Judge Finds NSA Phone Bulk Metadata Program Unconstitutional - Technologist
Technologist - The FindLaw Legal Technology Blog

Judge Finds NSA Phone Bulk Metadata Program Unconstitutional

We've had our suspicions since June or so, but today, someone far more important than a blogging lawyer came to the conclusion that the NSA's bulk collection of phone metadata (calling records, phone numbers, etc.) "almost certainly" violates the Fourth Amendment: U.S. District Court Judge Richard Leon.

Judge Leon granted an injunction barring the NSA from collecting any metadata related to the two plaintiffs who alleged that they were affected by the phone program, while denying a similar injunction for a similar Internet data collection program that allegedly ended in 2011. (In a footnote, Judge Leon noted that a class has not yet been certified in the case, though four extensions have been sought -- hence, the limited scope of the injunction.) The injunction, however, is on hold pending any further appeals.

Scope of the Program

Just how invasive is the NSA's bulk metadata collection program? The program obtains metadata for all calls from phone companies and adds the data to a large database.

After approval from an NSA supervisor, data is pulled from within "three hops" of a target. NSA analysts then are authorized to dig deeper into this "smaller" collection of data. Judge Leon noted that as of now, the government has only admitted that it used phone numbers (though Foreign Intelligence Surveillance Court orders mention other unspecific "identifiers").

Using just phone numbers, and assuming a person takes and receives calls from 100 unique numbers in a year, that means for each identifier, extended three "hops," the government pulls 1 million individuals' records.

(As we've noted before, the NSA extends "three hops" from an identifier. By comparison, it only takes 4.74 "hops" to reach between any two Facebook users on the planet.)

Judge Leon notes that his example is conservative, as a phone call to a Domino's Pizza would expand that seven-figure number exponentially, even with "minimization procedures" in place, especially since there are numerous instances cited by Judge Leon where the "minimization procedures" were skirted or ignored.

No Jurisdiction to Review APA Violations

As the government has maintained all along, individual Americans have no authority to challenge FISC orders directly by arguing, via the Administrative Procedures Act, that the government has exceeded its statutory authority. The FISC is a closed court system. Interestingly enough, Judge Leon notes that even the phone companies themselves couldn't participate in FISC proceedings until 2006 -- it was an ex parte, government-only system.

And though the statute doesn't explicitly say "No district court judges or private plaintiffs allowed," the clearly-closed system impliedly bars such a review.

'No Cloak of Secrecy Over the Constitution'

That doesn't bar constitutional challenges in district court, however. Under Webster v. Doe, there is a strong presumption of judicial review of constitutional challenges to administrative action, absent statutory language explicitly prohibiting such review.

Judge Leon eloquently noted that, "While Congress has great latitude to create statutory schemes like FISA, it may not hang a cloak of secrecy over the Constitution."

Standing, Surveillance Not Speculative

One major obstacle to any NSA-related litigation is the Supreme Court's ruling in Clapper v. Amnesty International, which denied standing because the plaintiffs' suspicions of NSA surveillance were "speculative."

Of course, as Judge Leon notes, that decision was handed down months before the Snowden/NSA leaks. Here, as Verizon subscribers, two of the plaintiffs have strong evidence that their phones' metadata were part of the program.

Judge Leon also calls the government out for lying by omission. They argued that the leaked order was for Verizon Business Services, not the consumer-oriented Verizon Wireless, yet in numerous briefs and arguments, the government has described a comprehensive database that combines data from multiple telecommunications providers. Verizon Wireless is the largest carrier in the nation.

"[T]he government asks me to find that plaintiffs lack standing on the theoretical possibility that the NSA has collected a universe of metadata so incomplete that the program could not possibly serve its putative function. Candor of this type defies common sense and does not exactly inspire confidence," Judge Leon remarked.

Plaintiffs Likely to Succeed on the Merits

The other major obstacle to the plaintiffs' claims was a 1979 Supreme Court case (Smith v. Maryland) which held that a person does not have a reasonable expectation of privacy in the numbers that he voluntarily transmits to the phone company (and which were intercepted, sans warrant, via a pen register).

That case would seem to preclude any claims here. But as Judge Leon notes, times have changed, and he could no longer use "as my North Star a case that predates the rise of cell phones."

"When do present-day circumstances -- the evolution of the government's surveillance capabilities, citizens' phone habits, and the relationship between the NSA and telecom companies -- become so thoroughly unlike those considered by the Supreme Court thirty-four years ago that a precedent like Smith does not apply? The answer, unfortunately for the government, is now."

In holding that plaintiffs were likely to succeed on the merits, and that an injunction was warranted, Judge Leon concluded that the "almost-Orwellian" program "almost certainly" amounted to a violation of the plaintiffs' reasonable expectation of privacy.

"I cannot imagine a more 'indiscriminate' and 'arbitrary invasion' than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying it and analyzing it without judicial approval," Judge Leon wrote.

Join the discussion on Facebook at FindLaw for Legal Professionals.

Related Resources: