The National Security Agency’s mass collection of telephone data does not violate the Constitution, the United States District Court for the Southern District of New York (SDNY) ruled last week. The ruling, against the ACLU, found that the NSA’s “bulk collection” of the metadata related to every telephone call made in and out of the United States was both legal and constitutional.
Among other things, the Court found that Section 215 of the USA PATRIOT Act, which authorized the Foreign Intelligence Surveillance Court (FISC) to issue subpoenas for “tangible things” was an express authorization by Congress of the bulk data collection because the NSA provided some Members of Congress with a five page classified briefing on the program, and Congress did not repeal the statute. Therefore, the Court concluded, Congress expressly approved and ratified the bulk data collection.
The federal district court also adopted the rationale of the NSA and the FISC regarding the scope of the government’s authority to obtain “relevant” information. This may prove very problematic for the government in the future.
You see, Section 215 authorized the FISC to issue orders for documents or tangible objects as long as they are “relevant” to a terrorism investigation. So, if the NSA wants the phone records of Abu Nazir and/or those with whom Nazir communicated, these are “relevant” to its terrorism mission.
The Court likened this to a grand jury (criminal) investigation, where the government merely has to issue a statement that it believes the information sought is relevant and voila!
The information must be produced unless the Court is convinced (in an ex parte proceeding where only the government appears and argues) that “there is no reasonable possibility that the category of materials the Government seeks will produce information relevant to the subject of the grand jury’s investigation.”
Note the problem here. Information is “relevant” unless you can prove that the broad amount of information sought won’t also include information that is “relevant.” So “relevant” information is any database that may also include “relevant” information. And so on, and so on. And the burden is reversed.
The subpoenaed party must produce the entire database (cloud, server, etc.) unless they can prove that absolutely nothing in the database might be “relevant” to the subject of the inquiry. A database is “relevant” if a file contained therein is “relevant.” A collection of databases is “relevant” if a database is relevant. The court imposes no “minimization” requirement — no requirement that the government subpoena only those records that are “actually” relevant. In fact, it redefines “relevant” to suit its needs.
Now there are certainly circumstances, and the NSA case may (or may not) be one, where relevant data is so intertwined with irrelevant data that production of the entire database is necessary. In those cases, the Court will typically impose a “minimization” requirement that says, “while you may take the entire computer, you can only look at the child pornography.” The court does NOT say that the tax records in the computer are “relevant” to the child pornography case because they are on the same computer. The court also does not say that the tax records are subject to production because they may, some day be deemed to be relevant to the child porn case.
This principle for search warrants is embedded in the Fourth Amendment, which provides that “no warrant shall issue except upon a finding of probable cause, specifying the place to be searched and the things to be seized.” This is called the “particularity” provision, and limits the ability of the government to simply take what it wants. Everything seized must be specified in the warrant, and must have been the subject of a probable cause finding. Everything. Well, mostly.
But these limitations apply only to search warrants. Litigants (including the government) typically subpoena records from other parties on what is euphemistically called a “fishing expedition.” The particularity requirements do not apply (nor do the probable cause requirements) to a subpoena. The only limits on a subpoena are (1) relevance; (2) burden; and (3) privilege.
The SDNY court essentially removed numbers (1) and (3). It is hard to imagine any document, object, database, cloud provider, etc. for which there is no reasonable possibility that it contains SOMETHING relevant to some investigation. Indeed, the broader the subpoena, the more likely it is to contain SOMETHING relevant to some investigation. And remember, it is the burden of the recipient of the subpoena to show that there is NO reasonable possibility that SOMETHING in the database might not bear on something that the subpoenaing party might find relevant.
The same is true for privileges. The problem with privileges, like attorney-client, doctor-patient, priest-penitent, and husband-wife privilege, is that you can’t always tell that a communication or document is “privileged” when you subpoena it — particularly from a third party.
There is no way that AT&T would know that I am an attorney, or that a particular person is my client, or that the telephone calls between us relate to a privileged matter. By analyzing, for example the pattern of phone calls of an attorney, a priest, or a doctor, we can determine the contents of the communications. If we were to trace all of the calls of a doctor specializing in AIDS treatment, we could easily and quickly determine the names and addresses of patients with AIDS, and even the severity of the disease (or at least the urgency of the patient). We could determine the names of referring doctors, pharmacies, and the nature and extent of treatment just by looking at phone longs. In other words, we could breach the privilege.
