It seems like aeons ago, but just a week ago, EFF and DOJ had a court hearing over preserving evidence in the EFF lawsuits (Shubert, Jewel, and First Unitarian Church v. NSA). As I noted in two posts, a week ago Monday DOJ surprised EFF with the news that it had been following its own preservation plan, which it had submitted ex parte to Vaughn Walker, rather than the order Walker subsequently imposed. As a result, it has been aging off data in those programs (notably the PATRIOT-authorized Internet and phone dragnets) authorized by law, as opposed to what it termed Presidential authorization. DOJ’s behavior makes it clear that it is trying to justify treating some data differently by claiming it was collected under different authorities.
Remember, there are at least five different legal regimes involved in the metadata dragnet:
- EO 12333 authority for data going back to at least 1998
- Stellar Wind authority lasting until 2004, 2006, and 2007 for different practices
- PATRIOT-authorized authorities for Internet (until 2011) and phone records (until RuppRoge or something else passes)
- SPCMA, which is a subset of EO 12333 authority that conducts potentially problematic contact chaining integrating US person Internet metadata
- Five Eyes, which is EO 12333, but may involve GCHQ equities or, especially, ownership of the data
At the hearing and in their motions, EFF argued that their existing suits are not limited to any particular program (they didn’t name all these authorities, but they could have). Rather, they are about the act of dragnetting, regardless of what authority (so they’ll still be live suits after RuppRoge passes, for example).
EFF appears to have at least partly convinced Judge Jeffrey White, because on Friday he largely sided with EFF, extending the preservation order and — best as I can tell — endorsing EFF’s argument that their suits cover the act of dragnetting, rather than just the Stellar Wind, FISA Amendments Act, or phone and Internet dragnets.
With that as background, I want to look at a few things from the transcript of last Wednesday’s hearing. First, at one point White suggested there might be a — purely hypothetical, mind you — event that happened 5 years ago the plaintiffs might need live data from.
THE COURT: Well, what if the NSA was doing something, say, five years ago that was broader in scope, and more problematical from the constitutional perspective, and those documents are now aged out? And — because now under the FISC or the orders of the FISC Court, the activities of the NSA have — I mean, again, this is all hypothetical — have narrowed. And wouldn’t the Government — wouldn’t the plaintiffs then be deprived of that evidence, if it existed, of a broader, maybe more constitutionally problematic evidence, if you will?
MR. GILLIGAN: There — we submit a twofold answer to that, Your Honor.
We submit that there are documents that — and this goes to Your Honor’s Question 5B, perhaps. There are documents that could shed light on the Plaintiffs’ standing, whether we’ve actually collected information about their communications, even in the absence of those data.
As far as — as Your Honor’s hypothetical goes, it’s a question that I am very hesitant to discuss on the public record; but I can say if this is something that the Court wishes to explore, we could we could make a further classified ex parte submission to Your Honor on that point.
Of course, this is not at all hypothetical. By NSA’s own admission, they were watchlisting 3,000 US persons until just over 5 years ago without the requisite First Amendment review. And Theresa Shea has submitted another sealed filing in the suit, so White may know that. (Or maybe he reads yours truly — I believe I still am the only person to have reported this, though it is in public records). Now, White doesn’t hint at this, but this concern would already implicate two authorities, because the US persons were watchlisted under EO 12333 authorities (possibly SPCMA), dumped into Section 215 data, then moved back onto the EO 12333 lists.
Then there are a few ridiculous, more general claims. DOJ claimed it would take the most advanced SIGINT Agency in the world “many months” and hours of personnel time and technological resources to figure out how to save data onto a storage medium.
Because we’re talking about a periodic transition of data from the operational database to a preservation medium, we’ve got to develop a capability to do that, which is going to require a software-development effort that could take many months, and involve a diversion of many NSA resources.
EFF’s Cindy Cohn noted, these claims of hardship are particularly odd given that the NSA proposed keeping all the data before the FISA Court.
I’m a little confused about why they’re fighting in front of you for the very thing they asked for in the FISC. They didn’t talk about operational problems or difficulties preserving it when they asked the FISC for permission for this on March 7.
Judge White not only mocked this in the hearing, he basically extended the preservation order.
