The documents describe an operation known as MILK COOKIES, based out of Fort Meade and run in conjunction with the U.S. Postal Service. COOKIES is the interception of the letters while MILK feeds them through a complex series of algorithms to spot any hidden messages.
Agency director Gen. Keith Alexander had previously testified to Congress in 2011 that the NSA would occasionally collect letters addressed to Santa, but insisted that it was totally accidental and that no one was actually reading or storing them.
The NSA is prohibited from directly monitoring American citizens under both Executive Order 12333 and the Foreign Intelligence Surveillance Act. However, because the letters are addressed to the North Pole, which falls outside of U.S. territory, they are considered potential foreign intelligence signals which the NSA is authorized to intercept.
Speaking on condition of anonymity, a former senior administration official defended the program: “We’re only looking for any unusual presents, like children who ask Santa for pressure cookers, large amounts of ammonium nitrate fertilizer, hyzadrine rocket fuel, things like that. I mean a six-year old with a hammer is bad enough; just try to imagine that same six-year old with a truck bomb.”
The leaked reports show that the NSA also routinely hacked Santa’s Naughty and Nice List for any information on world leaders, and at one point tried to smuggle surveillance devices disguised as lumps of coal into Santa’s sack. They also reveal the existence of a massive NSA data storage center at the North Pole, known as ELFCHELON, which dwarfs even the planned one at Utah, and is capable of storing letters dating back to 1952.
The documents were part of the massive data haul taken by fugitive whistleblower and Playgirl centerfold Edward Snowden, whom the former official referred to as “a very naughty boy.”
U.S. intelligence has closely monitored the Letters to Santa program ever since the U.S. Post Office first created it in 1912. Initially, children’s letters were reviewed by both Army and Navy Intelligence under the aegis of Project SHAMROCK until that program’s termination in 1975.
Four years later the NSA began MILK COOKIES in response to the Secret Santa program, which the agency initially thought was a Soviet operation after a flier for the program mistakenly replaced the picture of Santa with Karl Marx.
Following the September 11, 2001, terrorist attacks, the NSA began an almost-relentless campaign to insert itself both legally and covertly into the Christmas spirit.
First the NSA managed to get language inserted into the PATRIOT Act which required Santa to file a flight plan with NORAD and submit to random TSA inspections at select chimneys. Then came the 2002 judgment in United States v. Kringle, when the NSA and the Justice Department ordered him to deliver multiple GPS devices to the location of Usama bin Laden and other high-ranking Al Qaeda leaders.
When Santa refused and was put on a no-fly list he briefly had to outsource all his American operations to Canada, which handles diplomatic issues for the North Pole.
In response to the scandal, the task force appointed by President Obama to review NSA activity has issued a further critique of the agency. Calling Santa a “close and traditional U.S. ally,” panel member Richard Clarke urged tough new restrictions on NSA collection against holiday figures.
He added, “We’re not in any way recommending the disarming of the intelligence community. The NSA can still spy on the Easter Bunny.”
Top NSA officials were skeptical. “What else would you expect from someone who asked Santa for a Barbie doll when he was nine?” Gen. Alexander was overheard remarking.
Some privacy advocate groups believe that the panel’s recommendations don’t go far enough. They are telling parents not to let their children use the U.S. Post Office to contact Santa this year, and risk having their children’s information indefinitely stored for whatever the government wants to use it for.
Parents are instead being urged to use organizations that have a higher regard for privacy, such as Google or Facebook.