76 BOOK REVIEW VOL. 101 NO. 1 NATIONAL SECURITY. CIVIL LIBERTIES. CAN WE

IN THE WAKE OF A CATASTROPHIC TERROR- HAVE BOTH? Intelligence Surveillance Court (FISC). IST ATTACK LIKE 9/11, what balance should Instead, the government grounded the the government strike between its weighty programs on the President’s constitutional national-security responsibilities and its powers as commander in chief. The admin- equally solemn duty to preserve Americans’ BY NATHAN SALES istration eventually had second thoughts privacy and civil liberties? The question about this muscular view of presidential may sound theoretical but it has enormous power, however, and STELLARWIND was practical importance. If authorities err on placed on more stable statutory foundations. the side of assertiveness, they risk doing In 2004, the government transferred the violence to our country’s most basic values. internet metadata program to the part of the But if they err on the side of restraint, they Foreign Intelligence Surveillance Act (FISA) risk missing signs of the next plot. that authorizes the FISC to approve pen Laura Donohue, a professor at registers and trap-and-trace devices (which Georgetown University Law Center and record phone numbers dialed and received); one of the country’s leading voices in it was discontinued in late 2011. Telephony the field of national-security law, is well metadata was shifted in 2006 to FISA’s positioned to tackle the problem. Her business-records authority — known as important new book, The Future of Foreign “section 215,” which is the part of the USA Intelligence, argues that the government’s PATRIOT Act that enacted it in its current post-9/11 surveillance programs, begun form. Congress effectively abolished the by the George W. Bush administration program in the USA Freedom Act of 2015. and largely continued by President Barack Authority to collect internet and telephony Obama, represent the first kind of error. content was transferred to section 702 of Faced with an unprecedented threat, she the 2008 FISA Amendments Act (FAA), says, authorities responded with equally in which Congress approved the programs unprecedented — and unjustified — with certain limits. countermeasures. Agree or not, Donohue’s At its high-water mark, Donohue book is a must-read for lawmakers, judges, argues, STELLARWIND represented an and citizens who want to understand the enormous and unwarranted intrusion into THE FUTURE OF FOREIGN INTELLIGENCE: difficult policy choices and legal judgments PRIVACY AND SECURITY IN A DIGITAL AGE the private lives of ordinary Americans made as the nation confronts the terrorist who had no involvement in terrorism threat in the digital age. LAURA K. DONOHUE whatsoever. According to Donohue, “thou- Donohue begins by describing sands of citizens’ telephone numbers and OXFORD UNIVERSITY PRESS, 2016 STELLARWIND, a suite of NSA surveil- e-mail addresses were targeted for content lance programs launched shortly after 9/11. collection”4 in a dragnet that “swe[pt] in STELLARWIND involved what’s known as “information that describes who is commu- millions of Americans’ communications.”5 “bulk” or “programmatic” collection.1 In nicating” — the phone number one dials, Unsupervised bulk surveillance addition to targeting individual suspects, the address from which an email is sent, certainly poses serious questions about as in criminal investigations, the NSA and so on — whereas “content” is the actual privacy and civil liberties, but it’s import- swept up huge troves of data in an effort substance of the communication.2 Metadata ant to be precise about the extent to which to identify previously unknown terrorists. is the envelope, the letter is content.3 Americans found themselves in Fort In particular, Fort Meade intercepted both At its inception, STELLARWIND Meade’s crosshairs. Take, for instance, the metadata and content from phone calls and wasn’t authorized by statute, nor did two content programs. The NSA’s objective internet communications. “Metadata” is officials get permission from the Foreign was to intercept the international commu- JUDICATURE 77 nications of suspected al Qaeda operatives Moqed) who used the same frequent- located overseas, including their phone GOVERNMENT flyer number as Al-Midhar. Five other calls and emails to and from the United hijackers used the same phone numbers as