Page 69 - pclob usa freedom

TOP SECRET//SI//NOFORN

Freedom Act to telephone metadata because the law was designed to achieve a very specific end:
providing a narrower replacement for the previous bulk CDR program. 324
(U) Second, while I agree that, when crafting surveillance laws, technology-neutrality
should be the default, there are times when it will make sense for a law to pick out particular
technologies. The churn of technological innovation will inevitably spit out new modes of
communication and other technologies whose privacy implications we cannot presently foresee.
For that reason, it may be rational for Congress to specify that an authority permits use of a
known, present-day technology, while excluding emerging or yet-unknown technologies that
may prove more invasive.

(U) Consider a hypothetical technology-neutral statute authorizing an agency to employ
“biometric analysis.” Congress might reasonably prefer to allow an agency to use fingerprinting,
and perhaps some forms of facial recognition, while excluding “rapid DNA identification
devices, which are making positive identifications possible in as little as 90 minutes,” or other
intrusive biometric checks yet unimagined. 325 Or legislators might choose to permit facial
recognition where photos are taken at a clearly identified checkpoint in a secure area, but to
prohibit it where images are taken in public, or by stealth.

(U) The point is that enacting a technology-specific statute is not always a blunder.
Rather, where consciously chosen, technology-specificity may reflect a considered judgment to
rule out applications that would transform the authority at issue into something more intrusive
than Congress intended. The USA Freedom Act supplies a real-world example: Congress
approved two-hop CDR collection, but specifically barred the government from collecting “the
contents . . . of any communication,” “the name, address, or financial information of a subscriber
or customer,” and “cell site location or global positioning system information,” presumably
based on its view that these types of data would be qualitatively more revealing than other data
that CDRs ordinarily contain. 326

(U) Indeed, technology-specific legislation, with its effect of anchoring levels of intrusion
in the present, may become more common as technology races forward. Avulsive technological
change seems to arrive every few years: the internet, IP-based messaging, social media,
smartphones, biometrics, big data, the internet of things, and AI, each galloping past with

324 (U) See H.R. Rep. No. 114-109 (2015), at 17 (USA Freedom Act’s CDR provision “relies on” previous reforms
to bulk metadata collection “to establish a new, narrowly-tailored mechanism for the targeted collection of telephone
metadata . . . as part of an authorized investigation to protect against international terrorism. This new mechanism is
the only circumstance in which Congress contemplates the prospective, ongoing use of Section 501 of FISA in this
manner.”).
325 (U) International Biometrics & Identity Association, Biometrics & Identify: DNA Biometrics (visited Oct. 18,
2019), https://ibia.org/biometrics-and-identity/biometric-technologies/dna.
326 (U) 50 U.S.C. § 1861(k)(3).
66

TOP SECRET//SI//NOFORN