The order was six weeks old before anyone outside a small circle saw it. On 5 June 2013 the Guardian published a secret order of the United States Foreign Intelligence Surveillance Court, signed on 25 April by Judge Roger Vinson, directing Verizon Business Network Services to give the National Security Agency, on an ongoing daily basis, the call detail records for communications on its network — in the paper's description, the numbers at both ends of a call, location data, unique identifiers, the time of the call and its duration. Not the contents of anything. Not, the order said, a subscriber's name or address or financial information. The Director of National Intelligence, James Clapper, called the disclosure reprehensible.
The next day the argument moved to the companies. On 6 June the Guardian and the Washington Post published on PRISM, from a slide deck listing nine providers with the year each was said to have joined: Microsoft in 2007, Yahoo in 2008, Google, Facebook and Paltalk in 2009, YouTube in 2010, AOL and Skype in 2011, Apple in 2012. The denials turned on one phrase. Yahoo said it did not provide the government with direct access to its servers, systems or network; Facebook said it did not provide any government organisation with direct access to Facebook servers; Microsoft said it handed over customer data only on a legally binding order or subpoena, never voluntarily. On 7 June Larry Page of Google and Mark Zuckerberg of Facebook each said they had known nothing of it.
President Obama, asked on 7 June, said the programmes had been authorised by Congress and repeatedly reauthorised by bipartisan majorities, and that Section 702 could not be used to target a United States person intentionally. On 8 June the Guardian described Boundless Informant, a tool that counted what the agency collected and drew the result as a map: for the thirty days ending in March 2013, about 97 billion internet records and 125 billion telephone records worldwide, close to three billion of them gathered inside the United States. On 9 June, at his own request, the Guardian published a video filmed in Hong Kong in which Edward Snowden, a contractor with Booz Allen Hamilton, gave his name and his reasons. Booz Allen dismissed him the following day.
The last fortnight gathered. On 21 June the Guardian reported Tempora, describing GCHQ probes attached by mid-2011 to more than two hundred internet links, each carrying ten gigabits a second, content buffered three days, metadata held thirty, both shared with the NSA. Britain's answer had begun earlier: on 10 June the foreign secretary, William Hague, told the Commons that GCHQ worked within a strict legal framework and called baseless the suggestion that the American partnership was used to get round British law; asked about Tempora on 21 June, GCHQ said only that it did not comment on intelligence matters and that it kept to a rigorous legal compliance regime. That same 21 June the Justice Department unsealed a complaint, filed a week earlier in the Eastern District of Virginia, charging Snowden under the Espionage Act of 1917 and with theft of government property. On 23 June he flew to Moscow with Sarah Harrison of WikiLeaks; Hong Kong said the American papers seeking a provisional warrant of arrest "did not fully comply with the legal requirements under Hong Kong law".
Six million contacts
On 21 June 2013 Facebook said a report to its White Hat programme had turned up a bug in Download Your Information, the tool that let a person take a copy of their own account. The archive a user received could contain email addresses and telephone numbers for their contacts that the user had never supplied — details assembled from the address books other people had uploaded to the site to find friends. Facebook put the number of people whose contact details had been exposed this way at about six million, said it had found no evidence the bug had been used maliciously, and said it had switched the tool off while it was fixed. What made the disclosure land was not the leak but the inventory it implied: the company held contact details for people taken from other people's phones, matched them to accounts, and it took a fault in an export function for that store to become visible from outside. The word attached to it was shadow profile, and the practice underneath — a picture of a person assembled from everyone around them — was still the argument in March 2018.
A certificate and a nameserver
Two smaller failures that month hit the same joint: the parts of the internet that vouch for who a company is. On the evening of 19 June 2013 visitors to LinkedIn were pointed somewhere else. Its DNS records, along with those of several thousand other domains registered through Network Solutions, had been changed to nameservers at a domain called ztomy.com; Cisco's security team, publishing the next day, listed LinkedIn, the United States Postal Service, Yelp and Fidelity among the affected and put the scale at roughly five thousand domains. Network Solutions said the records had been altered while it was dealing with a distributed denial of service incident that Wednesday night, and that customer sites had been inadvertently affected for up to several hours. In the same small hours of 19 June, between 01.00 and 01.36 UTC, an attacker who had got inside Opera Software's network pushed an update to Opera users on Windows signed with an old, expired Opera code-signing certificate. Opera disclosed it on 26 June, said a few thousand Windows users might have received the malware automatically, said its systems had been cleaned with no evidence of user data compromised, and said it would ship a new browser with a new certificate.
The heat map and the system
The Boundless Informant map published on 8 June coloured India among the countries the agency collected most from. The Guardian's own report placed India fifth, with about 6.3 billion pieces of intelligence gathered from Indian networks in the thirty days to March 2013, out of the roughly 97 billion internet records collected worldwide — behind Iran, Pakistan, Jordan and Egypt. The Ministry of External Affairs said that if the privacy of any Indian individual or organisation had been transgressed in violation of Indian law it would be unacceptable, and that the matter had been raised with Washington before and would be again. The fuller defence — the external affairs minister, Salman Khurshid, describing the programmes as computer analysis of patterns rather than snooping — came on 2 July in Brunei and belongs to July's edition.