States.6 So, yes, the NSA did eavesdrop on ACCESS TO HUGE Mohamed Atta: Fayez Ahmed, Mohand Americans, but this was a byproduct of Alshehri, Wail Alshehri, Waleed Alshehri, targeting terrorists in foreign countries. TROVES OF META- and Abdulaziz Alomari. . . . Officials The collection on Americans was “inci- could have found a twelfth hijacker in an dental.” (The FAA reflects this distinction DATA ENABLES IT TO INS watch list for expired visas (Ahmed as well. It expressly bars the government PIECE TOGETHER Alghamdi), and the remaining seven could from targeting Americans anywhere in have been flagged through him by match- the world,7 and authorizes warrantless THE MOST INTIMATE ing other basic information.15 surveillance only when the government What about the Constitution? Donohue seeks to monitor non-Americans who DETAILS OF OUR argues that the “third-party doctrine” of are “reasonably believed to be located Smith v. Maryland16 cannot justify bulk outside the United States.”8) Incidental PRIVATE LIVES. metadata collection. In Smith, the Supreme collection raises important concerns, to Court held that people have no reasonable be sure, and strict safeguards are needed expectation of privacy in the information to prevent misconduct. But the problem, they turn over to third parties. Police use of while serious, differs fundamentally from data enables it to piece together the most a pen register to record the phone numbers the deliberate targeting of Americans that intimate details of our private lives. dialed by a suspect therefore isn’t a “search” produced the notorious abuses of the 1960s The costs, then, are substantial. What and doesn’t require a warrant or probable and ’70s — the monitoring of Rev. King, about the benefits? Here, Donohue argues, cause. Donohue counters that section 215 Operation CHAOS, among others. the 215 program was essentially useless. simply collects too much information of the Nor should we overstate the novelty of The government could only point to a utmost sensitivity to fall within Smith. “The bulk collection in the post-9/11 era. For single case where it helped identify a information being sought is not different in Donohue, programmatic surveillance is a terrorist, and “[i]t was hardly a smoking degree. It is different in kind.”17 radical “depart[ure] from how FISA tradi- gun: for two months, the FBI did nothing More broadly, the third-party doctrine tionally worked”; normally authorities must with the information.”12 She then develops may have a dim future, as Donohue obtain FISC approval to monitor specific a more ambitious, and more debatable, suggests. Scholars have deplored it for individuals who are suspected of being claim — that metadata generally “is not decades — Orin Kerr calls it “the Lochner spies or terrorists.9 Yet certain forms of a particularly good [tool] for uncovering of search and seizure law”19 — and five bulk collection both predate FISA and were terrorist plots.”13 In fact, communications members of the Supreme Court questioned preserved by it. When Congress enacted and other metadata can be enormously its viability in United States v. Jones, a case the statute in the late 1970s, the NSA was valuable to a technique known as link involving GPS tracking.20 Yet it’s not intercepting huge volumes of telecommu- analysis, in which officials probe hidden clear that the Court is ready to abandon it nications traffic into and out of the United ties between known threats and their in national-security cases. Justice Alito’s States — specifically, it was tapping cables yet-unknown associates. If authorities had concurrence, joined by three others, in international waters and monitoring been able to analyze airline reservation data argued that long-term GPS monitoring satellite-based radio transmissions, all before 9/11, it would have been possible to amounts to a search “in investigations of without judicial supervision. Part of the uncover the links among all 19 hijackers.14 most offenses.”21 This is so because people reason for FISA’s convoluted definition of The story is worth telling at some length: reasonably expect that, for garden-variety “electronic surveillance” is that Congress Start with two men who helped fly crimes, police won’t devote the substan- wanted to maintain these capabilities.10 American Airlines flight 77 into the tial resources it would take