Spycraft: how do we fix a broken NSA?

KILLING THE THIRD-PARTY DOCTRINE

One answer from Saturday's rally would look to the judiciary, trying to rewrite the laws and precedents of surveillance into something less hostile towards privacy. In particular, advocates have their eye on Smith v. Maryland, a single Supreme Court case that ended up being responsible for much of current surveillance law. Sina Khanifar, founder of StopWatching.Us and organizer of Saturday's march, said overturning the case was one of his main goals for the rally. The case established that anyone turning their data over to a third party (like the phone company) has no reasonable expectation of privacy. That precedent became known as the third-party doctrine, a major exception to the Fourth Amendment’s restrictions on warrantless search that’s only expanded in recent years. "I think, ultimately, what we want is a reversal of Smith vs. Maryland and the third-party doctrine, which is at the heart of this," Khanifar says. "We want the government and our courts to make it clear that we do have a reasonable expectation of privacy when we do things online."

In 1979, the ruling was fairly specific, focusing on the government's ability to install a pen register device at a central phone company facility without a warrant — but as communication technology has grown, so have the government’s third-party powers. Now that same legal precedent is being used to justify much broader powers. According to Snowden documents, that same pen register can pull all the email that passes through a service. In the case of Lavabit, the FBI even used the order for a pen register to demand access to the service's SSL certificate, effectively hijacking the site. "If it were still 1978, technologically, then the Smith v. Maryland ruling wouldn't be that big a deal," says Julian Sanchez, fellow at The Cato Institute, a libertarian think-tank . "The reason it has this outsized importance is that technology has changed in a way that makes that cover a huge quantity of data." The hope is that, without the third-party doctrine, intelligence organizations would be forced to find a better justification for broad surveillance, or go without it entirely.

But while this logic is appealing, it may not go as far as advocates want it to. Smith v. Maryland is hugely influential in standard civilian courts, but it's unclear how much effect its repeal would have on the secret FISA courts that rule on the NSA's surveillance requests. Without stronger disclosures, we might never know.

Another path to the same goal might go through the legislature rather than courts, passing laws to strengthen the Fourth Amendment without bringing the Supreme Court into it at all. Senator Rand Paul (R-KY) has introduced two separate bills that protect specific Fourth Amendment rights, intended as a legislative check on judicial carve-outs like the third-party doctrine. "Our independence and the Fourth Amendment go hand in hand," Senator Paul said in a statement. "They emerge together. To discount or to dilute the Fourth Amendment would be to deny really what constitutes our very republic." Neither of Paul's bills have made it to the floor, but they stand as one model of what Fourth Amendment activism might look in the future.

WATCHING THE WATCHERS

In the meantime, most tech companies have been lobbying for stronger transparency on the consumer side. Since the PRISM news first broke, service providers like Google, Microsoft, and Facebook have been asking for looser gag orders and stronger disclosure rules. In July, nearly every major American tech company signed on to a letter to Congress demanding the right to disclose how many users were affected by FISA warrants and national security letters. The equivalent data for civilian law enforcement "has been published for years without any apparent disruption to criminal investigations," the letter claimed. Some progress has already been made with specific disclosure deals, but the agreements have been divisive, and companies like Google are still lobbying for a more open process. In the meantime, a new group of bills has emerged promising to break out “affected user” numbers, giving a better sense of the scale of the surveillance at work.

On some level, it's a self-serving request: a more comprehensive transparency report from Google might make users feel better about using Gmail without addressing the deeper structural problems of government surveillance. But in the long term, stronger transparency measures could set up third-party companies as a check on government power, giving users the information and the platform to object if privacy violations occur. More importantly, of the bills facing Congress, the current crop of transparency bills seem the most likely to make it through.

Photograph of Joshua Foust courtesy of Joshua Foust; Photograph of Julian Sanchez courtesy of Matthew Yglesias

FIXING THE LAWS

Another solution is repealing or modifying the more recent laws that enabled this surveillance. The Patriot Act is a common target, establishing new norms for surveillance, but the 2008 FISA Amendments act is arguably more important, establishing the secret FISA court system that’s been at the center of many Snowden documents. Both laws have been reauthorized in the past two years, and neither faced any serious challenges. Even if the laws aren’t repealed entirely, putting up more of a fight at the next reauthorization could open the door to larger reforms. Explaining his vote against the most recent FISA Amendments reauthorization, Senator Al Franken (D-MN) said his main priority is still transparency. “I think the laws are necessary, and I think they’ve saved lives,” Franken told The Verge. “I voted ‘no’ because I didn’t think there were sufficient transparency and oversight mechanisms in place.”

But if Congress decided to crack down on the NSA, there’s plenty more they could do. Joshua Foust is a former intelligence analyst turned freelance defense reporter who's generated controversy recently for his outspoken criticism of the Snowden leaks. Foust says the basic problem is the failure of congressional oversight. "If they're angry that [Director of National Intelligence] James Clapper lied to them, hold him in contempt of Congress. If they have evidence the intelligence community is violating the law, hold a public hearing and call them out on it. If they think the laws are too permissive, rewrite the laws. These are things I think should be happening." But as long as Congress is comfortable giving national security agencies a free pass on those issues, we’re unlikely to see any change coming out of it.

Photograph of Rand Paul courtesy of Gage Skidmore; Photograph of Al Franken courtesy of Veni Markovski

THE FUTURE

Faced with that many targets, activists face a daunting problem. Government surveillance is a puzzling tangle of courts and intelligence services, growing intertwined with no clear way to separate them. After over a decade of widespread domestic wiretapping, the culture of the NSA will be slow in changing, but it won't shift at all without the close eye of Congress and the White House. The current laws could be challenged through the courts, but making that case requires verifiable information that, before Snowden, only the NSA had access to. The leaks broke many of these stalemates, but it's still difficult to see how any single part of the system can be fixed without ripping the whole thing up and starting again.

For the true pessimists, even that may not be enough. What if the new surveillance regime isn't the result of government overreach, but an inevitable result of cheap technology? State intelligence has always tried to gather as much information as possible. In 1968, that meant steaming open every letter sent to Russia and East Germany; steaming open more letters than that was impractical. But it’s not impractical anymore. With email and server clusters on their side, there's virtually no limit to what's practical for the modern NSA. In the cloud, they can see into every corner, through walls, and backwards in time. If privacy is going to be preserved, we need new limits, limits that cut against centuries of intelligence-gathering tradition. Some argue that changing it would mean changing the nature of the state itself. And when the transformation is done, there’s still little sense of what the country and its spies might look like.

It’s a common problem, whether you’re approaching reforms from the courts or the Congress. For all its momentum, StopWatching.Us is still a movement with many directions and no clear destination. Suddenly, they know what the NSA is doing, and perhaps even what it shouldn’t do — but lasting reform will mean striking a new equilibrium for intelligence-gathering, and there are precious few ideas about where to strike the final balance. It’s a problem for activists, but also increasingly a problem for politicians who would seek to address privacy concerns without dismantling the NSA entirely. “I think that Americans are naturally suspicious of executive power,” Senator Franken says. “And when things are done secretly or if they aren't given enough information about what's happening, they tend to believe that power is being abused.” But the question now is, what do they do next? No one’s found an answer yet.