The NSA Documents, Part II: The October 2011 FISC Opinion

The document that will surely capture the lion’s share of the public’s attention---and rightly so---is the October 3, 2011 FISC opinion by Judge John D. Bates, then the presiding judge of the FISC. This 81-page opinion, along with its accompanying order, finds certain aspects of NSA’s collection under Section 702 to be “deficient on statutory and constitutional grounds.” Judge Bates also expresses concern about the accuracy of a series of government representations to the court. He finds that the NSA collection was, while not targeting Americans, capturing a large number---tens of thousands---of email communications per year that were either purely domestic or that involved U.S. persons whose communications were not of foreign intelligence value. And he orders the deficiencies corrected within 30 days, or the government must cease the particular form of collection in question.

This is, to put it simply, the ugly part of the story. But it’s actually an ugliness with some redeeming features---features that make the document particularly interesting.

For starters, Judge Bates became aware of the problem because the government itself brought it to his attention. And their dialog over the subject offers a window into just how robust actual FISC oversight of intelligence operations really is.

The issue arose in the context of a government application for reauthorization of 702 collection. After filing this application, the government---on May 2, 2011---wrote a letter of “clarification” describing how certain “upstream collection” of internet communications included what are called “transactions.” Upstream collection refers to collection by tapping the U.S. data pipeline, rather than by collecting from internet service providers. And “transactions,” as Judge Bates explains, “may contain a single, discrete communication, or multiple discrete communications, including communications that are neither to, from, nor about targeted facilities.” While it’s not entirely clear what a “transaction” is, think of it as a communications package---say, a snapshot of someone’s email inbox---in which the individual communications come bound together. While they can later be separated and disaggregated, the NSA cannot capture them separately. Moreover, these “transactions” turn out sometimes to include both purely domestic communications and communications involving U.S. persons not of foreign intelligence interest.

This disclosure by the government led to a months-long back-and-forth between the government and the court. From May through September, the government provided answers to the court’s questions about this form of collection. There were written submissions and meetings between the court staff and the Justice Department. There was a hearing. There were extensions of time so the government could answer questions fully. And at the end of this process, Judge Bates okayed most of what the government was seeking, but he also had problems.

For one thing, he clearly felt caught off guard that his court had permitted prior certifications without understanding the full parameters of the NSA’s collection and its implications for the privacy of Americans. He writes in a footnote that he “is troubled” that this incident “marks the third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection program.” His choice of words here is interesting. He gives the government credit for disclosing its error, but the error itself he describes as a “substantial misrepresentation.” The rest of the footnote has harsh words about the previous incidents, which include “misrepresentation” about the use of captured telephone metadata.

Then there’s the scope of the collection itself---which is a bit hard to pin down. As a percentage matter, it’s miniscule. Judge Bates notes that all of upstream collection itself only constitutes nine percent of the the 250 million internet communications the NSA acquires each year. The number of domestic and U.S. person communications trapped in “transactions” within upstream collection is far smaller than that. But as Judge Bates notes, the absolute number is not small. While the dialog with the government produced only estimates as to the number, it is likely in the tens of thousands per year, and “tens of thousands of non-target, protected communications annually is a very large number.”

For Judge Bates, the collection is significant for a number of reasons. It involves a unique capability for acquiring certain types of communications, which contain very valuable foreign intelligence, he writes. But to collect those targeted internet communications, NSA’s upstream collection devices inevitably have to acquire large numbers of privacy-invading internet transactions too. And the NSA is technologically unable to exclude certain internet transactions from its upstream collection---thus making it unable to avoid capturing communications involving a U.S. person and purely domestic communications some of the time. This renders, in Judge Bates's view, the court’s previous understanding of the parameters of 702 collection vis a vis U.S. persons moot and requires a new legal analysis.

In the end, Judge Bates finds a few related problems with the collection program. In particular, he finds that the the NSA’s minimization procedures were not consistent with the FISA statute. To be clear, he does not object in principle to the collection of multi-communication transactions. This, he agrees, is inevitable given the technology---and justified. But he finds the minimization procedures the NSA was proposing lacking in key respects. The government had, in essence, proposed that upstream acquisition of this type of transmission would be retained until accessed by an NSA analyst. When an analyst sought a particular communication from the transaction, he or she would make an assessment as to whether it is to, from, or about a legitimate subject. If not, and if the communication is to or from an identifiable U.S. person, that communication “cannot be used for any purpose other than to protect against an immediate threat to human life.” If the communication is wholly domestic, the entire transaction would be purged entirely from NSA’s systems.

In Judge Bates’s view, “The principal problem with the government’s proposed handling of [transactions] relates to what will occur, and what will not occur, following acquisition.” Specifically, “If an analyst decides that he or she does not wish to use any discrete communication contained therein, the analyst is not obligated to do anything unless it is immediately apparent to him or her that the [transaction] contains a wholly domestic communication.” Thus,

thousands of wholly domestic communications (those that are never reviewed and those that are not recognized by analysts as being wholly domestic), and thousands of other discrete communications that are not to or from a targeted selector but that are to, from, or concerning a United States person, will be retained by NSA for at least five years, despite the fact that they have no direct connection to a targeted selector and, therefore, are unlikely to contain foreign intelligence information.

There are ways the government could fix this problem, he writes, and by not fully exploring these options, “the government has failed to demonstrate that it has struck a reasonable balance [as the statute requires] between its foreign intelligence needs and the requirement that information concerning United States persons be protected.”

Moreover, Judge Bates contended, both the targeting and minimization procedures have Fourth Amendment problems too:

NSA’s collection of [transactions] results in the acquisition of a very large number of Fourth Amendment-protected communications that have no direct connection to any targeted facility and thus do not serve the national security needs underlying the Section 702 collection as a whole. . . . NSA’s proposed handling of [transactions] tends to maximize retention of such information and hence to enhance the risk that it will be used and disseminated.

While Judge Bates agrees that no warrant is necessary for this sort of collection, the collection fails the more basic reasonableness inquiry, in his view.

The Fourth Amendment reasonableness inquiry requires a balancing test: a court must consider the nature and implementation of the intrusion: “The more important the government’s interests, the greater the intrusion that may be constitutionally tolerated,” he writes. While Judge Bates acknowledges the power of the government’s interest in the collection, he finds the scale of the incidental acquisition large and distinguishes between past incidental acquisitions and the ones at issue in this program insofar as “the communications of concern here are acquired simply because they appear somewhere in the same transaction as a separate communication that is to, from, or about the targeted facility.” The national security need for acquiring, retaining, and disseminating discrete communications as to which the user of the targeted facility is a party or in which the targeted facility is mentioned is much higher than it is for information that is acquired “simply because it happens to be within the same transaction as a communication involving a targeted facility.” So under the totality of the circumstances, Judge Bates finds the program violates the Fourth Amendment---and he orders the government either to remediate it quickly or to cease it altogether.

This brings us to the government’s response to the opinion and order.