Governance & Risk Management , Privacy , Standards, Regulations & Compliance
The Implications of Court's NSA Ruling
Assessing Order Declaring NSA Bulk Collection Program IllegalA federal appellate court decision that the National Security Agency's bulk data collection program is illegal could have sweeping ramifications beyond derailing the initiative to amass the metadata of Americans' telephone calls.
See Also: How Enterprise Browsers Enhance Security and Efficiency
"The leadership of NSA and the intelligence community have had a clear vision of cyberspace and how best to operate there," says Jason Healey, senior fellow at the Atlantic Council, a think tank. "This ruling should be one of the first real shocks to that confidence. If they are wrong in a continuing insistence that such massive monitoring is OK, then what other dynamics of cyber-espionage and conflict are they getting wrong?"
In its May 7 order, the U.S. Second Circuit Court of Appeals ruled that Congress, in enacting the Patriot Act in the wake of the 2001 terrorist attacks, did not authorize the secret bulk data program revealed nearly two years ago in documents leaked by former NSA contractor Edward Snowden (see Appeals Court: NSA Lacks Bulk Collection Authority).
Justifying Bulk Collection
The Bush and Obama administrations have used Section 215 of the Patriot Act to justify the bulk collection program. Section 215 authorizes the government, with the approval of a secret court, to access "tangible things for an investigation to protect against international terrorism and clandestine intelligence activities," provided citizens' constitutional rights aren't violated.
Jim Harper, senior fellow at the Cato Institute, another think tank, says the government likely stretched the meaning of Section 215 to justify other intelligence-gathering programs that remain secret. "This ruling should put an end to them, or at least an end to using section 215 as authority for them," Harper says. "Maybe some government attorneys with sense and spines will start to question others' bizarre interpretations of the laws."
Because Section 215 is set to expire at the end of the month, the appellate court did not issue an injunction to halt it, remanding the case brought by the American Civil Liberties Union to a federal circuit court, should Congress reauthorize the law. "The court in essence challenged Congress to vote the practice up or down when it considers whether to reauthorize the Act," says cybersecurity and privacy attorney Robert Cattanach, a partner at the law firm Dorsey & Whitney.
A Heavy Lift
Georgia Tech Law and Ethics Professor Peter Swire, the White House privacy counsel in the Clinton administration, questions the viability of any legislation reauthorizing the bulk collection program as implemented by the NSA. "The program can apparently only continue if Congress makes an affirmative decision to strengthen the statutory authority," he says. "That seems like a heavy lift for Congress to do."
Indeed, a groundswell of opposition to the bulk collection program suggests that reauthorization is highly unlikely, and the court's opinion could help Congress decide how to proceed on the matter. "It provides members of Congress with an actual example of the way Section 215 might be interpreted, and the significant consequences of the clarity - or lack thereof - of the provisions," says privacy lawyer Francoise Gilbert, managing director of the IT Law Group.
Still, Senate Majority Leader Mitch McConnell, R-Ky., is supporting legislation to at least temporarily renew Section 215, and he defended the program on the Senate floor shortly after the appellate court decision, saying that the terrorist attacks might not have occurred if such a law was in place on in September 2001.
Not the Time to 'Weaken' Security
House Intelligence Committee Chairman Devin Nunes, R-Calif., in disagreeing with the circuit court opinion, maintains the NSA telephone metadata collection program is constitutional under the Patriot Act, noting that all three branches of government provided oversight. "As threats to Americans at home and abroad increase by the day, now is not the time to be weakening our national security, with all the traffic consequences that may follow," he says.
Such defense of the bulk collection program was quickly rebutted by one of the Senate sponsors of the USA Freedom Act, legislation that would ban bulk collection. "These Republicans are ignoring the findings of national security experts that this program is unnecessary, and the decision by a federal appellate court earlier today that the program is illegal," says Sen. Patrick Leahy, D-Vt., "Nevertheless, these Republicans seem intent on demonstrating that they are wholly out of touch with the facts, the law and the American people on this issue."
Not all Republicans agree with McConnell and Nunes. Leahy's co-sponsor of the USA Freedom Act is Utah Republican Mike Lee. And, the Republican-controlled House Judiciary Committee overwhelmingly approved its version of the USA Freedom Act on April 30 (see Panel Votes to End Bulk Collection). That bill could come up for a vote by the entire House next week.
Modifying Collection Program
The Obama administration in February modified the bulk data collection program by placing limits on it, including the deletion of collected data after five years unless the director of National Intelligence determines the information is needed for intelligence investigations (see Administration Modifies Data Collection Rules).
Attorney General Loretta Lynch discusses the NSA bulk collection program.
Testifying May 7 before the Senate, new Attorney General Loretta Lynch said the Obama administration is working with Congress to reauthorize Section 215 "in a way that does preserve its efficacy and protect privacy."
Yet, the appellate court's decision is seen as strengthening the hand of those who favor the restrictions to bulk collection found in the USA Freedom Act. "Reauthorization of Section 215 without reform, if it ever was a viable option, is no longer," says Harley Geiger, advocacy director for the Center for Democracy & Technology, a civil liberties advocacy group.