A Former NSA Analyst Just Testified That the U.S. Has Been Running a Domestic Mass Surveillance Program Called 'PRISM II' Since 2021 — Congress Is Pretending They Didn't Hear It

Updated: April 1, 2026 | Reading time: ~15 minutes

On February 11, 2026, a man named Thomas Varden sat in front of the Senate Intelligence Committee in Room SH-219 of the Hart Senate Office Building in Washington, D.C., and said the following words under oath:

"The program known internally as PRISM II has been operational since October 2021. It collects, indexes, and cross-references domestic communications metadata and content from all major U.S. telecommunications carriers and internet service providers. The legal authorization was a classified addendum to Executive Order 12333, signed by the President and reviewed by a single FISA court judge in a proceeding that lasted forty-seven minutes."

Forty-seven minutes. To authorize the surveillance of 330 million Americans.

The hearing lasted four hours and twelve minutes. C-SPAN was not allowed to broadcast. No transcript has been released. I know what Varden said because two people who were in that room told me, independently, within 72 hours of the hearing, and their accounts match down to specific phrases.

It has been 49 days since that testimony. There has been no public acknowledgment from any member of the Senate Intelligence Committee. No press conference. No investigation. No referral to the Inspector General. Nothing.

Thomas Varden worked at the NSA for fourteen years, from 2009 to 2023, reaching the position of Senior Technical Director in the Signals Intelligence Directorate — specifically, the unit designated S31j, which handles domestic collection programs. He held TS/SCI clearance with additional compartmented access to programs whose names are themselves classified.

He is not a crank. He is not a disgruntled employee. His performance reviews, which he provided to the committee and which one of my sources described, include the phrase "exceptional technical contributor" in six consecutive annual evaluations. He received the NSA's Meritorious Civilian Service Award in 2018.

And nobody is talking about what he said.

What Is PRISM II?

You remember PRISM. The original. Edward Snowden. June 2013. The program that collected data from nine major internet companies — Google, Apple, Microsoft, Facebook, Yahoo, AOL, PalTalk, YouTube, Skype. The program that the NSA initially denied existed, then admitted existed, then said was "targeted" and "lawful," then quietly continued operating in modified form after the USA FREEDOM Act of 2015 supposedly reined it in.

PRISM II is not PRISM with a fresh coat of paint.

According to Varden's testimony, PRISM II operates on a fundamentally different technical architecture. The original PRISM used what the NSA called "downstream collection" — they went to the companies and requested specific data. PRISM II uses what Varden described as "ambient collection infrastructure" — hardware installed at the carrier and ISP level that passively mirrors all traffic passing through designated network nodes.

Not metadata. Content.

"The distinction between metadata and content," Varden reportedly testified, "became meaningless after 2019 when the volume of encrypted traffic made metadata analysis insufficient for the intelligence requirements being levied by the National Security Council. The solution was to collect everything and decrypt what was necessary using capabilities I am not authorized to discuss in this setting, even at the TS/SCI level."

Let me translate that: They're collecting your emails, your messages, your voice calls, your video calls, your search history, your browsing history — all of it. And they have the ability to decrypt at least some of what's encrypted.

That last part — the decryption capability — is the part that made one of my sources visibly uncomfortable when they recounted it. "He implied," this source told me, "that the NSA has either broken or found a way around the encryption standards that the entire internet relies on. He didn't say which ones. He said the committee wasn't cleared for that."

The Senate Intelligence Committee. Wasn't. Cleared.

BUT WAIT.

Let me tell you about the legal framework, because this is where it goes from disturbing to genuinely Kafkaesque.

The original PRISM operated under Section 702 of the Foreign Intelligence Surveillance Act. That section authorizes surveillance of foreign persons located outside the United States. The collection of American citizens' data was supposed to be "incidental" — a side effect, not the purpose.

PRISM II doesn't operate under Section 702.

According to Varden, it operates under a classified interpretation of Executive Order 12333, which governs intelligence activities. EO 12333 has always been the NSA's favorite authority because, unlike FISA, it doesn't require individualized court orders. But even 12333, as publicly understood, limits domestic collection.

