Skip Navigation

NSA Data Collection: A Legal Dance

Following the revelation that the NSA was collecting phone records of millions of customers, how did the FBI and NSA maneuver rules and regulations to collect, mine, and use collected data?

Cross­pos­ted on Balkiniz­a­tion.
Many ques­tions remain about the revel­a­tions that the NSA has been receiv­ing the phone records of all of Veri­zon’s domestic custom­ers, almost in real-time, appar­ently for the past seven years. Among them are the fact that while it’s the FBI that asked the secret­ive Foreign Intel­li­gence Surveil­lance Court to order Veri­zon to provide the records, the leaked FISC order indic­ates that all of the data goes the National Secur­ity Agency. [A quick caution: Read­ers with secur­ity clear­ances who weren’t permit­ted to review Wikileaks docu­ments may not want to read the order, as it’s highly clas­si­fied.]
So why do the docu­ments go to the NSA? The obvi­ous answer is that the NSA has the biggest comput­ing and data-crunch­ing capa­city around, and this is a LOT of data. There are some inter­est­ing legal quirks that arise from this bisec­ted approach, though. This post attempts to walk through them – and I welcome correc­tions or comments if I’ve gone off-course some­where.
Let’s start with the order. It was issued under Section 215 of the Patriot Act, also known as the “busi­ness records” provi­sion. Under Section 215, the FBI (and only the FBI) can ask the FISA Court to issue a secret order requir­ing a busi­ness to produce “any tangible things” (records, docu­ments, etc.). The applic­a­tion for the order must be suppor­ted by a state­ment of facts show­ing that the records are “relev­ant” to an author­ized coun­terter­ror­ism or coun­ter­in­tel­li­gence invest­ig­a­tion (or an invest­ig­a­tion to obtain foreign intel­li­gence inform­a­tion not concern­ing a U.S. person, which does­n’t seem relev­ant here). So the FBI has to identify a specific invest­ig­a­tion to which these records are relev­ant, and it must be a predic­ated invest­ig­a­tion, not an “assess­ment” (which is the ostens­ibly low-level but quite intrus­ive author­ity under which the FBI invest­ig­ated Tamer­lan Tsarnaev).  
The stat­ute also requires the Attor­ney General to adopt minim­iz­a­tion proced­ures (reten­tion and dissem­in­a­tion limit­a­tions) for the mater­i­als the FBI receives. This require­ment only kicks in, however, when the FBI receives inform­a­tion in response to the order. And the FBI does­n’t receive this inform­a­tion: the NSA does.  
So that gets us to the NSA. Exec­ut­ive Order 12333, issued in 1981 by Pres­id­ent Reagan, gener­ally governs how intel­li­gence agen­cies collect and use inform­a­tion about U.S. persons (citizens and lawful perman­ent resid­ents, plus many corpor­a­tions). EO 12333 seems to author­ize fairly gener­ous collec­tion, reten­tion, and dissem­in­a­tion of U.S. person inform­a­tion, as long as (among other things) the inform­a­tion is “obtained in the course of a lawful foreign intel­li­gence, coun­ter­in­tel­li­gence, … or inter­na­tional terror­ism invest­ig­a­tion.” That is, the kind of invest­ig­a­tion for which a section 215 order is avail­able.
Under EO 12333, the head of each intel­li­gence agency must issue minim­iz­a­tion proced­ures detail­ing the permiss­ible collec­tion, reten­tion, and dissem­in­a­tion of inform­a­tion about U.S. persons, includ­ing inform­a­tion gathered during a coun­ter­in­tel­li­gence or coun­terter­ror­ism invest­ig­a­tion, which is presum­ably what’s involved here.
