What's the Legal Significance of the Data Mining?

Marty Lederman

Today's New York Times reports that "the 2004 dispute over the National Security Agency’s secret surveillance program that led top Justice Department officials to threaten resignation involved computer searches through massive electronic databases, according to current and former officials briefed on the program. It is not known precisely why searching the databases, or data mining, raised such a furious legal debate. But such databases contain records of the phone calls and e-mail messages of millions of Americans, and their examination by the government would raise privacy issues."

Josh Marshall understandably wonders what's going on here. After all, as the Times itself notes, the fact that the N.S.A. was involved in data mining "has previously been reported," including importantly in the book of the Times's own James Risen. Moreover, the Administration's emphasis has been on why it did not need to comply with FISA. And yet, my understanding is that FISA generally does not restrict the sort of data mining that was likely at issue here. The electronic surveillance that FISA restricts is limited to the acquisition of the "contents" of certain communications (50 USC 1801(f)(1)), and "contents" is defined in turn to mean "any information concerning the identity of the parties to such communication or the existence, substance, purport, or meaning of that communication" (50 USC 1801(n)). According to John Yoo's latest book and other sources, the data mining that the NSA wished to use "did not provide the content of the calls," but instead revealed what the Times today calls "metadata," i.e., some information about the characteristics of the calls apart from their contents and (in Yoo's words) "devoid of information that could identify an individual."

So what was the legal dispute about?

I think there are at least three possibilities (and probably many more).

First, and least likely I think, perhaps the dispute was about another statute entirely, the Stored Communications Act, 18 U.S.C. 2702(a)(3), which provides that a provider of remote computing service or electronic communication service to the public "shall not knowingly divulge a record or other information pertaining to a subscriber to or customer of such service . . . to any governmental entity."

It's not clear that the data mining here involved any such divulgence of subscriber information by service providers. And in any event, that statute restricts only the service providers, not the government, and so it's unlikely that this is what caused the furor in March 2004. If, however, this is the source of the dispute, perhaps it centered on a very implausible theory that a statutory exemption applied due to some notion of customer consent. I'm grateful to Orin Kerr for raising this possibility, and for having earlier explained, in a slightly different context, why such a "consent" theory would have been a legal non-starter. I have more on the SCA and the weakness of the "consent exception" theory, here.

Second, perhaps the NSA data mining was the legal problem -- not because of FISA, but because of a different prohibition found in a law that had just been enacted in the Fall of 2003, the 2004 Department of Defense Appropriations Act. (Thanks to a Balkinization reader for pressing me on this theory.) I don't think this was the problem, for a reason I'll describe below, but to even get to that point, it takes a bit of exposition to explain what the legal restriction might have been. If you're not interested in the details, and want to just get to the meat of what I think the legal problem actually was, just skip ahead down the page to just before the section on the "Third" problem.

Famously, section 8131(a) of the 2004 DoD Appropriations Act had defunded another data mining program that had received substantial public attention and approbation -- the Total Information Awareness program, or TIA, which had recently been re-dubbed the "Terrorist Information Program." Section 8131(a) of the Act provided that "[n]otwithstanding any other provision of law, none of the funds appropriated or otherwise made available in this or any other Act may be obligated for the Terrorism Information Awareness Program."

Importantly, however, the DoD appropriations bill included a proviso clarifying that this TIA funding cut-off did not apply to another data-mining program: "Provided, That this limitation shall not apply to the program hereby authorized for Processing, analysis, and collaboration tools for counterterrorism foreign intelligence, as described in the Classified Annex accompanying the Department of Defense Appropriations Act, 2004, for which funds are expressly provided in the National Foreign Intelligence Program for counterterrorism foreign intelligence purposes."

OK, so there was also a funded program for "processing, analysis, and collaboration tools for counterterrorism foreign intelligence" -- let's call it "PAC-CFI." We don't know what this program consisted of, or what the specific appropriation for it was, because that is all described in a secret law -- in the Classified Annex "accompanying" the bill, which apparently "expressly" provides funds for what was then called the "National Foreign Intelligence Program for counterterrorism foreign intelligence purposes." (The modifier "foreign" was deleted in a law passed several monhs later. The current National Security Act definition of the "National Intelligence Program" (50 USC 401a(6)) is "all programs, projects, and activities of the intelligence community, as well as any other programs of the intelligence community designated jointly by the Director of Central Intelligence and the head of a United States department or agency or by the President.")

The TIA funding prohibition didn't cover this secret program, for which appropriations were specified in the Classified Annex to the law. So what's the problem? Well, the very next subsection -- 8131(b) -- also purported to impose a limitation on that data-mining program: "None of the funds provided for Processing, analysis, and collaboration tools for counterterrorism foreign intelligence shall be available for deployment or implementation except for:

(1) lawful military operations of the United States conducted outside the United States; or

(2) lawful foreign intelligence activities conducted wholly overseas, or wholly against non-United States citizens."

