U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

42–457 PDF 2008

S. HRG. 110–385

NATIONAL SECURITY LETTERS: THE NEED FOR

GREATER ACCOUNTABILITY AND OVERSIGHT

HEARING

BEFORE THE

COMMITTEE ON THE JUDICIARY 

UNITED STATES SENATE

ONE HUNDRED TENTH CONGRESS

SECOND SESSION

WEDNESDAY, APRIL 23, 2008

Serial No. J–110–86

Printed for the use of the Committee on the Judiciary

(

(II)

COMMITTEE ON THE JUDICIARY 

PATRICK J. LEAHY, Vermont, Chairman 

EDWARD M. KENNEDY, Massachusetts 

JOSEPH R. BIDEN, JR., Delaware 

HERB KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

RUSSELL D. FEINGOLD, Wisconsin 

CHARLES E. SCHUMER, New York 

RICHARD J. DURBIN, Illinois 

BENJAMIN L. CARDIN, Maryland 

SHELDON WHITEHOUSE, Rhode Island 

ARLEN SPECTER, Pennsylvania 

ORRIN G. HATCH, Utah 

CHARLES E. GRASSLEY, Iowa 

JON KYL, Arizona 

JEFF SESSIONS, Alabama 

LINDSEY O. GRAHAM, South Carolina 

JOHN CORNYN, Texas 

SAM BROWNBACK, Kansas 

TOM COBURN, Oklahoma 

BRUCE A. COHEN, Chief Counsel and Staff Director 

STEPHANIE A. MIDDLETON, Republican Staff Director 

NICHOLAS A. ROSSI, Republican Chief Counsel 

(III)

C O N T E N T S 

STATEMENTS OF COMMITTEE MEMBERS 

Page

Cardin, Hon. Benjamin L., a U.S. Senator from the State of Maryland ............. 6

Feingold, Hon. Russell D., a U.S. Senator from the State of Wisconsin ............. 5

prepared statement, letter and attachments .................................................. 79

Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont .................... 1

prepared statement .......................................................................................... 84

Specter, Hon. Arlen, a U.S. Senator from the State of Pennsylvania ................. 3

Whitehouse, Hon. Sheldon, a U.S. Senator from the State of Rhode Island ...... 7

WITNESSES 

Baker, James A., former Counsel for Intelligence Policy, Department of Justice, Washington, D.C. ......................................................................................... 8

Nojeim, Gregory T., Director, Project on Freedom, Security & Technology, 

Center for Democracy & Technology, Washington, D.C. .................................. 11

Woods, Michael J., former Chief, National Security Law Unit, Office of the 

General Counsel, Federal Bureau of Investigation, Washington, D.C. ........... 13

QUESTIONS AND ANSWERS 

Responses of Michael J. Woods to questions submitted by Senator Feingold .... 35

SUBMISSIONS FOR THE RECORD 

American Civil Liberties Union, Caroline Fredrickson, Director, Washington 

Legislative Office, Washington, D.C., statement and attachments ................. 48

Baker, James A., former Counsel for Intelligence Policy, Department of Justice, Washington, D.C., statement ...................................................................... 66

Nojeim, Gregory T., Director, Project on Freedom, Security & Technology, 

Center for Democracy & Technology, Washington, D.C., statement ............... 86

Organizations supporting the National Security Letters Reform Act, joint 

letter ...................................................................................................................... 100

Woods, Michael J., former Chief, National Security Law Unit, Office of the 

General Counsel, Federal Bureau of Investigation, Washington, D.C., statement ...................................................................................................................... 102

(1)

NATIONAL SECURITY LETTERS: THE NEED 

FOR GREATER ACCOUNTABILITY AND 

OVERSIGHT 

WEDNESDAY, APRIL 23, 2008

U.S. SENATE, 

COMMITTEE ON THE JUDICIARY, 

Washington, DC 

The Committee met, pursuant to notice, at 10:04 a.m., in room 

SD–226, Dirksen Senate Office Building, Hon. Patrick J. Leahy, 

Chairman of the Committee, presiding. 

Present: Senators Feingold, Cardin, Whitehouse, Specter, Kyl, 

and Sessions. 

OPENING STATEMENT OF HON. PATRICK J. LEAHY, A U.S. 

SENATOR FROM THE STATE OF VERMONT 

Chairman LEAHY. Good morning. 

When Congress last reauthorized and expanded the USA PATRIOT Act in March, 2006, I voted against it, although I voted for 

the first one. I stated then that I felt the administration and the 

Congress had missed an opportunity to get it right. But we were 

able to include some sunshine provisions, which has given us insight that we will use today in our examination of national security 

letters, or NSLs. 

I have long been concerned by the scope of the authority for 

NSLs and the lack of accountability for their use. Thankfully, we 

are able to include requirements for review of the NSL program by 

the Inspector General when we reauthorized the PATRIOT Act. 

There had not been that kind of a review before. 

Now, for 2 years, the reports by the Inspector General have revealed extremely troubling and widespread misuse of NSLs. The 

authority to issue NSLs allows the Federal Bureau of Investigation 

to request sensitive personal information: phone bills, e-mail transactions, bank records, credit reports, things that could basically 

stop a business while they try to put this all together, and do this 

without a judge, without a grand jury, without even having a prosecutor evaluate those requests. 

In the reports, the Inspector General has found some very, very 

disturbing misuse of this authority. The Inspector General’s report 

found widespread violations, including failure to comply with even 

the minimal authorization requirements, and more disturbingly, 

that the FBI requested and received information to which it was 

not entitled under the law. The reports found some rampant confuVerDate 0ct 09 2002 14:52 May 27, 2008 Jkt 042457 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\42457.TXT SJUD1 PsN: CMORC
2

sion about the authorities, and virtually no checks to ensure compliance or correct mistakes. 

But what I found very significant, is the Inspector General found 

that NSL use has grown to nearly 50,000 a year, and nearly 60 

percent of those NSLs are used to find information about Americans. It is a major change in the years since 9/11. I raised these 

concerns publicly and privately with Director Mueller of the FBI. 

In fairness, the FBI has acknowledged some problems. It has 

issued new guidelines, new guidance, a new data system to track 

issuance of these NSLs. 

It has also created an Office of Integrity and Compliance to ensure that there are processes and procedures in place to ensure 

compliance. 

I believe that the Director and his staff are sincere in their efforts, but I am not persuaded that the actions taken have been 

enough. So we are following up on an earlier oversight hearing to 

ask what changes are needed to the statutory authority. Among the 

things that concern me are whether the law should require higher 

level review and approval, perhaps judicial or Department of Justice review, before NSLs can be issued. 

Is a standard for issuance which requires only that it be relevant 

to a terrorism investigation too lenient? I mention this, because we 

have seen all the statistics, the sudden huge increase in the number of arrests that were related and said to be terrorism. Then 

when we asked the question about, if they are terrorists, why did 

they get a fine or 30 days in jail or 60 days in jail? Well, it turned 

out they were just run-of-the-mill cases that they reclassified so 

that the statistics were good. I want to know if that is the same 

thing here. Is the scope of documents available under NSLs too 

broad? 

I’d like to hear how we can ensure that there are adequate 

standards for determining when private records on U.S. persons 

that have been collected using NSLs, how can they be retained? Actually, how can they be disseminated and used? 

Simply because one of these NSLs is issued with no guidance, no 

checks and balances, or anything else and their name gets picked 

up, are they going to find some day when their kids are trying to 

get into college, are they blocked? If they’re trying to get a job or 

a promotion, are they suddenly blocked and they don’t know why? 

Now, I commend Senator Feingold. He’s been a leader on this 

issue. I believe his bipartisan bill, the National Security Letter Reform Act of 2007, is on the right track, particularly in its recommendation for the need for a real check on independent oversight of NSLs. 

The bill would also narrow the extraordinarily broad scope of information that NSLs can acquire. They would make the standard 

for their issuance more rigorous. I look forward to hearing our witnesses’ view on this important legislation, getting ideas from them 

if there are other important steps we can take. 

The problem we see with NSLs is just one part of a much broader concern. We all know that the changing nature of national security threats, and particularly the threat from international terrorism, has required changes in the way the government collects 

3

and uses intelligence, the kind of information it needs. Nobody disagrees with that. 

But we have to remember what a perilous undertaking it is when 

the government engages in domestic spying. Americans don’t like 

it, and for very good reason. We have a long history of abuses: the 

Red scare of 1919; McCarthyism; co-intel for Watergate; the recent 

Pentagon Talon data base program; the collected information on 

Quakers and other anti-war protestors. 

Can you imagine the shock that must have been, those collecting 

that, to find that Quakers were protesting a war? Quakers always 

protest a war. The shock would have been if, when they did that, 

spying on these Quakers, if they had them saying, we’re in favor 

of war. Now, that, that would have been worth collecting. 

So if we’re going to adapt our collection and use of information 

for Americans as a changing threat, we have to be sure to do the 

same for the checks and accountability mechanisms, we have to 

protect our liberties as Americans. The FBI’s misuse of NSLs is one 

example of the need for clearly defined procedures and careful controls when collecting and using domestic intelligence, but we have 

to be just as vigilant in other areas: data mining, use of satellites 

to collect domestic information, biometrics, fusion centers. They are 

all tools for national security, but each is fraught with the potential 

for privacy invasions and harm to American liberties. We in the 

Congress have a responsibility to see how these are being used. 

[The prepared statement of Senator Leahy appears as a submission for the record.] 

So I am looking forward to this. Senator Specter, who I mentioned is the senior Republican on the Committee, has a long history of asking these questions of both Republicans and Democrats, 

and I am glad you’re here. 

STATEMENT OF HON. ARLEN SPECTER, A U.S. SENATOR FROM 

THE STATE OF PENNSYLVANIA 

Senator SPECTER. Thank you, Mr. Chairman. I wouldn’t be anywhere else, especially since I’m the Ranking Member and I’m really 

not needed here because there’s such a large showing of Republican 

members of this Committee to handle this important issue. 

This is a prized Committee, very keenly sought after by members 

of the U.S. Senate. If any were here, I would exhort them to attend 

because this is a very important matter, especially in the context 

of what has happened with expansion of executive authority. 

Decades from now, I believe historians will look down on this period since 9/11 to the present time and beyond as an extraordinary 

expansion of executive power, necessary, at least to some extent, as 

I have stated by my votes and my positions in supporting the expansion of the PATRIOT Act. 

But I am concerned when we are having hearings on national security letters and we do so in the context of the President having 

issued a signing statement which purports to limit the executive’s 

responsibility to comply with Section 119, notwithstanding the fact 

that this was a matter negotiated. That’s my recollection, confirmed by Nick Rossi, who was on my staff at the time and is now 

Chief Counsel. 

4

We negotiated the oversight on review of national security letters, and then the President signs a statement in which he says 

that he’ll interpret Section 119 in a manner consistent with the 

broader Article 2 powers. Well, that’s not adequate. There’s been 

expressed negotiations. This comes in the context where one of the 

reported incidents involves a matter where the FBI sought records 

under Section 215 under the order for business records from the 

FISA court, twice refused. Then the FBI goes to a national security 

letter based on the same information. Well, that sounds wrong to 

me. If they don’t have a basis for it when it goes to a court, to come 

back to something they have unilateral control on, it’s not exactly 

what Congress intends here. And all of this occurs in a context 

with vast, vast expansion. 

When you have the President violating the Foreign Intelligence 

Surveillance Act, the National Security Act, requiring reports to 

the Intelligence Committees, on his purported authority under Article 2, never tested judicially, but violations occur on unilateral action. You have the concerns about the State Secrets Act, and the 

Attorney General says there will be a calamitous result, violating 

the President’s Article 2 powers. 

