UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA John C. Gilmore, ) Plaintiff ) Civil Action No. C-92-3646 ) TEH vs . ) ) National Security ) Agency, ) Defendant. ) . . . oOo . . . DECLARATION OF MICHAEL A. SMITH AND VAUGHN INDEX Michael A. Smith hereby declares and says: 1. I am the Director of Policy for the National Security Agency (NSA). I have served in this position since 6 October 1991. I have served in the NSA for 19 years and, prior to assuming my current assignment, I held various senior and supervisory positions including positions as the chief of the Agency's Legislative Affairs Office and as the Agency's Assistant General Counsel for Operations. As Director of Policy, I am a TOP SECRET classification authority, and I am responsible for the processing of all initial requests made pursuant to the Freedom of Information Act (FOIA) for NSA records. The statements made herein are based upon my personal knowledge, upon my personal review of information available to me in my official capacity, upon advice of counsel, and upon conclusions reached in accordance therewith. I have prepared this declaration to support a Motion for Summary Judgment to be filed concurrently with this declaration. ORIGIN AND MISSION OF NSA 2. The National Security Agency was established by Presidential Directive in October 1952 as a separately organized Agency within the Department of Defense, under the direction, authority, and control of the Secretary of Defense, who was designated by the President as Executive agent of the Government for conducting the communications security activities and signals intelligence activities of the United States. 3. NSA's signals intelligence mission is to obtain information from foreign electromagnetic signals and to provide reports derived from such information or data on a rapid-response basis to national policymakers and the intelligence community of the United States Government. The intelligence collection mission of the NSA provides this community with highly reliable foreign intelligence information. 4. There are two principal means for sending and receiving international radio communications. The term "radio communications" as used here includes communications passed in part by wire. a. The first involves the use of one's own radio transmitter and receiver facilities not available for public use. b. The second involves the use of facilities of an international communications common-carrier also available for use by the public. Such common-access carriers supply the means by which large volumes of radio communications of foreign governments, foreign organizations and their representatives are carried. 5. Because of the enormous volume of world-wide communications, interception activities, in order to be effective, must be focused on those particular lines, channels, or communications links which are apt to yield the highest proportion of useful foreign intelligence information. Knowledge of which lines, channels, or links carry such information is important to the operational effectiveness of the intelligence collection process; conversely, knowledge of which lines, channels, or links are of interest to one country can cause another country to take action to frustrate or deny this collection effort. Hence it is essential to the continued efficacy of signals intelligence operations that the communications links of interest to NSA remain unidentified. 6. If a foreign power is successful in defeating an intercept operation, all of the intelligence from that source is lost unless and until NSA can establish a new and equivalent intercept. The risk involved is great. Information produced by NSA is of great value to the President, the Secretary of Defense, the Secretary of State, and other senior policymakers. If a source becomes unavailable, policymakers must operate without the information that source produced. Sometimes it is impossible to establish a new and equivalent intercept and the source is lost permanently. These losses are extremely harmful to national security. APPLICATION OF EXECUTIVE ORDER 12356 7. A fundamental tenet of the communications intelligence process is that the identity of targets, the degree of success in exploiting those targets, the vulernability of particular foreign communications, the ability to process large masses of information, and the extent of any analytic successes are all matters that must be maintained in strictest secrecy because of the fragility of the sources. Disclosures of any of these items of information would encourage countermeasures by the target with the likely result that the United States would be denied valuable intelligence. Because of these factors, information that would reveal, either directly or indirectly, the degree of exploitation of such foreign government's communications by NSA is classified in accordance with the provisions of Executive Order 12356 Sections 1.3(a)(2), (a)(4), and (a)(8) and Section 1.3(c). Section 1.3(a)(2) provides that information shall be considered for classification if it concerns the vulnerabilities or capabilities of systems, installations, projects, or plans relating to national security. Section 1.3(a)(4) provides that information shall be considered for classification if it concerns intelligence activities or intelligence sources or methods. Section 1.3(a)(8) provides that information shall be considered for classification if it concerns cryptology. Section 1.3(c) provides that unauthorized disclosure of foreign government information, the identity of