Blog No. 24 Whither NSA Metadata: The Judges and the Report to the President (Part I).

On December 16, Judge Richard Leon of the District Court in the District of Columbia issued an opinion in which he found it likely that the collection and analysis of telephone metadata by the National Security Agency is unconstitutional (“the Leon Opinion.”) In Judge Leon’s view, the NSA system appeared to constitute a warrantless “search” in violation of the 4^th Amendment. Accordingly, he granted a preliminary injunction against the collection of such data with respect to the plaintiffs in that case (but stayed the injunction pending appeal). 

Only two days later, the advisory panel appointed by the President issued its report on the NSA’s intelligence gathering activities (“the Report”). Although the Report was wide ranging, making 45 separate recommendations, the section dealing with telephone metadata was a centerpiece that largely echoed the Leon Opinion. It drew no conclusion as to the constitutionality of the NSA program, but recommended that it be terminated with a transition to a system in which metadata would be held by the telephone companies or by an unspecified “third party.” 

Then on December 27, Judge William H. Pauley III, a federal judge in the Southern District of New York, issued an opinion upholding the legality of the metadata program and dismissing a suit by the ACLU (“the Pauley Opinion”). The conflict between the Leon and Pauley opinions will be resolved by the Circuit Courts or perhaps the Supreme Court. 

A review of the Leon and Pauley opinions and the Report leads to several conclusions. First, the Leon Opinion conflicts with controlling authority and is almost certain to be reversed. Both the Leon Opinion and the Report are seriously flawed in that they conflate the collection of data with the use of the data or the risk of its misuse. Any invasion of privacy associated with the NSA system is potential rather than experienced. 

Nevertheless, the Leon Opinion and the Report do raise open questions as to whether the NSA system is as vital as claimed and whether it justifies whatever potential risks to privacy it may create. These competing interests will have to be weighed by the Administration and Congress. However, the “solution” proposed by the Review Group, leaving metadata with the service providers or placing it with a third party, appears to be both impractical and inadequate. 

Finally, one of the most important recommendations of the Report has gone virtually unreported in the media: that the NSA take steps to improve its protection of the data it collects.

How the System Works.

In 2012, NSA queried 288 “seed phone numbers.” A seed phone number is a foreign telephone number which is certified by NSA analysts to meet a standard of a “reasonable, articulable suspicion” that it is associated with a foreign terrorist organization. The Report provided a description of how the NSA system works in practice: 

When a seed phone number is queried, NSA receives a list of every telephone number that either called or was called by the seed phone number in the past five years. This is known as the “first hop” …In most cases, NSA makes a second “hop.” That is, it queries the database to obtain a list of every phone number that called or was called by the [hypothetical] 100 numbers it obtained in the first hop. To continue with the hypothetical: If we assume that the average telephone number called or was called by 100 phone numbers over the course of the five-year period, the query will produce a list of 10,000 phone numbers (100 x 100) that are two “hops” away from the person reasonably believed to be associated with a foreign terrorist organization. If one of those 10,000 phone numbers is thought to be associated with a terrorist organization, that is potentially useful information not only with respect to the individuals related to the first and third hops, but also with respect to individuals related to the second hop (the middleman). In a very few instances, NSA makes a third “hop,” which would expand the list of numbers to approximately one million (100 x 100 x 100). 

In 2012, NSA’s 288 queries resulted in a total of twelve “tips” to the FBI that called for further investigation. If the FBI investigates a telephone number or other identifier tipped to it through the section 215 program, it must rely on other information to identify the individual subscribers of any of the numbers retrieved. If, through further investigation, the FBI is able to develop probable cause to believe that an identifier in the United States is conspiring with a person engaged in terrorist activity, it can then seek an order from the [Foreign Intelligence Surveillance Court] authorizing it to intercept the contents of future communications to and from that telephone number. 

The Report did not define the “other identifier” referred to, but it presumably is other telephone data (such as the trunk identifier). It clearly does not include the identity of parties to conversations with the seed number, let alone the identity of those with whom the second (or third) party had conversations, or the content of any conversation. 

The Leon and Pauley Opinions.

The Leon Opinion. In the case before Judge Leon, the government defended the NSA program by citing the 1979 decision of the Supreme Court in Smith v. Maryland. That case involved the installation, without a warrant, of a pen-register to record the telephone numbers called by an individual who was suspected of committing a robbery and thereafter making threatening calls to the victim. The Court held that the recording of the numbers called did not amount to a “search” in violation of the 4th Amendment. In so holding, the Court applied the rule that, where no physical intrusion is involved, there is no search unless the information falls within a “legitimate expectation of privacy.” The Court found that Smith could have had no such expectation with respect to information (the telephone numbers) that he had voluntarily furnished to a third party (the telephone company). 

