Judge Says NSA Bulk Metadata Collection Likely Unconstitutional, Issues Injunction

Privacy

from the stayed-for-appeal dept

Well, this is big, big news. Judge Richard Leon, a judge in the DC district court, has ruled that the NSA’s bulk metadata collection should be stopped as violating the 4th Amendment, though he’s put the ruling on hold, knowing that it will be appealed. This is the first major court ruling concerning the program, and the judge is pretty clear that it’s a 4th Amendment violation even though the FISA court approved it. The case is actually two different cases brought by Larry Klayman, the founder of Freedom Watch, over the NSA’s activities. Here’s the key bit:

The Court finds that it does… have the authority to evaluate plaintiffs’ constitutional challenges to the NSA’s conduct, notwithstanding the fact that it was done pursuant to orders issued by the Foreign Intelligence Surveillance Court (“FISC”). And after careful consideration of the parties’ pleadings and supplemental pleadings, the representations made on the record at the November 18, 2013 hearings regarding these motions, and the applicable law, the Court concludes that plaintiffs have standing to challenge the constitutionality of the Government’s bulk collection and querying of phone record metadata, that they have demonstrated a substantial likelihood of success on the merits of their Fourth Amendment claim, and that they will suffer irreparable harm absent preliminary injunctive relief.

The ruling is worth reading, going through the legal history and details of the program. While it notes that the plaintiffs and the government (not surprisingly) explain the bulk metadata collection very differently, the court says that even if it accepts the government’s explanation, it still likely violates the 4th Amendment. That’s important.

Even while accepting the government’s description of the system, it appears, thankfully, that Judge Leon is not being confused and suckered by the government’s attempt to mislead. For example, in a footnote (21) the judge shows that he completely understands that the NSA is being exceptionally misleading when it implies that within all of that metadata, it’s just looking at fewer than 300 individuals.

After stating that fewer than 300 unique identifiers met the RAS standard and were used as “seeds” to query the metadata in 2012, Ms. Shea notes that “[b]ecause the same seed identifier can be queried more than once over time, can generate multiple responsive records, and can be used to obtain contact numbers up to three ‘hops’ from the seed identifier, the number of metadata records responsive to such queries is substantially larger than 300, but is still a very small percentage of the total volume of metadata records.” (emphasis added). The first part of this assertion is a glaring understatement, while the second is virtually meaningless when placed in context. First, as the sample numbers I have used in the text above demonstrate, it is possible to arrive at a query result in the millions within three hops while using even conservative numbers–needless to say, this is “substantially larger than 300.” After all, even if the average person in the United States does not call or receive calls from 100 unique phone numbers in one year, what about over a five-year period? And second, it belabors the obvious to note that even a few million phone numbers is “a very small percentage of the total volume of metadata records” if the Government has collected metadata records on hundreds of millions of phone numbers.

But it’s also easy to imagine the spiderweb-like reach of the three-hop search growing exponentially and capturing even higher numbers of phone numbers. Suppose, for instance, that there is a person living in New York City who has a phone number that meets the RAS standard and is approved as a “seed.” And suppose this person, who may or may not actually be associated with any terrorist organization, calls or receives calls from 100 unique numbers, as in my example. But now suppose that one of the numbers he calls is his neighborhood Domino’s Pizza shop. The Court won’t hazard a guess as to how many different phone numbers might dial a given Domino’s Pizza outlet in New York City in a five-year period, but to take a page from the Government’s book of understatement, it’s “substantially larger” than the 100 in the second hop of my example, and would therefore most likely result in exponential growth in the scope of the query and lead to millions of records being captured by the third hop.

Judge Leon is also well aware of the newly declassified rulings from FISC judges Walton and Bates detailing regular and drastic non-compliance by the NSA. While Judge Leon does admit to lacking jurisdiction over claims that the program violates the Administrative Procedures Act, it’s the constitutional questions that are the big ones, and he does not shy away there. He notes that the FISA law does not include an expressed right of judicial review — but neither does it bar it. And, since Congress “should not be able to cut off a citizen’s right to judicial review of… Government action simply because it intended for conduct to remain secret,” he finds that the court has the authority to rule on the constitutional issues.

On the question of standing (where the government often wins since individuals can’t prove they’ve been spied on), the court sides with the plaintiffs — noting that there’s strong evidence to suggest their info has, in fact, been collected.

First, as to the collection, the Supreme Court decided Clapper just months before the June 2013 news reports revealed the existence and scope of certain NSA surveillance activities. Thus, whereas the plaintiffs in Clapper could only speculate as to whether they would be surveilled at all, plaintiffs in this case can point to strong evidence that, as Verizon customers, their telephony metadata has been collected for the last seven years (and stored for the last five) and will continue to be collected barring judicial or legislative intervention…. In addition, the Government has declassified and authenticated an April 25, 2013 FISC Order signed by Judge Vinson, which confirms that the NSA has indeed collected metadata from Verizon.

