Is the 4th Amendment Dead in Cyberspace?

Over a year ago former director of both the NSA and CIA, Michael Hayden, flat out admitted, "we kill people based on metadata." He quickly distinguished between the metadata about which the debate was focused, telephone records, and other forms of surveillance metadata upon which covert actions are taken. Not surprised about the actions, I confess I was taken aback when I considered the implications that this disclosure has on Fourth Amendment jurisprudence in cyberspace.

Ever since the USA-Patriot Act in 2001, I have been harping on complications of the Fourth Amendment between content and metadata in data networking. For as many years I have hoped for a revision of the Electronic Communications Privacy Act (ECPA) to correct the discordance. In all that time, I have assumed that a restructuring of Fourth Amendment jurisprudence around these distinctions might be possible. 

I no longer believe that is a reasonable fix. The advanced algorithms applied to metadata in government surveillance make metadata the equivalent of content. That is what struck me about Hayden’s remarks. Not just occasional leaks of subject lines or an Internet Protocol address that resolves to a web page found in routing records, but the sorting, combining and redefining of that data into identifiable predictive behaviors that function as the basis of military or law enforcement actions. It is in this sense that I declare the Fourth Amendment dead in cyberspace. The only way to resurrect the Fourth Amendment could be to place all data, both content and metadata, under Fourth Amendment rubric. 

For those who have not been keeping up with the debate, here is the background. The USA-Patriot Act (“Patriot Act”) lowered the evidentiary showing for law enforcement (F.B.I. or D.O.J.) to obtain metadata for both Title III criminal courts under ECPA and the “secret courts” under the Foreign Intelligence Surveillance Act (FISA).  Privacy advocates and organizations such as the A.C.L.U. have raised this issue persistently with a focus on section 215 especially, the section that covers “business records.”  For whatever Congress intended – and many drafters such as Sensenbrenner have denied this was their intent -- the N.S.A. used this provision to defend its legal standing for the wholesale collection of telephone metadata. In the court of public opinion this practice was the most explosive of Edward Snowden’s revelations.   Earlier this year the Second Circuit declared it illegal, at least for the plaintiff, the A.C.L.U., but also by implication to everyone else whose records have been collected since the program began, under Presidential directive, in October of 2001.

In May and June of this year, section 215 became the focus of Congress debate.  One of the many sections of the Patriot Act that are under a “sunset” clause, which requires period renewal, Congress has, until now, repeatedly done so without too much pushback. Public opinion over the practice threw a political wrench into the works. Congress took a step back.  Partisan wrangling resulted in a brief period when the provision lapsed. The new Freedom Act quickly revived it for a 180-day extension, time enough to bridge a shift from government collection to a requirement that Internet Service Providers hold the records. Whether the government can or will then use the same provision to get the records back in bulk, or take the tack that privacy advocates support of using those records for targeted searches, or both, remains to be experienced in practice and in the courts. 

In either case, the damage to the Fourth Amendment jurisprudence in the electronic realm is done.  It no longer makes any sense to distinguish content from metadata. The only way to resurrect a meaningful Fourth Amendment would therefore be to bring all electronic data under the Fourth Amendment rubric.  In Title III courts, a request for metadata would require a judicially sanctioned evidentiary showing of probable cause of criminal activity particularly described, the standard that is used for a warrant. The subpoena power that comes from an investigation would not be sufficient.  The same would hold true in a FISA court, or FISC, although there are the important points that need to be made to distinguish these two courts. It is upon this distinction that I also call for a repeal of FISA and an elimination of FISA Courts.

Cast your mind back to the mid-seventies, when the Central Intelligence Agency was well into its prime of covert activities. Surveillance was among some of its more benign activities given the assassination of government leaders such as Diem brothers in Vietnam and the overthrow of democratically elected governments such as Iran, Guatemala and Chile. Congress sought to impose legal process on these activities. In 1978 it passed the Foreign Intelligence Surveillance Act. This Act created the secret and ex parte FISA Court, a process for selecting the judges and even an appellate FISA review for those requests that the FISA court denied. Terrorism was something that occurred abroad, and so to have a process for the investigation of not just criminal activity but for “persons of interest” seemed to represent progress.

Historical circumstances would turn what was intended to be a brake on government into an accelerator. The Patriot Act exacerbated that shift. Government interpretations of ambiguous sections, such as 215, opened the floodgates.  Moreover, other aspects of FISA became more an encouragement than a restraint. Anyone – U.S. citizen or foreign national, in the United States or outside of it – “relevant” or “significant” to a terrorist investigation could be brought in its scope. That scope included three contact orbits out from persons under surveillance. I am not great at math, but I know that  this pattern represents the possibility of exponential searches, searches that software engineering and sophisticated algorithms made feasible if not inviting.

Under the contemporary circumstances of the FISA practices, it is not consistent with the Fourth Amendment. The blurred lines between citizens and “persons of interest” outside of U.S. is so great as to throw the Fourth Amendment completely out of focus. Combine that effect with the telephone records quagmire and it would appear to be a legal mess. This mess is difficult to describe and even more so for people to understand, a symptom that it is unworkable in a democratic republic. Basic concepts such as transparency and accountability are absent. We therefore have a choice: either become prey to more and more slippage of core values or return to first principles of due process.

In favor of the latter, Congress should enact two radical reforms. The first is to end the distinction between content and metadata in the Electronic Communications Privacy Act, any acts that serve in a similar capacity, and any law that would be represented as a reform of ECPA. The second is the abolition of the FISA. Under current historical circumstances it is no longer consistent with a democratic republic. Investigations of terrorism should continue to exist. Insofar as they involve U.S. persons (which includes citizens, resident aliens) those investigations should come under regular Title III criminal courts.

Please note, I am not calling for an abolition of the Central Intelligence Agency nor the end of intelligence gathering in the name of U.S. interests. In other words, when the individual(s) under surveillance are not U.S. persons, have at it. This is an area of law that the international community should pick up, debate and strive for a harmonic effect on electronic search and seizures. While I suspect that some liberals with not be happy with that conclusion, I can only say that being a privacy advocate in my view does not mean willfully ignoring real threats to national interests. At the same time, conservatives doubt that open courts are appropriate for national security threats. To the degree that some investigations understandably require a period of time in which disclosures would damage law enforcement process, legal tools in these traditional courts already exist to allow those investigations to proceed as such.

The surest path for terrorist success would be to undermine our democratic republic. There are many ways in which we can join the fight against crime and terrorism.  One of them is to protect civil liberties.  In fact, civil liberties are a core component of our national interests.