The Whistleblower Who Uncovered the NSA’s ‘Big Brother Machine’
On January 20, 2006, the front doorbell rang at the Electronic Frontier Foundation’s offices on Shotwell Street in the Mission District of San Francisco. At the time, Shotwell Street wasn’t the glamorous part of the Mission. Our offices sat between two auto repair shops, across the street from a utility substation. The sidewalk was often dotted with homeless people’s tents. At one point, San Francisco did a survey, and our block of Shotwell Street had the highest reported amount of human feces in the whole city.
We had many people down on their luck ring that doorbell. Some were just lost. Others sought us out because they believed, quite sincerely, that the government or aliens had put a chip or magnet in their brains. We tried to be sympathetic and point them to other resources, but generally we had to turn them away.
Because of this, it was with friendliness but some caution that our executive director, Shari Steele, answered the bell.
“Do you folks care about privacy?” the guy asked. He was in a tan trench coat, looked to be in his early 60s, with gray hair, intense eyes, and a raspy voice.
“Why yes, we do,” Shari answered.
“Then I have some information for you. I am a retired AT&T technician. I know how the NSA is tapping into the internet at an AT&T facility downtown.”
“Well, come on in.”
Shari found EFF attorney Kevin Bankston in his tiny office. They talked for a long time. After the man left, Kevin and Lee Tien, another EFF attorney, burst into my office.
“This guy named Mark Klein, who just came to the door, has something,” Kevin said, with more excitement than I had seen from him in a long time. I was immediately intrigued, but what they told me blew past my highest expectations. Mark had presented us with unequivocal evidence that the National Security Agency was engaged in mass, untargeted spying in the U.S. by tapping into the internet backbone. And it was doing this from an AT&T building just a short distance from our offices.
The backstory to Mark knocking on EFF’s door starts in 2001 with the government’s response to the horrific 9/11 attacks. The first of these was the Patriot Act.
In the seven weeks between its introduction and passage in 2001, Lee and I stayed up countless nights trying to parse the three-inch-thick printout of the proposed legislation to identify the sections that affected the internet. We needed to understand what laws the government wanted to change, spot overreach and unconstitutionality, and marshal appropriate support or resistance where necessary.
The draft legislation had been rolled out so quickly that we had the impression it was just sitting in an envelope on someone’s desk, with a note that read, “Open at the next crisis.” Our theory was confirmed when we saw that a good chunk of the proposed law was nearly the same package of legal changes that the FBI had tried — and failed — to push after the Oklahoma City bombing in 1995.
One big change impacting surveillance was clear: Prior to September 11, the U.S. had what could reasonably be called a “wall” separating foreign surveillance for national security purposes done by the NSA from domestic surveillance for law enforcement purposes done by the FBI. The theory was that those powers would never be turned on in the U.S. and used against its own people. The Patriot Act, however, helped erode that wall.
Soon, folks at EFF started to hear whispers of mass domestic surveillance programs. We were told confidentially that the NSA was gathering all the telephone records from America’s leading telecommunications companies. We separately heard that the NSA was now sitting on the wire in the U.S. We even heard that the agency was collecting metadata on our online activities from both telecommunications companies and some internet companies. Friends in the industry would say things like, “You wouldn’t believe what the NSA is doing in the United States now,” and “I can’t tell you anything without getting in trouble, but it’s massive.”
All sounded wildly illegal under the Foreign Intelligence Surveillance Act (FISA) and the Patriot Act. Several people reached out to us, and each time we sat down with them to see if we had enough provable facts to bring a case. But no one who reached out to talk to us was willing to go on the record, much less provide documentary evidence we could use in court.
The information Mark gave us made the whispers we had heard over the years from our friends at telecommunication companies make more sense. By his account, mass spying involved the internet’s deepest layer, known as the “backbone.” A set of large providers — big companies, academic institutions, and governments — operate a series of powerful computers that provide the backbone’s main data routes.
AT&T operated part of the internet backbone from the Folsom Street facility. One component of Mark’s job was to maintain the section of the AT&T system that routed traffic from AT&T’s internal networks to the internet backbone via a set of connections called “peering links.” What Mark was telling us, and what his documents were showing, was that the NSA was now tapping in at these junctures.
Mark had been a technician at AT&T for many years. In mid-2003, he was transferred to the Folsom Street building and charged with maintaining the room where AT&T’s own fiber-optic network connected to the rest of the internet.
Mark told us that the fiber-optic cables carrying traffic to and from AT&T’s portion of the backbone converged on the seventh floor of the Folsom Street building. This was reasonable. But he showed us that those cables also connected down to the sixth floor of the building. The sixth floor was where the weirdness happened. Sometime in 2002, a “secret room” (designated 641A) had been built on that level of the building, accessible only to workers with NSA clearances. Mark didn’t have clearance himself, but he knew and worked with the person who did and had access to that room.
Next to the secret room was a “splitter cabinet.” On one side, the internet-connecting fiber-optic cables that came down from the seventh floor fed into it. On the other side, two sets of fiber-optic cables came out. One set snaked back up to the seventh floor to carry traffic onto the wider internet. But a second set of cables went into the secret room.