For the NSA, those minim­iz­a­tion proced­ures would be Depart­ment of Defense regu­la­tion 5240.1-R, which seem to be *more* restrict­ive than EO 12333. That is, these proced­ures don’t say that any inform­a­tion can be collec­ted as long as it’s relev­ant to a coun­terter­ror­ism or coun­ter­in­tel­li­gence invest­ig­a­tion. Instead, they say inform­a­tion can be collec­ted about a U.S. person only if (1) the inform­a­tion consti­tutes foreign intel­li­gence (basic­ally inform­a­tion about foreign­ers) AND (2) the U.S. persons are “reas­on­ably believed to be engaged or about to engage, in inter­na­tional terror­ist … activ­it­ies.” (There are a few other circum­stances, which I don’t think are relev­ant here.) If the inform­a­tion consti­tutes coun­ter­in­tel­li­gence (inform­a­tion gathered to protect against vari­ous foreign activ­it­ies) rather than foreign intel­li­gence, the U.S. persons must be “reas­on­ably believed to be engaged in, or about to engage in, intel­li­gence activ­it­ies on behalf of a foreign power, or inter­na­tional terror­ist activ­it­ies.” So the people whose inform­a­tion is collec­ted by the NSA need to be actively enga­ging, or about to be engaged in some­thing nefar­i­ous – they can’t just be vaguely relev­ant to an invest­ig­a­tion.
However, as others have noted as well, the regu­la­tions have a partic­u­larly restrict­ive and some­what pecu­liar defin­i­tion of collec­tion: “data acquired by elec­tronic means” is collec­ted ONLY “when it has been processed into intel­li­gible form.” This has two implic­a­tions. First, this might be why the FISA order specific­ally directs Veri­zon to send the NSA an elec­tronic copy of the data: so that the produc­tion does­n’t auto­mat­ic­ally trig­ger the “collec­tion” restric­tions. (Plus, of course, it would be crazy to ask for a hard copy.) And second, as long as there’s just a huge data dump sitting there, unpro­cessed, the NSA hasn’t “collec­ted” inform­a­tion, and thus does­n’t yet have to comply with the restric­tions of the DOD regu­la­tions .
Once the NSA processes it – for instance, by search­ing for call­ing patterns and communit­ies of interest related to people the FBI or NSA iden­ti­fies as being “reas­on­ably believed to be engaged in inter­na­tional terror­ist activ­it­ies” – it’s been collec­ted. At that point, though, it’s fine, because that target­ing satis­fies the regu­la­tion. This would help explain state­ments by Senate members imply­ing that the NSA does­n’t do anything with the inform­a­tion until it gets specific names. (Of course, some of those senat­ors are also making laugh­able pronounce­ments that inform­a­tion has been collec­ted “only on bad guys.”) 
There’s one prob­lem (and maybe more) with this line of argu­ment: how does the NSA process ONLY the inform­a­tion it’s search­ing for? Does­n’t it have to process a large batch of inform­a­tion in order to conduct the search within the data, which would then involve collect­ing more than just the inform­a­tion permit­ted by the DOD regu­la­tions? The NSA does, though, have to get around the 5240.1-R collec­tion limit­a­tions in some way, since other­wise the collec­tion of phone data on every single person in the U.S. would seem a wee bit over­broad. So maybe this legal and tech­no­lo­gical foot­work is the way it does it – and in the mean­time, the FBI has neatly sidestepped its own minim­iz­a­tion oblig­a­tions by not receiv­ing inform­a­tion under the section 215 order. (Of course, we don’t know what inform­a­tion the NSA is feed­ing back to the FBI after it processes the data – but perhaps the FBI argues that at that point, it’s not receiv­ing inform­a­tion “in response to” the original order.)
There’s one other inter­est­ing note. Under EO 12333, the NSA is required to use the “least intrus­ive collec­tion tech­nique feas­ible” where Amer­ic­ans are concerned. But by the time the NSA comes into play, they’ve got everything – so the only ques­tion is what tech­nique they use to burrow in on the relev­ant inform­a­tion, not what they do to capture the whole data­set. The FBI, which makes the original request, is also required to use the least intrus­ive method avail­able, and one would think a FISA Court judge might inquire whether there’s a very slightly less intrus­ive method than obtain­ing the entire coun­try’s call­ing inform­a­tion. But conveni­ently, the Attor­ney General Guidelines that Michael Muka­sey issued in 2008 add that the FBI “shall not hesit­ate to use any lawful method,” as long as it’s warran­ted, “partic­u­larly … in invest­ig­a­tions relat­ing to terror­ism.” So the NSA gets to obtain inform­a­tion in a more intrus­ive way than it might other­wise be allowed, since the FBI is the one doing the asking.

Photo by beaufour.