The symmetry had arrived first. On 7 June 2013, a day after PRISM was published, Human Rights Watch put out a statement on India's own instrument: the Central Monitoring System, rolled out from April 2013 to let agencies monitor telephone and internet communications nationally without going through the service providers. The system threatened rights, the organisation said, for want of adequate legal safeguards or transparency; its senior internet researcher, Cynthia Wong, called the centralised monitoring chilling given what she called the reckless and irresponsible use of the sedition and internet laws. It pointed at the Indian Telegraph Act of 1885 and the Information Technology (Amendment) Act of 2008, and at an expert group's finding of a regime unclear, non-transparent, prone to misuse and offering no remedy to an aggrieved individual. Nothing then obliged anyone to disclose a breach: that came by direction in 2022, a statute on personal data in 2023, and the constitutional question beneath both in August 2017.
New Voices and Sixteen Machines
Apple's Worldwide Developers Conference opened on 10 June 2013 with iOS 7, and the assistant inside it was reworked. Siri gained new male and female voices across English, German and French, could read back Wikipedia entries and search Twitter, was given control of a limited set of device settings, and had the engine behind its web results changed from Google to Bing. A day later Google confirmed it had bought Waze, the Israeli crowd-sourced traffic application, without giving a price; the quarterly filing that followed put it at $966 million. The month's more consequential paper was read in Atlanta, where the thirtieth International Conference on Machine Learning ran from 16 to 21 June. Adam Coates, Brody Huval, Tao Wang, David Wu, Bryan Catanzaro and Andrew Ng described training a network of a billion parameters on three commodity GPU servers in a couple of days, and over eleven billion parameters on sixteen — the arithmetic that would move the next decade of model building onto graphics cards rather than warehouses of ordinary processors.
Citadel Comes Down, and Researchers Object
On 5 June 2013 Microsoft's Digital Crimes Unit filed a civil complaint in the Western District of North Carolina and, with the FBI and banking industry bodies, moved against Citadel, a Zeus derivative used to empty bank accounts. Operation b54 seized more than four thousand domains and pointed them at Microsoft's own sinkhole; the company attributed more than half a billion dollars of losses to the fourteen hundred or so botnets it disrupted. The applause was not unanimous. Roman Hüssy of abuse.ch said roughly a quarter of the seized domains were sinkholes researchers already ran; James Wyke of Sophos found much of the command-and-control estate untouched and questioned the legality of pushing configuration files to infected machines. Symantec, reporting after the 25 June attacks on South Korean government sites, tied them by shared code to what it called the DarkSeoul gang, without naming a state. On the same day Vista Equity Partners took Websense private at $24.75 a share — an early move in the private-equity buying that later took Sophos and McAfee off the public markets.
⏳ Time capsule — June 2013
- On 16 June a cloudburst over Uttarakhand set off four days of flooding and landslides across the north Indian hills; the Air Force, Army and paramilitary forces brought out more than 110,000 people, and the death toll was finally placed at 6,054.
- On 20 June more than two million people marched in over a hundred Brazilian cities, the largest day of protests that had begun on 6 June over a twenty-centavo rise in the São Paulo bus fare; mayors in São Paulo and Rio de Janeiro had cancelled the increases the day before.
- On 23 June Nik Wallenda crossed the Little Colorado River Gorge in Navajo territory near the Grand Canyon on a wire about 1,400 feet long and some 1,500 feet above the ground, untethered, in 22 minutes and 54 seconds, broadcast live with a ten-second delay.
- On 25 June the Supreme Court of the United States struck down section 4(b) of the Voting Rights Act in Shelby County v. Holder, five to four, holding a coverage formula unchanged since 1975 no longer responsive to current needs and leaving section 5 preclearance with no jurisdictions to apply to.
The phrase that outlived the programme
The programme printed on 5 June 2013 did not last. The USA FREEDOM Act, signed on 2 June 2015, ended the government's own bulk collection of telephone records and required specific orders against records the carriers kept themselves. In August 2019 the Director of National Intelligence said the National Security Agency had suspended the call detail records programme and deleted what it had gathered under that authority, and the authority itself lapsed in March 2020. On 2 September 2020 the Ninth Circuit held in United States v. Moalin that the bulk collection had violated the Foreign Intelligence Surveillance Act and might not survive the Fourth Amendment, while upholding the convictions in the case. The finding came seven years after the order and some months after the programme had already been switched off.
The industry's answer moved in three steps. First the argument about the word direct. Then the transparency report: the aggregate totals Facebook and Microsoft negotiated with the Justice Department that June, national security orders folded in with ordinary criminal ones, hardened within two years into an annual publication nobody could skip. Then the part that changed the wire — after the encryption reporting of September 2013 and MUSCULAR in October 2013, the large services encrypted the links between their own data centres and then very nearly everything else, and HTTPS stopped being an option. Snowden did not come back; the counts unsealed on 21 June 2013 stand, and he was naturalised as a Russian citizen in 2022. What June 2013 changed was not that states stopped collecting but that they had to argue for it in public.