All withheld information exempt under b(1) and except as othterwise noted. Approved for public release. UNITED STATES FOREIGN INTELLIGENCE SURVEILLANCE COURT WASHINGTON, D.C. Imam.? OPINION AND ORDER REQUIRING DESTRUCTION OF INFORMATION OBTAINED BY UNAUTHORIZED ELECTRONIC SURVEILLANCE For the reasons explained below, the Court is ordering the government to destroy information obtained by unauthorized electronic surveillance that it conducted under color of orders issued in the above-referenced dockets pursuant to the electronic surveillance provisions of the Foreign Intelligence Surveillance Act (F ISA), codi?ed as amended at 50 U.S.C. 1801- 1812. I. Background1 The authorized surveillance target in this case was the? The unauthorized electronic surveillance involved Compliance notice ?led on Aug. 26, 2010, at . uration unau orize surveillance ranged from approximately 15 months to three years and collectively involved over- improperly intercepted communications. E. at 2?8. Under its standard minimization procedures, NSA was obligated to ?monitor the acquisition of raw data at regular intervals to verify that the surveillance is not avoidably acquiring communications outside the authorized scope of the surveillance or information concerning United States persons not related to the purpose of the surveillance.? Standard Minimization Procedures for Electronic Surveillance Conducted by the NSA The Court has found, and the government has not disputed, that failure ?to comply with Opinion and Order Regarding Fruits of Unauthorized Electronic Surveillance issued on Dec. 10, 2010, at 1-3 (?December 10, 2010 Opinion?) for a discussion of the procedural history ofthis matter prior to that date. The December 10, 2010 Opinion is incorporated herein by reference. January 31. 2018, Public Release. EFF v. DOJ 16-CV-02041 Document 10, Page 1 of 9 . All withheld information exempt under b(1) and except as otl?enivise noted. Approved for public release. this requirement resulted directly in the unauthorized intercept of December 10, 2010 Opinion at 5. Also contributing to the duration and volume of unauthorized surveillance in this case was the government?s submission of applications that falsely stated that The government proposed to retain the fruits of this unlawful surveillance, insofar as they reside in an NSA database called - See Letter ?led on Dec. 3, 2010 (?December 3, 2010 Letter?). In support of this proposal, the government argued that the SMPs did not apply to the fruits of unlawful surveillance, but only to interceptions authorized pursuant to the Court?s orders. December 3, 2010 Letter at 2 11.3. Secondly, it argued that the criminal prohibition codi?ed at 50 U.S.C. 1309(a)(2) only prohibits use or disclosure of unlawfully obtained information for investigative or analytic purposes. 1g. at 4?6. The Court addressed both of these contentions in its December 10, 2010 Opinion. After examining the SMPs and the statutory provisions relating to minimization, the Court rejected the government?s contention that the SMPs do not apply to over-collected information.3 December 10, 2010 Opinion at 3-6. The Court also noted that the SMPs appeared to require the destruction of at least some of the over?collected information. lg. at 5. With regard to Section 1809(a)(2), the Court found unpersuasive the government?s argument that the unquali?ed language of this prohibition only encompasses use or disclosure for investigative or analytic purposes. December 10, 2010 Opinion at 6-7. However, the Court recognized a narrower implicit exception from this prohibition for use or disclosure of ?the results of unauthorized surveillance [that is] needed to remedy past unauthorized surveillance or prevent similar unauthorized surveillance in the ?iture.? E. at 8. Based on the information available at the time of the December 10, 2010 Opinion, the Court could not ascertain whether or to what extent the over?collected information in this case might fall within this implicit exception to Section 1809(a)(2). The Court ordered the . ., Docket No. NSA, at 3?4 3 The Court uses the term ?over-collect to refer to information obtained by unauthorized electronic surveillance. 2 January 31, 2018, Public Release. . EFF v. DOJ 16-CV-02041 Document 10, Page 2 of 9 . All withheld information exempt under b(1) and except as otl?snrvise noted. Approved for public release. WW government to make a submission by Januaryr 31, 2011, providing additional information and analysis. 1d. at 8-9. With the bene?t of extensions, the government completed this submission on April 8, 2011, after ?ling an interim update on February 14, 2011. At the request of the government, a hearing was conducted in this matter on May 10, 2011. II. The Current Status of the Over-Collected Information Since the December 10, 2010 Opinion, NSA has completed its efforts to locate and purge the information obtained from this unauthorized electronic surveillance from data repositories other than Veri?ed Factual Update ?led on Feb. 14, 2011 (?Veri?ed Factual Update?), at 4-5. Information from records was used in this process. E. at 5. More ci?call NSA re it SA assessest at it IS at information obtained from this unauthorized surveillance exists in any repository other than ILL at 3 n.2. Within information from this unauthorized surveillance is retained in- . Government?s Response submitted on April 8, 2011 (?Government?s January 31, 2018, Public Release. EFF v. DOJ Document 10. Page 3 of 9 . All withheld information exempt under b(1) and except as ottnanivise noted. Approved for public release. Each record corresponding to the over-collected information in this case has been marked as ?subject to