NSA Bulk Metadata Collection Not Lawful, Says 2nd Cir.

Well, color us shocked. The Second Circuit this morning found that the NSA's bulk metadata collection program -- which, by the way, would have remained secret if not for Edward Snowden -- was not authorized by the USA PATRIOT Act.

The court took seriously the notion that systematic bulk electronic collection of metadata is very different from more "traditional" metadata collection, such as reading the address on an envelope or using a pen register on a phone. Even though the court limited its holding to the statute, and avoided the Constitution, the stage is set for putting the concurring opinions in United States v. Jones into practice.

The NSA's Collection Went Well Beyond the Statute

NSA folded its bulk collection program into section 215 of the USA PATRIOT Act, which allows the FBI to use a subpoena to obtain any tangible thing that relates to an ongoing investigation into international terrorism, provided the investigation doesn't concern a "United States person."

After finding that the plaintiffs had standing, and that section 215 didn't preclude judicial review (the government had contended that only the recipient of a section 215 order -- the phone company -- could challenge it), the court got to the meat of the issue.

NSA's ongoing collection program, which consisted of a standing order for Verizon to provide metadata on all telephone calls in the United States, didn't even meet the fairly low standard of section 215, the court said. The statute authorizes collection of data "relevant to an authorized investigation," but the court found the NSA's collection of data far surpassed what would be relevant to an investigation. Instead, it said, the NSA "seeks the records to create a vast data bank, to be kept in reserve and queried if and when some particular set of records might be relevant to a particular investigation."

Also integral to the court's finding was the nature of the information the NSA sought. Normally, a warrant or a subpoena will specify which things, from which people, are to be seized. But not with the NSA's order, which demanded "every telephone call made or received in the United States." There was no evidence that every person whose call records were seized was under investigation, and in fact, the orders "extend to every record that exists, and indeed to records that do not yet exist, as they impose a continuing obligation on the recipient of the subpoena to provide such records on an ongoing basis as they are created."

Fourth Amendment Concerns

Constitutionally, the government located its argument in the third party doctrine, as the government often does, which holds there is no right to privacy in information voluntarily turned over to third parties. This has usually worked in the past, but the scope of the NSA program gives one quite a bit of pause.

The court noted that the changing landscape of technology "is one of the most difficult issues in Fourth Amendment jurisprudence." Though it launches into a discussion of the concurring opinions in Jones, positing that it might be the case that long-term surveillance that reveals "a 'mosaic' of information in which individuals had privacy interests, even in the absence of a privacy interest in discrete pieces of such information."

The "mosaic" theory is a good one for understanding the way modern technology implicates privacy. At the outset, the Second Circuit cited to a study showing that scientists were able to identify 90% of individuals based on four data points from anonymous credit card records. This is troubling, the court says, but nevertheless, it avoided the constitutional issue altogether. It was enough that the NSA's collection program exceeded the scope of the statute.

With the Second Circuit's ruling in place, we may finally have the Supreme Court weigh in on the bulk government surveillance that has been going on since at least 2006.

Related Resources:

• N.S.A. Phone Data Collection Illegal, Appeals Court Rules (The New York Times)
• NSA Verizon Metadata Program Slammed by Court (FindLaw's D.C. Circuit Blog)
• Judges Skeptical of NSA in 1st Cell Phone Metadata Appeals Case (FindLaw's Technologist)