Watered Down

05.22.14

The NSA Wins Again. You Lose

The USA Freedom Act, once lauded by privacy and technology groups, passed the House today in a watered-down form.

After nearly a year of revelations about the shocking extent of the National Security Agency’s surveillance efforts, lawmakers have finally passed legislation limiting the agency’s ability to collect information on American citizens. But if you were hoping for the kind of rock-solid reform that guarantees the agency won’t be able to cast enormous nets for your phone and Internet data, don’t hold your breath.

The USA Freedom Act, which passed Thursday in the House of Representatives 303-121, was initially lauded by privacy advocates and tech companies as a major step forward in balancing Americans’ privacy with the need for foreign intelligence. But thanks to quietly applied pressure from the intelligence community, the bill is now a very different animal from the one that passed unanimously in the House Judiciary Committee—so much so that many of its biggest cheerleaders have jumped ship.

Another red flag came as the White House announced its support (PDF) for the amended bill, saying it would “provide the public greater confidence in our programs and the checks and balances in the system.” Kevin Bankston, a policy director at the New America Foundation, said, “Either hell has frozen over or it’s been totally watered down.”

In many ways the USA Freedom Act was meant to be an antidote to the much-derided USA Patriot Act. When Congress passed the Patriot Act just weeks after 9/11, there was virtually no opposition to expanding government surveillance powers from either side of the aisle. In fact, only a single senator, Russ Feingold of Wisconsin, took the unpopular position of rejecting the bill, warning fellow lawmakers that it would allow the government to “go on a fishing expedition and collect information on virtually anyone,” as long as it claims the information is “relevant” to a terrorism investigation.

Fast-forward to 2013, when documents obtained by Edward Snowden revealed the government had actually gone far beyond what the law proscribed, radically reinterpreting in secret the law’s notion of “relevance” to allow the mass collection of phone records from virtually every American citizen. It created, in effect, a body of secret law concealed from the American public through court opinions issued by clandestine intelligence tribunals—many of which remain classified.

The goal of the Freedom Act was simple: end bulk collection on Americans and impose new transparency requirements on surveillance orders. But after amendments were pushed through—without debate by the House Rules Committee—after backroom meetings with members of the intelligence community, the bill became too bitter a pill for NSA reformers to swallow. Many of those who hyped the legislation in its initial stages pulled their support, worried a “gutted” bill would muzzle future calls for more comprehensive reform.

The Reform Government Surveillance coalition—which includes Google, Twitter, Yahoo, Apple, Facebook, Microsoft, and Dropbox—issued a statement on Wednesday saying the amended bill has “moved in the wrong direction.”

“I think it’s ironic that a bill that was intended to increase transparency was secretly changed between the committee markup and floor consideration,” said Rep. Zoe Lofgren (D-CA), who originally co-sponsored the bill. “And it was altered in worrisome ways.”

“There is strong bipartisan concern that this bill makes it legal for the NSA to continue mass surveillance of U.S. citizens,” Lofgren said in a statement emailed to The Daily Beast after the vote. “Without much needed improvements to the USA FREEDOM Act, Congress risks a continuation of mass surveillance in this extension of the Patriot Act.”

At issue was the modified language concerning the “specific selection terms” the NSA can use to get information. Whereas the original bill explicitly limited the agency to search terms that “uniquely describe a person, entity, or account,” the modified version offers only broad examples of those terms, “such as a term specifically identifying a person, entity, account, address, or device.” [emphasis added]

Given the NSA’s demonstrated propensity for exploiting loopholes in both the law and the computer networks it accesses, it seems more than likely the agency will do whatever it can to continue bulk collection—or at least something very closely resembling it. Since the search terms are no longer strictly defined, it seems the NSA could, for instance, specify broadly defined collection targets based on a city, state, or ZIP code.

"Regrettably, we have learned that if we leave any ambiguity in the law, the intelligence agencies run a truck right through that ambiguity,” said Rep. Lofgren on the House floor.

“Unfortunately, the bill’s changed definitions, the lack of substantial reform to Section 702 of the Foreign Intelligence Surveillance Amendments Act, and the inability to introduce a special advocate in the FISA Court severely weakens the bill,” said Mark Jaycox, a legislative analyst for the Electronic Frontier Foundation, one of the groups that initially supported the bill. “In short, it doesn’t achieve the goal of ending the mass spying.”

Large tech companies also pulled their support. The Reform Government Surveillance coalition—which includes Google, Microsoft, Twitter, Yahoo, Apple, Facebook, Microsoft, and Dropbox—issued a statement on Wednesday saying the amended bill has “moved in the wrong direction.” 

“The latest draft opens up an unacceptable loophole that could enable the bulk collection of Internet users’ data,” the companies said. “While it makes important progress, we cannot support this bill as currently drafted and urge Congress to close this loophole to ensure meaningful reform.”

Rep. Dutch Ruppersberger (D-MD) retorted, saying the bill would still have its intended effect of ending the NSA’s bulk-collection program. “Those that say this bill will legalize bulk collection are wrong,” he said. “They’re trying to scare you by making you think there are monsters under the bed. There aren’t.”

Rep. John Conyers (D-MI) acknowledged the loophole, but insisted the bill should nevertheless move forward. “Nothing in the definition explicitly prohibits the govt from using a very broad selection term, like area code 202 or the entire eastern seaboard,” he admitted. However, he said: “We must seize this opportunity. If this bill is not approved today, we’re giving our intelligence people and NSA a green light to go ahead.” Rep. Jerrold Nadler (D-NY) concurred: “To not pass this bill now would be to say to the NSA we’re passing no restrictions on you beyond what the law already has,” he said.

Also unlike the original bill, the version that passed in the House permits a loophole allowing what’s called “About” collection. This legal trick permits intelligence analysts to collect communications from American citizens if a foreign target (which, again, could be a person, entity, or location) is simply mentioned in their contents. The new bill also maintains limits on what kind of information Internet companies are allowed to share with their customers about when, why, and how often they hand over data to the government.

The modifications left privacy advocates in a tough position, because rejection of the modified Freedom Act would likely pave the way for another “reform” bill authored by the intelligence community’s allies in Congress, which proposes not only keeping the NSA’s surveillance power but expanding them. Still, some privacy advocates are optimistic. The version to be considered in the Senate, led by Sen. Patrick Leahy (D-VT), still has the opportunity to re-apply the House bill’s privacy protections.

“I think they can and they will,” said the Electronic Frontier Foundation’s Jaycox.