purge.? Veri?ed Factual Update at 5. The government proposes to retain, use, and disclose the over-collected information in subject to certain restrictions that are discussed Elm at page 6. HI. Analysis Section 1809(alf2l Section 1809(a) states without quali?cation: person is guilty of an offense if he intentionally . . . (2) discloses or uses information obtained under color of law by electronic surveillance, knowing or having reason to know that the information was obtained through electronic surveillance not authorized? by statute. The December 10, 2010 Opinion recognized a narrow implicit exception to this prohibition for ?actions that are necessary to mitigate or prevent the very harms at which Section 1809(a)(2) is addressed.? December 10, 2010 Opinion at 8 (emphasis in original). The Court observed that this exception ?must be carefully circumscribed, so that it does not lead to an unjusti?ed departure from the terms of the statute.? 1d. The Court indicated that this exception would encompass ?use? or ?disclosure? in the course of ?actions in direct response to unauthorized surveillances? that are ?necessary to avoid similar instances of over~collection (eg, by identifying and remedying a technical malfunction) or to remedy a prior over-collection (egg, by aiding the identi?cation of over-collected information in various storage systems).? E. at 7. The Court was doubtful that ?xture use or disclosure of the over-collected information in this case could fall within this narrow exception, ?now that the over?collection has been conclusively attributed? to ?failure to recognize and respond properly to - and that ?apparently all of the [over-collected] information . . . has been purged or marked for purging.? at 8. A. Scope of the Implicit Exception Because the outcome of this case depends on the scope of this exception, a full explanation of why Section admits only a narrowly focused exception is appropriate. ?Federal crimes are de?ned by Congress, and so long as Congress acts within its constitutional power in enacting a criminal statute,? a court ?must give effect to Congress? expressed intention concerning the scope of conduct prohibited.? United States v. Kozminski, 487 US. 931, 939 4 January 31, 2018, Public Release. EFF v. DOJ 16-CV-02041 Document 10, Page 4 of 9 . All withheld information exempt under b(1) and except as otllierwise noted. Approved for public release. WW (1988); accord= United States v. Lanier, 520 US. 259, 267 n.6 (1997) (?Federal crimes are de?ned by Congress, not the courts,? and in construing criminal statutes courts are ?oblige[d] . . . to carry out congressional intent as far as the Constitution will admit?). This generally means that, ?in applying criminal laws,? courts ?must follow the plain and unambiguous meaning of the statutory language,? United States v. Albertini, 472 US. 675, 680 (1985), and bear in mind that it is for Congress to resolve ?the pros and cons of whether a statute should sweep broadly or narrowly.? Jnited States v. Rodgers, 466 US. 475, 484 (1984). More speci?cally, courts should not attempt ?to resuict the unquali?ed language of a [criminal] statute to the particular evil that Congress was trying to remedy even assuming that it is possible to identify that evil from something other than the text of the statute itself.? Brogan v. United States, 522 US. 398, 403 (1998). Thus, even if it were established that Congress enacted Section 1809(a)(2) in order to curb investigative abuses, that provision would still properly apply to non-investigative uses or disclosures. Albertini 472 US. at 682 (criminal prohibition applies even though enacting Congress ?very likely gave little thought? to circumstances in question). The exception recognized in the December 10, 2010 Opinion stands on narrower but ?rmer ground: that in limited circumstances, prohibiting use or disclosure of the results of unauthorized electronic surveillance would be ?so ?absurd or glaringly unjust? . . . as to [call into] question whether Congress actually intended what the plain language" of Section 1809(a)(2) ?so clearly imports.? Rodgers, 466 US. at 484 (quoting Sorrells v. United States, 287 US. 435, 450 (1932)); accord Chapman v. United States. 500 U.S. 453, 463-64 (1991); see alts?o United States v. Rutherford, 442 US. 544, 552 (1979) (?Exceptions to clearly delineated statutes will be implied only where essential to prevent absurd results or consequences obviously at variance with the policy of the enactment as a whole?) (internal quotations omitted). B. Application of the Implicit Exception In accordance with the narrowness of the exception it had articulated, the Court ordered the government to ?speci?cally explain why [the] pggicular information? at issue in this case ?is needed to remedy past unauthorized surveillance or prevent similar unauthorized surveillance in the future.? December 10, 2010 Opinion at 8-9 (emphasis added). The government has not done so. At the May 10, 2011 hearing, the government conceded that there were no plausible circumstances in which further use or disclosure of the information obtained by the unauthorized surveillance in this case and now residing in would prove necessary to these ends. See also Government?s Response at 9 (?The compliance incident resulted from a set of discrete and speci?c facts . . . . [I]t did not result from technological problems and appears to be the result of human January 31, 2018, Public Release. EFF v. DOJ 16-CV-02041 Document 10, Page 5 of 9 . All withheld information exempt under b(1) and except as otl?enrvise noted. Approved for public release. Instead, the government argues that certain restrictions on access to the over?collected information in - will ensure that future use and disclosure will comport with Section 1809(a)(2). The Court disagrees for reasons explained below.5 The government reports that all records in that are marked as subject to purge, including the records containing the over-collected information in this case, are only accessible to a limited number of authorized personnel, termed_ Veri?ed Factual Update at 5-6. And, pursuant to a policy adopted after the December 10, 2010 Opinion, ?information from unauthorized electronic surveillance in and marked as subject to purge will be used only when reasonably necessary (1) to remedy or prevent the 1809(a) harmsl?