NSA Surveillance Leaks: Background and Issues for Congress
Released: 2013-09-04T00:00:00

Introduction

Recent media stories about National Security Agency (NSA) surveillance address unauthorized disclosures of two different intelligence collection programs. These programs arise from provisions of the Foreign Intelligence Surveillance Act (FISA). However, they rely on separate authorities, collect different types of information, and raise different policy questions. As such, where possible, the information contained in this report distinguishes between the two. For both programs, there is a tension between the speed and convenience with which the government can access data of possible intelligence value and the mechanisms intended to safeguard civil liberties. The first program collects and stores in bulk domestic phone records that some argue could be gathered to equal effect through more focused records requests. The second program targets the electronic communications of non-U.S. persons while they are abroad, but also collects some communications unrelated to those targets.

The following sections address (1) what information is being collected; (2) the legal basis for the collection; (3) existing oversight mechanisms; and (4) arguments for and against the two programs. The last section of this report discusses legislation that has been proposed in response to information disclosed about NSA surveillance. Because documents leaked to the news media may be classified, CRS is precluded from providing a detailed analysis of the content of those documents. The information in this report is based largely on public comments from intelligence officials and Members of Congress.

What Information Is Being Collected?

Domestic Collection of Domestic Phone Records — collected under Section 215 of the USA PATRIOT ACT: On Wednesday, June 5, 2013, The Guardian reported that NSA collects in bulk the telephone records of millions of U.S. customers of Verizon, pursuant to an order from the Foreign Intelligence Surveillance Court (FISC). Intelligence officials and leaders of the congressional intelligence committees have confirmed the existence of this domestic phone records collection program, although they have not identified the companies providing the records. It has been alleged, but not confirmed, that similar orders have been sent to other telecommunications providers. The court order disclosed by T he Guardian was a three-month extension of a program that has been going on for seven years. The Director of National Intelligence (DNI) has acknowledged the breadth of the program, analogizing it to "a huge library with literally millions of volumes of books," but has stated that data about Americans in the possession of the United States government can only be accessed under specific circumstances.

The program collects "metadata"—a term used in this context to refer to data about a phone call, but not the phone conversation itself. Intelligence officials have stated that the data are limited to the number that was dialed from, the number that was dialed to, and the date and duration of the call. The data do not include cell site location information. Intelligence officials have committed to alerting Members of Congress before collecting that location information, suggesting they currently have the authority to do so. The data must be destroyed within five years of acquisition. Information collected does not include the location of the call (beyond the area code identified in the phone number), the content of the call, or the identity of the subscriber. However, some civil liberties advocates have argued that a telephone number today is essentially a unique identifier that can be easily tied to a person's identity by other means and that the distinction between a telephone number and subscriber identity is therefore insignificant.

On June 27, 2013, The Guardian published an article alleging that NSA previously collected the metadata for Internet-based communications (email being the prime example) for Americans inside the United States. A spokesman for the DNI confirmed The Guardian 's account, but said this program was discontinued in 2011. Intelligence officials have stated that, pursuant to the same FISA authorities, NSA does not currently collect in bulk the metadata of these types of communications. The collection of Internet metadata was based on separate FISA authorities. Some have expressed concern that those authorities could again be used to collect Internet metadata in the future.

Domestic Collection of Foreign Internet-Related Data —collected under Section 702 of FISA: The Washington Post reported on June 6th, 2013, that, "The National Security Agency and the FBI are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track foreign targets." The Guardian ran a similar story that same day. These articles referred to a system called PRISM allegedly used to collect this data. Outside commentators and government officials have argued that portions of these stories are inaccurate. Public comments from the Administration indicate this intelligence collection is more targeted in scope than was suggested by these articles, and major technology companies have denied giving the federal government direct access to their servers.

The DNI on June 8, 2013, released a public statement saying, " The Guardian and Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act." A fact sheet provided by the DNI stated that PRISM is an internal government computer system used to facilitate access to these communications. In accordance with Section 702, this collection program appears largely to involve the collection of data, including the content of communications, of foreign targets overseas whose emails and other forms of electronic communication flow through networks in the United States.

