Senate Intelligence Authorization Bill Would Reduce PCLOB Oversight

June 6, 2016. Section 603 of S 3017 [LOC | WW], the "Intelligence Authorization Act Fiscal Year 2017", would limit the authority of the Privacy and Civil Liberties Oversight Board (PCLOB). Its current mission is examining the impact of anti-terror laws and programs on "privacy and civil liberties". This bill would reduce this to examining "privacy and civil liberties of United States persons".

The Senate Intelligence Committee (SIC) approved this bill on May 24, before its introduction on June 6. See, related story in this issue titled "Sen. Burr Introduces Intelligence Authorization Bill".

Introduction. 42 U.S.C. § 2000ee currently provides that the PCLOB shall "analyze and review actions the executive branch takes to protect the Nation from terrorism, ensuring that the need for such actions is balanced with the need to protect privacy and civil liberties".

It "shall continually review  ... the regulations, policies, and procedures, and the implementation of the regulations, policies, and procedures, of the departments, agencies, and elements of the executive branch relating to efforts to protect the Nation from terrorism to ensure that privacy and civil liberties are protected".

This bill adds the words "of United States persons" after "privacy and civil liberties".

A clear and transparent bill would elaborate on the meaning of this change. It would identify which laws and government activities and operations are placed beyond the review of the PCLOB. However, this bill does not elaborate. Nor does it provide any guidance or explanation. It does not even provide a definition of U.S. person.

This creates both secrecy and uncertainty. It also enables government agencies to arbitrarily assert that certain laws and activities and operations lay beyond PCLOB scrutiny, and hence deny the PCLOB access to information.

The PCLOB mainly examines federal government surveillance programs. However, surveillance by nature is often not easily categorized by nationality of targets. The government may conduct surveillance of a person whose identity (and hence citizenship) the government does not know, or about which it is mistaken. The government may conduct surveillance of a person who moves from country to country (including the U.S.). The government may conduct surveillance of a foreigner in a distant country who sends messages to, or receives messages from, U.S. citizens. Thus, surveillance that the government asserts is directed at non-U.S. persons, and hence lays beyond the purview of PCLOB examination, may in fact impact privacy and civil liberties of U.S. persons.

Also, the government engages in activities and operations that are not directed at any person. Consider for example, government actions regarding encryption technologies incorporated in ICT devices, location detection mandates imposed upon telecom companies and device makers, and imposition of CALEA and CALEA like mandates. These government actions go to the regulation of technology and network facilities, not persons, but still have profound impacts on privacy and civil liberties. Hence, the question arises, since none of these reference U.S. persons, would government agencies be able to tell the PCLOB that it lacks authority to examine them.

PCLOB Independence. This bill would also diminish PCLOB independence.

Section 601 of the bill would require the PCLOB to keep the Director of National Intelligence (DNI) and others "fully and currently informed of the activities of the Board, including any significant anticipated activities".

This limits the independence of the PCLOB, and the effectiveness of its oversight function.

Fundamental to the concept of independent oversight is the notion that the overseer does not report to the agencies that it oversees.

Also, this language might enable agencies to refuse access to information. For example, does an agency's determination that the PCLOB failed to give prior notice of a review excuse it of its obligation to cooperate with that review?

FISA Section 702. This change could impact PCLOB review of one of the most controversial provisions of surveillance law -- Section 702 of the Foreign Intelligence Surveillance Act (FISA).

Section 702 of the FISA, which is codified at 50 U.S.C. § 1881a, contains the "outside" the U.S. surveillance authority.

This section was enacted by the 110th Congress by HR 6304 [LOC | WW], the "Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008". It is Public Law No. 110-261.

This Act allows federal surveillance, without individualized court approval, under the FISA, of people believed to be outside of the US. More specifically, it pertains to "the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence information". And, it allows access to the content of communications.

This provision has always been controversial. And, for this reason, the Congress has kept it under sunset. Its current sunset is December 31, 2017. The 112th Congress extended its sunset in HR 5949 [LOC | WW], the "FISA Amendments Act Reauthorization Act of 2012".

