The USA Freedom Act’s limits on bulk collection

By Adina Schwartz

Section 215 of the Patriot Act, 50 U.S.C. Section 1861 was scheduled to expire on June 1, 2015. On June 2, the Senate passed and President Obama signed into law the identical version of the Uniting and Strengthening America by Fulfilling Rights and Ensuring Effective Discipline Over Monitoring Act of 2015 (the “USA Freedom Act of 2015”), Public Law 114-23, 129 Stat. 277, that the House had passed on May 13, 2015. A major aim of the Act was to limit the bulk collection of telephony metadata that the Foreign Intelligence Surveillance Court (“FISC”) had authorized under 50 U.S.C. Section 1861 (“Sec. 1861”) since 2006, and to impose other limits on the collection and use of telephony metadata. The USA Freedom Act also prevents the bulk collection of other types of records under Sec. 1861 and under the pen/trap provisions of the Foreign Intelligence Surveillance Act (“FISA”), 50 U.S.C. Section 1842, and various statutes authorizing national security letters.

I. THE AMENDMENTS TO SEC. 1861

Specific selection terms. The requirement of a “specific selection term” is the key means that Title I of the USA Freedom Act uses to end the use of Sec. 1861 to authorize collecting all Americans’ telephony metadata or other records on the oft chance that some of the data may someday prove relevant to some investigation into terrorism. The only Congressional Report on the USA Freedom Act, the Report of the House Judiciary Committee, H.Rpt. 114-109 (“the House Report”), states that, “The ‘specific selection term’ required in each Section 501 [of FISA, 50 U.S.C. Sec. 1861] application is the mechanism by which the Act prohibits the indiscriminate, bulk collection of any type of tangible thing under Section 501.” At 19.

In particular, Sec. 103 (a) of the Act amends Sec. 1861(b)(2) by requiring, in subsection (A), that all applications for the production of “call detail records” (the Act’s term for telephony metadata, whose definition is explained below) and other tangible things include “a specific selection term to be used as the basis for the production of the tangible things sought.” As per Sec. 103(b)(2) of the Act, new subsection (F) of Sec. 1861(c)(2) provides that unless an application meets Sec. 1861(b)(2)’s requirements for the use of a specific selection term, a judicial production order will not issue. Further, Sec.103 (b)(1) amends Sec. 1861(c)(2)(A) to require FISC orders to include “each specific selection term to be used as the basis for the production.”

Limits on the breadth of selection terms. As legislation on the USA Freedom Act progressed, civil liberties groups were concerned that the Act’s definition of “specific selection term” might be so broad as to allow bulk surveillance in through the back door. See Mark Jaycox, Nadia Kayyali & Lee Tien, “EFF Dismayed by House’s Gutted USA Freedom Act,” May 20, 2014. The definitions that Sec. 107 of the Act adds in new subsection (k) of Sec. 1861 impose different limits on the “specific selection terms” that can be used for the production of daily call detail records and other types of tangible things. Under new subsection (k)(4)(B), a “term that specifically identifies an individual, account or personal device” must be used in an application, under new subsection (C) of Sec. 1861(b)(2), for the daily production of call detail records. Although the USA Freedom Act does not define the term “personal device,” the House Report expounds on the contrast between a personal device that “can reasonably be expected to be used by an individual or group of individuals affiliated with one another,” and “devices that are made available for use by the general public or by multiple people not affiliated with one another.” At 20.

For the production of other types of tangible things, Sec. 107 of the Act provides, under subsection (k)(4)(A)(i)(I) of Sec. 1861, that in addition to “an individual, account or personal device,” a specific selection term may specifically identify an “address or any other specific identifier.” Although “address” is broadly defined, in subsection (k)(2) of Sec. 1861, as “a physical address or electronic address, such as an electronic mail address or temporarily assigned network address (including an Internet protocol address),” as per subsection (k)(4)(A)(i)(ii), broad definitions of electronic address (e.g., an ISP) or physical address (e.g., a zip code, county, or area code) cannot count as specific selection terms. More generally, subsections (k)(4)(A)(i)(II) and (k)(4)(A)(ii) hinder bulk collection by requiring that specific selection terms “limit, to the greatest extent reasonably practicable, the scope of tangible things sought consistent with the purpose for seeking the tangible things.” Nonetheless, a loophole allowing bulk collection may arise from subsection (k)(4)(A)(ii)(I)’s proviso that an electronic communication service provider or provider of a remote computing service may count as a specific selection term where “the provider is itself a subject of an authorized investigation for which the specific selection term is used as the basis for the production.”