Compared to the breadth of phone records collection under Section 215, this program is more discriminating in terms of its targets—it is focused on the communications of non-U.S. persons located outside the United States—but broader in terms of the type of information collected. Examples cited by the Administration include the email content of communications with individuals inside the United States, but in those cases the targets of the intelligence collection appear to have been non-U.S. citizens located outside the United States.

The original press articles and more recent stories have suggested NSA monitors or can monitor the vast majority of the world's Internet traffic. NSA has stated that it "touches" only 1.6% of Internet traffic and "selects for review" 0.025% of Internet traffic. These portrayals by both critics and proponents may provide an incomplete account of NSA collection because they incorporate certain assumptions about that collection and about what types of Internet traffic are relevant to the public debate about Section 702 authorities. In August, the Office of the DNI released an October 2011 opinion of the Foreign Intelligence Surveillance Court (FISC) that provided additional insight into the scope and nature of Section 702 collection.

According to the 2011 opinion, NSA collected 250 million Internet communications per year using 702 authorities. Of these communications, 91% were acquired "directly from Internet Service Providers." The opinion did not identify specific providers or describe the means NSA uses to "directly" acquire communications. The other 9% were acquired through what NSA calls "upstream collection," meaning acquisition while Internet traffic is in transit from one unspecified location to another. NSA also has two methods for collecting information about a specific target; "to/from" communications collection, in which the target is the sender or receiver of the Internet communications; and "about" communications collection, in which the target is mentioned in the communications of non-targets. "About" communications are acquired through upstream collection. Because this method does not collect the communications to or from specific individuals but rather communications that mention those individuals, it implicates a potentially broader swath of communications and raises additional civil liberties concerns.

What Are the Legal Bases for the Collection?

Domestic Phone Records: Section 215 of the USA PATRIOT ACT, which is the authority under which the collection of domestic phone records has been authorized, broadened government access to private business records by both enlarging the scope of materials that may be sought and lowering the legal standard required to be met. Specifically, Section 215 modified the business records provisions of FISA to allow the FBI to apply to the FISC for an order compelling a person to produce "any tangible thing," including records held by a telecommunications provider concerning the number and length of communications, but not the contents of those communications. In 2005, the provision was further amended to require the FBI to provide a statement of facts showing that there are "reasonable grounds to believe" that the tangible things sought are "relevant to an authorized investigation (other than a threat assessment)" into foreign intelligence, international terrorism, or espionage.

The phrase "reasonable grounds to believe" is not defined by FISA, but has been used interchangeably with the "reasonable suspicion" standard, a less stringent standard than "probable cause." Although there are not any publicly available judicial opinions interpreting this language in the context of Section 215, it may be helpful to look at appellate courts' interpretations of the Stored Communications Act (SCA), as it similarly authorizes law enforcement to access telecommunications transactional records (as well as stored electronic communications) upon a showing that "there are reasonable grounds to believe" that the information sought is "relevant and material to an ongoing criminal investigation." Under the SCA, the collection of stored email has been held to meet that standard in the context of a "complex, large-scale mail and wire fraud operation" in which "interviews of current and former employees of the target company suggest that electronic mail is a vital communication tool that has been used to perpetuate the fraudulent conduct" and "various sources [have verified] that [the provider who had custody of the email] provides electronic communications services to certain individual(s) [under] investigation." Similarly, obtaining the internet protocol (IP) address and name associated with a Yahoo! account was justified when a police officer received a tip from an individual that he had received what appeared to be child pornography from that Yahoo! account.

"Relevancy" is also not defined by FISA, but is generally understood to be a less stringent standard than probable cause requiring only that the information sought would tend to prove or disprove a fact at issue. In August 2013, the Obama Administration released a whitepaper providing a legal analysis of the bulk collection of telephony metadata under Section 215. Included in this whitepaper was an examination of the term "relevancy" as used in Section 215. The whitepaper first noted previous characterizations of relevancy by the Supreme Court described relevance as encompassing "any matter that bears on, or that reasonably could lead to other matter that could bear on, any issue that is or may be in the case." The whitepaper also noted that courts have upheld requests for "entire repositories of records, even when any particular record is unlikely to directly bear on the matter being investigated, because searching the entire repository is the only feasible means to locate the critical documents." On the other hand, the cases cited in the whitepaper do not appear to involve document requests which are on the same scale as the NSA's collection of domestic telephone records. Nevertheless, in approving the order authorizing the NSA's collection of these records, the FISC must necessarily have agreed that Section 215's relevancy requirement had been satisfied.