You have an effort to legislate under the Shield Law and letters 

from the FBI and the Attorney General and the Director of National Intelligence and Homeland Security that the world is going 

to collapse, notwithstanding the careful calculation of that statute 

to preserve national security interests. 

The attorney/client privilege, pressed by this administration far 

beyond any other administration. Former Attorney General Edwin 

Meece and former Attorney General Richard Thornburg testified in 

this room that the current interpretation is inappropriate. Two 

principles: the government proves its case, and the constitutional 

right to counsel, which necessarily implies confidential privilege. 

But now there is an expansion of executive authority. Thank God 

for the courts, because it has been more than frustrating to be on 

this Committee and to chair it, to be Ranking Member, and not to 

have the semblance of effective oversight. We simply can’t chase 

the executive sufficiently to have effective oversight. 

Now there is a move to have retroactive immunity to the telephone companies. As yet on the record we don’t know what that 

retroactive immunity is for, but we’re asked to grant it legislatively. I believe that from what I know as to what the telephone 

companies have done, they’ve been good citizens and they ought to 

be protected. But the government can step into their shoes and defend those cases and preserve the open courts, and also to give the 

telephone companies their due. 

So I would say, Mr. Chairman, we ought to do a lot more, but 

I’m not quite sure what to do. 

Chairman LEAHY. Well, if the Senator would yield, I was somewhat concerned when I became Chairman. I’d send letters down to 

Department of Justice asking questions and not get any response, 

and wondered if it was because I was a Democrat and it was a Republican administration. Then I found out that the chairman, when 

he was chairman, found it difficult to get answers to those letters 

also. 

5

Senator SPECTER. Well, I’m still co-signing the letters, Mr. Chairman. 

Chairman LEAHY. I know you are, and I appreciate that very 

much. I think oversight—I agree with the Senator from Pennsylvania. Oversight is extremely important because if you have no 

check and balance, at a time when our government can be all-powerful, it is a terrible situation. The Senator from Pennsylvania, like 

myself, was a prosecutor. There are a lot of things we would have 

loved to have done unilaterally. But fortunately we couldn’t. We 

had to have oversight by the courts, we had to have checks and balances. The country’s safer that way. 

Senator SPECTER. I want to associate myself with the remarks 

which you made, following the interruption, and conclude my statement just by associating myself. 

Chairman LEAHY. I apologize. I thought you had. I thought you 

had. 

Senator SPECTER. Oh, no you don’t. It’s fine. We do it all the time 

and it’s totally acceptable. 

Chairman LEAHY. You see? What you all missed was the opportunity to see Senator Specter and myself at a hearing in Vermont. 

Senator SPECTER. Where was everybody? 

Chairman LEAHY. It was very interesting. They’re still talking 

about it up there, approvingly. 

Senator SPECTER. It was an official Committee hearing. Where 

was everybody? 

Chairman LEAHY. And Senator Specter was praised by Republicans and Democrats across the political spectrum for his participation. 

Senator Feingold, this is your legislation. If you want to say 

something, please feel free. 

STATEMENT OF HON. RUSSELL D. FEINGOLD, A U.S. SENATOR 

FROM THE STATE OF WISCONSIN 

Senator FEINGOLD. Thank you, Mr. Chairman and Ranking 

Member Specter. Thank you for holding this important hearing, 

and for your commitment to this issue. 

I could not agree more that greater oversight and accountability 

are needed with respect to national security letters. The Justice 

Department’s Inspector General documented serious misuse and 

abuse of national security letters from 2003 to 2006. 

A followup audit conducted by the FBI itself not only confirmed 

the Inspector General’s findings, it documented even more violations. These widespread problems are directly attributable to the 

PATRIOT Act, which expanded the NSL statutes to essentially 

grant the FBI a blank check to obtain sensitive information about 

innocent Americans. 

Congress gave the FBI very few rules to follow and then failed 

to adequately fix these problems when it reauthorized the PATRIOT Act. I appreciate that Director Mueller and others in the 

FBI leadership ranks have taken these problems seriously, but 

leaving this to the FBI alone to fix is not the answer. These Inspector General reports prove that ‘‘trust us’’ simply doesn’t cut it. 

It was a significant mistake for Congress to grant the government broad powers and just keep its fingers crossed that they 

6

wouldn’t be misused. Congress has the responsibility to put appropriate limits on government powers, limits that allow agents to actively pursue criminals, terrorists, and spies, but that also protect 

the privacy of innocent Americans. 

Congress must also ensure that the statute complies with the 

Constitution. In that vein, last fall a Federal District Court struck 

down one of the new NSL statutes, as modified by the PATRIOT 

Act Reauthorization legislation enacted in 2006 on First Amendment grounds. 

This is why I introduced the National Security Letter Reform Act 

with a bipartisan group of Senators, including Senators Sununu, 

Durbin, Murkowski, Salazar, Hagel, and others. This bill places 

new safeguards on the use of national security letters and related 

PATRIOT Act authorities to protect against abuse and ensure the 

constitutionality of the statute. 

Among other things, it restricts the type of records that can be 

obtained without a court order to those that are the least sensitive 

and private, and it ensures that the FBI can only use NSLs to obtain information about individuals that have at least some nexus 

to a suspected terrorist or spy. I am pleased that it has received 

endorsements from all over the political spectrum, from the Center 

for American Progress, to the League of Women Voters, to Grover 

Norquist of Americans For Tax Reform. 

I would ask, Mr. Chairman, that an April 22 letter in support of 

the bill, as well as a ‘‘Dear Colleague’’ about the bill, be included 

in the record. 

Chairman LEAHY. Without objection, so ordered. 

[The prepared statement of Senator Feingold, with attachments, 

appears as a submission for the record.] 

Senator FEINGOLD. Thank you, Mr. Chairman. 

This legislation is a measured, reasonable response to a serious 

problem. Again, thank you very much for holding the hearing on 

the bill and on this topic, and I look forward to the witnesses’ testimony. 

Chairman LEAHY. Thank you. 

Senator Cardin, did you wish to—

STATEMENT OF HON. BENJAMIN L. CARDIN, A U.S. SENATOR 

FROM THE STATE OF MARYLAND 

Senator CARDIN. Thank you, Mr. Chairman. Just very briefly, let 

me first comment that I will be moving between this Committee 

and the Foreign Relations Committee that has a hearing on Darfur 

today. I’m saying that for Senator Specter’s benefit, because I’m 

sure his colleagues are very busy in other committees that are 

holding hearings today. 

But obviously this is an extremely important hearing, and I 

thank you very much for conducting this hearing. 

I just want to make a quick observation, if I might. I think 

Americans would be very surprised to learn that there are tens of 

thousands of national security letters issued every year—every 

year—the majority of which are directed toward Americans, requesting sensitive information such as their credit information or 

their telephone records, and it is done without any court supervision. They also, I think, would be surprised to learn about the InVerDate 0ct 09 2002 14:52 May 27, 2008 Jkt 042457 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\42457.TXT SJUD1 PsN: CMORC
7

spector General’s report that pointed out that a large number of 

these letters were issued contrary to the law, in violation of the authority that the Department had. 

So I think it’s very important for us to do the appropriate oversight. I’m sure we’re going to hear today, Mr. Chairman, that as 

a result of the Inspector General’s report, as a result of the oversight that this Committee has done, that the circumstances are improved, that procedures are now in place, that the number of violations of laws have been reduced dramatically and that the circumstances and the use of national security letters have improved 

dramatically. 

But what happens when we turn off the spotlight? What happens 

when Congress does not hold regular oversight hearings on the use 

of national security letter? Will we revert back to the use of these 

letters, contrary to law? When one agency can make a decision 

without review of the courts, without oversight, there is the potential for abuse. 

So I just want to compliment Senator Feingold for his legislation. 

I think it’s important that we look at ways in which we can establish the appropriate check-and-balance in our system to make sure 

that the agencies have the tools that they need to protect our country and to pursue investigations that are important so they can get 

the material necessary for investigations, but at the same time protect the civil liberties of the people of our Nation. Clearly that was 

not done over the last five or 6 years. Clearly that was abused and 

did not further justice, and it did hurt the civil liberties of the people of our country. 

So I think that we should not only be holding the oversight hearing that Senator Specter has talked about the importance of, but 

to look at ways in which we can institutionalize a better check-andbalance system on the use of this extraordinary power by the Department of Justice. 

Mr. Chairman, I look forward to our witnesses. Again, I apologize 

if I have to leave to attend another hearing on the circumstances 

within the Darfur region of Sudan. 

Chairman LEAHY. Thank you very much. 

Senator Whitehouse, did you have anything you wanted to add? 

STATEMENT OF HON. SHELDON WHITEHOUSE, A U.S. SENATOR 

FROM THE STATE OF RHODE ISLAND 

Senator WHITEHOUSE. Thank you, Mr. Chairman. 

Very briefly, I just wanted to commend Senator Feingold for his 

legislation. He has undertaken what those of us who have the 

honor of working with him have come to expect as a very thoughtful and thorough approach to this issue. I think we should also 

take a moment, if it has not been done already, to commend Inspector General Glen Fine. We are here, in large part, because of 

the research work that he did. 

Our job is to oversee the executive branch and remark and bring 

attention to situations where folks have failed in their duties or 

failed in their responsibilities, and assure that those mistakes are 

cured. It is also, I think, our responsibility to express appreciation 

and pride when folks in the executive branch do their duties particularly well. 

8

I think the Department of Justice Office of Inspector General did 

its duties particularly well in this respect, and I think the record 

of the hearing should reflect that. I remain a little bit dismayed 

that the FBI, as an institution—I had this discussion with Director 

Mueller when he was here—did not more highly value the rather 

extraordinary powers that they were given in this legislation and 

the responsibilities, the concomitant responsibilities that came with 

that. 

The fact that there wasn’t adequate internal oversight, that 

there weren’t checks and balances going, frankly, right up to the 

Director’s office, because this is an issue that directly affects the 

credibility of one of our proudest law enforcement agencies with 

this Congress, and if they’re not minding the store when we give 

them the kind of scope—I think mistakenly, but irrespective of 

that—that they are and it’s cabined with particular congressional 

restrictions, the level of disinterest in attending to those congressional limitations is kind of surprising. 

You would have thought that the highest levels of the FBI, somebody would be saying, you know, this is pretty serious stuff, they 

put some pretty serious boundaries around it. We’re going to look 

like real dopes if we foul this up. You know, somebody in my office 

is going to be in charge of making sure this is done right. The failure of that, I think, is an interesting and significant failure in this 

whole process. 

So I very much look forward to the testimony of all the witnesses. I appreciate the Chairman holding this hearing, and I 

thank Senator Feingold for, once again, his thoughtful and thorough approach to an important issue. 

Chairman LEAHY. Well, thank you very much. 

Gentlemen, you’ve had a chance to hear our views on this. Don’t 

let that influence you in any way, shape, or manner as you give 

your testimony. I mean that, seriously. 

The first witness will be James Baker. He has an extensive background in the area of national security. He served at the Justice 

Department for 17 years. He was Counsel for Intelligence Policy in 

the Office of Intelligence Policy & Review from 2001 to 2007. Is 

that correct? A former Federal prosecutor, he’s worked on a wide 

variety of national security matters. He taught national security 

law at Harvard Law School in 2007. He’s a Fellow at the Institute 

of Politics at Harvard’s Kennedy School of Government. He currently serves as the Assistant General Counsel for National Security at Verizon. 

He received his bachelor’s degree from the University of Notre 

Dame and his law degree from the University of Michigan Law 

School. 

Mr. Baker, please go ahead, sir. 