Because entities like AT&T would have no way of knowing if phone records would reveal privileged information, it just gives them up in response to a subpoena. In fact, under the law, it is the burden on the party seeking to assert the privilege to affirmatively assert the existence of the privilege. Failure to assert the privilege is deemed a waiver of the privilege. So if the lawyer, priest or doctor doesn’t object to AT&T’s production of records, not only has the lawyer, priest or doctor waived the privilege with respect to the phone records, but may also have waived it with respect to the “subject matter” discussed in those phone calls. Of course, the lawyer, priest or doctor has no idea that their records have been subpoenaed, and in fact the Court order and secrecy have prevented the phone company from ever telling them. So privilege is essentially gone.
That leaves “burden.
A recipient of a subpoena for “relevant” information can object to the scope of the subpoena as being unduly burdensome and oppressive. So if a litigant (private or government) seeks an entire database because a single record might be relevant, the recipient can say that production of the database is too cumbersome or difficult.
But if the database contains a single relevant record, the SDNY decision means that the ENTIRE database is now relevant. NOT that the record is relevant — the database is relevant. This is a rewriting of the term relevant. Ordinarily a court will balance the need for a relevant record against the cost of production. If the single record is what is relevant, then the burden shifts.
By redefining the entire database to be “relevant” (and not merely containing a relevant document) the burden shifts. Applying the court’s reasoning, a database of 10 million records containing a single “relevant” document makes the entire database of 10 million records “relevant.” Thus, the litigant has subpoenaed not one relevant record by 10 million “relevant” records. Well, if 10 million records are “relevant” then cost is no object.
The problem is even worse in civil cases, where a litigant has a right to subpoena not only “relevant” records, but records which, with appropriate diligence, may lead to the discovery of “relevant” records. Thus, if a database containing a single “relevant” record is “relevant” then a cloud service that contains multiple databases might lead to the discovery of a database that might contain a single record that might be relevant.
I don’t think we are in Kansas anymore.
The other problem with the “burden” argument is that a party is not excused from producing “relevant” records simply because it is costly or difficult to do so. Rather, if production is difficult, this shifts the cost of production to the party seeking to obtain the records. In the FISA case, the government had to pay the phone companies to produce everyone’s records. And thus, data production became a profit center for the phone companies. So where’s the incentive to resist? Besides, if there is a secret subpoena, for the most part, resistance is futile.
The Litigation Problem
It would be one thing for the FISC and District Court to say that the records of Abu Nazir are “relevant” to a terrorism investigation, and obtaining the entire database of everyone’s phone calls was “necessary” to get relevant records. While I disagree with that analysis on legal, policy and technical grounds, it at least has the benefit of not perverting the definition of the word “relevant.” My phone calls to my mother are in no way “relevant” to the government’s investigation of terrorism, but the government may — and I stress may — be able to show that they need those records to find an actually relevant record.
But this is not what the court said.
The court said that my calls to my mom ARE now relevant to the investigation. They did this because Section 215 only allowed the NSA to subpoena “relevant” records. So the court redefined “relevant.”
Under this rationale, if a private litigant in a divorce case seeks the GPS records of his or her spouse, the litigant can now seek the entire database of everyone’s GPS records unless the recipient can show there is no “reasonable possibility that the database does not contain a relevant record.” The database becomes magically relevant.
And that is the problem with redefining the word “relevant.” When everything is relevant, everything can be subpoenaed. And it will be.
‘When I use a word,’ Humpty Dumpty said, in rather a scornful tone, ‘it means just what I choose it to mean — neither more nor less.’ The question is,’ said Alice, ‘whether you can make words mean so many different things.’
Less than two weeks ago, a federal court district judge in Washington, D.C., ruled that the wholesale collection of metadata did violate the Constitution’s ban on unreasonable searches.
Both rulings are certain to be appealed the Washington decision to the D.C. Circuit Court of Appeals and last week’s rulings. Ultimately, whichever side loses in the appeals courts probably will ask the Supreme Court to rule on the issue.