Perhaps the pre-3/04 data mining that OLC had approved -- and that Gonzales and Card might have been imploring the ailing Ashcroft to continue approving -- would have violated this funding prohibition.

And what might OLC's legal theory have been, prior to March 2004, for avoiding this funding limitation? Three possibilities:

a.) When President Bush signed the 2004 DoD Appropriations bill, on September 30, 2003 (just before Jack Goldsmith took over at OLC), he issued a signing statement that raised a constitutional objection to section 8131. Oddly, however, that objection was not that the funding limitation itself was unconstitutional, but instead that the classified annex was, well, classified: "8131 of the Act make[s] clear that the classified annex accompanies but is not incorporated as a part of the Act, and therefore the classified annex does not meet the bicameralism and presentment requirements specified by the Constitution for the making of a law. Accordingly, the executive branch shall construe the classified annex reference[] in section[] 8131 as advisory in effect. My Administration continues to discourage any efforts to enact secret law as part of defense funding legislation and encourages instead appropriate use of classified annexes to committee reports and joint statements of managers that accompany the final legislation."

How this objection interacts with the section 8131(b) funding restriction is oblique, at best. Here's one theory: What the signing statement is saying is that President Bush does not consider the underlying classified annex to be a validly enacted law at all, because it is not part of the public law enacted by the bicameralism and presentment that Article I of the Constitution requies. (This -- whether the Constitution permits classified laws -- is actually a fascinating topic in and of itself.) If so, then the specific appropriation in that Classified Annex is treated merely as "advisory, in effect," and then (this would be the subtle, or implausible, move in the legal analysis, depending on your perspective) the funding limitation in section 8131(b) is also effectively "advisory," because it applies only to a specification that is not itself law. Perhaps DOJ reasoned that the PAC-CFI data-mining program was not limited to the funds specified in the Annex -- that it could be funded, even more extensively, by money generally appropriated to intelligence or military activities in the Appropriations Act and other laws to intelligence acitvities -- and that therefore the 8131(b) limitation does not effectively apply, either because it refers to a non-law, or because it does not extend to the other, broader founts of funding for the PAC-CFI program.

b.) More likely, OLC and/or the Vice President had simply concluded that the funding restrction in 8131(b) was substantively unconstitutional, because it impinged on the Preisdent's Commander-in-Chief authorities (the Torture Opinion/NSA White Paper theory). (My only hesitation here is that I can't figure out why that objection was not also included in the signing statement.)

c.) The NSA data-mining "program" at issue here was deemed to be distinct from the PAC-CFI program to which the funding restriction applied.

It is possible that when Jack Goldsmith looked at the question, he concluded that these (or other) legal arguments for avoiding the funding limitation were indefensible.

Possibly. But I'm skeptical, for a couple of reasons. One is that I'd be willing to wager that at least one of these arguments -- perhaps the third -- was not so far beyond the pale that it would have set off the crisis within DOJ. The bigger problem with the notion that this restriction on the PAC-CFI was the source of the March 2004 dispute is that the OLC "fix" that Jack Goldsmith reportedly developed does not appear to have been tailored to that statutory restriction: The NSA program even after March 2004 -- the one that OLC approved -- does not track section 8131(b): It was not limited to surveillance "wholly oveseas" or "wholly" against non-U.S. citizens. Instead, it allowed interception of communications that were partly overseas, and that were partly of non-U.S. citizens (the Al Qaeda and related suspects).

Third -- and this is to my mind the most likely possibility -- the legal problem wasn't the data mining itself, but instead that the uses of the data that were mined violated FISA. The Times story hints at this -- that perhaps it was not so much the data mining itself, but instead what what NSA did with the mined data, that caused the legal uproar: "Some of the officials said the 2004 dispute involved other issues in addition to the data mining, but would not provide details. They would not say whether the differences were over how the databases were searched or how the resulting information was used."

Here's the theory, roughly:

There was some sort of data mining program going on. Probably not of content, almost certainly not content reviewed by humans. That is to say, it involved computers searching through "meta-data" related to calls and e-mails, looking for certain patterns that might suggest connections to Al Qaeda or to suspicious activitiy that might be terrorism-related. (I have my theories as to what the programs might have been looking for, but don't want to get into such speculation in this forum. And in any case, my theories are probably way off.)

This data-mining indicated that it might be valuable to do more targeted searches of particular communications "pipelines" (John Yoo's phrase), looking for more specific information. But that's where FISA came in. In order to target a particular U.S. person, or to wiretap a particular "facility," FISA requires that the NSA demonstrate to the FISA court probable cause to believe (i) that the target of the electronic surveillance is a foreign power or an agent of a foreign power, and (ii) that each of the facilities or places at which the electronic surveillance is directed is being used, or is about to be used, by a foreign power or an agent of a foreign power. 50 U.S.C. 1805(a)(3).

