Room 641A: AT&T Fiber-Splitter NSA Tap (2003–2006)

Introduction

In 2006, a retired AT&T technician named Mark Klein filed sworn declarations in a federal lawsuit brought by the Electronic Frontier Foundation against AT&T. Klein had worked at AT&T's 611 Folsom Street facility in San Francisco and had witnessed the installation of a secret room — Room 641A — on the 7th floor of the building. Inside that room, Klein documented, a fiber-optic splitter cabinet had been installed, feeding copies of all internet traffic passing through the facility into a Narus STA 6400 deep-packet inspection system. The room was accessible only to technicians with NSA clearances.

Klein's technical documentation, including wiring diagrams and equipment lists, provided the first detailed physical evidence that the NSA had direct access to AT&T's internet backbone traffic — not a targeted tap of specific suspects, but a wholesale copy of all traffic transiting the facility.

The Physical Setup

The 611 Folsom Street building was a major AT&T internet backbone hub, handling traffic for a large portion of US internet communications. Klein's documentation described a beam splitter that diverted a copy of the fiber-optic signal entering Room 641A to the Narus STA 6400 — a commercial deep-packet inspection platform capable of analyzing traffic at speeds sufficient for backbone-level interception.

The splitter arrangement meant that AT&T customers' internet traffic — email, web browsing, voice-over-IP calls — was being copied and fed to NSA systems without individualized warrants. The splitter architecture, by design, could not distinguish domestic from international communications; it copied everything.

Mark Klein's Testimony

Klein retired from AT&T in 2004. In 2006 he came forward to the EFF and later to journalists, providing technical documentation he had retained. His declarations in the EFF v. AT&T lawsuit (also known as Hepting v. AT&T, filed on behalf of plaintiff Carolyn Hepting) described in precise technical terms what he had seen and documented. Klein was not a whistleblower in the traditional sense of someone with access to classified programs — he was a working technician who saw the physical hardware and the wiring.

The EFF case proceeded through the courts. The New York Times had published its own account of the NSA warrantless wiretap program in December 2005, based on reporting by Eric Lichtblau and James Risen, who had held the story for a year at government request. The Klein declarations added concrete physical corroboration to what the NYT had revealed from classified sources.

The Legal Outcome: Retroactive Immunity

The FISA Amendments Act of 2008 included a provision granting retroactive civil immunity to telecommunications companies that had assisted the government's surveillance program. The Hepting case and related lawsuits were effectively ended by this legislation. No AT&T executive faced legal consequences. The FAA 2008 also codified the Section 702 collection framework that the PRISM program would operate under.

What Room 641A Confirmed

Room 641A is not a conspiracy theory in the traditional sense — it is a confirmed surveillance program, documented by a technician with first-hand access, corroborated by NSA documents obtained through other channels, and effectively acknowledged by the government's pursuit of retroactive immunity. The existence of the room, the Narus equipment, and the splitter arrangement is not seriously disputed.

Harm and Implications

The Room 641A tap represented a fundamental departure from the legal framework governing domestic surveillance. Prior law required individualized warrants for domestic wiretapping. The backbone tap collected all traffic regardless of the identity or nationality of the communicants. For US persons communicating with other US persons across AT&T infrastructure, this was unambiguously domestic surveillance without legal authorization under the existing FISA framework.

The harm was to the constitutional expectation of privacy in electronic communications, to the integrity of the legal framework governing intelligence collection, and to public trust in both telecommunications providers and the intelligence agencies they were secretly serving.

Verdict

Confirmed. Mark Klein's sworn declarations, technical documentation, and the government's own pursuit of retroactive telco immunity collectively confirm that Room 641A existed, that it fed AT&T backbone traffic to NSA systems, and that this occurred without the individualized warrants required by existing law. The broader warrantless wiretap program was confirmed by government officials following the NYT disclosure.

How the Tap Worked: Folsom Street and the Narus STA 6400

Klein's schematics, later filed as exhibits in Hepting v. AT&T, describe a specific engineering sequence rather than a general allegation. AT&T's 611 Folsom Street building in San Francisco carried "peering" circuits — the physical links where AT&T's WorldNet internet service exchanged traffic with other backbone carriers. In 2003, AT&T installed a splitter cabinet on these circuits that used a passive optical beam splitter to divert a full duplicate of the light signal — and therefore of every packet crossing it — before that traffic reached its normal routing equipment. The diverted copy ran into Room 641A, a roughly 24-by-48-foot secure space on the sixth floor accessible only to personnel holding NSA clearances; ordinary AT&T technicians, Klein included, were barred from entering it. Inside sat racks of processing equipment including a Narus STA 6400, a commercial semantic-traffic-analysis platform built to reconstruct and inspect content — not just headers — from high-speed backbone links in real time. Because the splitter operated on the physical layer, it could not selectively pass only traffic tied to a specific FISA-authorized target; by design it copied everything transiting that circuit, domestic-to-domestic communications included. Klein additionally reported he had been told similar rooms existed at other AT&T switching centers around the country, a claim later substantiated when EFF's discovery in related litigation identified comparable AT&T facilities in at least eight major cities.

