The USA Today's NSA Story

The blogosphere is a buzz with discussion of today's groundbreaking story in the USA Today regarding the NSA's apparent attempt to data-mine ALL domestic telephone calls.

Like Glenn, I'm not sure what to make of the legal issues implicated by this story. If the NSA is not intercepting the content of calls, they may not be violating FISA (at least with respect to this particular activity). But there are a number of other statutes that are potentially at play here. It will take some time to sort through the legal issues.

For instance, the USA Today article highlights the potential significance of section 222 of the Communications Act:

The concern for the customer was also based on law:
Under Section 222 of the Communications Act, first
passed in 1934, telephone companies are prohibited
from giving out information regarding their customers'
calling habits: whom a person calls, how often and what
routes those calls take to reach their final destination.
Inbound calls, as well as wireless calls, also are
covered.

What specifically does section 222 prohibit? Well, on April 3, 2001--before this program began--Michael C. Lamb, the Chief Privacy Officer for AT&T Corp., testified before Congress about the meaning of section 222:

Section 222 of the Communications Act requires
telecommunications carriers to protect the confidentiality
of customer proprietary information ("CPNI"), such as the
telephone numbers called by customers and the length of
time of the calls. . . .

Section 222 defines "CPNI" as information that relates to
the quality, technical configuration, type, destination,
location, and amount of use of a telecommunications service
that is made available to the carrier by the customer solely
by virtue of the carrier-customer relationship. The Act
excludes from the definition of CPNI several categories of
information, including:

-subscriber list information such as name, address, and
telephone number;

-aggregate customer information from which individual
customer identities have been removed . . .

Section 222 provides that, except with customer approval,
a carrier receiving or developing CPNI by virtue of
providing a telecommunications service shall use
individually identifiable CPNI only to provide the type of
service from which CPNI is derived.

The statute, at least by its terms, does not appear to provide any exception for CPNI requested by the government. So it appears that the most important question (at least with respect to this statute) is whether the data these carriers are providing to the NSA fits within the "aggregate customer information" exception. Based on the USA Today article, that seems like a stretch, but then again, this is an area of the law with which I am not at all familiar, so I'll reserve judgment.

I expect that this and other questions will be explored in the coming days and weeks. Much more to come . . .

UPDATE: Great quote from Patrick Leahy:

Sen. Patrick Leahy of Vermont, the ranking Democrat on
the Senate Judiciary Committee, sounded incredulous
about the report and railed against what he called a lack
of congressional oversight. He argued that the media was
doing the job of Congress.

“Are you telling me that tens of millions of Americans are
involved with al-Qaida?” Leahy asked. “These are tens of
millions of Americans who are not suspected of anything. ...
Where does it stop?”

The Democrat, who at one point held up a copy of the
newspaper, added: “Shame on us for being so far behind and
being so willing to rubber stamp anything this administration
does. We ought to fold our tents.”

UPDATE II: Good primer on some of the relevant legal issues by Professor Orin Kerr.