The Rights of the People (37 page)

Furthermore, backstage, the Justice Department and some members of Congress have considered legislation that would require the Internet, phone companies, and certain others to retain data for certain periods, as required of financial institutions under the Bank Secrecy Act of 1970.
¹⁹
That would strip from companies the option to protect customers by destroying records.

The legislative branch might be able to fashion statutes nuanced enough to facilitate law enforcement while defending liberties. The language of laws can govern investigators’ behavior more precisely than the brittle opinions of the courts, which lurch from case to case by chipping away and patching statutes, creating exceptions, and constructing guidelines that can be confusing to agents in the field. Congress has done well at times only to unravel its good work in moments of fear or intellectual corruption.
²⁰

National Security Letters are a disheartening illustration. They became civil liberties problems after they were expanded by the Patriot Act. Before that, they were calibrated tools designed to spy on spies, like narrow peepholes drilled through three different walls of privacy that Congress had erected to guard Americans’ personal information.

Much of that privacy legislation had come in reaction to the government’s secret, illegal surveillance of civil rights and antiwar activists from the 1950s into the 1970s, an assault on privacy that in 1972 Justice William O. Douglas called “an important phase in the campaign of the police and intelligence agencies to obtain exemptions from the Warrant Clause of the Fourth Amendment.”

Citing “national security,” the executive branch had bypassed the courts and placed warrantless wiretaps on phones of allegedly violent protesters. The wiretaps were struck down unanimously by the eight
Supreme Court justices participating in a key case, and in his concurring opinion, Douglas sounded this warning:

“If the Warrant Clause were held inapplicable here, then the federal intelligence machine would literally enjoy unchecked discretion. Here, federal agents wish to rummage for months on end through every conversation, no matter how intimate or personal, carried over selected telephone lines, simply to seize those few utterances which may add to their sense of the pulse of a domestic underground.”

Removing judges from the process produced warrantless wiretaps lasting much longer—78 to 209 days—than the average of 13 days under court order, indicating that thousands of citizens were monitored for extended periods without judicial oversight. “Even the most innocent and random caller who uses or telephones into a tapped line can become a flagged number in the Government’s data bank,” Douglas declared. “More than our privacy is implicated. Also at stake is the reach of the Government’s power to intimidate its critics.”
²¹

Nevertheless, by 1975, with the cooperation of communications companies, the National Security Agency was intercepting most of the millions of private cables that Americans sent, picking out 100,000 a month to analyze.
²²

Congress acted. Three new laws barred private firms from revealing the personal data they had on file—credit reports, bank and brokerage statements, telephone records, and, later, video-rental and Internet activity—unless served with a warrant, a subpoena, or a court order. Before disclosure, the individual had to be notified and given a chance to mount a challenge. Anyone wronged could sue the company in federal court.

The laws acknowledged reality—that you can’t live normally in an electronic age without placing personal information in the hands of third parties, usually corporations that have little interest in fighting the government to protect your privacy.

Meanwhile, the Supreme Court was moving the other way by ruling that you lose your Fourth Amendment protection as soon as you provide records to banks, phone companies, and the like. In 1976, it reversed a circuit court decision to suppress the evidence of microfilmed canceled checks and deposit slips subpoenaed from two banks, finding in
United States v. Miller
no “expectation of privacy” in such commercial documents voluntarily conveyed to a financial institution. “The depositor takes the risk, in revealing his affairs to another, that the information will be conveyed by that person to the government. This Court has held repeatedly
that the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed.” Consequently, the warrant contemplated by the Fourth Amendment was not required; a subpoena—or, by implication, nothing more than a polite request to the bank—was sufficient to get your records.
²³

Three years later, the Court subtracted phone records from Fourth Amendment protection, finding in
Smith v. Maryland
that a customer has no “legitimate expectation of privacy” over what numbers he calls from his home telephone. A pen register, an electronic device placed by the company at police request to record outgoing phone numbers, is not a “search” because it keeps track of only the calling destinations, not the conversations’ contents. “Since the pen register was installed on telephone company property at the telephone company’s central offices, petitioner obviously cannot claim that his ‘property’ was invaded or that police intruded into a ‘constitutionally protected area,’ the Court ruled. “We doubt that people in general entertain any actual expectation of privacy in the numbers they dial. All telephone users realize that they must ‘convey’ phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed. All subscribers realize, moreover, that the phone company has facilities for making permanent records of the numbers they dial, for they see a list of their long-distance (toll) calls on their monthly bills.”
²⁴

Maybe I don’t fall into the category of “people in general,” but I don’t think that my bank and the phone company are the same as the FBI. In my mind, there is a difference between the private sector and the state. When I push buttons on my phone, I recognize that the phone company’s switching equipment has to work for me, but I don’t
expect
the numbers I call to show up on the computer screens of government agencies. When I give my banker and broker personal financial information, I don’t
expect
cops to be looking over their shoulders. My
expectation of privacy
does not disappear when I share information with trusted service providers, because I am not placing it in the public square. My personal information should be treated like my personal property, inaccessible without my permission.

The Supreme Court has ruled otherwise, and its sophistry is a curse on the Bill of Rights. It goes like this: Because your personal information is collected by companies, you cannot expect it to remain private,
and therefore government may acquire it. Since the government can get it, you have no expectation of privacy in such records, which allows the government to act as if there were no privacy.

