Landmark ruling on NSA sweep pushes case for stronger surveillance reforms

When the US Court of Appeals for the Second Circuit vacated a lower court ruling, effectively declaring the National Security Agency’s bulk data collection program illegal, it dealt a significant blow to the controversial program just weeks before Congress will have to decide whether to renew a key section of the Patriot Act, the post-9/11 legislation that greatly expanded government intelligence gathering.

Three surveillance provisions in the Patriot Act — including Section 215, which under the NSA’s interpretation allowed for the bulk collection of U.S. phone records — are set to expire on June 1.

New legislation currently being considered in the House and Senate would reauthorize the expiring provisions but, according to sponsors, proscribe the bulk data collection allowed under Section 215.

While supporters of the changes envisaged under the proposed USA Freedom Act claim that it is sufficient to address court concerns, privacy advocates and intelligence agency watchdogs worry the new law could instead codify the bulk gathering of data on phone and Internet use by American citizens and fail to provide safeguards for innocent parties whose information is being stored.

The NSA's bulk collection and storage of the “metadata” on every call made or received by everyone in the U.S. — the times, dates and phone numbers, but not the content of calls — was one of the earliest and most controversial programs disclosed in the 2013 leaks by former NSA systems administrator Edward Snowden.

Researchers have found that metadata exposes more of our personal information than we may realize.

In one study published by the Massachusetts Institute of Technology, researchers suggested that an individual could be identified using only four bits of metadata and publicly available information.

Sponsors of the Freedom Act — a revised version of a similar bill that failed to pass in 2014 — say the new legislation seeks to prohibit the bulk collection of metadata. Under the proposed legislation, data would instead be stored by the companies themselves, and the government could only access the data with a warrant issued by the Foreign Intelligence Surveillance Act (FISA) court, which holds all its session in secret.

The FISA court, established in 1978, grants the government permission to pursue covert electronic surveillance. From its inception through 2013, the panel rejected only 11 government applications while approving more than 20,000, according to the Electronic Privacy Information Center.

Thursday’s decision — the first federal appeals court to rule on the NSA program's legality — changes the debate surrounding post-9/11 surveillance, according to Elizabeth Goitein, co-directer of the Brennan Center for Justice’s Liberty and National Security Program.

"The ruling changes the politics. Until now, the options we had on the table were the USA Freedom Act, letting Section 215 expire, or straight reauthorization,” Goitein said.

Senate Majority Leader Mitch McConnell, R-Ky., and Intelligence Committee Chairman Richard Burr, R-N.C. — among the biggest defenders of the NSA program — took to the Senate floor Thursday shortly after the ruling and strenuously argued for government bulk data collection to continue.

But McConnell's position is weakened by the ruling.

"He’s limited in how much he can do now. McConnell and his buddies want to keep [Section 215] going but he doesn’t have the votes in Congress to support him," Goiten said. "The only question that remains is whether McConnell will still try to water down the Freedom Act in some way."

McConnell and Burr introduced a bill in April to extend the authority for NSA bulk collection under Section 215. But the Washington Post reported McConnell as conceding to reporters that the end result will probably be “somewhere between” the Freedom Act and his own bill.

The ruling Thursday declared the NSA program illegal because it was based on an expansive reading of Section 215 not justified by the legislative or legal history. The Appeals Court based its decision on a phrase within the provision, which states that the government may gather data “relevant to an authorized investigation."

The three judge panel said that the government had essentially ignored the terms “authorized investigation,” arguing that all telephone records are relevant, not because of any connection to a particular investigation, but simply because some of those records might one day become connected with a hypothetical inquiry.

“Put another way, the government effectively argues that there is only one enormous 'anti‐terrorism' investigation, and that any records that might ever be of use in developing any aspect of that investigation are relevant to the overall counterterrorism effort," the opinion said.

"Indeed, the government’s information‐gathering under the telephone metadata program is inconsistent with the very concept of an 'investigation.'"

Goitein says that the USA Freedom Act diverges somewhat from the Patriot Act by including language that attempts to limit the scope of investigations.

Under the new legislation, before the government can access the bulk data, it would need to present to the FISA court a "specific selection term” that identifies a person, account, address, or any other discrete identifier.

“The addition of the language will help to modify that particular reading of ‘investigation’ — meaning there will have to be a nexus between the query and the investigation,” Goitein said.

With a warrant, the government may then approach a company and request records that contain the term, such as a suspect’s name — a step known as the “first hop.”

“From there, the government can then do a 'second hop' and search the records of anyone that has been in contact with the suspect or target," Goitein said.

Despite arguments from sponsors that the legislation narrows the scope of surveillance, privacy advocates say that it still leaves wiggle room for the government to engage in broad collection.

"The government could still amass a collection of records belonging to people who might not have any nexus to terrorism. So, for example, if they collected records of people with a certain IP address … that could be an entire company," said Neema Singh Guliani, legislative counsel at the ACLU.

Goitein adds that the legislation also fails to place limits on how long the government can retain data on people who turn out to have no connection to a suspect or target. “The NSA is likely to pick up information that it doesn’t need during the second hop, so there really should be stronger backend protections that require government to get rid of data it doesn’t need.”

While much of the public debate has focused on telephony records, Goitein says government surveillance is far broader and more invasive because Section 215 authorizes the collection of any "tangible thing.”

And while the Freedom Act narrows the scope of queries within a given database, privacy advocates warn the bill does not limit the kinds of databases that can be searched.

"The statute could be construed to allow multiple medical records from a particular hospital, or all the financial records from a specific company on a particular day," Guliani said. 

Another major concern with the bill is that it provides businesses with immunity and compensation, two things that Section 215 did not, according to Marcy Wheeler, an intelligence blogger.

“That’s important because, for much of this sharing, the government claims only the providers have standing to challenge an order in court. Each time the government grants corporations immunity for information sharing, then, it makes it far less likely they’ll resist requests to share their customers’ information,” Wheeler writes in Salon magazine.

In addition, the bill contains noticeably weaker government reporting requirements compared to last year’s version of the bill, according to OpenTheGovernment.org.

For its part, the ACLU says it neither supports nor opposes the Freedom Act.

"'We're calling for improvements on legislation. The court's decision should strengthen the push for greater reforms than what is currently being considered," Guliani said.

Others expressed greater cynicism.

NSA whistleblower Thomas Drake told U.S. News and World Report that the Obama administration’s support for the legislation is partly motivated by a desire to thwart lawsuits that may find their way to the Supreme Court.

Referring to the bill as “Free-dumb Act 2.0,” he accuses government officials of trying “to keep the status quo in place” by passing ineffectual reform.

With wire services