} arising ?om a particular incident of unauthorized electronic surveillance or (2) to evaluate and, when necessary, adjust processes and procedures designed to remedy or prevent the 1809(a) harms.? Government?s Response at 13. As explained above, it is untenable that further use or disclosure of the over-collected information in this case is necessary for the ?rst enumerated purpose. In the government?s view, actions taken as ?reasonably necessary? to the second enumerated purpose would include steps to implement ?an enterprise-wide compliance program,? to include third?party audits and assessments, as well as monitoring and assessment of internal controls. 1d. at 14-15. The Court is unpersuaded that uses and disclosures of the over-collected information in this case would comply with Section l809(a)(2) simply because they are in furtherance of this second purpose. That is not because the Court doubts the importance of an enterprise-wide compliance program in remedying or preventing 1809(3) harms. Rather, it is because there is no reason to believe that further use or disclosure of the speci?c over-collected information in this case will be needed for such a program to be effective, now that the cause of the unauthorized surveillance has been identi?ed as discrete human error and all of the over~collected information has been purged or marked as subject to purge. A?er all, in a happier world where NSA had not unlawfully intercepted - under color of the orders in this case, NSA presumably would still have the wherewithal to devise and implement an effective compliance program. There is no reason to think that 5 The government also identi?es adverse consequences that might follow from a general requirement to destroy over-collected information in- Because this argument goes to the retention or destruction of over-collected information, rather than its use or disclosure, the Court addresses it in the context of minimization. gee infra pp. 8?9. 6 The government has adopted the term ?1809(a) harms? as shorthand for unauthorized electronic surveillance or use or disclosure of the results of such surveillance. gag? Government?s Response at 12?13, 17. 6 January 31, 2018, Public Release. EFF v. DOJ Document 10, Page 6 of 9 . All withheld information exempt under b(1) and except as otlitenrvise noted. Approved for public release. information about? is necessary for an effective, real-world compliance program, now that the particular incidents to which it pertains have been addressed. The most that the government can claim is that, an undifferentiated class, records marked as subj ect to purge are needed for an effective compliance program. ?e_e Government?s Response at 7-8, 10?11; Declaration of- Director of Compliance, NSA Declaration?) at 4 (submitted as Attachment to the Government?s Response). But it does not follow from this premise that use or disclosure of any information within that undifferentiated class would comport with Section 1809(a)(2), so long as it is made in furtherance of a compliance program designed to prevent or remedy 1809(a) harms at a programmatic level. Because the Speci?c over-collected information at issue no longer has any distinctive utility for compliance efforts, it is neither absurd, nor glaringly unjust, nor obviously at variance with the policy of FISA as a whole, s3 p. 5, to conclude that Section 1809(a)(2) prohibits its further use or disclosure, even in the context of external auditing, monitoring of internal controls, or other aspects of an enterpri se-wide compliance program. IV. Analysis SMPs The Court?s December 10, 2010 Opinion noted that Section 5(3) of the SMPs appears to require the destruction of at least some of the information over-collected in this case, December 10, 2010 Opinion at 5, and directed the government to ?[a]ddress in detail . . . how the SMPs apply to the proposed retention and use of information obtained ?'om this unauthorized surveillance.? E. at 8 (emphasis added). In response, the government has stated that the do not explicitly address the Government?s authority to retain, use, or disclose information from unauthorized electronic surveillance for the purpose of preventing or remedying . . . 1809(a) harms,? and that the government ?is assessing an appropriate amendment to the SMPs to account? for such situations. Govemment?s Response at 17-18. The Court understands this response to its December 10, 2010 Opinion to concede that the SMPs, as now in effect, do not explicitly permit the retention of the over?collected information in this case. Apart from this concession, it seems clear that the SMPS explicitly require NSA to destroy most, if not all, of the over-collected information in this case, and would do so even if the information had been lawfully acquired. The SMPs divide communications into two types: foreign communications and domestic communications. ?Communications identified as domestic communications shall be destroyed,? subject to exceptions that appear inapplicable to this case. SMPs Similarly, foreign communications ?of or concerning United States persons? may only be retained under speci?ed circumstances that do not appear to be present in this case, and otherwise ?shall be destroyed.? 