Outside the room, the splitter cabinet and newly installed wiring meant that when the communications came down from the seventh floor, they were “split” there. One copy of the communication went into the secret room, while the other went to the intended recipient. In this way, the NSA could be sitting “on the wire” inside the U.S., the fiber-optic cables that carry everyone’s communications, since it could make and capture a copy of all the traffic passing through the juncture. The NSA could then review the traffic separately, without slowing it down or leaving any trace of what it was actually doing on the public network. Mark called it the “Big Brother machine.”
I tried hard to keep my jaw from dropping as Mark explained both the banality of the technical infrastructure — so clear that I could easily understand how it worked — and the audacity of what the NSA and AT&T had built together to undermine the privacy of likely hundreds of millions of innocent people, including millions of AT&T’s own customers. His revelation was not entirely unexpected; what was unexpected was someone knocking on our front door and handing us the actual schematics.
We talked with several telecommunications experts, and they confirmed that this setup was a reasonable method for the NSA to “sit on the wire” in a way that would allow it to operate surreptitiously while remaining effective. One expert we talked to, who had been involved in the development of several critical internet technologies, including email, web, and document representation and transmission, said, “This isn’t a wiretap, it’s a country tap.”
We had our evidence. This was that crucial confirmation, in a form admissible in court, that we had been hoping for. We knew, and could now prove, that AT&T had facilitated illegal domestic surveillance of internet communications. As part of the legal strategy we had been crafting, this evidence would help us bring a lawsuit against mass surveillance.
It was nearing the end of January. With Mark Klein’s direct evidence about AT&T in hand, the next thing to do was to get him his own lawyers. We needed him as a star witness, so we couldn’t have him be our client. The risk of conflicts of interest between Mark and AT&T customers wasn’t great, but it was real, especially if Mark faced prosecution or a civil claim from AT&T. We all knew — as did Mark — that he had serious legal risk. We made some calls and were overjoyed when an all-star team readily signed on.
On March 31, we filed our motion for a preliminary injunction, including Mark’s declaration and the AT&T documents he had provided. As a courtesy, I also called the Department of Justice and left a message informing them of Mark’s declaration and the evidence.
The person who returned my call was DOJ attorney Tony Coppolino. Tony and I had actually become friendly over the years. He was a nice guy and a smart and fair-minded opponent. I’ll never forget the first voicemail I got from him after we filed Mark’s evidence.
“Hi Cindy, it’s Tony Coppolino calling about your Hepting case. I’m baaaack. Call me.”
I did, on a Friday afternoon. “Hi Tony, are you handling this case? This will be fun.”
“Yes, it looks like it. But this is serious; we need to see the documents you filed right away to see if they are classified. If so, it is illegal for you to even have them.”
“I don’t think they are classified, Tony. They aren’t marked as ‘classified’ or anything like that. I’m happy to show them to you. Can’t you get them directly from the court?”
“With all due respect, Cindy, you don’t know if they are classified since they don’t have to have markings and can still be classified. Only we can tell. We also can’t get them from the court if they are classified. Can you have someone bring another copy down to the SCIF [sensitive compartmentalized information facility] in the federal building so that they can be sent to us in DC?”
“Sure. We’ll do that right away. How will you get them?”
“Well, there is a very slow but very secure fax machine in the San Francisco SCIF that will get them to us in DC, page by page.”
“Well, OK, but I could FedEx them, or fax or even email them . . .”
“No. None of those ways are secure enough. This is the only way. And if they are classified, you are likely in trouble.”
After I got off the phone, we quickly arranged for another set of the documents to be delivered to the federal building. After we sent off the documents, we all started to get a little nervous. We looked up, again, the potential prison sentence for illegal possession of classified information. We reminded ourselves that we didn’t think the documents were classified, and even if they were, they revealed a flatly illegal and unconstitutional program. The classification system is not supposed to be used to hide illegal government actions. After all, we were only showing them to a federal court, under seal, to try to get the law applied to have the program stopped. That couldn’t get us in trouble, right?
The truth was, we were all a little worried.
Cindy Cohn is Executive Director of the Electronic Frontier Foundation. From 2000 to 2015, she served as EFF’s Legal Director and General Counsel. Today, she leads a team of more than 120 lawyers, activists, and technologists dedicated to ensuring that technology supports speech, privacy, and innovation for all people around the world. Cindy is the author of “Privacy’s Defender,” from which this article is adapted.
Facts Only
Mark Klein, a retired AT&T technician, visited the Electronic Frontier Foundation (EFF) offices in San Francisco on January 20, 2006.
Klein provided evidence that the NSA was tapping into internet backbone traffic at an AT&T facility located on Folsom Street in San Francisco.
The surveillance involved a "secret room" (641A) on the sixth floor of the AT&T building, accessible only to NSA-cleared personnel.
A "splitter cabinet" duplicated internet traffic, sending one copy to the secret room and another to its intended destination.
Klein had worked at AT&T for years and was transferred to the Folsom Street facility in mid-2003.
The EFF had previously heard unconfirmed reports of mass domestic surveillance but lacked concrete evidence before Klein’s disclosure.