STATEMENT OF JAMES A. BAKER, FORMER COUNSEL FOR INTELLIGENCE POLICY, DEPARTMENT OF JUSTICE, WASHINGTON, D.C. 

Mr. BAKER. Thank you, Mr. Chairman, Ranking Member Specter, and members of the Committee. I appreciate the opportunity 

to be here today. 

9

Let me just say at the outset that I am appearing here today in 

my individual capacity at the request of the Committee and anything I say should not be taken as reflecting the views, necessarily, 

of my current or former employers. 

So, Mr. Chairman, you have my written statement, which I 

would ask to be made part of the record. 

Chairman LEAHY. Without objection, it will be part of the record. 

Mr. BAKER. Thank you, sir. 

[The prepared statement of Mr. Baker appears as a submission 

for the record.] 

Mr. BAKER. I won’t try to recapitulate what I say there, but my 

objective today is to try to be of whatever assistance I can to the 

Committee to try to put national security letters in context with 

what the intelligence community, the FBI, is doing every day to 

conduct national security investigations and to obtain foreign intelligence information. So what I am urging today is that we think 

about this in a holistic way and try to understand the perspective 

of the people on the ground who have to use these tools as they 

go about doing what everybody agrees we want them to do, which 

is to protect the country. 

And so what I urge is we not focus just on NSLs, but we think 

in a larger way about the whole question of what I refer to as 

metadata. I’ll come back to that. Well, I’ll just address that right 

now. 

Metadata, as I describe in my written statement, what I mean 

by that, and what other people have referred to or used that term 

to refer to, is really a distinction between content information and 

non-content information. Content information is the words that are 

spoken on a telephone call, the substance of an e-mail, what happens in the privacy of our homes, those kinds of things. That’s the 

content that I refer to. 

When I’m talking about metadata I’m talking about non-content. 

It’s information about those things, maybe the date, the time, the 

duration of the telephone call, the ‘‘to’’ and ‘‘from’’ of an e-mail, indications about where you moved at different points in time, but 

it’s not your actual substance of your communications. 

So what I think, and what I’m trying to say today is that Congress, I suggest, should think about the problem or the issue of the 

collection of non-content information and how it wants the government to go about doing that, and what rules apply, what oversight 

there should be, and so on. 

Metadata, generally speaking, is not protected by the Fourth 

Amendment. Content is protected by the Fourth Amendment. 

Metadata is protected in some instances by statute, but in many 

instances by nothing. There are no statutes with respect to certain 

types of metadata. So what I think Congress needs to think about, 

is what does it want the government to do? What do we as Americans want the government to do with respect to the collection of all 

types of metadata, from the types of metadata we’re talking about 

today from national security letters, but broadly, all different types 

of metadata? That’s the big issue. That’s the big privacy issue, I 

think, that faces us today. 

Let me just say, metadata is a critically important tool for conducting national security investigations. It’s been referred to as the 

10

bread and butter of FBI investigations. But I don’t want to oversell it, either. It’s not a panacea. It may be the bread and butter, 

but it’s not necessarily the main course or the dessert. I mean, it’s 

not everything. It provides you with certain guideposts and ways 

to think about problems and who to focus on, but it’s an investigative tool, not an investigation. 

My main criticism, I think, of the current statutes that we have, 

and I urge the Congress to think about it as it decides what to do 

next, is that they are just way too complex. There are too many 

tools that are out there for the government to use with too many 

different standards, too many different approval levels, too many 

different oversight mechanisms with respect to the collection of 

metadata. 

For example, as I said in my written statement, there are eight 

different ways, by my count, at least, to get telephone toll records. 

There are eight different ways, with all kinds of different standards. That’s too complex. That is what leads to, I think, some of 

the confusion that ensues that you see reflected in the Inspector 

General’s report, which I also commend. I think it’s an excellent report. 

So I think as you consider what to do next, you should worry 

about making things too complex. That’s what I urge you to worry 

about with respect to that. You should also worry about making 

sure there’s adequate oversight. You should make sure that there 

are the right people in the right jobs, working hard to get it right. 

That’s critically important. I also urge that there be adequate and 

statutorily mandated minimization procedures with respect to all 

different types of metadata. Senator Feingold’s bill urges that, or 

would require that with respect to national security letters, but you 

need to think broadly and think about other types of metadata that 

are collected from a variety of different sources. 

As I suggest in my written statement, one thing to think about 

would be a national security subpoena. It would be simple, it would 

be broad in scope. It wouldn’t be unlimited in scope. It wouldn’t be 

able to collect certain types of data if you wanted to restrict that, 

such as tax records and so on. It would not be an administrative 

subpoena, it would be a subpoena that would require the involvement of the Department of Justice. 

I see my time has expired, Mr. Chairman, so I will stop there. 

But what I urge is, do not approve a national security subpoena 

unless you also provide for adequate oversight mechanisms, provide resources for that, and require minimization. 

Thank you, Mr. Chairman. 

Chairman LEAHY. Thank you. We will go into what you mean by 

adequate oversight on that. 

The next witness is Gregory Nojeim—did I get that correct? 

Mr. NOJEIM. Yes. 

Chairman LEAHY. Thank you. He’s a Senior Counsel and Director 

of the Project on Freedom, Security & Technology at the Center for 

Democracy & Technology in Washington. He’s a recognized expert 

on Fourth Amendment and surveillance issues arising in the national security and intelligence areas. Before joining CDT in May 

of 2007, he was the Associate Director and Chief Legislative Counsel for the American Civil Liberties Union. He received his bachVerDate 0ct 09 2002 14:52 May 27, 2008 Jkt 042457 PO 00000 Frm 00014 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\42457.TXT SJUD1 PsN: CMORC
11

elor’s degree from the University of Rochester and his law degree 

from the University of Virginia. 

Go ahead, sir. 

STATEMENT OF GREGORY T. NOJEIM, DIRECTOR, PROJECT 

ON FREEDOM, SECURITY & TECHNOLOGY, CENTER FOR DEMOCRACY & TECHNOLOGY, WASHINGTON, D.C. 

Mr. NOJEIM. Thank you, Senator Leahy, Senator Specter, members of the Committee. Thank you for the opportunity to testify 

today on behalf of CDT. 

The DOJ Inspector General found widespread errors and violations in the FBI’s use of NSLs to obtain bank, credit, and communication records of U.S. citizens without prior judicial review. 

These violations are the natural, predictable outcome of the PATRIOT Act and other legal and technology changes. They weakened 

the rules under which FBI agents make these demands while dramatically expanding their scope. In response, the FBI issued detailed guidance on NSLs that contains many useful elements. 

But internal reforms can only fix so much. The only way to truly 

address the problems is to legislate traditional checks and balances 

under which a judge must approve governmental access to sensitive information. 

So far, NSL legislation has been a one-way street. With almost 

every change in the law, more records from more businesses with 

more personal information about people increasingly distant from 

the target of the investigation have been made available to more 

people in government, with more coercion and less judicial oversight. And, the judicial review that has been provided for has been 

largely toothless. 

Self-policing doesn’t work. Going to a judge makes a difference 

in a way that is unachievable by merely internal reviews or by reviews conducted by attorneys in a different part of the executive 

branch. 

Senator Specter said, ‘‘Thank God for the courts.’’ It’s time to 

give the courts something meaningful to do in this context. 

We ask that you enact legislation that reflects the principle that 

the more sensitive the information sought, the tighter the standard 

should be for getting it and the more exacting and detached the review for the request for information should be. 

When revealing information is sought in an intelligence investigation, mere relevance without judicial review and without a tie 

between the subject of the records and a foreign power is an inappropriate standard. The weak relevance standard is often justified 

by drawing parallels between NSLs and criminal subpoenas, which 

are issued without prior judicial review. 

But intelligence investigations are more dangerous to liberty 

than criminal investigations. They require stronger compensating 

protections. 

Intelligence investigations are broader than criminal investigations. They are not limited by the criminal code. They can investigate legal activity, including First Amendment activity. 

Intelligence investigations are conducted in much greater secrecy 

than criminal cases, even perpetual secrecy. When a person receives a grand jury subpoena, normally a person can complain 

12

about it. In an intelligence case, when a business gets an NSL, 

they’re gagged. They’re prohibited by law from complaining about 

it, and the subject of the NSL never learns of it. 

Finally, in a criminal investigation almost everything the government does is ultimately exposed to scrutiny. The prosecutor knows 

that at the end of the day, his actions will often come out in public. 

That is a powerful constraint. There’s no public airing at the end 

of intelligence investigations. 

In this context, the relevance standard offers insufficient protection against abuse. There is just no substitute for tightening the 

standard and subjecting requests for sensitive information to judicial review. 

After-the-fact minimization, while it’s important, doesn’t prevent 

the initial intrusion. Minimization under FISA, the model that 

many urge for NSLs, is actually quite permissive. 

Moreover, none of the changes that the FBI has put in place can 

get to the core issue. That is to ensure that NSLs are used only 

in a focused way when there is a factual basis for believing that 

the individual whose data is sought is a terrorist or a foreign 

agent, or that information is otherwise sufficiently important to the 

activities under investigation. 

The NSL Reform Act, in contrast, does get to the core issue. It 

creatively honors the principle that sensitive information deserves 

more protection. First, it would separate information that can now 

be obtained with an NSL into sensitive and less-sensitive personal 

information. 

Not all metadata is created alike. Some of it is particularly sensitive. The ‘‘to′′/′′from’’ information about a person’s e-mailing is 

more sensitive than information that merely identifies a person. 

Yesterday I applied for a loan at a bank. The records that I gave 

to the bank might be regarded as metadata under this proposal. I 

had to give them my tax return and a lot of other sensitive information that, frankly, I didn’t want to give up, and frankly 

shouldn’t be available to law enforcement without a really good 

reason. 

We like the way that the NSL Reform Act separates out these 

two types of sensitive information to less sensitive and more sensitive, and says that when the information is more sensitive there 

has to be some judicial authorization, usually -probably -through 

Section 215 of the PATRIOT Act before the information can be 

given to the government. These are necessary reforms. They and 

other measures can ensure that the government has the tools it 

needs to prevent terrorism and that those tools are subjected to appropriate checks and balances. 

Thank you very much. 

Chairman LEAHY. Thank you very much. 

[The prepared statement of Mr. Nojeim appears as a submission 

for the record.] 

Chairman LEAHY. Our next witness, Michael Woods, is an attorney with extensive expertise in national security areas. He served 

in a variety of national security-related positions at the Justice Department, beginning his service in 1993. He served as Chief of the 

FBI’s National Security Law Unit from 1997 to 2002. In private 

practice, he has advised Department of Defense clients in matters 

13

of national security policy. He has published Law Review articles 

on national security law issues, including those related to national 

security letters and the PATRIOT Act. He graduated from the University of Oxford and Harvard Law School. 

Mr. Woods, glad to have you here. 

STATEMENT OF MICHAEL J. WOODS, FORMER CHIEF, NATIONAL SECURITY LAW UNIT, OFFICE OF THE GENERAL 

COUNSEL, FEDERAL BUREAU OF INVESTIGATION, WASHINGTON, D.C. 

Mr. WOODS. Thank you, Mr. Chairman. 

Mr. Chairman and members of the Committee, I am very pleased 

to have the opportunity to appear this morning. I think, really, I 

have two things to offer the Committee in this very important 

work. The first, is my practical experience. As a former Chief of the 

FBI’s National Security Law Unit, I was basically in charge of the 

national security letter production process during the time I was 

there. I would add and would underline that I left the FBI in 2002, 

and so I am probably not the person who can comment on what has 

gone on more recently than that internally, or about the measures 

that have taken place. 

