Congress Has the Opportunity to Enact Meaningful Surveillance Reforms Now: Here's How.

As Congress debates reauthorization of the three Patriot Act authorities set to expire on March 15, 2020, policymakers should take this opportunity to enact significant reforms to protect Americans’ privacy and provide greater accountability and transparency around government surveillance.

The three authorities that will sunset next month are Section 215, the “lone wolf” authority, and the roving wiretap authority. Most significant among these is Section 215. When the Patriot Act swiftly passed in 2001—less than two months after the 9/11 attacks—Section 215 amended the Foreign Intelligence Surveillance Act (FISA) to broaden the government’s ability to obtain business records for foreign intelligence purposes. From 2006 through 2015, the government relied on an illegal interpretation of Section 215 to conduct bulk collection of millions of phone records showing Americans’ calling patterns.

After Edward Snowden’s 2013 disclosures revealed that the National Security Agency (NSA) was engaging in this bulk collection of Americans’ phone records, Congress aimed to end bulk collection and increase transparency through reforms in the 2015 USA Freedom Act. Since then, it has become clear that USA Freedom failed to achieve these goals.

As Congress considers reauthorization of the expiring surveillance law provisions, it is critical that they include robust reforms. OTI’s priorities include the following reforms, further explained below:

• End the Section 215 Call Detail Records program, which replaced “bulk collection” but is ineffective as a counterterrorism measure and still leads to overproduction of Americans’ personal records.
• Prohibit discriminatory surveillance based on race, ethnicity, religion, and other protected classes, and based on First Amendment-protected activities.
• Strengthen and expand the role of the “amicus” in the Foreign Intelligence Surveillance Court, to provide arguments in support of privacy and civil liberties.
• Prohibit warrantless collection of geolocation data and other sensitive location data, making clear that the Supreme Court’s decision in Carpenter v. United States applies to intelligence cases.
• Establish meaningful data retention limits.
• Strengthen transparency and oversight provisions.
• Require that notice be provided to defendants against whom Section 215 data is being used.

Ending the Call Detail Records Program

Although USA Freedom ended the NSA’s bulk collection program, reports have shown that through the replacement program—the Section 215 Call Detail Records (CDR) program—the government continued to collect massive amounts of personal information about Americans. CDRs reveal who calls whom, when, and for how long, and are the same kind of records that the NSA was collecting in bulk under the old program. Although the current CDR authority is more limited than the former bulk program, it still permits the government to collect records “two hops” away from the target individual (the calls of the person suspected of being connected to terrorism as the first hop, and all the calls of their contacts as the second hop). This captures the phone records and call patterns of far more innocent Americans in the process. In 2018, the government collected hundreds of millions of CDRs with less than a dozen targets under the program. Moreover, the program has been ineffective as a counterterrorism tool. The NSA quietly shuttered the CDR program in late 2018 due to “the program’s relative intelligence value, associated costs, and compliance and data integrity concerns.” Still, the Administration nonetheless is pushing for permanent reauthorization of the CDR authority, just in case it could ever be useful. Accordingly, as we and many organizations have argued, ending the CDR authority entirely is a “necessary first step” for any meaningful surveillance reform effort, as the program is both privacy invasive and ineffective.

Prohibiting Discriminatory and First-Amendment-Based Surveillance

Since its inception, the Patriot Act has failed to provide explicit protections against discrimination based on identity—an issue that Congress failed to rectify in prior reauthorization debates. The public has little information as to what procedures, if any, exist to prevent discriminatory surveillance using the Patriot Act authorities. And although the FBI has a history of abusing its intelligence authorities to surveil Americans based on First Amendment-protected activities, Section 215 merely prohibits surveillance based “solely” on First Amendment activities. Congress should make clear that the intelligence community has no authority to engage in unconstitutional and discriminatory practices, by explicitly prohibiting both discriminatory surveillance based on race, ethnicity, religion, and other protected classes, and targeting based on activities and speech protected under the First Amendment.

Foreign Intelligence Surveillance Court Amicus

Congress should also strengthen and expand the role of the “amici” (friends of the court) in the Foreign Intelligence Surveillance Court. The USA Freedom Act created a role for “amici” to participate in certain cases and make arguments in support of privacy and civil liberties. However, as the recent Department of Justice Inspector General’s report revealed, this role should be far more robust to ensure that the secret court hears perspectives beyond those of government attorneys. The 2014 recommendations of the bipartisan Privacy and Civil Liberties Oversight Board urged a role that was broader and stronger than the current amicus role. To carry out the PCLOB’s recommendations and to address the harms outlined in the Inspector General’s report, Congress should make three key improvements:

(1) Allow the amici to participate in a broader range of cases than simply those deemed “novel or significant,” including any case involving activities protected by the First Amendment;

(2) require that the amici get access to all government filings and supporting materials in cases in which they are appointed, and not just what the judge finds to be relevant; and

(3) create a mechanism for the amici to seek appellate review of FISC decisions.

Prohibiting Warrantless Collection of Geolocation Data

Congress should also prohibit the government from using Section 215 to obtain geolocation data and other sensitive location data. In Carpenter v. United States, the Court explained that people have a reasonable expectation of privacy for cell site location information, pointing out that “the time-stamped data provides an intimate window into a person’s life, revealing not only his particular movements, but through them his ‘familial, political, professional, religious, and sexual associations.’” While the Court in Carpenter limited its decision to the facts at hand, the same Fourth Amendment principles apply in the context of intelligence collection. Congress should use this opportunity to bar the government from warrantless collection of not only geolocation information, but any sensitive information that would require a warrant if it were collected by law enforcement agencies in the context of criminal investigations.

Establishing Meaningful Data Retention Limits

Although the government is required to establish retention limits for information collected under Section 215, those retention limits have not been made public. Additionally, we know that the government does not review and purge irrelevant information. This means that large swaths of information with no relevance to any intelligence investigation are unnecessarily retained. The Privacy and Civil Liberties Oversight Board found that in the context of calling records, a retention period of three years will minimize privacy risks while preserving the greatest intelligence value of records. Therefore, Congress should enact a three year retention limit for information collected under Section 215.

Transparency Improvements

Although the USA Freedom Act provided important transparency requirements, it left several gaps. In order to better assess the impact of FISA surveillance on Americans, we must improve transparency by requiring that certain statistics on both Section 702 and Section 215 be made public. At a minimum, it is essential that Congress require the FBI to report on the number of searches it conducts for U.S. person information in data collected under Section 702 of FISA—the FBI currently is excepted from this type of reporting. Congress should also strengthen reporting requirements under Section 215 to provide more transparency on how many Americans have their information collected under this authority. Additionally, a reform bill should include language clarifying that declassified versions of all pre-2015 Foreign Intelligence Surveillance Court (FISC) opinions must be released, in the interest of transparency. Finally, Congress should set a six-month limit for the government to declassify and release FISC opinions.

Notice

Unlike Section 702 of FISA, Section 215 does not require the government to provide notice to defendants in cases where information obtained or derived from the 215 authority is used in a criminal case. Congress should rectify this by adding a provision to 215 requiring the government to provide notice to defendants when 215 data used in a criminal context, so that defendants have the opportunity to challenge the lawfulness of such surveillance.

With the upcoming sunset date for the three surveillance law provisions quickly approaching, Congress once again has an opportunity to enact meaningful surveillance reform. Another extension of the sunsets without reforms would be irresponsible, setting a dangerous precedent for unending, unchecked surveillance authorities moving forward.