The reinvigoration of Sec. 1861’s relevance requirement. Starting in 2006, the FISC relied on a “needle in the haystack” interpretation of relevance to find that the collection of records of all Americans’ telephone calls met Sec. 1861(b)(2)(A)’s requirement of “reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation (other than a threat assessment) … to obtain foreign intelligence information … or to protect against international terrorism or clandestine intelligence activities.” Secs. 101(a)(1) and (2) of the Act retain this language about relevance, in new Sec. 1861(b)(2)(B), in regard to the production of tangible things other than daily call detail records. Crucially, however, Sec. 103(a) adds the requirement, in new subsection (A) of Sec. 1861(b)(2), that “a specific selection term … be used as the basis for the production of the tangible things sought.” Similarly Sec. 101(a)(3) of the Act requires applications for daily call detail records to satisfy Sec. 1861(b)(2)(A)’s requirement of a specific selection term as well as a relevance requirement. Under new subsection (C)(i) of Sec. 1861(b)(2), there must be “reasonable grounds to believe that the call detail records sought to be produced based on the specific selection term … are relevant” “to an authorized investigation (other than a threat assessment) … to protect against international terrorism.”

The House Report emphasizes that the specific selector requirement precludes interpreting Sec. 1861’s relevance requirement to authorize bulk collection. “Congress’ decision to leave in place the ‘relevance’ standard for Section 501 [of FISA, 50 U.S.C. Sec. 1861] orders should not be construed as Congress’ intent to ratify the FISA Court’s interpretation of that term. These changes restore meaningful limits to the ‘relevance’ requirement of Section 501, consistent with the opinion of the U.S. Court of Appeals for the Second Circuit in ACLU v. Clapper.” At 18-19.

The definition of call detail records. While the addition of specific selection terms to Sec. 1861’s relevance requirement limits the persons whose records may be collected, the Act’s definition of “call detail record” limits the kind of information that the government may obtain through telephone records. The most recent FISC bulk collection orders flexibly define “telephony metadata” to include “comprehensive communications routing information,” a term that includes, but is not limited to, “session identifying information … trunk identifier, telephone calling card numbers, and time and duration of call.” See, e.g.,Primary Order, BR 15-99 (FISC Aug. 27, 2015) at 3 n.1; Primary Order, BR 15-24 (FISC Feb. 26, 2015) at 3 n.1. Instead of placing bounds on what counts as “session identifying information,” the Orders list “originating and terminating telephone number, International Mobile Subscriber Identity (IMSI) number, International Mobile station Equipment Identity (IMEI) number“ as examples of such information.

By contrast, as per Sec. 107 of the Act, the definition of “call detail record,” in new subsection (k)(3)(A) of Sec. 1861, only includes “session identifying information …, a telephone calling card number, or the time or duration of a call.” The only information that counts as “session identifying information” is “[a]n originating or terminating telephone number, an International Mobile Subscriber Identity number, or an International Mobile Station Equipment Identity number.”

In addition, the Act amends Sec. 1861 to more stringently limit the collection of location information. While recent FISC bulk collection orders and new subsection (k)(3)(B)(iii) of Sec. 1861 both prevent the collection of cell site location information, “trunk identifier” is included in the Orders’ definitions of “telephony metadata,” but not in the definition of “call detail record.” in new subsection (k)(3)(A). See, e.g., Primary Order, BR 15-99 (FISC Aug. 27, 2015) at 3 n.1; Primary Order, BR 15-24 (FISC Feb. 26, 2015) at 3 n.1. The omission of “trunk identifier” from the definition of “call detail record” is important because, as Judge Leon recognized in Klayman v. Obama, trunk identifiers “ ‘can reveal where [each] call enter[s] the trunk system’ and can be used to ‘locate a phone within approximately a square kilometer’.” Klayman v. Obama, 957 F.Supp.2d 1, 36 (D.D.C. 2013 (citing Patrick Di Justo, “What the NSA Wants to Know About Your Phone Calls,” The New Yorker, June 7, 2013)), rev’d on other grounds, No. 14-5004, 2015 WL 5058403 (D.C. Cir. Aug. 28, 2015).

A further important contrast is that “global positioning system information” is excluded from the definition of “call detail records” in new subsection (k)(3)(B)(iii) of Sec. 1861, but not from the definition of “telephony metadata” in recent FISC orders. This difference especially impacts the government’s ability to track the location of smart phone users.