But I can certainly give some insight into how these letters were 

used investigatively prior to the PATRIOT Act, into the rationale 

for the changes that were sought in the PATRIOT Act, and into 

some of the investigative concerns that I think persist to this day. 

The second, of course, as the Chairman has noted, I have written 

on what I call transactional data, which Mr. Baker is referring to 

as metadata. I will use whatever term the Committee wants. I do 

not mean to create confusion. I have summarized this research in 

my written testimony, and I have appended a Law Review article 

that I think might be helpful. 

Chairman LEAHY. Incidentally, all the written testimony of all 

the witnesses will be put in the record in total. 

Mr. WOODS. Thank you, Mr. Chairman. 

Like the other witnesses this morning, and I’m sure everyone on 

the Committee, I see in this constantly evolving digital environment an enormous challenge for our government. The cloud of 

transactional information or metadata that each of us now creates 

in our daily lives, though it may not contain the direct content of 

our private communications, reveals a steadily more detailed picture of our activities, our personal habits, our social networks, our 

finances. This information largely resides in the custody of third 

parties, in quantities, formats, and conditions of which most of us 

remain unaware. 

The constant expansion in the capacity of digital storage systems 

and in the power of search engine technology make this transactional information at once more permanent and more easily accessible than ever before. This situation poses a real challenge to 

counterintelligence and counterterrorism investigators. On the one 

hand, it allows a new window into the hidden activities of our most 

sophisticated adversaries. On the other, the compromise of privacy 

by the acquisition of transactional data seems much greater now, 

that the quantity and detail of that information has increased. 

14

I believe it is critically important that the Committee leave the 

FBI with a flexible and effective tool for obtaining transactional information. That tool should incorporate safeguards that inspire 

public confidence, but safeguards that are proportionate and carefully tailored in response to the actual harms. 

Though I disagree based on my experience with the suggestion 

that the legal standard for national security should be returned to 

its pre-PATRIOT Act level, I think many parts of the current legislative proposal represent very promising steps in the right direction. 

I am very happy to elaborate on these views in response to your 

questions, and look forward to assisting the Committee in this important work. 

Again, thank you for inviting me. 

Chairman LEAHY. Thank you very much, Mr. Woods. 

[The prepared statement of Mr. Woods appears as a submission 

for the record.] 

Chairman LEAHY. Over the last several years, the FBI issued virtually no guidance. They had no real checks or oversight on the expanded use of national security letters. We have had several Inspector General reviews which came about because Congress, in its 

oversight, insist on these reviews. They pointed out errors in every 

single aspect of the national security letters: they’re drafted incorrectly; they’re issued without even the minimal administration requirements; their use was not monitored; the information collected 

is often not even recorded or tracked. 

So, in other words, these Inspector General reports showed that 

the FBI failed in every respect to police its use of NSLs. It was only 

after these devastating IG reports came out that the FBI took steps 

to control use, and then started issuing guidance, creating a data 

bank, and so forth. 

But even now the FBI resists any process for outside review. 

Even though they had this abysmal record following on them, they 

don’t want any outside approval. One article likens this to the 

stereotypical male driver who has circled the same block four 

times, but still stubbornly refuses to ask anyone for directions. My 

wife would like that one. 

Now, haven’t we seen enough from these IG reports? Though the 

FBI can’t effectively check it’s own use of this very powerful authority, do we have to wait for more years, and documents, and so 

on or should Congress require approval of the NSLs outside of the 

FBI? Who should be the reviewing authority? Should we have judicial review? You have differing views. 

Mr. Baker, let me begin with you, then go to Mr. Nojeim, then 

Mr. Woods. 

Mr. BAKER. Thank you, Mr. Chairman. Yes. I mean, I subscribe 

to the notion that it’s appropriate to have review of metadata collection tools, whatever legal tool Congress ends up approving outside of the FBI. I think it’s appropriate. I think it works well when 

you think about it in the criminal context or the grand jury process 

where the FBI agents need to go—must go—to a Federal prosecutor to obtain approval to issue the grand jury subpoena so 

there’s an outside check on what happens before the document goes 

15

out that results in the collection of the information. So, I think 

that’s very appropriate. 

I think that system has worked well with respect to grand juries. 

The difficult thing for the Committee is to try to calibrate what it 

does with respect to what the effect is. So the higher you ratchet 

up the approval levels, if you indeed require the FBI to go to a 

court in addition to a Justice Department attorney, it’s just going 

to make it that much more difficult and that much more time-consuming to obtain the information. It will be something that discourages the FBI from actually trying to pursue those. 

Now, some people say that’s a good idea, we don’t want them to 

do all these NSLs. But the volume, as you can see, of the number 

of NSLs is so huge and the time pressure is so great, that we need 

to have something that’s—

Chairman LEAHY. But even now they’re not even going to the 

U.S. Attorney. 

Mr. BAKER. No, I agree. But with the NSLs, they just do it internally. It goes to the SAC, Special Attorney in Charge. 

Chairman LEAHY. But you would not support judicial review because of the volume? 

Mr. BAKER. For much of the information, I think judicial review 

is too much. I concede and think it would be a good idea if Congress wanted to carve out a certain set of records—tax return 

records, firearms records, educational records, the sort of things 

that are listed in the current 215—out and say, if you’re going to 

have this category of material you have to go to the court. But for 

the transaction, for much of the transactional data, again, I agree 

with Mr. Woods, we need to be very careful. It needs to be carefully 

calibrated. You need to think about what categories you want to 

carve out and make sure they’re really important. 

Chairman LEAHY. Mr. Nojeim? 

Mr. NOJEIM. That is exactly what the Feingold bill does. It carves 

out the more sensitive information and says for that tax return 

that was given to the bank so a person can get a loan, for e-mail 

‘‘to’’/‘‘from’’ information, you’ve got to go to a court first. It’s not 

good enough for the FBI to check itself. 

Let me just say a word about the checks and balances that we’re 

calling for. One doesn’t normally think of a person in the executive 

branch charged with being a prosecutor or protecting national security as being the person who provides the check and the balance. 

It’s the judge who has to provide that check and the balance. That’s 

their role in our system. It’s just not the proper role of prosecutors 

to be actually charged with that. They can certainly help, but a 

true check has to be judicial. 

Chairman LEAHY. And Mr. Woods? 

Mr. WOODS. I guess I would agree with the idea that there needs 

to be judicial review available, but I would focus directly on the 

calibration. I would draw the analogy to the grand jury. The former 

prosecutors on the Committee know that, as a prosecutor, you 

might issue hundreds of grand jury subpoenas. Now, the possibility 

of judicial review is there, but it’s the prior approval of the court, 

and in most instances in the Federal system, prior approval of a 

grand jury is not something that is required. I think we have to 

shift toward that analysis. 

16

Chairman LEAHY. Of course, in the grand jury the prosecutor 

eventually is going to have to answer to the court how he collected 

the evidence. 

Mr. WOODS. Exactly. 

Chairman LEAHY. They’re not going to say, OK, on every one of 

these subpoenas you have to have a witness come in, but at some 

point they’re going to say, it appears you overreached, or you 

didn’t. Is that not correct? 

Mr. WOODS. That is correct. But I think that one of the things 

we’ll certainly end up discussing here is the very fundamental distinction between the collection of intelligence and criminal investigations. I mean, Congress and the executive branch have struggled with the oversight of these activities for a long time because 

that public accounting is not present in the intelligence world. 

Chairman LEAHY. Thank you. 

Senator Specter? 

Senator SPECTER. Thank you, Mr. Chairman. 

Mr. Baker, in my opening statement I referred to a situation 

where the FBI had been twice turned down by the FISA court on 

a request for a Section 215 order for business records and they 

then used a national security letter. I am advised, further, that at 

the time you were head of the Office of Intelligence, Policy & Review in the Department of Justice and that you advised the FBI 

that they ought not to use a national security letter in that context. 

Is all of that true? 

Mr. BAKER. It is true, Senator, that I was head of the Office of 

Intelligence & Policy Review at that time. Senator, I don’t recall, 

sitting here today, giving that advice with respect to NSLs. 

Senator SPECTER. Do you recall the situation where the FBI had 

twice been turned down by the FISA court for a Section 215 order? 

Mr. BAKER. I remember the case in general, Senator. I would just 

comment, just as a point of clarification—and I can talk more about 

how the FISA process works—but it was—

Senator SPECTER. Well, I don’t have much time. There was such 

a case. Then the FBI did use a national security letter in that situation? 

Mr. BAKER. With respect to that investigation, yes. 

Senator SPECTER. Well, that’s pretty blatantly wrong, isn’t it, Mr. 

Baker? 

Mr. BAKER. Well, technically speaking, under the law they were 

authorized to do it. Now, that doesn’t mean necessarily that it was 

a good idea to do it with respect to the facts that are here in this 

case. 

Senator SPECTER. Well, did the court turn it down because there 

was a First Amendment issue? 

Mr. BAKER. My understanding is that the court did not officially 

turn it down. There was a back-and-forth between the government 

on a number of—

Senator SPECTER. OK. But the court didn’t grant it? 

Mr. BAKER. I beg your pardon? 

Senator SPECTER. The court didn’t grant it. 

Mr. BAKER. I’m sorry. I didn’t—

Senator SPECTER. The court didn’t authorize the order? 

Mr. BAKER. No, it did not, sir. 

17

Senator SPECTER. OK. Well, with 5 minutes of talk, that’s 

enough on this issue. To me it’s pretty plain that the FBI is circumventing the court, which had it twice before it. It wasn’t granted. 

That’s the critical aspect. 

Let me move to you, Mr. Nojeim. You call for ‘‘specific and 

articulatable facts’’ for NSLs. Others have contended that the relevance standard is sufficient. Isn’t a standard of relevance, which 

is not even reviewed by an attorney, highly subjective and highly 

questionable just on the say-so of an FBI agent? 

Mr. NOJEIM. It is. It is. One of the problems with a relevance 

standard—

Senator SPECTER. Would it slow down the process to make it impractical if your standard of a specific and articulatable facts 

standard were to be required? 

Mr. NOJEIM. No, I don’t think so. The FBI guidance actually requires agents now to articulate the reasons why they believe that 

the information sought is relevant to the investigation. 

Senator SPECTER. Mr. Woods, what do you think about a ‘‘specific 

and articulable facts’’ standard for NSLs? 

Mr. WOODS. I think it’s inappropriate. 

Senator SPECTER. You think what? 

Mr. WOODS. I think it’s inappropriate. I believe it’s inappropriate 

because it was the standard prior to the PATRIOT Act. It did slow 

the process prior to the PATRIOT Act and it did make these tools 

far less available. 

Senator SPECTER. Well, was it a good process? Just being part of 

the PATRIOT Act doesn’t speak to its value, speak to its appropriateness. 

Mr. WOODS. As I’ve outlined in my written testimony, it was a 

process and a standard that worked very well in the traditional 

counterintelligence cases of the FBI in chasing spies, in cases 

where you make fairly common investigative links from known 

agents out to their associates, et cetera. 

It did not work very well in the kind of inchoate threat situations 

that we were encountering in terrorism where you don’t have a lot 

of facts about the individual, therefore you don’t have specific facts 

about the person to whom you are trying to connect. This is where 

that standard started to break down in the 1990’s, and it’s why the 

FBI asked for it to be changed. 

Senator SPECTER. Mr. Woods, what do you think of Judge 

Posner’s argument, which was made again in March of 2007 in the 

Wall Street Journal that the FBI, really, institutionally, is not the 

best agency to handle this, going again and looking to the idea of 

a United States Mi–5. What do you think of that? 

