'ol. ~ ....M9d8tat~,~~ 1A•lllaence Susvalllanci court ~·· . NOV 2~ 2015 UNITED STATES LeeAnn flynn Hall, Cferk of Court FOREIGN INTELLIGENCE SURVEILLANCE COURT , •• a• ..._...,,..,., ... WASHINGTON, D.C. IN REAPPLICATION OF THE FEDERAL BUREAU OF INVESTIGATION FOR AN ORDER REQUIRING THE PRODUCTION OF TANGIBLE THINGS Docket Number BR 15-99 OPINION AND ORDER On August 27, 2015, this Court approved in part the government's application in the above-captioned docket. The Court granted the government's request for the issuance of orders pursuant to the "business records" provision of the Foreign Intelligence Surveillance Act ("FISA"), codified as amended at 50 U.S.C. § 1861, authorizing the National Security Agency ("NSA") to acquire, in bulk, and on an ongoing daily basis, certain call detail records consisting of metadata but not the contents of any communication ("BR Metadata"). Such acquisition is authorized until 11 :59 p.m. Eastern Time on November 28, 2015, immediately after which the USA FREEDOM Act prohibits any further bulk collection of tangible things pursuant to Section 1861. See USA FREEDOM Act of2015, Pub. L. No. 114-23, § 103, 129 Stat. 268, 272; see also id § 109(a), 129 Stat. at 276. The application also requested authority for the government, after November 28, 2015, to retain and use for certain technical and litigation-related purposes the BR metadata acquired by NSA through the Court's orders in this docket and predecessor dockets. Specifically, the application requested authority for the government to retain the BR Metadata after November 28, 2015, in accordance with the Opinion and Order of this Court issued on March 12, 2014, in Docket No. BR 14-01("March12, 2014 Opinion and Order''), concerning the retention of BR metadata for purposes of litigation, and subject to the restrictions stated therein. The application also requested authority, for a period ending on February 29, 2016, for appropriately trained and authorized NSA technical personnel to use BR metadata to verify the completeness and accuracy of call detail records produced under targeted (i.e., "non-bulk") production orders issued by the Court after November 28, 2015. The Court took these requests under advisement. See Docket No. BR 15-99, Primary Order issued on August 27, 2015 ("Primary Order"), at 12-13. On September 17, 2015, the Court appointed attorney Preston Burton to serve as ainicus curiae in this matter pursuant to 50 U.S.C. § 1803(i)(2)(B) and directed him to address whether the government's above-described requests to retain and use BR metadata after November 28, 2015, are precluded by section 103 of the USA FREEDOM Act or any other provision of that Act. Pursuant to a Briefing Order issued by the Court on October 7, 2015, Mr. Burton and the government submitted briefs addressing this question. On November 20, 2015, the Court held a hearing on this matter. 1 After careful consideration, the Court concludes that the government's requests to retain and make limited use of the BR Metadata after November 28, 2015, are consistent with the applicable requirements of FISA. Section 103 of the USA FREEDOM Act, entitled "Prohibition on Bulk Collection of Tangible Things," plainly prohibits any further bulk collection of tangible things pursuant to 50 U.S.C. § 1861 after November 28. To that end, Section 103 requires that all FISA business records applications brought after November 28 must include a "specific selection term to be The Court wishes to thank Mr. Burton for his work in this matter. His written and oral presentations were extremely informative to the Court's consideration of the issues addressed herein. The Court is grateful for his willingness to serve in this capacity. 1 2 used as the basis for the production of the tangible things sought.'' See Pub. L. No. 114-23, § I 03, 129 Stat. at 272; see also id § 109, 129 Stat. at 276. "Specific selection tenn" is defined in pertinent part as "a term that specifically identifies a person, account, address, or personal device, or any other specific identifier," and that "is used to limit, to the greatest extent reasonably practicable, the scope of tangible things sought consistent with the purpose for seeking the tangible things." See id § 107, 129 Stat. at 274. "The 'specific selection term' required in each [FISA business records] application is the mechanism by which the Act prohibits the indiscriminate, bulk collection of any type of tangible thing under [Section 1861 ]." H.R. Rep. No. 114-109, pt. 1, at 19 (2015). But while Section 103 clearly forecloses the issuance of additional bulk collection after November 28, 2015, it does not by its tenns address the retention or use after that date of BR Metadata previously acquired in bulk. Indeed, no provision of the USA FREEDOM Act dictates any particular disposition of the BR Metadata acquired by the government through November 28. Congress enacted the USA FREEDOM Act after extensive hearings and public debate, and with full knowledge of the government's bulk collection, retention, and use of BR Metadata. In Section 103 of that Act, Congress directed that further bulk collection end after November 28, 2015. Congress had every opportunity to direct a particular disposition of the BR Metadata already in the government's possession on November 28, but it chose not to do so. Instead, Congress furnished a legal framework for analyzing the government's requests to retain and make limited use of the BR Metadata after that date. As both Mr. Burton and the government contend, Section 1861, as amended by the USA FREEDOM Act, provides this framework. See Memorandum of Law by Amicus Curiae, 3 submitted on October 29, 2015, at 15-19; Response of the United States to the Memorandum of Law by Amicus Curiae, submitted on November 6, 2015 ("Government Response"), at 7. Specifically, the USA FREEDOM ACT retains