Judge Leon further mocks the Government’s attempts to argue no standing, noting that their own arguments appear to contradict themselves:

Straining mightily to find a reason that plaintiffs nonetheless lack standing to challenge the metadata collection, the Government argues that Judge Vinson’s order names only Verizon Business Network Services (“VBNS”) as the recipient of the order, whereas plaintiffs claim to be Verizon Wireless subscribers. The Government obviously wants me to infer that the NSA may not have collected records from Verizon Wireless (or perhaps any other non-VBNS entity, such as AT&T and Sprint). Curiously, the Government makes this argument at the same time it is describing in its pleadings a bulk metadata collection program that can function only because it “creates an historical repository that permits retrospective analysis of terrorist-related communications across multiple telecommunications networks, and that can be immediately accessed as new terrorist-associated telephone identifiers come to light.”

[….] Put simply, the Government wants it both ways. Virtually all of the Government’s briefs and arguments to this Court explain how the Government has acted in good faith to create a comprehensive metadata database that serves as a potentially valuable tool in combating terrorism–in which case the NSA must have collected metadata from Verizon Wireless, the single largest wireless carrier in the United States, as well as AT&T and Sprint, the second and third-largest carriers…. Yet in one footnote, the Government asks me to find that plaintiffs lack standing based on the theoretical possibility that the NSA has collected a universe of metadata so incomplete that the program could not possibly serve its putative function. Candor of this type defies common sense and does not inspire confidence!

In terms of the actual constitutional analysis, Judge Leon takes on directly the issue of metadata collection in Smith v. Maryland, the key case that the NSA and its defenders repeatedly rely on to insist that there is no 4th Amendment rights in information stored by third parties. Judge Leon notes that issue here is very different.

The question before me is not the same question that the Supreme Court confronted in Smith. To say the least, “whether the installation and use of a pen register constitutes a ‘search’ within the meaning of the Fourth Amendment,” … — under the circumstances addressed and contemplated in that case–is a far cry from the issue in this case.

Indeed, the question in this case can more properly be styled as follows: When do present-day circumstances–the evolutions in the Government’s surveillance capabilities, citizens’ phone habits, and the relationship between the NSA and telecom companies–become so thoroughly unlike those considered by the Supreme Court thirty-four years ago that a precedent like Smith simply does not apply? The answer, unfortunately for the Government, is now.

From there, he relies on the US v. Jones case, which we’ve discussed extensively as well, in which the court found that attaching a GPS device to a car could be a 4th Amendment violation. He notes there that the court similarly looked at the differences in that case as compared to a previous precedent, and notes that the same situation likely applies here, vis-a-vis comparisons to Smith:

For the many reasons discussed below, I am convinced that the surveillance program before me is so different from a simple pen register that Smith is of little value in assessing whether the Bulk Telephony Metadata Program constitutes a Fourth Amendment search. To the contrary, for the following reasons, I believe that bulk telephony metadata collection and analysis almost certainly does violate a reasonable expectation of privacy.

He then goes into a detailed and thorough dismantling of Smith and why it clearly doesn’t apply to this program — noting how Smith was a very limited data collection, rather than a “collect it all” process. He even refers to the current program as “Orwellian.” Furthermore, he implicates the close relationship between the NSA and the telcos, noting that this is entirely different from Smith, where police made a specific request to the telcos to turn over specific information — rather than the telcos automatically handing over all info for the NSA to keep.

It’s one thing to say that people expect phone companies to occasionally provide information to law enforcement; it is quite another to suggest that our citizens expect all phone companies to operate what is effectively a joint intelligence-gathering operation with the Government.

Finally, he points out that the amount of metadata in question is significantly more detailed and revealing than what was captured in the Smith case:

…the ubiquity of phones has dramatically altered the quantity of information that is now available and, more importantly, what that information can tell the Government about people’s lives…. Put simply, people in 2013 have an entirely different relationship with phones than they did thirty-four years ago.

In this, it appears that Judge Leon was convinced by Ed Felten’s declaration which, as we noted, went into great detail about how much metadata could reveal about a person today.

In the end, he says that Smith is simply the wrong case:

In sum, the Smith pen register and ongoing NSA Bulk Telephony Metadata Program have so many significant distinctions between them that I cannot possibly navigate these uncharted Fourth Amendment waters using as my North Star a case that predates the rise of cell phones…. As I said at the outset, the question before me is not whether Smith answers the question of whether people can have a reasonable expectation of privacy in telephony metadata under all circumstances. Rather, the question that I will ultimately have to answer when I reach the merits of this case someday is whether people have a reasonable expectation of privacy that is violated when the Government, without any basis whatsoever to suspect them of any wrongdoing, collects and stores for five years their telephony metadata for purposes of subjecting it to high-tech querying and analysis without any case-by-case judicial approval.

Finally, in looking at the government’s insistence that the program is necessary, Judge Leon is not convinced. He notes examples of them saying it can help them do their job faster, but none of it is actually stopping an attack. In fact, he notes that for all the talk of doing the job faster, there’s not been a single shred of evidence presented that it helped stop an imminent attack, where that kind of speed would matter. In fact, he notes, “none of the three ‘recent examples’ cited by the Government [for the need for this program] involved any apparent urgency.” In short, Judge Leon is calling the government’s bluff. Their only reason for needing the program is the speed it provides, but then they present no evidence of any cases where that speed was important.

Thus, the end result is an injunction against the metadata collection, but recognizing the inevitable appeal, that injunction is stayed pending appeal. This is a very good decision, but this is just the beginning.

Filed Under: 4th amendment, bulk metadata, larry klayman, metadata, nsa, patriot act, richard leon, section 215, smith v. maryland, standing, surveillance