a confidential foreign source, or intelligence sources or methods is presumed to cause damage to the national security. Section 1.3(d) provides that information shall not be declassified as a result of any unofficial publication of identical or similar information. I have reviewed the records at issue and have determined that the information contained in them pertains to intelligence sources and methods and to cryptology and that it relates to the national defense and foreign relations of the United States. I have further determined that the records are currently and properly classified CONFIDENTIAL and SECRET pursuant to E.O. 12356 and are exempt from disclosure under 5 U.S.C. ¤ 552(b)(1). E.O.'12356, section l.l(a)(2) provides that "SECRET" shall be applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security. Section l.l(a)(3) provides that "CONFIDENTIAL" shall be applied to information, the unauthorized disclosure of which could be expected to cause damage to the national security. STATUTORY PROTECTIONS 8. Similarly, the fact that NSA has the ability to decipher particular foreign communications relates to the functions and activities of NSA. These functions and activities are protected from public disclosure by several specific statutes. Congress has enacted a number of laws to protect information concerning signals intelligence operations due to the uniquely fragile nature of signals intelligence sources and methods and the ease with which foreign powers could institute countermeasures if either specific source or method information were disclosed. Section 6 of Public Law 86-36, 50 U.S.C. ¤ 402 note, specifically protects from disclosure any information pertaining to the organization, or any function or any information with respect to the activities of NSA. 18 U.S.C. ¤ 798 prohibits any disclosure of classified information concerning the communications intelligence activities of the United States. The term communications intelligence is defined therein to mean: "all procedures and methods used in the interception of communications and the obtaining of information from such communications by other than the intended recipients." Further, a disclosure of the means by which intercepted communications are deciphered would cause recognizable impairment to intelligence sources and methods specifically protected by the Director of Central Intelligence under authority conferred by 50 U.S.C. Section 403(d)(3). Accordingly, the revelation of information about this agency's cryptologic activities is exempt from disclosure under 5 U.S.C.¤ 552(b)(3), implementing the non-disclosure provisions of Section 6 Public Law 86-36, by 50 U.S.C. ¤ 403(d)(3), and by 18 U.S.C. ¤ 798. THE DOCUMENTS AT ISSUE 9. Plaintiff made a valid FOIA request by letter dated 27 June 1992. We denied his request by letter dated 2 October 1992. Plaintiff mentions in his request that Parts I and II of Military Cryptanalysis by William Friedman are publicly available. This is true; Part I, consisting of 142 pages, and Part II, consisting of 120 pages, were printed in 1938 and later declassified. Part III, printed in 1939 and consisting of 119 pages, and Part IV, printed in 1941 and consisting of 189 pages, remain classified CONFIDENTIAL and protected by statute and have been withheld from plaintiff. Plaintiff also correctly states that parts I and II of Military Cryptanalytics by Lambros Callimahos (co- authored by William Friedman) are publicly available. Part I, printed in April 1956 and consisting of 443 pages, has been declassified, while Part II, printed in October 1959 and consisting of 634 pages, was declassified on 22 March 1984. Part III, printed in 1977 and consisting of 664 pages, remains classified SECRET and protected by statute, thus has been withheld from plaintiff. Some of the material in the various volumes plaintiff has requested is duplicative. For example, Part III of Military Cryptanalysis comprises the first five chapters of Military Cryptanalytics, while Part IV of Military Cryptanalysis is largely contained in later chapters of Military Cryptanalytics. Plaintiff, in his request, referred to Parts IV, V, and VI of Military Cryptanalytics. These were never written; Mr. Callimahos died before he could complete the series and the agency has not tasked any other person or group to do so. Although each of the three volumes that plaintiff requested was authored by an individual who was a recognized expert in the field of cryptography, each was the product of the collective knowledge and experience of many specialists and analysts. Part III of Military Cryptanalytics, for example, contains compilations of several internal agency monographs. THE NEED FOR PROTECTION OF THE DOCUMENTS 10. The texts were reviewed by proper classification authorities prior to our responding to plaintiff's initial FOIA request. It was determined that the only segregable portions of the series are those that have already been made public. There is a fundamental difference between the content of the earlier, unclassified volumes, and the later, classified volumes, that I cannot describe fully in this unclassified declaration, but that I can address in a classified declaration. Parts III and IV of Military Cryptanalysis and Part III of .Military Cryptanalytics discuss cryptology, capabilities of systems relating to national security, and intelligence methods. These texts instruct the reader in sophisticated cryptographic systems. Despite the age of the texts, the systems they describe are still in use in parts