What Should Senator Wyden Ask About Section 702 Now?

Director of National Intelligence Dan Coats testified last week that he would be unable to provide an estimate of the number of U.S. persons whose information has been incidentally collected under Section 702, despite promising during his confirmation hearing to make every effort to obtain this information. Unsurprisingly, this announcement was met with criticism from legislators and privacy advocates who have long requested this metric—particularly from Senator Wyden, who has been asking for this information since 2011.

In light of Director Coats’s argument that quantifying the collection of U.S. person communications under Section 702 would exhaust agency resources and threaten privacy rights, here are four questions that Senator Wyden should ask now to establish why an estimate has not been provided and what could be done to encourage such an estimate in the future.

1. How much would it cost to quantify U.S. person communications collected under Section 702?

Director Coats testified that it would be infeasible to quantify the collection of U.S. person communications under Section 702 because even if only a small sample were analyzed, the amount of resources that would be required to conduct this analysis would detract from the NSA’s core intelligence and counterterrorism mission. However, the amount of resources required might be perfectly acceptable to lawmakers who have been requesting this number for years and must soon decide whether to reauthorize Section 702. By asking Director Coats to estimate how much it would cost to quantify collection of U.S. person communications under Section 702, Senator Wyden and his colleagues would be in a better position to counter the argument that this analysis would be too expensive—or understand how much funding should be allocated to producing this estimate in the future.

2. Are there steps that could be taken to protect the privacy of persons whose communications would need to be analyzed in order to quantify U.S. person communications collected under Section 702?

Director Coats also testified that quantifying the collection of U.S. person communications under Section 702 would threaten privacy and civil liberties, as determining whether a particular communication was sent to or from a US person may require NSA analysts to identify the parties to the communication. Privacy advocacy groups have argued that, given the importance of understanding the scope of U.S. person communications collected under Section 702 surveillance programs, the potential privacy harms may be justified if appropriate safeguards are applied. In a 2015 letter to then-Director of National Intelligence James Clapper, a coalition of groups including the ACLU wrote:

For instance, the review should be conducted by an independent office; it should use a sample that is about to reach the “age-off” date (i.e., is reaching the end of the applicable retention limit) and is representative of current collection practices; and the communications should be destroyed immediately after review.

Senator Wyden and his colleagues should ask whether Director Coats considered applying any of these safeguards and, if so, why they were deemed sufficient to protect the privacy interests at stake.

3. What specific measures did you try to estimate?

Although there are undoubtedly significant technical and privacy hurdles at play, one difficulty in quantifying the scope of U.S. person information collected under Section 702 is ambiguity about precisely what information is being requested. For example, Senator Wyden has characterized the information requested in at least two different ways.

In March, he stated:

So the key question is, and has always been: how many law-abiding Americans are having their communications swept in all that collection? Without even an estimate of that number, there is no way to judge what Section 702 means for the civil liberties of Americans.

Last week, in response to Coats’s testimony, Wyden stated:

You can’t say that there’s no impact from sweeping up law-abiding Americans’ communications under this program, and then complain that counting the number of those calls and emails would violate their privacy.

These questions may seem similar on their face but the first is much more difficult to answer than the second. The first question focuses on counting the number of U.S. persons who have had their communications collected, and would therefore require the NSA to identify parties to each analyzed communication with enough particularity to determine whether their communications had been collected more than once. The second question focuses on counting the number of individual communications to or from U.S. persons collected under Section 702, which would require the NSA to determine whether a communication originates from a U.S. person but not identify the particular U.S. person. Because the second question is less privacy-invasive to answer than the first, Senator Wyden and his colleagues should determine precisely which question Director Coats sought to answer.

4. Did you consider the use of a proxy to identify whether a communication was sent to or from a U.S. person? If so, which did you consider and why did you decide they would not work?

If it would be too costly or too invasive to directly determine whether each item in a sample of communications collected under Section 702 involves a U.S. person, it might be possible to use proxy measures to identify whether a communication was sent to or from a U.S. person. For example, Elizabeth Goitein of the Brennan Center for Justice has suggested classifying communications as being to or from U.S. persons if they originate from the U.S. country code (in the case of phone communications) or from a U.S. IP address (in the case of upstream collection of internet communications). This approach is limited in that it would not provide any information about the collection of communications under PRISM, or the collection of communications to or from U.S. person living abroad. That said, it could reduce the costs of analyzing at least some types of surveillance conducted under Section 702. Senator Wyden and his colleagues should therefore ask whether Director Coats considered using proxies to estimate collection of U.S. person communications under Section 702 and, if so, why they were not deemed sufficient for this analysis.