THE NATIONAL SECURITY STATE: THE NSA'S MASS SUVEILLANCE AND META-DATA COLLECTION

Sponsor: Young Lawyers Division CLE Credit: 1.0

Friday, June 19, 2015 9:00 a.m. - 10:00 a.m.

Elkhorn A-D Lexington Convention Center

Lexington, Kentucky

A NOTE CONCERNING THE PROGRAM MATERIALS

The materials included in this Kentucky Bar Association Continuing Legal Education handbook are intended to provide current and accurate information about the subject matter covered. No representation or warranty is made concerning the application of the legal or other principles discussed by the instructors to any specific fact situation, nor is any prediction made concerning how any particular judge or jury will interpret or apply such principles. The proper interpretation or application of the principles discussed is a matter for the considered judgment of the individual legal practitioner. The faculty and staff of this Kentucky Bar Association CLE program disclaim liability therefore. Attorneys using these materials, or information otherwise conveyed during the program, in dealing with a specific legal matter have a duty to research original and current sources of authority.

Printed by: Evolution Creative Solutions 7107 Shona Drive

Cincinnati, Ohio 45237

Kentucky Bar Association

TABLE OF CONTENTS The Presenter .................................................................................................................. i The National Security State: The NSA's Mass Surveillance and Meta-Data Collection ....................................................................................................... 1 Metadata, the NSA, and the Fourth Amendment: A Constitutional Analysis of Collecting and Querying Call Records Databases ............... 7 Why NSA's Bulk Data Seizures Are Illegal and Unconstitutional ................................... 15 NSA Surveillance May Be Legal – but It's Unconstitutional ........................................... 21

THE PRESENTER

Professor Brian Frye University of Kentucky College of Law

620 South Limestone Lexington, Kentucky 40506-0048

(859) 218-0632 brianlfrye@gmail.com

PROFESSOR BRIAN FRYE joined the faculty of the University of Kentucky College of Law in 2012 and teaches civil procedure, copyright, intellectual property, and nonprofit organizations. Prior to coming to the university, he was a Visiting Assistant Professor of Law at Hofstra University School of Law. He also worked as a litigation associate at Sullivan & Cromwell, LLP and clerked for Judge Andrew J. Kleinfeld of the United States Court of Appeals for the Ninth Circuit and Justice Richard B. Sanders of the Washington Supreme Court. Professor Frye received his J.D. from the New York University School of Law, his M.F.A. from the San Francisco Art Institute, and B.A. from the University of California at Berkeley. His research focuses on legal issues affecting artists and arts organizations. Professor Frye is also a filmmaker. Most recently, he produced the documentary film Our Nixon (2013), which was broadcast by CNN and opened theatrically nationwide. His other films have been shown in the Whitney Biennial 2002, the New York Film Festival, and the San Francisco International Film Festival, among other venues, and are in the permanent collection of the Whitney Museum of American Art. His critical writing on film and art has appeared in October, The New Republic, Film Comment, Cineaste, Senses of Cinema, and Incite!, among other journals.

i

ii

THE NATIONAL SECURITY STATE: THE NSA’S MASS SURVEILLANCE AND META-DATA COLLECTION

Brian L. Frye

I. WHAT KIND OF DATA DOES THE NATIONAL SECURITY AGENCY (NSA)

COLLECT?

A. Telephone Metadata (MAINWAY)

MAINWAY is an NSA database containing metadata relating to about two billion telephone calls made through the four largest telephone carriers in the United States: AT&T, SBC, BellSouth (all three now called AT&T), and Verizon. The metadata collected includes the telephone number of the caller and the recipient, the date and time of the call, the duration of the call, and information related to the location of the caller and recipient. The NSA created the database in 2002, and stores the metadata for about five years.

B. Internet Data (XKEYSCORE)

XKEYSCORE is an NSA database containing data from various sources, including keystroke data relating to the Internet activities of a large number of people. XKEYSCORE collects a very large amount of data that can only be stored for a short period of time.

C. Other Data (Various Programs)

The NSA collects data about targeted individuals and organizations under the auspices of an assortment of programs.

II. WHAT IS THE LEGAL BASIS FOR THE NSA DATA COLLECTION

PROGRAMS?

Section 215 of the USA Patriot Act of 2001, which amended Title V, Section 501 of the Foreign Intelligence Surveillance Act (FISA), "Access to Certain Business Records for Foreign Intelligence and International Terrorism Investigations," codified at 50 U.S.C. §1861. A. 50 U.S.C. §1861(a)(1): "[T]he Director of the Federal Bureau of

Investigation or a designee of the Director (whose rank shall be no lower than Assistant Special Agent in Charge) may make an application for an order requiring the production of any tangible things (including books, records, papers, documents, and other items) for an investigation to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities, provided that such investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution."

1

B. The government argues that Section 215 of the Patriot Act gives the FBI and its designees essentially plenary authority to collect data, subject to constitutional restrictions.

III. HOW WERE THE NSA DATA COLLECTION PROGRAMS DISCLOSED TO

THE PUBLIC?

Edward Snowden: A. Snowden was a former system administrator for the Central Intelligence

Agency (CIA), counterintelligence trainer at the Defense Intelligence Agency (DIA), and NSA contractor. In March 2013, he joined the consulting firm Booz Allen Hamilton and worked as an infrastructure analyst for the NSA in Hawaii.

B. In May 2013, Snowden flew to Hong Kong. In June 2013, he provided

thousands of classified documents relating to various NSA data collection programs to several media outlets. He currently resides at an undisclosed location in Russia.

