On February 3, 2015, the Administration announced numerous changes to surveillance activities to protect privacy and civil liberties, including reforms to its Minimization Rules – last updated in July 2014 and released publicly as part of the announcement – for Section 702, concerning retention and use of communications of or about US persons. Some of these reforms are significant improvements, but they do not adequately address ongoing problems with overbroad collection, retention, and use of information pursuant to Section 702.
New Restrictions on Use as Evidence in Criminal Cases:
Previously, Section 702 Minimization Guidelines (including the 2009 Guidelines leaked by Edward Snowden, the 2011 Guidelines released by the government in 2013, and the 2014 Guidelines released last week) permitted NSA to retain, share, and use communications of or about US persons that may constitute evidence of any crime. Under the new policy announced on February 3, such information “will not be introduced as evidence against that [US] person in any criminal proceeding except 1) with the approval of the Attorney General, and 2) in criminal cases with national security implications or certain other serious crimes,” a policy similar to Recommendation 12(2) by the President’s Review Group.
DNI General Counsel Robert Litt specified that “serious crimes” is limited to crimes involving: 1) death, 2) kidnapping, 3) substantial bodily harm, 4) conduct that constitutes a criminal offense that is a specified offense against a minor as defined in 42 USC 16911, 5) incapacitation or destruction of critical infrastructure as defined in 42 USC 5195c(e), 6) cybersecurity, 7) transnational crimes, and 8) human trafficking. This list is imperfect;notably, “criminal cases with national security implications” and “crimes involving cybersecurity” are undefined, and could be applied in an overbroad manner. Further, it does not appear in the Minimization Guidelines themselves, and could be expanded at any time. However, it represents a substantial improvement over current minimization practices, which allows use of information collected under Section 702 for prosecution of any domestic crime, including misdemeanors and non-violent offenses.
Continued Overbroad Retention and Use for Law Enforcement Investigations:
Although use as evidence in criminal cases is curtailed as set forth above, the new policy contains a significant loophole that will permit continued retention, dissemination, and some uses of US persons’’ communications collected under Section 702 that contain evidence of any crime. While the new policy restricts use of such communications as evidence in prosecutions, it does not limit retention or other uses by law enforcement. Therefore, communications of or about US persons believed to contain evidence of any crime could still be retained for years, as is currently permitted.
While this information could not be used as evidence in criminal proceedings (except for the serious crimes as set forth above) NSA could still disseminate this information to law enforcement for use in investigations. This is especially troubling given the DEA’s use of parallel construction to rely on information obtained through intelligence surveillance, then obscure the source of information provided by the Intelligence Community so that the defendant is unaware. In 2013 the Department of Justice changed its policy and began providing defendants notice when information obtained from Section 702 is used, but questions remain as to whether the scope of this notification policy is sufficient. And even if notification is eventually provided, the government could still use communications obtained using Section 702 as the foundation for investigation of minor domestic crimes, so long as it gathers other evidence for the purpose of prosecution.
If the Administration is sincere in its commitment to limiting the range of crimes that information on US persons obtained through Section 702 can be used for, it should change the Minimization Guidelines – and support statutory reform – that requires communications of or about US persons that does not contain evidence of the crimes listed above (or foreign intelligence information) be immediately purged upon discovery.
New Restrictions on US Person Querying:
The policies announced on February 3 also create new restrictions on the NSA’s ability to querying its database of Section 702 communications for the communications of US persons. This practice is commonly referred to as the “backdoor search loophole” because if the NSA wanted to conduct the surveillance of the US person directly, it would be a “search” that would require a full FISA court order based on a finding of probable cause that the US person is a terrorist, spy, or other agent of a foreign power. Previously, minimization procedures vaguely required that querying construction be “reasonably likely to return foreign intelligence information,” effectively allowing NSA to deliberately seek out in a vast database of content collected under Section 702 Americans’ communications without judicial authorization. Under the new rules, the NSA and CIA will be permitted to query the database with US person identifiers (a unique identifier associated such as a name, phone number, email address, etc.) only after developing “a written statement of facts showing that a query is reasonably likely to return foreign intelligence information,” as recommended by the Privacy and Civil Liberties Oversight Board in its report on Section 702. This is a step forward for preventing some potential abuse posed by the backdoor search loophole, but it is a far cry from requiring a judicial finding of probable cause that the person whose communications are sought is an agent of a foreign power, as Senator Wyden has proposed to close the backdoor search loophole.
While the NSA will be prohibited from searching the Section 702 database for an American’s communication with the goal of gathering evidence for domestic criminal investigations that have no national security implications, or simply gathering personal information that could be used to hold a person in disrepute (troublingly, it is unclear whether the FBI will be similarly restricted), it could still query the data base — and obtain the contents of the US person’s communications — for broad foreign intelligence purposes, such as when the analyst thinks the query would disclose information necessary to the conduct of US foreign affairs or US national security. In addition, an NSA analyst, not a judge, would decide whether obtaining the US person’s communications was proper. The new restrictions reflect the privacy interest in Americans’ communications being queried, but falls short of providing the protection that privacy interest is due.