By Mike Masnick | Techdirt | September 17, 2013
The FISA Court (FISC) today released a heavily redacted version of its July ruling approving the renewal of the bulk metadata collection on all phone calls from US phone providers under Section 215 of the Patriot Act. This is part of the “secret interpretation” as to how the FISC interprets the Patriot Act’s “business records” or “tangible things” section to mean that the government can order a telco to turn over pretty much all records — even as the very author of the law says it was written specifically to not allow this interpretation.
Much of the ruling is pretty much what you’d expect, given the way defenders of this program have been insisting that this is all very legal. It argues that Smith v. Maryland show that there are no privacy protections in data given to your telco. It goes on at length defending the third party doctrine, arguing that because some third party holds your data, you have no expectation of privacy. As many have argued, this is a ridiculous and antiquated view of the third party doctrine, not at all consistent with modern technology, but the FISC repeats it without question. While some have pointed out that even if single points of metadata might not be privacy violating, collecting all of them creates a new problem, the court rejects that entirely.
From there, there’s a big discussion of whether or not “there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation.” This is a big part of where the concern lies. How can the government defend the claim that all records are “relevant to an authorized investigation.” Here, the court compares the order to the Stored Communications Act (SCA), which lets the government get access to records as well. And then the word games begin. Basically, it argues that because one law requires “specific and articulable facts” and that the information must be “material,” while the other (the PATRIOT Act) does not, then the government doesn’t need specific and articulable facts. Rather it just needs “a statement of facts showing there are reasonable grounds to believe that the records are relevant to the investigation.”
For non-content records production requests, such as the type sought here, Section 2703(c) provides a variety of mechanisms, including acquisition through a court order under Section 2703(d). Under this section, which is comparable to Section 215, the government must offer to the court “specific and articulable facts showing that there are reasonable grounds to believe that the records or other information sought, are relevant and material to an ongoing criminal investigation.” 2703(d) (emphasis added). Section 215, the comparable provision for foreign intelligence purposes, requires neither “specific and articulable facts” nor does it require that the information be “material.” Rather, it merely requires a statement of facts showing that there are reasonable grounds to believe that the records sought are relevant to the investigation. 50 U.S.C. That these two provisions apply to the production of the same type of records from the same type of providers is an indication that Congress intended this Court to apply a different, and in specific respects lower, standard to the government’s Application under Section 215 than a court reviewing a request under Section 2703(d). Indeed, the Act version of FISA’s business records provision required “specific and articulable facts giving reason to believe that the person to whom the records pertain is a foreign power or an agent of a foreign power.” 50 U.S.C. §1862(b)(2)(B) as it read on October 25, 2001. In enacting Section 215, Congress removed the requirements for “specific and articulable facts” and that the records pertain to “a foreign power or an agent of a foreign power.” Accordingly, now the government need not provide specific and articulable facts, demonstrate any connection to a particular suspect, nor show materiality when requesting business records under Section 215. To find otherwise would be to impose a higher burden — one that Congress knew how to include in Section 215, but chose to dispense with.
Also, it argues that since Section 215 allows recipients of the order to challenge them and no telco ever has that this lends it to believe there are no problems with the law.
Second, Section 2703(d) permits the service provider to file a motion with a court to “quash or modify such order, if the information or records requested are unusually voluminous in nature or compliance with such order otherwise would cause undue burden on such provider.” Congress recognized that, even with the higher statutory standard for a production order under Section 2703(d), some requests authorized by a court would be “voluminous” and provided a means by which the provider could seek relief using a motion. Under Section 215, however, Congress provided a specific and complex statutory scheme for judicial review of an Order from this Court to ensure that providers could challenge both the legality of the required production and the nondisclosure provisions of that Order. 50 U.S.C. §1861(f). This adversarial process includes the selection of a judge from a pool of FISC judges to review the challenge to determine if it is frivolous and to rule on the merits, provides standards that the judge is to apply during such review, and provides for appeal to the Foreign Intelligence Surveillance Court of Review and, ultimately, the U.S. Supreme Court. This procedure, as opposed to the motion process available under Section 2703(d) to challenge a production as unduly voluminous or burdensome, contemplates a substantial and engaging adversarial process to test the legality of this Court’ Orders under Section 215. This enhanced process appears designed to ensure that there are additional safeguards in light of the lower threshold that the government is required to meet for production under Section 215 as opposed to Section 2703(d). To date, no holder of records who has received an Order to produce bulk telephony metadata has challenged the legality of such an Order. Indeed, no recipient of any Section 215 Order has challenged the legality of such an Order, despite the explicit statutory mechanism for doing so.
