First, some background. The basic idea of FISA is that it requires the Executive Branch to get a warrant to conduct “electronic surveillance,” and permits the government to get a long-term, lower-threshold monitoring order when it is monitoring “an agent of a foreign power” (such as a foreign spy). So the most basic questions under FISA are what is “electronic surveillance,” and who is an “agent of a foreign power”? These definitions are found in Section 101 of FISA, codified at 50 U.S.C. 1801.
Under the current version of FISA, “electronic surveillance” is quite broad, and “agent of a foriegn power” is relatively narrow. As a result, FISA imposes a fairly comprehensive regulatory scheme over national security surveillance.
It’s kind of hard to explain this without some details, so here are the details. (If you want to skip to the punchline, scroll down a bit.) Here is the statutory definition of electronic surveillance:
“Electronic surveillance” means—
(1) the acquisition by an electronic, mechanical, or other surveillance device of the contents of any wire or radio communication sent by or intended to be received by a particular, known United States person who is in the United States, if the contents are acquired by intentionally targeting that United States person, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes;
(2) the acquisition by an electronic, mechanical, or other surveillance device of the contents of any wire communication to or from a person in the United States, without the consent of any party thereto, if such acquisition occurs in the United States, but does not include the acquisition of those communications of computer trespassers that would be permissible under [the Wiretap Act]
(3)the intentional acquisition by an electronic, mechanical, or other surveillance device of the contents of any radio communication, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes, and if both the sender and all intended recipients are located within the United States; or (4)the installation or use of an electronic, mechanical, or other surveillance device in the United States for monitoring to acquire information, other than from a wire or radio communication, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes.
“Contents” are in turn defined as “any information concerning the identity of the parties to such communication or the existence, substance, purport, or meaning of that communication.”
An “agent of a foreign power” is defined as follows:
“Agent of a foreign power” means—
(1) any person other than a United States person, who— (a) acts in the United States as an officer or employee of a foreign power, or as a member of a foreign power as defined in subsection (a)(4) of this section; (B) acts for or on behalf of a foreign power which engages in clandestine intelligence activities in the United States contrary to the interests of the United States, when the circumstances of such person’s presence in the United States indicate that such person may engage in such activities in the United States, or when such person knowingly aids or abets any person in the conduct of such activities or knowingly conspires with any person to engage in such activities; or
(2) any person who— (A) knowingly engages in clandestine intelligence gathering activities for or on behalf of a foreign power, which activities involve or may involve a violation of the criminal statutes of the United States;
(B) pursuant to the direction of an intelligence service or network of a foreign power, knowingly engages in any other clandestine intelligence activities for or on behalf of such foreign power, which activities involve or are about to involve a violation of the criminal statutes of the United States ;
(C) knowingly engages in sabotage or international terrorism, or activities that are in preparation therefor, for or on behalf of a foreign power;
(D) knowingly enters the United States under a false or fraudulent identity for or on behalf of a foreign power or, while in the United States, knowingly assumes a false or fraudulent identity for or on behalf of a foreign power; or
(E) knowingly aids or abets any person in the conduct of activities described in subparagraph (A), (B), or (C) or knowingly conspires with any person to engage in activities described in subparagraph (A), (B), or (C).
So what does this all mean, in plain English? Well, the basic idea is that the government can’t monitor content or non-content information about people in the U.S. without a court order, and it can only get a long-term monitoring order to monitor people if there’s probable cause to beliebve they are spies or members of terrorist groups.
That’s the current law, at least, which is pretty much what we’ve had for the last 30 years or so. But check out what the Specter bill would do to the basic definitions of FISA. The changes appear at page 25, the beginning of Section 9 of the latest draft. First, the existing 4-part definition of “electronic surveillance” is eliminated, and replaced with this shorter and also narrower definition:
(f) electronic surveillance means –
(1) the installation or use of an electronic, mechanical, or other surveillance device for the intentional collection of information concerning a particular known person who is reasonably believed to be in the United States by intentionally targeting that person under circumstances in which that person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes; or
(2) the intentional acquisition of the contents of any communication under circumstances in which that person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes, and if both the sender and all intended recipients are located within the United States.
The definition of contents is changed, as well: instead of “any information concerning the identity of the parties to such communication or the existence, substance, purport, or meaning of that communication,” the Specter bill would borrow the Wiretap Act’s definition, “any information concerning the substance, purport, or meaning of that communication,” excluding information that merely contains the identity of the parties and the existence of the communication.
Finally, the definition of “agent of a foreign power” is amended, too, so that it includes a non-U.S. person — that is, someone other than a U.S. citizen or permanent resident alien — who “otherwise possesses or is expected to transmit or receive foreign intelligence information inside the United States.”
So what does this all mean? Well, to me it says that these are some pretty important changes. Start with the change in the definition of “agent of a foreign power.” That used to mean a spy or terrorist, and the government needed probable cause to believe that the bad guy was in cahoots with a foreign government or terrorist organization to get the monitoring order. The Specter bill would bring a much broader approach: as long as the person is not a U.S. citizen or permanent resident alien, the fact that some one is expected to receive foreign intelligence info — that is, info about national security threats or about foreign governments — would be enough to treat them as agents of a foreign power. You can see why this would make an enormous difference in an era of easily-forwarded Internet communications: the government could follow the trail of data, and could start monitoring the folks who were along the trail so long as they were not U.S. citizens or permanent resident aliens. Maybe this is a good idea, and maybe it’s a bad idea. Either way, it strikes me as a pretty important change.