Mr. WOODS. I’ve never been in favor of that. I disagree with 

Judge Posner on that, and some other things. 

I actually think it is a good—I mean, the critics like Judge 

Posner say that it’s the FBI’s investigative criminal orientation 

that slows down the intelligence gathering process. I think that if 

you’re going to have anyone do domestic intelligence collection, and 

I think someone needs to, it ought to be people who are steeped in 

the criminal process, in the constitutional process rather than the 

kind of people we have collecting foreign intelligence, for example, 

who lack that background. 

18

Senator SPECTER. Thank you very much. 

Thank you, Mr. Chairman. 

Chairman LEAHY. Thank you, Senator Specter. 

Senator Feingold? 

Senator FEINGOLD. Thank you, Mr. Chairman. 

Mr. Baker and Mr. Woods, according to the Inspector General’s 

reports the FBI uploads information it obtains through NSLs into 

numerous data bases that are widely accessible to tens of thousands of personnel at the FBI and other agencies. 

I’d like to ask you both, should all this information be retained 

indefinitely, and what type of limit should the FBI be required to 

impose on the type of information it retains and the length of time 

it is kept? 

Mr. Baker? 

Mr. BAKER. Well, as I have said in my written statement, Senator Feingold, I think there should be rules. There need to be minimization rules. As your bill would require for national security letters, I would urge you to require it for all types of metadata. It’s 

something that Congress needs to worry about, not just with respect to the fruits of the national security letters, but with respect 

to all the types of data from all the different tools that the government uses to collect metadata, including grand jury subpoenas, pen 

register trap and trace orders, all kinds of things. 

That said, with respect to destruction, I do say in my statement 

that I think, if you’re going to allow the government to collect a lot 

of data on the front end, you need to minimize the retention and 

dissemination, and at some point in time it needs to be destroyed. 

Senator FEINGOLD. Well, the FBI would probably argue that you 

can never predict when the information might be useful. Based on 

your government experience, how quickly does the utility of this 

type of information as actionable intelligence start to decrease? I 

realize you can’t say an absolute answer, but what is your sense 

as a professional in this area? 

Mr. BAKER. If you’re trying to get actionable intelligence which 

will allow you to actually do something to stop a threat, stop a spy, 

it starts to dwindle relatively quickly. So what I suggest in my testimony is a pretty long time period, which is 5 years, destruction 

after 5 years. 

You can come up with examples where 10, 15, 20 years would 

reveal something about someone, but it is—I don’t know how you 

want to say it, but it’s a slope that drops pretty quickly, Senator. 

So I think definitely after 5 years, and at some point even before 

that it drops off quickly. 

Senator FEINGOLD. Thank you, Mr. Baker. 

Your response to this issue, Mr. Woods? 

Mr. WOODS. I think, definitely, there needs to be a mechanism 

for governing the retention of this information. The national security letter statutes were developed kind of quickly. They’ve been ignored and in a corner for most of their life. It’s really a mistake 

that these statutes didn’t have something like this from the beginning. And I would agree with Mr. Baker. I think for a model we 

would look at other things, the retention rules that we put in the 

Attorney General guidelines, the retention rules that are in the 

19

DoD guidelines. There should be that kind of review to eliminate 

retention as quickly as possible. 

Senator FEINGOLD. Based on those responses, I’d like to ask each 

of the witnesses if you could give a ‘‘yes’’ or ‘‘no’’ answer. Is it safe 

to assume that all the witnesses support the provision of the NSL 

Reform Act mandating that the FBI issue minimization and retention procedures for NSLs? 

Mr. Baker? 

Mr. BAKER. Yes, I do. But I would also suggest that you should 

worry about acquisition, minimization at the stage of acquisition. 

Don’t get more than you really need for the purpose that you’re 

searching for it. 

Senator FEINGOLD. Mr. Nojeim? 

Mr. NOJEIM. Yes, I agree. 

Senator FEINGOLD. OK. 

Mr. Woods? 

Mr. WOODS. Yes, I agree, too. 

Senator FEINGOLD. And I want to thank the Ranking Member for 

raising the issue of the relevance standard, which I consider, of 

course, to be woefully inadequate to protect the privacy of Americans who have done nothing wrong. I believe that the specific and 

articulable facts standard is an appropriate standard, but we will 

certainly work on this legislation to make sure that the government can get what it needs, but not go too far. 

I do think that the relevance standard is not adequate, and as 

Senator Specter said, the mere fact that it was put in as a change 

in the PATRIOT Act is not to me, a recommendation. It is actually 

a sign that it might not have been looked at closely enough, because that’s my view of the whole legislation. 

Mr. Nojeim, the most recent Inspector General report indicated 

that the percentage of NSL requests generated in the course of investigations of U.S. persons has increased steadily in the past several years, from 39 percent in 2003 to 57 percent in 2006. Is this 

cause for concern? 

Mr. NOJEIM. Yes, it is. I think that you can trace that increase 

to the PATRIOT Act itself, which eliminated the requirement that 

the records pertain to an agent or a foreign power. Most Americans 

don’t fit that description. 

Senator FEINGOLD. And also, Mr. Nojeim, the FBI conducted its 

own internal review of 10 percent of all NSLs issued from 2003 to 

2006. According to the most recent Inspector General report, the 

FBI’s review found more than 550 instances in which the FBI received records it had not requested in response to an NSL, yet out 

of those hundreds of incidents only four times did the FBI realize 

that this violation had occurred. That’s less than 1 percent. The IG 

report also stated that at least some of this unlawfully obtained information was uploaded into an FBI data base that is shared more 

widely with the intelligence community. What does that tell us 

about the extent to which these data bases may contain unlawfully 

obtained information? 

Mr. NOJEIM. It suggests that there could be a big, big problem. 

We won’t know what information in the data base was lawfully obtained and what information wasn’t. It’s not tagged, so you just 

won’t know. 

20

Senator FEINGOLD. Thanks to all the witnesses. 

Thank you, Mr. Chairman. 

Senator WHITEHOUSE. Thank you. 

I believe Senator Sessions is next in order. 

Senator SESSIONS. Well, I think the FBI deserves criticism for 

not managing this program well, not following strictly the guidelines and accounting correctly in the beginning. Wouldn’t you 

agree, Mr. Woods? 

Mr. WOODS. Yes, I would. 

Senator SESSIONS. And Mr. Mueller came here and promised to 

do better, and the OIG report indicates that they have done better 

and fixed the problem in recent months. Is that correct? 

Mr. WOODS. That’s the testimony. 

Senator SESSIONS. I think we heard—we know what happened. 

We saw the Director in here. This oversight Committee, which has 

the responsibility to make sure this program is going right, we 

grilled Mr. Mueller, we made him promise to do better, and he’s 

done better. 

Now, let me ask you this, Mr. Woods. Isn’t it true that a DEA 

agent investigating an American citizen can issue a subpoena for 

some person’s telephone toll records if he thinks it’s relevant to a 

drug-dealing operation? 

Mr. WOODS. That is absolutely true. 

Senator SESSIONS. And IRS can get your bank records if they 

think you may be cheating on your income tax. 

Mr. WOODS. That’s correct. There are actually over 300 Federal 

agencies that have administrative subpoena authority that is based 

on the relevance standard. 

Senator SESSIONS. And Mr. Nojeim, forgive me if I object, but I 

do not believe, and strongly reject the idea that we ought to give 

greater protection to terrorists and spies than we give to drug dealers and tax cheats. I just do not believe that’s accurate, and fundamentally that is what I understood you to be saying. 

Mr. NOJEIM. What I have said, Senator, is that intelligence investigations are different. If you’re conducting a criminal investigation of a terrorist who may have committed a crime or a spy who 

may have committed espionage, which is a crime, the same rules 

apply. What we’re talking about is a different kind of investigation, 

one untethered from a criminal charge or from criminal suspicion. 

Senator SESSIONS. Well, OK. Now, Senator Specter asked the 

question about specific and articulable facts, shouldn’t that be the 

standard. Well, Mr. Woods, isn’t it true that DEA doesn’t have to 

quote articulable facts to get your telephone toll records? 

Mr. WOODS. That’s correct. 

Senator SESSIONS. Or the bank records. 

Mr. WOODS. No. These—

Senator SESSIONS. Or your motel records. 

Mr. WOODS. All of these transactional records are basically available in the other context, criminal, administrative subpoenas, on 

relevance to the investigation, Senator. 

Senator SESSIONS. So we absolutely ought not to be adding greater difficulties for investigators investigating a life-and-death situation, perhaps, than we do for drug dealers. And let’s make this 

clear, Mr. Baker. You’re a lawyer, and all of this. But the reason 

21

is, these are not the individual’s records. These are records in the 

possession of a third party. They have a diminished right of privacy 

in those records because they’re not their records. You can’t subpoena an individual’s home computer. You can’t subpoena their 

personal records and obtain those records without a warrant, if 

they object. But you can subpoena records at the Office of Motor 

Vehicles, at the telephone records or bank records, right? 

Mr. WOODS. That’s correct. The Fourth Amendment protects 

things with respect to which you have an expectation of privacy, 

and the type of things we’re talking about today, the transactional 

data, is not protected by the Fourth Amendment. 

Senator SESSIONS. And every day in America, Mr. Woods, every 

county attorney in America investigating any kind of misdemeanor 

or offense that wants records can issue a subpoena based on the 

standard of relevance to that investigation in every State in America that I know of. Would you agree? 

Mr. WOODS. Yes, I would. 

Senator SESSIONS. And since time immemorial, that’s been the 

standard that prosecutors have used. 

Mr. WOODS. Yes. 

Senator SESSIONS. And how we’re in this deal where we want to 

put more standards, more burdens on people who are trying to protect the American people from an attack is beyond my comprehension, and I’d object to it. 

Let me ask this, Mr. Woods. Let’s say you’re investigating a person that you think may be connected to—you have some indication 

they may be connected to Al Qaeda and you issue a subpoena on 

the relevance to the investigation and get those telephone toll 

records. You see a lot of other calls to someone else and you want 

to now subpoena that person’s records to see if they may have—

see what connections those phone numbers show. 

Now, in this context there may not be anything. It may be a perfectly innocent series of phone records you receive. But isn’t it possible, and isn’t it what we pay our investigators to do, if lo and behold there’s a call to some known Al Qaeda number in Iraq or Afghanistan? Isn’t that what we’re about? 

Mr. WOODS. Well, yes. I mean, that’s the goal of these investigations, along with the goal of eliminating the people who are not, 

which is another function of these types of legal authorities. 

Senator SESSIONS. Well, I don’t know if somebody got my 

phone—my time is up. We also need to be sure that the information we’re obtaining is not the power to listen in on these phone 

calls, but it’s just simply the telephone toll records that show where 

that person may have called in the past. Is that correct? 

Mr. WOODS. That is correct. These national security letters do 

not get content of phone conversations or e-mail content. 

Senator SESSIONS. And I would point out that we tightened these 

standards when we reauthorized the PATRIOT Act. I didn’t think 

they needed to be tightened, but we tightened them, all to make 

sure that spies and terrorists have their full rights—in fact, more 

rights than we give the drug dealers in America. 

Senator WHITEHOUSE. Senator Kyl? While I am chairing, I am 

going to be the last person here, I’m very happy to have you go 

22

ahead, if you would like to. I’d be happy to defer to you at this 

point. 

Senator KYL. I am going to be here for a while, so please go 

ahead. 

Senator WHITEHOUSE. Thank you. 

This is, I think, a very, very interesting question that we have 

and it’s a very interesting hearing. I see it in a slightly different 

context than Senator Sessions does, although we share the experience of both having been prosecutors and U.S. Attorneys. 

