Newly Disclosed Documents on the Five Eyes Alliance and What They Tell Us about Intelligence-Sharing Agreements
This article was originally published by Lawfare.
The United States is party to a number of international intelligence sharing arrangements—one of the most prominent being the so-called “Five Eyes” alliance. Born from spying arrangements forged during World War II, the Five Eyes alliance facilitates the sharing of signals intelligence among the U.S., the U.K., Australia, Canada and New Zealand. The Five Eyes countries agree to exchange by default all signals intelligence they gather, as well as methods and techniques related to signals intelligence operations. When the Five Eyes first agreed to this exchange of intelligence—before the first transatlantic telephone cable was laid—they could hardly have anticipated the technological advances that awaited them. Yet, we remain in the dark about the current legal framework governing intelligence sharing among the Five Eyes, including the types of information that the U.S. government accesses and the rules that govern U.S. intelligence agencies’ access to and dissemination of Americans’ private communications and data.
In July 2017, Privacy International and Yale Law School’s Media Freedom & Information Access Clinic filed a lawsuit against the National Security Agency, the Office of the Director of National Intelligence, the State Department, and the National Archives and Records Administration seeking access to records related to the Five Eyes alliance under the Freedom of Information Act. Over the past few months, we have begun to receive limited disclosure from the NSA and the State Department. While we have not seen the text of the current agreement—as well as other records that would shed important light on how the agreement operates—the disclosures to date give us insight into the nature and scope of U.S. intelligence sharing agreements.
Below, we summarize a few of these disclosures and talk through their implications. In particular, we highlight how, taken together, they suggest that the U.S. government takes an inconsistent approach to legal classification and therefore publication of these types of agreements. We also take a closer look at one agreement—the 1961 General Security Agreement between the Government of the United States and the Government of the United Kingdom—which further illuminates our understanding of the privatization of intelligence activities and provides us with a rare glimpse of the “third party rule,” an obstacle to oversight and accountability of intelligence sharing.
The Disclosures
1959-61 Appendices to the United Kingdom-United States Communication Intelligence (UKUSA) Agreement
The sharing arrangements undergirding the Five Eyes alliance were first memorialized in the British-U.S. Communication Intelligence Agreement in 1946, later renamed the United Kingdom-United States Communication Intelligence Agreement. At the time we brought our lawsuit, the 1956 version of the that agreement was the most recent publicly available. In response to our litigation, the NSA disclosed several appendices that span from 1956–61 and therefore update our understanding of the agreement by several years.
1961 General Security Agreement between the Government of the United States and the Government of the United Kingdom (General Security Agreement)
The State Department disclosed the General Security Agreement as well as a set of procedures developed to implement the provisions of that agreement. The General Security Agreement relates to the protection of classified information exchanged between the U.S. and the U.K. and provides that “[o]fficial information given a security classification by either of [the] two Governments ... and furnished by either Government to the other through Government channels will be assigned a classification by ... the receiving Government which will assure a degree of protection equivalent to or greater than that required by the Government furnishing the information.” The State Department also disclosed an exchange of letters between then-U.K. Ambassador to the U.S. Harold Caccia and then-U.S. Secretary of State Dean Rusk expressing their respective governments’ acceptance of the terms of the agreement.
1988 Agreement to Extend the 1966 Agreement between the Government of Australia and the Government of the United States of America relating to the Establishment of a Joint Defence Facility at Pine Gap (Pine Gap Agreement)
The State Department disclosed an exchange of letters between then-Australian Minister for Foreign Affairs Alexander Downer and then-U.S. Ambassador to Australia Genta Holmes expressing their respective governments’ agreement to extend the terms of the 1966 “Agreement between the Government of Australia and the Government of the United States of America relating to the Establishment of a Joint Defence Facility at Pine Gap.” Pine Gap is a base located in Alice Springs, Australia jointly operated by the U.S. and Australia. From Pine Gap, the U.S. controls satellites across several continents, which can conduct surveillance of wireless communications, such as those transmitted via cell phones, radios and satellite uplinks. The intelligence gathered supports both intelligence activities and military operations, including drone strikes.
The letters express the U.S. and Australian governments’ agreement to extend the Pine Gap Agreement “for a period of ten years from 16 November 1988” and to have it remain in force thereafter “until terminated.” The letter from Downer to Holmes expressly proposes that
this Note and your confirmatory reply thereto shall together constitute an Agreement between our two Governments concerning this matter which shall enter into force on the date that the Government of Australia notifies the Government of the United States of America that all domestic procedures as are necessary to give effect to this Agreement in Australia have been satisfied.
