(Washington, DC) – The United States Congress should swiftly pass the Safeguarding American’s Private Records Act of 2020 (SAPRA) to end bulk data collection and improve transparency and oversight of surveillance in the US, Human Rights Watch said today.
The bill would end the bulk collection of US phone metadata by intelligence agencies authorized under Section 215 of the USA Patriot Act. Though Section 215 was reformed by the USA Freedom Act of 2015, it still permits the government to collect a staggering amount of data, in secret and without a warrant, on how people use their phones, chilling freedom of expression and association.
“Congress should put an end to mass phone metadata collection,” said Kian Vesteinsson, senior law and tech policy officer at Human Rights Watch. “Though the Safeguarding American’s Private Records Act of 2020 could do more to safeguard rights, the bill as written will greatly improve privacy protections for millions of people.”
Section 215, which allows intelligence agencies to acquire business records that are “relevant” to an investigation, will expire on March 15 unless Congress renews the authority. Members of Congress have introduced several proposals to renew and reform Section 215 and two other expiring authorities. One such alternative bill, the USA FREEDOM Reauthorization Act of 2020, would also end bulk data collection, but would need significant changes to adequately protect people’s rights. Of the bills, the Safeguarding American’s Private Records Act of 2020 best protects the rights of people in the US.
As the former National Security Agency contractor Edward Snowden revealed in 2013, the US government interpreted Section 215 to justify the collection of potentially millions of phone and text records of people in the US who have not been linked to wrongdoing. Phone metadata can produce a comprehensive picture of a person’s movements, associates, and interests by mapping the network of people with whom they communicate and where and when they make the calls.
The USA Freedom Act prohibits the government from using Section 215 for bulk metadata collection, instead imposing a narrow set of rules for metadata collection known as the call detail records (CDR) program. The CDR program limits metadata collection to certain types linked to a “specific selection term,” such as an individual, account, or personal device. The government must show that the term is associated with international terrorism to request records based on that term. The National Security Agency can use the records produced from an initial query to request further records – the so-called “second hop.”
While this is an improvement on the previous rules, it still permits the government to collect a vast amount of phone metadata. The second-hop provision enables the government to collect the call detail records of every person communicating with the initial target of a surveillance order. Between May 23 and December 31, 2018, the National Security Agency queried over 19 million phone numbers and collected over 434 million records under this program. These mass intrusions of privacy are disproportionate and chill the rights to freedom of expression and association, Human Rights Watch said.
Following reports in 2018 that the National Security Agency had destroyed millions of records collected under the program due to “technical irregularities,” the Trump administration announced that it had stopped collecting records under that authority. Between 2015 and 2019, the program cost $10 million to operate and yielded only one significant lead. Despite these problems, the administration asked Congress to indefinitely renew the expiring surveillance authorities.
The Safeguarding American’s Private Records Act would end this program and bring critical reforms to other potentially rights-abusing interpretations of Section 215. The bill would limit Section 215 surveillance to counterterrorism and foreign intelligence investigations and restrict the use of evidence produced under Section 215 surveillance to criminal proceedings related only to national security.
SAPRA would prohibit the use of Section 215 to collect certain forms of location data, internet browsing history, and search history, as well as any information that would normally require a warrant. It would also strengthen the role of privacy advocates in the Foreign Intelligence Surveillance Court, which authorizes surveillance warrants into foreign intelligence investigations, and imposes new requirements to report to Congress about how certain Patriot Act authorities are used.
The bill would also forbid the government from using evidence derived from Patriot Act authorities in a criminal trial or proceeding without providing notice to defense counsel. The notice provision helps guard against law enforcement creating an alternative set of facts to hide secret or unlawful surveillance, a practice known as parallel construction. Human Rights Watch has documented how this practice seriously harms the rights of those accused of crimes in the United States and deprives the public of information on secret law enforcement investigations.
The bill would leave some rights concerns unaddressed. It would only prevent collection of certain types of phone location data, although the Supreme Court affirmed in 2018 that the Fourth Amendment right to privacy protects all historical cell phone location data.
The bill also would not address the mass surveillance that Snowden revealed under other laws, including Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333. These legal authorities provide almost no protections for the privacy and other human rights of people outside the US. Section 702 permits the National Security Agency to collect the communications of millions of people outside and inside the US. Congress should address the human rights concerns presented by these surveillance programs, including by repealing or not renewing Section 702 and conducting a congressional inquiry into Executive Order 12333, Human Rights Watch said.
“Any bill ending bulk metadata collection should include reforms to strengthen transparency and oversight of other potentially rights-abusing interpretations of Section 215,” Vesteinsson said. “Congress should pass the Safeguarding American’s Private Records Act of 2020 to permanently end phone metadata collection under the Patriot Act and safeguard rights in the US.”