The changes to the definition of “electronic surveillance” are even more important. Part of the changes are presumably needed to authorize the NSA program; much of the program would seem to be excluded from the definition of “electronic surveillance.” But more broadly, note that under the new definition, monitoring does not constitute electronic surveillance if a) the person monitored has no Fourth Amendment “reasonable expectation of privacy” or b) no warrant would be required to conduct that monitoring in the criminal context.
This explicit incorporation of Fourth Amendment law as the sole test of the statute is troubling, I think, because the Fourth Amendment standards for electronic surveillance are tremendously murky right now. For example, courts have held that you don’t have a reasonable expectation of privacy in calls to or from cordless phones, and they have used reasoning that would also appear to apply as well to cell phone calls. (You have statutory privacy protection, which is much stronger than constitutional protection, but not constitutional protections.) If you don’t have a reasonable expectation of privacy in your cell phone calls, which those cases suggest is the case, Specter’s bill would mean that the NSA can tap every cell phone in the country of every US citizen, for entirely domestic calls, all without a warrant. This monitoring wouldn’t be “electronic surveillance” because (based on the cordless phone cases) the Fourth Amendment doesn’t apply.
Similarly, right now it’s really uncertain whether one can have a reasonable expectation of privacy in your e-mail, and if so, when such protection exists. (Again, there is statutory protection, but constitutional protection is really uncertain.) Some scholars suggest that there is such protection, others suggest there isn’t; as a matter of doctrine, the answer is essentially unknown. But if the statutory standard hinges on constitutional protection, and it may be that there isn’t any constitutional protection at all, then it may be that there is no statutory protection either. And since the government’s applications are secret, we wouldn’t know it.
What would happen, I would assume, is that DOJ and the FISA court judges would reach some kind of understanding about how the Fourth Amendment applies to these new technologies. But no one else would get to know what that understanding is, and as a result no one else would know how the law actually would apply. (Some of this presumably happens now, as parts 1, 3, and 4 of the current definition incorporate this approach: but under current law, part 2 is the broader definition, and does not incorporate the Fourth Amendment standard.)
In sum, my sense is that the Specter bill would make some pretty significant changes to some of the basic principles of FISA. Some of the changes may be good, others bad, and some are just quite uncertain (a constant problem with FISA, as it’s hard for outsiders to get an accurate feel for the impact of specific legislative reforms on secret monitoring). But however you look at it, it’s pretty clear that the Specter bill does a lot more than just subject the NSA program to constitutional review. That’s my sense of it, at least; if you think my analysis is off, please let me know.
Do not some of the questions raised above about the new definitions’ reliance on the “reasonable expectation of privacy” under the Fourth Amendment also obtain in the current definitions — at least so long as the intercept does not actually occur within the country?
Similarly, both the old language and the new language refer to a “particular, known” target. Do these definitions exclude listening to conversations where the target’s identify is not yet “known” — even if the phone number or email address is? What if the identify of the person is easily knowable but the government chooses not to look it up yet to avoid triggering the law?
In other words, how big are these loopholes today? To the extent that the “acquisition” of international communitications can occur abroad, or that any off-the-air interception is deemed not to occur “in the United States” under FISA’s current interpretation, the exceptions seem to apply today.
The conventional wisdom holds that FISA was deliberately drafted to allow intercepting satellite signals or even over-the-horizon microwave and cellphone transmissions as if they were outside the country. I have seen some people argue that these exceptions are well established in practice today, but I can’t know what exactly secret interpretations are applied within the NSA or the FISA courts. (Whatever that scope is, it would be opened wide by the Specter bill’s elimination of FISA’s current trigger that also is based upon where the intercept occurs.)
It is well known that as a policy matter preceding the current program and controversy, NSA has favored legalization of network-based intercepts in the United States. That is because since FISA was enacted, technological change has shifted most international and long-haul traffic from satellite and radio to fiber optic networks. Both Gen. Hayden and Gen. Alexander were remarkably open about this policy objective in their July 26 testimony before the Senate Judiciary Committee.
As Hayden said that day, when FISA was enacted most international traffic was in the air, and most local traffic was on a wire, but now the reverse is the case.
Some legislators and observers might be sympathetic to a change that would effectively update FISA so that the same classes of calls that once were legally intercepted off-the-air now would be legally intercepted on a network. That, itself, is an interesting policy issue. But to what extent would the proposed definitional changes broaden the scope of the exceptions even beyond that?