The intelligence agencies, Congress and public would benefit from continuing review of Section 702 programs by the PCLOB. But, the question arises, by adding the words "United States persons", can the government assert that Section 702 surveillance is beyond the PCLOB's authority.

Section 702 also contains a CALEA like clause. Subsection 1881a(h)(1) provides that "With respect to an acquisition authorized under" Section 1881a(a), the DOJ and DNI "may direct, in writing, an electronic communication service provider to -- (A) immediately provide the Government with all information, facilities, or assistance necessary to accomplish the acquisition ...". Subsection 1881a(h)(2) provides that the government shall compensate service providers for this.

Section 702 does not reference the CALEA. However, in both FISA Section 702, and CALEA Section 103, service providers are compelled to provide "assistance" and "facilities" to facilitate government acquisition of the contents of communications.

The CALEA is codified at 47 (sic) U.S.C. §§ 1001-1010. It is Public Law No. 103-414. It was enacted by the House and Senate in 1994 as HR 4922, the "Communications Assistance for Law Enforcement Act", which begins with the words, "To amend title 18, United States Code ...".

Hence, if this bill were enacted into law, the DNI, NSA and/or DOJ might refuse to cooperate with the PCLOB in a review of implementation of 1881a(h), on the grounds both that CALEA like assistance pertains to technology and facilities not to persons, and that the underlying surveillance is directed at non U.S. persons.

But, there remain arguments that any body charged with overseeing the surveillance activities of the government ought to examine Section 702 activities. Surveillance that is targeted at foreigners may nevertheless sweep in U.S. citizens. Moreover, requiring service providers to design and build their facilities to enable intercepts and other surveillance to enable them to promptly comply with Section 702 orders also means that both intelligence and law enforcement agencies -- federal and state -- will have enhanced surveillance assistance to facilitate compliance with other types of intelligence and law enforcement orders -- including orders that are directed at U.S. citizens.

What is a U.S. Person? This bill presents another uncertainty. It does not define the term "United States person". There are several inconsistent definitions in other federal statutes.

For example, 50 U.S.C. § 1801, which is the definitional section for the FISA, provides that "United States person" means "a citizen of the United States, an alien lawfully admitted for permanent residence (as defined in section 1101(a)(20) of title 8), an unincorporated association a substantial number of members of which are citizens of the United States or aliens lawfully admitted for permanent residence, or a corporation which is incorporated in the United States, but does not include a corporation or an association which is a foreign power, as defined in subsection (a)(1), (2), or (3) of this section." (Parentheses in original.)

Subsections 1801(a) provides, in part, that foreign power means "(1) a foreign government or any component thereof, whether or not recognized by the United States; (2) a faction of a foreign nation or nations, not substantially composed of United States persons; (3) an entity that is openly acknowledged by a foreign government or governments to be directed and controlled by such foreign government or governments; ...". Section 1801 fails to provide a definition of "faction of a foreign nation".

The PCLOB does examine surveillance programs authorized by the FISA. But, it also examines non-FISA activities, codified in Title 18, and elsewhere. Moreover, the PCLOB statute is codified in Title 42.

Consider for example, that the Department of the Treasury and its Internal Revenue Service (IRS) are involved in protecting the nation from terrorism, and these activities impact privacy and civil liberties. The tax code provides at 26 U.S.C. § 7701 that U.S. persons "means (A) a citizen or resident of the United States, (B) a domestic partnership, (C) a domestic corporation, (D) any estate (other than a foreign estate, within the meaning of paragraph (31)), and (E) any trust if (i) a court within the United States is able to exercise primary supervision over the administration of the trust, and (ii) one or more United States persons have the authority to control all substantial decisions of the trust."

Also, 22 U.S.C. § 6010, which pertains to foreign relations, provides that U.S. person means "any United States citizen or alien admitted for permanent residence in the United States, and any corporation, partnership, or other organization organized under the laws of the United States."

(Published in TLJ Daily E-Mail Alert No. 2,820, June 10, 2016.)