Wake-Up Call: 2nd Circuit Declares NSA’s Mass Telephone Surveillance Program Illegal; Defers Injunction While Congress Ponders Renewal of Key PATRIOT Act Provision

Whatever your opinion of Edward Snowden, the shockwaves from his leaks of classified material continue to roil all three branches of the federal government. 

The latest wave broke last week when the United States Court of Appeals for the Second Circuit held in ACLU v. Clapper that the National Security Agency’s mass telephone metadata collection program, which has been in place for a decade or more, is not authorized by Section 215 of the Patriot Act, and is therefore illegal. Public awareness of that program came to light in June 2013, and only when the newspaper The Guardian published a leaked order from the Foreign Intelligence Surveillance Court (“FISC”) requiring Verizon to produce to the NSA “on an ongoing daily basis . . . all call detail records or ‘telephony metadata’ created by Verizon for communications (i) between the United States and abroad; or (ii) wholly within the United States, including local telephone calls.” It has since become clear that such FISC orders have been issued to virtually all major telephone carriers in the United States.

This is arguably the most significant ruling to date on the various surveillance programs revealed by Snowden, and the only appellate court ruling on Section 215, which is currently set to expire on June 1, 2015. In recent months, lawmakers have intensely debated whether the program should be continued as is, modified, or ended. Some members of Congress, such as Senate Majority Leader Mitch McConnell and other republican lawmakers, are still pushing for a clean reauthorization, even though extending the program without modification would appear to run contrary to the court’s ruling. Meanwhile, the bipartisan-backed USA Freedom Act in the House and the Senate’s USA FREEDOM ACT of 2015 would curb bulk data collection and introduce additional reforms, but consumer advocates argue that the reforms do not go far enough, and are urging Congress to simply let the provisions expire. While the Obama Administration has defended the program, it has also called for the end of bulk collection, advancing an alternative mechanism that would require the carriers themselves to maintain the data, until the government requests it. Votes on such reforms are expected soon in both the House and the Senate, with some Senators already threatening a filibuster.

The 2nd Circuit decision is remarkable for its strong criticism of the breadth of the data collection program, the government’s efforts to justify that breadth by unpersuasive comparison to ordinary search warrants and subpoenas, and the government’s strained argument that information about every phone call is “relevant” to an authorized investigation. The court would not countenance stretching the concept of relevance so far, as Section 215 requires:

if the orders challenged by appellants do not require the collection of metadata regarding every telephone call made or received in the United States (a point asserted by appellants and at least nominally contested by the government), they appear to come very close to doing so. The sheer volume of information sought is staggering; while search warrants and subpoenas for business records may encompass large volumes of paper documents or electronic data, the most expansive of such evidentiary demands are dwarfed by the volume of records obtained pursuant to the orders in question here.

We will have to wait to see whether the government will seek a rehearing en banc or certiorari from the Supreme Court, and it may be some time before the ultimate disposition of this case. In the meantime, it is unclear how this ruling could affect the telephone carriers’ immunity when providing information to the government pursuant to National Security Letters (“NSLs”) and FISC orders. However, there are several other cases challenging the legitimacy of the mass data collection program under appellate review in other jurisdictions that may give more specific guidance on this topic, and the courts considering them will undoubtedly take account of the Second Circuit’s decision, which is summarized below. 

The NSA Bulk Metadata Collection Program

Launched sometime after the September 11, 2001 terrorist attacks, the NSA’s mass telephone metadata collection program is implemented through orders issued by the Foreign Intelligence Surveillance Court, upon application from the NSA. As presently constituted, Section 215 of the PATRIOT Act permits the government “to make an application for an order requiring the production of any tangible things . . . for an investigation to obtain foreign intelligence information not concerning a United  States person or to protect against international terrorism or clandestine intelligence activities.” The government’s application must include “a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation (other than a threat assessment) conducted in accordance with subsection (a)(2) of this section to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities.” The review of such applications by FISC is conducted in secret, typically in ex parte proceedings.

The Order to Verizon – and presumably every similar order addressed to other providers – required the ongoing production of telephone metadata, which was then to be stored on a secure NSA network indefinitely.  The court noted that under the program, the metadata “would only be accessed ‘when NSA has identified a known telephone number for which . . . there are facts giving rise to a reasonable, articulable suspicion that the telephone number is associated with [Redacted]’– presumably, with terrorist activity or a specific terrorist organization.” As set forth specifically in a “Secondary Order,” the metadata collected included “comprehensive communications routing information, including but not limited to session identifying information (e.g., originating and terminating telephone number, International Mobile Subscriber Identity (IMSI) number, International Mobile station Equipment Identity (IMEI) number, etc.), trunk identifier, telephone calling card numbers, and time and duration of call.”