of the world today. While Parts III and IV of the Military Cryptanalysis were written in 1939 and 1941 respectively, the age of these publications is deceptive when used as a factor in evaluating the sensitivity of the contents. Notwithstanding their age, they contain principles of cryptanalysis that represent the very foundations upon which successive and more sophisticated systems are built. William Friedman is rightly viewed as a pioneer in modern cryptology. As an individual, his writings represent the efforts not only of himself, but of many other early cryptographers. Similarly, Part III of Military Cryptanalytics represents the work of many eminent people, and is not solely the work of one. One could argue that mathematical principles and techniques are discernable by anyone and that they are not or should not be classified; indeed, they may be available in open source. However, it is the specific application of the principles and techniques to cryptanalysis that makes these works so sensitive. A public release of these materials would demonstrate a level of sophistication and specific approaches of cryptanalysis. Countries that are foreign intelligence targets could reasonably be expected to re-evaluate their procedures in light of the disclosures. Re-acquisition of those intelligence sources, if it is ever possible, would be costly both in terms of physical effort and expenditure of public monies. ll.a. The age of a system, or the fact that the principles upon which it is based were recognized some 50 years ago, does not make a cryptographic system based upon those principles less secure or satisfactory for current encryption of a foreign government's secrets. Public disclosure that the NSA has long had the ability to solve specific types of systems, however, exposes those vulnerabilities and takes the prospect of those vulnerabilities out of the realm of speculation for a foreign power and can make that foreign source perceive an urgent need to change. Thus, the texts have been classified CONFIDENTIAL or SECRET in accordance with Executive Order 12356, as explained above, and are appropriately marked and exempt from automatic declassification or downgrading, and are exempt from disclosure under 5 U.S.C. ¤ 552(b)(1).b. Further, if these volumes were made available, intelligence methods would be directly revealed and intelligence sources would be indirectly revealed. Release of this material would disclose information about the nature of NSA's functions and activities. Based upon all the foregoing, I have determined that the records involved in this case cannot be disclosed, because to do so would jeopardize intelligence sources and methods and is appropriately exempted from disclosure under 5 U.S.C. ¤ 552(b)(3). NSA'S FOIA PROGRAM 12. In addition to asserting that the requested documents should be released, plaintiff claims that NSA did not meet the statutory time limits of the FOIA and that our general FOIA policies constitute an unlawful pattern and practice. It is the Agency's policy to respond to public requests for information in a manner which is as fair as possible to each individual requester. To implement this policy, the Agency has developed a two-track "first-in/first-out", "easy/hard" system for processing FOIA requests and referrals of documents from other agencies. This system permits early recognition of "easy cases" so that requesters who have made such a request do not have to wait unnecessarily for a response. This method of responding to requesters is advocated by both the Department of Defense and the Department of Justice. An easy case is one in which there are no Agency records responsive to the request or, where the review of records that are responsive will take one hour or less. When such an easy case is presented, the case worker assigned to that matter will take the case out of line, undertake the review, and will respond to the requester. All other more difficult requests are placed in queue in the order in which they are received. With this system, the Agency is able to maintain equitable treatment of all requesters since each must wait for his or her turn unless no responsive documents are located or the request requires minimal review time. 13. When a request is received it is logged into the FOIA database. A search of that database is conducted to determine if a response to an identical or similar request will help in processing the current case. If none is found, the FOIA staff, based on their experience in the Agency, cause a search request to be sent to the Agency Key Components which in their opinion are most likely to have responsive material. 14. A search is then conducted in the various organizations tasked to look for responsive documents. This search can result in suggestions of additional organizations which are likely to have responsive material or it may result in the need to consult with another Agency organization either because the material was authored by that organization or the organization has the primary expertise required to review the records. All the documents retrieved are reviewed by the organization where they were located and then forwarded to the FOIA unit where a line-by-line review is conducted to determine segregability. The FOIA unit is the only organization in the Agency which has a full-time staff specifically trained and devoted to FOIA process. If consultation with other organizations is necessary, the FOIA staff will coordinate that additional review. 