The Many Problems with the DEAs Bulk Phone Records Collection ProgramHanni Fakhoury It turns out this concern was valid, as last week the government let slip for the first time that the Drug Enforcement Agency (DEA) had also been collecting the phone records of Americans in bulk since the 1990s. From NSA to DEA The government didnt disclose this information in a report or in response to a congressional inquiry. Instead, it was quietly mentioned in a declaration by a DEA agent, in a criminal case brought in D.C. federal court. The defendant, Shantia Hassanshahi, is under indictment for allegedly conspiring to export electronic parts to Iran. The facts are important, as they highlight the problem with bulk collection. An agent with the Department of Homeland Security (DHS) received an unsolicited email from a source who claimed that an Iranian emailed him seeking to procure electronic parts for a project in Iran. The email to the source contained the Iranians phone number and business address in Tehran. The DHS agent took that phone number and queried it in a law enforcement database, seeking to find USbased phone numbers that had communicated with the Iranian. The results turned up one number that corresponded to a Google voice phone number. Via a subpoena to Google, the government was able to identify the number as Hassanshahis. After additional investigation, including a search of the TECS database, the government indicted Hassanshahi. Assuming the database was the NSAs controversial phone records database, Hassanshahis lawyers moved to suppress the information learned from the search of the database. The government responded that it wasnt the NSA database and refused to give the court or the defendant any more information about the databasebut asked the court to assume the information had been obtained unconstitutionally. Thats rightthe government stated that the database it used was unconstitutional. Unsurprisingly, such an admission got a few raised eyebrows, including the judge overseeing the case, who noted that the government left him in a difficult, and frustrating, situation. The judge ordered the government to submit an ex parte declaration summarizing the contours of the mysterious law enforcement database. The government obliged by submitting a three-page declaration from DEA Assistant Special Agent in Charge Robert Patterson. This declaration revealed, for the first time, the existence of a DEA phone records database that included phone numbers, the time, date and length of calls made from the US to designated specific countries. While we dont have a comprehensive list of which countries were involved in the program, we know that Iran was on that list. Agents could query the database if they had reasonable articulable suspicion that a phone number was related to an ongoing criminal investigation. The government discontinued the program in September 2013 and apparently purged the records in the database. The existence of another database of phone records collected in bulk for domestic law enforcement purposes raises serious legal questions. Stretching Statutory Authority The governments claimed authority for this bulk collection was 21 U.S.C. 876, which empowers the Attorney General to issue administrative subpoenasnot approved ahead of time by a grand jury or judgewhich compel the production of records that are relevant and material to an investigation relating to drug crimes. But bulk collection of all call records based solely on the country a person called could never satisfy the statute, because most of the records are irrelevant to an active investigation. To be sure, the government may only have queried the database for records relevant to an active investigation, but the government was using 876 to collect all records in anticipation of some future investigation. In other words, unless every person in the US who has ever made a phone call to someone in Iran or some other country contained in the database is considered a criminal suspect, the vast majority of records are irrelevant to any investigation. Even more problematic, 876 doesnt have even the minimal safeguards or limitations contained in Section 215 of the PATRIOT Act. Bulk collection under 215 at least requires the government to involve a court in the process; it requires the government comply with minimization procedures, and it only permits the government to query records for foreign intelligence purposes. While we have serious doubts about the effectiveness of these safeguards, theyre better than the total lack of safeguards in 876. Constitutional Problems As weve argued in our cases challenging bulk collection of phone records and Internet communications, this blanket collection violates the Fourth Amendments prohibition against unreasonable searches and seizures. And as weve repeatedly argued, people do have a reasonable and legitimate expectation of privacy in these communication records. When the US Supreme Court ruled in Smith v. Maryland 35 years ago that there was no expectation of privacy in phone records collected on a single phone number over three days, it certainly was not contemplating the bulk collection of communication records over an extended period of time that reveal all sorts of sensitive and intimate information about people. Keep in mind that the DEA engaged in bulk collection not for national security purposes, but instead for routine criminal investigation. The government has consistently argued that the national security character of 215 excuses the government from the Fourth Amendments warrant requirement. But the government cannot hide behind that argument here. While investigating and prosecuting drug trafficking is of course a legitimate law enforcement goal, Fourth Amendment protections are at their strongest when the governments purpose is investigating crime, rather than some other non-criminal interest. Ultimately, the constitutional harm is that the governments bloated (and incorrect) interpretation of Smith, allows it to collect anything held by a third party, regardless of what it is and why they want it. Thats an incredibly overbroad interpretation of the workings of the Fourth Amendment, and in an increasingly digital world, where financial and health records, communications with loved ones and intricate maps of where weve gone and are going are sitting in servers controlled by others, there is no limit to this collection power. Excessive Secrecy The governments concession that the search of the database was unconstitutional was not a sincere acknowledgement of a screw-up but rather a concerted effort to keep the details of this database secret. Had the court not ordered the government to explain the specifics of the database, the existence and details of the program would likely have remained out of public sight. This secrecy isnt surprising, and the fact the DEAs program was discontinued in September 2013 is probably not accidental. Thats because on September 1, 2013, the New York Times reported for the first time the existence of a program known as Hemisphere. which allows the DEA and local law enforcement to obtain call records from ATT. As government presentations about the program repeatedly make clear, law enforcement agencies are given instructions on protecting the program, and advised to never refer to Hemisphere in any official document. Earlier in 2013, Reuters reported about the DEA and IRSs secret use of investigative tips provided by the NSA and other law enforcement and intelligence agencies. Like Hemisphere, agents are instructed to keep the true source of this information under wraps and to recreate the investigative trail through some other means. The government calls this practice parallel construction but its really intelligence laundering, designed to insulate surveillance programs from the scrutiny of defense attorneys and judges. Given the DEAs well-documented tendency to be less than truthful when it comes to explaining where it really got investigative information, its likely the DEA laundered the results of their bulk phone records database too. That puts criminal defendants at a serious disadvantage in defending their cases and undermines the courts ability to act as an effective check on government surveillance. Illegal Spying, Whether by the NSA or DEA, is Illegal The DEAs bulk collection program confirms our worst fears about the scope of unconstrained government surveillanceits not just about national security but disregarding constitutional standards to collect as much information as possible. But the Constitution doesnt exist to make law enforcements job easy. It exists as a restraint on the governments power. And at a time when the efficacy and legality of bulk surveillance for national security purposes is under serious scrutiny by all branches of the government, there should be no question that bulk surveillance for domestic law enforcement purposes should be off limits. While were glad the program has now been discontinued and the records purged, there are many more questions that need to be answered: Perhaps the most pressing question is this: what other government databases exist that the public doesnt know about? The public shouldnt have to count on an after-the-fact accounting pressed by one federal judge exasperated by the governments obfuscation to learn about the bulk collection of its calling records. But with the knowledge of this database now public, the DEA and other agencies should be aware that were watching too. For the latest news in digital privacy and civil liberties, please visit the Electronic Frontier Foundation, where this article first appeared. 