An "authorized investigation" must be conducted under guidelines approved by the Attorney General under Executive Order 12333 and may not be conducted of a United States person solely upon the basis of activities protected by the First Amendment. The Attorney General's Guidelines for FBI Domestic Operations authorize three levels of investigations: assessments, preliminary investigations, and full investigations. Preliminary investigations require an "allegation or information indicative of possible criminal or national security-threatening activity" before being initiated. Similarly, full investigations require "an articulable factual basis for the investigation that reasonably indicates" the existence of some activity constituting a federal crime, a threat to national security, or foreign intelligence. In contrast, assessments do not require any factual predicate. As Section 215 explicitly requires an authorized investigation "other than a threat assessment," it is likely that Section 215 orders may only be used in conjunction with preliminary or full investigations.

Following the disclosure of the FISC order compelling Verizon to produce large amounts of telephony metadata, some commentators have expressed skepticism regarding how there could be "reasonable grounds to believe" that such a broad amount of data could be said to be "relevant to an authorized investigation," as required by the statute. Although the order has been leaked to various media outlets, other pieces of information that would significantly help inform any understanding of how the legal standard in Section 215 is being applied have not yet been disclosed. Specifically, it is not known what was included in the statement of facts that is required to be submitted as part of the application for a Section 215 order. Similarly, there have not been any widespread disclosures of the manner in which the FISC or FICR is applying the "reasonable grounds to believe" or "relevant to an investigation" standards provided in Section 215.

Foreign Internet-Related Data: Title VII, added by the FISA Amendments Act of 2008, provides additional procedures for the acquisition of foreign intelligence information regarding persons who are believed to be outside of the United States. The DNI has stated that the recently disclosed collection of foreign intelligence information from electronic communication service providers has been authorized under Section 702 of FISA, which specifically concerns acquisitions targeting non-U.S. persons who are overseas.

Prior to the enactment of Section 702, and its predecessor in the Protect America Act of 2007, FISA only authorized sustained electronic surveillance or access to electronically stored communications after the issuance of a FISC order that was specific to the target. The FISC, in authorizing electronic surveillance or a physical search, must find probable cause to believe both (1) that the person targeted by the order is a foreign power or its agent, and (2) that the subject of the search (i.e., the telecommunications or place to be searched) is owned, possessed, or will be used by the target.

Section 702 permits the Attorney General (AG) and the DNI to jointly authorize targeting of persons reasonably believed to be located outside the United States, but is limited to targeting non-U.S. persons. Once authorized, such acquisitions may last for periods of up to one year. Under subsection 702(b) of FISA, such an acquisition is also subject to several limitations. Specifically, an acquisition:

May not intentionally target any person known at the time of acquisition to be located in the United States; May not intentionally target a person reasonably believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States; May not intentionally target a U.S. person reasonably believed to be located outside the United States; May not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States; and Must be conducted in a manner consistent with the Fourth Amendment to the Constitution of the United States.

Acquisitions under Section 702 are also geared towards electronic communications or electronically stored information. This is because the certification supporting the acquisition, discussed in the next section, requires the AG and DNI to attest that, among other things, the acquisition involves obtaining information from or with the assistance of an electronic communication service provider. This would appear to encompass acquisitions using methods such as wiretaps or intercepting digital communications, but may also include accessing stored communications or other data.

Central components of Section 702 are the targeting and minimization procedures that must be submitted to the FISC for approval. In order to be approved, Section 702 requires the targeting procedures be reasonably designed to ensure that an acquisition is limited to targeting persons reasonably believed to be located outside the United States, and to prevent the intentional acquisition of any communication where the sender and all intended recipients are known at the time of the acquisition to be located in the United States.

