The Volokh Conspiracy -

[Orin Kerr, July 11, 2008 at 2:38am] Trackbacks

The New FISA Law -- and the Misleading Media Coverage Of It: I've been studying the new FISA legislation, as well as the press coverage of it, and so far I've found a major disconnect between the two. The MSM is presenting the new legislation as a major expansion of government surveillance powers. Here is how the Eric Lichtblau of the New York Times introduced the Senate's passage of the bill:

The Senate gave final approval on Wednesday to a major expansion of the government’s surveillance powers, handing President Bush one more victory in a series of hard-fought clashes with Democrats over national security issues.
The measure, approved by a vote of 69 to 28, is the biggest revamping of federal surveillance law in 30 years.

  But is that true? The new law is very complicated, and I've only been studying it for a few hours. It's quite possible that I'm missing something important. But based on my first reading, the media coverage of the new law strikes me as quite inaccurate.

  As I see it, the new law takes the basic approach of the Protect America Act of 2007 and adds privacy protections and bolsters the scope of judicial review. On the whole, the new law strikes me as pretty good legislation: It nicely responds to the widely expressed fears last year about how the Protect America Act could be implemented. and it ensures that the FISA Court will play a major role in reviewing surveillance of individuals located outside the U.S. Indeed, it seems to me that the new rules create pretty much the regime that critics of the Protect America Act wanted back in 2007.

  So the question is, why is the press coverage painting such a different picture? I think there's a reason, but it doesn't have very much to do with the new surveillance rules. In this post, I want to summarize how the new surveillance rules compare to those under the Protect America Act of 2007, and then I want to consider why the press is reporting the new law as it is.

  First, a bit of background. The legal rules for monitoring individuals outside the United States has become an important issue under FISA because many foreign Internet and telephone communications are now routed through the United States in the course of delivery. For example, a person in Pakistan who calls another person in Pakistan might have the call routed through New York. This creates an opportunity for monitoring of that communication from inside the network of the provider located in New York.

  The legal question is, what kinds of rules should govern monitoring directed at targets overseas from inside the United States? The original FISA of 1978 wasn't supposed to regulate surveillance of individuals outside the United States, but then back in those days you didn't have foreign to foreign calls routed through the U.S. So what happens when technology changes?

  The Protect America Act of 2007 required the Executive to submit plans for monitoring individuals overseas to the Foreign Intelligence Surveillance Court (FISC). The FISC would then determine whether the monitoring plans were “directed at a person reasonably believed to be located outside of the United States.” So long as it was not “clearly erroneous” that the proposals were “reasonably” so directed, the FISC had to approve the monitoring. The monitoring could occur for one year. See 50 U.S.C. §§ 1805B (2007). But the Protect America Act sunset after six months, requiring new legislation to be passed if Congress wished to authorize such surveillance in the future.

  At the broadest level, the new Act continues the basic approach of the Protect America Act while adding more judicial review in significant ways. As in the Protect America Act, the government submits monitoring plan to the FISC as to whether the monitoring plans were "directed at a person reasonably believed to be located outside of the United States." The FISC then reviews the plan to see whether it does so or not. At the same time, it looks to me like the new law has considerably more judicial review than the Protect America Act.

To read the rest of this post, click here.

  First, the law clarifies that the reverse-targeting that Marty Lederman was very worried about last year under the Protect America Act is forbidden: the government "may not intentionally target a person reasonably believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States." 702(b)(2). Second, the law requires the executive to adopt minimization procedures that have to comply with the traditional FISA minimization rules. 702(e).

  Third, and perhaps most importantly, it looks to me that the statutory review by the FISC is now de novo rather than under a clearly erroneous standard: the court assesses de novo whether the protocols are reasonably designed to be limited to those outside the U.S. and that the minimization procedures satisfy the statutory standards. Sec. 702(i)(2)-(3). Fourth, the FISA court does an independent constitutional analysis: the Court can only sign the order if it finds that the surveillance plan is "consistent with the . . . fourth Amendment to the Constitution of the United States." 702(i)(3)(A).

  Fifth, the new law brings under FISA for the first time the surveillance of U.S. citizens abroad. In the past, this was left to executive order: The government was trusted to comply with the Fourth Amendment and only monitor U.S. citizens abroad in ways that satisfied the Fourth Amendment (whatever that meant, as the rules are rather vague). The new law imposes a statutory warrant requirement for surveillance of U.S. persons abroad: the government must get a FISA Court order based on probable cause to believe the person is an agent of a foreign power located outside the United States. Sec. 704. The law also requires various types of Congressional oversight. See, e.g. Sec. 707.

