The NSA's Spying Powers: Reading the Statute

[Ed. note -- We are pleased to feature a guest post today by Kit Walsh of the Harvard Law School Cyberlaw Clinic. More information on Kit and Kit's practice can be found here.]

In the midst of confusion over the NSA's spying powers, evenmembers of Congress who voted for the applicable laws claim surprise at howthey are playing out in practice. With defenders of spying saying to “read thestatute” to understand its privacy protections, I thought I'd do just that.

Say I'm the NSA and I want to legally justify a court ordergiving me access to private emails of Occupy activists (so I can join in the FBIand DHSsurveillance of peaceful protesters, for example). It's a domestic politicalmovement, so that sounds as if it should be pretty hard, right? Let's see...

Just to challenge ourselves, we'll ignore the several statutory provisions andother doctrines that allow for spying without court oversight, such as urgentcollection, gathering information not considered protected by the FourthAmendment, the wartime spying provision, or the president's "inherentauthority" for warrantless spying. Let's also ignore the fact that we havegeneral wiretaps ala the Verizonorder on phone metadata and Internet traffic that we can fish through insecret. Let's actually try to get this by the FISA Court under 50 U.S.C.§§ 1801-1805 for electronic surveillance or § 1861 for documents and records.

First Hurdle: I need "probable cause" to believe the"target" is a "foreign power" or "agent of a foreignpower." This is great - I don't need probable cause of any crime, just something relating to theidentity of the "target." And if the "target" of myinvestigation meets those criteria, I can slurp up all sorts of data about USpeople, subject only to toothless "minimization" requirements I'lldiscuss in step 2. To obtain stored records such as emails, it's even easier. The court is instructed to presume that I am entitled to an order to get those records if I can just show "reasonable grounds to believe" the records are "relevant to" investigating a foreign power or an agent of a foreign power or someone "known to" a suspected agent of a foreign power.

So, can I consider "Occupy" itself to be a foreign power? Believe itor not, any foreign-based politicalorganization qualifies unless it is "substantially composed" of USpersons. So all the Occupy branches in other parts of the world, and theiragents, are valid "targets" for surveillance (as well as AdBusters,the Canadian organization that first called for an occupation of Wall Street).That's a great start. I bet a lot of the domestic Occupiers are within one ortwo links of a person directly communicating with a "foreign power"or one of their "agents," so I'll ask for their communications aspart of my "targeting" the foreigners. Actually, some of theforeign-run banks and corporations they're protesting might qualify as validforeign targets, too. I'll "target" them... by reading emails ofpeople talking about their actions, and maybe their private intelligence aboutthe protesters.

Second Hurdle: I'm going to have to "minimize" the data I collectabout US persons. But wait! I don't have to minimize if it's evidence of a"crime" that has been or might be committed. All of Occupy's civildisobedience organizing is fair game for surveillance. I bet I can findevidence of drug crimes in here, too, and who knows what else? That'll give thestate some leverage in case these uppity protesters get out of hand. I alsohave the general "national security" and "foreign affairs"exceptions to minimization, which might help if the protesters plan todemonstrate at sites relevant to national security or at diplomatic summits. Ofcourse, the court can require me to minimize even in those circumstances, butthey don't have to, and no one will ever know one way or the other. Besides,the secret "minimization" procedures may sound good to laypeople, butanyone who follows privacy research knows that it's really easy to re-identifypeople from anonymized records if you have other databases to correlate dataagainst, and boy do we ever!

Third Hurdle: Maybe tech companies won't like it. But I have a court order, andI already