IV. ARE THE NSA DATA COLLECTION PROGRAMS CONSTITUTIONAL?

A. Relevant Supreme Court Doctrine

1. Katz v. U.S., 389 U.S. 347 (1967).

Defendant was convicted in the United States District Court for the Southern District of California, Central Division, Jesse W. Curtis, J., of a violation of statute proscribing interstate transmission by wire communication of bets or wagers, and he appealed. The Court of Appeals, 369 F.2d 130, affirmed, and certiorari was granted. The Supreme Court, Mr. Justice Stewart, held that government's activities in electronically listening to and recording defendant's words spoken into telephone receiver in public telephone booth violated the privacy upon which defendant justifiably relied while using the telephone booth and thus constituted a "search and seizure" within Fourth Amendment, and fact that electronic device employed to achieve that end did not happen to penetrate the wall of the booth could have no constitutional significance. The Court further held that the search and seizure, without prior judicial sanction and attendant safeguards, did not comply with constitutional standards, although, accepting account of government's actions as accurate, magistrate could constitutionally have authorized with appropriate safeguards the very limited search and seizure that government asserted in fact took place and although it was apparent that agents had acted with restraint.

2

2. U.S. v. Miller, 425 U.S. 435 (1976).

Defendant was convicted before the United States District Court for the Middle District of Georgia, of possessing an unregistered still, carrying on the business of a distiller without giving bond and with intent to defraud the Government of whiskey tax, possessing whiskey upon which no taxes had been paid and conspiring to defraud United States of tax revenues, and he appealed. The Court of Appeals for the Fifth Circuit, reversed, 500 F.2d 751, and certiorari was granted. The United States Supreme Court, Mr. Justice Powell, held that bank depositor had no protectible Fourth Amendment interest in bank records, consisting of microfilms or checks, deposit slips and other records relating to his accounts at two banks, maintained pursuant to Bank Secrecy Act and obtained by allegedly defective subpoenas, and thus trial court did not err in denying motion to suppress subpoenaed documents.

3. Smith v. Maryland, 442 U.S. 735 (1979) (Blackmun, J.).

The telephone company, at police request, installed at its central offices a pen register to record the numbers dialed from the telephone at petitioner's home. Prior to his robbery trial, petitioner moved to suppress "all fruits derived from" the pen register. The Maryland trial court denied this motion, holding that the warrantless installation of the pen register did not violate the Fourth Amendment. Petitioner was convicted, and the Maryland Court of Appeals affirmed. Held: The installation and use of the pen register was not a "search" within the meaning of the Fourth Amendment, and hence no warrant was required. (a) Application of the Fourth Amendment depends on whether the person invoking its protection can claim a "legitimate expectation of privacy" that has been invaded by government action. This inquiry normally embraces two questions: first, whether the individual has exhibited an actual (subjective) expectation of privacy; and second, whether his expectation is one that society is prepared to recognize as "reasonable." Katz v. U.S., 389 U.S. 347. (b) Petitioner in all probability entertained no actual expectation of privacy in the phone numbers he dialed, and even if he did, his expectation was not "legitimate." First, it is doubtful that telephone users in general have any expectation of privacy regarding the numbers they dial, since they typically know that they must convey phone numbers to the telephone company and that the company has facilities for recording this information and does in fact record it for various legitimate business purposes. And petitioner did not demonstrate an expectation of privacy merely by using his home phone rather than some other phone, since his conduct, although perhaps calculated to keep the contents of his conversation private, was not calculated to preserve the privacy of the number

3

he dialed. Second, even if petitioner did harbor some subjective expectation of privacy, this expectation was not one that society is prepared to recognize as "reasonable." When petitioner voluntarily conveyed numerical information to the phone company and "exposed" that information to its equipment in the normal course of business, he assumed the risk that the company would reveal the information to the police, cf. U.S. v. Miller, 425 U.S. 435.

4. U.S. v. Jones, 132 S. Ct. 945 (2012).

The Government obtained a search warrant permitting it to install a Global-Positioning-System (GPS) tracking device on a vehicle registered to respondent Jones's wife. The warrant authorized installation in the District of Columbia and within ten days, but agents installed the device on the eleventh day and in Maryland. The Government then tracked the vehicle's movements for twenty-eight days. It subsequently secured an indictment of Jones and others on drug trafficking conspiracy charges. The District Court suppressed the GPS data obtained while the vehicle was parked at Jones's residence, but held the remaining data admissible because Jones had no reasonable expectation of privacy when the vehicle was on public streets. Jones was convicted. The D.C. Circuit reversed, concluding that admission of the evidence obtained by warrantless use of the GPS device violated the Fourth Amendment. Held: The Government's attachment of the GPS device to the vehicle, and its use of that device to monitor the vehicle's movements, constitutes a search under the Fourth Amendment. Pp. 948-954. (a) The Fourth Amendment protects the "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." Here, the Government's physical intrusion on an "effect" for the purpose of obtaining information constitutes a "search." This type of encroachment on an area enumerated in the Amendment would have been considered a search within the meaning of the Amendment at the time it was adopted. Pp. 948-949. (b) This conclusion is consistent with this Court's Fourth Amendment jurisprudence, which until the latter half of the twentieth century was tied to common-law trespass. Later cases, which have deviated from that exclusively property-based approach, have applied the analysis of Justice Harlan's concurrence in Katz v. U.S., 389 U.S. 347, which said that the Fourth Amendment protects a person's "reasonable expectation of privacy," id., at 360, 88 S.Ct. 507. Here, the Court need not address the Government's contention that Jones had no "reasonable expectation of privacy," because Jones's Fourth Amendment rights do not rise or fall with the Katz formulation. At bottom, the Court must "assur[e] preservation of that degree of privacy against government that existed when the Fourth

4

Amendment was adopted." Kyllo v. U.S., 533 U.S. 27, 34 (2001). Katz did not repudiate the understanding that the Fourth Amendment embodies a particular concern for government trespass upon the areas it enumerates. The Katz reasonable-expectation-of-privacy test has been added to, but not substituted for, the common-law trespassory test. See Alderman v. U.S., 394 U.S. 165 (1969); Soldal v. Cook County, Ill., 506 U.S. 56, 64 (1992), U.S. v. Knotts, 460 U.S. 276 (1983), and U.S. v. Karo, 468 U.S. 705 (1984) – post-Katz cases rejecting Fourth Amendment challenges to "beepers," electronic tracking devices representing another form of electronic monitoring – do not foreclose the conclusion that a search occurred here. New York v. Class, 475 U.S. 106 (1986) and Oliver v. U.S., 466 U.S. 170 (1984), also do not support the Government's position. Pp. 949-954.

