Over at The Guardian, Glenn Greenwald has a report on a leaked top secret court order apparently issued by Judge Vinson of the Foreign Intelligence Surveillance Court ordering Verizon to turn over all metadata on all domestic calls (including calls between the U.S. and a foreign country) for a period of 90 days from April to July 2013. You can see the 3-page order here. On its face, the order has no limitations beyond the date: It orders Verizon to turn over “all” non-content records, not just records relating to a particular case, suspect, or group.
Only the order itself was leaked, not the application for it, but the order refers to an application that the court found satisfied the requirements of 50 U.S.C. 1861. Section 1861(b)(2)(A) provides that the government must make the following showing to obtain an order for “tangible things,” including “records”:
[A] statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation (other than a threat assessment) conducted in accordance with subsection (a)(2) to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities, such things being presumptively relevant to an authorized investigation if the applicant shows in the statement of the facts that they pertain to—
(i) a foreign power or an agent of a foreign power;
(ii) the activities of a suspected agent of a foreign power who is the subject of such authorized investigation; or
(iii) an individual in contact with, or known to, a suspected agent of a foreign power who is the subject of such authorized investigation
The subsection (a)(2) referred to above states the folloiwing:
An investigation conducted under this section shall—
(A) be conducted under guidelines approved by the Attorney General under Executive Order 12333 (or a successor order); and
(B) not be conducted of a United States person solely upon the basis of activities protected by the first amendment to the Constitution of the United States.
Three thoughts:
1) This is potentially a huge story. If the NSA is getting all call records from every domestic call from Verizon, then that’s a very big deal. And if they’re getting all of those call records, what else are they getting? If they have an order for phone calls, they could also have it for e-mails and other electronic records. This could be just one order among many.
2) One caveat is that The Guardian has the FISC order but was unable to get anyone to say anything about its context. I don’t think we yet know if this 3-page order is what it appears to be, or if there is some other document that may reveal limitations not clear from the 3-page order. Note that the order is titled “Secondary Order,” which presumably means that there is a primary one that it follows; we don’t know what that order said. So while this is potentially a huge story, we don’t yet have substantial certainty that the facts are what they have been reported to be.
3) If the order is what it appears to be, then the order points to a problem in Section 1861 that has not been appreciated. Section 1861 says that the “things” that are collected must be relevant to a national security investigation or threat assessment, but it says nothing about the scope of the things obtained. When dealing with a physical object, we naturally treat relevance on an object-by-object basis. Sets of records are different. If Verizon has a database containing records of billions of phone calls made by millions of customers, is that database a single thing, millions of things, or billions of things? Is relevance measured by each record, each customer, or the relevance of the entire database as a whole? If the entire massive database has a single record that is relevant, does that make the entire database relevant, too? The statute doesn’t directly answer that, it seems to me. But certainly it’s surprising — and troubling — if the Section 1861 relevance standard is being interpreted at the database-by-database level.
Incidentally, I have a section in a forthcoming article pointing out similarly problematic ambiguities in the criminal-investigation surveillance authorities. The statutes don’t speak about particularity of records, making the scale of records something that Congress has left unaddressed. That didn’t matter as much in the past when fewer records were kept, but it matters today; storage is cheap and record-keeping is the norm, making the scale issue extremely important. (I hope to post a draft of that article in a few days; stay tuned.)
4) The court order calls for Verizon to hand over its records on an ongoing basis — that is, in real time — rather than to hand over a stored database that has been created. It’s not obvious to me that Section 1861 can be used to order a provider to hand over a set of records prospectively, as this order does, as that sounds like a pen register/trap and trace device that would have to be governed by the pen register authority in 50 U.S.C. 1842 instead of the authority in 50 U.S.C. 1861. It’s also not obvious to me that it makes a difference, as the standard is the same and the statutory ambiguity as to scope is similar, too. But I thought it an issue worth raising.