Wake-Up Call: 2nd Circuit Declares NSA's Mass Telephone Surveillance Program Illegal, Then Weighs Whether Claims Are Moot in Light of Later Development

Whatever your opinion of Edward Snowden, the shockwaves from his leaks of classified material have continued to roil all three branches of the federal government. The latest wave broke on May 7, 2015, when the United States Court of Appeals for the 2nd Circuit held in ACLU v. Clapper that the National Security Agency's mass telephone metadata collection program, which had been in place for a decade or more, was not authorized by Section 215 of the Patriot Act and was therefore illegal. Public awareness of that program had come to light in June 2013 when The Guardian newspaper published a leaked order from the Foreign Intelligence Surveillance Court (FISC) requiring Verizon to produce to the NSA "on an ongoing daily basis ... all call detail records or 'telephony metadata' created by Verizon for communications (i) between the United States and abroad; or (ii) wholly within the United States, including local telephone calls." It subsequently became clear that such FISC orders have been issued to virtually all major telephone carriers in the United States.

This was arguably the most significant ruling to date on the various surveillance programs revealed by Snowden and the only appellate court ruling on Section 215, which at the time of the ruling was set to expire on June 1, 2015. In light of the pending expiration, lawmakers had begun intensely debating whether the program should be continued, modified, or ended. Some members of Congress pushed for a clean reauthorization, while the Obama Administration defended the program, but also called for the end of bulk collection, advancing an alternative mechanism that would require the carriers themselves to maintain the data until the government requests it.

The 2nd Circuit's May 7 decision is remarkable for its strong criticism of the breadth of the data collection program, the government's efforts to justify that breadth by unpersuasive comparison to ordinary search warrants and subpoenas, and the government's strained argument that information about every phone call is "relevant" to an authorized investigation. The court would not countenance stretching the concept of relevance so far, as Section 215 requires:

If the orders challenged by appellants do not require the collection of metadata regarding every telephone call made or received in the United States (a point asserted by appellants and at least nominally contested by the government), they appear to come very close to doing so. The sheer volume of information sought is staggering; while search warrants and subpoenas for business records may encompass large volumes of paper documents or electronic data, the most expansive of such evidentiary demands are dwarfed by the volume of records obtained pursuant to the orders in question here.

On June 2, 2015, one day after Section 215's sunset provisions were triggered, Congress passed the USA Freedom Act, which was subsequently signed into law by President Obama. The legislation strikes a middle ground, amending Section 215 to temporarily reauthorize the surveillance program for a 180-day period, but then prohibiting future large-scale bulk collection of call detail records after November 29.

Given the important revisions that the USA Freedom Act made to Section 215, the 2nd Circuit directed both parties on June 9 to brief whether the changes to Section 215 prohibiting future bulk collection of telephone metadata moots any of the appellants' claims. Meanwhile, the Foreign Intelligence Surveillance Court issued an order on June 29 permitting the government to resume metadata collection during the 180-day reauthorization period.

The 2nd Circuit is currently weighing the arguments in the parties' response briefs, which were due on July 27. We will have to wait to see whether the 2nd Circuit will find that the USA Freedom Act's future termination of the bulk collection program renders the ACLU's claims moot or warrants further judicial action. In its response brief, the government stated that the definite termination of the bulk collection program on November 29, coupled with the NSA's decision to sequester and later destroy all collected metadata, will moot the ACLU's claims, and asked the court to respect the compromise worked out between Congress and the President. It may be some time before the ultimate disposition of this case; in the meantime, it is unclear to what extent this ruling or the USA Freedom Act could affect telephone carriers' immunity when providing information to the government pursuant to National Security Letters ("NSLs") and FISC orders. However, there are several other cases challenging the legitimacy of the mass data collection program under appellate review in other jurisdictions that may give more specific guidance on this topic, and the courts considering them will undoubtedly take account of the 2nd Circuit's decision, which is summarized below, along with a brief discussion of the current status of the case.

The NSA Bulk Metadata Collection Program

Launched sometime after the September 11, 2001, terrorist attacks, the NSA's mass telephone metadata collection program is implemented through orders issued by the Foreign Intelligence Surveillance Court, upon application from the NSA. As presently constituted, Section 215 of the Patriot Act permits the government "to make an application for an order requiring the production of any tangible things ... for an investigation to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities." The government's application must include "a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation (other than a threat assessment) conducted in accordance with subsection (a)(2) of this section to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities." The review of such applications by FISC is conducted in secret, typically in ex parte proceedings.

