Saturday, July 06, 2013

The Fourth Amendment Doesn't Cover Data Collection In the Abstract

The Fourth Amendment does not restrict the collection of things unless those things are used by the Government to deprive someone of life, liberty or property. Additionally, existing Supreme Court precedent says there is no reasonable expectation of privacy in phone call data and therefore the Government does not need a warrant to get phone company call data even if it uses that data in a criminal proceeding. Simply put, what many people perceive as an invasion of privacy is neither illegal nor Unconstitutional. Those two points and some other matters seem to get glossed over in some of the discussion about the disclosures of the NSA's data collection practices. This is an attempt to sort through a little of that and is limited to the NSA program collecting call records from phone companies.

Disclaimer. I believe there is far too much information classified by the federal government. I believe we have far too many intelligence agencies. I believe that portions of the Patriot Act are a very bad idea, particularly the authority to issue national security letters, though I suspect the current Supreme Court would find it all Constitutional. I believe we need a court like the FISA Court with Article III judges who have security clearances and who can convene and make decisions on quick notice to review intelligence agency actions and issue warrants. I believe that much of what the FISA court does must remain classified for a reasonable period of time. Having said that I think the FISA court can be considerably more transparent. I also believe the Congressional oversight committees can be considerably more transparent. Lastly if I could choose who I wanted to have my phone records, I would prefer the NSA over Verizon.

When the NSA requests telephone call records from telephone companies, records which the telephone companies already have collected and maintained, two questions arise. Is the NSA authorized by statute to collect the information and is the NSA or another agency using the information in a manner consistent with law? There is an important distinction between these two issues. Analysis of these two issues also subsumes the question of whether the law as written or applied is Constitutional.

Before getting to the NSA, let's appreciate the world we are already live in. There is a considerable amount of data that is collected and maintained by private companies on every individual in this country. For example, our banks know our names addresses, telephone numbers, Social Security numbers, credit history, credit rating, and how much we spend, what we buy, where we buy it, and how much we spend for it. Banks maintain those records and use the information for a variety of purposes including billing, credit reviews, credit decisions, marketing, and other matters. Similarly, our telephone companies maintain records on every call we make, what numbers we call, how long we are on the phone, and other matters. The same is true for stores where we shop, which maintain detailed records on what we buy, how much we spend, when we buy it, and how we pay for it. The list of private companies maintaining records on our personal lives is extensive.

These records are maintained as a matter of course by commercial enterprise and there are no federal laws prohibiting companies from collecting this data. In some instances, such as financial institutions and medical providers, there are laws governing how the data can be used, but to a large extent our privacy is subject to the whim of these companies. We rely on them to keep our data secure and to implement and enforce strict policies regarding how it is used by the company and how the company prevents its misuse by its employees.

The recent NSA disclosures shine a light on the fact that telephone company call record data is also shared with and held by the NSA. To some people, having the government hold that data presents a significantly greater concern than when that data is merely held by a private company. That fear is justifiably based on the concern that the Government, using that data, could use the power of the state to deprive people of life, liberty or property. I would share that concern if I didn't know that there are statutory and Constitutional restrictions that prevent this from happening. Furthermore, to the best of our knowledge, this data has never been used to deprive American citizens, residents or others living in the United States of life, liberty or property in violation of the laws or Constitution.

Now to the Constitution. The Fourth Amendment provides

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

While on its face it may appear otherwise, the Fourth Amendment does not, in a vacuum, restrict the government from collecting data. In fact it doesn't restrict the government from collecting anything. What the Fourth Amendment does is prohibit the government from collecting things without probable cause and without a properly executed warrant if it uses that data, information, or material to deprive someone of life, liberty or property, most often in a criminal proceeding. And if the original collection is Unconstitutional then everything that flows from that collection is Fruit Of The Poison Tree that is likewise excluded from use under the Exclusionary Rule. It may be possible to pursue a civil action under the Federal Tort Claims Act for a violation of privacy, but that would face many hurdles, not the least of which a determination of damages if the Government hasn't actually done anything with your data. (There are many good treatises on the Fourth, even this one in Wikipedia.)

And when it comes to call records, the Supreme Court has gone so far as to say they are not covered by the Fourth Amendment even if used to get a name and tap a phone and introduce the tapped calls in evidence in a criminal proceeding. That 1979 case is Smith the Maryland, which held that there was no reasonable Fourth Amendment expectation of privacy regarding the phone numbers given by a person to a phone company. In that case, the police installed a "pen register" at a telephone company without a warrant. The pen register recorded all of the phone numbers that were dialed from the defendant's home telephone. The police use those numbers to develop evidence against the defendant. At trial the defendant sought to have that evidence excluded on the grounds that it was only obtained through a warrantless search of his phone records. The lower courts and ultimately the Supreme Court ruled that there was no Fourth Amendment violation. Specifically, the Supreme Court stated:

(a) Application of the Fourth Amendment depends on whether the person invoking its protection can claim a "legitimate expectation of privacy" that has been invaded by government action. This inquiry normally embraces two questions: first, whether the individual has exhibited an actual (subjective) expectation of privacy; and second, whether his expectation is one that society is prepared to recognize as "reasonable." Katz v. United States, 389 U. S. 347. Pp. 442 U. S. 739-741.