to track their Donohue next provides a lengthy Pentagon: Nawaq Alhamzi and Khalid movements 24 hours a day. But Justice account of the founding generation’s Al-Midhar. Their names appeared on a U.S. Alito leaves open the possibility that hostility to general warrants — “promis- watchlist, because they previously had been lengthy monitoring might not require cuous” authorizations that don’t name “the spotted at a terrorist meeting in Malaysia. a warrant for “extraordinary offenses”; place to be searched and the individual on So they would have been flagged when in such cases, society might reasonably whom the warrant would be served”11 — they bought their tickets. Tugging on that expect authorities to undertake “long-term before turning to the main event: a critique thread would have revealed three other tracking . . . using previously available of telephony metadata collection, on both hijackers who used the same addresses as techniques.” Terrorism, espionage, nuclear policy and constitutional grounds. The the first two: Salem Al-Hamzi, Marwan proliferation, and other national-security now-defunct 215 program, she argues, Al-Shehhi, and Mohamed Atta, the plot’s crimes certainly sound like the sorts of was a gross affront to individual privacy. operational ringleader. Officials would “extraordinary offenses” Justice Alito and Government access to huge troves of meta- have discovered another hijacker (Majed his colleagues had in mind. 4 78 VOL. 101 NO. 1

Donohue has a somewhat more sympa- decided in the past decade, it “only denied thetic view of the content collection IT IS, IN OTHER 8 in whole and 3 in part.”31 Yet there are authorized by section 702. A legislative other signs that the FISC is more active in fix to FISA was necessary, she explains, WORDS, A TALE OF policing the government than this lopsided because of the email problem. Thanks to the batting average would suggest. The FISC’s internet’s architecture, foreign-to-foreign EXECUTIVE ACTION presiding judge recently reported that, over messages — emails sent from, say, London FOLLOWED BY a three-month period in 2013, he and his to Paris — sometimes pass through servers colleagues declined to approve nearly 25 located in the United States. As a result, LEGISLATIVE AND percent of the government’s applications, “communications previously exempted from requiring “substantive changes” before FISA had begun to fall within the statute, JUDICIAL REACTION. allowing the requested surveillance.31 The triggering the FISC approval process.”22 FISC doesn’t say “no” very much, put it says Section 702 restored the default rule: The “not yet” pretty often. feds needn’t obtain a court order to intercept Donohue concludes by proposing foreign-to-foreign communications, even if reforms that she says would strike a more they happen to pass through this country done with them. Donohue cautions that equitable balance between privacy values on their way to their final destinations. The the FISC’s review is fairly perfunctory. and national-security needs. Her first is to NSA has implemented section 702 expan- Even when a violation occurs the court is rebuild the pre-9/11 “wall” that prevented sively, using it not just to target particu- reluctant to give more than “a slap on the cops and spies from sharing information lar suspects but for bulk collection. Two wrist.”28 Yet an incident from late 2011 with one another. Doing so is necessary, she programs are of particular interest: PRISM, gives reason to hope that FISC oversight is argues, to prevent pretextual surveillance; in which the NSA receives bulk data from more robust than that. the government might “use FISA in place communications providers, and “upstream” The government alerted the FISC that of [criminal laws] . . . to avoid restrictions collection, in which the NSA taps into the the NSA’s upstream collection was sweep- that protect individual rights.”32 internet backbone. ing up telecommunications bundles that At the risk of overstatement, this would Constitutionally speaking, this surveil- included both foreign-to-foreign messages be a catastrophic mistake. The informa- lance depends on a foreign-intelligence (which may be intercepted under section tion-sharing wall was as responsible as any exception to the Fourth Amendment’s 702) as well as domestic ones (which may other factor for the government’s failure to