The order to Verizon—and presumably every similar order addressed to other providers—required the ongoing production of telephone metadata, which was then to be stored on a secure NSA network indefinitely. The court noted that under the program, the metadata "would only be accessed 'when NSA has identified a known telephone number for which ... there are facts giving rise to a reasonable, articulable suspicion that the telephone number is associated with [Redacted]'– presumably, with terrorist activity or a specific terrorist organization." As set forth specifically in a "Secondary Order," the metadata collected included "comprehensive communications routing information, including but not limited to session identifying information (e.g., originating and terminating telephone number, International Mobile Subscriber Identity number, International Mobile station Equipment Identity number, etc.), trunk identifier, telephone calling card numbers, and time and duration of call."

The District Court Decision

The American Civil Liberties Union, American Civil Liberties Union Foundation, New York Civil Liberties Union, and New York Civil Liberties Union Foundation filed the instant case in the United States District Court for the Southern District of New York, challenging the NSA's metadata program on the grounds that it was beyond the scope of Section 215 of the Patriot Act, and that it violated the First and Fourth Amendments. In the district court, Judge William H. Pauley granted the government's motion to dismiss, finding that Section 215 impliedly precludes judicial review, that the statutory claims were meritless, and that the statute does not violate the Constitution.

The 2nd Circuit Opinion

Standing and Preclusion

First, the 2nd Circuit affirmed the district court's ruling that the appellants had standing to support their action against the NSA's metadata program, finding that they alleged concrete, traceable, and redressible injuries. Specifically with regard to appellants' Fourth Amendment claim, the court found that the FISC orders permitting the government to collect virtually all telephone metadata demonstrated that the appellants' records are collected as part of the NSA's program and that the appellants' claim alleges injury from the very collection of their metadata. The court found that such collection was more appropriately challenged as a seizure under the Fourth Amendment, rather than as a search, and accordingly held that "whether or not such claims prevail on the merits, appellants surely have standing to allege injury from the collection and maintenance ... of records relating to them."

Significantly, in addition to finding that collection alone is a seizure and confers standing, the court noted that even on the government's theory—that no search (and therefore no harm) occurred unless a particular record was singled out for scrutiny—it was clear that any actual review of collected data by a human being would constitute a search and confer standing. The court held that the computerized review the government described was no different:

Finally, the government admits that, when it queries its database, its computers search all of the material stored in the database in order to identify records that match the search term. In doing so, it necessarily searches appellants' records electronically, even if such a search does not return appellants' records for close review by a human agent. ... That the search is conducted by a machine might lessen the intrusion, but does not deprive appellants of standing to object to the collection and review of their data.

Next, the court addressed the government's contention that the plaintiffs were impliedly precluded from bringing suit, in particular because Section 215 provides only for judicial review by FISC and a "specialized mechanism for appellate review," and anticipates challenges only from the communications companies that have actually received Section 215 orders (not the targets of the orders). Rejecting this argument, the court noted the strong presumption in favor of judicial review deriving from the Administrative Procedure Act (APA), requiring the government to show "clear and convincing" or "fairly discernible" evidence that Congress intended preclusion. The government argued that the extensive secrecy requirements surrounding the limited judicial review provided by statute indicated that Congress intended not to permit any other judicial review. But the court disagreed:

Indeed, the government's argument from secrecy suggests that Congress did not contemplate a situation in which targets of § 215 orders would become aware of those orders on anything resembling the scale that they now have. That revelation, of course, came to pass only because of an unprecedented leak of classified information. That Congress may not have anticipated that individuals like appellants, whose communications were targeted by § 215 orders, would become aware of the orders, and thus be in a position to seek judicial review, is not evidence that Congress affirmatively decided to revoke the right to judicial review otherwise provided by the APA in the event the orders were publicly revealed.

The court also rejected the government's arguments that the statutory scheme as a whole, legislative history, and the language of other statutes favored preclusion, summing up its arguments as follows: "In short, the government relies on bits and shards of inapplicable statutes, inconclusive legislative history, and inferences from silence in an effort to find an implied revocation of the APA's authorization of challenges to government actions."

