Don’t (Just) Let the Sun Go Down on Patriot Powers

A handful of provisions of the sprawling USA Patriot Act are now all but certain to at least temporarily expire at the end of the month, including the controversial section 215, the basis of the National Security Agency's notorious bulk telephone records dragnet.

As a result, NSA has already begun winding down the program, first revealed nearly two years ago by Edward Snowden, and many civil libertarians are breaking out the champagne.

Yet the celebration may not only be premature, but counterproductive if the impending expiration is perceived as a substantial victory in itself. Some legislators and activists are now so fixated on the symbolism of sunsetting "the Patriot Act" that they're even urging opposition to broader reforms.

The pivot to viewing sunset as a big win for privacy advocates is relatively recent. For months, civil libertarians had rallied behind the latest version of the USA Freedom Act , a modest but significant reform bill with broad bipartisan support, as the best realistic hope to begin reining in our ballooning surveillance state. But surveillance reform plans, like indie rock bands, seem to alienate many of their early core fans just as they achieve mainstream popularity.

Thus, when the Freedom Act finally passed the House by an overwhelming margin earlier this month, many of the "no" votes came from the National Security Agency's fiercest critics—and in an epic 11 hour jeremiad against the Patriot Act delivered from the Senate floor, Sen. Rand Paul had nearly as many harsh words for the Freedom Act, even suggesting that the bill could ultimately expand rather than restrict government spying powers.

Though a majority of senators last weekend voted in favor of moving forward with the Freedom Act—which would extend section 215 in a heavily modified form—it didn't get the 60 votes now required to accomplish anything in the Senate. A competing proposal to simply reauthorize the expiring powers without any changes, supported by Majority Leader Mitch McConnell, was even less popular. Other senators are preparing alternatives—mostly weakened versions of USA Freedom—but with the House in recess until after the sunset date, at least a temporary lapse of the authorities now seems assured.

Meanwhile, many erstwhile reformer boosters—including the American Civil Liberties Union and an assortment of grassroots groups—have adopted a new message: They're simply embracing the looming sunset. While for some this is a largely strategic shift grounded in the hope that sunset will strengthen their bargaining position, others seem to genuinely think expiration would be a bigger victory for privacy than passing reform legislation.

But while "Sunset the Patriot Act" makes for an appealing slogan, the fact remains that the vast majority of the Patriot Act is permanent—and includes an array of overlapping authorities that will limit the effect of an expiration.

While section 215 covers business records, section 214, also known as the "pen register/trap & trace" authority, covers the acquisition of communications "metadata" (things like dialed phone numbers and email or Internet Protocol addresses) in real time.

Years before the current version of the NSA telephone program under 215 was born, the government employed similar arguments to persuade the secret Foreign Intelligence Surveillance Court (FISC) to bless a bulk program vacuuming up international internet metadata under the aegis of section 214. Though that program was ended in 2011—likely at least in part because NSA was able to obtain much of the same data by collecting it overseas, with fewer restrictions—the authority is permanent.

Also permanent are National Security Letters or NSLs, which allow the FBI to obtain a more limited range of telecommunications and financial records without even needing to seek judicial approval. Unsurprisingly, the government loves these streamlined tools, and used them so promiscuously that the FBI didn't even bother using 215 for more than a year after the passage of the Patriot Act. Inspector General reports have also made clear that the FBI is happy to substitute NSLs for 215 orders when even the highly accommodating FISC manages a rare display of backbone. In at least one case, when the secret court refused an application for journalists' records on First Amendment grounds, the Bureau turned around and obtained the same data using National Security Letters.

Currently the other major use of 215, aside from the bulk telephone program, is to obtain internet records. Previously this was done primarily via NSL, but a 2008 memorandum from the Office of Legal Counsel slapped the FBI's wrist for reading its National Security Letter authorities too broadly to cover any and all types of electronic communication "transactional records." Indeed, obtaining specific internet records pursuant to an order signed by a judge seems like the kind of authority we should want the government to have in national security investigations. Ironically, removing 215 completely could make things worse from a civil liberties perspective by creating an incentive for the FBI to again push the limits of NSLs, pleading necessity on the grounds that it now lacks a court-supervised alternative—effectively shifting collection from a mechanism overseen by judges to one requiring only a senior FBI agent's say-so.