The Patriot Act, passed in 2001, weakened legal distinctions between foreign and domestic surveillance.
EFF filed a lawsuit against AT&T in March 2006, using Klein’s documents and testimony as evidence.
The Department of Justice (DOJ) claimed the documents might be classified and demanded their secure transfer via a slow fax machine.
DOJ attorney Tony Coppolino warned EFF that possessing classified material could be illegal, though the documents were not marked as classified.
EFF arranged for the documents to be sent to a federal SCIF (sensitive compartmentalized information facility) for secure transmission to Washington, D.C.
The case raised concerns about legal risks for whistleblowers and the extent of corporate cooperation with government surveillance.
Executive Summary
In 2006, Mark Klein, a retired AT&T technician, approached the Electronic Frontier Foundation (EFF) with evidence that the NSA was conducting mass surveillance by tapping into internet backbone traffic at an AT&T facility in San Francisco. Klein provided documents and firsthand accounts detailing how a "secret room" (641A) on the sixth floor of the Folsom Street building allowed the NSA to copy and analyze internet communications without detection. This revelation confirmed long-standing suspicions about illegal domestic surveillance programs, which EFF had been investigating since the passage of the Patriot Act in 2001. The Patriot Act had eroded legal barriers between foreign and domestic surveillance, enabling the NSA to operate more aggressively within the U.S. Despite earlier whispers from industry insiders, Klein’s evidence was the first concrete proof of such activities. EFF used his testimony to file a lawsuit against AT&T, arguing that the company had facilitated unconstitutional surveillance. The Department of Justice responded by questioning the legality of EFF’s possession of the documents, claiming they might be classified, though they were not marked as such. The case highlighted tensions between national security, corporate complicity, and civil liberties, with EFF positioning itself as a defender of privacy rights against government overreach.
The situation underscores the challenges of balancing security and privacy in the post-9/11 era. While the government justified expanded surveillance powers as necessary for counterterrorism, critics argued that programs like the one exposed by Klein violated constitutional protections and operated without adequate oversight. The legal and ethical implications of such surveillance remain contentious, particularly regarding the role of private companies in enabling state monitoring. Klein’s whistleblowing also illustrates the risks faced by individuals who expose classified or sensitive information, even when their actions serve the public interest. The EFF’s response—pursuing litigation while navigating potential legal threats—reflects the broader struggle to hold powerful institutions accountable in an environment where secrecy and national security concerns often take precedence.
Full Take
The strongest version of this narrative presents a clear and compelling case of government overreach enabled by corporate complicity, with Mark Klein’s whistleblowing serving as a rare moment of accountability. The EFF’s role as a defender of civil liberties is framed as both necessary and courageous, particularly in the face of legal threats from the DOJ. The technical details provided by Klein—such as the splitter cabinet and secret room—lend credibility to the claim that the NSA was conducting mass, untargeted surveillance on American citizens. The narrative also effectively highlights the erosion of legal safeguards post-9/11, positioning the Patriot Act as a turning point that normalized previously unthinkable intrusions into privacy.
However, the story also invites scrutiny of its framing. The EFF’s perspective is central, and while their advocacy for privacy is well-documented, the piece does not explore counterarguments from national security proponents who might argue that such surveillance is necessary for preventing terrorism. The DOJ’s response—focusing on the classification of documents rather than the legality of the surveillance itself—could be seen as an evasion tactic, but it also reflects genuine concerns about the handling of sensitive information. The emotional weight of the narrative, particularly in describing the EFF’s mission and the risks faced by Klein, may appeal to readers’ sense of justice but could also be interpreted as a form of moral framing that simplifies complex trade-offs between security and liberty.
At its core, this narrative reflects a broader paradigm of distrust in government and corporate power, echoing historical patterns of surveillance abuses, from COINTELPRO to the Church Committee hearings. The implications for human agency are significant: if mass surveillance operates without transparency or accountability, the ability of individuals to exercise privacy rights is severely diminished. The beneficiaries of such systems are typically state actors and their corporate partners, while the costs—chilling effects on free speech, erosion of trust in institutions—are borne by the public. Second-order consequences include the normalization of surveillance as a tool of governance, which could further entrench unchecked power.
Bridge questions worth considering: What safeguards, if any, could make mass surveillance programs constitutionally permissible? How should the legal system balance the protection of whistleblowers with the need to safeguard national security secrets? What role should private companies play in resisting or facilitating government surveillance requests?
Counterstrike scan: If this narrative were part of a coordinated influence campaign, the playbook would likely emphasize the dangers of unchecked government power, frame corporations as complicit enablers, and position civil liberties organizations as the sole defenders of democracy. The actual content aligns with this pattern to some extent, particularly in its focus on the EFF’s heroic role and the villainy of the NSA and AT&T. However, the inclusion of specific technical details and legal proceedings grounds the narrative in verifiable facts, reducing the likelihood of outright manipulation. The piece does not engage in overt emotional exploitation or distortion, though it does lean into a clear moral framework.
Patterns detected: ARC-0024 Ambiguity (in the DOJ’s classification claims), ARC-0043 Motte-and-Bailey (potential retreat to "national security" as a justification for surveillance).