NSA takes one-two punch to the face

The US National Security Agency has been hit by two legal losses that may put the last part of its controversial spying program on US citizens under threat.

In one case, brought by customers of AT&T and run by the Electronic Frontier Foundation (EFF), the NSA was ordered [PDF] to provide relevant evidence that would prove or disprove that consumer's communications had been tapped – a legal first.

In the second case, filed by the American Civil Liberties Union (ACLU), an appeals court reversed [PDF] the earlier dismissal of a lawsuit and allowed Wikimedia to continue in its fight to sue the NSA for violating the First and Fourth Amendments.

Both cases tackle the same issue: the use of Section 702 of the FISA Amendments Act to carry out "upstream" interception of internet traffic. In effect, the NSA ordered telecom companies to give them permanent access to the online activities of millions of US citizens by tapping the internet's backbone.

The first case is nearly a decade old and started when AT&T technician Mark Klein leaked documents that showed that the telco giant cloned its internet backbone traffic and fed it into a secret room at its headquarters in San Francisco controlled by the NSA.

Since then, the case has been tied up in legal process. Although developed during the Bush administration and with several members of that administration named as defendants, the lawsuit ran through the court during the Obama administration.

In 2009, the US government tried to dismiss the case, arguing that it covered state secrets. But the court dismissed it on different grounds – that none of the plaintiffs had standing. That decision was overturned in 2011 on appeal. The government then remade its state secrets argument, which was ultimately rejected in 2013 after a number of NSA whistleblowers confirmed the details of the program. The case was narrowed down to whether the program violated the First and Fourth Amendments.

Evidence?

Even after all these legal arguments, the people suing still don't have evidence that their communications have been intercepted. So in 2016, the court allowed for "discovery" in the case, allowing the plaintiffs to ask for relevant information to prove their case. Of course, the NSA stonewalled. So late last week, the court ordered the NSA to hand over information in response to a narrow set of requests. The order was published on Monday.

(Incidentally, the name of the case – Jewel v NSA – comes from one of the plaintiffs, Carolyn Jewel, who, improbably, is a writer of "paranormal romance" fiction and lives in California.)

The reason the court decision in this case is significant is that it is the first time the NSA has been ordered to hand over details from its domestic mass surveillance program. The court also strongly suggested that its responses be put into the public record.

In the second case, the same issue – the ability to prove that the NSA held people's private information – had caused the case to be dismissed for lack of standing.

In October 2015, a district court ruled that the plaintiffs – in this case nine of them including Wikimedia, Amnesty, Human Rights Watch and the National Association of Criminal Defense Lawyers – could not sufficiently prove that their communications were being monitored by the NSA.

But the Fourth Circuit Appeals Court unanimously reversed that decision on Tuesday – at least for Wikimedia. Two of the three judges decided the other eight plaintiffs did not have standing; the third argued that all nine did. The upshot is that Wikimedia and the ACLU can progress with their case against the NSA.

The legal argument is that because Wikimedia changed how it communicates out of fear that the NSA is tapping its electronic data, the NSA is violating its First Amendment rights. And because its communications are likely to be seized, that the NSA is violating its Fourth Amendment rights.

The judges had some sympathy for that argument, writing in their decision: "Wikimedia has plausibly alleged that its communications travel all of the roads that a communication can take, and that the NSA seizes all of the communications along at least one of those roads. Thus, at least at this stage of the litigation, Wikimedia has standing to sue for a violation of the Fourth Amendment.

"And, because Wikimedia has self-censored its speech and sometimes forgone electronic communications in response to Upstream surveillance, it also has standing to sue for a violation of the First Amendment."

ACLU lead lawyer on the case, Patrick Toomey, said he looks forward to his day in court: "The NSA has secretly spied on Americans' internet communications for years, but now this surveillance will finally face badly needed scrutiny in our public courts."

Where do we go from here?

Despite these latest procedural wins in long-running legal disputes, the reality is that these types of lawsuits never end in outright victory. Instead they serve as constant pressure on the system and typically force a political solution.

Most of the domestic spying system put in place by the Bush administration in the aftermath of the 9/11 attacks has since been dismantled. Three of the four spying programs (that we are aware of) have been abandoned. Notably, however, there have been very few legal rulings that classify such programs as illegal or unconstitutional, leaving the door open to them being introduced in future – or perhaps to continue to protect spying programs that we don't yet know exist.

It is also worth noting that almost all legal challenges against the NSA and the US government for spying have been challenged and have often failed because of the inability to prove that the spying systems exist. Time and again, documents leaked by individuals such as Mark Klein and Edward Snowden that prove the existence of such programs have enabled those legal challenges to persist.

The NSA's mass collection of phone records was killed off when Section 215 of the Patriot Act was not included in the updated USA Freedom Act in 2015.

And its full-content "about" search of internet backbone traffic was recently ended by the NSA in response to threats by Congress that it would not renew Section 702 of the FISA Amendments Act – the same section used to justify the spying covered by the two lawsuits above.

The system

The only time the official system for curbing abuse has worked was when the Foreign Intelligence Surveillance Court took exception to the NSA purposefully ignoring its rules and massively over-collecting internet metadata.

But the NSA provided no explanation for how that had happened and the abuse only came to light due to Edward Snowden's leak of classified information – the court would likely never have noticed otherwise.

What the two ongoing lawsuits noted above may achieve is a spotlight on the tapping of the internet's backbone and what the NSA does and can do with the information it receives.

That process may introduce additional privacy controls and possibly roll back NSA spying from covering almost all US citizens to only picking up those who pose a national security risk – the original and explicit intent of spying laws.

But don't hold your breath. There is still a long way to go. ®