FYI.

This story is over 5 years old.

Tech

This Is the Secret Court Order That Forced the NSA to Delete the Data It Collected About You

The court found an "institutional lack of candor on NSA's part and emphasized that this is a very serious Fourth Amendment issue."
Image: Shutterstock

A newly released court opinion from the secretive Foreign Intelligence Surveillance Court (FISC) shows that for years the NSA improperly and perhaps illegally surveilled Americans. The court order triggered the surprise announcement two weeks ago that the agency would be severely scaling back its domestic surveillance and destroying previously collected data on Americans.

Thursday, the Department of Justice released the 99-page court opinion from last month that ordered the National Security Agency to delete much of its surveillance on American people, which was collected improperly and in potential violation of the Fourth Amendment. The DOJ released the opinion as part of a 2015 plan to be more transparent.

Advertisement

The NSA collected data about Americans if they even mentioned a foreign target.

The opinion is a rebuke of many of the NSA's surveillance collection practices under Section 702 of the Foreign Intelligence Surveillance Act, the powers of which were expanded under the US Patriot Act. According to the opinion—parts of which are redacted—the NSA improperly collected untold numbers of "multi-communications transactions" (MCTs) as they were in transit around the internet. The NSA is intentionally vague about what MCTs are, but they are believed to be groups of emails, metadata, screenshots of your inbox, and still-classified types of digital information (here's the best primer explaining MCTs).

Under Section 702, the NSA is allowed to collect domestic communication if Americans are communicating directly with a "foreign intelligence target" as approved by the FISC court. According to the opinion, the NSA had been collecting information if a foreign target was merely mentioned in the communication.

"Upstream collection could acquire an entire MCT for which the active user was a nontarget and that mostly pertained to non-targets, merely because a single discrete communication within the MCT was to, from or contained a reference to a tasked selector," Judge Rosemary Collyer wrote. "Such acquisitions could take place even if the non-target active user was a U.S. person in the United States and the MCT contained a large number of domestic communications that did not pertain to the foreign intelligence target."

Advertisement

Collyer's opinion—which is worth reading in full if you're at all interested in privacy—contains a number of other important details:

  • The NSA was found to be regularly and improperly sharing information about Americans with the CIA, FBI, and other intelligence agencies.
  • Internal NSA reviews found that a classified number of agents had conducted "improper queries" on Americans in 2015 and 2016; the NSA blamed "human error" and "system design issues" for these improper searches.
  • An internal review of NSA searches between November 2015 and May 2016 found that as many as 85 percent of searches of Americans under Sections 704 and 705(b) of the Foreign Intelligence Surveillance Act "were not compliant with applicable [data] minimization procedures," meaning the NSA did not take proper steps to minimize the amount of data collected about Americans in those cases.

Earlier this month, the NSA announced that it would stop this type of collection and would delete data that was collected improperly. Now we know that at least part of that announcement was made because the FISC court ordered the agency to, because the NSA could not prove that the surveillance was legal under the Fourth Amendment. The court order says that the NSA must delete this information within one year.

'Compliance problems' also led to collection of data about Americans.

According to the order, in 2016, the FISC asked the NSA to prove that Section 702 collection involving Americans was legal under the Fourth Amendment. It also asked the US government for internal reviews about the program, which it did not initially disclose: "The Court ascribed the government's failure to disclose those reviews at the October 4, 2016 hearing to an institutional 'lack of candor' on NSA's part and emphasized that 'this is a very serious Fourth Amendment issue,' Collyer wrote.

Finally, the court gave the US government a January 31, 2017 deadline to prove the constitutionality of its program; the government asked for an extension to May 26. The court granted a shorter extension to April 28. Rather than prove the constitutionality of the program, the court opinion noted that the NSA instead had "chosen a new course:" The destruction of improperly collected data and the narrowing of its collection practices.

The NSA will continue collecting data under Section 702 of the Patriot Act, but the FISC court ordered that the NSA must "limit all acquisitions to communications to or from an authorized 702 target" in order to comply with the Fourth Amendment. The NSA will also no longer be able to share 702 surveillance with the FBI, CIA, or other intelligence agencies unless they follow specific data minimization procedures.

The court order gives us more background and specifics on what we already knew: Much of the NSA's surveillance of Americans was unconstitutional, and the agency regularly collected things it wasn't supposed to.