The collection of location information has Major Fourth Amendment implications. In reauthorizing bulk collection of telephony metadata on October 11, 2013, FISC Judge McLaughlin recognized that the five concurring justices in United States v. Jones, 132 S.Ct. 945 (2012), had “suggest[ed] that the precise, pervasive monitoring of a person’s location could trigger Fourth Amendment protections even without any physical intrusion.Memorandum Opinion and Order, BR 13-158 (FISC 2013). It was very arguably a mistake for the judge to then distinguish the Jones concurrences away on the ground that the bulk telephony metadata program did not involve the collection of “location information.” “Trunk identifier” was included in the definition of “telephony metadata” in her Order. By contrast, in Klayman v. Obama, 957 F.Supp.2d at 36, Judge Leon’s Fourth Amendment concerns about the bulk telephony metadata program were properly heightened by the recognition that location information was collected through trunk identifiers.

Legislative enactment of President Obama’s proposals for limits on queries. In a speech on January 17, 2014, President Obama proposed that except in emergency situations, a judicial finding of a reasonable, articulable suspicion (“RAS”) that a selection term was associated with an international terrorist organization be required for querying telephony metadata. The President further directed that queries only extend to metadata within two, rather than the previous three, hops of the selection term. Starting with FISC Judge Reggie B. Walton’s Order of February 5, 2014, these changes were put into effect in FISC orders authorizing the collection of bulk telephony metadata.

Before the USA Freedom Act, these limits on queries were a matter of executive discretion, not enacted law. Under Sec. 101(a)(3) of the Act, new subsection (C)(ii) of Sec. 1861(b)(2) requires the government to provide the FISC with a statement of facts showing that there is a reasonable articulable suspicion that a proposed specific selection term is associated with a foreign power or its agent that is engaged in or preparing to engage in international terrorism. As per Sec. 101(b)(3), the FISC may authorize the government, under new subsections (F)(iii) and (iv) of Sec. 1861 (c)(2), to require telephone companies to produce a first hop of call detail records identified through a specific selection term. The production of a second hop of records, identified through session-identifying information or telephone calling card numbers obtained through the first hop, may also be required.

Retention of records and minimization requirements. Sec. 101(b)(3) of the Act only speaks of the government’s requiring third parties to produce first and second hop call detail records. By contrast, the House Report states that, “[T]he Government can use the FISC-approved specific selection term to identify CDR’s [call detail records] from metadata it already lawfully possesses. Together, the CDR’s produced by the telephone companies and those identified independently by the government constitute the first ‘hop.’” At 17. This raises the question of how big a repository of call detail records the NSA may build up, retain, and use for first hop queries with FISC-approved specific selection terms and subsequent second hop queries.

A first aspect of this question is whether after the amendments to Sec. 1861 come into effect, the NSA will be allowed to retain and query with FISC-approved specific selection terms telephony metadata previously collected under FISC bulk collection orders. On July 27, 2015, the DNI announced that NSA analysts’ authority to query previously collected bulk telephony metadata for intelligence purposes would end on November 29, 2015, the date on which, as per Sec. 109(a) of the Act, the amendments to Sec. 1861 come into effect.

Further unresolved questions arise in regard to the retention and querying of call detail records after the amendments come into effect. What, if any, restrictions will apply to the retention of first and second hop records that the NSA obtains from telephone companies on the basis of specific selector terms and to the continued querying of these records as the FISC approves further selector terms? Section 101(b)(3) of the Act amends Sec. 1861(c)(2) by requiring, under new subsection (F)(vii)(I), that the government “adopt minimization procedures that require the prompt destruction of all call detail records produced under the order that the Government determines are not foreign intelligence information.” The absence of any time limits for determining whether records are or are not “foreign intelligence information” calls the efficacy of this limit on retention into question, however. In addition, since all call detail records obtained under amended Sec. 1861 will either be associated with RAS [reasonable articulable suspicion]-approved targets or with contacts of RAS-approved targets, it is doubtful that the government would ever determine that a particular call detail record was “not foreign intelligence information” and should therefore be destroyed.

Sec. 104 of the Act does, however, provide for more robust FISC supervision of the minimization procedures that Sec. 1861(g) requires the government to adopt. While FISC approval of production orders was previously conditioned on a finding that the Attorney General had issued minimization procedures, Sec. 104(a) of the Act amends Sec. 1861(c)(1) to require an additional judicial finding that the minimization procedures conform to the requirements of Sec. 1861(g). Yet more importantly, Sec. 104(a) amends Sec. 1861(g) by providing, in new subsection (3), that there are no limits to “the authority of the court … to impose additional, particularized minimization procedures with regard to the production, retention or dissemination of nonpublicly available information concerning unconsenting United States persons, including additional particularlized procedures related to the destruction of information within a reasonable time period.” The extent to which this amendment will enhance privacy protections is entirely within the discretion of FISC judges, however. By definition, moreover, FISA’s minimization procedures afford no protection to anyone who is not a citizen or legal resident of the United States.