B. Current Federal Court Challenges

1. Klayman v. Obama, 957 F.Supp.2d 1 (D.D.C. 2013).

Subscribers to certain telecommunications and Internet services brought actions against federal government and private service providers and their executive officers, challenging the constitu-tionality and statutory authorization of certain of government's intelligence-gathering practices relating to wholesale collection of phone record metadata for United States citizens and analysis of that data through National Security Administration (NSA). Subscribers moved for preliminary injunction to bar government from continuing to engage in bulk collection and querying of phone record metadata, and to require government to destroy any such metadata in its possession. Holdings: The District Court, Richard J. Leon, J., held that: a. Court was barred from reviewing subscribers' claim that

program exceeded government's statutory authority, in violation of Administrative Procedure Act (APA);

b. Subscribers had standing to raise Fourth Amendment

challenge to collection and querying components of program;

c. Program constituted search under Fourth Amendment; d. Subscribers were likely to succeed in showing that

government's searches and NSA's analysis were unreasonable under Fourth Amendment;

e. Subscribers demonstrated irreparable harm and public

interest to support injunctive relief; and

5

f. Order would be stayed pending appeal, in light of national security interests and novelty of constitutional issues.

2. American Civil Liberties Union v. Clapper, 959 F.Supp.2d 724

(S.D.N.Y. 2013).

Background: Non-profit civil rights and liberties organizations brought action seeking a declaratory judgment that the National Security Agency's (NSA) telephony metadata collection exceeded the authority granted by the Foreign Intelligence Surveillance Act (FISA) and violated the First and Fourth Amendments. Organizations moved for a permanent injunction enjoining the government from continuing the collection, and the government moved to dismiss. Holdings: The District Court, William H. Pauley III, J., held that: a. Government's collection of metadata related to the

organizations' calls constituted an actual injury sufficient to give the organizations' standing;

b. Administrative Procedure Act's (APA) waiver of sovereign

immunity did not apply to FISA statute allowing the collection of metadata;

c. Organizations were precluded from bringing statutory

cause of action challenging FISA statute allowing the collection of metadata;

d. FISA did not preclude organizations from bringing

constitutional claims; e. Collection of virtually all telephony metadata was

authorized by FISA; f. NSA's telephony metadata collection program did not

violate the Fourth Amendment; and g. Organizations' speculative fear that government would

review metadata related to their calls was insufficient to establish a violation of First Amendment associational rights.

C. The Expiration of Section 215 of the Patriot Act

Section 215 of the Patriot Act will expire on June 1, 2015, unless it is renewed by Congress.

D. The Constitutionality of NSA Data Collection in light of Supreme Court

Precedent and Politics

6

METADATA, THE NSA, AND THE FOURTH AMENDMENT: A CONSTITUTIONAL ANALYSIS OF COLLECTING AND

QUERYING CALL RECORDS DATABASES Orin Kerr

Reprinted with permission from The Volokh Conspiracy, July 17, 2013 3:54 a.m.

In his recent Wall Street Journal op-ed, my co-blogger Randy Barnett argues that massive-scale collection of communications metadata by the NSA violates the Fourth Amendment because it is an unreasonable seizure. Randy's colleague Laura K. Donohue recently argued in the Washington Post that such collection violates the Fourth Amendment as an unreasonable search. Jennifer Granick and Chris Sprigman made a similar argument in the New York Times. Are they right? Does obtaining all telephony metadata under Section 215 – and then querying the database – violate the Fourth Amendment? In this post, I'll start with current law, and I'll explain why current law supports the conclusion that massive-scale collection of communications metadata by the NSA does not violate the Fourth Amendment rights of its customers. I'll then consider alternate views of the Fourth Amendment and explain the prospects and challenges of using the mosaic theory to get to a contrary result. I'll then turn to the argument Randy flags that obtaining this metadata may violate the rights of the communications providers instead of customers. This strikes me as a plausible argument, but not a certain one; I find the issue doctrinally murky, and I don't have a strong view of it. But in this post I'll offer the arguments for the sake of those interested in them. I. METADATA SURVEILLANCE AND THE FOURTH AMENDMENT RIGHTS OF

CUSTOMERS

First, the facts. From what we can tell, the FISC has signed an order requiring communications providers to disclose the telephony metadata they have collected to the federal government. We don't know exactly what records are actually being turned over, but the order indicates that it includes all non-content information, which might include numbers dialed, duration of calls, and the location information of cell-phones. The NSA is then querying the database, although it seems that pursuant to a FISC order they can do so only when they have reasonable suspicion that the fruits of the query will reveal information relating to terrorist plots and the like. The conventional account of the doctrine would indicate that this does not violate the Fourth Amendment. When I say "conventional account," I mean the account found in conventional sources of legal authority like Supreme Court opinions and circuit court decisions. Here's how the conventional account would go: (a) First, obtaining telephone metadata is not a "search" under Smith v. Maryland, 442 U.S. 735 (1979). Smith held that the number dialed from a telephone call is not protected because it is information provided to the phone