  Based on my quick look at the news, it seems like the MSM isn't really reporting on this stuff. And when they cover it they're describing the changes as a dramatic expansion of government power, not an addition of restrictions. Why the apparent difference between the media coverage of the new surveillance rules and what seems to be in the law?

  I think there are two major reasons. The main reason is that very few people actually care about these sorts of detailed surveillance rules. What the press cares about is the question of retroactive immunity for the lawsuits challenging the Bush Administration's TSP program that the Times disclosed in 2005. That issue has taken on major symbolic resonance, and the bill also has a provision that for all intents and purposes ends up providing immunity in those lawsuits. To a lot of people, that resolution of the lawsuits has tremendous symbolic importance: To those hoping that the lawsuits would "punish" the Bush Administration for its very likely unlawful monitoring, getting rid of the lawsuits symbolically lets the Administration "get away with" the illegal monitoring. That makes this legislation a win for the Bush Administration. And if you're going to report a Bush Administration win on the big question, who really cares about (and who has the patience to figure out and explain) about the details of those new surveillance rules? So, somewhat weirdly, the story becomes that the law triggered a major expansion of surveillance powers quite apart from what the new rules regulating surveillance actually will be.

  Second, the press seems to be taking as the baseline the pre-Protect America Act state of the law. The Protect America Act of 2007 had a sunset of 6 months: The idea was that Congress would have to renegotiate after the law elapsed. I tend to think that the most accurate way to frame looking at the new law is by reference to the Protect America Act negotiated just last year. Compared to the Protect America Act, the new law looks clearly preferable from a civil libertarian perspective. But the press coverage seems to be comparing the new law to the law before the Protect America Act, when technological change had created an unexpected limit on the scope of government power that pretty much everyone agreed shouldn't be there.

  Anyway, that's my sense based on a first read of the new legislation; it's accurate to my knowledge, but I am not yet an expert in what the law contains. If you think I'm missing something about how the law works, please let me know: I would be delighted to be corrected, the sooner the better. (Oh, and no need to make it seem like a "gotcha" if I missed something; I'm just trying to be accurate, not to score points, so I'm happy if you can help me be more accurare.)

Related Posts (on one page):

Assessing Surveillance Laws in An Era of Sunset Provisions:
Strange Op-Ed By Chris Hedges:
The New FISA Law -- and the Misleading Media Coverage Of It:

Comments

[Orin Kerr, July 15, 2008 at 2:33am] Trackbacks

Assessing Surveillance Laws in An Era of Sunset Provisions: In my blog post last week on the new FISA Amendments, and a follow-up on Friday, some commenters expressed strong disagreement — and in some cases, downright contempt — at my view that the most natural baseline for assessing the latest FISA Amendments was last year's FISA law, the Protect America Act. Our disagreement raises a conceptually interesting question: How should we characterize the direction of new surveillance laws in an era when so many surveillance laws are being subject to sunset provisions? And applying that to the specific case here, is the Protect America Act the right baseline for the new FISA Amendments?

  I think the question is tremendously important. Statutory laws require a feedback loop: The public needs to know if their policy preferences are being enacted into law. But the details of surveillance law are a mystery to 99.99% of the population. The laws are arcane and technical, which means that the only way most people will get a sense of the direction of the law is second-hand. In my view, this puts intense pressure on those of us who want to write on these issues in a public forum to get it right. The democratic process only works correctly if we describe the law accurately. If our writings don't accurately describe what is happening, over time the law will no longer match public preferences in the way that they should in a democratic system.

  Reporting on the direction of the law is particularly tricky when Congress uses sunset provisions. A sunset provision makes the new law temporary: After a period of time, the new provision elapses and we revert to the old law (pending the likely passage of some new legislation). Sunsets let Congress experiment with different rules and see how they work out; near the end of the sunset period, Congress can have hearings and then decide whether to stick with the old law or try something new.

  Congress's heavy reliance on sunset provisions in surveillance law is one of the most interesting developments in the surveillance law of the post 9/11 era. As far as I know, the Patriot Act's sunset provisions were the first to use this: About half of the surveillance law changes in the original Patriot Act of 2001 sunsetted at the end of 2005. The Protect America Act of 2007 picked up the idea, sunsetting after 6 months but allowing orders granted under it to be valid for a year after they were issued. The new FISA Amendments also use sunsets: the new law expires at the end of 2012.

