EFF: House Lawmakers Extend Section 215 into Next Year Even Though They Had Years to Stop Illegal Overcollection of Americans’ Sensitive Data

House Lawmakers Extend Section 215 into Next Year Even Though They Had Years to Stop Illegal Overcollection of Americans’ Sensitive Data

With federal agencies set to run out of money this week, House lawmakers today passed a short-term funding bill that contained a nasty surprise. Tucked into the end of this must-pass legislation, in a section titled “Other Matters,” is language reauthorizing three Foreign Intelligence Surveillance Act (FISA) authorities currently set to expire on December 15, 2019. The new expiration date would be March 15, 2020.

The extension of these surveillance authorities, even for three months, is bad enough. Hiding the language in the back of a must-pass funding bill shows a patent disregard for the importance of this issue.

One of the expiring authorities in question is Section 215 of the USA PATRIOT Act. Section 215 has become synonymous with the NSA’s database of billions of telephone records, known as the Call Detail Records (CDR) program, but it actually has an even wider scope. In addition to authorizing ongoing collection of telephone records, Section 215’s “business records” authority allows the government to obtain a secret order from the Foreign Intelligence Surveillance Court (FISC) requiring third parties to hand over any records or other “tangible thing” if deemed “relevant” to an international terrorism, counterespionage, or foreign intelligence investigation.

Since 2006, EFF has been suing over the government’s mass surveillance programs, including the bulk collection of billions of Americans’ domestic telephone call detail records (showing who called whom and when). In 2013, thanks to the Snowden revelations, Congress and the public were shocked to learn that the executive branch had relied on Section 215 to conduct this mass surveillance program. After a federal appeals court ruled that the government’s interpretation of Section 215 was “unprecedented and unwarranted,” Congress passed the 2015 USA FREEDOM Act to amend Section 215 to stop mass surveillance of Americans’ telephone records. Instead, the law limited the government’s collection records of calls within “two hops” of a “specific selection term.” It also included an expiration date on the authorities to force Congress to revisit these programs in 2019.

However, in 2018, the NSA announced that it received large numbers of CDRs it should not have had access to under USA FREEDOM, and that these “technical irregularities” began in 2015. Despite this, the NSA encountered yet another “overcollection” incident just months later. As a remedy, the NSA deleted every record it had collected since the technical irregularities began and announced that it had voluntarily stopped the CDR program entirely.

Earlier this fall, both in response to these revelations and because the authority for the programs are expiring, both the House Committee on the Judiciary and the Senate Committee on the Judiciary called witnesses from the NSA, the FBI and the DOJ to discuss Section 215. The witnesses told both Committees they were requesting the renewal of the legal authorization for CDR program - that they had voluntarily shut down - because it might be useful one day. Additionally, the witnesses confirmed that the 215 “business records” provision may allow the government to collect sensitive information, like medical records, location data, or even possibly  footage from a Ring camera. Both Committees appeared rightfully skeptical.

Even outside of the hearings, the DOJ, FBI and NSA have also been slow to respond to requests for information from concerned Representatives and Senators. Senator Wyden sent a letter to the Office of the Director of National Intelligence in July 2019 asking about the collection of sensitive geolocation information using Section 215 and only received a reply in November. Similarly, Senators Leahy and Lee sent a letter to the Office of the Director of National Intelligence and the Attorney General in July seeking more information about overcollection of CDRs and have yet to receive a response.

It’s clear that relying on the NSA to remedy its failures to stay within the law as passed by Congress is insufficient and that additional oversight and transparency measures are desperately needed. EFF and other civil liberties advocates were hopeful Congress would take this well-timed opportunity to enact real reform and necessary transparency.

Instead, Congress hid an extension of these authorities in a funding bill, without debate and without consideration of meaningful privacy and civil liberties safeguards to include. While we are very disappointed in this decision, we will continue to push Congress to pass real reform this invasive surveillance authority in March 2020.