7

company to place the call. The caller sends the information to the phone company, and the phone company uses it; the information is the phone company's record of what it did, not the user's property. Smith built on U.S. v. Miller, 425 U.S. 435 (1976), which held that a person does not have Fourth Amendment rights in their bank records. The bank records are the bank's business records of how the account was used, Miller reasoned, so the customer has no privacy rights in the information. Under the reasoning of Smith and Miller, metadata that is account information about how an account was used – but not call contents – is not protected under the Fourth Amendment. See, e.g., U.S. v. Fregoso, 60 F.3d 1314, 1321 (8th Cir. 1995) (stored telephone records not protected). Lower courts have applied the same principles to Internet metadata, too. See U.S. v. Forrester, 512 F.3d 500, 510 (9th Cir. 2008) (IP addresses); U.S. v. Perrine, 518 F.3d 1196, 1204 (10th Cir. 2008) ("Every federal court to address this issue has held that subscriber information provided to an internet provider is not protected by the Fourth Amendment's privacy expectation."). (b) Under existing doctrine, the closer call is with cell-site location – location information about where phones are located – that is part of the same Section 215 order. There is pending litigation on how the Fourth Amendment applies to cell-site information collection in several circuits, and it's not inconceivable that the issue might get to the Supreme Court within a few years. However, the predominant view in the case law is that cell-site location is unprotected under Smith v. Maryland. See, e.g., U.S. v. Skinner, 690 F.3d 772 (6th Cir. 2012); U.S. v. Booker, 2013 WL 2903562, at *9 (N.D. Ga. Jun. 13, 2013); U.S. v. Graham, 846 F.Supp.2d 384, 389 (D. Md. 2012); U.S. v. Benford, 2010 WL 1266507, at *3 (N.D. Ind. Mar. 26, 2010). (c) One difference between the existing cases like Smith and the facts of the NSA program involves the scale of the records obtained. In the criminal cases Smith, Forrester, and Perrine, the government obtained and examined the records of a single customer – the criminal suspect. Under the current Section 215 order, however, the government is obtaining massive databases of tens of millions of customers. It is then only looking through that database when it has reasonable suspicion. So it's a big difference in the facts. But do those facts make a constitutional difference? I think that distinction can make a difference in the analysis on the Fourth Amendment rights of the phone companies – more on that in a minute. But I don't see a doctrinal hook in existing case law for why it would make a difference in the Fourth Amendment rights of their users. If obtaining pen register information on one user is not a search, the[sic] obtaining that pen register information for 100 or 10,000 or 1,000,000 or more users is still not a search. Katz tells us that the Fourth Amendment protects "people, not places," and it's not clear how surveillance that is not a search when[sic] provides information about one person can become a search when it provides information about many. To be sure, it's possible to devise theories of the Fourth Amendment that would make that relevant, but it's hard to get there just based on the conventional sources of existing appellate cases.

8

(d) That brings us to the last part of the picture. If the information that is in the database is not protected by the Fourth Amendment, then querying the database does not raise any Fourth Amendment issues. See, e.g., State v. Sloane, 939 A.2d 796 (N.J. 2008).

II. THE MOSAIC THEORY AND THE RIGHTS OF CUSTOMERS

So that's the conventional account. The most common arguments to the contrary invoke what I have called the mosaic theory of the Fourth Amendment. Specifically, they draw from the concurring opinions in U.S. v. Jones, 132 S.Ct. 945 (2012) to say that the collective acquisition and analysis of information about a person over time constitutes a search even if collecting individual discrete pieces are not searches. Here's Chris Sprigman and Jennifer Granick making the argument:

The government has made a mockery of [Fourth Amendment] protection by relying on select Supreme Court cases, decided before the era of the public Internet and cellphones, to argue that citizens have no expectation of privacy in either phone metadata or in e-mails or other private electronic messages that it stores with third parties. This hairsplitting is inimical to privacy and contrary to what at least five justices ruled just last year in a case called U.S. v. Jones. One of the most conservative justices on the Court, Samuel A. Alito Jr., wrote that where even public information about individuals is monitored over the long term, at some point, government crosses a line and must comply with the protections of the Fourth Amendment. That principle is, if anything, even more true for Americans' sensitive nonpublic information like phone metadata and social networking activity.

Laura Donohue echoes the same point:

Americans reasonably expect that their movements, communi-cations and decisions will not be recorded and analyzed by the government. A majority of the Supreme Court seems to agree. Last year, the court considered a case involving twenty-eight-day GPS surveillance. Justice Samuel Alito suggested that in most criminal investigations, long-term monitoring "impinges on expectations of privacy." Justice Sonia Sotomayor recognized that following a person's movements "reflects a wealth of detail about her familial, political, professional, religious, and sexual associations."

This argument isn't impossible to make, but it is certainly uphill. That's true for three primary reasons: 1) The concurring opinions in Jones are only that – concurring opinions. They are not binding law. Most lower courts have rejected the rationale of the concurring opinions. See, e.g., State v. LeMasters, 2013 WL 3463219 (Ohio App. 12 Dist.

9

Jul. 8, 2013) ("While [the appellant] spends a great amount of time in his brief quoting and referencing the concurring opinions in Jones that suggest that the Fourth Amendment should be stretched to include other privacy rights, we are bound only by the majority opinion of the court, rather than questions raised and suggestions made within the dicta of concurring opinions.") So to succeed on this argument, first you need to argue that courts should adopt the mosaic theory and apply it in cases like the NSA surveillance. I have argued that courts should reject the mosaic theory; you can read my argument here if you'd like. But even if you disagree, I don't think you can just cite the concurring opinions in Jones and call it a day. Instead, you need to offer an argument as to why courts should adopt those concurring opinions. As I explain in my article, that's possible but not at all easy. 2) Even if you accept the concurring opinions in Jones as controlling opinions, it's far from clear that they should apply to the facts of the NSA program. That's true for several reasons, but for the sake of brevity I'll focus on just one: The key to the Jones concurring opinions was the combination of the collection of information and its subsequent analysis, and that subsequent analysis seems to be missing. Justice Alito's opinion in Jones looked to whether a person reasonably expects others to "secretly monitor and catalog" a person's movements. Justice Sotomayor asked "whether people reasonably expect that their movements will be recorded and aggregated" in a manner that creates the mosaic. Cataloging and aggregating are verbs that describe subsequent analysis instead of initial collection. These phrases suggest that the mosaic theory requires some step beyond the acquisition stage. In the case of the NSA program, it appears that the NSA gathers everything but then makes only very specific and targeted (and relatively rare) queries through the database. It's not at all clear that the facts of the NSA program involve the systematic analysis of data that appears to be so important to the concurring arguments in Jones. 3) Next, even if you conclude that accessing location information is a search under the mosaic theory or some other theiry[sic], there is work to be done to show that it is an unreasonable search. Not all warrantless searches are unreasonable searches. Indeed, there are lots of problems squaring the mosaic theory with a warrant requirement, as I explain in my article. Further, even if you say that a mosaic search requires a warrant generally, there is considerable appellate case law indicating that searching with the goal of finding national security information about foreign terrorist groups relaxes the warrant requirement. See, e.g., U.S. v. Brown, 484 F.2d 418 (5th Cir. 1973); U.S. v. Butenko, 494 F.2d 593 (3d Cir. 1974) (en banc); U.S. v. Buck, 548 F.2d 871 (9th Cir. 1977); U.S. v. Truong Dinh Hung, 629 F.2d 908 (4th Cir. 1980). I don't have a good sense of how those cases would play out in the context of the NSA program, as the facts are so different. But I flag the point just as a reminder that there would need to be some kind of analysis on what reasonableness means in this specific situation. You can't just assume that a warrantless collective search automatically requires a warrant. In sum, using the mosaic theory to say that at least parts of the NSA program violate the Fourth Amendment is a possibility, but it's an uphill battle for a number of independent reasons.