  So what baseline should we use when reporting on these issues? Here's my best sense: The most accurate and principled way to report on changes to surveillance laws in an era of sunset provisions will usually be to compare each new provision to the prior provision Congress negotiated. With an important exception, we should ordinarily compare new rules to sunsetting or recently sunset old rules.

  I think this is the case for three reasons. First, my sense is that this view matches the understanding of the institutional players in Congress and the Executive branch. Congress has pushed the use of sunsets to ensure that the baseline negotiated today can be renegotiated tomorrow; as the old law sunsets, the new law becomes the baseline for where the new law will go. The understanding of the parties is that the sunsetting law will be the future baseline.

  For example, the sunsetting Patriot Act provisions became the standard for how the law would change when Congress negotiated the next step at the end of 2005. Congress had hearings on whether or how to renew or amend pretty much every single sunsetting provision, no matter how minor. Similarly, my understanding is that the Protect America Act became the baseline for the negotiation of the new FISA Amendments. Given that this is the expectation of the institutional players when they insist on (or fight against) sunset provisions, I think it makes sense to track that understanding.

  Second, sunset provisions have become sufficiently common in surveillance law that any other baseline becomes rather arbitrary. As I see it, sunset provisions are here to stay: They seem to have become the new norm in surveillance law. If I'm right about that, my concern is that looking back to the pre-sunset law as the standard mostly just looks back to the era before sunsets were common rather than to any objectively "neutral" standard. In the case of surveillance of individuals overseas, for example, Congress's realization of the new technology allowing surveillance from inside the U.S. of individuals abroad led first to the Protect America Act for between 6 and 18 months (depending on how you look at it), then the new law for the next 52 months or so, and then we'll have something else new when the 2008 law expires in 2012. We may keep going on sunset provisions after that, too: we'll keep renegotiating every few years off into the future.

To read the rest of this post, click here.

  Finally, I think the prior negotiated law is a good baseline because the passage of a new law with a sunset is a front page story of legal change while the reversion back to the pre-sunset version generally is not. When Congress passes a new surveillance law, the papers and op-ed writers usually decry the law and say it is a radical shift that guts protections. But when the sunset expires, we don't get that in reverse: we don't see the same writers celebrate the reversion and say it is a radical shift that drastically enhances protections. The reason relates to reason #1 above, I think: the understanding is that the law isn't permanently reverting, but rather being renegotiated, so it would be odd to report the change as if it were permanent.

  If we adopt pre-sunset law as the standard, the law and the press coverage can diverge in a pretty bizarre way. Imagine Congress enacts a new sunsetting law every year in a particular area, and further imagine that the new law always becomes more privacy protective than the prior year's. In that case, the press coverage will announce every year that the old law has been gutted and privacy diminished while actually the law will be becoming more privacy protective every year rather than less. If you're an interested citizen and you want to know what's happening in surveillance law, press coverage that uses the pre-sunset baseline is going to leave you with a pretty dramatic misimpression.

  I hope this explains to readers why I think the PAA is the right baseline for reporting on the new FISA Amendments. My understanding is that Congress intended it that way; my sense is that such sunsets are here to stay; and I think it leads to the most accurate overall impression of the direction of the law for the public that wants to know where the law is heading. So I think it's the best standard to use.

  Finally, let me add that there is an exception to this general rule. In some cases, so much time will have has passed after a provision has expired that the sunset provision will no longer be considered the standard for Congressional negotiations. If Congress lets a sunset expire and then a good chunk of time passes under the reverted law, then eventually the reverted law becomes the standard.

  But I don't think that exception means the PAA isn't the standard here. First, while the Protect America Act expired on February 17, 2008, the surveillance orders issued under the Act did not expire. They are valid for a year, and it has been less than a year since the PAA was enacted. Second, my understanding is that Congress did in fact take the PAA as the baseline when the new law was negotiated. Third, it's important to recognize that pre-PAA warrant requirement was a coincidence of technological change, not a knowing Congressional decision. Congress didn't know until the Times story broke in December 2005 that lots of foreign to foreign communications were being routed through the U.S. and that they could be monitored there. As a result, Congress didn't realize that the FISA statute was imposing a warrant requirement on the surveillance of foreign to foreign communications in that setting. The PAA is the first statute that tried to regulate this type of surveillance knowing that the category of surveillance in fact existed. Given that, it seems like a particularly sensible baseline to apply.