Bringing intelligence agencies to heel

It is rare for Congress or the federal courts to offer significant pushback against assertions of authority by the intelligence community. It is rarer still for the executive branch to impose or invite such limits on itself. When President Barack Obama appointed a five-member committee in August to review the National Security Agency’s surveillance practices, observers noted that four of the five members had been executive branch insiders and predicted that the group would recommend minor tweaks at best. The recommendations that the committee issued Wednesday surprised almost everyone — including, almost certainly, the White House.

Many of the specific reforms are far-reaching. But what may be most unexpected is the group’s articulation of sweeping principles to guide future decision making. Twelve years after 9/11, the group asserted that “it is now time to step back and take stock,” and concluded that “some of the authorities that were expanded or created in the aftermath of September 11 unduly sacrifice fundamental interests in individual liberty, personal privacy, and democratic governance.” Going forward, it proposed a general rule that “the government should not be permitted to collect and store all mass, undigested, non-public personal information about individuals to enable future queries and data-mining for foreign intelligence purposes.”

The recommendations are also striking in their unanimity. The group’s members include Richard Clarke, a former counterterrorism czar under Presidents Bill Clinton and George W. Bush, and Michael Morell, a two-time acting director of the Central Intelligence Agency — individuals who might be expected to defend the prerogatives of the intelligence community against perceived encroachment. Yet there is no dissenting opinion, no minority report.

Below are some of the most significant recommendations the group generated. Their adoption would not solve all the problems posed by the NSA’s surveillance activities. Significant concerns remain, some of which are noted herein. Nonetheless, it is an auspicious starting point for a national discussion about intelligence reform.

The review group recommends that Americans’ telephone records be held by the telephone companies — not the government — and that the government be required to obtain an order from the Foreign Intelligence Surveillance Court (FISC) each time it wants to access the records. This would return the government’s activities under section 215 of the Patriot Act, which authorizes the government to obtain with a FISC order “any tangible thing” that is relevant to a foreign intelligence investigation, to the status quo before bulk collection was implemented. In other words, it would end bulk collection. The review group agreed with experts who have argued that so-called metadata — information such as the times of phone calls, numbers contacted and lengths of conversations — can reveal intimate details of Americans’ personal lives. Moreover, having reviewed the relevant classified information, the group flatly concluded that “the information contributed to terrorist investigations by the use of section 215 telephony meta-data was not essential to preventing attacks and could readily have been obtained in a timely manner using conventional section 215 orders.”

Privacy advocates have warned that if bulk collection under section 215 were prohibited, the government might try to obtain the same information using National Security Letters (NSLs) — a form of subpoena that the FBI can issue to obtain certain records without involvement of the FISC or any other court. The review group addressed this concern with a recommendation that went beyond anything privacy advocates had dared request: It suggested amending the law to require prior judicial approval of NSLs by regular federal courts. This proposal would provide meaningful oversight for an executive authority that currently lacks any outside check and has been misused on multiple occasions (according to two reports of the Justice Department’s Inspector General). In essence, it would replace NSLs with a variant of section 215 orders, to be issued with the approval of regular courts and without opening the door to another form of bulk collection.   

There are two important qualifications to these recommendations. First, as far-reaching as they are, they may not go far enough to satisfy the Constitution. Earlier this week, a federal judge ruled that telephone records are protected under the Fourth Amendment. Ordinarily, the government needs a warrant based on probable cause in order to obtain Fourth Amendment-protected materials — a higher standard than what the government needs to obtain a FISC order under section 215, or what it would need to obtain judicial approval for NSLs under the committee’s proposal. There is an exception that applies when the government has “special needs” unrelated to law enforcement, such as when it administers drug tests to transportation workers. It is debatable whether the government could claim “special needs” in the context of section 215. Even if it could, it would have to show that its need to obtain telephone records without showing probable cause outweighs Americans’ privacy interest in those records — something that is far from clear.

Second, the review committee left open the possibility of modifying the bulk collection program rather than terminating it. The government claims two advantages to collecting telephone records in bulk as opposed to obtaining needed records from the telephone companies: it is faster and less cumbersome to run searches within a single database, and the government keeps the records for five years, while many telephone companies dispose of them after a year or 18 months. The review group was unpersuaded by these arguments. It nonetheless presented fallback options of requiring the companies to hold the data for a longer period of time (although no longer than two years), or creating a single database held by a third party.

In practice, these fallback options might work better than bulk collection by the government. In principle, however, they would create a dangerous precedent. Requiring private companies to assemble or maintain databases for the government’s purposes turns these service providers into agents of the intelligence community. Such a practice could ultimately facilitate an expansion of surveillance by enabling the government to “launder” its activities through private parties that are not subject to the same legal restraints. 

