If the House Judiciary Committee keeps to its current schedule, on Thursday it will meet to consider the third version of the USA Freedom Act in the last two years. I’ve seen a very recent draft of the bill, and from my perspective in its current form the bill effectively acts as if the Snowden revelations and several independent reviews of the PATRIOT Act Sec. 215 metadata program never happened.
The bill ignores the fact that both the Congressional Joint Inquiry into the 9/11 attacks and the 9/11 Commission itself found that the attacks happened because of information sharing and analytical failures, not because of intelligence collection shortfalls. The bill claims to end the controversial telephone metadata program, but a close reading of the bill reveals that it actually leaves key PATRIOT Act definitions of “person” or “U.S. Person” intact—and under 50 U.S.C. sec. 1801(m) of the PATRIOT Act, “person” is defined as “any individual, including any officer or employee of the Federal Government, or any group, entity, association, corporation, or foreign power." It’s the “group, entity, association or corporation” language that leaves open the possibility of continued mass telephone metadata surveillance under the PATRIOT Act.
The bill also grants the government sweeping “emergency” collection authority not tied to an imminent threat of death or bodily harm, which has generally been the standard for such programs in the past. The bill allows the government to retain U.S. Person call detail records if the government alone determines such records are “foreign intelligence information”. The bill’s FISA court revisions include the creation of amicus curiae (previously called “special advocates” in earlier version of the USA Freedom Act) that in theory would help the court work its way through particularly thorny cases potentially involving major interpretations of law. But there are two key caveats to this provision: the FISA court has sole discretion to appoint—or not appoint—these amicus curiae and the government still retains the ability to invoke the “state secrets” privilege, which would render the presence of the amicus curiae moot.
What is missing from the bill is at least as significant as what it contains.
The bill does not address bulk collection under EO 12333 as reported by former State Department official John Napier Tye. Further, the bill fails to address bulk collection and retention of US Person records under Sec. 702 of the FISA Amendments Act.
The bill lacks mandatory US Person data destruction and audit compliance provisions for information previously collected on US Persons not currently the subject of a criminal investigation. It contains no protections for national security whistleblowers; has no bar on the government imposing “back doors” being built into electronic devices, software or hardware; does not bar the USG from targeting U.S. Persons solely on the basis of their use of internet anonymizing technology such as Tor; and does not address the recently revealed DEA telephony metadata program.
Whether supporters of the far more sweeping Surveillance State Repeal Act will be able to get a hearing on that bill or have the chance to take provisions of the SSRA and offer them as amendments to the USA Freedom Act—either in committee or on the House floor—remains to be seen. One thing is certain: the fight over reforming our nation’s surveillance laws is about to get much more intense, and quickly.