Observations
An Inconsistent Approach to International Agreements
The Pine Gap and General Security Agreements described above differ in a notable respect: While the 1988 extension to the Pine Gap Agreement is available to the U.S. public, the 1961 General Security Agreement has not been published by the United States. This difference reveals gaps in the laws requiring the publication of international agreements. And it bolsters calls, raised elsewhere, for greater executive branch transparency and accountability in the formation and legal bases of these types of agreements.
The United States plainly considers the 1988 extension to the Pine Gap Agreement a legally binding international agreement. The U.S. State Department has made the 1988 Pine Gap Agreement publicly available in the Treaties and Other International Agreements Series (TIAS), a repository which serves as “competent evidence” of the treaties and other international agreements entered into by the United States. 1 U.S.C. § 113. Likewise, the Australian government has published the Pine Gap Agreement in the Australian Treaty Series. But whereas the Australian government has also published the text of the original 1966 Pine Gap Agreement, the United States has not. This omission is significant. Only the 1966 agreement contains the terms agreed upon by both parties—in other words, the nature and scope of the agreement to establish a joint defense facility to conduct intelligence activities.
Similarly, neither the U.S. nor the U.K. appear to have published the 1961 General Security Agreement. According to the U.K. government’s response to a Parliamentary question in 2000, the General Security Agreement had not been declassified at that time. Searching through a variety of publicly available materials, including government websites and academic databases, we found several references to the General Security Agreement, but not the Agreement itself (nor portions of it). For example, the 2007 Treaty with United Kingdom Concerning Defense Trade Cooperation recognizes “principles established under the General Security Agreement.” However, prior to the State Department’s disclosure in response to our FOIA request, we did not know what these principles were.
There is a colorable argument that State has a legal duty to publish both the original text of the Pine Gap Agreement and the 1966 General Security Agreement, as well as any updates to both. Under 1 U.S.C. § 112a, the Secretary of State is required to publish all treaties and non-treaty international agreements to which the United States is a party. This duty is subject to a short list of exceptions outlined in § 112a(b). Most notably, the State Department may elect not to publish an international agreement if, “in the opinion of the President,” disclosure would prejudice national security interests.
The government could justify its failure to publish the agreements on two grounds. First, the national security exemption might apply. However, this claim falls apart in light of the facts that the original Pine Gap Agreement has already been published by the Australian government and the United Nations, and State released the General Security Agreement in response to a FOIA request notwithstanding FOIA’s national security exemption in 5 U.S.C. § 552(b)(1).
A second argument could be made that at the time of their formation, the U.S. State Department did not consider the 1966 Pine Gap Agreement and the General Security Agreement to be binding international agreements. Under current U.S. law, legally binding international agreements may take the form of treaties or executive agreements. The majority of U.S. international agreements are executive agreements, which, as the Congressional Research Service outlines, take three general forms:
- congressional-executive agreements, in which Congress has previously or retroactively authorized an international agreement entered into by the Executive;
- executive agreements made pursuant to an earlier treaty, in which the agreement is authorized by a ratified treaty; and
- sole executive agreements, in which an agreement is made pursuant to the President’s constitutional authority without further congressional authorization.
The 1966 Pine Gap Agreement and the General Security Agreement appear to fall into the third category. Both were formed under the executive’s Article II powers in foreign affairs and national security and without congressional authorization.
Prior to the 1970s, executive agreements were unregulated and undefined. Indeed, it was not until after the Case-Zablocki Act’s passage in 1971 that the State Department outlined criteria for identifying non-treaty international agreements. By this logic, the United States perhaps did not publish the agreements because it did not understand them to trigger § 112a’s publication requirement at the time they were signed.
This argument, however, is suspect because both agreements appear to remain in force. In fact, evidence suggests that the 1966 General Security Agreement is not the most recent version in effect. The British House of Commons referenced 1983 and 1984 amendments to the General Security Agreement, as well as a “new Security Implementing Arrangement for operations between the [U.K. Ministry of Defense] and the [U.S. Department of Defense]” formed in 2003. And since it was the State Department that gave us these disclosures, State possessed these agreements (and even recognized the Pine Gap Agreement in the TIAS). Accordingly, the State Department should have published the agreements pursuant to § 112a.