Commentators have paid far less attention to another, equally important aspect of the report: its treatment of Americans’ information collected under section 702 of the FISA Amendments Act. Section 702 allows the government to obtain the content of telephone calls and emails without a warrant, as long as the target of the surveillance is a noncitizen overseas and the government’s purpose is to obtain foreign intelligence. The government has admitted that the program “incidentally” sweeps up a substantial amount of Americans’ information, as the collected communications include calls and emails between foreigners (the ostensible targets) and Americans. There also appears to be significant “inadvertent” collection of Americans’ domestic communications, given uncertainties about whether a particular Internet user is foreign or American and technical difficulties in sorting the data.

The law requires the government to make all reasonable efforts to minimize the collection and retention of Americans’ information. Instead, the NSA sought and obtained permission from the FISC to conduct searches for Americans’ communications among the section 702 data pool. Sen. Ron Wyden, D-Ore., dubbed these “back-door searches,” because they allow the government to conduct warrantless searches for already collected information that would require a warrant to collect upfront.

The review group recommended closing this back door by requiring the government to obtain warrants to search communications obtained under section 702 for Americans’ data. An exception would exist “when the information is necessary to prevent a threat of death or serious bodily harm.” As written, this is a narrow exception, although there is certainly reason to fear that the government might construe it broadly.

The review group also acknowledged and addressed another kind of back door. The constitutionality of collecting communications between foreigners and Americans without a warrant depends on the government’s having a “foreign intelligence” purpose, as some courts have found this purpose to constitute a “special need” unrelated to law enforcement. Section 702, however, expressly allows the government to have mixed motives — which might include gathering evidence for criminal prosecutions — and current procedures allow the NSA to keep and share any “incidentally” collected information about Americans that is evidence of a crime. The review group recommended closing this loophole, allowing the government to keep information about Americans only if it has foreign intelligence value or is necessary to prevent serious harm to others.

These limits on retaining, sharing and using information are important. Unfortunately, though, the review group’s recommendations would do little to limit collection. The current statutory definition of “foreign intelligence information” is so broad — it encompasses any information that “relates to ... the conduct of the foreign affairs of the United States” — that it potentially authorizes the collection of any communications between Americans and foreigners that discuss current international events. There is no justification for casting such a broad net. Limitations on access and use can help mitigate the risks posed by overcollection, but they cannot substitute for appropriate boundaries on collection in the first instance. The task of defining those boundaries remains.

The report contains several proposals for strengthening the transparency and oversight of the NSA’s activities. It includes a proposal that the president himself has endorsed: creating a special advocate to argue the other side of significant legal issues presented to the FISC. It recommends more public disclosure of FISC opinions, although it is short on details about how this would be accomplished. And it would charge all of the justices of the Supreme Court, not just the chief justice, with appointing FISC judges.

A less-noticed provision would revamp and fortify the Privacy and Civil Liberties Oversight Board (PCLOB). The board, created by Congress, is an independent body made up of five presidential appointees who are responsible for monitoring counterterrorism policies for privacy and civil liberties concerns. It is hampered by a lack of staffing and resources, as well as various statutory restrictions on the work it can perform. The review group recommends reconstituting the board as the Civil Liberties and Privacy Protection (CLPP) Board, providing it with significantly greater resources, and expanding its mandate to include some of the compliance functions currently served by agencies’ internal watchdogs.

Here, the specter of Edward Snowden raises its head. Although the report never mentions the name of the former NSA contractor who leaked sensitive agency documents to journalists, and expressly condemns the leaking of classified information, it also acknowledges that “a free and democratic nation needs safe, reliable, and fair-minded processes to enable (government employees and contractors) to present their concerns to responsible and independent officials. After all, their concerns might be justified.” The report notes that existing national security whistle-blower protections — which allow employees to report suspected wrongdoing to certain individuals within the intelligence community — do not go far enough. It recommends that employees and contractors be permitted to report concerns to the CLPP Board, which would sit outside the intelligence community. The task of identifying a meaningful way for national security whistle-blowers to bring government misconduct to light without turning the classification system into a free-for-all has been challenging, to say the least. The review group’s suggestion could represent an important breakthrough.

There is no question that the intelligence community will push back forcefully against these and other recommendations in the committee’s report. The administration has already indicated that it will reject the group’s proposal to put the NSA and U.S. Cyber Command — both currently under NSA Director Gen. Keith Alexander — under separate leaderships. But the significance of what appears to be an arcane matter of bureaucratic structure is likely lost on most Americans. It will be far less easy for the president to dismiss summarily the committee’s recommendation to end bulk collection — especially since it comes on the heels of a judicial ruling that the program is unconstitutional and a forceful call for reform on the part of the major internet service providers. The president may well try to forge a middle-of-the-road approach. But even that strategy would be risky, as splitting the baby might satisfy no one.   

As the president ponders how to move forward, he should bear in mind the words of the Church Committee — the special congressional committee convened in the 1970s to investigate a host of intelligence abuses that took place in the early decades of the Cold War. As quoted in the review group’s report, the Church Committee observed that “men entrusted with power, even those aware of its dangers, tend, particularly when pressured, to slight liberty.” Resisting this tendency is a sign of strength, not weakness. The president should follow the courageous model his review committee has set and embrace real change.