Page 85 - pclob usa freedom

TOP SECRET//SI//NOFORN

II.

(U) Many will point—as we do—to changing times and technologies in assessing the
relative value of the CDR program. But that obvious truth should not pull us away from the
harder question of how law and policy affect intelligence programs in both intended and
unintended ways, potentially altering both their operational utility and invasiveness. In
reviewing the transition from the bulk collection program to the operation, and then suspension,
of the CDR program, we see the following worth noting.

(U) First, by tying the USA Freedom Act to telephony metadata alone, Congress limited
the statute’s usefulness as terrorists moved away from traditional telephony as their primary
mode of communication. Experts have noted that the codification of surveillance authority in
one technological medium will naturally push those seeking to evade government detection to
substitute alternative methods of communications. 360 And yet the Act did not provide multi-hop
authority for the myriad other ways in which terrorists may communicate, from emails to
encrypted messaging. That proved to be a problem. Thus, in the future, for surveillance
authorities to be useful in a world of rapidly advancing technology, they should be neutral as to
communications methods. 361

(TS//SI//NF) Second, several of the compliance incidents arose when Congress codified
in statute a two-hop architecture, a framework that seems to assume that telephone
communications occur between two parties (i.e., A calls B). But in a world where
communications can occur through intermediaries, the two-hop statutory framework results in
ambiguities as to how to determine the scope of a particular communication. The compliance
incidents related to were created by this statutory
ambiguity and premised on the fundamental question left open by the statute: What’s a hop? In
this fashion, the USA Freedom Act itself created the potential for compliance difficulties,
prompted by statutory confusion when the application of law to technology arose in unforeseen
circumstances. 362

360 (U) See generally Remarks of Robert Litt, General Counsel for the Office of the Director of National
Intelligence, Statement before the Senate Judiciary Committee (Dec. 13, 2013).
361 (U) The same issue arose when Congress amended the pen register statute in the USA PATRIOT Act of 2001.
See In re Certified Question, 858 F.3d 591, 602 (FISA Ct. Rev. 2016) (“The principal change to the pen
register/trap-and-trace provision was to make those provisions applicable not just to telephony, but to all forms of
wire and electronic communications.”).

362 (U) Courts have addressed comparable questions in the context of the pen register statute. See, e.g., In re
Certified Question of Law, 858 F.3d at 591; In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d
125 (3d Cir. 2015).

82

TOP SECRET//SI//NOFORN