Because the gods of traffic metrics are stern taskmasters, you’ll likely read a lot of headlines today about “the expiration of the Patriot Act,” possibly paired with the implication that Rand Paul has singlehandedly dealt the National Security Agency some sort of crippling defeat. The reality is still exciting news for civil libertarians, but would yield the rather more prosaic headline: “Major surveillance reform moves forward by huge Senate majority; USA Freedom Act to pass this week after brief and largely irrelevant lapse of about 3% of the Patriot Act.” The only real question is whether Mitch McConnell will be able to peel off enough hawkish Democrats to weaken the reform further first—but happily his prospects seem doubtful.
From an operational and policy perspective, the sunset really doesn’t matter. The bulk telephony metadata program will end, but they started winding that down a week ago, and will also have to end it under the USA Freedom Act. For all other purposes, grandfather clauses will allow the government to keep using the expired authorities for all their existing investigations, and even without that, as I observed at Vice‘s Motherboard last week, they’ve got plenty of overlapping authorities that would allow them to obtain most of the same information. The real significance of the sunset is symbolic and political: Mitch McConnell clearly believed the same script he’s been reading from for the past decade would still work, that he could fill the Senate schedule with trade promotion authority and oil pipelines until the eve of the sunset, then use the “crisis” he’d manufactured to strongarm senators into foregoing substantive debate on reform and voting for reauthorization without any changes, lest our spies “go dark” and the terrorist boogeyman du jour lay waste to the homeland. But it turns out Americans aren’t quite so scared of the dark anymore. The Patriot Act hasn’t expired—three provisions have lapsed quite temporarily—but the scaremongering strategy that birthed it is now, happily, well past its sell-by date and starting to emit a noxious odor. That will be important as we head to 2017 and the debate over reauthorization of the FISA Amendments Act.
It now seems plain the USA Freedom Act will pass: the Senate voted to move forward on the bill by a vote of 77–17, opposed only by the strange bedfellows coalition of Rand Paul and 16 of the Senate’s most hardcore NSA cheerleaders. McConnell has proposed an array of amendments weakening or diluting it, though perhaps less because he think they’ll pass than because doing so “fills the tree” for amendments and prevents folks like Ron Wyden or Rand Paul from offering amendments that would strengthen the bill. Among these are a data retention “notice” mandate (which would compel phone companies to notify the government in advance if they plan to retain call records for less than 18 months, a way of encouraging without strictly requiring retention) and an amendment stripping away the crucial transparency provision that requires publication of significant FISA Court opinions, which is necessary to ensure that new safeguards can’t be secretly “reinterpreted” into irrelevance the same way the court secretly transformed §214 and §215 into bulk collection authorities. While unfortunately there are probably quite a few senators in the “yes” column on USA Freedom who would also favor these changes, they’re likely to meet strong opposition from both technology companies and civil liberties groups, and it seems at the very least doubtful they’d make it through the House. For those who purport to think it’s essential to extend the expiring powers quickly, that should be a powerful argument for just moving with the language the House has already approved, so it can go speedily to the President’s desk.
As I noted above, all of the pro-privacy Senators but Rand Paul are on board with the USA Freedom Act, but it may be worth elaborating a bit on why I think their concerns are largely misguided. As I argued in my Vice piece, we should distinguish between fundamentally strategic arguments for letting Patriot provisions sunset, of the sort we’ve heard from the American Civil Liberties Union, and the kind of substantive objections we’ve heard from grassroots activists and a handful of legislators, though very few actual policy experts. This is the argument, as Robyn Greene summarized it at Slate, that ” USA Freedom is a ‘fake’ reform that actually codifies bulk collection rather than restraining it.” Certainly the track record of the FISC provides ample reason to fear that statutory ambiguities risks being exploited to expand surveillance powers, and I absolutely agreed with those fears about previous versions of the bill. But the drafters of USA Freedom in its latest incarnation have done everything you could reasonably want to forestall that possibility.
As a rough heuristic, it’s probably worth asking whether it’s really plausible that Ron Wyden and Pat Leahy and Mike Lee have all been duped into supporting a reform that really expands surveillance, and only Rand Paul has pierced the veil of illusion. But let’s take a more granular look at the argument as articulated by Rep. Justin Amash in a Facebook post, and also summarized in this article at The Intercept. Here’s the core of Amash’s argument:
H.R. 2048 [attempts to prohibit bulk collection] by authorizing the government to order the production of records based upon a “specific selection term” (i.e., like a search term used in a search engine). The records sought still must be relevant to an investigation, so it’s possible the court’s ruling will continue to restrain the government in some fashion. But it’s more likely a court looking at H.R. 2048’s language will see the “specific selection term” as defining the outer limits of what Congress considers acceptably “relevant” under Section 215.
Indeed, the Second Circuit encouraged Congress in reforming Section 215 to make a “congressional judgment as to what is ‘reasonable’ under current circumstances.” Unfortunately, “specific selection term” is defined so broadly under the bill as to have little effect on narrowing the scope of items the government may obtain through a 215 order.