The U.S. government’s failure to publish these agreements adds to longstanding confusion about what constitutes an international agreement under U.S. law, their legal bases, how many have been formed, and what they contain. It also makes it more difficult for the public to hold the government accountable. As others have noted, “Today nearly all of U.S. international law is made by the President acting alone with little oversight by Congress or the U.S. public.” Put simply, members of the public should not have to undertake lengthy FOIA processes (these disclosures were made nearly a year after we filed our request) in order to uncover the text of agreements that underpin our understandings of national security and international cooperation.
The 1961 General Security Agreement
Below, we take a closer look at the 1961 General Security Agreement. In particular, we consider its provisions on the role of private contractors, which contributes to our understanding of the privatization of intelligence activities. We further consider the General Security Agreement’s invocation of the “third party rule,” a rarely-seen but common feature of intelligence sharing agreements, which presents a challenge to the effective oversight and accountability of intelligence sharing.
The History of Privatizing Espionage
The 1961 General Security Agreement sheds important light on the history and scope of the privatization of espionage, particularly during the formative years of the U.S. intelligence community. A substantive body of literature on this topic does exist, one prime example being Tim Shorrock’s “Spies for Hire,” which discusses the “American Intelligence-Industrial Complex, the agencies it serves, its key industrial players, and the former high-ranking national security officials who run its largest companies.” In his book, Shorrock maps out the historical origins and underpinnings of this partnership. For instance, he describes how the CIA contracted with Lockheed Corporation to build the U-2 Spy planes, which were used to gather intelligence during the Cold War, including on the Soviet Union and the People’s Republic of China. He also describes how the CIA contracted with General Electric, Itek, and Lockheed to commission the CORONA photoreconnaissance satellites, which catalogued Soviet ICBM complexes. The CIA was hardly the only government player in such partnerships. As Shorrock highlights, “outsourcing has always been part of the U.S. spying enterprise,” suggesting that other parts of the U.S. intelligence community have long been involved in the practice. For example, in the 1950s, IBM, Bell Labs, and Cray developed the first supercomputers and encryption equipment which the NSA “used to crack coded diplomatic and military messages and convert huge volumes of signals intelligence into actionable intelligence.”
Much of the existing literature focuses on the relationship between the U.S. intelligence community and American corporations, but very little is known about outsourcing from U.S. intelligence agencies to foreign corporations and from foreign intelligence agencies to U.S. corporations. Even less is known about the level of access that foreign contractors might have to classified American intelligence. The “Industrial Security Annex” of the General Security Agreement sheds some light on these relationships:
The Annex governs “those cases in which contracts, subcontracts, precontract negotiations or other government approved arrangements involving classified information of either or both countries, hereinafter referred to as classified contracts, are placed or entered into by or on behalf of the” U.K. or U.S. governments.
The Annex provides a mechanism by which U.S or U.K. contractors can be treated as government entities for the purposes of sharing classified information. The general rule is that “[t]ransmission of classified information and material shall be made only through representatives designated by each of the governments ... known as transmission through government-to-government channels.” But
[a]s an exception, the US may transmit classified material directly to a firm located in the US which is under the ownership, control, or influence of a UK entity, and the UK may transmit such information directly to a firm in the UK which is under the ownership, control, or influence of a US entity provided such firms have been granted a reciprocal security clearance ... and the information is determined to be releasable under the national disclosure policy of the releasing government.
In very limited circumstances, the Annex also provides a mechanism by which non-U.S/U.K. contractors might be “eligible to be awarded classified contracts.” The general rule is that “[f]irms which are under the ownership, control, or influence of a third party country are not eligible.” But “[r]equests for exception to this requirement may be considered on a case-by-case basis by the releasing government.”
As Shorrock notes “many of the companies that dominate the intelligence industry today got their start by providing technical services and products to the Intelligence Community.” The conventional wisdom is thus that the public-private partnerships of the 1950s and 1960s were predominantly of a technological nature, namely to facilitate the development of new surveillance capabilities. One would therefore expect the Industrial Security Annex to limit the scope of access by contractors to information strictly necessary to accomplish those kinds of technical assignments. In reality, however, the Annex places no such limitation on the type of information that may be shared with contractors. Rather, the Annex covers the transmission of “classified information in any form, be it oral, visual or in the form of material,” and defines material as encompassing “everything regardless of its physical character or makeup including” documents, writing, maps and letters. Furthermore, the Annex establishes no criteria for what intelligence community activities may be outsourced, whether they may be outsourced to foreign contractors, and under what circumstances.