Obligations of Telecommunications Providers. The House Report states that Section 101 of the Act “does not require any private entity to retain any record or information other than in the ordinary course of business.” At 18. According to the Report, however, “nothing in current law or this Act prohibits the government and telecommunications providers from agreeing voluntarily to retain records for periods longer than required for their business purposes.” Id. From 2006 on, the only objections that telephone companies raised to the collection of bulk telephony metadata were feeble objections by Sprint and Verizon. Given this record of compliance, it seems likely that after the amendments to Sec. 1861 go into effect, telephone companies will agree to retain records for as long as the government wants.

By contrast to the failure to require records to be retained for longer than business purposes, Sec. 101(b)(3) of the Act amends Sec. 1861(c)(2) to require, in new subsection (F)(v), that call detail records be produced “in a form that will be useful to the Government.” Although the House Report does not comment on this requirement, a likely aim is to prevent telecommunications companies from protecting subscribers’ privacy by producing records to the government in encrypted form. Another aim may be to prevent cell phone service providers from making the commercially sensible decision that for subscribers with unlimited calling plans, records will only be kept of calls that are subject to roaming charges.

II.THE PROHIBITION OF BULK COLLECTION THROUGH PEN/TRAPS

The FISC relied on the pen/trap provision of FISA, 50 U.S.C. Sec. 1842 (“Sec. 1842”) to authorize bulk collection of electronic communications metadata from 2004 until the NSA allegedly discontinued such collection in 2011. Title II of the USA Freedom Act’s amendments to Sec. 1842 and the associated definitions in 50 U.S.C. Sec. 1841 (“Sec. 1841”) preclude both resumed bulk collection of electronic communications metadata and the end running of the Act’s amendments to Sec. 1861 by using Sec. 1842 to authorize bulk collection of telephony metadata.

As with the amendments to Sec. 1861, the requirement of a specific selection term is the means that the Act uses to prevent the use of pen/trap orders for untargeted collection. As per Sec. 201(a) of the Act, new subsection (3) of Sec. 1842(c) requires applications for pen/trap orders to specify “a specific selection term as the basis for the use of the pen register or trap and trace device.” As per Sec. 201(b) of the Act, new subsection (4) of Sec. 1841 sets virtually identical limits on the breadth of “specific selection terms” for pen/traps as those that Sec. 107 of the Act establishes, in new subsection (k)(4)(A) of Sec. 1861, for tangible things other than call detail records.

In addition, Sec. 202 of the Act creates privacy protections and minimization procedures. New subsection (h)(1) of Sec. 1842 requires the Attorney General to establish policies and procedures that “to the maximum extent practicable and consistent with the need to protect national security,” protect the privacy of United States citizens and legal residents in regard to the collection, retention, and use of nonpublicly available information about them obtained through pen/traps. Similarly to Sec. 104(a) of the Act’s amendment of the minimization procedures of Sec. 1861, Sec.202 of the Act authorizes FISC judges, under new subsection (h)(2) of Sec. 1842, to “impose additional privacy or minimization procedures with regard to the installation or use” of pen/traps.

III. THE PROHIBITION OF BULK COLLECTION THROUGH NATIONAL SECURITY LETTERS

Title V of the USA Freedom Act prevents bulk collection by specifying types of selection terms that must be included in national security letter requests for telephone records, financial records, consumer records and consumer reports. Under Sec. 501(a) of the Act, 18 U.S.C. Sec. 2709(b) is amended to require that “a term that specifically identifies a person, entity, telephone number, or account” be used as the basis for FBI requests to telecommunications providers for subscriber information, telephone toll billing records, or electronic communications transactions records. Sec. 501(b) amends Sec. 1142(a)(2) of the Right to Financial Privacy Act of 1978, 12 U.S.C. Sec. 3414(a)(2), to require that requests for financial records for intelligence purposes or for the exercise of the Secret Service’s protective functions include “a term that specifically identifies a customer, entity, or account to be used as the basis for the production and disclosure.” Similarly, the Act amends Section 626 of the Fair Credit Reporting Act, 15 U.S.C. Sec. 1681u, to require the FBI to use “a term that specifically identifies a consumer or account” as the basis for requests to consumer reporting agencies for the names and addresses of financial institutions at which consumers have or have had accounts (subsection (a) of Sec. 1681u, as amended by Sec. 501(c)(1)) and for identifying information about consumers (subsection (b) of Sec. 1681u, as amended by Sec. 501 (c)(2)). “[A] term that specifically identifies a consumer or account” must also be included in FBI requests for judicial orders for the production of consumer reports by consumer reporting agencies (subsection of Sec. 1681u, as amended by Sec. 501 (c)(3) of the Act) and in requests to consumer reporting agencies for consumer reports and other information in consumers’ files by government agencies authorized to investigate international terrorism or engage in related intelligence or counterintelligence activities or analyses (Sec. 627(a) of the Fair Credit Reporting Act, 15 U.S.C. Sec. 1681v(a), as amended by Sec. 501(d) of the Act)