Amash is suggesting that the USA Freedom Act will be interpreted as overriding the repudiation of bulk collection by the Court of Appeals for the Second Circuit. But that seems highly unlikely. Structurally, the “specific selector” requirement is an independent requirement imposed in addition to the relevance requirement. There’s absolutely nothing in there that would license a court to hold that records that would not otherwise satisfy the relevance standard somehow become relevant just because they’re identified by a specific selector. After all, §215 does say that certain categories of records, such as those of suspected foreign agents and their direct contacts, are “presumptively” relevant—but it clearly does not say that any record identified by a specific selector is presumptively relevant. This is quite clear from the text of the bill itself, but should the FISC find it at all ambiguous, they will look to the legislative history. And the House report on USA Freedom makes it still more explicit:
Section 103 requires the government to make an additional showing, beyond relevance, of a specific selection term as the basis for the production of the tangible things sought, thus ensuring that the government cannot collect tangible things based on the assertion that the requested collection ‘‘is thus relevant, because the success of [an] investigative tool depends on bulk collection.’ Congress’ decision to leave in place the ‘‘relevance’’ standard for Section 501 orders should not be construed as Congress’ intent to ratify the FISA Court’s interpretation of that term. These changes restore meaningful limits to the ‘‘relevance’’ requirement of Section 501, consistent with the opinion of the U.S. Court of Appeals for the Second Circuit in ACLU v. Clapper. [Emphasis mine]
Even the notorious deferential FISA Court would be hard-pressed to simply ignore such an unambiguous statement of legislative intent: They’re both concurring with the Second Circuit’s repudiation of the diluted “relevance” standard and imposing an additional limitation. Thanks to the transparency requirements imposed by USA Freedom, of course, the public would soon learn if the FISA court nevertheless sought to thwart the will of Congress. Amash continues:
A “specific selection term” may be a specific person (including a corporation, such as Western Union), account, address, or personal device, but it also may be “any other specific identifier,” and the bill expressly contemplates using geographic regions or communication service providers (such as Verizon) to define the records sought, so long as it’s not the only identifier used as part of the specific selection term. In other words, the bill doesn’t let the government require Verizon to turn over all its records without limitation, but nothing appears to prevent the government from requiring Verizon to turn over all its records for all its customers in the state of New York. Only a politician or bureaucrat wouldn’t call that “bulk.”
Again, the ultimate check on this is the transparency requirement, but this would be awfully difficult to square with the statutory text. Here’s how the bill defines “specific selection term”:
“(i) IN GENERAL.—Except as provided in subparagraph (B), a ‘specific selection term’—
“(I) is a term that specifically identifies a person, account, address, or personal device, or any other specific identifier; and
“(II) is used to limit, to the greatest extent reasonably practicable, the scope of tangible things sought consistent with the purpose for seeking the tangible things.“
(ii) LIMITATION.—A specific selection term under clause (i) does not include an identifier that does not limit, to the greatest extent reasonably practicable, the scope of tangible things sought consistent with the purpose for seeking the tangible things, such as an identifier that—
“(I) identifies an electronic communication service provider (as that term is defined in section 701) or a provider of remote computing service (as that term is defined in section 2711 of title 18, United States Code), when not used as part of a specific identifier as described in clause (i), unless the provider is itself a subject of an authorized investigation for which the specific selection term is used as the basis for the production; or
“(II) identifies a broad geographic region, including the United States, a city, a county, a State, a zip code, or an area code, when not used as part of a specific identifier as described in clause (i).
“(iii) RULE OF CONSTRUCTION.—Nothing in this paragraph shall be construed to preclude the use of multiple terms or identifiers to meet the requirements of clause (i).
Now it’s true, this allows a geographic term, or the name of a communications provider, to be used as part of a “specific selection term” but it sort of has to do that, doesn’t it? If you want the records associated with a particular billing address, then of course “New York” might be part of that selection term. If you’re getting records for a specific email account, of course “@Verizon.com” might be part of that e-mail address. But this language makes it about as clear as it can possibly be that this is not an authority to get records for every Verizon customer in New York, because the terms must still in tandem satisfy the requirements of clause (i). The government would have to argue that while Congress explicitly prohibited serving Verizon with an order for customer data using “New York” or “212” alone as a selection term, it has no problem with “Verizon” and “212” being used in tandem as selection terms in an order served on some other entity, even though these would be equivalent in scope.
Could John Yoo write that brief? Probably. Should we be too worried that the FISA court, already having had its wrist slapped, will endorse such logic in an opinion they know will have to be made public? At that point I think we’re simply saying the FISC will pervert whatever language is adopted, however clear, and it doesn’t really matter what the legislature does. I have some dark moments myself, but if we think it’s worth fighting for reform at all, we have to suppose it’s ultimately possible for Congress to be clear enough to forestall such shenanigans. Remember, the bill doesn’t just say that the government can’t use a zip code or a communication service provider alone as a selection term: It says that broad terms such as these would be insufficient to meet the requirements of the statute. The specific examples of unacceptable selection terms are illustrative, not exhaustive. and should therefore bar any term or terms that would result in collection on a similar scale.
Since Amash is particularly worried about the use of “any other specific identifier” as a loophole through which the government will smuggle renewed bulk collection, it’s critical to understand that the court’s interpretation of this language will be governed by a judicial canon of statutory construction known as ejusdem generis. Briefly, ejusdem generis means that when a series of specific terms like “account” and “address” and “personal device” are followed by a more general term like “other specific identifier,” the court has to read the more general term in light of the specific ones. In other words, the court can’t just read “other specific identifier” to mean anything under the sun. It’s got to be an identifier comparable to, or “of the same kind” as a selection term identifying a specific account or personal device.
We’ve learned that with the FISA Court one shouldn’t absolutely rule out even seemingly absurd leaps of logic, but it’s one thing to stretch an ambiguity in secret, quite another to defy an explicit congressional directive in an opinion that you know you’ll have to make public. No statute with any degree of flexibility for investigators can provide an absolutely bulletproof guarantee against being perverted, but in combination with the transparency requirement, it seems to me that the drafters of USA Freedom have done a pretty damn good job.