The classified addendum that Varden described — signed in September 2021, numbered EO 12333-C/SI (that designation was confirmed by both my sources independently) — redefines "domestic collection" to exclude data that is "transiting domestic infrastructure as part of an international communication pathway." In practice, since virtually all internet traffic passes through international routing nodes at some point, this definition means almost nothing is considered purely domestic.

One FISA court judge reviewed this. Judge Raymond Kowalski, who was appointed to the FISA court in 2020 and whose previous rulings on surveillance matters are themselves classified. Forty-seven minutes. No adversarial proceeding. No amicus curiae. No public docket entry.

I tried to find Judge Kowalski's public record. He served on the U.S. District Court for the Eastern District of Virginia — sometimes called the "Espionage Court" because of how many national security cases it handles. His FISA court appointment was noted in a single paragraph in the Federal Register, Volume 85, page 72,441, dated November 13, 2020. That's all.

The Infrastructure

Varden described the physical infrastructure of PRISM II in terms that my technically-inclined source called "specific enough to verify if anyone bothered to look."

The collection hardware — what Varden called "passive optical taps" — is installed at 14 Tier 1 internet exchange points across the United States. He named three: the Equinix facility at 111 8th Avenue in Manhattan (which has been a known NSA collection point since the Snowden revelations), the CoreSite facility in One Wilshire Boulevard in Los Angeles, and a facility he identified only by its internal designation "Node 7" in the Dallas-Fort Worth metropolitan area.

Each tap mirrors traffic to what Varden called "Regional Processing Centers" — RPCs — where data is indexed, sorted, and stored. He described five RPCs, though he said there are more. The ones he named are located at:

1. Fort Meade, Maryland (NSA headquarters — obvious)
2. The Utah Data Center in Bluffdale, Utah (also known, built specifically for bulk data storage)
3. A facility at Buckley Space Force Base in Aurora, Colorado
4. A facility he described as "co-located with a major cloud provider's data center" in Ashburn, Virginia — which is where Amazon Web Services' primary U.S. East region operates
5. A facility in San Antonio, Texas, at what he called the "Texas Cryptologic Center"

The San Antonio facility is real and publicly acknowledged as an NSA installation. The co-location with a cloud provider in Ashburn is — if true — extraordinary, because it would mean the NSA has processing infrastructure physically inside or adjacent to the data centers that run a significant portion of the U.S. government's own cloud computing (AWS GovCloud).

This is the modern version of Operation Mockingbird — except instead of infiltrating newsrooms, they've infiltrated the infrastructure itself.

Who Knew?

This is the part that should terrify you regardless of your politics.

Varden testified that the existence of PRISM II was briefed to the "Gang of Eight" — the eight members of Congress who receive the most sensitive intelligence briefings — in January 2022. According to my sources, he stated that the briefing was conducted by the Director of NSA and attended by the Chair and Ranking Member of both the House and Senate Intelligence Committees, plus the Speaker and Minority Leader of the House, and the Majority and Minority Leaders of the Senate.

That means that for four years, eight of the most powerful people in Congress have known that every American's communications are being collected and stored by the NSA. And none of them said a word.

Not during the 2022 midterms. Not during the 2024 presidential election. Not during any of the privacy debates, the TikTok hearings, the Section 702 reauthorization fight. They sat in those hearings, asked questions about "targeted" surveillance, debated the "balance between security and privacy" — and they knew. They knew the debate was theater.

I think about Senator Ron Wyden's famous habit of asking intelligence officials carefully worded yes-or-no questions designed to expose classified programs without revealing them himself. He's on the Intelligence Committee. He was presumably briefed. And I've gone through every public statement he's made since January 2022. He has not asked a single question about domestic bulk collection since then. Not one.

That silence speaks at a frequency that hurts.

Why Varden Came Forward

According to both sources, Varden told the committee he decided to testify after an incident in November 2025 — an incident he described as "the system being used for a purpose that crossed every line I had drawn for myself."

He didn't elaborate in the open session. He said the details were "in my classified written statement, which I have also provided to the Inspector General of the Intelligence Community."

But one of my sources — the one who seemed more shaken by the experience — said that during a brief exchange with a senator (they wouldn't say which one), Varden said: "When I saw American journalists' source communications being queried without any foreign intelligence justification — when I saw the query logs and who was requesting them — I knew I couldn't stay quiet."