Basically, the court says “why of course there’s an adversarial process” to protect users’ privacy. It just depends on Verizon or AT&T taking up the fight on behalf of their users, and they haven’t done so, so let’s just assume everyone’s okay with this. That’s kind of crazy when you think about it. Admittedly, the public should be up in arms that Verizon and AT&T appear to have no interest in challenging these broad collections of data, but that hardly makes them constitutional.
From there we move onto the interpretation of how this massive data collection could possibly be seen as “relevant.” First, it notes (as mentioned above) that the government doesn’t need to prove that the data is actually relevant. Just that it has reasonable grounds to believe that they are relevant.
As an initial matter and as a point of clarification, the government’s burden under Section 215 is not to prove that the records sought are, in fact, relevant to an authorized investigation. The explicit terms of the statute require “a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant.
Then it basically says that because the NSA can sniff out terrorists within a giant database, that makes the entire database relevant. Really.
This Court has previously examined the issue of relevance for bulk collections. See; [REDACTED] While those matters involved different collections from the one at issue here, the relevance standard was similar…. (“[R]elevant to an ongoing investigation to protect against international terrorism….”). In both cases, there were facts demonstrating that information concerning known and unknown affiliates of international terrorist organizations was contained within the non-content metadata the government sought to obtain. As this Court noted in 2010, the “finding of relevance most crucially depended on the conclusion that bulk collection is necessary for NSA to employ tools that are likely to generate useful investigative leads to help identify and track terrorist operatives.” [REDACTED] Indeed, in [REDACTED] this Court noted that bulk collections such as these are “necessary to identify the much smaller number of [international terrorist] communications.’ [REDACTED] As a result, it is this showing of necessity that led the Court to find that “the entire mass of collected metadata is relevant to investigating [international terrorist groups] and affiliated persons.” [REDACTED]
It then applies those previous, redacted-named rulings, to this case, repeating the DOJ’s own filing saying “all of the metadata collected is thus relevant, because the success of this investigative tool depends on bulk collections.”
That’s ridiculous and tautological. You could argue that the “success” of a program designed to stop crimes “depends on” putting cameras inside everyone’s home, but that doesn’t make it any less a violation of privacy. It also hardly makes the collection of all such data “relevant.”
The FISC continues to tap dance on the grave of the 4th Amendment:
The government depends on this bulk collection because if production of the information were to wait until the specific identifier connected to an international terrorist group were determined, most of the historical connections (the entire purpose of this authorization) would be lost. The analysis of past connections is only possible “if the Government has collected and archived a broad set of metadata that contains within it the subset of communications that can later be identified as terrorist-related.” Because the subset of terrorist communications is ultimately contained within the whole of the metadata produced, but can only be found after the production is aggregated and then queried using identifiers determined to be associated with identified international terrorist organizations, the whole production is relevant to the ongoing investigation out of necessity.
Once again, that makes no sense. First off, just because you can put together all this aggregate data and use it to find criminals and terrorists doesn’t automatically make it legal. Once again, I’m sure that having cameras in everyone’s homes would allow similar capturing of illegal behavior. But that doesn’t make it legal. Second, the argument that without this metadata collection the information would be “lost” is clearly untrue. As was just revealed a few weeks ago, AT&T has employees embedded with the DEA who are willing, ready and able to do deep dive searches on decades worth of phone records (even beyond AT&T). The data isn’t lost. They’re available via AT&T employees who are working right alongside government employees.
Incredibly, the FISC then claims that the mere claim that terrorists use the phone system is enough to show that all phone records are relevant.
The government must demonstrate “facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation.” The fact that international terrorist operatives are using telephone communications, and that it is necessary to obtain the bulk collection of a telephone company’s metadata to determine those connections between known and unknown international terrorist operatives as part of authorized investigations, is sufficient to meet the low statutory hurdle set out in Section 215 to obtain a production of records.
Except, almost nothing there makes sense. It’s not true that it is necessary to obtain bulk collection of the metadata to find those connections. And just because terrorists live in houses, we don’t say that it’s okay for law enforcement to search every house. Take this same argument and apply it to anything else and the 4th Amendment goes away entirely.
In short, this shows the serious problems with these efforts being non-adversarial. The FISC more or less buys the government’s argument at every single turn, even though there are multiple arguments for why the government’s position is either not true or, at the very least, misleading.