1d. One category of communications is not subject to a general destruction requirement: foreign communications that are not of or concerning a US. person. id. 7. Given the de?nitions of the operative terms and 7 January 31, 2018. Public Release. EFF v. DOJ 16-CV-02041 Document 10, Page 7 of 9 . All withheld information exempt under b(1) and except as otl?nlvise noted. Approved for public release. 49W the nature of the unauthorized surveillance in this case, this category would consist of- - communications in which (1) at least one communicant was outside the United States; (2) no communicants were U.S. persons; and (3) no non-public information concerning a US. person was divulged. gee id. Because? one would expect that ordy a small percentage of the unlawful intercepts if any would satisfy all three conditions. In any event, the government - notwithstanding the Court?s requiring a detailed discussion of how the SMPs apply to this case has not addressed the effect of speci?c provisions or the status of particular types of communications. Instead, it requests the Court to recognize an implicit exception to the destruction requirements of the SMPS, despite the fact that this information was unlawfully acquired. For the reasons stated Ma at pages 5-7, the Court concludes that further use or disclosure of the over-collected information in this case would not be consistent with Section 1809(a)(2). No lawful bene?t can plausibly result from retaining this information, but further violation of law could ensue. Accordingly, the Court declines to ?nd that the over?collected information in this case is subject to an implicit exception from the destruction requirements of the SMPs. The government also describes various ways in which it might be burdensome or counterproductive to require NSA to purge from information obtained by unauthorized electronic surveillance. It takes effort to identify information in_ S3 Veri?ed Factual Update at 9-10. NSA anticipates dif?culties in determining when records pertaining to a particular unauthorized electronic surveillance are no longer needed and asserts that premature destruction may impede compliance efforts in ways not foreseen when a decision to destroy is made. Government?s Response at 9-12; - Declaration at 7-10. It is feared that NSA personnel may draw erroneous conclusions from the resulting gaps in data. -Declaration at 7. To a considerable extent, these objections are directed at cases not before the Court. The records pertaining to the over-collected information in this case have already been identi?ed and isolated, see Government?s Response at 6; Veri?ed Factual Update at 9, and there is no dif?culty in concluding that this over-collected information is no longer needed to prevent or remedy 1809(3) harms, gee ma pp. 5-7. This case is therefore distinguishable from those that may require a longer period of technical examination or exploitation to understand and remedy causes of unauthorized surveillance or to identify and segregate over?collected information. In this case, the govemment?s objections fall well short of establishing a need to exempt the over-collected information from the destruction requirements of the SMPs. It could be asserted that a_ny requirement to destroy information ?on a case-by?case basis . . . might have negative unintended consequences.? -Declaration at 10 (emphasis added). Nevertheless, 8 January 31, 2018, Public Release. EFF v. DOJ 16-CV-02041 Document 10, Page 8 of 9 . All withheld information exempt under b(1) and except as ott93n~ise noted. Approved for public release. the SMPs routinely require NSA personnel to apply retention criteria on a case-by?case basis to information that was lawfully acquired, and destroy information that does not satisfy those criteria. S_ee pp. 7?8. There is no reason to think that this approach is distinctively unworkable for unlaw?Jlly acquired information. Indeed, a case?by-case assessment is most appropriate for over-collected information because, except in narrow circumstances, intentionally using or disclosing such information is a crime. V. Conclusion lnforrnation about these private, non-target communications should have never been acquired. Now that its further use or disclosure cannot reasonably be expected to be law?il, it should be destroyed. For the reasons stated herein, the government is ORDERED to destroy all information in that was obtained by the unauthorized electronic surveillance in this case. Although the Court cannot comprehensively identify such information based on the record before it, such information includes, to the extent it exists for each unlawfully intercepted? communication: The government may accomplish this destruction by deleting entire records in - or by deleting all of the ?elds within records that contain information obtained by the unauthorized electronic surveillance, so long as all information obtained from this unauthorized electronic surveillance and contained in is in fact destroyed. The government shall submit a written report no later than June 17, 201 l, and at intervals thereafter, describing the process by which it is destroying such information, until such time as the destruction process has been completed. 71.. Entered this?i day of May, 201 l, in Docket Nos. new? fw FREDERICK J. SCULLIN, JR. Judge, United States Foreign Intelligence Surveillance Court 15?. Deputy Clerk. FISC, certify that this document is a true and correct copy of Release. EFF v. DOJ 16-CV-02041 Document 10, Page 9 of 9 .