Leahy Introduces NSA Reform Bill

By Spencer Ackerman, Guardian UK

30 July 14

Patrick Leahy’s popular bill contains stricter privacy measures than the USA Freedom Act, which the House passed in May

surveillance reform bill backed by the Obama administration was introduced in the Senate on Tuesday, raising the possibility that Congress could this year take the National Security Agency out of the business of collecting and storing all US phone data.

Introduced by Senator Patrick Leahy, the bill is a counterpart to the USA Freedom Act, which the House of Representatives passed in May, but contains some stricter privacy measures and broader transparency requirements – the absence of which caused civil libertarians, privacy groups and technology firms to abandon their support for the House version. Many of them are backing Leahy’s bill.

The question underlying the legislation is “whether we are in control of our own government or the other way around,” Leahy, the chairman of the Senate judiciary committee, said on the Senate floor.

Warning that the legislative calendar will make passing reform this year difficult, Leahy said he wants to take the bill directly to the Senate floor. His 13 co-sponsors include Republicans Ted Cruz, Dean Heller and Mike Lee, who on the floor said the “broad-based bipartisan” bill “is absolutely necessary.”

Leahy’s bill, like the House’s, would still provide the NSA with access to enormous amounts of American phone data. Though it would require a judge to issue an order to telecos for “call detail records” based on a “reasonable, articulable suspicion” of association with terrorism or a foreign power, the NSA will be able to use that single order to obtain the “call detail records” of a suspicious entity, as well as those of entities in “direct connection” with it and entities in connection with those.

While that would permit the NSA to yield thousands of records off of a single court order, on a daily basis for six months, the NSA and the bill’s architects contend that it bans “bulk collection.”

Leahy’s bill would go further than the House version in narrowing the critical definition of “specific selection term,” a foundational aspect of the bill defining what the government can collect. The House definition is a “term specifically identifying a person, entity, account, address, or device,” which privacy groups have lambasted as unreasonably broad.

Seeking to plug that loophole, Leahy would prevent the NSA or the FBI from accessing a service provider’s entire clientele or a wholesale “city, state, zip code, or area code.”

Although the Leahy bill has the support of several civil libertarian groups and major tech firms like Facebook and Google, it does not revive some privacy proposals that those organizations considered crucial but the intelligence agencies and their advocates in Congress stripped from the House measure.

Leahy’s bill would not ban the NSA from warrantlessly accessing Americans’ communications information collected in its ostensibly foreign-focused dragnets, something civil libertarians call the “backdoor search loophole.” The NSA considers its ability to conduct those searches more important than collecting all US phone data.

Instead, the Leahy bill’s disclosure requirements instruct the director of national intelligence to annually reveal “the number of search terms that included information concerning a United States person that were used to query any database of the contents of electronic communications or wire communications” as well as the total number of searches. But the bill, as first noted by journalist Marcy Wheeler, continues a practice of exempting the FBI from even noting that it has performed such searches.

The NSA recently disclosed that it searched for 198 “identifiers” of Americans’ data within the troves in 2013, something the CIA and FBI can also access. In June, the House voted to forbid the warrantless searches.

Relatedly, the Senate version of the USA Freedom Act bans the government from using in court communications data collected warrantlessly, something the Justice Department has begun informing defendants it is doing.

Democratic senators Ron Wyden and Mark Udall, the intelligence committee’s leading civil libertarians, praised Leahy’s bill but said it needed to go further to protect Americans from the warrantless searches.

“Congress needs to close this loophole, and we look forward to working with Chairman Leahy and our colleagues to address this issue when the bill comes before the full U.S. Senate,” the two senators said in a joint statement.

The Senate version of the Freedom Act would also create a stronger privacy advocate for the secret Fisa Court, which currently only hears the government’s perspective before issuing the records orders. The House voted for an ad hoc advocate for cases involving “a novel or significant interpretation of the law,” although Fisa judges could determine its presence is unnecessary in a specific case.

Leahy’s bill instead would create a standing panel of special advocates before the court – one which will not necessarily participate in each case the court hears – and allow the Privacy and Civil Liberties Oversight Board, the government’s official privacy watchdog, to aid in its empanelment.

As well, Leahy’s version would provide for greater transparency by companies subjected to national-security records orders, another priority for civil libertarians.

Yet Leahy’s bill, like its House counterpart, grants legal immunity and financial compensation to service providers complying with surveillance orders. Like the House bill, it does not provide any additional privacy protections to non-Americans.

The bill faces an uncertain future in the Senate. The intelligence committee in June showed itself to be an outpost of opposition even to the House version of the Freedom Act that lacked Leahy’s privacy provisions. The calendar is also an obstacle: the Senate leaves on Friday for its August recess, only to reconvene in the height of the midterm election season.

Without action ahead of the expiration of the legislative session in December, NSA reformers would have to go back to square one in the next Congress, leaving the NSA with practically all of its pre-Snowden powers, absent some restrictions President Obama ordered in January.

“We’re running short on time in this Congress,” Leahy said.

The introduction of Leahy’s bill was greeted warmly but measuredly by privacy advocates and tech firms disappointed by the House version.

Mozilla’s privacy chief, Alex Fowler, said: “We’re pleased to see the Senate propose limits on mass surveillance but more reform is needed to repair the damage inflicted on Internet users and the Web economy. We hope the Senate will hold firm to the bill’s language and forgo loopholes that would further undermine trust, such as allowing bulk collection through broad ‘selector terms’ that sidestep the problem.”

Microsoft’s top lawyer said the bill “strengthens our privacy rights and our civil liberties.”

Amie Stepanovich, a lawyer with the digital rights group Access, which is supporting the bill, urged Congress to “immediately turn to Section 702” after the Leahy bill, a reference to the 2008 amendments to the Foreign Intelligence Surveillance Act – the wellspring of NSA’s foreign digital dragnets, the collection of Americans’ international communications and the backdoor-search loophole.

Congress should “pass comprehensive reform which limits [section 702’s] scope and ensures that the US government isn’t sweeping up the communications of millions of innocent users. In addition, the administration needs to focus on ending massive surveillance programs under Executive Order 12333, which the intelligence community unilaterally executes without any court or congressional oversight,” Stepanovich said.