The Fourth Amendment to the U.S. Constitution protects against "unreasonable searches and seizures." In domestic criminal law investigations, it generally requires law enforcement officers to obtain a court-issued warrant before conducting a search. When the warrant requirement does not apply, government activity is generally subject to a "reasonableness" test under the Fourth Amendment. The extent to which the warrant requirement applies to the government's collection of foreign intelligence is unclear. In a 1972 case, the Supreme Court invalidated warrantless electronic surveillance of domestic organizations on Fourth Amendment grounds, despite the government's assertion of a national security rationale. However, it indicated that its conclusion might be different in a future case involving the electronic surveillance of foreign powers or their agents, within or outside the United States.

In August 2013, the Obama Administration partially declassified several opinions of the FISC regarding collection activities under Section 702. The first of these opinions, dated October 3, 2011, dealt with the FISC's evaluation of the targeting and minimization procedures proposed by the government to deal with new information regarding the scope of upstream collection. Specifically, the government had recently discovered that its upstream collection activities had acquired unrelated international communications as well as wholly domestic communications due to technological limitations. After being presented with this new information, the FISC found the proposed minimization procedures to be deficient on statutory and constitutional grounds. With respect to the statutory requirements, the FISC noted that the government's proposed minimization procedures were focused "almost exclusively" on information that an analyst wished to use. Consequently, communications that were known to be unrelated to a target, including those that were potentially wholly domestic, could be retained for up to five years so long as the government was not seeking to use that information. The court found that this had the effect of maximizing the retention of such information, and was not consistent with FISA's mandate to minimize the retention of U.S. person information.

The FISC also held that the proposed minimization procedures did not satisfy the Fourth Amendment. In 2008, the Foreign Intelligence Surveillance Court of Review (FISCR) upheld collection activities under the Protect America Act (PAA) that appear to have closely resembled the authority under Section 702. The FISCR first determined that the purposes of foreign intelligence investigations were sufficiently important and different from traditional law enforcement to justify an exception to the warrant requirement. The court went on to hold that surveillance under the PAA was also reasonable since the targeting and minimization procedures used by the government provided sufficient proxies for the traditional particularity and probable cause requirements of the Fourth Amendment. The court especially noted that such procedures were reasonable especially when balanced against the government's interest in protecting national security, which was "of the highest order of magnitude." In contrast, in the October 2011 opinion, the FISC applied the same analysis, but after having first determined that the minimization procedures were statutorily deficient, found that the balance required under the Fourth Amendment's reasonableness test did not favor the government.

A second opinion declassified by the DNI in August 2013 dealt with the aftermath of the October 2011 opinion. Under Section 702, if the FISC disapproves of the proposed minimization procedures, the government may revise those procedures in order to come into compliance. In this case, the government presented revised minimization procedures to the FISC, and the court approved those procedures on November 30, 2011. The revised minimization procedures required the segregation of those communications most likely to involve unrelated or wholly domestic communications; required special handling and markings for those communications which were not segregated to warn analysts; and reduced the retention period from five years to two years.

What Oversight Mechanisms Are in Place?

The following is a summary of the oversight mechanisms governing the two intelligence collection programs. Both programs appear to be subject to frequent examination by the FISC, in addition to Congress. However, critics, citing the frequency with which requests are approved by the FISC, argue that the court operates as a "rubber stamp" for the executive branch. Others contend that the FISC is composed of experienced judges and a professional staff and that the frequency of requests approved by the court reflects an iterative, aggressive oversight process. Because of the lack of clarity into the court's decisions, it is difficult to judge the validity of these claims.

Domestic Phone Records : The collection of phone records in bulk is conducted pursuant to FICA orders that, according to intelligence officials, must be renewed every 90 days. The data are then stored at a repository at NSA. The FISC also approves the procedures governing access to those data and has apparently required that NSA meet a reasonable articulable suspicion standard prior to searching the data. FISC approval is not necessary prior to searching the data already held at NSA. Rather, 22 individuals at NSA have been authorized to approve requests to query the data and to determine whether information meets the reasonable suspicion standard.