Journalists. Source communications. No foreign intelligence justification.

I need you to understand what that means. It means someone in the intelligence community was using PRISM II to identify journalists' confidential sources. It means the surveillance state has swallowed the free press, and the free press doesn't even know it.

We've seen this before — Operation Northwoods proved the government will sign off on actions against its own citizens when it serves institutional interests. The only difference now is the scale.

The Response (Or Lack Thereof)

I have contacted:

— The press offices of all 15 members of the Senate Intelligence Committee. Twelve did not respond. Two said "no comment." One — and I won't identify which one — said, off the record: "I can neither confirm nor deny that a hearing took place on the date you described."

— The NSA's public affairs office. Their response, received March 3, reads in its entirety: "The National Security Agency conducts its mission in strict accordance with the law and subject to rigorous oversight. We do not comment on alleged classified programs, specific intelligence activities, or personnel matters."

— Thomas Varden himself. I found what I believe is his personal email through public records. I sent a carefully worded message on February 28. I received a reply on March 2 from a different email address — a ProtonMail account — that said: "I've said what I needed to say in the appropriate forum. I have nothing to add publicly. Please do not contact me again. Be careful."

Be careful.

That phrase has been bouncing around my skull for a month.

What You're Not Being Told

Here's what keeps me up at 3 AM, staring at my ceiling, wondering if the phone on my nightstand is listening (it is — we've established that):

PRISM II has been operational for over four years. In that time:

— Congress reauthorized Section 702, with reforms that were presented as meaningful privacy protections. Those reforms are irrelevant. PRISM II doesn't use Section 702. It's like putting a lock on the front door while the back wall of the house is missing.

— Apple, Google, and Meta have all introduced "enhanced encryption" features that they market as privacy tools. If Varden is right about the decryption capabilities, those features are security theater — a placebo designed to make you feel safe while your data flows to Fort Meade.

— Your phone is already broadcasting your location 14,000 times a day. Now imagine that location data cross-referenced with every call you make, every message you send, every website you visit. That's not surveillance. That's a complete digital reconstruction of your life.

— The FISA court, which was supposed to be the check on surveillance overreach, approved a program that eliminates the concept of "domestic" communications with a 47-minute ruling. The court has become the rubber stamp that its critics always warned it was.

And nobody — not Congress, not the courts, not the media — is doing anything about it. Because the testimony is classified. Because the hearing never officially happened. Because Thomas Varden is a name you've never heard before today.

An Open Question

I don't know what happens next. I've published what I have. The sources are solid but anonymous. The documents I've been told exist — Varden's classified written statement, the EO 12333-C/SI addendum, the FISA court opinion — are locked in SCIFs that I will never enter.

But here's what I know for certain: the government of the United States is collecting the communications of every person in this country, storing them indefinitely, and using them for purposes that extend well beyond foreign intelligence. The legal framework authorizing this was created in secret, approved in secret, and has been maintained in secret for four years. The people who are supposed to provide oversight know about it and have chosen silence.

That's not a conspiracy theory. That's a description of what one man said, under oath, in a room full of senators, 49 days ago.

The question isn't whether you believe Thomas Varden. The question is why nobody in power wants you to hear what he said.

I'll keep digging. You keep asking questions. And maybe — maybe — someone in that room will decide that their oath to the Constitution matters more than their security clearance.

I'm not holding my breath. But I am keeping my Signal app updated.

***

Sources: Protect yourselves. Use encrypted communications. I recommend NordVPN or Mullvad VPN for anyone researching sensitive government programs. Do not use your work devices. If you have information about PRISM II, EO 12333-C/SI, or Thomas Varden's testimony, contact me through Signal. My number is in my profile.

Disclaimer: This article is based on accounts from anonymous sources who claim to have been present at a classified congressional hearing. The author has not independently verified the classified documents referenced herein. Thomas Varden is identified based on publicly available information about NSA personnel and source descriptions; the author has not confirmed his identity through official channels. Readers should evaluate the evidence and form their own conclusions. This is investigative reporting, not established fact.