Even 215 itself doesn't really expire when it expires. In theory, the law reverts to a pre–Patriot Act version of the business records authority that is restricted to records that "pertain" to a suspected foreign agent or terrorist—language the government is sure to read as broadly as possible. But thanks to a little-noticed grandfather clause in the law, the current souped-up version of the law, which covers any records "relevant" to an authorized national security investigation, will remain available for investigations already open at the time of sunset, as well as new investigations into offenses committed before the sunset. Since the FBI routinely maintains massive "enterprise" investigations covering entire terror groups, which can continue for years if not decades, we can expect section 215 to have a lengthy afterlife.

The administration has promised it won't exploit this loophole to continue the NSA's telephone dragnet past 215's expiration. But without transparency reforms to provide some visibility on major decisions of the secret court—one major component of the USA Freedom Act—the public will have little hope of knowing or whether how 215's grandfather clause is used, nor of learning if the government continues invoking these other authorities to obtain telephone information or other types of sensitive data on a massive scale. All of these authorities, after all, contain the same "relevant to an authorized investigation" language that was used to legitimize the bulk telephone program, on the theory that entire vast databases (such as the phone records of nearly every American) can be "relevant" to an investigation, so long as the government later finds it useful to go trolling through the database later for information that is actually relevant.

All of this is somewhat complicated by a recent Second Circuit ruling holding the NSA telephone program unlawful, on the common-sense logic that Congress had never meant to authorize the government's unprecedented and effectively unlimited interpretation of "relevance" when it passed the Patriot Act. But the secret Foreign Intelligence Surveillance Court is not directly bound by that decision, and with the government choosing to end the current, 215-based version of its telephone program for now, the case becomes less likely to reach the Supreme Court, which does clearly have the power to rein in the FISC. Even if that court does choose to take the Second Circuit ruling into account, the recent decision really only says that this specific program, sweeping in hundreds of millions of records indiscriminately, without any concrete link to any particular investigation, stretches the language of the Patriot Act too far. That leaves the government plenty of room to argue that even slightly more limited forms of massive collection are still kosher, in front of a court with a solid track record of giving the government almost everything it wants.

That's not to say that the USA Freedom Act is by any means an ideal alternative, or that its critics shouldn't use the sunset of 215 as leverage to push for stronger reforms. USA Freedom, for instance, doesn't even touch massive surveillance within the United States under section 702 of the FISA Amendments Act, or the even more massive spying enabled by Executive Order 12333, a Reagan-era order that covers surveillance conducted outside the United States. But the Freedom Act does at least cover the full range of Patriot Act authorities that employ the "relevance" standard, preventing a tricky shell game that simply moves collection from expired authorities to permanent ones.

The way USA Freedom seeks to do this is also hardly perfect: The law creates a streamlined process for obtaining specific telephone records from multiple phone carriers (addressing objections that a massive NSA database was the only way to avoid the cumbersome necessity of serving many companies with orders for records stored in incompatible formats) and requires that, across all these authorities, "specific selection terms"—like a phone number or billing address—be used to identify the particular records sought. That means instead of evaluating whether an entire database might be "relevant" when considered in aggregate, the court would have to consider whether the government had demonstrated the relevance of the particular records corresponding to a set of selection terms.

Given the government's history of creative, secret reinterpretation of the law, critics of the law can't be faulted for fearing that it still leaves ample room for shenanigans. But the critical transparency provisions would at least require the secret court to publish any significant interpretation of the "specific selection term" requirement. Moreover, some of the scenarios floated by critics like Sen. Rand Paul—such as using an entire area code or the name of a telecommunications provider like Google or Verizon as a "selection term"—are explicitly prohibited by the law's text.

And while some, like Rep. Justin Amash, have worried that the new legislation could somehow be read to expand collection under 215, overriding the Second Circuit's ruling, it is difficult to see how this would work: The specific selector requirement in the statute is structurally and logically independent of the relevance standard—it's an additional requirement. As the House Committee Report on the bill makes explicit, should any judge find it ambiguous, the intent of this section is the "prohibition on bulk collection of tangible things," and it requires the government to make "an additional showing, beyond relevance" in applications for records. Should the court somehow manage to ignore such a clear statement of legislative intent, the new transparency provisions will at least act as a failsafe—one now sorely lacking.

There's certainly no reason to fear a 215 sunset, despite the claims of national security scaremongers, especially in light of the overwhelming evidence that the authority has not proved critical in any investigations to date. But it would be profoundly misguided to think that permanent expiration of this one authority would be better, from a civil liberties perspective, than even a highly imperfect reform that extends the authority in a heavily modified form. A temporary sunset may be a strategically useful means to the end of stronger reforms. But as a permanent end in itself, the expiration of 215 would provide the illusion of triumph even while leaving much of the machinery of surveillance intact.

Julian Sanchez is a Senior Fellow at the Cato Institute.