15. The FOIA staff has the capability to review and properly apply the FOIA to much of the information requested by the public. However, NSA consists of numerous highly specialized and technical organizations. It is therefore, often necessary to ask those units to review material which they originated or which, as in this case, contain technical or other material which is fully understood by only a limited number of people. The individuals conducting these technical reviews, though generally of the higher grade levels and technically very qualified, are not full-time FOIA experts. Thus, once they have reviewed the material and suggested appropriate redactions, the FOIA staff must conduct a second, word-by-word, paragraph-by-paragraph review in order to conform any suggested retractions to the requirements of the law and to ensure that all material has been properly handled. 16. There are additional factors which complicate the processing of requests and referrals at NSA. Records at NSA are diverse, highly specialized and complex, and often compartmented with access permitted strictly on a need-to-know basis. Because many requesters seek material which is classified, it requires very careful word-by-word review to both protect highly sensitive national security information and to ensure that any releasable material is disclosed. Because of the importance of both the protection of appropriate information and the need to release what can be disclosed, a great deal of time and effort are expended in the review process. Thus, there are necessarily delays in both the search and the review process. NSA RESOURCES AND BACKLOG 17. The FOIA staff at present consists of 8 full-time FOIA professionals and 2 part-time FOIA professionals. Between September 1990 and June 1992 the FOIA staff was augmented by two methods. Two people were reassigned from other tasks within the Directorate for Plans and Policy, the Key Component containing the FOIA staff. In addition, 4 new billets (positions) were acquired from the Directorate for Programs and Resources. The FOIA staff is responsible for the release of information pursuant to FOIA requests, and it is responsible for support to FOIA litigation. In the past few years the FOIA staff has devoted significant resources to supporting civil and criminal litigation in which the Agency is not a party and the Agency's interest, which usually involves the protection of highly classified information, is not publicly known. 18. As of November 6, 1992, NSA had a backlog of 448 FOIA cases. Our backlog is the result of the high volume of requests which have far outreached our resources to address FOIA despite the increase in the professional staff assigned to this task. During calendar year 1991 7.5 manyears of FOIA professionals and legal staff time was devoted to FOIA. Further, 2,576 hours were spent within Agency components in search time and review time for FOIA. The Agency received a total of 717 FOIA requests in 1991, closed 792 and finished the year with a backlog of 557. 19. With the additional resources allocated to FOIA in 1991 and 1992, even though NSA has received 715 new requests as of November 4, 1992, as compared with 601 as of the same time frame in 1991, NSA has been able to reduce its backlog from 593 in November of 1991 to 448 in November of 1992. 20. NSA has been responsible in allocating significant resources to its FOIA program and has made substantial efforts to respond in as timely and in as equitable a manner as possible to all requesters under FOIA. Nevertheless, despite our successful efforts in reducing our current FOIA backlog, and our continued due diligence in processing each FOIA request, the number and complexities of the requests NSA receives inevitably result in our inability to respond to any given request or referral within the time contemplated by the FOIA. FOIA PROCESSING OF THE DOCUMENTS AT ISSUE 21. When this Agency acknowledged receipt of plaintiff's 27 June 1992 request, we notified him that 458 cases preceded his in the queue. Although the documents requested have been the subject of previous FOIA requests, and thus, fell into the|"easy" category, to ensure that the passage of time had not changed the previous decision to protect the documents, it was necessary for the Office of Policy to consult with various Agency components. It was only after this consultation was completed that a response could be sent to plaintiff. Submitted with this declaration are copies of the 9 September 1992 and 2 October 1992 letters sent to plaintiff. I have examined these letters and they are authentic copies of the letters sent to plaintiff by this Agency. OFFER TO PRODUCE A CLASSIFIED DECLARATION 22. It is not possible to describe in more detail in an unclassified declaration the material in the records held by NSA, because this would itself enable the knowledgeable person to ascertain information concerning the Agency's mission and thus disclose intelligence sources and methods. The release of these documents would be extremely damaging to Agency operations. I am prepared to describe more specifically the content of the records sought and the damage to the national defense that would reasonably flow from their disclosure in a classified declaration for the Court's in camera, ex parte consideration. 23. I declare under penalty of perjury that the facts set forth in the foregoing declaration are true and correct to the best of my knowledge and belief. Executed pursuant to 28 U.S.C. Section 1746. (signed) MICHAEL SMITH Executed on this 10th day of November, 1992.