Reagan in 1981 and subsequently amended, became the primary governing document for NSA’s foreign collection activities — those occurring outside FISA’s domestic scope. EO 12333 authorizes broad signals intelligence collection against foreign targets abroad, with few of the judicial oversight mechanisms that apply to domestic collection. The order’s breadth, and the question of what rules apply when collection technically occurs “abroad” but involves American communications, became central to post-Snowden debates about the scope of NSA authority.

The Digital Revolution: ECHELON and Global Network Surveillance

The transition from analog to digital communications in the 1980s and 1990s transformed both the NSA’s capabilities and its challenges. Digital communications carried vastly more volume than their predecessors; internet protocols created new collection opportunities; and the globalization of telecommunications infrastructure created new legal and technical questions about where foreign communications ended and domestic ones began.

The ECHELON program — a signals intelligence collection and analysis system operated by the Five Eyes partners — attracted significant public attention in the late 1990s and early 2000s when investigative journalists and European parliamentary inquiries documented its scope. ECHELON’s satellite interception capabilities, ground station network, and keyword-based filtering systems were described in a 2001 European Parliament report as capable of intercepting a substantial portion of global satellite communications.^[5] European governments expressed concern that ECHELON was being used for commercial espionage on behalf of American companies, though U.S. officials denied the allegation.

The September 11, 2001 attacks dramatically accelerated NSA’s expansion of domestic collection activities. The Bush administration authorized a series of programs, collectively referred to as the President’s Surveillance Program (PSP), that operated outside FISA’s framework. The most significant of these — the warrantless wiretapping program later known as STELLAR WIND — authorized NSA to intercept communications of persons in the United States without the judicial approval that FISA required, justified under the administration’s theory that the post-9/11 Authorization for Use of Military Force (AUMF) implicitly authorized such collection.^[3]

The Snowden Revelations: What Was Actually Disclosed

On June 5, 2013, The Guardian published the first story based on documents provided by Edward Snowden, a 29-year-old NSA contractor working for Booz Allen Hamilton. The initial story revealed that the FISC had issued a bulk order requiring Verizon to provide NSA with metadata — records of calls made, received, numbers dialed, duration, and location data — for all calls on its network, regardless of whether the calls had any connection to foreign intelligence.^[5]

Subsequent disclosures revealed the architecture of NSA’s global surveillance programs in unprecedented detail. PRISM allowed NSA to collect data directly from the servers of major internet companies including Google, Facebook, Apple, Microsoft, and Yahoo, under court orders served on those companies under Section 702 of FISA. Upstream collection programs intercepted data flowing through internet backbone cables. XKeyscore, an analytical tool, allowed analysts to search through vast databases of intercepted communications using selectors ranging from email addresses to language to search terms.^[5]

The Snowden documents also documented NSA operations against allied governments. Intercepts of German Chancellor Angela Merkel’s personal mobile phone caused a significant diplomatic crisis with Berlin; collection against French government communications generated protests in Paris; and documents revealing NSA operations against Brazilian government and energy company Petrobras prompted Brazilian President Dilma Rousseff to cancel a planned state visit to Washington.^[5]

The intelligence community’s assessment of the Snowden disclosures was uniformly negative: Director of National Intelligence James Clapper called them “the most significant single theft of intelligence information in American history.” The operational damage — adversaries changing communications methods, collection gaps created by corporate compliance reforms, and the loss of programs that NSA officials said had foiled terrorist plots — was described as severe, though independent assessments of the claimed operational benefits of the bulk collection programs were more skeptical.^[5]

NSA Hacking Tools and the Shadow Brokers Leak

In August 2016, a group calling itself the Shadow Brokers published a cache of NSA offensive hacking tools online, including exploits for widely deployed commercial software. The disclosure represented a different kind of intelligence leak than Snowden’s: not a whistleblower revealing surveillance programs, but an apparent theft of operational cyberweapons.^[3]

The tools were real. Among them was EternalBlue, an exploit targeting a vulnerability in Microsoft Windows’ SMB protocol. After Microsoft patched the vulnerability in March 2017 following NSA notification, EternalBlue was incorporated into the WannaCry ransomware that infected an estimated 200,000 computers across 150 countries in May 2017, including systems at Britain’s National Health Service, Spanish telecommunications company Telefonica, and shipping conglomerate Maersk. The NotPetya attack of June 2017, which caused an estimated $10 billion in damages globally, also used EternalBlue as a propagation vector.^[5]

The Shadow Brokers episode raised fundamental questions about NSA’s “vulnerability equities” process — its policy for deciding whether to disclose software vulnerabilities it discovers to vendors for patching, or to retain them for offensive exploitation. The disclosure that a tool retained for offensive use had been stolen and repurposed to cause massive civilian damage demonstrated the systemic risk of intelligence agencies stockpiling software exploits. The KGB’s Cold War active measures doctrine — using offensive capabilities to cause disruption in adversary societies — finds a digital-era parallel in the consequences of state-developed cyberweapons escaping institutional control.