Judge Leon rejected the government’s position in an opinion rather breathless in its punctuation (exclamation points) and rhetoric (“almost Orwellian”). He attempted to distinguish Smith primarily on the grounds that technology has dramatically changed and expanded since 1976. Indeed, he seemed particularly bedazzled by the proliferation and varied uses of cell phones, marveling that they could provide maps and music, serve as cameras and even become “lighters that people hold up at rock concerts.” Somewhat more to the point, the judge emphasized the nature and quantity of information that could be derived from the metadata. To that end, he quoted an observation by Justice Sotomayor in United States v. Jones with respect to data obtained from a GPS. 

The Jones case involved a GPS device, which was attached to a vehicle, beyond the limits of time and jurisdiction in a warrant and maintained for 28 days. The majority opinion by Justice Scalia relied on the physical trespass in finding a violation of the 4th Amendment. Justice Sotomayor joined the majority opinion, but added a concurrence in which she commented that “GPS monitoring generates a precise, comprehensive record of a person’s public movements that reflects a wealth of detail about her familial, political, professional, religious, and sexual associations.” While it is conceivable that telephone metadata could be mined to yield a comparable record, Judge Leon ignored a critical factor: unlike the surveillance of Mr. Jones (and even that of Mr. Smith), the mere collection of metadata, without more, does not involve the compilation of data on any identified individual. Hence, there would seem to be no plausible basis for finding a search in violation of the 4th Amendment. 

The earliest point at which the government begins to collect information regarding an identified individual is when a telephone number is referred to the FBI for investigation (and there was no evidence in the case before Judge Leon that any such referral had been made regarding the plaintiffs). Even when a number is referred to the FBI, the reasoning of the Smith case would seem to permit the FBI to determine his identity and to obtain relevant public information without a warrant. It would be a considerable stretch to consider the acquisition of publicly available information a “search” within the meaning of the 4th Amendment. Nevertheless, if one is mindful of the concerns expressed by Justice Sotomayor, initiation of an FBI investigation is a juncture at which restraint might be imposed.

The Pauley Opinion. Judge Pauley’s opinion, in an action brought by the ACLU, appears to be more carefully crafted and persuasively reasoned than its District of Columbia counterpart.

At the outset, Judge Pauley observed that: 

The natural tension between protecting the nation and preserving civil liberty is squarely presented by the Government’s bulk telephony metadata collection program. Edward Snowden’s unauthorized disclosure of Foreign Intelligence Surveillance Court (“FISC”) orders has provoked a public debate and this litigation. While robust discussions are underway across the nation, in Congress, and at the White House, the question for this Court is whether the Government’s bulk telephony metadata program is lawful. This Court finds it is. But the question of whether that program should be conducted is for the other two coordinate branches of Government to decide.

Much of the Pauley Opinion was devoted to issues of standing and sovereign immunity and a painstaking explanation of why the metadata program was within the NSA’s authority under the Foreign Surveillance Intelligence Act. Turning to the constitutional issue, Judge Pauley found, contrary to Judge Leon, that Smith v. Maryland is a controlling precedent. And he quoted the admonition of the Supreme Court that lower courts should not attempt to anticipate the overturning or modification by the Court of any of its decisions. Beyond that, his discussion of the issues suggests that there is little reason for the Court to change the approach it adopted in Smith: 

Some ponder the ubiquity of cellular telephones and how subscribers’ relationships with their telephones have evolved since Smith.While people may “have an entirely different relationship with telephones than they did thirty-four years ago,[citing Leon Opinion], this Court observes that their relationship with their telecommunications providers has not changed and is just as frustrating. Telephones have far more versatility now than when Smith was decided, but this case only concerns their use as telephones. The fact that there are more calls placed does not undermine the Supreme Court’s finding that a person has no subjective expectation of privacy in telephony metadata.[citing Smith] 

Judge Pauley acknowledged the breadth of the data collected, but cogently observed that “Every day, people voluntarily surrender personal and seemingly-private information to trans­national corporations, which exploit that data for profit. Few think twice about it, even though it is far more intrusive than bulk telephony metadata collection.” 

In a concluding paragraph, Pauley reflected on the relationship between liberty and security: 

“Liberty and security can be reconciled; and in our system they are reconciled within the framework of the law.“[citation omitted]The success of one helps protect the other. Like the 9/11 Commission observed: “The choice between liberty and security is a false one, as nothing is more apt to imperil civil liberties than the success of a terrorist attack on American soil.” A court’s solemn duty is “to reject as false, claims in the name of civil liberty which, if granted, would paralyze or impair authority to defend [the] existence of our society, and to reject as false, claims in the name of security which would undermine our freedoms and open the way to oppression.”[citation omitted]

The “solemn duty” of a court in exercising its judicial responsibilities is, of course, one that applies no less to the executive and legislative branches in the determination of policy.

* * * *

Part II of this blog will discuss further the analysis and recommendations of the Report released by the advisory panel appointed by President Obama.