10

III. CURRENT FOURTH AMENDMENT DOCTRINE AND THE FOURTH AMENDMENT RIGHTS OF THE TELEPHONE COMPANIES

My co-blogger Randy has taken a different approach to the question. Randy focuses on the Fourth Amendment rights of the telephone companies rather than the individual customers: If the provider doesn't want to turn over the records, then does the Fourth Amendment stop the government from forcing the government to compel them? Is forcing the provider to turn over its records an unconstitutional "seizure"? To answer this, let's start my assuming that the telephone companies do not want to turn over the records: They are only turning over the records because the FISC has ordered them to do so. Does the Fourth Amendment allow the FISC to order the companies to disclose the records? The question raises a complex question because Section 215 orders are somewhat sui generis from a Fourth Amendment perspective. To simplify a lot of case law, there are two traditional kinds of legal process in Fourth Amendment law governed by two different legal frameworks. The first legal process is a warrant, which a judge issues based on probable cause. The warrant lets the government enter the place to be searched and retrieve the property described in the warrant. The second legal process is a subpoena, which is issued by a government agency without judicial supervision. The subpoena tells the recipient to hand over property it has or to come testify. The two forms of legal process have different Fourth Amendment rules governing them. Warrants are governed by the standard found in the text of the Fourth Amendment: "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." On the other hand subpoenas do not require probable cause or warrant-like particularity. Subpoenas to testify are not regulated by the Fourth Amendment at all, see United States v. Dionisio, 410 U.S. 1 (1973), and warrants to compel the disclosure of property are regulated primarily by the requirement that complying with the subpoena must not be overly burdensome. See, e.g., See v. City of Seattle, 387 U.S. 541, 544 (1967). Also, the two legal standards are enforced in two different ways. When the government gets a warrant, the government can execute the warrant and the subject of the warrant can't object until later. In contrast, subpoenas are not self-executing. The recipient of the subpoena can move to quash it before complying; it is only enforced if a judge is called on to review the constitutionality of the subpoena and issues a subsequent ruling. This framework creates some difficulty for analyzing Section 215 orders because it's not clear which framework applies. Section 215 orders are like subpoenas in some ways (they are orders to compel) and like warrants in other ways (they are signed by judges). Let's assume that ordering a company to copy information "seizes" that information from the company. That point isn't obvious, but I have argued that it is generally the case. See Kerr, "Fourth Amendment Seizures of Computer Data," 119 Yale L.J. 700 (2010). Assuming that a seizure occurred, do you determine the reasonableness of the seizure using the warrant standard, the subpoena standard, or something else? For that matter, how does the Butenko/Trung foreign surveillance impact the reasonableness of the seizure?

11

This is pretty novel ground, and I don't know if there's an obvious answer in existing case law. Perhaps the best argument for saying that Section 215 orders are unconstitutional is to assert that they have to fit either the warrant standard or the subpoena standard but they can't satisfy either one. It's obvious that Section 215 orders aren't valid warrants. And less obviously, but also quite plausibly, you could say that under the usual Fourth Amendment standard for administrative agency subpoenas, the orders violate the requirement "that the subpoena be sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome." See v. City of Seattle, 387 U.S. 541, 544 (1967). By ordering the disclosure of the entire database of collected metadata, the argument would run, the government is obviously not getting a limited and specific directive. It is making the providers turn over absolutely everything, not just a narrow and limited set of information. And that is "unreasonable" under the subpoena precedents. The counterargument to this could run on two grounds. First, you could argue that whether a subpoena to obtain and query an electronic database is "sufficiently limited in scope, relevant in purpose, and specific in directive" to be reasonable requires considering not just whether the order to disclose the database is limited, but also whether querying the database is limited. In other words, you could consider reasonableness over the two steps – the acquisition of the database with strict protections from it being queried, and then the subsequent permitted queries – rather than just the one step of acquisition. This isn't a perfect fit, as the burdensomeness standard is about burdensomeness to the recipient of the subpoena; it's not clear how querying the database has anything to do with that. But it's a plausible argument given the unusual facts here. And it may explain why the FISC has imposed a reasonable suspicion requirement on querying the database: Perhaps the FISC has concluded that the reasonableness of the seizure of the database under the subpoena precedents allows the whole database to be obtained but only actually queried when there is reasonable suspicion. It's hard to know. A second counterargument could rest on the many cases indicating that searching for information in national security cases is a "special need." Perhaps you could say that this line of cases makes the reasonableness inquiry different in the context of Section 215 orders to try to stop terror attacks than it would be in the case of a routine administrative agency subpoena issued to investigate regulatory compliance and the like. That's a possible argument, too. A final counterargument would go to the assumption I made earlier, that the companies are not providing the information voluntarily. This is also murky Fourth Amendment ground. In general, subpoenas are enforced only when the recipient objects. There is no public sign that the companies have objected to the Section 215 orders. Further, as I recall the history that has been disclosed, the telcos originally were voluntarily disclosing the records but then asked for orders to be issued as a CYA move (triggering statutory good faith standards, for example) when the program was revealed in 2006. I'm not sure how that plays out: Do you analyze the Fourth Amendment question by assuming that the telcos objected, or

12

do you not get to the Fourth Amendment issues because the telcos actually are playing along? Off the top of my head, I'm not totally sure.