In other words, obtaining the information is possible, so it is also permissible, for if you have no “expectation of privacy,” a “search” is not actually occurring under the Fourth Amendment. Your entire financial, travel, communications, purchasing, Web-browsing, and library-book-borrowing activities may be collected by law enforcement, but these are not “searches.” The logic is relentless: Citing Supreme Court opinions, “several senior FBI attorneys” told Justice Department investigators that National Security Letters for phone records “do not implicate privacy interests under the Fourth Amendment.”
²⁵
To protect information, you have to keep it solely in your home or office or wallet.

In a technological age, when few details of a person’s life remain in her desk drawer alone, this circular argument diminishing the “expectation of privacy” creates a whirlpool that sucks down a critical constitutional principle: that the state must be held at bay to preserve individual liberty. It’s a bit like the old Soviet Union arguing that since Russians obviously had no expectation of privacy on their phones, the KGB was perfectly entitled to listen in.

That interpretation leaves only the law, not the Constitution, to restrict third parties from revealing data. Read the little privacy brochures your bank, broker, and Internet provider send periodically and you’ll notice that they invariably begin with high-sounding promises: “We are honored that you have entrusted us with your financial affairs, and we are committed to safeguarding the privacy of information we maintain about you,” says Charles Schwab’s “Commitment to Your Privacy.” It sounds good until you get to page three, which notes the big exceptions: “We provide access to information about you to outside companies and other third parties in certain limited circumstances, including … when we believe that disclosure is required or permitted under law. For example, we may be required to disclose personal information to cooperate with regulatory or law enforcement authorities, to resolve consumer disputes, to perform credit/authentication checks, or for risk control.”
²⁶

In the 1970s and ’80s, as the boundaries of privacy were being redrawn by the courts, the Congress, and the executive branch’s law enforcement and intelligence agencies, the limits were made fluid by crosscurrents of invasion and protection. Into the ebb and flow came the three federal privacy statutes designed to defend Americans from government snooping by prohibiting companies from releasing information without overt, challengeable
orders. And then each was diluted by the provision authorizing secret National Security Letters.

The Fair Credit Reporting Act of 1970 required firms to keep your credit reports private and, even if properly subpoenaed, to reveal only your name, addresses, and places of employment. It was watered down with an NSL section in 1996.
²⁷

The Right to Financial Privacy Act, passed in 1978, concealed your check-writing, investing, travel, and other such records. It was weakened by an NSL exception in 1986.
²⁸

Your telephone and Internet browsing records and e-mails were made inaccessible under the Electronic Communications Privacy Act, which took effect in 1986 only to be breached by expanded NSL authorizations in 1993 and 1996.
²⁹
A fourth law, the National Security Act of 1947, was amended in 1994 after the arrest of the CIA spy Aldrich Ames, to permit NSLs against government employees suspected of disclosing classified information.
³⁰

Even in its early form, the investigative tool of the NSL circumvented judicial oversight, carried the automatic gag order, and provided the target with neither notification nor appeal. Yet it generated little opposition. Its limitation to counterintelligence, plus the six to twelve months it took to get a letter issued, made it relatively unpopular in the FBI. So it lurked in legal shadows until the rush of panic that produced the Patriot Act after September 11, 2001. Then the number of annual requests for information via NSLs soared, from about 8,500 in 2000 to 56,000 in 2004 (decreasing somewhat to 47,000 in 2005), according to incomplete FBI records. (An internal sampling of files found the actual number to be 17 percent higher than these official figures.)
³¹

Furthermore, the Defense Department secretly issued about five hundred NSLs for contractors’ and employees’ financial and credit card records between September 11, 2001, and 2007, according to an internal review, thereby breaching the traditional barrier designed to prevent military involvement in domestic intelligence and law enforcement. The letters, made public in an ACLU Freedom of Information suit, sometimes asked for all credit card charges or bank account records over as much as a five-year period, indicating that investigators were looking for purchases and deposits beyond a person’s means, perhaps from extraordinary payments for espionage.

In the hands of the Pentagon, the tool was a request, not a requirement, legally less powerful than the FBI’s version. The air force letters that
were released contained a standard warning not to disclose the request “regardless of whether you provide this information,” suggesting that compliance was optional. But one letter also called itself a “subpoena” and was stamped “This Subpoena contains a: NON-DISCLOSURE ORDER. Do Not Notify Customer. Do Not Charge Account.” In the face of such a document stating that it was part of “an official foreign counterintelligence investigation,” very few institutions refused, the records showed. To add muscle, the FBI was sometimes asked to use its more draconian variant to get information the Pentagon wanted for investigations of alleged spying, terrorism, or other supposed threats against the military. The ACLU believed the targets included antiwar activists.
³²

This history of the National Security Letter is a cautionary tale of metamorphosis, illustrating how an intrusion that seems reasonable and tightly focused can evolve into a menace. In all three privacy statutes, the limited NSL loopholes that had been added in the 1980s and 1990s were broadened by the Patriot Act. No longer did the letters require “specific and articulable facts giving reason to believe” that the records sought belonged to “a foreign power or agent of a foreign power,” but now could be gathered if “relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities.”
³³

It was a powerful sentence. Adding antiterrorism to counterintelligence, removing the foreign-agent criterion, and making the information merely “relevant” eliminated the concept of individualized suspicion that is central to the Fourth Amendment. It opened the NSL for use against more than the suspect in an investigation by permitting information collection on relatives, friends—indeed, anyone the suspect may have contacted, including innocent people whose data are now floating around in numerous agencies’ computers. How many non-suspects have been targeted is unknown, since the FBI did not keep track before 2006.