The White House officially unveiled its proposal to end the National Security Agency's call records program Thursday, but key questions remain about just how far the changes would go, even if approved by Congress.
"I think the president was under a lot of pressure from his own intelligence officials and agencies to continue bulk collection in some form, and I am encouraged by the fact that he has decided not to do that," said Elizabeth Goitein of the Brennan Center, who nonetheless warned that "aspects of bulk collection could continue" even after the changes are approved.
Under the White House's plan, the NSA would no longer collect in bulk records detailing the time, duration and numbers involved in a phone call. Instead, the phone companies would hold on to the records, which the NSA would be allowed to acquire only through requests pertaining to specific numbers and approved by the secret foreign intelligence surveillance court -- with an exception for "emergencies." The government would only be allowed to request records when, according to a senior administration official speaking to reporters Thursday morning, the court determines that there is a "reasonable, articulable suspicion that the numbers are associated with a terrorist or a terrorist group." Privacy advocates would prefer a stricter standard -- that the records sought are "relevant and material to an authorized investigation."
The request would include records up to two "hops" from the target, meaning not just the records from the initial number but also those of every number the target is in contact with. Prior to last June, when information about the breadth of the program was first leaked by former NSA contractor Edward Snowden, the NSA was allowed to query its database for records up to three "hops" from a target. Yet even under the new proposal, the government would still be collecting the communications records of potentially hundreds of thousands of people with no connection whatsoever to terrorism.
That's not the only concern however.
"The collection is only half of the equation, and what they do with it afterwards is very important," said Michelle Richardson of the ACLU.
That's where things get tricky. Although the government would no longer be collecting as many records, it's not clear what would be done with the records after they're collected, and whether the government would need to have reasonable suspicion or a new court order to look through the records it has. In other words, while "bulk collection" might be ended in the sense that the government is beginning with a single phone number, rather than requesting all the records at once, "bulk preservation" could continue, Goitein says, depending on what the government does with the records it acquires.
"The problem is there are no meaningful limits on what they can do with that data, the only limits are on what they have to do to get the data," says Goitein.
Asked by msnbc how the government would handle the records it collects, National Security Council spokesperson Caitlin Hayden said that "the retention and dissemination of any data received would be subject to FISC approved minimization procedures." All that means is that whatever the government ultimately decides to do with the data would have to be okayed by the secret foreign intelligence surveillance court. It's entirely possible that the court would approve "minimization procedures" that allow the government to search through the data it has already acquired without reasonable suspicion and without asking permission from the court. The court has previously accepted "minimization procedures" do just that.
On a conference call with reporters, a senior administration official said in response to questions about how long the NSA would be allowed to query the data after it is obtained, "there would be some limited time period, and I don't think we’ve settled on what that would be, and obviously that's something we’re going to have to talk with Congress about." Prior to Snowden's leaks, the NSA held its phone records for up to five years, while the telecommunications firms hold them for about a year and a half.
Beyond that, civil liberties groups are concerned that the president's proposal would not address other forms of data collection under section 215 of the Patriot Act, the provision of the law from which the government has based its authority for its phone records program. Section 215 is set to expire in 2015 if not reauthorized by Congress.
Ending bulk collection of phone records without also ending other forms of bulk collection of data only addresses one aspect of the problem, privacy advocates say. There are also other aspects of surveillance law that civil liberties groups would like to see changed.
Only one proposal currently being considered, the USA Freedom Act, backed by Wisconsin Republican Rep. Jim Sensenbrenner and Vermont Democratic Senator Patrick Leahy, would address those concerns. A separate proposal from the House intelligence committee is similar to the Obama administration's proposal, but it would allow the NSA to acquire data from communications providers and seek court approval after the fact, which is a dealbreaker for privacy advocates.
"We're wary that [the White House proposal] becomes the end-product instead of the jumping off point, says Richardson. "This is a fine place to start, but we need to think more broadly."