EFF recently filed comments with the Privacy and Civil Liberties Oversight Board (PCLOB) concerning Section 702 of the Foreign Intelligence Surveillance Amendments Act (FAA), one of the key statutes under which the government claims it can conduct mass surveillance of innocent people's communications and records from inside the US. EFF maintains that the government's activities under Section 702 that we know about are unconstitutional, not supported by the statutory language, and violate international law.1 

The PCLOB, created as a result of recommendations by the 9/11 Commission, is an agency charged with ensuring privacy and civil liberties are included in the White House's counterterrorism activities. After a long delay, the board became operational in February 2012. Their first report, issued in January 2014, reviewed the government's use of the Patriot Act to collect all Americans' calling records. The report largely agreed with our concerns about that program, carefully described how it is illegal and recommended the government stop the program. In our recent comments, we urge the PCLOB to take the same careful approach to the government's activities under Section 702.

Specifically, we urge the PCLOB to work on:

1) Transparency: The PCLOB should push for more disclosures about surveillance conducted under Section 702, especially as it impacts innocent people in the US and around the world. The comments outline what is known about two types of spying the government has said are authorized by Section 702: the PRISM program and “upstream” collection. We also point out key information needed to have a real public debate on these issues, including specifics about the programs that have no reasonable harm to national security such as the number of orders sent and the number of US person communications collected. Throughout the comments, we offer specific suggestions about additional technical and policy information that should be made publicly available. This includes whether any of these programs limit or restrict the architecture or technology of private-sector systems. The information will help innocent people around the world understand whether and how their non-suspect communications are being collected, analyzed, used, and retained by the US government.

2) A Constitutional Analysis: As it did concerning the telephone records collection program, we urge the PCLOB to perform a serious Constitutional analysis of the government's activities under Section 702. Section 702 is being used to authorize modern-day general warrants inconsistent with the Fourth Amendment. The comments discuss how the founders specifically rejected the so-called “hated writs” on the grounds, among others, that the writs did not require judicial approval, particularity, and a finding or probable cause prior to seizure and search of the "papers and effects." The comments urge the PCLOB to consider the serious threats to privacy including:

• Searches done "about" a target of surveillance, which collect the content of Americans and trigger Fourth Amendment requirements;
• "Backdoor searches," which are searches of potentially innocent communications sucked into the NSA's databases containing phone calls and emails collected under Section 702;
• The mass collection and analysis of millions of Americans' communications, both domestic and international, which the government claims were merely "incidentally" collected;
• The court review limited to "procedures" for targeting and minimization rather than the actual seizure and searches. This abstract approval is not a sufficient substitute for the Fourth Amendment's requirement of a "neutral and detached" magistrate, especially when the NSA is seizing millions of complicated communications, like "multiple communications transactions" and nested messages including those of innocent users.
• Filtering only by IP address, which is what the government says it does to protect Americans. IP filtering cannot tell what passport a person holds and is grossly insufficient as a way to ensure that only the communications of foreigners abroad are ultimately analyzed. EFF notes specifically that many American websites (including the House of Representatives website) load content from foreign websites with foreign IP addresses and that many Americans use VPNs and other common technological processes which result in Americans having foreign IP addresses.

3) A Statutory Analysis: We also urge the PCLOB to engage in a statutory analysis of Section 702 and note, as it did for Section 215, that the statutory language does not provide for bulk collection. Instead, the statute forbids the government from "intentionally acquiring" fully domestic communications and requires "reasonably designed" procedures. We write: "it strains credulity to think that mass collection from the fiber optic cables located inside the US. is either 'reasonably designed' to ensure that acquisition is limited to persons believed to be outside the US," especially given that the cables carry both international and domestic traffic.

4) An International Analysis: We point out that Section 702 violates international human rights law, as explained in detail in the Necessary and Proportionate Principles. Section 702's mass surveillance is inherently disproportionate and is improperly discriminatory in ignoring the privacy rights of innocent foreigners.

5) Recommending Fixes: We urge the PCLOB to suggest legislative fixes to, or repeal of, Section 702. This includes narrowing definitions in the statute, like "foreign intelligence information;" ensuring a judge approves specific targets; and ensuring more information is released about the programs.

A full copy of the comments can be found here.

• 1. We say "that we know about" because there is still much we don't know about the government's actual use of the statute or its legal interpretations of it. In fact, throughout the paper we identify specific areas where the PCLOB could demand more transparency about government surveillance activities under Section 702, especially as it impacts innocent people worldwide.