Pingback: Radio Left
Prof. Kerr says:
This explicit incorporation of Fourth Amendment law as the sole test of the statute is troubling, I think, because the Fourth Amendment standards for electronic surveillance are tremendously murky right now. For example, courts have held that you don’t have a reasonable expectation of privacy in calls to or from cordless phones, and they have used reasoning that would also appear to apply as well to cell phone calls. (You have statutory privacy protection, which is much stronger than constitutional protection, but not constitutional protections.) If you don’t have a reasonable expectation of privacy in your cell phone calls, which those cases suggest is the case, Specter’s bill would mean that the NSA can tap every cell phone in the country of every US citizen, for entirely domestic calls, all without a warrant. This monitoring wouldn’t be “electronic surveillance” because (based on the cordless phone cases) the Fourth Amendment doesn’t apply.
While I’m by no means a fan of warrantless surveillance, I think the concern here is slightly misplaced.
The same language that is in the original FISA bill (“under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes”) is also in the Specter bill (“under circumstances in which that person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes”). The real change is rather to the circumstances under which this condition applies.
Note that this condition is a ‘strict’ condition; it must be met for certain types of surveillance in order for FISA to apply at all. If FISA doesn’t apply, then either the Title III wiretap law and telecommunications privacy laws apply, or the surveillance is not prohibited at all.
The specific types of surveillance that impose this “strict” 4th-Am.-like condition (outside of which surveillances are not prohibited by FISA) are:
1). “Wire” surveillances “targeted” at known “U.S. persons” inside the United States, regardless of the locus of the surveillance itself [50 USC § 1801(f)(1)].
2). Radio intercepts where the sender and all intended recipients are within the United States (this drops the “U.S. person as ‘target’ requirement”) [50 USC § 1801(f)(3)].
FISA was passed before the advent of cell phones and the blurring of the wireline/wireless distinction.
Today’s telecommunications world has witnessed an expolsion of wireless technology, and the distinction is getting less and less important; even if FISA thought to regulate what it thought at the time were two different modes of communication, they have merged, and it may be that the update to FISA’s requirements were at least intended to reflect this new reality.
It may well be that courts would look at cell phone technology, and consider such to be for all practical purposes “wireline” technology in part due to the functional similarities of the communications, and in part due to the fact that even wireless cell phone communications are transmitted in part with wireline technology, the cordless-phone cases notwithstanding (the cordless-phone cases I think stand on flawed reasoning). They were decided as well partly on the fact that commercially available scanners for analog communications could pick up the signals and even your busybody neighbours could listen in … or even did listen in, in cases where you chose the frequency as they did. But modern cordless phones have adopted digital encoding and use more channels, so that the expectation of privacy for such calls is increased, and the technological means for a casual listener to listen in on such calls has become much harder to come by.
I note that the CALEA laws (which regulate the wiretaps of mobile technology) recognises cell phones as being telephone communications devices, and treats them pretty much the same as land-line phones, but doesn’t extend to such as walkie-talkies or wireless handsets.
The most significant instance of the original FISA law that didn’t include this “reasonable expectation of privacy” proviso was the one where the surveillance was physically conducted within the United States [50 USC § 1801(f)(2)]. I guess the folks that wrote FISA thought that we ought to put a tight rein on surveillances performed domestically, possibly due to concerns about the higher probability of inadvertent snooping on the U.S. public that wasn’t warranted, recognition of the fact that the needs for such domestic snoops weren’t as high, and probably mostly because the authors thought that within the United States, the gummint ought to adhere by our laws and policies as much as possible.
The “domestic locus of surveillance” clause may have been rendered moot by the changing nature of telecommunications; nowadays purely foreign communications may easily pass through the U.S., and purely domestic communications may pass through other countries. It does make some sense to concentrate on the target of the communications, rather than the means (with the possible proviso that surveillances installed domestically may contain a higher proportion [but not exclusively] of purely domestic communications).
The more important changes, I think, have to do with the definition of “content”. The original FISA law included “the identity of the parties” as “content”; the more recent CALEA law as well as Title III do distinguish between “call data” and “call content” where “call data” is the “signalling information” (the phone numbers dialed, etc.), and the call content is the “substance” of the communication [the actual voice, or the text of messages sent]). A change in the definition of “content” would actually put the FISA laws into closer accord with the CALEA laws and Title III, where only the “call content” requires the Title III warrant. Unfortunately, though, CALEA itself has blurred the distinction between “content” and “data”, with the gummint pushing for the inclusion of short message text, the location of the mobile subscriber, and the “dialed digits” entered post-cut-through, as “call data” not requiring a Title III warrant. Short message text is clearly a “message” in my mind”, identical to an e-mail, and ought to be treated as “content”; I don’t know what the upshot was of the fight about this as “call data” but I know that some surveillance equipment has ability to include such in “call data” if such is required by the gummint. Dialed digits
“post-cut-through” is another grey area: The gummint maintains that of you reach a company PBX or other private exchange, and then access a specific extension, they ought to know who the extension was. But the equipment that extracts the post-cut-through dialed digits can’t determine if these touch-tome digits are used to access an extension, or rather are the PIN, the account number, and the amount of a bank account transfer, for instance. In the latter case, one could well argue that this is “call content”, but the gummint gets it without a Title III warrant anyway.
I think there’s significant problems with the Specter bill, but these definitional changes could be relatively benign.
Cheers,
Pingback: Debating Terrorism » Archives » New FISA Bill Does More than Provide Constitutional Review