The always thought-provoking Orin Kerr has responded, on Lawfare, to my plea here for respecting the privacy rights of foreign nationals. Kerr finds my arguments unpersuasive, so I thought I’d elaborate briefly. This week’s news in the Washington Post that the NSA has been infiltrating Google’s and Yahoo’s data centers overseas and vacuuming up massive amounts of data without any legal authorization could be read to make this entire conversation irrelevant, but in fact I think underscores the need for a transnational response. The article reports that NSA lawyers spend their days figuring out how to exploit loopholes in the privacy laws, and probably the biggest one of all is the notion that foreign nationals deserve no privacy protection whatsoever.
In my initial post, I argued that one reason to protect the privacy rights of all, and not just of one’s own citizens, is that in the modern digital era, it is increasingly possible for the security agencies of one nation to sweep up vast amounts of data about other nation’s citizens. While at the moment we seem to be doing it to “them” more than they are doing it to “us,” that is already beginning to change. The NSA’s Google and Yahoo infiltration program was reportedly done with its UK counterpart, GCHQ. How long before China, Russia, India, and others have similar capabilities? Isn’t it in our interest to preserve our privacy from the prying eyes of foreign governments? If we finally get around to reining in the NSA adequately, what’s to stop the GCHQ from spying on us and then turning over the results to the NSA?
Orin’s response is that we should not be surprised that other governments spy on us, and indeed it’s naïve to think that they don’t. In a recent forum at Johns Hopkins SAIS in which I participated, former Acting CIA Director John McLaughlin said essentially the same thing: When we communicate internationally, “all bets are off.” He should know.
But should we accept that state of affairs? It’s one thing to acknowledge that foreign governments spy on each other’s agents. It’s another thing to sweep up millions of electronic communications from a foreign country’s ordinary citizens, as the NSA apparently does. Under the FISA Amendments Act of 2008, the only thing the NSA has to show to justify collecting all of a foreigner’s emails, internet traffic, and phone calls is that he isn’t residing in the US, and that his data might help inform our understanding of “foreign affairs.” That is effectively no requirement of suspicion at all. Would we be satisfied to give the French authority to pick up all of our communications simply on a showing that we were not French and not living in France?
I also argued that we have an interest in protecting the privacy of foreign nationals because our own privacy is implicated by our government’s collection of their communications. To the extent that we are on the other end of an international communication, a surveillance scheme focused on the foreign source with which we are communicating will pick up our content as well. There are minimization procedures in place to attempt to limit this, but the source of the problem is the overbroad authorization to spy on foreigners in the first place, coupled with the technological capacity to do so with respect to millions of communications a month.
Finally, I argued that the blowback triggered by our intrusive efforts to spy on the rest of the world’s citizens, without attempting to target our inquiries at those involved in wrongdoing or in conduct that directly implicates us, will have serious costs to our ability to collaborate with other nations. Orin says I need more evidence that these costs outweigh the benefits of the programs. I don’t know that the costs and benefits on either side are strictly quantifiable, but one need only glance at the front pages of the world’s leading newspapers this past week to see that the costs are indeed substantial.
In short, there’s a reason Article 17 of the International Covenant on Civil and Political Rights says “No one shall be subjected to arbitrary or unlawful interference with his privacy.” It doesn’t say “no citizen.” It says “no one.” We need to do a lot of work if we are to begin to honor that commitment.