It strikes me that there is a privacy interest that is raised that 

is separate from the privacy interest or value of a particular piece 

of data once you start to multiply and aggregate it into an enormous pool of data. It’s something we don’t have much guidance on 

from the Constitution, because at the time the Constitution was 

written the way an investigation worked was, the marshall or the 

sheriff came to your house, seized whatever evidence was necessary, brought it before the prosecutor or the magistrate, whoever, 

and when it was done, whether it was a bloody axe, a contract document, or whatever, it was either contraband, in which case it was 

destroyed, or it was of no value, in which case it was discarded, or 

it was returned and that was the end of that. 

Then along comes the Xerox machine. Now documents start to 

live on in the files of government agencies. Fortunately—or unfortunately—they are paper files. They’re very hard to go back and 

search. 

So while they’re still there for somebody who remembers, you 

know, in the so and so investigation I think we did this, let’s go 

back and see what we found when we searched Joe Smith’s house, 

we still have that in that file in this paper record, it’s not a very 

live record. 

Now, electronically we can not only preserve it, but we can aggregate it and we can maintain it indefinitely, and we can build, 

in theory, a massive consolidated data base of all of this information that people could plow through at will. 

I do think, despite the fact that none of those individual pieces 

of data might rise over Fourth Amendment levels, it does raise a 

new question that we as a society need to address. So I would ask 

you to comment a little bit on those thoughts, and in particular the 

sort of nexus or matrix between the intensity of the privacy value 

of a particular piece of data that is sought versus the intensity of 

the investigation itself. 

I am not sure whether I would be more concerned as a citizen 

about my privacy if the government said, look, I want 1 year’s tax 

records for this one purpose or if they said, every phone call you 

have ever made, we are going to track who you made it to, when 

you made it, when it ended, and we’re going to share it with all 

people who are interested. 

The privacy balance, I just think isn’t that easy, yet it’s hard to 

measure that intensity of government investigation component. It’s 

so much easier when the document itself is the trigger. How would 

you recommend—do you have thoughts on how you’d recommend 

we cope with that concern? And I’ll followup further. 

Mr. BAKER. Senator, at the end of my written statement I have 

a statement in there about, as time goes by—you’re exactly right—

23

and our data collection capabilities increase, every human endeavor 

that can be reduced to a digital form will be collected by someone 

for some purpose, either commercially or for intelligence purposes 

or law enforcement. That’s the direction we’re heading in. These do 

become extremely powerful tools. They’re powerful tools to protect 

the country. They’re powerful tools that, when you have an urgent 

situation, you can go into a data base, you can search through, you 

can look for connections. 

Senator WHITEHOUSE. And they’re valuable tools. They’re important tools, I think we all agree. 

Mr. BAKER. Right. Extremely valuable. 

Senator WHITEHOUSE. But they still need some—

Mr. BAKER. They need oversight. They need oversight and they 

need minimization. They need oversight by people. We can have all 

of our technology, we can have all of our systems, we can have all 

of our laws, quite frankly, but at a certain point in time the people 

matter. 

For example, it mattered that Glen Fine was Inspector General 

at the Department of Justice at the time that you ordered a review 

of these things. I’ve worked with Glen closely and he’s a very tenacious, intelligent, hard-working person. It mattered who he was. So 

you really have to make sure you have the right people in those 

jobs, doing the right thing. 

At a certain point—I know time is almost up—you are right, I 

think, to focus on the Fourth Amendment issues. At a certain point 

in time, when the government’s knowledge about our activities becomes so pervasive, that may, in fact, raise Fourth Amendment 

concerns. I think it’s something that we’re going to be struggling 

with. 

Senator WHITEHOUSE. Let me interrupt you now, because my 

time has expired and I do have plenty of time with you once Senator Kyl has a chance to ask his questions, and yield to the distinguished Senator. 

Senator KYL. Thank you very much. I think we all agree that, 

over time, the challenge presented by the acquisition of this transactional information is going to require us to develop new regimes 

or protocols of dealing with it. 

What I’d like to do, especially with regard to how long you keep 

it, I do suspect that the last thing government agencies are going 

to want are roomfuls of data that they can’t do anything with because they’re simply too massive. 

But what I’d like to do here is focus just a little bit on how this 

process actually works, the typical situation, because it gets to the 

standard that we’re debating here and the reason why we went to 

a relevance standard. 

This is transactional information about which the individuals 

had no expectation of privacy. Mr. Woods, you had experience in 

actually doing this and actually supervising it. Give us an example 

of how it worked. I’m specifically interested in why it’s different in 

the context of preventing a crime from being committed, a terrorist 

act, as opposed to investigating a crime that has been committed. 

Mr. WOODS. OK. I think that probably the best example is the 

sort of classic terrorist threat scenario that we run into a lot these 

days, where there is information, perhaps from foreign intelligence, 

24

which indicates maybe a particular target or a particular city or a 

particular—there’s been a foreign communication that is suspect. 

We don’t know who made the communication, but it has enough 

characteristics that we’re concerned about it and it says something 

about Washington, DC. 

This is thrown to the FBI in a proactive mode. What can the FBI 

do? Well, the FBI could say—say it’s sort of an e-mail, or the FBI 

might want to look at other e-mails that had connected to the same 

source, maybe it’s from an internet cafe or something like that, and 

just do a quick scan to see, is this point of communication been in 

contact with anybody else that we know about, anything that 

might give us a lead? That transactional information about those 

communications is certainly relevant to the threat. It would be, I 

think, impossible in those situations to make out a specific and 

articulable facts case. 

We don’t know who the person on the other end of the communication is. We don’t know for sure that they’re an agent of a foreign power. It becomes very gray and circumstantial. We could 

spend a lot of time trying to work with that standard. That’s kind 

of—I mean, that is why we asked, in the Bureau, for the relevance 

standard. There are situations where, you know, when the FBI is 

being mandated to be proactive and to depart from the investigative model, it’s encountering these situations that don’t fall into 

line with the standard that was designed for an investigative 

model. It is more dangerous. It is more risky in terms of civil liberties, but it is, in my view, what needs to be done now. 

I would focus, therefore, more on the oversight, retention, and 

minimization end of this than on the legal standard itself. 

Senator KYL. Now, that is the precise thing that I think we need 

to focus on. Why would you do that? Why would you want to retain 

the relevancy standard rather than going back to the articulable 

facts standard that we discussed earlier? Why would minimization 

procedures or other oversight be a better answer to the privacy concerns? 

Mr. WOODS. Well, I think the standard itself, the scenario that 

I laid out, I think is going to become more and more common. 

We’re going to need to assess threats quickly. We’re going to need 

to respond to them quickly. But by their very nature, many of them 

are going to fall into the sort of fuzzy environment that the relevance standard is far better for. I mean, there’s a reason why it’s 

the standard for criminal investigations. This is how you quickly 

figure out what’s going on. 

I do think, though, where the system is breaking down is, once 

that’s done, once that information is collected, how long do we keep 

it? What impulse is there for the government to sort through that? 

If I might, just one sort of side issue on this. The government—the 

FBI and other agencies—are facing two pressures. I mean, one is, 

get out there in front of the threats. 

The other pressure is, share information. These data bases didn’t 

exist when I was first in the FBI. They exist now because of our 

examination of the failure of information sharing prior to 9/11. So 

I think with those two things together, you need to reinvigorate the 

rules on minimization and retention. They were never added to national security letter statutes in the first place. All these things 

25

came into existence without those, very unlike, say, FISA or criminal statutes in that regard. But that is why I would focus the attention there. 

Senator WHITEHOUSE. Senator, can I just followup on that? Since 

it’s down to just the two of us, we can be off the clock. 

Senator KYL. Sure. That’s fine. Go on, please. Senator Feingold 

might object to that now, but it’s fine with me. 

Senator WHITEHOUSE. Continue as long as you please, though. 

Senator KYL. No. Let’s just go ahead and have others respond to 

that if they like, and then a final comment. That will be fine. 

Mr. NOJEIM. Mr. Woods has made a good case for the relevance 

standard, but the problem that we see with it is that it really 

doesn’t have a good articulable end. 

Say, for example, the threat information that is received is that 

there’s a terrorist in Washington, DC. What information is relevant 

to investigating that threat? Is information about everyone who is 

staying at a hotel in Washington relevant? Is information about everyone who rented a car in Washington relevant? It just seems like 

there’s no end. 

Once you decide that information about who that person has 

communicated with is relevant, is information about who they communicated with also relevant, and so on, and so forth? So I guess 

the problem with the relevance standard is that it seems to 

untethered in that when we’re talking about an intelligence investigation that is, again, not tied to the investigation of a particular 

crime, it seems like there’s just no end to the information that 

could be obtained. 

Senator KYL. I appreciate that point. But it seems to me that it, 

in some respects, ignores realities of life. That is, you’ve got some 

people who we have a lot of confidence in, we’ve given a great deal 

of authority to, to protect us from terrorism. We have put them 

into that position and they’re in real-time situations trying to sort 

through a lot of material to be able to track something to get to 

the point where they can maybe stop a terrorist act from occurring. 

They don’t have time in that context, it seems to me, to sit 

around saying, oh, look at this juicy bit of information, let’s set that 

aside and maybe we can deal with that later and really embarrass 

this political figure, or why don’t we stop what we’re doing here 

and gather up all this information for some other purpose? 

I mean, they’re on the tail of something, they’re trying to get 

through it quickly. It seems to me that the problem is really quite 

the other way, and that is to be able to barrel through a whole of 

information as quickly as possible and not go back to what they 

just went through because it’s of no immediate use to them, and 

they’ve simply got too much work to do to figure out what the terrorist attack might be to sit around and focus on all that. 

So I think that the realities, the practical realities don’t suggest 

that the problem is a likely big problem. I think, though, that ultimately there’s got to be some decision made about, OK, now that’s 

over did all of that stuff get captured someplace or did we simply 

go through it and it’s simply out there in the ether again? To the 

extent we did make a record of some of it, what should be done 

with it? 

26

I mean, I can see why privacy concerns there would require some 

mitigation or some procedures and protocols and so on. But during 

the process of trying to prevent the crime or the terrorist act itself, 

it seems to me that the broader standard giving them more flexibility and leeway to protect us is the appropriate way to approach 

it. That’s my own point of view which I believe is pretty consistent 

with Mr. Woods’. 

Senator WHITEHOUSE. The Senator from Wisconsin? 

Senator FEINGOLD. Thank you, Mr. Chairman. 

Let me briefly respond to what Senator Sessions, and to some extent Senator Kyl, said about the standard for getting an NSL. Senator Sessions mentioned grand jury subpoenas, which of course are 

to investigate crimes. 

I believe that Congress should change the current relevance 

standard for NSLs. Intelligence investigations are not, as has been 

pointed out, subject to the same built-in checks that are present in 

criminal investigations. They are much broader, meaning that virtually anything could be relevant to an intelligence investigation. 

They are conducted entirely in secret. Investigative techniques are 

rarely tested through the adversary judicial process. I think that 

is why more oversight is needed, and that is why a more targeted 

standard is needed for the NSL authority. 

So in that connection I would like to ask Mr. Nojeim, we have 

heard a proposal today for a new national security subpoena authority. Would you please address your thoughts on that proposal? 

Mr. NOJEIM. I think that if the response to the Inspector General’s reports is that there be a broader collection device—and 

that’s what these subpoenas would be—that it’s exactly the wrong 

response. 

It’s not clear to me who could receive one of these subpoenas. It 

does seem to me that they could be received by anyone as opposed 

to just the limited entities that are now possible recipients of national security letters. 