MR. GILLIGAN: I think the answer to this question, Your Honor, brings us back to the discussion we were having with respect to your first question. The — migrating the data to tape would require, because we’re dealing here with a live program, where data are coming in and data are periodically being aged off, rather than a program that has been terminated, and you have a static data set, you’re going to have to or the NSA is going to have to engage in a complicated software-development effort to basically come up with a capability of periodically aging data off from the operational database into a preservation medium.
THE COURT: But you’re not saying the NSA, with all of its computer expertise, can’t do this. You’re not saying it’s impossible to do it. You’re saying it would be a burden financially and perhaps operationally, but it can be done; can it not?
MR. GILLIGAN: Your Honor, we have not said it can’t be done. If it — but again, it would be at significant costs that are detailed in classified declaration, and would result in a diversion of financial, technological, and personnel resources from the NSA’s core national-security mission.
Then DOJ argued — in a lawsuit brought, in part, because the government has utterly blown up the definition of relevant — that relevance must be defined very narrowly here.
Is this relevant evidence that is so potentially beneficial to the Plaintiffs’ case, that preservation is required, notwithstanding the burden of doing so?
We — we — simply ascertaining that the data are relevant within the meaning of the Rule 26 is only the start of the inquiry. It’s not — it doesn’t get us the answer to the question.
On both of these, you see how the multiple authorities involved could make the issue more difficult. EO 12333 data may not have age off dates, 215 query results definitely don’t, and GCHQ won’t want to do anything with their data because our government is being sued. And one way to make all of this easier is to define relevance to those programs that FISC has authority over.
I’m most interested in the following exchange:
This Court’s jurisdiction is to determine what our preservation obligation is; but apart from preserving data, what access we should have to it is something that should be determined by the FISC, and in accordance with statutes and regulations and Executives Orders that otherwise govern such matters.
THE COURT: On minimization?
MR. GILLIGAN: On minimization, yes. Principally, minimization; but perhaps otherwise. The other thing that troubles us in this language is that I could foresee, particularly after the debate we’ve been having today, all in good faith, that we could find ourselves here three or four years down the road, arguing whether or not this language imposed some sort of independent restriction on the Government’s access to preserve[d] data, which it absolutely should not do. Why — the Court’s writ here is to tell us whether or not to preserve; but what access we should have to our own data while it’s being preserved is something, again, that is not at issue in this litigation.
[snip]
MR. GILLIGAN: It would — within — any access we should have to that aged-out data would have to be with the permission of the FISC, and in accordance with FISC orders. The language here, Your Honor, I don’t believe accomplishes the objective that Ms. Cohn just described. I’m either misunderstanding the language, or I’m misunderstanding Ms. Cohn’s explanation of it. It says nothing in this order — this is language that Plaintiffs would have this Court enter — nothing in this order where the Court’s prior preservation orders shall be construed as authorizing any review or use of telephone orders records or intelligence gathering for any other nonlitigation purposes. What we fear is that this — we don’t want sort of a day to come where there’s an argument that this language independently barred us from accessing the data. Any restrictions on our access to the data are — should be imposed by the FISC in accordance with the terms of FISA. To the extent that that —
THE COURT: So it’s a jurisdictional issue, is really what you’re saying?
MR. GILLIGAN: Right. The Congress, through FISA, conferred on the FISC the authority to determine whether and under what circumstances the particular personnel should have access to data that are acquired under the authority of FISA.
The same DOJ that has agreed in FISC to not touch any data archived for this preservation order is here saying that White can’t impose any such order because it’s their data damnit and they can access it if they want to!
It’s a seeming contradiction.
Except it’s not, not even for the Section 215 data, because the data in question may well be in the corporate store! That data would be the most important to show the plaintiffs’ exposure.
Moreover, there’s all the other data — the 12333, the SPCMA, GCHQ’s own data — that they have limited restrictions on accessing, each having also fed the corporate store.
But here’s the thing: The government got White not to impose this protection order here based on a claim that it falls under FISC’s jurisdiction. And that’s true for the small fraction of it that derives from Section 215. But the bulk of it doesn’t arise from 215, it arises from 12333.
Which is, in part, what Gilligan was referring to when he raised “statutes and regulations and Executives Orders.” Except that for that data, White should be entitled to jurisdiction because FISA doesn’t.
Meanwhile, DOJ wants to delete the legally collected stuff and keep playing with the rest of it.