the preexisting requirement of Section 1861 that each FISA business records application include "an enumeration of the minimization procedures adopted by the Attorney General under subsection (g) that are applicable to the retention and dissemination" of the tangible things to be produced in response to the order. See 50 U.S.C. 1861(b)(2)(B), which effective November 29, will be renumbered as Section 186l(b)(2)(D). Subsection (g), in tum, provides in pertinent part that the term "minimization procedures" means(A) specific procedures that are reasonably designed in light of the purpose and technique of an order for the production of tangible things, to minimize the retention, and prohibit the dissemination, of nonpublicly available infonnation concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information; (B) procedures that require that nonpublicly available information, which is not foreign intelligence information, as defined in section 1801 (e)( 1) of this title, shall not be disseminated in a manner that identifies any United States person, without such person's consen4 unless such person's identity is necessary to understand foreign intelligence information or assess its importance; and (C) notwithstanding subparagraphs (A) and (B}, procedures that allow for the retention and dissemination of information that is evidence of a crime which has been, is being, or is about to be committed and that is to be retained or disseminated for law enforcement purposes. 50 u.s.c. § 1861(g)(2). The foregoing definition of "minimization procedures" - which was not altered by the 4 USA FREEDOM Act! - provides the standards for evaluating the manner in which the government proposes to retain and handle information acquired pursuant to FISA business records orders. The question is whether the minimization procedures proposed by the government for use after November 28, 2015, satisfy the requirements of this definition. The Court concludes that they do. The Court has already concluded that the minimization procedures currently being applied by the government meet the statutory definition of minimization procedures. See Primary Order at 2. Those procedures closely track the minimization procedures that the Court has approved in prior orders authorizing the bulk production of BR Metadata. See id The minimization procedures that the government proposes using after the production ceases on November 28, 2015 are in important respects substantially more restrictive than those currently in effect. The procedures that will apply after November 28, which were initially included as 2 The USA FREEDOM Act made several minimization-related changes to Section 1861. For instance, Section 1861 now provides that, before granting a business records application, the Court must expressly find that the minimization procedures put forth by the government "meet the definition ofminimiz.ation procedures under subsection (g)." See Pub. L. No. 114-23, § 104(a)(l), 129 Stat. at 272. This change is not substantive, however, as such a finding was previously implicit in the broader finding required by Section 1861 (c)(1) - i.e, "that the application meets the requirements of subsection (a) and (b)." Among the requirements of subsection (b) was - and still is - the requirement that the application include an enumeration of Attorney General-approved minimization procedures that meet the definition set forth in subsection (g). Another change is the addition of a "rule of construction" confirming the Court's authority "to impose additional, particularized minimization procedures with regard to the production, retention, or dissemination" of certain information regarding United States persons, including "procedures related to the destruction of information within a reasonable time period." See id. § 104(a)(2), 129 Stat. at 272. A third new provision that talces effect on November 29, 2015, states that orders compelling the ongoing, targeted production of "call detail records" must direct the government to adopt minimization procedures containing certain requirements relating to the destruction of such records. See id Pub. L. No. 114-23, § 10l(b)(3)(F)(vii), 129 Stat. at 270-71. 5 part of the broader set of procedures set forth in the application, were resubmitted by the government in a standalone document on November 24, 2015 ("November 24, 2015 Minimization Procedures"). The BR Metadata will continue to be retained in repositories on secure networks under NSA's control and carry unique markings that will be used to restrict access to it. See November 24, 2015 Minimization Procedures at 2-3. After November 28, 2015, no access to the BR metadata will be permitted for intelligence analysis purposes. See id at 2. Hence, queries of the BR Metadata for the purpose of obtaining foreign intelligence information will no longer be permitted. See Primary Order at 10. Limited access to the BR Metadata will be permitted only in two circumstances. First, for a period ending on February 29, 2016, appropriately trained and authorized technical personnel will have access to the BR Metadata solely for the purpose of verifying the completeness and accuracy of call detail records produced under the targeted (i.e., non-bulk) production orders issued by the Court after November 28, 2015. See November 24, 2015 Minimization Procedures at 3. According to the government, verification will involve a comparison of the two sets of records (i.e., the BR Metadata and call detail records received pursuant to subsequent, targeted orders). See Government Response at 9. NSA technical personnel will compare the number of call detail records produced for a specific selection term with the number of call detail records identified in response to a query of the BR Metadata using the same identifier. See id at 9-10. Such comparisons will help provide assurance