The District Court Decision

The American Civil Liberties Union, American Civil Liberties Union Foundation, New York Civil Liberties Union and New York Civil Liberties Union Foundation filed the instant case in the United States District Court for the Southern District of New York, challenging the NSA’s metadata program on the grounds that it was beyond the scope of Section 215 of the Patriot Act, and that it violated the First and Fourth Amendments. In the district court, Judge Pauley granted the government’s motion to dismiss, finding that Section 215 impliedly precludes judicial review, that the statutory claims were meritless, and that the statute does not violate the Constitution.

The 2nd Circuit Opinion

Standing and Preclusion

First, the 2nd Circuit affirmed the district court’s ruling that the appellants had standing to support their action against the NSA’s metadata program, finding that they alleged concrete, traceable, and redressable injuries. Specifically with regard to appellants’ Fourth Amendment claim, the court found that the FISC orders permitting the government to collect virtually all telephone metadata demonstrated that the appellants’ records are collected as part of the NSA’s program, and that the appellants’ claim alleges injury from the very collection of their metadata. The court found that such collection was more appropriately challenged as a seizure under the Fourth Amendment rather than as a search, and accordingly held that “[w]hether or not such claims prevail on the merits, appellants surely have standing to allege injury from the collection and maintenance . . . of records relating to them.”

Significantly, in addition to finding that collection alone is a seizure and confers standing, the court noted that even on the government’s theory – that no search (and therefore no harm) occurred unless a particular record was singled out for scrutiny – it was clear that any actual review of collected data by a human being would constitute a search and confer standing. The court held that the computerized review the government described was no different:

Finally, the government admits that, when it queries its database, its computers search all of the material stored in the database in order to identify records that match the search term. In doing so, it necessarily searches appellants’ records electronically, even if such a search does not return appellants’ records for close review by a human agent. . . . That the search is conducted by a machine might lessen the intrusion, but does not deprive appellants of standing to object to the collection and review of their data.

Next, the court addressed the government’s contention that the plaintiffs were impliedly precluded from bringing suit, in particular because Section 215 provides only for judicial review by FISC and a “specialized mechanism for appellate review,” and anticipates challenges only from the communications companies that have actually received Section 215 orders (not the targets of the orders). Rejecting this argument, the court noted the strong presumption in favor of judicial review deriving from the Administrative Procedure Act (“APA”), requiring the government to show “clear and convincing” or “fairly discernible” evidence that Congress intended preclusion. The government argued that the extensive secrecy requirements surrounding the limited judicial review provided by statute indicated that Congress intended not to permit any other judicial review. But the court disagreed:

Indeed, the government’s argument from secrecy suggests that Congress did not contemplate a situation in which targets of § 215 orders would become aware of those orders on anything resembling the scale that they now have. That revelation, of course, came to pass only because of an unprecedented leak of classified information. That Congress may not have anticipated that individuals like appellants, whose communications were targeted by § 215 orders, would become aware of the orders, and thus be in a position to seek judicial review, is not evidence that Congress affirmatively decided to revoke the right to judicial review otherwise provided by the APA in the event the orders were publicly revealed.

The court also rejected the government’s arguments that the statutory scheme as a whole, legislative history, and the language of other statutes, favored preclusion, summing up its arguments as follows: “In short, the government relies on bits and shards of inapplicable statutes, inconclusive legislative history, and inferences from silence in an effort to find an implied revocation of the APA’s authorization of challenges to government actions.”

Illegality Under Section 215

Turning to what it saw as the heart of the matter, the court first noted that Section 215 allows the government to seek “an order requiring the production of any tangible things . . . for an investigation . . . to protect against international terrorism or clandestine intelligence activities,” including anything that “can be obtained with a subpoena duces tecum issued by a court of the United States in aid of a grand jury investigation” or any other court order. While this is broad language, the court noted that the government must also submit a fact statement demonstrating reasonable grounds to believe “that the tangible things sought are relevant to an authorized investigation (other than a threat assessment) conducted [under guidelines approved by the Attorney General].”  In plain English, this meant that “[t]he basic requirements for metadata collection under § 215, then, are simply that the records be relevant to an authorized investigation (other than a threat assessment).”

The court’s decision on the legality of the FISC orders under Section 215 turned on the definition of “relevance.”    The court pointed out that the parties were not even really debating whether the data being collected were “relevant to any particular inquiry.”  There was no comparison to the scope of traditional subpoenas or court orders because such mass data collection is something different – the government argued that the relevance of bulk aggregation of metadata comes instead from “the ‘creation of a historical repository of information” that can be queried by “’certain analytic techniques’” (citations omitted) in future terrorism investigations. The court concluded that the government’s definition would render the word “relevant” virtually meaningless because, by that reasoning, all telephone metadata in the United States, at all times, would be “relevant to terrorism investigations”:

Thus, the government takes the position that the metadata collected – a vast amount of which does not contain directly “relevant” information, as the government concedes – are nevertheless “relevant” because they may allow the NSA, at some unknown time in the future, utilizing its ability to sift through the trove of irrelevant data it has collected up to that point, to identify information that is relevant. We agree with appellants that such an expansive concept of “relevance” is unprecedented and unwarranted.