Perhaps, as John Yoo suggests in his book, FISA would have prohibited following up on the leads revealed by the data mining with more targeted wiretaps of suspicious "channels" or "pipelines," "because we would have no specific al Qaeda suspects, and thus no probable cause."

I think what happened is that the data mining revealed something that the NSA, with DOJ's blessing, followed up on, perhaps using quite long and attenuated "connections" (e.g., phone calls and e-mails three degrees of separation removed) -- what Risen and Lichtblau's original story referred to as "an expanding chain" -- and this follow-up surveillance involved purely domestic communications, as well as communications of persons for whom there was no probable cause to believe they were Al Qaeda agents. Further speculation, with links to plenty of other bloggers, here.) If this is corerct, then it was the follow-up surveillance, not the data mining, that was the legal problem -- it didn't satisfy FISA because whatever it was NSA learned from the data mining, it was something far short of probable cause that all the subsequent targets were agents of Al Qaeda. And OLC concluded that Article II did not justify disregarding FISA.

Goldsmith reportedly insisted that the surveillance be justified based on the AUMF, which imposed two limitations:

a. First, on the view of the Court in Hamdi (later explained in much greater detail by Jack Goldmsith and Curt Bradley in their Harvard Law Review artcle on the AUMF), the AUMF only authorizes conduct that had historically been undertaken by the Preisdent in wartime. Roosevelt and other Presidents had intercepted overseas telegrams and other international communications; but there was no precedent for interception of wholly doemestic communications without court approval.

b. Second, the AUMF itself requires a nexus to those responsible for 9/11 -- which is where the OLC requirement came from that the communications involve at least one person in, or associated with, Al Qaede or related groups.

So OLC insited these two criteria be satisfied in order to avoid FISA's strictures. (I should emphasize that I do not think this AUMF theory is adequate justification for disregarding FISA -- I'm only trying to describe the possible legal argument here.)

But who knows for sure? As Orin writes, "we still don't know exactly what the legal issues were that were in dispute. I can come up with about 10 different theories" (Orin knows more about all this stuff than I do, which is why I've only provided three, with some sub-theories!) -- "but I just don't know which one is particularly likely to be right."

P.S. Unfortunately, most of the reaction to the Times story is about the question of whether it helps or hurts the allegations that the Attorney General lied to Congress. Folks, really, that's a sideshow. Of course he tried as much as possible to deceive the Congress, in numerous respects, including in order to keep them from discovering what Comey bravely and responsibly revealed. No one -- no one -- still thinks that Gonzales's testimony is at all valuable or relevant, or ever has been, for purposes of informing Congress about anything. For goodness sake, when Newt Gingrich and Jonah Goldberg and Orrin Hatch and Jeff Sessions all think you're dishonest, well . . . there isn't a single issue on which there is more consensus in America than whether Alberto Gonzales is trustworthy and has been a truthful Attorney General. And, in my view, whether the deceptions and prevarications and dissembling add up to perjury or not is really neither here nor there. It wasn't about perjury with Clinton, and it's not now. There was a serious cover-up here, but it largely occurred before the Times broke the NSA story in 2005. Since that time, the scandal is not that any particular Administration witness wrongly reassured any member of Congress about anything -- it's not as if anyone listened to Gonzales's testimony and then said, "well, then, ok, never mind about that NSA thing" -- but instead that the Administration (and those in Congress aware of the details of the NSA program) have continued to hide the details of the program, and the legal justifications during the lifespan of the program, from Congress as a whole and (with the exception of some technical details that should remain classified) from the public, as well. The focus now, in other words, should be on the substance of the NSA and FBI conduct, on DOJ's justifications therefore, and on the breakdown in the separation of powers -- and not the parsing of the Attorney General's testimony, which has never been useful for anyone in Congress anyway.

P.P.S. I've turned off the comments function, because unfortunately the comments on this blog long ago devolved into something . . . well, something not worth reading. In and of itseld that's fairly benign; the problem, as I see it (and Jack may well disagree), is that it effectively discourages serious discussion in the comments section of the substance of our posts and the questions they raise. That is to say, we can't get a really good discussion going, the way they do on Obsidian Wings, Crooked Timber, and precious few other blogs. I don't mean to suggest that our comments are uniformly unhelpful -- far from it; the problem is that the chaff buries the wheat to the point where it's not worth the effort to cull it. Accordingly, if you have substantive reactions and/or other theories, please let me know by e-mail, thanks.
Posted 7:11 AM by Marty Lederman [link]