Queries against phone records data are documented and audited by NSA. In 2012, less than 300 phone numbers were used to query the database. Intelligence officials have identified several additional oversight mechanisms that monitor the implementation of this program. These include (1) a report filed every 30 days with the FISC; (2) a meeting at least every 90 days between the Department of Justice (DOJ), the Office of the Director of National Intelligence (ODNI), and NSA, and (3) a semiannual report to Congress.

Foreign Internet-Related Data: The collection of electronic communications pursuant to Section 702 is subject to a less stringent oversight regime. "[I]nformation is obtained with the FISA Court approval and with the knowledge of the provider based upon a written directive from the Attorney General and the Director of National Intelligence." In accordance with the FISA Amendments Act, procedures governing the program, designed to prevent the acquisition and dissemination of Americans' communications, are subject to court approval. Actual collection of this information does not require a warrant or court order. Decisions regarding whether collection on a foreign target is in keeping with Section 702 appear to take place largely within the DOJ and ODNI.

After data are collected, NSA is subject to a number of oversight reporting procedures. These include (1) quarterly reports to the FISC concerning compliance issues; (2) semi-annual reports to the FISC and Congress that assess compliance with targeting and minimization standards; (3) semi-annual reports to the FISC and Congress on the implementation of the program; and (4) annual reviews from the NSA Inspector General.

Arguments For and Against the Two Programs

The Administration has argued that the surveillance activities leaked to the press, in addition to being subject to oversight by all three branches of government, are important to national security and have helped disrupt terror plots. These arguments have not always distinguished between the two programs, but generally the Administration appears to have taken the position that collection pursuant to Section 702 is an important tool on a broad range of national security issues and that collection pursuant to Section 215 has been useful in a discrete number of terrorism cases. Regarding bulk phone records, which have come under greater scrutiny, intelligence officials have argued that the breadth of the collection is necessary to ensure all relevant information is available to the government and can be identified through searches in NSA's database, rather than having more focused collection that might miss relevant information. For example, Deputy Attorney General James Cole before the HPSCI stated "if you're looking for a needle in the haystack, you have to get the haystack first."

Intelligence officials initially stated that the two programs have "helped prevent over 50 potential terrorist events"—which appear to encompass both active terror plots targeting the United States homeland and terrorism facilitation activity not tied directly to terrorist attacks at home or abroad. NSA Director General Alexander subsequently clarified these remarks, citing a total of 54 terrorist events. Forty-two of these involved terrorist plots and 12 involved material support to terrorism. Of the total number of terrorist events, 53 somehow involved collection pursuant to Section 702. Thirteen of the 54 involved threats inside the United States, and 12 of those cases somehow utilized the phone records held by NSA.

Intelligence officials have provided one example in which the target of the plot was the U.S. homeland and for which the phone records were somehow utilized. Of the other 11 cases in which the phone records were used, one involved U.S.-based material support for extremist activity outside the United States. It is not clear how many, if any, of the remaining 10 cases that utilized the phone records involved terror plots targeting the U.S. homeland as opposed to U.S.-based material support for terrorism. The Administration has provided four examples:

Najibullah Zazi : NSA, using 702 authorities , intercepted an email between an extremist in Pakistan and an individual in the United States. NSA provided this email to the FBI, which identified and began to surveil Colorado-based Najibulla Zazi. NSA then received Zazi's phone number from the FBI, checked it against phone records procured using 215 authorities , and identified one of Zazi's accomplices, an individual named Adis Medunjanin. Zazi and Medunjanin were both subsequently arrested and convicted of planning to bomb the New York City subway. Additional information on this case is offered in the next section. Khalid Ouazzani : NSA, using 702 authorities , intercepted communication between an extremist in Yemen and an individual in the United States named Khalid Ouazzani. Ouazzani was later convicted of providing material support to al-Qaeda and admitted to swearing allegiance to the group. The FBI has claimed that Ouazzani was involved in the early stages of a plot to bomb the New York Stock Exchange. David Headley: According to intelligence officials, the FBI received information indicating that Headley, a U.S. citizen living in Chicago, was involved in the 2008 attack in Mumbai that took the lives of 160 people. NSA, using 702 authorities , also became aware of Headley's involvement in a plot to bomb a Danish newspaper. It is unclear from public statements how Headley first came to the FBI's attention. He pled guilty to terrorism charges and admitted to involvement in both the Mumbai attack and Danish newspaper plot. Basaaly Saeed Moalin: NSA, using phone records pursuant to 215 authorities , provided the FBI with a phone number for an individual in San Diego who had indirect contacts with extremists overseas. The FBI identified the individual as Basally Saeed Moalin and determined that he was involved in financing extremist activity in Somalia. Moalin was convicted in 2013 of providing material support to al-Shabaab, the Somalia-based al-Qaeda affiliate.

