Last week’s dramatic Second Circuit decision in ACLU v. Clapper, invalidated the alleged legal basis for the NSA domestic phone call dragnet, Section 215 of the USA Patriot Act, just weeks before that provision is about to expire.
But some people are acting like nothing has changed. Yesterday, Senate Majority Leader Mitch McConnell introduced a bill for a so-called “short term clean reauthorization” of Section 215, to give the Senate time to keep the provision alive while it negotiates over (i.e., weakens) the USA Freedom Act reform proposal passed overwhelmingly by the House. On the other side, reformers labor under the mistaken impression that the Second Circuit opinion will have no actual impact on the phone dragnet because the FISA court that issues Section 215 orders doesn’t sit in the Second Circuit. Indeed, Office of the Director of National Intelligence attorney Robert Litt fed this speculation when he told Sean Vitka of Sunlight Foundation that the FISA Court doesn’t have to listen to the Second Circuit, at least, not yet.
ACLU v. Clapper should definitively end the phone dragnet. The case has been remanded to the District Court, which will likely enjoin it. And, the decision raises the spectre of future legal liability for Verizon, AT&T, and any other telecommunications company that continues to hand records over, even under 215 orders from the FISA court. Specifically, 47 U.S.C. 222 says:
(c) Confidentiality of customer proprietary network information
(1) Privacy requirements for telecommunications carriersExcept as required by law or with the approval of the customer, a telecommunications carrier that receives or obtains customer proprietary network information by virtue of its provision of a telecommunications service shall only use, disclose, or permit access to individually identifiable customer proprietary network information in its provision of (A) the telecommunications service from which such information is derived, or (B) services necessary to, or used in, the provision of such telecommunications service, including the publishing of directories.
Any company that breaches confidentiality except as required by law is liable for damages and attorneys’ fees under 47 U.S.C. 206. And there is a private right of action under 47 U.S.C. 207.
Note that there’s no good faith exception in the statute, no immunity for acting pursuant to court order. Rather, the company is liable unless it was required by law to disclose. So Verizon could face a FISC 215 dragnet order on one side and an order from the Southern District of New York enjoining the dragnet on the other. Is Verizon required by law to disclose in those circumstances? If not, the company could be liable. And did I mention the statute provides for attorneys’ fees?
Everything is different now than it was last week. Reauthorization won’t protect the telecoms from civil liability. It won’t enable the dragnet. As of last Thursday, the dragnet is dead, unless a phone company decides to put its shareholders’ money on the line to maintain its relationships with the intelligence community.