[Cross-posted at ACSblog]
Yesterday the Second Circuit declared the NSA’s bulk telephone metadata program unlawful. Specifically, it ruled that it was unauthorized by section 215 of the USA PATRIOT Act (and thus did not reach the constitutional law questions). At the same time, however, it declined to grant an injunction that would have halted the program and instead sent the case back to the district court to reconsider the issues. As the Second Circuit recognized, many of the issues — many of which could may be mooted by congressional action (or inaction) between now and June 1, when this key statutory provision is set to expire.
The program’s continuing operation, at least for the next few weeks, has prompted commentators such as Orin Kerr to describe the ruling as “merely symbolic.” I disagree. To be sure, the telephony metadata program has long been given outsized attention relative to its impact and importance. But the ruling has significant import nonetheless —not just for what it means for the continued operation of the program, but for the range of interconnected areas that the opinion addresses. Below are four key, and substantive, implications of the ruling.
1. Collection Matters
The Second Circuit resoundingly rejected the government’s argument that there is no cognizable injury until data is actually analyzed and reviewed. According to the government, appellants had no standing because they could not establish that the metadata associated with their telephone calls (i.e. the numbers called, received, and duration of the call) had actually been analyzed, rather than merely collected; absent subsequent review, the suffered no injury in fact. The government makes analogous arguments with respect to other forms of bulk collection: Don’t worry — we have robust limitations as to who can access the data and why.
The Second Circuit was not persuaded, and rightly so. As the Second Circuit concluded, collection is properly analyzed as a government seizure. If the collection is unlawful, then “appellants have suffered a concrete and particularized injury,” even without a subsequent review by human actors. In other words, collection matters, even if the subsequent use restrictions are robust and strictly followed. That’s because we have a separate privacy interest not just in how the government uses our data, but in the government’s collection of our data in the first place.
Importantly, the Second Circuit also separately rejected the government’s position —adopted by the district court in the separate Microsoft case that is also now before the Second Circuit (involving a challenge to a warrant for data stored in Ireland) — that a search of data first occurs when human eyes review the collected information. Rather, the Second Circuit concluded that the computer review of data to identify records that match a search term constitutes a cognizable injury that confers standing. As the court put it:
There is no question that an equivalent manual review of the records, in search of connections to a suspect person or telephone, would confer standing even on the government’s analysis. That the search is conducted by a machine might lessen the intrusion, but does not deprive appellants of standing to object to the collection and review of their data
While the analysis focused on the standing issue, the holding seems equally applicable to the definition of a search under the Fourth Amendment. By implication, and contrary to the lower court’s ruling in the Microsoft case, it thus brings a whole host of surveillance activities, often involving computer search of vast troves of the data, under the rubric of the Fourth Amendment.
2. Relevant Means Relevant to a Particular, Specified Investigation
The court also decisively rejected the government’s argument that all our call records could be relevant because it “may allow the NSA, at some unknown time in the future, utilizing its ability to sift through the trove of irrelevant data it has collected up to that point, to identify information that is relevant.” Calling this “expansive” definition of relevant “unwarranted” and “unprecedented,” the Second Circuit concluded that it was completely untethered to the definition of relevant used to that the government relied on as a standard — grand jury and administrative subpoenas. Rather, the data collected pursuant to 215 need to be relevant to aparticular investigation, and not relevant to counterterrorism in general (the court’s interpretation of the government’s position.)
As the court itself notes, this part of the opinion has implications well beyond the telephony metadata program. Other statutes authorize the compelled production of telephone toll-billing and educational records “relevant” to authorized investigations related to terrorism; the government’s use of national security letters are similarly governed by a relevance standard; and other forms of metadata could also be collected under 215, such as financial records, medical records, and metadata associated with email communications (such as the to/from lines). Thanks to the court’s ruling, the government can no longer claim the authority to collect such information in bulk just because it might someday be useful.
The rejection of the government’s interpretation of “relevant” will also affect, as my colleague Steve Vladeck notes (see also Liza Gotein on this point), what happens between now and June 1 when the program is set to expire. Senate Majority Leader Mitch McConnell has, despite push back from members of his own party, been advocating a straight extension of the statutory provision. Before today, that would have meant a continuation of the program. After today, he needs more than a straight reauthorization, but actually a clarification of the meaning of “relevant” to cover bulk data. Given that the more reform-oriented USA FREEDOM Act sailed through the House Judiciary Committee and is headed for almost certain passage on the House floor, it is hard to see Senator McConnell lining up anywhere near enough support for a re-write of the statute to allow the program to continue in its current form.
3. Congressional Ratification
With important implications for the work of those committees overseeing classified programs, the Second Circuit rejected the government’s argument that earlier congressional re-authorization of section 215 constituted implicit ratification of the government’s interpretation. As the court put it, Congress “cannot reasonably be said to have ratified a program of which many members of Congress — and all members of the public — were not aware.” The fact that members, without their staff and in a secure location, were invited to review the FISC opinions authorizing the program did not cure the infirmity; moreover, the secrecy of the program meant that the public could not engage in an educative function that might have otherwise made the ratification argument credible. The court’s ruling highlights (yet again) the value of the greatest transparency possible — at least as to the legal arguments that are being made, if not the specific programs. . It also suggests, going forward, that the government will no longer be able to argue that, merely because Congresscould have known about secret government interpretations of existing statutory authorities, we should assume that Congress did know.
4. The Fourth Amendment
Although the Court did not reach appellants’ Fourth Amendment challenge to the phone records program, it nevertheless opined on the matter — highlighting the vulnerability of the third-party doctrine and noting the challenges of defining reasonable expectation of privacy in an increasingly technologically sophisticated world. But rather than offer any conclusions to the hard questions posed, the court suggested that it was up to Congress to set the key parameters of what is and is not reasonable expectation of privacy in a digital age. In Judge Lynch’s words: “Congress is better positioned than the courts to understand and balance the intricacies and competing concerns involved in protecting our national security, and to pass judgment on the value of the telephone metadata program as a counterterrorism tool.” But should the contours of the Fourth Amendment as a policy judgment really be left to legislators?
Judge Sack pushed back (as I was glad to see). As he wrote in his concurring opinion:
“I think it . . . appropriate to pause to ensure that that [the opinion] is not read to devalue or minimize the role of the courts in determining the meaning of . . . legislation. . . .or its propriety under the Constitution. The courts are charged with the responsibility of making those judgments. They are. . . tasked with the duty, in the context of cases or controversies properly brought before them, to seek to reconcile the never completely reconcilable tension between the individual’s interest in privacy and right to civil liberties and the government’s duty to protect American lives and property.”
****
Hence, lots of substance, with implications for other collection programs, current debates in Congress, the way we treat the acquisition of data, and our understanding of the Fourth Amendment. Contrary to Kerr, it is an opinion that actually matters a lot.