Page 155 - Privacy in a Cyber Age Policy and Practice

BALANCING NATIONAL SECURITY AND INDIVIDUAL RIGHTS 143

executive order is not subject to judicial or congressional oversight, 153 and
it “authorizes collection of the content of communications, not just meta-
data.” The order does not authorize the specific targeting of U.S. persons
without a court order, but it authorizes retention of their communications
when collected inadvertently, “does not require that the affected U.S. per-
sons be suspected of wrongdoing[,] and places no limits on the volume
of communications by U.S. persons that may be collected and retained.”
This order is not the legal basis of either of the two programs under discus-
sion, and thus lies outside the scope of this discussion, but if the account
given by the Washington Post’s John Napier Tye is accurate, it is a serious
154
matter that deserves a separate analysis. According to Tye, it was on the
basis of 11233 order that the White House counsel’s office instructed him
to remove from a speech the assertion that Americans have “the oppor-
tunity to change” the “scope of signals intelligence activities” through the
“democratic process.” This raises serious questions about congressional
and judicial oversight over the executive branch and thus about the separa-
tion of powers, which was much debated throughout 2014 due to President
Obama’s own use of executive orders and recess appointments to bypass
Congressional deadlock. 155

2. Americans Abroad

FISA bans monitoring the Internet activity of American citizens abroad by
mandating that activities authorized under Section 702 “not intentionally
target a U.S. person reasonably believed to be located outside the United
States.” 156 In addition to noting that the NSA’s surveillance activities are
subject to oversight by the FISC, the executive branch, and Congress,
Director of National Intelligence James Clapper stated that the program
must not be used to “intentionally target any U.S. citizen, any other U.S.
person, or anyone located within the United States.” 157
These statements sound much more absolute than they should. One
notes that people are hardly required to show their passports when they
“travel” in cyberspace. It is far from obvious what their target’s nationality
is when the NSA is watching someone overseas. The NSA uses the following
procedure to deal with this attribution problem. The process of acquiring
data on a foreign target begins when an NSA analyst “tasks” the PRISM
system with acquiring information about a new surveillance target. 158 The
request to add a new target is subsequently reviewed by a supervisor who
must endorse the analyst’s “reasonable belief,” which is defined as 51 percent
confidence, that the specified target is a foreign national who is overseas at
the time of collection. 159