Bulk collection of signals intelligence (bulk surveillance, for short) is a controversial topic. The most well known program to collect signals intelligence “in bulk” is the bulk collection of telephone metadata authorized by the Foreign Intelligence Surveillance Court under Section 215 of the Patriot Act. Opponents of the program contended the program is an unwarranted invasion of privacy, a general search of exactly the kind prohibited by the 4th Amendment to the U.S. Constitution. Supporters of the program asserted it was and is a critical tool in the nation’s counterterrorist arsenal.
On May 8, 2015, the U.S. Court of Appeals for the Second Circuit held the language of this section could not plausibly be interpreted as authorizing bulk surveillance, though it did not rule on whether the program would be constitutional even with statutory justification. On June 1, Section 215 authority for this program expired, and on June 2, a new program was enacted into law under the USA Freedom Act requiring the metadata be held by phone companies. The National Security Agency lost the ability to query this metadata broadly based on prior arrangements from the Foreign Intelligence Surveillance Court, but continued to have access to specific numbers with an appropriate order issued by the Court.
The new program was hailed by civil liberties advocates as a step forward, but it is pretty clear it is only the first step in a broader debate over policy regarding bulk collection of signals intelligence. Regardless of where one stands on the issue, a reasoned discussion has to start with clarity about terms such as “bulk,” “collection,” and “signals intelligence.” (To the best of my knowledge, the word “of” has not engendered much controversy.)
Broadly speaking, signals intelligence refers to information contained in electronic signals used by foreign targets of interest.a Thus, the debate over bulk surveillance properly extends far beyond the phone metadata program.
Bulk collection is defined in presidential policy directive (PPD-28) as “the authorized collection of large quantities of signals intelligence (SIGINT) data which, due to technical or operational considerations, is acquired without the use of discriminants (e.g., specific identifiers, selection terms, etc.)”b But the directive does not define “discriminant,” and so there is no precise definition of bulk (or targeted) collection.
Under this definition, all signals intelligence associated with communications in, for example, Syria, would be regarded as “targeted,” simply because the selector “Syria” was used to separate Syrian traffic from other traffic. And signals intelligence associated with a communications channel linking only two individuals would be regarded as “bulk,” simply because all (two) individuals in using that channel were being monitored.
What is the commonsense meaning of the term “bulk” collection? A recent National Research Council (NRC) study on Presidential Policy Directive 28,c in which I participated as a staffer, argued that “if a significant portion of the data collected is not associated with current targets, it is bulk collection; otherwise, it is targeted.” The study went on to note “there is no precise definition of bulk collection, but rather a continuum, with no bright line separating bulk from targeted [collection].” The report acknowledges the term “significant” is itself imprecise, but in my view “significant” is at least amenable to quantification, and in principle one could argue as to whether “significant” should mean 10%, 90%, or some number in between.
A third issue involves the term “collection.” In the context of modern electronic communications, at least two conceptually different definitions are possible. Under one definition (call it Definition A), collection has occurred when the electronic signal of a communication is first captured. Under a second definition (Definition B) that is particularly important in an environment in which different communications streams are interleaved on the same physical channel, collection has occurred only when the signal has been processed to determine whether it is relevant to the purpose of the collection. In this environment, every signal must be examined to know which ones are irrelevant.
The proper measure is not whether a program is necessary but rather whether it is helpful.
The NRC study elaborated Definition B as encompassing three steps: extraction of data into discrete data items from a communications channel, filtering the extracted data for items of interest (as might be indicated, for example, by the use of a discriminant; if all data items are of interest, no discriminant is used); and storage of these items in a database controlled by the cognizant U.S. government authority. (Under this definition, the new program does not call for government collection of phone metadata.)
Concerns about bulk surveillance raise objections that can be lumped into three general categories—its legal propriety, its efficacy in the overall counterterrorism effort, and its policy implications.
Regarding legal propriety, first consider domestic U.S. law. Foreigners do not have protection against surveillance in any form, except that foreigners in the U.S. are presumed to be U.S. persons unless there is specific evidence to the contrary. Executive order (specifically EO 12333) governs the handling of communications involving U.S. persons related to a legitimate foreign intelligence investigation, and a number of analysts assert the scope of information gathered regarding such communications is vast, including both content and metadata for a wide variety of communications modalities, including phone, email, chat rooms, instant messages and so on.d Within scope, for example, are communications between two U.S. persons that happen to be routed outside U.S. borders. However, Congressional oversight over activities conducted under EO 12333 is minimal.
As for international law, Article 17 of the International Covenant on Civil and Political Rights states that “No one shall be subjected to arbitrary or unlawful interference with his privacy, … or correspondence,” and some have argued that U.S. bulk surveillance violates this provision.e However, this argument ignores Article 2(1) of the Covenant, which calls for parties to the Covenant “to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the present Covenant” (emphasis added). Thus, the U.S., as well as most analysts, have taken the view the Covenant imposes duties on a nation only with respect to activities involving individuals within its territory and subject to its jurisdiction—and does not impose duties on that nation with respect to activities involving activities outside its territory.
