Is the USA Freedom Act the Best We Can Expect Right Now?
Tech. privacy-oriented Rep. Zoe Lofgren explains her reluctant support for limited reform.
It doesn't appear to be easy to support the USA Freedom Act. The Act's full real name is the "Uniting and Strengthening America by Fulfilling Rights and Ending Eavesdropping, Dragnet-Collection, and Online Monitoring Act." Knowing the full name of the act helps explain why privacy supporters aren't shouting from the rafters over the legislation, even if they are supporting it. As is the case with many other bills with elaborate names, the USA Freedom Act doesn't actually do what its name states.
The USA Freedom Act (H.R. 2048) is Congress' response to the public revelation and the following outrage that the National Security Agency (NSA) has been for years secretly collecting mass amounts of domestic metadata from virtually all Americans as part of its goal of sniffing out terrorists. It has been doing so under the aegis of Section 215 of the PATRIOT Act, which allows the NSA and FBI to collect all sorts of data and records that are relevant to an ongoing investigation.
But the NSA and the Foreign Intelligence Surveillance (FISA) Court that oversaw approval of records collection requests took a very, very wide view of what was "relevant," and that included, among other things, the phone records of every single American. There was an awareness among privacy experts that this was happening, but because the entire process was classified, the ability for anybody, even members of Congress, to do much about it was limited.
Then Edward Snowden came around and released information showing how remarkably expansive the NSA surveillance actually was. This all came as a surprise to Rep. James Sensenbrenner (R-Wis.), who introduced the PATRIOT Act in 2001. He said it was never his intent to authorize mass collection of the data of Americans in the first place. The USA Freedom Act, which Sensenbrenner has also sponsored, is intended to reform these procedures.
But what the USA Freedom Act actually does is fairly modest compared to the amount of surveillance authority the NSA had claimed for itself. It will end the bulk collection of phone metadata collection under Section 215, but that's not the only avenue by which the federal government claims authority to collect huge amounts of private information. Furthermore, right now we're seeing the third attempt to get the act passed, and the strength of the reforms has been watered down along the way. Indeed, some of the reforms called for in the act (storing the telecommunications data with the companies rather than the government and requiring the government to request it) came from former NSA Director Keith Alexander. The support of the Obama Administration has itself given some pause, due to its role in fighting lawsuits against the program and the blatant deception of current Director of Intelligence James Clapper before the Senate about the existence of mass phone record collection.
What the USA Freedom Act is intended to do is end mass domestic data collection through Section 215, as well as in the secretive National Security Letters, and require "specific selection terms" to limit mass records requests. It also reforms the FISA court to designate several independent advisors to the court to help provide "legal arguments that advance the protection of individual privacy and civil liberties," making the FISA court a slightly more adversarial place rather than the apparent rubber stamp factory it had been. It will also mandate a declassification review process for FISA court decisions.
But it's also really hard to try to gauge the impact of the bill as written, and that's coloring perceptions of its value. Making the situation more complicated is a federal court ruling that is actually friendly to privacy reformers. On May 7, the Second Circuit Court of Appeals ruled that Section 215 never actually authorized the NSA to engage in mass phone metadata collection in the first place. The court ruled that the NSA had stretched the definition of "relevance" and "investigation" too far by scooping up pretty much everything and storing it just in case it might be useful later. But the court also did not demand any immediate changes, partly because it knew Congress was already working on legislation to deal with the pending sunsetting of Section 215, which expires June 1.
This ruling prompted some rethinking of the USA Freedom Act by the Electronic Frontier Foundation (EFF). The group had previously endorsed each iteration of the act, increasingly reluctantly as it was watered down with each session. In response to the court ruling, though, EFF withdrew its support and went neutral, calling for legislators to now strengthen the act.
Mark Jaycox, a legislative analyst for EFF who has been writing about the USA Freedom Act, still has positive things to say about it, but doesn't want Congress to settle for less than it has to. It's the first reform of NSA surveillance since the 1970s. There should be more to it.