warrant requirement, and Donohue faults not). Observing that the NSA’s procedures stop the 9/11 attacks. The 9/11 Commission a 2002 decision of the Foreign Intelligence “tend[] to maximize retention of [domes- reported that, in August 2001, a group Surveillance Court of Review (FISCR) that tic] information,” the court held that they of intelligence analysts was trying desper- she says announced such a rule “for the violated both section 702 and the Fourth ately to find Khalid al-Midhar, an al Qaeda first time.”23 “The U.S. Supreme Court,” Amendment, and it ordered the government operative who had entered the country a few she points out, “has never recognized” a to adopt stricter minimization procedures months earlier. An FBI agent saw a message foreign-intelligence exception.24 That’s within 30 days or end the program.29 The describing the manhunt and immediately true, but plenty of other courts have, following month officials came back with contacted the intelligence team, demand- including the Third, Fourth, Fifth, and more restrictive rules — among other ing to know more and offering to help. Ninth Circuits.25 Indeed, the FISCR changes, the NSA would segregate the He was told to stand down. Because he emphasized that “all the other courts bundles in restricted databases, stamp them “was designated a ‘criminal’ FBI agent, not to have decided the issue, held that the with special markings, and keep them for an intelligence FBI agent, the wall kept President did have inherent authority to just three years (down from five).30 The him from participating in any search for conduct warrantless searches to obtain court thus performed pretty much how we Midhar.” And, for good measure, he should foreign intelligence information.”26 would expect a neutral and detached magis- “destroy his copy” of the message “because While section 702 doesn’t require trate to perform. It identified constitutional it contained NSA information.” The agent judges to approve particular targets before and statutory violations, struck down the responded with an angry email: “Whatever the government monitors them, it does offending procedures, and allowed the has happened to this — someday somebody direct the FISC to review the government’s program to continue only after the govern- will die — and wall or not — the public “targeting” and “minimization” procedures ment cured the violations. will not understand why we were not more at regular intervals to ensure that they are Donohue is also skeptical of the FISC’s effective and throwing every resource we “consistent with the requirements of [the role in traditional FISA cases, describing had at certain ‘problems.’”33 Tragically, FAA] and with the fourth amendment.”27 the court as more or less a rubber stamp he was right. Days later Khalid al-Midhar The point of these procedures is to keep for the government’s surveillance requests. would help crash American Airlines flight the NSA from deliberately collecting “Between 1979 and 2003,” she observes, the 77 into the Pentagon. Americans’ communications and, if it “FISC denied only 3 out of 16,450 appli- Fortunately there are a number of prom- inadvertently does, to limit what can be cations.” And of the 18,473 applications ising reforms that stop short of rebuilding JUDICATURE 79 the wall. An important one is already in routine matters like criminal law, public executive action followed by legislative and place. FISC proceedings are normally ex health, and for “myriad other purposes”37 judicial reaction. That story points to the parte, but Congress recently authorized the — policymakers could insist on stronger strains our tripartite system of government court to appoint outside counsel to provide minimization rules with stricter limits on experiences when Hamilton’s “vigorous an adversarial perspective in a case that the types of investigations in which the Executive”38 takes decisive steps in times “presents a novel or significant interpre- information may be used. of national emergency. But it also has a tation of the law”;35 the court has named In the end, the story Donohue tells more comforting lesson about the system’s Donohue herself as one of the people who may be a familiar one after all. Facing an durability, and its tendency to roll back are eligible for appointment. In addition, unparalleled terrorist threat and immense initial excesses