Concerns Regarding Domestic Phone Records: Criticism has increasingly focused on the collection of phone records pursuant to Section 215. The public and Members of Congress have expressed particular concern about data provided to NSA in bulk about U.S. citizens. Critics question the importance of the phone records in the cases identified by the Administration and question whether any value from those records could have been derived from a more traditional court order. Rather than using a phone number to query a database at the NSA, they argue the same number could be given to phone companies to conduct a search of their records. This could produce similar results, although the process of obtaining the order and making a request could take longer. In essence, using the government's needle-in-a-haystack analogy, critics are suggesting that the "haystack" could be utilized to equal effect regardless of whether it is sitting at the NSA or remains in the possession of the phone company. For example, Senators Ron Wyden and Mark Udall, in a statement from June 19, 2013, argued:

[I]t is still unclear to us why agencies investigating terrorism do not simply obtain this information directly from phone companies using a regular court order. If the NSA is only reviewing those records that meet a "reasonable suspicion" standard, then there is no reason it shouldn't be able to get court orders for the records it actually needs. Making a few hundred of these requests per year would clearly not overwhelm the FISA Court. And the law already allows the government to issue emergency authorizations to get these records quickly in urgent circumstances....

[W]e have yet to see any evidence that the bulk phone records collection program has provided any otherwise unobtainable intelligence. It may be more convenient for the NSA to collect this data in bulk, rather than directing specific queries to the various phone companies, but in our judgment convenience alone does not justify the collection of the personal information of huge numbers of ordinary Americans if the same or more information can be obtained using less intrusive methods.

Concerns Regarding Foreign Internet-Related Data : Many critics of Section 702 collection appear to agree that it is a valuable tool for national security, but question whether the program has been implemented, or can be implemented, in a way that adequately protects American civil liberties. Some argue that for certain types of electronic communications, it is not possible to assess with enough confidence whether a prospective target is inside the United States or overseas.

This concern sharpened in August 2013, when the Office of the DNI released the October 2011 FISC opinion in which the court found that some elements of the 702 collection program were inconsistent with the Fourth Amendment of the Constitution. The problem concerned "about" communications and NSA's "upstream collection," which are described earlier in this report. Because of technical constraints, NSA was unable to specifically collect the relevant "about" communication and instead was collecting groupings of communications, which contained communications about legitimate targets as well as communications unrelated to those targets. In some cases, that involved the collection of Americans' communications and of wholly domestic communications. As a result of this overcollection, NSA acquired tens of thousands of domestic communications, which the court determined was in violation of the Constitution.

As discussed above, the FISC allowed the problematic upstream "about" collection to continue but required NSA to implement stricter minimization procedures for tranches of data that might contain Americans' communications. Members may wish to engage intelligence officials about the effectiveness of NSA's "about" communications collection, which does not specifically collect the communications of foreign intelligence targets and might therefore be of less utility than "to/from" communications, which comprise 91% of collection under Section 702. While "about" communications apparently present challenging technical issues, Section 702 might nonetheless be amenable to legislative fixes if the collection that raises the greatest concerns also has the least utility.