To the extent the government did point to prior decisions examining the breadth of subpoenas, the court found that “as broad as those subpoenas were, the cases cited by the government only highlight the difference between the investigative demands at issue in those cases and the ones at issue here.” Notably, in all such prior cases, the subpoenas were limited by the context of the investigation itself, or temporally.  By contrast, the court held,

The telephone metadata program requires that the phone companies turn over records on an “ongoing daily basis” – with no foreseeable end point, no requirement of relevance to any particular set of facts, and no limitations as to subject matter or individuals covered.”

Indeed, such a broad reading of “relevant” ignored the statutory limitation of such orders “to an authorized investigation.” The government’s argument implied that there is “only one enormous ‘anti‐terrorism’ investigation, and that any records that might ever be of use in developing any aspect of that investigation are relevant to the overall counterterrorism effort.” Finding that the government’s interpretation of the statute “defies any limiting principle,” the court held that the surveillance far exceeded the statutory scope.

The court also found that the government’s interpretation read the phrase “other than a threat assessment” out of the statute. The FBI’s own guidelines, the court noted, differentiate assessments from investigations because “they may be initiated without any factual predication”. The objective of an assessment may be broad – for instance, prevention of “terrorist acts against the nation” – but must still be clearly defined and serve an authorized purpose. When conducting assessments, the court further noted, the FBI typically limits itself to methods with “low intrusiveness,” such as collecting public information and reviewing government records. Given these distinctions, it was clear that Congress intended “to prevent § 215 orders from being issued where the FBI, without any particular, defined information that would permit the initiation of even a preliminary investigation, sought to conduct an inquiry in order to identify a potential threat in advance.” The metadata collection program was “even more remote from a concrete investigation” than such threat assessments.

Constitutional Challenges

While the 2nd Circuit chose not to address the appellants’ First Amendment claim, it discussed at length the argument that the metadata collection program violated appellants’ expectations of privacy under the Fourth Amendment. The district court rejected appellants’ Fourth Amendment claim on the grounds that the Supreme Court has held that an individual has no privacy interest in telephone records or other information voluntarily disclosed to a third party. Appellants argued that technological advances in surveillance such as the metadata program gave cause to revisit this third-party records doctrine.

The court acknowledged that appellants’ claim raised the “vexing” question of how modern technology is altering traditional privacy expectations, an issue that has thrown Fourth Amendment jurisprudence into “some turmoil” in recent years.  In its analysis of appellants’ Fourth Amendment claim, the 2nd Circuit highlighted Justice Sotomayor’s concurrence in United States v. Jones, which questioned whether the realities of the digital age – “in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks” – call for us to reevaluate the notion that we have no reasonable privacy expectation in information like telephone metadata that we must disclose to third parties to live in the modern world.

Despite its pondering, however, the court did not resolve these difficult issues. Because the court already held that the NSA’s program was not authorized by Section 215, and because Congress might make the appellants’ constitutional claims moot by revising Section 215 or letting it expire on June 1, the court decided that “we need not and do not reach these weighty constitutional issues.” Instead, the 2nd Circuit suggested that courts should defer to Congress, which can apply its experience and judgment and reflect the will of the electorate to define the contours of privacy under the Fourth Amendment in an evolving technological and social landscape. Finally, the court noted that several bills to revise Section 215 are currently pending before Congress, and that “[t]he constitutional issues [involved] are sufficiently daunting to remind us of the primary role that should be played by our elected representatives.”

Injunctive Relief/Remand

Although the court determined that the district court erred in dismissing the appellants’ claims and that “appellants have shown a likelihood – indeed, a certainty – of success on the merits of at least their statutory claims,” it declined to decide whether a preliminary injunction is required. Instead, the court demurred and chose to remand the issue to the district court.

Echoing its analysis of appellants’ constitutional claims, the court noted that the program’s sunset provisions would take effect in a few weeks’ time without congressional action; should Congress allow Section 215 to lapse, appellants’ injunction will be consequently moot. In the court’s view, given the government’s asserted national security interests in the program, and the importance of Congress’ role in deciding whether to reauthorize Section 215, “we deem it prudent to pause to allow an opportunity for debate in Congress that may (or may not) profoundly alter the legal landscape.”