Illegality Under Section 215

Turning to what it saw as the heart of the matter, the court first noted that Section 215 allows the government to seek "an order requiring the production of any tangible things ... for an investigation ... to protect against international terrorism or clandestine intelligence activities," including anything that "can be obtained with a subpoena duces tecum issued by a court of the United States in aid of a grand jury investigation" or any other court order. While this is broad language, the court noted that the government must also submit a fact statement demonstrating reasonable grounds to believe "that the tangible things sought are relevant to an authorized investigation (other than a threat assessment) conducted [under guidelines approved by the Attorney General]." In plain English, this meant that "the basic requirements for metadata collection under § 215, then, are simply that the records be relevant to an authorized investigation (other than a threat assessment)."

The court's decision on the legality of the FISC orders under Section 215 turned on the definition of "relevance." The court pointed out that the parties were not even really debating whether the data being collected were "relevant to any particular inquiry." There was no comparison to the scope of traditional subpoenas or court orders because such mass data collection is something different—the government argued that the relevance of bulk aggregation of metadata comes instead from "the 'creation of a historical repository of information'" that can be queried by "'certain analytic techniques'" in future terrorism investigations. The court concluded that the government's definition would render the word "relevant" virtually meaningless because, by that reasoning, all telephone metadata in the United States, at all times, would be "relevant to terrorism investigations":

Thus, the government takes the position that the metadata collected—a vast amount of which does not contain directly "relevant" information, as the government concedes—are nevertheless "relevant" because they may allow the NSA, at some unknown time in the future, utilizing its ability to sift through the trove of irrelevant data it has collected up to that point, to identify information that is relevant. We agree with appellants that such an expansive concept of "relevance" is unprecedented and unwarranted.

To the extent the government did point to prior decisions examining the breadth of subpoenas, the court found that "as broad as those subpoenas were, the cases cited by the government only highlight the difference between the investigative demands at issue in those cases and the ones at issue here." Notably, in all such prior cases, the subpoenas were limited by the context of the investigation itself, or temporally. By contrast, the court held,

The telephone metadata program requires that the phone companies turn over records on an "ongoing daily basis"—with no foreseeable end point, no requirement of relevance to any particular set of facts, and no limitations as to subject matter or individuals covered."

Indeed, such a broad reading of "relevant" ignored the statutory limitation of such orders "to an authorized investigation." The government's argument implied that there is "only one enormous 'anti‐terrorism' investigation and that any records that might ever be of use in developing any aspect of that investigation are relevant to the overall counterterrorism effort." Finding that the government's interpretation of the statute "defies any limiting principle," the court held that the surveillance far exceeded the statutory scope.

The court also found that the government's interpretation read the phrase "other than a threat assessment" out of the statute. The FBI's own guidelines, the court noted, differentiate assessments from investigations because "they may be initiated without any factual predication." The objective of an assessment may be broad—for instance, prevention of "terrorist acts against the nation"—but must still be clearly defined and serve an authorized purpose. When conducting assessments, the court further noted, the FBI typically limits itself to methods with "low intrusiveness," such as collecting public information and reviewing government records. Given these distinctions, it was clear that Congress intended "to prevent § 215 orders from being issued where the FBI, without any particular, defined information that would permit the initiation of even a preliminary investigation, sought to conduct an inquiry in order to identify a potential threat in advance." The metadata collection program was "even more remote from a concrete investigation" than such threat assessments.

Constitutional Challenges

While the 2nd Circuit chose not to address the appellants' First Amendment claim, it discussed at length the argument that the metadata collection program violated appellants' expectations of privacy under the Fourth Amendment. The district court rejected appellants' Fourth Amendment claim on the grounds that the Supreme Court has held that an individual has no privacy interest in telephone records or other information voluntarily disclosed to a third party. Appellants argued that technological advances in surveillance such as the metadata program gave cause to revisit this third-party records doctrine.

The court acknowledged that appellants' claim raised the "vexing" question of how modern technology is altering traditional privacy expectations, an issue that has thrown Fourth Amendment jurisprudence into "some turmoil" in recent years. In its analysis of appellants' Fourth Amendment claim, the 2nd Circuit highlighted Justice Sotomayor's concurrence in United States v. Jones, which questioned whether the realities of the digital age—"in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks"—call for us to reevaluate the notion that we have no reasonable privacy expectation in information like telephone metadata that we must disclose to third parties to live in the modern world.

