Thursday, June 4, 2015

Bulk Phone Records Collection

The Foreign Intelligence Surveillance Act (FISA) was passed in the 1970's in response to revelations of serious abuses by the Nation Security Agency (NSA).  FISA required the NSA to get a warrant to gather electronic information and established a secret court to issue such warrants in foreign intelligence and international terrorism cases.  To obtain a warrant the NSA had to prove probable cause that the target was the agent of a foreign power.  From the very start, international terrorists as well as foreign spies were permitted as targets.  FISA as originally written required individual suspicion for a warrant and limited the duration of the warrant to 90 days.  In some cases, presumably including specific plots by spies or terrorists, the investigation could be finished in that amount of time.  Other targets, such as foreign embassies, had continually renewed warrants issued.

Following 9-11, George Bush requested and received increased surveillance -- the PATRIOT Act, passed in 2002.  When Bush found the PATRIOT Act was not giving him all he wanted, he did some intelligence gathering illegally.  In 2008, Congress passed yet another modification to FISA expanding its powers still further, but denying the President a blank check.  Among the members voting for was a freshman Senator by the name of Barrack Obama.  It was not clear at the time and is still not clear what they were approving.  Did the new law require individual suspicion as in the past, or did it allow "basket" warrants to wiretap a general group?  What degree of surveillance did it allow over international calls?  And what of e-mails, texts, and tweets?

So far as I can tell, many if not most of those questions remain unanswered.  But one thing did become clear from Edward Snowden's revelations.  The NSA was using these provisions to gather metadata (numbers, dates, times, lengths of call, etc) every call made in the country.  Over 90 day increments only, because that was still the limit in duration of a FISA warrant.  But each such warrant was automatically rolled over into a new one 90 days later.  This may not have been exactly breaking the law, since the court was issuing warrants, after all.  But it was definitely stretching the law beyond all possible recognition.  And because the FISA Court operates in complete secrecy, no one outside of certain inside circles knew that it had placed such an expansive interpretation on the law. It had been known for a long time that the FISA Court almost never refused requests for a warrant, but no one really knew whether that was because the court was a rubber stamp or because requests were so cautiously made.  Snowden's revelations answered the question -- the court was a rubber stamp.

How long this state of affairs would have continued is anyone's guess but two things conspired to place at least some limits on it.  First, all these provisions have an automatic sunset provision, although Congress has always renewed it as purely a matter of form.  The other is that Second Circuit Court of Appeals issued an opinion an opinion that not even the new version of FISA authorized such extensive record keeping.

As a lawyer, I will give a brief rundown of the opinion.  It first addressed the issue of standing, since no one who is not personally affected by a law has standing to challenge it.  This was easily addressed.  When it was first revealed that the Bush Administration was listening to international phone calls without a warrant, it was extremely difficult to establish who had standing because no one knew who as being listened to.  In this case, nothing could be easier.  Since the government was collecting all telephone metadata, anyone with a telephone (at least a land line) has standing.  The ACLU did not even need a front party; it could sue in its own name.  Somewhat more delicate was the issue of whether FISA warrants (or any warrants, really) can be challenged, since a warrant is supposed to be secret and the target is not supposed to know about it.  But the court held that nothing in the statute expressly disallowed review, even if the opportunity was not anticipated.

The ACLU challenged the metadata program on both constitutional and statutory grounds.  It is a court rule not to address a constitutional challenge if a practice is forbidden by statute.  The court therefore begins with the statute, which authorizes collection of "tangible things" that are "relevant to an authorized investigation."  The government likened "relevance" under FISA to relevance in issuing a grand jury subpoena.  "Relevant" records may, indeed, be broad and include a considerable volume from which ones directly related to the investigation may be gleaned.  But no grand jury has ever subpoenaed anything so sweeping as all phone record in the entire US!  At least records subpoenaed by a grand jury are constrained by the subject of the investigation.  In other words, give us all your haystacks; we think there may be some needles in them simply does not cut it. Furthermore, the court points out, subpoenas are normally limited not only by the subject of the investigation, but by some particular target at some particular time.  The government, in offering very broad subpoenas that had been approved, mentioned one for all Western Union money order applications for over $1,000 in Kansas City for two years; and all of a particular doctor's records on Medicare and Medicaid patients for at least seven years.  But neither approached the breadth of all telephone records in the country, indefinitely.  Furthermore, the court says, the information cannot just be "relevant" to fighting the war on terror or to anything the government might want to know.  It must be relevant to an authorized investigation.  This means a particular investigation, not to all possible investigations of terrorism, present and future.  An "investigation" is contrasted to a "threat assessment," which does not allow for FISA orders.  Nor would the court accept the fact that Congress reauthorized the act after such sweeping data collections were underway, given that most of Congress was not aware of them.

In short, the court held that the statute did not authorize such sweeping data collection.  It then declined to rule on the constitutional issue on the grounds that it had already struck down the data collection on statutory grounds.  It further declined to enjoin the data collection on the grounds that the statute would expire soon and Congress would have the opportunity to address the issue.

And now Congress has acted.  It passed the USA FREEDOM Act (some sort of acronym, probably better not to ask) and Obama has signed.  So what do I think of it?

Well, Obama endorsed it from the start.  As if to prove that not everything he endorses is automatically poison to Republicans, it passed the House 388-88.  It passed the Senate 67-32. Even the intelligence community has said it can live with it.  All of which makes me deeply distrustful and suspect that if it is getting that much mainstream support, it must be a purely cosmetic reform that doesn't change the real meat of what is going on.

But that is a dangerously cynical attitude.  It amounts to a belief that anything that is politically feasible to do must therefore not be worth doing.  Talk about defeatism!

A better way to assess the Act is to see that it does and does not change.  This summary says that it goes somewhat beyond just limiting bulk collection of phone records.

What it does:

  • Bans bulk collection of telephone or e-mail metadata
  • Requires something more specific that bulk collection of an area, time, or provider
  • Allows government to subpoena phone companies for information up to two degrees of separation from a suspect
  • Allows private companies to report how many FISA requests they receive
  • Requires FISA to disclose legally significant opinions (such as the opinion that "relevant to an ongoing investigation" included all phone records in the country!)
  • Allows someone to argue against the warrant in legally significant cases
  • Extends other PATRIOT Act provisions, such as roving wiretap and "lone wolf" surveillance
Others emphasize the power that the new law still allows:
  • It continues bulk collection, but by the phone companies instead of by the NSA
  • It allows search of the metadata by a "specific selection term," which can sweep in immense amounts of information
  • It continues to allow mass subpoena of other types of records
  • It does not interfere with mass records collection by other agencies (mostly international calls by the DEA)
  • It does not interfere with massive collections of foreign data which (probably deliberately) sweeps in many US persons
  • It does not strengthen minimization requirements
So I suppose this should not be surprising.  It does some but not enough.  It could be better and it could be worse.  But this is (so far as I can tell) the first real attempt since 9-11 to scale back surveillance.  The real question is, will this be some minor changes to put a better face on the old system?  Or will it be the first of many measures to reign in a rogue agency?

Time alone will tell.

No comments:

Post a Comment