that the new collection process is working as intended. See id at 10. NSA technical personnel also will examine the record fields in call detail records produced under targeted production orders to verify that they accurately correspond 6 to the fields contained in the previously collected BR Metadata and that only data authorized for collection is being produced. See id. at 10. Second, NSA will also be pennitted to retain the BR Metadata in accordance with the March 12, 2014 Opinion and Order, and subject to the conditions stated therein. See November 24, 2015 Minimization Procedures at 3-4. In short, the government considers itself to be under an obligation pursuant to orders issued by the United States District Court for the Northern District of California in connection with civil litigation regarding the bulk collection program to preserve the BR Metadata as evidence possibly relevant to the litigation. The government has interpreted these orders as requiring it to preserve BR Metadata beyond the five-year retention period authorized by this Court's orders. The March 12, 2014 Opinion and Order pennits retention of BR Metadata otherwise subject to destruction under the five-year retention limit imposed by this Court, but such data must be "stored in a format that precludes any access or use by NSA intelligence analysts for any purpose, including to conduct contact chaining queries of the BR metadata. '' See March 12, 2014 Opinion and Order at 6; see also November 24, 2015 Minimization Procedures at 3. NSA technical personnel may access the BR Metadata retained for litigation-preservation purposes solely to ensure continued compliance with the government's preservation obligations and the continued integrity of the BR Metadata. See November 24, 2015 Minimization Procedures at 3. Further access to the BR Metadata for litigation purposes is permitted only following written notice to the FlSC specifically describing the nature of and reason for the access. See id at 3-4. The government remains under a continuing obligation to promptly notify this Court of any 7 additional material developments in the district court litigation. See id at 4.3 Once the government's preservation obligations are lifted, it will promptly destroy the BR Metadata, see November 24, 2015 Minimization Procedures at 4, as well as the results of most past queries of the BR Metadata, see Government Response at 11-12. The government will, however, retain infonnation derived from the BR Metadata that has been previously disseminated in accordance with the Court-approved minimization procedures,4 as well as select query results generated that fonned the basis of such disseminations. See Government Response at 11-12. Once the destruction process is started, the government expects it to take approximately one month to complete. See id at 11. The limited retention and use of the BR Metadata proposed by the government comports with the statutory definition of minimization procedures set forth at 50 U.S.C. § 186l(g). Access to and use of the BR Metadata - including any infonnation concerning or identifying United States persons contained therein - will be more tightly restricted than it is under the procedures currently in effect. Such access and use are appropriately tailored to serve the government's strong interest in ensuring that the successor program established by the USA FREEDOM Act is During the hearing held on November 20, 2015, the Court directed the government to submit its assessment of whether the cessation of bulk collection on November 28, 2015, will moot the claims of the plaintiffs in the Northern District of California litigation relating to the BR Metadata program and thus provide a basis for moving to lift the preservation orders. The Court further directed the government to address whether, even if the California plaintiffs' claims are not moot, there might be a basis for seeking to lift the preservation orders with respect to the BR Metadata that is not associated with the plaintiffs. The government intends to make its submission on these issues by January 8, 2016. 3 See Primary Order at 11-12 (requiring, among other things, that prior to disseminating U.S. person infonnation, a high-level NSA official first "detennine that the information identifying the U.S. person is in fact related to counterterrorism infonnation and that it is necessary to understand counterterrorism information or assess its importance.") 4 8 effectively serving its counterterrorism purpose consistent with applicable legal requirements, as well as the government's need to comply with litigation-related obligations. The BR Metadata will be retained no longer than is reasonably necessary to serve these important purposes. Accordingly, the minimization procedures proposed by the government are consistent with the requirements of Section 186l(g)(2)(A) and (B). With respect to subsection (g)(2)(C), the BR Metadata will not be accessed or reviewed by analysts after November 28, 2015. Accordingly, it is unlikely that the government will identify evidence of any crime within the accumulated BR Metadata after that time. Nevertheless, evidence of a crime that is discovered by analysts in the chain summaries that are retained by NSA (i.e., query results that formed the basis of an approved dissemination) may, as appropriate, still be disseminated for law enforcement purposes in accordance with the Primary Order. For the foregoing reasons, the Court finds that the November 24, 2015 Minimization Procedures satisfy the requirements of SO U.S.C. § 1861(g). The government is hereby directed to follow the November 24, 2015 Minimization Procedures for the period following November 28, 2015. SO ORDERED, this..."29"lfY'orNovember, 2015, in Docket No. BR 15-99. ~1-~ MICHAEL &MAN Judge, United States Foreign Intelligence Surveillance Court 9