Summary: Jewel v. NSA and the Accidental Deletion of Surveillance Data

The National Security Agency made headlines last week when Politico reported that the agency had made a court filing informing a federal judge that it had accidentally deleted data related to ongoing litigation—Jewel v. NSA—in violation of a court order. The Electronic Frontier Foundation (EFF) sued the NSA in Jewel on behalf of AT&T customers in 2008. EFF alleges that certain NSA surveillance programs authorized under the Bush administration, including those targeting the contents of communication and those related to the collection of metadata, were unconstitutional. In March 2014, a federal judge in northern California issued a temporary restraining order in that case, requiring the NSA to preserve evidence related to the case.

Procedural Background

The case was initially dismissed in federal district court for lack of standing and was appealed to the Ninth Circuit Court of Appeals. The Ninth Circuit reversed the dismissal and sent the case back to the Northern District of California. To show standing at this stage, the plaintiffs need NSA data to show that their communications were collected as part of the surveillance programs they are challenging—the data that the restraining order covered.

The NSA declared in 2014 that it was complying with the order, and explained that its preservation efforts date back to an order issued in a 2007 case, In re NSA, filed against telecommunications companies. But a pair of court filings in the Jewel case, one on Oct. 5, 2017 and, more recently, on Jan. 18, 2018, stated that the 2014 declaration was not entirely accurate—some data had been accidentally deleted, and the NSA was making efforts to recover the information.

October 2017 Declaration

In the Oct. 5, 2017 filing, Elizabeth B., identified as the deputy director of the directorate of capabilities, addresses the deletions and recovery efforts. She expresses that the NSA “sincerely regrets its failure to prevent the deletion” of the data and notes that “the NSA is fully committed to making extraordinary efforts to recover the deleted data, if possible.”

According to the declaration, the data deleted was the contents of targeted international internet-based communications, believed to involve “members or Agents of al Qaeda or affiliated terrorist organizations,” which the document refers to as “PSP Internet content data” (referring to the President's Surveillance Program, the Bush administration surveillance authority that authorized the collection). According to the filing, the data was stored on an undisclosed number of magnetic tapes.

The document explains that the loss of the data is unlikely to affect the plaintiffs’ discovery requests related to standing, because existing metadata can be used to determine whether the NSA collected the plaintiffs’ internet communications from 2003 to 2007 (though the declaration notes that it is not able to find metadata collected between 2001 and 2003).

The October declaration also describes the NSA’s “extraordinary technical efforts” to recover the PSP internet-content data, saying the agency planned to identify tapes from which relevant content had been deleted, recover “as many deleted files as possible” and create preservation copies.

The October 2017 declaration further states that the NSA is engaging in an internal inquiry into the events that led to the deletion. The document also notes that the 2014 declaration, which stated that the agency had preserved the evidence on magnetic tapes and stored them in the general counsel offices, “may have been only partially accurate.” According to the filing, magnetic tapes holding evidence related to the litigation were stored in the general counsel’s offices, but those tapes contained communications metadata, not PSP internet content data.

January 2018 Declaration

The Jan. 18, 2018 declaration, made by Mark O., chief of capabilities compliance, provided the court with the following update on the agency’s recovery and preservation efforts.

A review of agency logs revealed that, in November 2011 and February through April 2016, PSP internet content data was deleted. According to the filing, the data was not targeted for deletion, but the erased PSP internet content data “matched criteria that were broadly used to delete data” of a certain type or timeframe. The NSA is looking into how the data could be accidentally deleted while the litigation was still pending, noting that archived email communications are currently being reviewed.

The document also addresses the 2014 declaration, indicating once again that it “regrettably may only have been partially accurate,” particularly with respect to the “preserving magnetic/digital tapes of the Internet content intercepted” and the statement that the NSA had “stored these tapes in the offices its General Counsel.” According to the January 2018 declaration, the NSA’s inquiry into how these inaccurate statements were made “is ongoing and [has] been inconclusive.”

The document states that several NSA components participated in identifying what information the agency had preserved. Those components included the litigation support team for the Signals Intelligence Directorate (SIDLIT). At the time the document was filed, the NSA had not identified “any records indicating OGC or SIDLIT personnel were aware of the 2011 deletion of PSP Internet Content data.”

The declaration suggests that miscommunication between SIDLIT and the general counsel’s office may have been responsible for the some misstatements in the 2014 declaration, stating that, based on interviews and documentation from 2014, they can “make a reasoned guess as to the basis of the [2014] declaration.” At the time, SIDLIT had responded to OGC questionnaires intended to “confirm the inventory of all information being preserved for purposes of this case.” SIDLIT’s questionnaire response “indicated that hardcopy results of queries of PSP intercepted content data were being maintained in ‘OGC Lit spaces,’” and a SIDLIT employee “indicated this was likely a reference to hardcopy binders of materials, not tapes, maintained in OGC spaces.” The document states there was a “reasonable possibility that personnel in OGC may have misinterpreted the SIDLIT reference to PSP Internet Content data to refer to the magnetic tapes located in OGC spaces, rather than hardcopy binders.”

The agency has completed searches of preserved metadata that show that it is still possible to determine whether the content of the plaintiffs’ online communication was collected through the PSP. The NSA has also located some preserved PSP internet content data, collected between July and November 2003.

All of the magnetic tapes that may have contained the PSP internet content data deleted in 2016 have been identified. While the agency was not able to provide a specific estimate, the declaration states that “the NSA is confident that a substantial number of the total deleted files may be recoverable.” The declaration notes, however, that files from the 2011 deletions are unlikely to be recoverable.

Next Steps

It’s hard to say how the court will respond to the NSA’s failure to comply with the preservation order, but the Jewel litigation is slated to continue. In addition to providing updates on the data deletion, the NSA’s Jan. 18 filing also asks the court for more time to respond to the plaintiffs’ discovery requests—the government’s final extension. If the court grants the extension as requested, the NSA will have until Feb. 16, 2018 to produce all evidence related to the issue of the plaintiffs’ standing, and until April 1, 2018 to provide the results of searches of preserved data. Only then will the court be able to determine whether the plaintiffs have standing.