How Many Americans Might Be Under Surveillance?

Marty Lederman

Some press stories about DNI's McConnell's El Paso Times interview, such as this one in the Washington Post, are focusing on the fact that McConnell said the U.S. is "targeting" thousands of foreigners, but fewer than 100 U.S. persons.

This may, in fact, be true, in the sense that there are fewer than 100 U.S. persons whose calls and e-mails are being specifically, i.e., "directly," intercepted (e.g., a particular tap on an American's phone, or its modern-day equivalent).

But this does not mean, as the Post suggests, that there is a "relatively low number of those under surveillance in this country." And it certainly does not mean that the new Protect America Act could only affect such a small number of U.S. persons.

The most important point is that McConnell's "fewer than 100" comment did not include all of the communications of U.S. persons that are intercepted when the surveillance is "directed at" someone overseas. Under the new law, the NSA would have the authority to intercept virtually all communications made by anyone overseas (not only suspected terrorists), as long as it could in some sense say that its surveillance was "directed at" that overseas person. This means, of course, that even if the NSA does not directly tap into every phone and computer in the U.S., the NSA could still intercept and maintain all international communications of U.S. persons, because each of those communications is, of course, with someone overseas -- and the NSA can freely intercept the latter's communications, based on no standard at all.

The key question is what happens when the NSA surveillance of foreigners -- possibly even vast surveillance of huge numbers of overseas communications -- invariably picks up communications that have a U.S. person at one end. Can the NSA listen to (or read) the U.S. person's communications? Can it maintain those? Can it share them with other government agencies? Make particular uses of them (i.e., for criminal investigations)? Does it have to satisfy any standards in order to do any of those things? Does it have to make any showing to a court with respect to any of those uses of U.S.-person communications? Is there congressional oversight? Does the Fourth Amendment impose any limits on such uses? Does the new statute supersede, and render inapposite, the existing internal Executive branch orders (e.g., USSID-18), which at least imposed minimal "minimization" requirements with respect to such foreign-to-domestic communications?

The fact that the NSA might not specifically "target" the international communications of U.S. persons without a court order, in other words -- that only 100 or so Americans are "targeted" -- is small solace if it the agency can obtain, read, use and maintain all such communications anyway, by simply saying that its surveillance is "directed" at the foreign end. And that's what the new statute appears to authorize.

Moreover, it's not even clear that the statute does not authorize warrantless surveillance "directed at" U.S. persons -- e.g., a tap on a U.S. person's phone -- so long as the government can say that such surveillance is also "directed at" the foreign persons with whom the American is communicating. Orin Kerr and others have suggested that a particular interception is necessarily either "directed at" someone overseas, or at someone in the U.S., but can't be "directed at" both. But the statute doesn't say that. The only requirement under section 1805A is that the surveillance be "directed at" someone reasonably believed to be overseas.

If, for example, the government is (genuinely) interested in the way in which a foreign scholar is influencing her American counterparts, and they know that she and I communicate, can the NSA put a tap on my phone, on the theory that the surveillance is at least in part "directed at" the foreigner? Orin thinks not. And I hope he's right. It would be nice if Congress and the Administration could agree on a statutory definition of "directed at" that would foreclose such an interpretation of 1805A. But what in the current statute would prevent such surveillance? Note that, unlike current FISA section 1802, which allows warrantless surveillance "solely directed at" foreign government communications systems here in the U.S. -- and even then, only if there is no "substantial likelihood" that such surveillance will acquire the contents of any communication to which a United States person is a party -- section 1805A of the new law requires only that the surveillance be "directed at" someone overseas, not "solely" directed at them.

Again, however, this is not the main concern. Even assuming arguendo that the new statute would not allow the NSA to tap my phone and computer without court order in order to glean information about my foreign correspondents, it remains the case that under the Act the NSA could intercept all of the communications of that foreign scholar, based on no showing at all -- indeed, could make such interceptions of the foreign scholar because it is interested in the activities of Americans with whom she deals -- and could thereafter read, maintain and use all of the communications she makes with persons here in the U.S. And this is true with respect to the communications of every single person in the world who is "reasonably believed" to be overseas.
Posted 8:31 AM by Marty Lederman [link]