IV. CONTINUED BULK COLLECTION OF TELEPHONY METADATA AFTER THE ENACTMENT OF THE USA FREEDOM ACT

While the amendments to the pen/trap and national security provisions went into effect immediately, Section 109 of the USA Freedom Act delays the prohibitions of bulk collection of telephony metadata and other tangible things in Sections 101-103 from going into effect until 180 days from the enactment of the Act. After the Act was passed on June 2, 2015, the government applied to the FISC later that day to renew bulk collection of telephony metadata. The FISC reauthorized the bulk telephony metadata program on June 29 until August 28 (Primary Order, BR 15-75) and on August 27 until November 29, the end of the 180 day period that the USA Freedom Act set for its prohibitions of bulk collection under Section 1861 to go into effect (Primary Order, BR 15-99). In granting the government’s applications, the FISC considered and rejected statutory and constitutional arguments by amici Kenneth T. Cuccinelli, II and Freedom Works, Inc. (Motion in Opposition, Misc. 15-01 (June 5, 2015); Movant’s Supplemental Brief, Misc. 15-01 (June 12, 2015)) and statutory arguments in The Center for National Security Studies’ amicus brief filed in another docket on April 3, 2014. Opinion and Order, BR 15-75, MISC 15-01 (June 29, 2015) . See also Memorandum Opinion, BR 15-77, 78 (June 17, 2015) (disposing of argument that the Sunset Clause of the Patriot Act bars the authorization of continued bulk collection without appointing amici). The Challenges portion of our website describes this litigation before the FISC in more detail.

Also discussed in our Challenges section is the opinion of the United States Courts of Appeals for the Second Circuit in ACLU v. Clapper, 14-42–cv, 2015 WL 6516757 (2d Cir. Oct. 29, 2015), rejecting both statutory and constitutional challenges to the renewal of the bulk telephony metadata program during the 180-day interim provided by the USA Freedom Act. On July 27, the Ninth Circuit withdrew the constitutional challenge to the program in Smith v. Obama, No. 14-35555, pending the Second Circuit’s final decision, and on November 10, the government adduced that decision as a reason for the Ninth Circuit to deny relief. In addition, as we discuss, the United States Court of Appeals for the D.C. Circuit on August 28, 2015 in Obama v. Klayman, 800 F.3d 559, reversed on the ground that the plaintiffs lacked standing the District Court’s initial grant of a preliminary injunction on December 16, 2013 against the telephony metadata program. On remand, the District Court responded to the D.C. Circuit’s August 28, 2015 opinion by allowing the plaintiffs to amend their complaint to add additional plaintiffs. On November 9, 2015. the District Court held that the operation of the NSA telephony metadata program during the 180-day interim very likely violated the Fourth Amendment, and therefore granted the additional plaintiffs a preliminary injunction. Klayman v. Obama, Civil Action No. 13-851 (RJL), 2015 WL 6873127 (D.D.C. Nov. 9, 2015). The D.C. Circuit stayed the injunction on November 16, 2015. Klayman v. Obama, No. 15-5307 (D.C. Cir. Nov. 16, 2015).

V. THE END OF THE NSA’S BULK COLLECTION OF TELEPHONY METADATA

On November 27, 2015, the Director of National Intelligence (“DNI”) announced that the NSA’s bulk collection of telephony metadata would end on November 29 and that NSA agents would no longer access the data for analytic purposes. Still pending before the FISC was the government’s request for technical personnel to have access to previously collected bulk metadata until February 29, 2016 in order to verify that the new targeted collection program was working as intended. In addition, the DNI stated that the NSA was obligated to retain metadata collected under the bulk program until civil litigation concerning the program was resolved or relevant courts relieved it of the obligation.