Scholars have, in the past, raised concerns about the privatization of espionage. For example, Professor Martin Trybus has argued that privatizing intelligence work degrades a set of fundamental objectives:
First, democracy and the rule of law are compromised. Escaping parliamentary and judicial scrutiny are important reasons for privatisation in the first place. Second, value for money is compromised since the private sector operates at higher costs and the necessity of security clearances limits competition to an extent undermining the economic rationale for privatisation in this sector dominated by national security and secrecy concerns. Finally, national security is compromised by the higher costs for intelligence on the one hand and intelligence and know-how being transferred outside the intelligence agencies on the other hand. The public interest enshrined in the three objectives of the triangle does not appear to be served by the current state of privatisation of intelligence services in the United States.
The privatization of espionage also raises concerns about the outsourcing of inherently governmental functions. U.S. law has long prohibited contractors from performing such functions. But there is insufficient guidance on what constitutes “inherently governmental functions.” (For a review of conflicting definitions under U.S. law, see this 2009 summary by the Congressional Research Service). For example, should a private contractor be permitted to engage in target selection or intelligence analysis and verification? Professor Simon Chesterman has noted that “uncertainty in this area appears to be intentional and thus exacerbates the accountability challenges posed by secrecy and problematic incentives.”
The “Third Party Rule” or the “Originator Control Principle”
The 1961 General Security Agreement also provides a rare glimpse of the “third party rule” or “originator control principle,” considered a common feature of many intelligence sharing arrangements. The third party rule prohibits the disclosure of information shared between agencies to third parties, which may include oversight bodies, without the prior consent of the state from which the information originated. As Privacy International has noted, such rules limit oversight and weaken accountability of intelligence sharing.
While the use of the third party rule is commonly remarked upon in discussions of intelligence sharing (by both civil society and multilateral organizations), we have had few opportunities to see what the rule actually looks like in practice, as intelligence sharing agreements are rarely subject to public scrutiny. The General Security Agreement contains two different articulations of the third party rule: one contained within the letter exchange concerning the Agreement from the U.S. to the U.K. and the other within an annex to the Agreement on General Security Procedures. The former is more expressive and less stringent than the latter and reads as follows:
Recognizing that the protection of all classified information communicated directly or indirectly between our governments is essential to the national safety and security of both our countries, I have the honor to suggest the following mutual understanding for the protection of such information, namely, that the recipient:
a. Will not release the information to a third Government without the approval of the releasing Government.
b. Will undertake to afford the information substantially the same degree of protection afforded to it by the releasing Government.
c. Will not use the information for other than the purpose given.
d. Will respect private rights, such as patents, copyrights, or trade secrets which are involved in the information.” (emphasis added)
The third party rule as expressed in the Annex is far shorter, stating:
The recipient government will not use such information for other than the purposes for which it was furnished and will not disclose such information to a third Government without the prior consent of the Government which furnished the information
As articulated, the third party rule illustrates the desire for a partner agency to retain some measure of control over shared information. In some instances, that control might also protect human rights. For example, the rule helps to prevent the further dissemination of shared information to third party agencies, particularly those that the originating agency is concerned would potentially misuse the information. One example of misuse is the Maher Arar case where the Canadian government produced inaccurate intelligence, which was later shared with the U.S. government. The U.S. government subsequently detained Mr. Arar for 12 days and then proceeded to subject him to rendition in Syria where he was tortured.
Governments have also interpreted the third party rule as prohibiting disclosure to other third parties and have included oversight bodies within that prohibition. Under this interpretation, the rule can be fundamentally detrimental to intelligence oversight. As a matter of principle, requiring oversight bodies to seek consent from a foreign agency to access intelligence information shared with a domestic agency can cripple their capacity to exercise independent and impartial oversight. And as a matter of practice, foreign partners are unlikely to consent to such requests. Seeing the two different articulations of the third party rule in the General Security Agreement highlights that there is no “one size fits all” phraseology for the rule. Alternative versions of the rule attentive to human rights might include, for example, a carve-out that would explicitly permit oversight bodies in both countries to review shared information.