Organizational Structure and the Intelligence Community Role

The NSA is headed by a Director who simultaneously serves as Commander of U.S. Cyber Command, a unified military command established in 2009 to conduct offensive and defensive cyber operations. This dual-hatted arrangement reflects the deep integration of signals intelligence collection and offensive cyber capabilities, though it also creates institutional tensions between the collection mission (which benefits from maintaining access to adversary networks) and the military mission (which may require disrupting those same networks).^[2]

NSA’s budget is classified but is generally understood to be the largest of any U.S. intelligence agency. The Snowden documents revealed a fiscal year 2013 intelligence community budget request totaling $52.6 billion for non-military programs; NSA’s share, while not publicly specified, was assessed by analysts at several billion dollars annually. The agency’s Fort Meade headquarters campus spans approximately 350 acres; its Utah Data Center, opened in 2014, has a reported storage capacity measured in yottabytes and was built specifically to handle the volume of digital collection that modern internet-based surveillance generates.^[3]

Post-Snowden Reform: USA FREEDOM Act and Section 702

The Snowden revelations generated the most significant legislative reform of NSA authorities since FISA’s passage in 1978. The USA FREEDOM Act of 2015 ended the bulk telephone metadata collection program revealed in the initial Verizon story, replacing it with a system requiring NSA to query records held by telecommunications companies rather than collecting them in bulk.^[8]

Section 702 of FISA — the authority underlying PRISM and Upstream collection — proved more durable. Reauthorized in 2018 and again in subsequent years, Section 702 permits collection of communications of non-U.S. persons located outside the United States, even when those communications transit through or are stored on U.S. systems. Civil liberties organizations have consistently challenged Section 702 on the grounds that Americans’ communications are inevitably “incidentally collected” when they communicate with foreigners targeted under the authority, and that this incidental collection constitutes mass surveillance without adequate legal protection for Americans.^[5]

The FISC, nominally the oversight court for these programs, has been criticized as insufficiently adversarial: it hears only the government’s arguments, approves the vast majority of applications it receives, and its proceedings are classified. The reform debate has produced incremental improvements — an amicus curiae mechanism to provide independent legal perspective in certain cases, increased transparency reporting requirements — but has not resolved the fundamental tension between national security collection requirements and constitutional privacy rights.

The NSA and Cryptography: Both Shield and Sword

The NSA’s relationship with cryptography is paradoxical: it is simultaneously the world’s leading organization for breaking encryption and one of the primary institutional forces shaping the development of strong encryption standards. The agency employs more mathematicians than any other organization in the United States and its classified research on cryptography has historically led academic work by years or decades.^[1]

NSA’s involvement in the development of the Data Encryption Standard (DES) in the 1970s was controversial: the agency modified the S-boxes (substitution tables) in IBM’s proposed algorithm in ways that IBM did not fully explain publicly. Cryptographers long suspected that the modifications had introduced a backdoor; subsequent analysis suggested instead that NSA had actually strengthened DES against a then-classified attack technique called differential cryptanalysis, which the agency had independently discovered years before academic researchers.^[3]

The 2013 disclosure that NSA had inserted a backdoor into the Dual_EC_DRBG pseudorandom number generator, which had been standardized by the National Institute of Standards and Technology (NIST), was less benign. NSA had apparently paid RSA Security $10 million to use the compromised algorithm as the default random number generator in its security products — a covert operation that undermined the global encryption infrastructure that legitimate users and businesses depended on for security.^[5] The episode represented a fundamental conflict between NSA’s role as a protector of U.S. communications security and its role as an attacker of adversary communications.

Legacy and Continuing Relevance

The NSA’s seventy-plus-year history traces the arc of American technical intelligence from vacuum-tube code-breaking machines to global internet surveillance, from the Cold War’s binary superpower confrontation to the diffuse threat landscape of terrorism, cybercrime, and great-power competition. Its achievements — VENONA, the Cold War strategic warning mission, signals intelligence support to military operations from Korea to the present — represent genuine contributions to American security. Its failures and controversies — Gulf of Tonkin, SHAMROCK and MINARET, the post-9/11 bulk collection programs, the Shadow Brokers leak — represent recurring patterns of institutional overreach, inadequate oversight, and the corrosive effects of excessive secrecy on democratic accountability.

The tensions revealed by the Snowden disclosures have not been resolved by subsequent reform. Section 702 remains in force; EO 12333 collection abroad operates with minimal judicial oversight; the question of how to calibrate intelligence collection capabilities against democratic values in a digital world where communications are inherently global remains genuinely difficult. The NSA is indisputably a powerful and technically sophisticated organization; whether that power is subject to adequate democratic control is a question that each generation of Americans must answer for itself.