"The USA Freedom Act should be stronger," Jaycox says. "Congress should be pushing for more control for themselves and more for the public." EFF would like Congress to return to the first iteration of the act that called for a stronger adversarial position within the FISA court, not just an adviser. They want Congress to address other authorizations used to justify bulk metadata collection, not just Section 215 and National Security Letters. They want better "minimization" procedures to make sure information that isn't directly connected to an investigation is properly purged. And they want to remove an "emergency exception" that allows the government to snoop on any "non-United States person" for 72 hours without any court authorization at all.
Given that the court ruling determined that the NSA had been operating outside of the law's intent, should we be concerned that any attempt to partly rein in surveillance powers without completely eliminating them will ultimately lead back to more abuse? Who gets to decide what a "specific selection term" is? The same people who determined that every single phone record of every American was "relevant" to investigating potential terrorist attacks on Americans? Jaycox is aware that this abuse concern helps feed the belief the USA Freedom Act doesn't go nearly far enough.
"We've seen the intelligence community and the administration stretch definitions," Jaycox says. "We've seen them come up to the line and cross it completely. Section 215 is an example. I think that's where the hesitancy comes from." It's the FISA court that was supposed to stand in the way of the NSA abusing the language, but that clearly didn't happen. Congress can legislate words to be as narrow as they like, Jaycox notes, "But at the end of the day it's going to be a judge that's reviewing these orders." And thus, there's the push for more transparency and declassification of FISA court decisions, in the hopes of making it more clear how the judges themselves are interpreting the law.
The modest reforms weren't enough for some privacy-minded House members like Rep. Justin Amash (R-Mich.), Rep. Thomas Massie (R-Ky.), and Rep. Jared Polis (D-Colo.). They all voted no. Amash later explained on Facebook that he feared passing the USA Freedom Act in the wake of the court ruling would have the impact of authorizing bulk data collection rather than restricting it: "H.R. 2048 falls woefully short of reining in the mass collection of Americans' data, and it takes us a step in the wrong direction by specifically authorizing such collection in violation of the Fourth Amendment to the Constitution. Americans, and members of Congress, should demand that Congress instead pass the original, bipartisan version of the USA FREEDOM Act from 2013, which strengthened—not weakened—Section 215's relevance standard to end bulk collection, while still allowing the government the flexibility it needs to pursue genuine threats against the United States." And this morning Amash posted a letter signed by him and 58 others in the House who voted no, explaining that their opposition to the USA Freedom Act was tha the surveillance reforms did not go far enough.
Breaking from this group, reluctantly, was Rep. Zoe Lofgren (D-Calif.). Lofgren had previously yanked her support for earlier versions of the USA Freedom Act for the same reasons as Amash. She felt the Act had been significantly weakened. But this time she voted aye, even though her attempt to amend it to make it stronger failed (no amendments were permitted at all).
"It does reform bulk collection under [Section] 215," Lofgren said in a phone interview. "I think that was a major objective, and we've made progress there. … It doesn't go as far as I like, but it's better than existing law."
But as it stands, Lofgren's own support is tenuous. Her vote in favor of the USA Freedom Act is predicated on her understanding that the other forms of bulk data collection completely unconnected from Section 215 will be subsequently addressed by Congress, and she says she has the support of House Judiciary Committee Chairman Bob Goodlotte (R-Va.) there. She had also previously worked with Massie to introduce legislation to defund "backdoor" warrantless searches of data the government had already collected and stopped the government from attempting to force companies to insert security vulnerabilities into their services/technology to make government surveillance easier. Though this amendment passed in the House by a wide margin last December, it was blocked from inclusion in the omnibus spending bill and died anyway. Lofgren wants it back, and made it clear on the House floor she would again yank her support if it appeared that USA Freedom Act was the only surveillance reform that was going to happen:
The possibility of a fake sense of finality is a worry for privacy legislators. Is the USA Freedom Act all Americans are going to get? If the act passes the Senate, will there be a concerted effort to declare that the issue of domestic surveillance is taken care of and that further action is not necessary? Will these modest reforms be presented as being much more than they are? It's definitely a concern, Lofgren says.
"I think we should always be worried, but that's why we spoke so forcefully. If you say we've ended bulk collection that's not correct," she says.