There was no discussion about the gag that would come with one 

of these subpoenas. I put those two together because I think about 

who might be a recipient. What we’re talking about is expanding 

the class of people who might receive a demand from the FBI for 

information, but, the demand says that they can’t disclose anything 

about that demand. 

It could be served on any person. I just don’t know how my mom 

would respond to that request. I don’t know how other people 

would respond to that request. I don’t think that we should go in 

that direction as a result of the abuses that have been uncovered 

in the IG reports. 

Senator FEINGOLD. I couldn’t agree with you more. I can’t imagine how granting the FBI administrative subpoena authority is a 

response to evidence of abuse of their current authority. We just 

barely dodged this bullet in the last round. For this to be a response to what we learned about the NSLs strikes me as kind of 

bizarre. 

Mr. Nojeim, two Supreme Court decisions in the 1970s determined that Americans do not have Fourth Amendment rights to information they reveal to their phone companies or banks, such as 

the phone numbers they dial or the checks they write. 

27

Given the unprecedented technological advances of the past 30 

years, do you think these decisions would come out the same way 

again today? 

Mr. NOJEIM. I think they’re on shaky ground today. Take Smith

v. Maryland, for example. That’s the decision where the court decided that numbers dialed on a telephone didn’t have Fourth 

Amendment protection. They reached that decision in part because 

those numbers dialed are not so revealing. The court said, for example, you can’t even tell whether the telephone call was actually 

completed. You can’t tell who was communicated with when those 

numbers were dialed. 

Fast forward to today and think about the kinds of information 

that qualify as metadata, but that are much more revealing. E-mail 

‘‘to’’/‘‘from’’ information. It’s usually the case that you know who 

you’re communicating with and the government will know when it 

gets that information. It knows the communication actually happened. So right there, it’s much more revealing. 

URL information—where a person went on the Internet. The 

closest parallel to that is probably library sign-out records, and 

most States protect those and require extra procedures. Yet, in the 

internet context, URL information, at least before the first 

backslash, is available with a national security letter. 

Senator FEINGOLD. I commend all the witnesses for their testimony today. Mr. Nojeim, I particularly commend you for your ability today to distinguish not simply between metadata and content, 

but to point out that within the context of metadata there really 

need to be distinctions. It’s not simply one kind of information or 

another, there are vast differences. You’ve done an excellent job of 

pointing out the dangers of not having those kind of distinctions 

within the metadata category. 

Thank you, Mr. Chairman. 

Senator WHITEHOUSE. Thank you. 

I will sort of pick up where I left off, because I find this subject 

so intriguing. I think it’s our next really big civil liberties issue to 

address. Does anyone dispute that it is essentially inevitable that, 

given the way we can electronically gather and store data, government data bases containing personal information are going to continue to proliferate and that, given the ease with which access to 

different electronic data bases can be increasingly achieved, there 

will be more and more access points for government agencies to 

those data bases? Are we not, to some degree, headed for a situation in which there is essentially a large, multi-accessed, multiinputted, but essentially single government data base containing a 

vast amount of personal data related to American citizens? 

Mr. BAKER. Senator, there may be a number of reasons you 

wouldn’t want to create one data base, but you could have data 

bases that are linked in certain ways. 

Senator WHITEHOUSE. Linkage makes it effectively the same, I 

think. 

Mr. BAKER. It would allow you, with certain tools, to go through 

the different data bases. If your query fit the criteria for going into 

a data base, you could come up with some kind of a model to do 

that. So, I think that’s right. 

28

If I could just quickly respond to something that Senator Feingold said before he left, since it was my sort of bizarre idea to come 

up with this national security subpoena. Just, I want to be clear, 

and when Senator Kyl was talking about the different standards 

that apply, you can have relevance, you can have specific and 

articulable facts, you can have probable cause, but relevance, specific and articulable facts as to what? As to what? You have a twofold task in front of you. You have to pick the right standard, the 

right predication, how much facts you want to support it, but then 

as to what? You need to think about that. 

My concern is, and the reason I came up with this bizarre idea—

other people have too—is that if you raise the standard with respect to national security letters so high, FBI agents in the field 

will find some other way to get what they need because they are 

charged with, and have tremendous pressure on them, to prevent 

the next attack, as we all know. 

So if national security letters are too difficult, well, let’s see if we 

can find something else. 215? Oh, you’ve got to go to a judge. That’s 

a pain in the neck; forget that. Oh. Grand jury subpoena? I’ll just 

go to this AUSA that I work with all the time, we’ll get that, and 

there’s no court oversight in the real-time sense and you just get 

it from the AUSA. There’s no minimization requirements. Boom, 

we’ve got it. 

We’ve got the information that I believe I, the agent, need to protect the country and I’m not going to mess with these other statutes. So the volume will drop with respect to national security letters, it will be a less effective tool, but your insight into what is 

going on—your, the Congress’ insight—the government’s insight 

will just change. It will be harder to conduct oversight of those 

kinds of activities, and I urge that you worry about that. 

Senator WHITEHOUSE. I understand that. But I think, in addition 

to the question you have raised of the ‘‘how do you get it’’ problem, 

we also have to address the ‘‘what do you with it’’ problem, which 

I think, as those of us familiar with this area—we would generally 

categorize that as the minimization problem. So you’ve got the 

‘‘how do you get it’’ problem, then once you’ve got it, what do you 

do with it, how long can you keep it, do you destroy it, who can 

you connect to it, all that sort of stuff. 

Then you have, as you mentioned, the predication problem, 

which is, who is allowed to query it. Who’s allowed to hit the data 

base and under what circumstances? Is strikes me that if we’re 

going to solve this problem we have to address really all of those 

three issues, that those are the three big prongs of this question 

from the government’s point of view: what are you allowed to get, 

what are you allowed to do with it once you get it, and who are 

you allowed to let have a look at it, and on what terms? 

Mr. NOJEIM. And to add just a couple more things. Not just what 

can you get, but what do you have to show to get it, and also what 

do you do with it after a few years? I mean, do you just throw it 

away or do you save it to see whether it might be useful in some 

other investigation 10 decades from now? I think that your—

Senator WHITEHOUSE. And minimization, I think, has become a 

hugely moving target. In my days as a U.S. Attorney, minimization 

basically meant that the agent flipped off the switch on the microVerDate 0ct 09 2002 14:52 May 27, 2008 Jkt 042457 PO 00000 Frm 00032 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\42457.TXT SJUD1 PsN: CMORC
29

phone and stopped listening when it became apparent that the conversation was with the subject about pork chops for the weekend, 

that he’d called the butcher. Once you learned that this was an 

every Thursday call for Friday dinner, you didn’t listen to it at all 

because you didn’t any longer have a reasonable basis to listen to 

it. It was just kind of that simple. 

Now, particularly in the FISA minimization context, it’s gotten 

much more complex, much more deep in time, and into questions 

of distribution. So the simple ground rules very recently have had 

to adapt to a much more complex landscape, and I’m not sure that 

they’re well understood. 

Yes, Mr. Woods? 

Mr. WOODS. Senator, there is a reason for that. That is—and we 

keep coming back to this matter of intelligence investigations—this 

is fundamentally different than the criminal context in that the adversaries we are facing are different. We are facing intelligence 

services with the full resources and backing of foreign governments. We are facing transnational terrorist groups. 

So FISA minimization, for example, is structured after the fact, 

I think largely because of the language difficulties. You may be 

intercepting something on FISA that’s in a dialect of, choose the 

language, and therefore the Congress allowed that to be done after 

the fact. I think we face the same thing here. To go to your earlier 

comments, it is important to remember that these intelligence investigations are not solely restrained by these statutes. We have 30 

years of oversight, of regulation, of Attorney General guidelines, of 

executive orders. 

The reason I put so much emphasis on retention/minimization 

issues is, over the years that has been the least-glamorous part of 

this work. I would say that minimization rules are stuck in the 

Xerox era, at best. What we need—I mean, minimization in the 

FBI, in my experience, was done with respect to FISA quite carefully, and one of the reasons is that every so often the Justice Department comes by and audits it. There’s nothing like that. We’ve 

had national security letters since 1986. This is the first serious 

audit of how they are being used. I think, going forward, the Committee really ought to look at creating some of that, and at the 

same time maybe look at updating stuff from the Xerox era to 

something a little closer now. 

Senator WHITEHOUSE. I also felt that the minimization process in 

Federal investigations that I oversaw, and at State investigations—

I was a State Attorney General as well—was helped by the prospect that the Rhode Island State Police, local FBI agents, Secret 

Service agents, or ATF agents had that they were operating pursuant to an order allowing them to do this, which incorporated in its 

terms the legal requirement that they follow the minimization procedures, and that there was the prospect that a judge might at 

some point take an interest and say, you know, I signed this order 

and gave you the authority to collect this stuff, I told you you had 

to do it under these terms, I want to have a look. And just the 

prospect, I think, of judicial oversight was very helpful. 

It’s one of the reasons we’ve had this fight on the Foreign Intelligence Surveillance Act, because they put out minimization rules 

but they wouldn’t let it be set up so that the FISA court ever had 

30

the authority to see if they were being complied with, which completely undercut that motivation. I thought that was mistake, and 

thankfully I think we’ve corrected that in the FISA statute. 

Mr. NOJEIM. I think that one of the reasons that we need the 

NSL Reform Act is that it requires that minimization procedures 

be adopted. There was a provision in the reauthorization legislation 

that required the Attorney General and the DNI to study whether 

minimization would be feasible. An NSL working group involving 

both agencies was put together. They recommended basically the 

FISA minimization procedures, but the Attorney General rejected 

that. I think it’s time for you to say, we’re going to have to step 

in and require that these minimization procedures be adopted. 

Senator WHITEHOUSE. A lot of very sensible stuff seems to have 

been rejected for reasons that make absolutely no sense to me. 

Senator Kyl? 

Senator KYL. Well, let me just play off that point. There’s a hierarchy of values here. One, is the protection of the American people 

from known dangerous enemies who have struck us with great destruction. We have instructed others in our government to see that 

that never happens again. Every one of us ought to be strongly 

committed to that. 

Now, we also have the potential prospect of violations of privacy 

that might have an adverse consequence on someone, but I don’t 

think there’s a lot of evidence that that’s happened yet. 

I recall the words of the FBI agent who, about two and a half 

weeks before 9/11, complained to another that, because of the wall 

that separated two groups within the FBI, the Terrorist and Criminal Investigation, that someday somebody was going to get killed 

and then questions would be asked, and of course that’s what happened. 

So on the one hand, we have something that is critical for the 

protection of the American people, and we’ve seen breakdowns in 

that because we set up artificial legal barriers to the exchange of 

information and collection of information. On the other hand, we’re 

all concerned about privacy because we can see in the future, if not 

today, a ballooning of information and access to information, and 

we’re rightly concerned about how that’s all used. 

But I suggest we keep this in perspective, and that enabling the 

people to do the job to protect this starts with, I would argue, a 

lower standard like the relevancy kind of standard. Then in order 

to prevent that other potential from occurring, you can build on it. 

All of you have addressed that in one way or another, and I think 

we’re all in agreement that both of those require work. 

But just another specific example that we fixed, Zacharias 

Mousawi. He didn’t fit into the two ways that you could get information. We couldn’t prove that he was an agent of a foreign power 

or that he belonged to a terrorist organization. They don’t carry 

cards anymore. He was acting on his own in concert, ultimately, 

with another group. So we had to create a third category after the 

fact, unfortunately. 

What it demonstrates is, I think we need to be a little bit more 

liberal on the front end for the purposes of the protection of the 

American people, and then make sure that, whether it’s minimization procedures or other kinds of protocols that ensure the privacy 

31

of the American people, to put those into place. But looking at the 

relative challenges and relative threats and relative harms that 

have occurred so far, it seems that some may be balancing these 

equities, I think, in the wrong way. 

