Page 67 - pclob usa freedom

TOP SECRET//SI//NOFORN

(U) The lesson here is not that Congress should prescribe the precise technical
mechanisms by which surveillance authorities may be implemented, or that automated, iterative
mechanisms will never be appropriate. To the contrary: In some cases, they may be the only
choice, particularly as the expanding volume of data makes constant human oversight of every
technical process less feasible. What’s more, automated mechanisms may be more privacy-
protective in some respects, by keeping human eyes off of the data and removing human bias and
temptation as a point of failure.

(U) The point, rather, is that a program may present qualitatively different implications
for privacy, civil liberties, and compliance if implemented using an automated, machine-to-
machine architecture with limited human intervention, than if it relies on human-to-human
fulfillment of one-off requests. The remedy is not prescriptive technical specifications, but to
remain aware of the potential implications of program architecture as outside bodies conduct
oversight and the agency itself structures its compliance and audit mechanisms.

III. (U) The Role of Statutes in Regulating Domestic Surveillance

(U) I agree with much of the insightful statement penned by Board Members Nitze and
Bamzai. I take a somewhat more sanguine view, however, of two topics they address: the ability
of Congress to constructively regulate in the area of domestic surveillance, and the utility of
specifying particular technologies in statutory text.

(U) Since 1978, Congress has created a comprehensive statutory architecture to govern
domestic surveillance for national-security purposes. That system, which began with FISA and
which Congress has continued to expand and diversify since then, 319 has helped protect privacy
and civil liberties. But it has also been good for the agencies themselves. Codification places
domestic surveillance practices on a publicly enacted legal foundation, empowering agencies to
act with the confidence that comes from explicit authority conferred by the people’s
representatives. The contrast between the reaction to the 2013 leaks that revealed the bulk call-
records program, which rested on a secretly approved legal interpretation, and the reaction to this
program, which rested on clear, publicly debated, publicly enacted statutory authority, is
illustrative.

(U) Of course, the risk that statutes will produce unintended consequences is ever
present, in intelligence statutes as in any other, and calls for careful drafting. I share my
colleagues’ view that the accidental, unavoidable compliance errors that can occur in any large

319 (U) See, e.g., Intelligence Reform and Terrorism Prevention Act of 2004, Pub. L. No. 108-458; Implementing
Recommendations of the 9/11 Commission Act of 2007, Pub. L. No. 110-53; FISA Amendments Act of 2008, Pub.
L. No. 110-261; USA Freedom Act of 2015, Pub. L. No. 114-23; FISA Amendments Reauthorization of 2017, Pub.
L. No. 115-118 (2018).

64

TOP SECRET//SI//NOFORN