and restore something like to reduce the risk that rogue officers might challenges posed by technological change, the prior equilibrium. rummage around in sensitive data, poli- the executive branch responded aggres- cymakers might require judicial approval sively with novel initiatives that disrupted NATHAN A. for “[a]ny query of foreign intelligence established ways of doing business. Then, SALES is Associate databases . . . where citizens’ information as the immediate crisis receded, Congress Professor of Law at is involved.”36 (The Obama administra- and the courts began to reassert themselves Syracuse University tion required something similar for the and police the executive’s use of power College of Law. 215 program before it was abolished; more rigorously. The result was that some He teaches and analysts could query the database only if of the new programs were discontinued writes in the fields the FISC found a “reasonable, articulable while others were domesticated — allowed of national security suspicion.”) And to prevent mission creep to persist, now on more durable statutory law, counterterrorism law, adminis- — the risk that information collected for foundations and with additional safeguards trative law, and constitutional law. national-security purposes will be used in in place. It is, in other words, a tale of

1 See, e.g., William C. Banks, Programmatic 16 442 U.S. 735 (1979). 28 Donohue, supra note 2, at 68. Surveillance and FISA: Of Needles in Haystacks, 88 17 Donohue, supra note 2, at 118. 29 [Case Title Redacted], 2011 WL 10945618, at *27 Tex. L. Rev. 1633, 1635 (2010). 18 Smith, 442 U.S. at 748 (Stewart, J., dissenting). (FISC Oct. 3, 2011). 2 Laura Donohue, The Future of Foreign 19 30 [Case Title Redacted], 2011 WL 10947772 (FISC Intelligence: Privacy and Surveillance in Orin S. Kerr, The Case for the Third-Party Doctrine, Nov. 20, 2011). the Digital Age 18 (2016). 107 Mich L. Rev. 561, 563 (2009). 20 132 S. Ct. 945 (2012). 31 Donohue, supra note 2, at 139. 3 Orin S. Kerr, Internet Surveillance Law After the USA PATRIOT Act: The Big Brother that Isn’t, 97 NW. 21 Id. at 964 (Alito, J., concurring in the judgment). 32 Letter from Reggie B. Walton, Presiding Judge, U. L. REV. 607, 611 (2003). 22 Donohue, supra note 2, at 34. FISA Ct., to Charles E. Grassley, Ranking Member, Sen. Comm. on the Judiciary, at 1 (Oct. 11, 2013). 4 Donohue, supra note 2, at 19. 23 Id. at 146 (emphasis in original). 33 Donohue, supra note 2, at 31. 5 Id. at 38. 24 Id. at 145 (emphasis in original). 34 The 9/11 Commission Report: Final Report 6 See Letter from William E. Moschella, Ass’t U.S. 25 See United States v. Butenko, 494 F.2d 593 (3d of the National Commission on Terrorist Att’y Gen., to Pat Roberts, Chairman, Senate Select Cir. 1974) (en banc); United States v. Truong Dinh Attacks Upon the United States, at 270–71 Comm. On Intelligence, at 1 (Dec. 22, 2005), Hung, 629 F.2d 908 (4th Cir. 1980); United States (2001). available at http://nsarchive.gwu.edu/NSAEBB/ v. Brown, 484 F.2d 418 (5th Cir. 1973); United 35 NSAEBB178/surv34.pdf. States v. Buck, 548 F.2d 871 (9th Cir. 1977). But see 50 U.S.C. § 1803(i)(2)(A). 7 50 U.S.C. §§ 1881b, 1881c. Zweibon v. Mitchell, 516 F.2d 594 (D.C. Cir. 1975) 36 Donohue, supra note 2, at 151. (en banc). 37 8 Id. § 1881a(a). Id. at 109. 26 , 02-002, 310 F.3d 717, 38 9 Donohue, supra note 2, at 59. In re Sealed Case No. 02-001 The Federalist No. 70 (Alexander 742 (FISCR 2002). Hamilton). 10 David S. Kris, Modernizing the Foreign Intelligence 27 50 U.S.C. § 1881a(i)(3)(A). Surveillance Act, in Legislating the War on Terror: An Agenda for Reform 217, 224–25 (Benjamin Wittes ed., 2009). 11 Donohue, supra note 2, at 76. CALLING ALL MAGISTRATE JUDGES! 12 Id. at 43. 13 Id. Duke Law is now accepting applications for its 14 Markle Foundation, Protecting America’s Freedom in the Information Age: A Report Master of Judicial Studies program for sitting of the Markle Foundation Task Force 28 judges. We invite you to apply! All accepted (2002). applicants receive a full scholarship that includes 15 Stewart A. Baker & Nathan Alexander Sales, Homeland Security, Information Policy, and the tuition plus room and board. Learn more at Transatlantic Alliance, in Legal Issues in the law.duke.edu/judicialstudies/degree. Struggle Against Terror 277, (John Norton Moore & Robert F. Turner eds., 2010).