Who Authorized the NSA to Acquire Your Phone Records? You Did.

(updates below)

Believe it or not, that seems to be the legal theory the government is using to justify its wholesale acquisition of ALL phone records it can get its hands on. Any number of different statutes appear to forbid the telecom companies from handing over their customer call information to the government, at least absent a court order or valid "national security letter" (neither of which appear to have been secured by the NSA).

But, of course, this being a free country, people are free to consent to just about anything. If you want the government to have your private information, you can give your telephone company permission to provide that information. No court order is required. And, amazingly enough, the NSA is apparently claiming that most Americans did exactly that.

Buried toward the end of an article in Friday's Washington Post is this remarkable claim:

One government lawyer who has participated in
negotiations with telecommunications providers said the
Bush administration has argued that a company can turn
over its entire database of customer records -- and even
the stored content of calls and e-mails -- because
customers "have consented to that" when they establish
accounts. The fine print of many telephone and Internet
service contracts includes catchall provisions, the lawyer
said, authorizing the company to disclose such records to
protect public safety or national security, or in compliance
with a lawful government request.

"It is within their terms of service because you have
consented to that," the lawyer said. If the company also
consents, "and they do it voluntarily, the U.S. government
can accept it."

There you have it folks. We all agreed to this. It's in the fine print.

That strikes me as a remarkably weak legal position if that's really what the government is relying on. But it is consistent with what we know about this program so far. Qwest's apparently successful (and admirable) refusal to participate in this program indicates that the government does not feel it has the power to compel these companies to provide this information. The NSA is not relying on court orders or administrative subpoenas, but rather the voluntary cooperation of the telecom companies. And those companies in turn must be relying on some sort of consent theory with respect to their customers; otherwise they would appear to be in violation of both the Communications Act and the Stored Communications Act, if not other statutes as well.

Are these companies really confident that this consent theory will stand up to legal scrutiny? Who knows. I hope and expect that people more familiar with the relevant case law will weigh in on this subject in the coming days. But it may be that the government was able to convince the companies to rely on a weak legal theory through a combination of hardball negotiating and assurances of payment, secrecy, and favorable enforcement. The USA Today article that broke this story indicated that the government offered to pay for access to this data. It also indicated that Qwest had been threatened with exclusion from future government contracts if it refused to cooperate. Finally, the companies may have been assured that if this program was ever publicly exposed, the administrative agencies (FCC, DOJ) charged with interpreting and enforcing these statutes would resolve any ambiguities in the law in the companies' favor.

I'm skeptical of the merits of this consent theory, but let's assume for a moment that it is capable of surviving judicial scrutiny. The beauty of a consent-based theory is that the consumer always has the power to revoke that consent. If customers demand different terms, the companies will be forced to comply. One easy way to register your dissatisfaction with these companies would be to switch to Qwest. If what the USA Today reported is true, Qwest deserves to be rewarded for acting responsibly and protecting the privacy rights of its customers.

Which brings me to one final bit of comic relief. Paul from Powerline has posted excerpts from the Qwest Privacy Policy. He quotes this passage:

Our representatives pull up account records and may refer
to your bill, your calling patterns, and other information we
have to answer questions you may have or recommend how
we can best serve you.

He then quotes another passage that informs customers that their information will not be shared with third-parties but may be shared within the Qwest group of companies. To this he responds:

[S]ince Qwest shares its customers' records with companies
with which it has a "business relationship," but not with the
NSA to prevent terrorist attacks, there is no way I'm doing
business with Qwest.

Could there be a bigger clown in the whole world? Are we really supposed to think that there is anything odd or sinister or hypocritical about Qwest reserving the right to look through your information in order to answer your questions? Or to market its own products to you? Please. And does Paul really not understand why using your information for those purposes is far less troubling from a privacy perspective than providing that information to the government?

And for the record, I think Paul's boycott of Qwest is going to be a pretty lonely one. He's going to have to convince Qwest customers that they should switch to another company so that all their information can be instantly handed over to the government. Good luck with that.

UPDATE: Orin Kerr weighs in on the consent argument. He thinks it's weak.

This seems like a very unpersuasive argument in light of
the cases construing consent under the Wiretap Act, of
which the consent provision in the SCA is a mirror. It
reminds me of the argument that a DOJ lawyer once
tried to make that monitoring prison phones was
allowed because language in the Code of Federal
Regulations clearly notified prisoners that their phones
would be monitored. According to the lawyer, the notice
in the fine print of the CFR was sufficient to make the
monitoring consensual. Judge Posner rejected the
argument, calling it "the kind of argument that makes
lawyers figures of fun to the lay community." United
States v. Daniels, 902 F.2d 1238 (7th Cir. 1990). In light
of these cases, I think the consent argument is weak.

UPDATE II: This is a total stab in the dark, but if anyone reading this happens to have any pre-9/11 phone bills lying around from AT&T/SBC, BellSouth, or Verizon (not Verizon Wireless)it would be interesting to compare the terms and conditions from those bills with the terms and conditions from later bills. I'm curious whether these companies inserted "consent" language into their standard service contracts before they began handing over data to the NSA.

UPDATE III: The New York Times has secured a statement from Qwest:

The telecommunications company Qwest turned down
requests by the National Security Agency for private
telephone records because it concluded that doing so
would violate federal privacy laws, a lawyer for the
telephone company's former chief executive said today.

In a statement released this morning, the lawyer said that
the former chief executive, Joseph N. Nacchio, made the
decision after asking whether "a warrant or other legal
process had been secured in support of that request."

Mr. Nacchio learned that no warrant had been granted and
that there was a "disinclination on the part of the
authorities to use any legal process," said the lawyer,
Herbert J. Stern. As a result, the statement said, Mr. Nacchio
concluded that "the requests violated the privacy
requirements of the Telecommunications Act."

Again, good for them. I hope their decision is rewarded by consumers.