Despite its pondering, however, the court did not resolve these difficult issues. Because the court already held that the NSA's program was not authorized by Section 215, and because Congress might make the appellants' constitutional claims moot by revising Section 215 or letting it expire on June 1, the court decided that "we need not and do not reach these weighty constitutional issues." Instead, the 2nd Circuit suggested that courts should defer to Congress, which can apply its experience and judgment and reflect the will of the electorate to define the contours of privacy under the Fourth Amendment in an evolving technological and social landscape. Finally, the court noted that several bills to revise Section 215 were pending before Congress, and that "[t]he constitutional issues [involved] are sufficiently daunting to remind us of the primary role that should be played by our elected representatives."

Injunctive Relief/Remand

Although the court determined that the district court erred in dismissing the appellants' claims and that "appellants have shown a likelihood—indeed, a certainty—of success on the merits of at least their statutory claims," it declined to decide whether a preliminary injunction is required. Instead, the court demurred and chose to remand the issue to the district court.

Echoing its analysis of appellants' constitutional claims, the court noted that the program's sunset provisions would take effect in a few weeks' time without congressional action; should Congress allow Section 215 to lapse, appellants' injunction consequently would be moot. In the court's view, given the government's asserted national security interests in the program, and the importance of Congress' role in deciding whether to reauthorize Section 215, "we deem it prudent to pause to allow an opportunity for debate in Congress that may (or may not) profoundly alter the legal landscape." As discussed below, this is precisely what occurred.

2nd Circuit to Consider Whether New Law Renders ACLU's Claims Moot

The court's prudent pause allowed Congress to drastically revamp Section 215, but to what extent the new law altered the legal landscape is unclear, at least in the short term. At the heart of the question is the fact that Section 103 of the new USA Freedom Act prohibits bulk collection of business records and other "tangible things"—including call detail records—by requiring FISC orders approving production to use "specific selection terms" as the basis for production. Section 101 requires that the FBI must also use specific selection terms as the basis for a production request, and mandates judicial oversight of production orders.

Perhaps critical to the appellants' claims, Section 109 delayed the effect of these changes for 180 days until November 29. In its order temporarily reviving the government's bulk metadata collection program, FISC looked to Section 109 and legislative history to hold that Congress intended to prohibit the bulk collection of data only after the 180-day period ended. Looking beyond the mere text of the new law, FISC also took pains to note its disagreement with the 2nd Circuit's analysis, and concluded that the 2nd Circuit's conclusions were nevertheless superseded by the USA Freedom Act.

The parties' response briefs to the 2nd Circuit paint drastically different pictures on just how the new law affected the appellants' claims. Not much has changed, according to the ACLU brief, as the government "continues to collect call records in bulk ... based on the same statutory language the Court has already held does not permit it" and "apparently intends to retain and use the fruits of its unlawful surveillance indefinitely." Looking to reach the finish line quickly, the ACLU also used the bulk of its response brief to petition the 2nd Circuit for a preliminary injunction against the revived collection program.

Conceding that appellants' claims are not currently moot, the government's response brief emphasized that the appellants will not have a cognizable claim once the program permanently ceases on November 29. The government also argued that the ACLU's claim for a purge of collected data will also be moot, as the Office of the Director of National Intelligence recently announced that the NSA will sequester and no longer use or access metadata already collected after November 29. Instead, the NSA will retain the data for an additional three months for "data integrity purposes" and will delete all metadata as soon as possible after all pending civil actions are resolved. As the bases for appellants' claims will expire in short order, the government asked the 2nd Circuit to respect the legislative compromise embodied in the USA Freedom Act and hold that the appellants are not entitled to any relief.

How the 2nd Circuit will divine the effect of the new law on the appellants' remaining claims, and whether its decision will come before the lapse of the reauthorization period, is currently unclear. But needless to say, the 180-day transition period built into the USA Freedom Act, combined with its prior deference to the congressional process and FISC's recent order criticizing the circuit court's prior ruling, will weigh heavily in the 2nd Circuit's deliberations.

How Will the USA Freedom Act Impact Provider Immunity?

Telephone carriers and other providers have likely been watching the events unfolding in the 2nd Circuit and Congress, wondering how any judicial decision or legislative action may affect their immunity when they are asked to comply with an NSL or FISC order. Providers fortunately received a reprieve under the USA Freedom Act's Section 105, which extends liability protection to entities that produce tangible things or provide information, facilities or technical assistance in complying with an order. Regardless of how the 2nd Circuit rules, providers should enjoy protection from liability for complying with government requests for information, both under the temporarily authorized bulk collection program and the more limited methods permitted by the USA Freedom Act after November 29.