I would hope that as we draw on your expertise—all three of you 

have been very valuable to this exercise today. As we continue to 

draw on your expertise, would you also take into account what I 

am trying to say here? Because as policymakers, we’ve got to take 

all of these things into consideration. It seems to me that—well, 

I’ve made my point. If any of you would like to comment, I still 

have a little bit of green left. 

Mr. Baker? 

Mr. BAKER. Yes, Senator. With respect to the law, I mean, Michael and I both lived through the era of the wall and we can probably go on for quite a bit of time about that. 

But let me just say, that’s why I focused on creating—urging you 

to create—a system that’s simple and effective. One of the lessons 

from the wall was, the rules were complex, the rules were misunderstood, and people were afraid of the adverse consequences to 

their career of making a mistake, so they didn’t do what they 

should have done in certain instances with respect to sharing information. 

I think that’s one of the things you don’t want to have happen 

here. I think with respect to the current regime that we have, as 

reflected in the IG’s report, you do have confusion about what these 

statutes allow: you do have confusion with respect to what the 

scope is, you have confusion about what the standard is. 

So, I think that has contributed to the situation that we find ourselves in today. The only other comment I would make is, the IG’s 

report with respect to national security letters are bad facts. I 

mean, that is a very bad situation. All I would suggest to the Congress, as we all learned in law school, bad cases make bad law. My 

urging is, don’t let that happen. 

Senator KYL. But fix the bad cases. 

Mr. BAKER. Fix the bad cases, but make sure you don’t inadvertently create some other problem. 

Mr. NOJEIM. I think if we can learn one thing from the IG reports, it’s that people who mean well and are in the business of collecting this information didn’t do a good job about following the 

rules. I think there’s just no question about that when you look at 

the Inspector General reports. 

I think there’s also no question that some of the reforms that the 

FBI put in place are going to address some of those problems, but 

the bigger problems can’t be addressed by changing the people who 

do the work or by changing what work they do. There just has to 

be a judicial check at some point in this process when the information is particularly sensitive. Again, the principle that we’re asking 

you to abide by is that the more sensitive information ought to be 

under that judicial check, and that less sensitive identifying information could still be sought without it. 

Senator KYL. A final word, Mr. Woods? 

Mr. WOODS. All right. 

Senator KYL. Again, thank you to all three of you. I appreciate 

it. 

32

Mr. WOODS. I actually agree with what both of the other witnesses have been saying, in principle. I think the committee should 

be guided by a rule of proportion. I mean, I read the IG reports and 

I see errors and ineptitude in the nuts and bolts of this, the kind 

of right documentation here, what should be uploaded, what 

shouldn’t be uploaded. I do not see, as one sometimes hears in the 

discussions, a malevolent presence in the government that is bent 

on subverting people’s civil liberties or obtaining information that 

it should not obtain. 

I think the remedy ought to reflect the reality of what’s in those 

reports, which to me means concentrating a lot of effort on that 

nuts-and-bolts level and not ratcheting up the legal standard that 

affects every case, or attempting to sort of, you know, throw up our 

hands and say, this is scary and we’re going to try to back off, because that affects the 90 percent of the cases that didn’t even have 

these nuts-and-bolts problems in the IG report. That’s what I’ve 

been trying to argue, and I’m happy to assist the Committee, as I’m 

sure my colleagues are. 

Senator WHITEHOUSE. Well, I agree with you that there are two 

very different issues here. One is the very simple, old-fashioned bureaucratic foul-up that took place at the FBI with respect to the 

implementation process for these NSLs, and that is an important 

problem. It’s a problem that we have drilled into, that the Inspector General has drilled into that I think a variety of initiatives will 

help to minimize. But every time we touch on this issue I think it 

raises these larger questions of, really, what the rules are. I don’t 

think we’ve adapted well enough yet to this modern electronic 

world in which there are vast pools of information available. 

I do think that the privacy of American citizens is a core value 

in our society and it’s a core value for a reason because it affects 

the balance of power, if you will, between government and citizenry. In a democracy, that is absolutely vital. So I give it, perhaps, a higher value than some of my colleagues do. 

But wherever you assign its value, I think I agree with the Senator from Arizona’s point, that the American people could feel more 

comfortable about what information is made available to law enforcement if they had a higher level of comfort with what would 

happen to it once law enforcement had its hands on it in terms of 

its duration, maintenance, and all of that, and with what uses it 

would be put to and who would have access to it. 

So I see the question as how you define what the government can 

get access to, how you define what the government can do with it 

once it’s been allowed to get access to it, and how you define who’s 

allowed to query that pool of information which, in a nutshell, are 

access, minimization, and predication, as related phenomena that 

I think this Committee and this Congress are going to have to deal 

with. I think I will ask you for final comments, because we’re nearly done with our time. Your thoughts on how you see those are 

three related, cross-referencing, interwoven concepts. 

Mr. Baker? 

Mr. BAKER. Well, I think you’re exactly right, Senator. If you 

look at old FISA that we’ve been talking about, the original FISA, 

that required minimization of acquisition in terms of, what does 

the government get and why; minimization of retention: once 

33

you’ve gotten it, what do you keep? Do you throw certain things 

away? Who has access to it? What do they do with it? Where do 

they store it? How can they look at it? And then minimization of 

dissemination: Who can they give it to, what purpose can they use 

it for, and so on. 

If you look at the definition of minimization under FISA, I think 

it’s a pretty good one because it says that the Attorney General will 

approve minimization procedures that will be reviewed by the court 

and approved by the court, but that—on the one hand, do all that, 

limit the acquisition, retention, and dissemination of non-relevant, 

non-pertinent U.S. person information, consistent with the need of 

the United States to obtain, produce, and disseminate foreign intelligence information. 

So you’ve got to have the right balance, exactly what you’re saying. You’ve got to have the right access to the right data, at the 

right time, for the right purposes, and to be able to use it effectively for what we all want to accomplish. So I think that is what 

you are focused on. I think that’s exactly right. 

I would just add in, as we discussed earlier, you need to think 

about how long we’re going to keep this stuff. As these data bases 

grow at a certain point in time, what should we be throwing away? 

Stuff that has not been found to be relevant or pertinent to an investigation in the sense that it’s produced a lead that’s really, really good during a 5-year period, should we throw it away at that 

point in time, or what are we going to do with it? 

Senator WHITEHOUSE. Mr. Nojeim? 

Mr. NOJEIM. It seems to me your ability to control some of the 

things that you want to control is limited, but is available for some 

of the things you want to deal with. So, for example, on ‘‘what is 

the quality of the employees that are doing this work, accessing 

this information? ’’ I don’t think you’re going to have a lot of control 

over that. 

You’ll be able to approve the people at the top, but the people 

below them you’re not going to be able to control that much. ‘‘Who 

in government can get the information once it’s uploaded into one 

of the databases? ’’ I don’t think you’re going to want to put a lot 

of limits on that because of the imperative toward information 

sharing. So you might, but probably won’t put limits on that. I 

think that we’re really looking at the front end and the back end. 

Senator WHITEHOUSE. Well, the logical limit on that, just to 

interject, would be not who gets access to it so much as when they 

get access, the predication question. 

Mr. NOJEIM. For what purpose. For what purpose they get access. 

Senator WHITEHOUSE. At what point does somebody in the government say, I’m interested in Mr. Nojeim’s file, let me pull that 

up? It shouldn’t be just on every government computer. There 

should be a question that has to be answered first: I need this because X. Particularly in the public corruption world, you’ve got to 

predicate before you can go after a public official. I think there’s 

a similar test. It’s not just who has access, it’s what is required. 

What’s the question that they have, and is it a legitimate question? 

Mr. NOJEIM. I think that’s exactly right. I think it’s very hard 

to legislate because there are just so many contexts in which you’re 

34

going to have to think down the road. I think that it’s worth talking about. 

I also think, though, where you can be most effective is at the 

front end and the back end. It’s articulating a standard that is 

what permits the data to get into the data base in the first place, 

and articulating the minimization procedures that must be followed 

for getting it cleared out at the end of the day. 

Senator WHITEHOUSE. Yes. I appreciate it. Thank you. 

Mr. Woods, it looks like you have the final word. 

Mr. WOODS. I think that we shouldn’t simply take a step because 

it’s easy. It’s easy to look at the front end and say we need to 

change the standard. I really do believe that the core of this is in 

the sort of middle and back end of this, controlling what is done 

with information. But I would just end on your point about—

Senator WHITEHOUSE. In terms of the interrelationship, do you 

agree that if we’re going to really get this right we’re going to have 

to focus on not only acquisition, but also minimization and retention and also predication and the querying function, and that those 

three need to be seen as a coordinated group? 

Mr. WOODS. They are all linked. I think—and you’re seeing 

this—as soon as you enter into this question you get pulled into the 

much broader issue of information sharing, of access to digital information. I think a very important issue, and that is public confidence. Things like the IG report shake public confidence and 

make the public concerned about these issues. I don’t think the 

public understands how their information is handled, either by the 

government or by commercial entities. It is a very large question 

and I think I would just urge the Committee to stick with it. It’s 

not going to be easily resolved, but it desperately needs doing. 

Senator WHITEHOUSE. Good. 

Well, I want to thank all the witnesses. I think this has been a 

helpful and interesting day. I would urge you also to stick with it 

and keep doing your work, and keep hammering on Members of 

Congress to get to this. We are, I think, in a very interesting time, 

driven by the technological leaps that we’ve taken. I will close by 

repeating the observation I made at the beginning when the 

Founding Fathers were designing the Fourth Amendment. It never 

crossed their mind that the sheriff would keep any evidence. It 

would be thrown out. It would be used at trial and it would be returned, or be destroyed if it was contraband. That was it. 

Now we have this facility for maintaining huge amounts of information and it raises a question that, because the Founding Fathers 

did not face, we can’t go and grab an answer off the shelf. This generation has to figure it out based on the principles that have made 

this country great. I think it’s a fascinating topic, and I appreciate 

your attention to it 

The record will remain open for 7 days for any additional submissions anybody chooses to make. 

The hearing is hereby adjourned. 

[Whereupon, at 11:54 a.m. the Committee was adjourned.] 

[Questions and answers and submissions for the record follow.]

35


42457.001
36


42457.002
37


42457.003
38


42457.004
39


42457.005
40


42457.006
41


42457.007
42


42457.008
43


42457.009
44


42457.010
45


42457.011
46


42457.012
47


42457.013
48


42457.014
49


42457.015
50


42457.016
51


42457.017
52


42457.018
53


42457.019
54


42457.020
55


42457.021
56


42457.022
57


42457.023
58


42457.024
59


42457.025
60


42457.026
61


42457.027
62


42457.028
63


42457.029
64


42457.030
65


42457.031
66


42457.032
67


42457.033
68


42457.034
69


42457.035
70


42457.036
71


42457.037
72


42457.038
73


42457.039
74


42457.040
75


42457.041
76


42457.042
77


42457.043
78


42457.044
79


42457.045
80


42457.046
81


42457.047
82


42457.048
83


42457.049
84


42457.050
85


42457.051
86


42457.052
87


42457.053
88


42457.054
89


42457.055
90


42457.056
91


42457.057
92


42457.058
93


42457.059
94


42457.060
95


42457.061
96


42457.062
97


42457.063
98


42457.064
99


42457.065
100


42457.066
101


42457.067
102


42457.068
103


42457.069
104


42457.070
105


42457.071
106


42457.072
107


42457.073
108

Æ


42457.074