Additional Background on Najibullah Zazi

The Zazi case cited by the Administration may help Members evaluate the utility of NSA's bulk phone records collection program. A significant amount of public information about that case has been made available since Zazi's arrest on September 19, 2009. Zazi, Medunjanin, and a third man traveled to Pakistan on August 28, 2008, to receive training from al-Qaeda. Zazi returned to the United States in January 2009. Medunjanin returned in September 2008. On September 6, 2009, Zazi sent an email from Colorado to an associate in Pakistan requesting a recipe for explosives. There is reason to believe this email is the one intercepted by NSA using 702 authorities and then passed to the FBI. The FBI opened an investigation and began surveillance of Zazi on September 7. Zazi traveled from Denver to New York on September 9, 2009, for the purpose of conducting an attack sometime between September 14 and 16. FBI agents observed his departure from Denver. Zazi became aware of FBI surveillance while in New York and chose to return to Denver on September 12. He was interviewed and arrested by the FBI several days later.

It is unclear at what point in the investigation authorities utilized the phone records at NSA to link Zazi to Medunjanin. FBI officials recently acknowledged that they were already aware of Medunjanin, but stated that the information derived from Section 215 collection provided corroborating information regarding Medunjanin's connection to Zazi. At some point in the investigation, the FBI was able to identify travel records showing that Zazi and Medunjanin in 2008 departed for Pakistan together. It has also been reported that the New York Police Department had previously identified both Zazi and Medunjanin using informants and undercover officers at a mosque in Queens. Prospective questions about the role of the phone records in the investigation include the following:

What did the FBI know about Medunjanin's travel to Pakistan and about his activity more generally prior to linking him with Zazi using the phone records database? Was that information sufficient to link him to Zazi absent a search of those phone records? To what extent was the information available to FBI agents in September 2009 sufficient to obtain phone records through a court order or a National Security Letter, rather than through the repository at NSA? Were the phone records connecting Zazi to Medunjanin from before or after their trip to Pakistan in August 2008? In light of when those calls were made, would company retention times for phone records have limited government access to data if those records had been provided pursuant to a more specific court order? Was the speed with which authorities were able to access phone records data important to identifying Medunjani or to disrupting the plot? Authorities appear to have had a nine-day window during which they could exploit available information to disrupt the attack. Were phone records utilized within that window?

Legislative Proposals

To date, legislative proposals have focused primarily on intelligence collection of domestic phone records. Members of Congress have introduced bills or are circulating draft bills that would limit in various ways the scope of requests for business records that could be covered under Section 215 of the USA PATRIOT ACT of 2001. Answers to the questions above concerning the Zazi case might help elucidate the policy dimensions of these proposals. The Administration has stated that it is currently looking at the architectural framework of the Section 215 collection program and will provide recommendations to Congress on how Section 215 might be changed.

Prospective changes that could require the federal government to make individualized requests to phone companies, rather than requests for phone records in bulk, could also require mandating specific retention times for phone company business records such that those times are consistent with the current five-year period for records held by NSA. The crux of the debate may come down to concerns about the speed with which the government can access phone records that are not held in bulk at NSA. With respect to changes to Section 215, NSA Director General Alexander has stated, "The concern is speed in crisis." The process for identifying prospective terrorists could be slowed to some degree if the government is required to make individual requests rather than having ready access to bulk phone data. One question for Members of Congress may be whether that increased time frame would have been detrimental in any of the roughly 10 cases identified by the intelligence community that involved phone records collected in bulk.

Some Members have also proposed legislation intended to provide greater transparency of opinions of the FISC and FISCR. Under current law, the opinions of either court that include significant construction or interpretation of any provision of FISA must be provided to the judiciary and intelligence committees of the House and the Senate within 45 days. However, the AG and DNI may redact information from those opinions where necessary to protect the national security of the United States and when limited to sensitive sources and methods information or the identities of targets. Recent legislative proposals would further require such opinions to be made public or summarized in an unclassified manner, but would continue to provide discretion for the AG to limit the disclosure of opinions or summaries if necessary to protect national security.

Of the 22 proposals identified below, 16 include changes to Section 215 and 15 of those attempt to limit the bulk collection of phone records by NSA. Eight proposals would change the FISA process by, among other things, requiring greater public disclosure of FISA court decisions or changing the way judges are appointed to the FISA court.