Regarding the efficacy of bulk surveillance, some opponents have argued the bulk collection of phone metadata authorized under Section 215 has been of minimal value because there has not been a single terrorist plot that would have happened but for information derived from the program.f That is, the Section 215 program has not been necessary for thwarting any terrorist plot. But as I have argued elsewhere,g the proper measure is not whether a program is necessary but rather whether it is helpful. For most intelligence analysts, redundant information is helpful in corroborating what is already known and increases confidence in the accuracy of a judgment, as, for example, in identifying potential targets of interest or in ruling out targets.
Along these lines, the PCLOB noted that “any particular technique or legal authority can [only rarely] be identified as the key component without which a terrorist plot would have succeeded. Intelligence-gathering tools can provide value in more indirect ways, by helping to advance investigations and focus efforts in ways that are sometimes more difficult to measure.”h Although the PCLOB went on to find no evidence the Section 215 program has made any significant contribution to counterterrorism efforts to date, this conclusion cannot be taken as an indictment of all possible bulk surveillance programs, each of which would have to be examined on its own merits for the benefits that it had provided or could be expected to provide in the future.
Others have argued that bulk surveillance results in information overload that makes it more difficult for analysts to find the information they do need.i That is, they argue a needle is more difficult to find in a big haystack than in a smaller one. Implicit in this argument is the claim the needle does exist in the haystack, and thus smarter analysis will be more helpful than adding more hay (information). But if the needle is not in the haystack, only adding more hay has even a chance of resulting in a successful needle discovery—and this is true despite the undeniable fact the additional data may place a greater burden on analysts and may still fail in the end to provide the necessary data. And until the needle is found, it is difficult to decide what information will turn out to be unnecessary before the analysis is complete.
Bulk surveillance is also useful for understanding events that have occurred in the past.j It can easily happen that information collected on Day X alerts analysts to the importance of a certain event A that occurred before Day X. Under such circumstances, it would only have been a matter of luck that any targeted surveillance operating before Day X would provide information about A, because A was not known before Day X to be important.
Finally, many policy implications of bulk surveillance remain to be addressed. How and to what extent, if any, should safeguarding the privacy of foreigners be relevant to U.S. collection of intelligence for national security purposes? Through PPD-28, President Obama granted foreigners certain privacy rights regarding information gathered on them through bulk surveillance. Should this step be rolled back, be the first step in treating foreigners and Americans alike, or be the last step along this path?
Many policy implications of bulk surveillance remain to be addressed.
A second issue is the scope of bulk surveillance. As noted, Section 215 authority has been used to justify bulk surveillance on domestic telephone metadata. But in principle, bulk surveillance could apply to communications modalities apart from telephone and to all kinds of data (indeed, the line between data and metadata—perhaps well-defined in an era of plain old telephone service—may well be blurry with other modalities). How far are we willing to go along these lines?
Lastly, how should the U.S. balance the intelligence value of capabilities provided by bulk surveillance against its costs? As noted earlier, bulk surveillance does have some value for the intelligence community. But as the PCLOB noted, “an intelligence-gathering tool with significant ramifications for privacy and civil liberties cannot be regarded as justified merely because it provides some value in protecting the nation from terrorism” (emphasis in the original). Nor, I might add, for other purposes as well. If any such tool is to be used to protect the public, the value it provides must be sufficient to outweigh its costs, which including financial, operational, and opportunity costs as well as costs to privacy and civil liberties.
The Section 215 debate pitted a tool (bulk surveillance over domestic phone metadata) that may be very helpful in preventing some serious terrorism incident against one that may be used to harass legal protestors of government policy—but there is no evidence that either has happened. In the absence of evidence, how should value and cost be determined?
Many factors enter into any such determination, but perhaps the most important factor is the reality that the determination is a strong function of the circumstances extant at any given time. As much as some would like it to be otherwise, a serious national security incident inevitably results in greater concerns for security and lesser concerns about privacy and civil liberties. Tools that policy makers see as providing marginal value and entailing high costs before the incident may well be seen as providing higher value and entailing lower costs afterward.
Does such a shift in perspective ever result in overreaction? Certainly. In the light of history, the internment of U.S. citizens of Japanese origin after the Pearl Harbor attack is widely acknowledged as being an overreaction. And the passage of the USA Freedom Act may indicate the beginnings of a similar realization, although the Paris attacks of November 2015 and the San Bernardino shootings of December 2015 cast such a realization in a different light. Time will tell how the U.S. Congress decides to act on all of these matters, and the voices of computing professionals can help inform their future actions.
Join the Discussion (0)
Become a Member or Sign In to Post a Comment