(b) Petitioner in all probability entertained no actual expectation of privacy in the phone numbers he dialed, and even if he did, his expectation was not "legitimate." First, it is doubtful that telephone users in general have any expectation of privacy regarding the numbers they dial, since they typically know that they must convey phone numbers to the telephone company and that the company has facilities for recording this information and does, in fact, record it for various legitimate business purposes. And petitioner did not demonstrate an expectation of privacy merely by using his home phone, rather than some other phone, since his conduct, although perhaps calculated to keep the contents of his conversation private, was not calculated to preserve the privacy of the number he dialed. Second, even if petitioner did harbor some subjective expectation of privacy, this expectation was not one that society is prepared to recognize as "reasonable." When petitioner voluntarily conveyed numerical information to the phone company and "exposed" that information to its equipment in the normal course of business, he assumed the risk that the company would reveal the information to the police, cf. United States v. Miller, 425 U. S. 435. Pp. 442 U. S. 741-746.

While the Constitution does not speak to the mere collection of data there are Federal laws which do. They provide agencies the authority they need to collect the data, and place restrictions on both the collection and use of the data. Section 215 of the Patriot Act is the law the Government assets as the authority to collect call record data from telephone companies. Section 215 authorizes the collection of any tangible thing, including business records from a telephone company after obtaining a warrant from the FISA court.

There is a difference of opinion as to whether or not section 215 covers mass collections of data regarding potentially millions of telephone numbers at one time and whether the law is Constitutional. At the link you will see why the ACLU thinks it is Unconstitutional. Suffice it to say that while there is a difference of opinion on this issue, the Justice Department believes this activity is authorized, the FISA court believes this activity is authorized, and most members of the Congressional oversight committees appear to believe this activity is authorized. Ultimately a court may rule the activity is not authorized or that the law is Unconstitutional but clearly, as of now, the activity is being carried out under color of law.

Many are troubled by the Government simply having the data, regardless of how it is used. Others are not particularly concerned about the collection of the data but focus instead on how it is used. Is the Government using it in an unauthorized or Unconstitutional manner to deprive people of life, liberty or property? Given a choice some people would rather have the data held by a government agency, which is at least somewhat accountable, then being held by private companies which have virtually no accountability.

While we have very little control or recourse over how private companies use our data we have a great deal of recourse on how the federal government uses the data. We are not talking about some random government employee voyeur perusing data, an activity that would violate agency regulations. We are talking about the information being used by the agency in a way that harms us.

In order for the federal government to use the telephone numbers against a person, it has to first determine the name of the person associated with a number. Until it does that, it merely has phone numbers. Then, if it wants to hear what the person talking on that phone is saying, it has to obtain an individualized warrants to tap that telephone number. If it does not obtain an individualized warrant to tap that telephone number none of those conversations can be introduced in evidence at a judicial or administrative proceeding. And if it did not get a warrant to collect the data initially, even the data cannot be introduced in evidence, not because of the Fourth Amendment but because of the restrictions in FISA.

It is noteworthy that the government's ability to obtain the content of phone conversations is prospective in nature. It cannot obtain records of the content of prior telephone conversations because they are not kept by the telephone company. And if the government on its own had decided to tap the phone number earlier, it would have needed an individualized warrant to engage in that activity if it subsequently sought to introduce evidence of the content of the phone conversation in a judicial proceeding.

Some have suggested that the NSA call data collection program is in some way comparable to the Bush warrantless wiretap program, which was discontinued after significant outrage. I too would be outraged if this program in any way resembled the Bush program, but it does not. The Bush warrantless wiretap program, involved the collection of the content of telephone calls, emails, and other communications in the United States, of US citizens, without a warrant. The Obama program does not. It only involves phone numbers and the duration of phone calls. There is no recording of telephone calls. If, based on a review of those phone numbers the authorities wish to obtain the content of future communications between people associated with those numbers, they have to obtain a separate individualized warrant to tap the phone.

Additionally, the Bush program was not only done without any warrants it was done without any legal authority. Since Bush knew the program was not authorized under the Foreign Intelligence Surveillance Act they did not go the FISA Court to obtain a warrant. And since they couldn't rely on FISA as legal authority for the program, Bush manufactured an Executive Order which he claimed was issued under the authority of the AUMF (Authorization For Use Of Military Force). This assertion was so bogus that even Republicans on the Hill didn't buy it and the result was amendments to FISA to make the point absolutely clear

If it turns out that the Obama administration has or in the future develops a program different from the one that is currently outlined I will have a problem with it. But until then I see this as a minimal intrusion.

No comments:

Post a Comment