The Litigation: Hepting, Retroactive Immunity, and Jewel v. NSA

EFF filed Hepting v. AT&T on January 31, 2006, before Judge Vaughn Walker in the Northern District of California, naming customer Tash Hepting as lead plaintiff. The Bush administration moved to dismiss on state-secrets grounds, but Walker denied the motion, ruling that the government had "opened the door for judicial inquiry" by itself publicly confirming and denying details of the program; the case proceeded into discovery, where J. Scott Marcus's technical analysis of Klein's documents was entered into the sealed record in 2007. That trajectory ended in mid-2008, when Congress passed the FISA Amendments Act, whose Section 802 granted telecommunications carriers retroactive civil immunity for post-9/11 surveillance assistance. Walker dismissed Hepting under the new provision in 2009; the Ninth Circuit upheld Section 802's constitutionality on December 29, 2011, rejecting arguments that it violated bicameralism-and-presentment, non-delegation, and separation-of-powers principles, and the Supreme Court declined further review on October 9, 2012.

Because the immunity statute reached telecom defendants only, EFF filed a second suit, Jewel v. NSA, on September 18, 2008, naming the government itself. That case survived an initial dismissal on appeal in 2011 and, in 2013, saw the district court reject a renewed state-secrets defense — but it never reached a verdict on the merits. After years of contested discovery, including a 193-page declaration from NSA Director Michael Rogers in 2018, the district court dismissed the remaining claims in 2019 for lack of standing, the Ninth Circuit affirmed in 2021, and the Supreme Court denied certiorari on June 13, 2022, closing the case on procedural grounds.

Key Evidence Beyond Klein's Declaration

Klein's account did not stand alone. EFF retained J. Scott Marcus, a former senior internet-technology advisor to the FCC, to independently assess the AT&T documents; Marcus concluded the evidence established "a credible, coherent, and detailed basis" for believing AT&T had built a physical connection allowing NSA to conduct backbone surveillance, and produced his own technical diagram of the setup. In 2015, after the NSA itself released internal documents describing its upstream collection architecture, EFF compared them to Marcus's decade-old diagram and found the two "remarkably" aligned — an outside expert's reconstruction from a technician's paperwork matching the agency's own classified description of how the program worked. Separately, discovery connected to the Jewel litigation surfaced evidence that AT&T operated comparable switching and collection infrastructure in at least eight major peering hubs beyond San Francisco, indicating Room 641A was one node in a larger, standardized architecture rather than an isolated installation.

The Strongest Counter-Argument — and How It Holds Up

Neither AT&T nor the government ever denied that the splitter cabinet and the Narus equipment existed. Their defense instead was procedural and inferential: that litigating the program's scope would expose state secrets, and that Klein, a technician without an intelligence analyst's clearance, had seen hardware and inferred a bulk-collection purpose rather than directly witnessing individualized, lawfully authorized surveillance. That inferential gap does not survive the physics of the equipment involved. A passive beam splitter copies the entire optical signal on a circuit before any filtering occurs — a design fact independent of what Klein personally understood, confirmed by Marcus's outside technical review and later matched by the NSA's own disclosed architecture. The state-secrets argument, meanwhile, is a doctrine about what courts can adjudicate, not a factual rebuttal; Judge Walker rejected it outright in 2006 specifically because the government's own public statements had already confirmed the program existed. It ultimately prevailed only in Jewel, on narrower standing grounds, sixteen years later — after the underlying facts were already a matter of extensive public and judicial record.

Aftermath

The public record Klein's documents helped establish fed directly into later reforms: the NSA's bulk domestic-internet-metadata program was shut down administratively in 2011, and the 2015 USA Freedom Act ended the analogous bulk telephone-records program. The upstream content-collection authority that the FISA Amendments Act legalized in 2008, however, continues; Congress reauthorized it, with added oversight provisions, as the Reforming Intelligence and Securing America Act in April 2024, extending Section 702 authority to April 2026. No AT&T executive or NSA official has ever faced individual civil or criminal liability over the program. Mark Klein died in Oakland on March 8, 2025, at age 79; EFF's memorial credited the roughly 100 pages of authenticated AT&T documents he supplied with anchoring nearly every subsequent legal and journalistic examination of the NSA's domestic collection program.

Why It Still Matters

Room 641A remains one of the few instances where the physical machinery of mass surveillance was documented from the inside, by a named technician, years before the Snowden disclosures confirmed the wider program. That the courts never ruled on its legality — because Congress retroactively immunised the carriers and the plaintiffs were denied standing — is itself the point: the tap was real, the evidence was concrete, and the accountability was legislated away.