More about metadata - USA appeals court finds NSA's collection of telephone metadata is unlawful and raises privacy concerns
Blog TMT and IP blog

Last week a US federal appeals court ruled that the NSA's mass collection of telephone metadata is not in fact authorised by the Patriot Act as the US government has long maintained. The NSA's collection of this data was made infamous by the revelations of former NSA contractor, Edward Snowden, and The Guardian newspaper in 2013.

The background

After losing their application for an injunction at first instance, a collective of civil liberties groups appealed to the United States Court of Appeals for the Second Circuit, arguing that section 215 of the Patriot Act did not authorise the NSA's bulk telephone metadata collection program, or in the alternative, if it did authorise the program, that section 215 violated the First and/or Fourth Amendments of the US Constitution.

Three judges of the Court of Appeals unanimously agreed that the NSA's program was unlawful, as it was not supported by section 215. As a result the court did not need to determine the constitutional issues, and vacated the orders of the district court, remitting the matter for further proceedings in light of their findings.

The Patriot Act

Currently, section 215 of the Patriot Act authorises the Director of the FBI (or his delegate) to 'make an application for an order requiring the production of any tangible things ... for an investigation... to protect against international terrorism or clandestine intelligence activities'.

Such an application is required to include 'a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorised investigation... to protect against international terrorism or clandestine intelligence activities'.

As a safeguard, section 215 was originally drafted to include a sunset provision. That has now been extended 11 times since it was introduced, most recently in 2011. It is now due to expire on 1 June 2015. Therefore the appeals court decision comes as Congress does battle over whether to again extend the operation of section 215 for a further five years, modify it, or leave it to expire.

The decision

The reasoning of the appeals court centred around what could be considered 'relevant' to an investigation authorised under section 215. The government argued that relevance is 'an extremely generous standard', and that section 215 therefore authorised it to collect metadata that, while not relevant to any particular investigation at the time of collection, may become relevant sometime in the future.

The appeals court recognised that the government's practice of listing multiple terrorist organisations in each application made under section 215, and stating that the records sought were relevant to investigations into all of those organisations was 'little different, in practical terms, from simply declaring that they are relevant to counter-terrorism in general'.

Effectively the government argued that 'there is only one enormous "anti-terrorism" investigation, and that any records that might ever be of use in developing some aspect of that investigation are relevant to the overall counterterrorism effort'. The court concluded that this approach could not be supported on the language of section 215, which requires records to be relevant to an authorised investigation.

Despite its findings the court did not grant the injunction sought by the appellants. The court recognised that the issues in this case could be rendered moot, or significantly altered, by Congress' imminent decision on the fate of section 215.

No doubt this decision will give Congress a lot to think about.

Metadata

The appeals court made some interesting observations regarding the nature of metadata. The court observed that the fact that metadata does 'not directly reveal the content of telephone calls... does not vitiate the privacy concerns arising out of the government's bulk collection of such data', and pointed to examples such as:

a call to a single-purpose telephone number such as a "hotline" might reveal that an individual is: a victim of domestic violence or rape; a veteran; suffering from an addiction of one type or another; contemplating suicide or reporting a crime. Metadata can reveal civil, political, or religious affiliations; they can also reveal an individual's social status, or whether and when he or she is involved in intimate relationships.

The court evidently appreciated the potential private information that can now be drawn from metadata using ever evolving technology and analytics, and observed that 'in today's technology based world, it is virtually impossible for any ordinary citizen to avoid creating metadata about himself on a regular basis simply by conducting his ordinary affairs'.

These observations echo those which we have recently seen at home in Australia, with the Federal Privacy Commissioner's determination last week that metadata held by Telstra constituted personal information, as well as the new Australian data retention legislation which deems metadata to be personal information for the purposes of the Commonwealth Privacy Act 1988.

Clearly there is a growing appreciation around the world of the potential value of metadata as a source of information, and an equally growing desire on the part of governments to harness that information in the name of national security.