IV. CONCLUSION

Anyway, that's my tentative take. In light of recent experience with comment threads on posts about the NSA, I think it's best to decline to open the post for comments. I've been frustrated to see that recent threads have too often become fora for venting by the angry and uninformed, and there's enough such commenting around the Internet that I don't feel the need to add more of that here. But I did want to offer my take on the questions for interested readers.

13

14

WHY NSA'S BULK DATA SEIZURES ARE ILLEGAL AND UNCONSTITUTIONAL Randy E. Barnett∗ and Jim Harper∗∗

October 21, 2013 Reprinted with permission from The Federalist Society for Law & Public Policy Studies

Introduction

The National Security Agency's ("NSA") data collection program, designed and built to collect information about every American's telephone calls, stands on weak statutory footing and raises grave concerns under the Fourth and Fifth Amendments. If Congress does not revisit these programs, the courts should invalidate them. I. The NSA Data Collection Program is Inconsistent with the Plain Meaning of the Statute and Congressional Intent Passing It Section 215 of the USA-PATRIOT Act1 allows Foreign Intelligence and Surveillance Act judges ("FISA") to issue orders requiring the production of tangible things upon satisfactory application by the FBI. The statutory language2 requires an investigation in existence at the time such a judge issues a Section 215 order. Because the NSA's Section 215 orders do not pertain to an existing investigation, they are not authorized by the statute. Section (b) of 50 U.S.C. §1861 specifies that an application for a Section 215 order must include "a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation . . . ."3 In two ways, this language requires an investigation to pre-exist any such application. First, the required statement of facts must show that the things sought "are relevant"4 to an investigation. It thus requires a showing at the time of application that the things sought are relevant to an investigation. This standard presumes and requires the existence of an investigation in progress at the time of application. Second, the statement of facts required by 50 U.S.C. §1861(b)(2)(A) must show that the application is relevant to an "authorized" investigation. It is impossible to determine that

∗ Carmack Waterhouse Professor of Legal Theory, Georgetown University Law Center; Director, Georgetown Center for the Constitution. This essay was adapted from the Brief for Cato Institute as Amicus Curiae Supporting Petitioner, In re: Electronic Privacy Information Center, No. 13-58 (U.S. Aug. 12, 2013). We thank Jason Kestecher and Elizabeth Gusfa for their research assistance. ∗∗ Director of Information Policy Studies, Cato Institute. 1 Pub. L. No. 107-56, 115 Stat. 272. 2 50 U.S.C. §1861. 3 50 U.S.C. §1861(b)(2)(A). 4 Id.

15

an investigation is or will be "authorized" if the investigation has not come into existence. Therefore, a FISA judge cannot properly conclude that a future investigation, including investigations arising from analyzing the seized data, met the standards of the statute. Because the NSA's Section 215 orders do not pertain to existing authorized investigations, they violate the plain language of the statute. In passing Section 215, Congress did not intend to create authority for collection of information beyond that which is relevant to an existing investigation. Report language accompanying a precursor of Section 215, clarifies Congress's purposes:

The Administration had sought administrative subpoena authority without having to go to court. Instead, section 156 amends title 50 U.S.C. §1861 by providing for an application to the FISA court for an order directing the production of tangible items such as books, records, papers, documents and other items upon certification to the court that the records sought are relevant to an ongoing foreign intelligence investigation.5

By its choice of language, Congress did not intend to allow applications with merely potential relevance to foreign intelligence generally. Instead it intended to restrict them to existing, discrete, "ongoing" investigations, not applications for general surveillance. II. The NSA's Section 215 Bulk Data Collection Orders are Unconstitutional A. Blanket Data Seizures Are Modern Day General Warrants The Fourth Amendment has two parts: First, "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated."6 And second, "no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."7 The Fourth Amendment was adopted to prevent general or nonspecific warrants. The Fourth Amendment requires the things to be searched or seized under a warrant to be described "particularly."8 But the order issued to Verizon under the NSA data collection program requires the company to produce "on an ongoing daily basis … all call detail records."9 Because they are not "particular," such orders are the modern incarnation of the "general warrants" issued by the Crown to authorize searches of American colonists. As with general warrants, blanket seizure programs subject the private papers of innocent people to the risk of searches and exposure, without their knowledge and with no realistic prospect of a remedy.

5 H.R. Rep. No. 107-236, pt. 1, at 61 (2001) (emphasis in original). 6 U.S. Const. amend. IV. 7 Id. (emphasis added). 8 Id. 9 In re: Application of the Federal Bureau of Investigation for an Order Requiring the Production of Tangible Things from (FISC) (Docket No. BR 13-80) (April 25, 2013), at 3.

16

The Founders thought that the seizure of "papers" for later perusal or "searching" was an abuse distinct from, but equivalent to, the use of general search warrants, which is why "papers" was included in the Fourth Amendment in addition to "effects" or personal property.10 [A]t the heart of Whig opposition to seizing papers was the belief that any search of papers, even for a specific criminal item, was a general search. It followed that any warrant to sift through documents is a general warrant, even if it is specific to the location of the trove and the item to be seized.11 Allowing blanket seizures of privately-held data would constitute an unprecedented legal and constitutional sea change that should be undertaken, if at all, only after robust public debate and a constitutional amendment that is itself worded specifically enough to govern the executive branch in the future. It is not a policy that should emerge from an advisory panel of judges to which the People are not privy. B. Property and Contract Define When a Seizure Requires a Warrant For good reason, the Fourth Amendment uses a possessive pronoun – "their" – to describe the "persons, houses, papers, and effects" it protects.12 People's ownership of themselves and their things is an essential counterweight to state power. The Fourth Amendment has long and appropriately been administered with reference to property. Two terms ago, in United States v. Jones,13 the Supreme Court held that the "reasonable expectation of privacy" formulation from Katz v. United States14 does not supplant, but adds protection beyond the protection of one's property from unreasonable searches and seizures. "[T]he Katz reasonable-expectation-of-privacy test," wrote Justice Scalia, "has been added to, not substituted for, the common-law trespassory test."15 While Katz has become the lodestar in current Fourth Amendment jurisprudence, the "reasonable expectations" language that now dominates the academic literature and case law actually appears, not in the majority opinion of the Court, but in a solo-

10 See generally Donald A. Dripps, "Dearest Property: Digital Evidence and the History of Private "Papers" as Special Objects of Search and Seizure," 103 J. Crim. L. & Criminology 49 (2013) (explaining how the seizure of papers to be later searched for evidence of criminality was considered to be a distinct but equally disturbing abuse than that of general warrants to search houses). 11 Id. at 104. 12 U.S. Const. amend. IV. 13 132 S.Ct. 945 (2012). 14 Katz v. United States, 389 U.S. 347 (1967). 15 Jones, 132 S.Ct. at 952. See also id. at 954-55, (Sotomayor, J. concurring) ("Of course, the Fourth Amendment is not concerned only with trespassory intrusions on property. Rather, even in the absence of a trespass, a Fourth Amendment search occurs when the government violates a subjective expectation of privacy that society recognizes as reasonable." (quotations and citations omitted)).

