The NSA on Trial

By David Cole, The New York Review of Books

23 December 13

ver since Edward Snowden's revelation that the National Security Agency was collecting and storing data on every phone call every American makes and every text every American sends, the Obama administration has maintained that the program is fully lawful, and that it has been approved repeatedly by all three branches of government. This defense has always been misleading. Since the program was developed, approved, and applied in secret, it had never been subject to public scrutiny or adversarial judicial testing. Now it has, and it has failed dramatically. As of this week, all three branches have called for substantial reforms of the program, and a federal judge has seriously questioned its constitutionality.

On Monday, US District Judge Richard Leon, an appointee of George W. Bush, ruled that the NSA's program "almost certainly" violates the Fourth Amendment, and issued a preliminary injunction against the program. In the judge's words:

I cannot imagine a more "indiscriminate" and "arbitrary invasion" than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying and analyzing it without prior judicial approval... I have little doubt that the author of our Constitution, James Madison, who cautioned us to beware "the abridgement of freedom of the people by gradual and silent encroachments by those in power," would be aghast.

Because of what he called "the significant national security interests at stake...and the novelty of the constitutional issues," Judge Leon stayed his injunction pending the inevitable appeal. But his decision marks the beginning of what will be a long and historic struggle over whether the NSA's program is indeed legal.

Judge Leon's decision is important for at least two reasons. First, it shows the inadequacy of the secret, one-sided review that has until now been the NSA program's only oversight. From 2006 to 2013, fifteen different judges on the secret Foreign Intelligence Surveillance Court reviewed the program and every one of them deemed it lawful. But they did so in proceedings closed to the public, and in which they heard from no one representing the hundreds of millions of Americans whose privacy is at stake. Now that the program has been disclosed and subjected for the first time to public adversarial testing, it has been declared unconstitutional. Secret, one-sided proceedings are rarely a good way to decide fundamental issues of constitutional rights.

The government went to extraordinary lengths to keep the program under wraps. In March 2013, the Director of National Intelligence, James Clapper, was asked under oath by Senator Ron Wyden if the government was collecting data on millions of Americans. He said, "No." When Snowden's June 2013 disclosure showed that indeed the NSA was doing just that, Clapper said his response was the "least untruthful" response he could muster. But of course, two more truthful answers were available: "yes" or "I cannot confirm or deny." The real truth is that the government was willing to lie to Congress and the American people to keep what it was doing secret.

Now that the secret is out, the program's validity and wisdom been deeply questioned. Underscoring the problem of secrecy, Representative Jim Sensenbrenner, the lead author of the Patriot Act provision on which the government has relied for the NSA, said that the scope of the program goes far beyond anything he ever imagined he was authorizing. He and Senator Pat Leahy have introduced a bill in Congress to rein in the NSA program-and theirs is one of about thirty such pending bills. When the program was secret, Congress repeatedly reauthorized this Patriot Act provision. Now that Congress knows how the NSA has been using or abusing its authority, there are widespread calls for reform.

The executive branch, too, has been prompted to consider reforms now that the NSA's electronic surveillance is out in the open. President Obama appointed a commission of constitutional and security experts to review the program, and on Wednesday that commission issued a report of more than three-hundred pages calling for a slew of reforms. The five-member panel has urged the president to end the NSA's dragnet collection of phone records and to require that searches of phone records maintained by the phone companies be preceded by a court order. They have also called for extending legal protections to foreigners' privacy that we insist on for ourselves, and for an end to the NSA's efforts to undermine encryption programs. Whether or not the president adopts any of these recommendations, we can be certain that none would have been forthcoming if the program not been exposed. There's a reason a democracy demands transparency, as the reactions to the NSA program in all three branches of government have made clear.