17

concurrence by Justice Harlan. Harlan's formulation has proven to be a weak rule for deciding cases. As Justice Alito observed in Jones, the "Katz expectation-of-privacy test . . . involves a degree of circularity, and judges are apt to confuse their own expectations of privacy with those of the hypothetical reasonable person to which the Katz test looks."16 In addition, "the Katz test rests on the assumption that this hypothetical reasonable person has a well-developed and stable set of privacy expectations."17 The "reasonable expectation of privacy" test reverses the inquiry required by the Fourth Amendment. Justice Stewart's majority opinion in Katz properly rested on the physical protection that the defendant had given to his oral communications. "What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected."18 What Katz sought to exclude when he entered the booth was not the intruding eye – it was the uninvited ear. He did not shed his right to do so simply because he made his calls from a place where he might be seen. No less than an individual in a business office, in a friend's apartment, or in a taxicab, a person in a telephone booth may rely upon the protection of the Fourth Amendment. One who occupies it, shuts the door behind him, and pays the toll that permits him to place a call is surely entitled to assume that the words he utters into the mouthpiece will not be broadcast to the world.19 Rather than airy and untethered speculations about "reasonable expectations," the courts should return to the traditional – and more readily administrable – property and contract rights focus of Fourth Amendment protection reflected in the majority opinion in Katz. Courts should examine how parallels to the walls of the home and the phone booth in Katz conceal digital information are employed by the people to preserve their privacy. An inquiry into the physical and legal barriers people have placed around their information – for example, by using passwords to restrict access to their email, or entering into terms of service agreements that include privacy protections – can generally answer whether they have held it close. This establishes the threshold of personal security that the Fourth Amendment requires a warrant to cross. No distinction should be made between sealing a letter before handing it to the postman, taking a phone call in a secluded phone booth, password-protecting one's email, or selecting a communications company with a suitable privacy policy. In short, the physical and legal barriers people place around their information define both their actual and "reasonable" expectations of privacy and should provide the doctrinal touchstone of the search warrant requirement. When one has arranged one's affairs using physics and the law of property and contract to conceal information from preying eyes, government agents may not use surreptitious means and outré technologies like thermal imaging20 to defeat those arrangements without obtaining a warrant that

16 Id. at 962 (Alito, J. concurring) (citations omitted). 17 Id. 18 Katz, 389 U.S. at 351 (emphasis added). 19 Id. at 352 (emphasis added). 20 See Kyllo v. United States, 533 U.S. 27 (2001).

18

conforms to the requirement of the Fourth Amendment. In Jones, the Court took an important step in this direction. It should now recognize the privacy of informational data that has in fact, in the words of the Fourth Amendment, been "secure[d]" by sufficient physical and legal protections. With this in mind, the Court should either adapt the third-party doctrine to modern circumstances or reject it altogether. Smith v. Maryland,21 which upheld the use of pen registers without a warrant, was a classic "reasonable expectation of privacy" case, and a paragon of its maladministration. Common experience shows that phone companies keep phone data private from everyone but the customer and a small circle of service providers that are bound to the phone companies' privacy rules. The public "reasonably expects" these records are kept from government agencies absent a warrant and consents to disclose this information to phone companies on that condition. Some members of the Supreme Court have already recognized Smith's poor reasoning and its irreconcilability with the Information Age. As Justice Sotomayor noted in Jones, the third-party doctrine "is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks."22 With the NSA's program of "pen registers for everyone," yesterday's tomorrow has already arrived. Smith v. Maryland and a third-party doctrine permitting blanket seizures of data that has been disclosed to a third party under contractual and regulatory restrictions is patently inapt for the age of mass storage of data accessed in secret by super computers. III. The FISA Court is Inconsistent with the Due Process of Law The procedures established by the Foreign Intelligence Surveillance Act do not provide communications companies and their customers the "due process of law" required by the Fifth Amendment. In contrast to the typical adjudication of a search warrant's validity, the constitutionality of a massive program of data seizure is being adjudicated in secret. No targeted customer has the right to intervene and contest the case, nor even to read the decision purporting to uphold the constitutionality of the seizure of its data. In the seminal case on the role of federal courts, the Supreme Court ruled: "A case or controversy, in order that the judicial power of the United States may be exercised thereon, implies the existence of present or possible adverse parties whose contentions are submitted to the court for adjudication."23 The absence of a genuine "case or controvery"[sic] means that the FISA Court is not a genuine Article III court, but is instead simply a part of the executive branch. The deprivation of property by such a court in secret proceedings justified by secret orders and constitutional rulings is the antithesis of the Due Process of Law guaranteed by the Fifth Amendment.

21 Smith v. Maryland, 442 U.S. 735 (1979). 22 Jones, 132 S.Ct. at 957 (Sotomayor, J., concurring) (citation omitted). 23 Muskrat v. United States, 219 U.S. 346 (1911) (citing Chisholm v. Georgia, 2 U.S. (2 Dall.) 419, 431 (1793)).

19

Conclusion In a republican form of government based on popular sovereignty, the people are the principals or masters and those in government are their agents or servants. For the people to control their servants, they must know what their servants are doing. The secrecy of these programs, and the proceedings by which their constitutionality is assessed, make it impossible to hold elected officials and appointed bureaucrats accountable. Internal governmental checks, and even secret congressional oversight, are no substitute for the sovereign people being the ultimate judge of their servants' conduct in office. Such judgment and control is impossible without the information that secret programs conceal. Without the recent leaks, the American public would have no idea of the existence of these programs, and it still cannot be certain of their scope. What we do know reveals that these programs are contrary to statute, and unconstitutional under any theory. The American people need relief from this unprecedented surveillance of them by their servants.

20

OPINIONS: NSA SURVEILLANCE MAY BE LEGAL – BUT IT'S UNCONSTITUTIONAL

Laura K. Donohue Reprinted with permission from the Washington Post, June 21, 2013

Laura K. Donohue is a professor at Georgetown University Law Center and director of Georgetown's Center on National Security and the Law. The National Security Agency's recently revealed surveillance programs undermine the purpose of the Foreign Intelligence Surveillance Act, which was established to prevent this kind of overreach. They violate the Fourth Amendment's guarantee against unreasonable search and seizure. And they underscore the dangers of growing executive power. The intelligence community has a history of overreaching in the name of national security. In the mid-1970s, it came to light that, since the 1940s, the NSA had been collecting international telegraphic traffic from companies, in the process obtaining millions of Americans' telegrams that were unrelated to foreign targets. From 1940 to 1973, the CIA and the FBI engaged in covert mail-opening programs that violated laws prohibiting the interception or opening of mail. The agencies also conducted warrantless "surreptitious entries," breaking into targets' offices and homes to photocopy or steal business records and personal documents. The Army Security Agency intercepted domestic radio communications. And the Army's CONUS program placed more than 100,000 people under surveillance, including lawmakers and civil rights leaders. After an extensive investigation of the agencies' actions, Congress passed the 1978 Foreign Intelligence Surveillance Act (FISA) to limit sweeping collection of intelligence and create rigorous oversight. But thirty-five years later, the NSA is using this law and its subsequent amendments as legal grounds to run even more invasive programs than those that gave rise to the statute. We've learned that in April, the Foreign Intelligence Surveillance Court (FISC) ordered Verizon to provide information on calls made by each subscriber over a three-month period. Over the past seven years, similar orders have been served continuously on AT&T, Sprint and other telecommunications providers. Another program, PRISM, disclosed by the Guardian and The Washington Post, allows the NSA and the FBI to obtain online data including e-mails, photographs, documents and connection logs. The information that can be assembled about any one person – much less organizations, social networks and entire communities – is staggering: What we do, think and believe. The government defends the programs' legality, saying they comply with FISA and its amendments. It may be right, but only because FISA has ceased to provide a meaningful constraint. Under the traditional FISA, if the government wants to conduct electronic surveillance, it must make a classified application to a special court, identifying or describing the target.

21

It must demonstrate probable cause that the target is a foreign power or an agent thereof, and that the facilities to be monitored will be used by the target. In 2008, Congress added section 702 to the statute, allowing the government to use electronic surveillance to collect foreign intelligence on non-U.S. persons it reasonably believes are abroad, without a court order for each target. A U.S. citizen may not intentionally be targeted. To the extent that the FISC sanctioned PRISM, it may be consistent with the law. But it is disingenuous to suggest that millions of Americans' e-mails, photographs and documents are "incidental" to an investigation targeting foreigners overseas. The telephony metadata program raises similar concerns. FISA did not originally envision the government accessing records. Following the 1995 Oklahoma City bombing, Congress allowed applications for obtaining records from certain kinds of businesses. In 2001, lawmakers further expanded FISA to give the government access to any business or personal records. Under section 215 of the Patriot Act, the government no longer has to prove that the target is a foreign power. It need only state that the records are sought as part of an investigation to protect against terrorism or clandestine intelligence. This means that FISA can now be used to gather records concerning individuals who are neither the target of any investigation nor an agent of a foreign power. Entire databases — such as telephony metadata — can be obtained, as long as an authorized investigation exists. Congress didn't pass Section 215 to allow for the wholesale collection of information. As Rep. F. James Sensenbrenner Jr. (R-Wis.), who helped draft the statute, wrote in the Guardian: "Congress intended to allow the intelligence communities to access targeted information for specific investigations. How can every call that every American makes or receives be relevant to a specific investigation?" As a constitutional matter, the Supreme Court has long held that, where an individual has a reasonable expectation of privacy, search and seizure may occur only once the government has obtained a warrant, supported by probable cause and issued by a judge. The warrant must specify the places to be searched and items to be seized. There are exceptions to the warrant requirement. In 1979 the court held that the use of a pen register to record numbers dialed from someone's home was not a search. The court suggested that people who disclose their communications to others assume the risk that law enforcement may obtain the information. More than three decades later, digitization and the explosion of social-network technology have changed the calculus. In the ordinary course of life, third parties obtain massive amounts of information about us that, when analyzed, have much deeper implications for our privacy than before. As for Section 702 of FISA, the Supreme Court has held that the Fourth Amendment does not protect foreigners from searches conducted abroad. But it has never recognized a foreign intelligence exception to the warrant requirement when foreign-targeted searches result in the collection of vast stores of citizens' communications.

22

Americans reasonably expect that their movements, communications and decisions will not be recorded and analyzed by the government. A majority of the Supreme Court seems to agree. Last year, the court considered a case involving twenty-eight-day GPS surveillance. Justice Samuel Alito suggested that in most criminal investigations, long-term monitoring "impinges on expectations of privacy." Justice Sonia Sotomayor recognized that following a person's movements "reflects a wealth of detail about her familial, political, professional, religious, and sexual associations." The FISC is supposed to operate as a check. But it is a secret court, notorious for its low rate of denial. From 1979 to 2002, it did not reject a single application. Over the past five years, out of nearly 8,600 applications, only two have been denied. Congress has an opportunity to create more effective checks on executive power. It could withdraw Sections 215 and 702 and introduce new measures to regulate intelligence collection and analysis. There are many options. James Madison put it best: "In framing a government which is to be administered by men over men, the great difficulty lies in this: you must first enable the government to control the governed; and in the next place oblige it to control itself."

23

24

NOTES

25

26