But the second and even more important aspect of Judge Leon's opinion is its recognition that the Fourth Amendment needs to adapt to the digital age. The government's principal defense of the NSA program rests almost entirely on an analog-era 1979 Supreme Court precedent, Smith v. Maryland, in which the Court ruled that the Fourth Amendment does not restrict the government's ability to obtain an individual's "pen register" phone records-namely, billing information about who the individual called, when, and for how long. These records, the Court reasoned, are shared with the phone company in the ordinary course of its business, and therefore anyone who uses a phone cannot reasonably expect that such information is private. Thus, the Court ruled, the government can obtain that information-though not the contents of a telephone call-without having to satisfy the usual Fourth Amendment requirements of probable cause and a warrant.

The FISA court judges who previously approved the NSA program in secret accepted Smith as disposing of the Fourth Amendment issue. If Smith had no expectation of privacy in his phone records, why should 300 million Americans today have any expectation of privacy in theirs? Judge Leon did not accept that logic, however. He reasoned that there is a world of difference between what could be done with phone records in the late 1970s and what can be done today: Instead of obtaining such records for a limited time on a single person, the government now has the ability to indiscriminately collect them-along with many other forms of electronic data that did not exist in 1979-on every American. What's more, it maintains them for five years, and searches through them without prior judicial approval of any particular search. Judge Leon showed that under the NSA's rules, a single search of this database can easily involve the review of one million phone numbers of innocent Americans. (I explain the NSA's misleading math here.)

We may not reasonably expect to keep private the fact of a particular phone call, or even a set of phone calls over a short time period, given the phone company's knowledge of them. But we can reasonably expect that the sum total of our phone activity over five years is private. Phone companies do not generally keep call record data for more than a few months, and make no effort to search through our data to reveal our intimate associations.

In his reasoning, Judge Leon looked to the Supreme Court, which engaged in similar analysis in 2012 in assessing whether the use of a GPS to monitor the public travel of a car around the clock for a month violated the Fourth Amendment. In United States v. Jones, the government argued that because one has no reasonable expectation of privacy with respect to one's travel on a public road, the Fourth Amendment did not apply at all to the use of the GPS monitor. The government relied on a 1983 decision, United States v. Knotts, which upheld the use of a beeper to track a car traveling from an airport to a house, and argued that if you have no expectation of privacy in going from point A to point B on a public road, you have no expectation of privacy in going from point A to point B to point Z for a month. The Court rejected this argument unanimously. Five justices deemed the use of the GPS monitor a search because the government trespassed on the car owner's property interests in attaching the device to the car at the outset. But five justices also concluded that the use of the monitor invaded a "reasonable expectation of privacy," because there was a qualitative difference between being followed from point A to point B, as in Knotts, and being followed around the clock for a month, as the GPS made possible.

The Supreme Court has repeatedly recognized that Fourth Amendment doctrine must evolve as technology changes. In the 1920s, the Court adjusted Fourth Amendment rules to account for the advent of the automobile, allowing searches of cars without a warrant. In 1967, it adjusted the Fourth Amendment again when confronted with wiretapping, concluding that even though a wiretap trespasses on no property interest, it invades the "reasonable expectation of privacy" of the phone caller. It further adapted the Fourth Amendment in 2001 when it ruled that the use of a thermal imaging device to infer that a person was growing marijuana in the privacy of his home constituted a search requiring a warrant. And it did so once again in 2012 in the Jones GPS monitoring case.

The reality of life in the digital age is that virtually everything you do leaves a trace that is shared with a third party-your Internet service provider, phone company, credit card company, or bank. Short of living off the grid, you don't have a choice in the matter. If you use a smartphone, you are signaling your whereabouts at all times, and sharing with your phone provider a track record of your thoughts, interests, and desires. Technological innovations have made it possible for all of this information to be collected, stored, and analyzed by computers in ways that were impossible even a decade ago. Should the mere existence of this information make it freely searchable by the NSA, without any basis for suspicion? Or should we recognize, as Judge Leon did, that the collection and search of such data infringes profound privacy interests, and that the way forward is to require the government to justify its intrusion, as the Constitution requires, on the basis of individualized suspicion of wrongdoing. Right now, the NSA records every time I text my daughter to tell her I'm out front in the school pickup line, and every time she texts back that she will be right out. And it does the same for every parent picking up every child across the nation. Can that possibly be constitutional?