With a mysterious surveillance target identified, calls for Congress to change course

When the House of Representatives voted to extend a controversial surveillance law last week, lawmakers tacked on a vaguely written amendment that expanded the scope of Section 702 of the Foreign Intelligence Surveillance Act. Its vague language served a purpose — to avoid tipping off U.S. adversaries about systems the American intelligence agencies planned to target. 

But on Tuesday, a press report revealed the amendment’s goal — to give spy agencies the ability to target cloud computing data centers under the law — and that has civil liberties advocates arguing that Congress can now move to narrow the measure.  

The amendment adopted last week would, if passed into law, broaden the definition of “electronic communication service providers” required to furnish data under Section 702, prompting privacy groups and some lawmakers to warn that it could force a much wider swath of organizations to assist U.S. government surveillance. Critics argue that, as written, it could require everyone from building landlords to delivery personnel to comply.

But debate around the measure has been limited because lawmakers have only been able to discuss its details behind closed doors for classification reasons, and it wasn’t until The New York Times reported Tuesday that the amendment’s goal was to clarify whether cloud computing data centers have to cooperate with Section 702 that its intended purpose became a matter of public record. 

The provision has spurred at least one senator, Democrat Ron Wyden of Oregon, to threaten to do everything in his power to prevent the bill from becoming law. But with congressional authorization for the Section 702 surveillance tools currently set to expire Friday, the Biden administration is pushing the Senate to act quickly.  

“They didn’t want people to know what they were going after,” said Elizabeth Goitein, senior director of the Brennan Center for Justice’s Liberty & National Security Program, so lawmakers wrote it in “enigmatic terms” that led to the provision amounting to a “kitchen sink” of affected organizations.

“The practical effect is that this allows the government to compel assistance from an enormous swath of U.S. businesses,” Goitein said. “It is staggeringly irresponsible to write something this broad, such a massive expansion of surveillance power, just to avoid tipping people off.”

“Now that everybody knows we’re talking about” adding data centers to the list of entities that have to turn over data under Section 702, “if the administration wants to add data centers for cloud computing, that’s what they should attempt to do” in Congress, she argued.

Advocates for the amendment have said it wouldn’t permit a wide expansion, but they’ve not been able to give a detailed answer on the problem it’s meant to address.

A senior Justice Department official told CyberScoop on Monday that the classified nature of the matter made it hard to discuss, but said the amendment stems from a court decision last year. 

“There have been significant changes in communications technology that have taken place since the law passed in 2008,” the official said. “The intent of the amendment is to update the definition of an [electronic communication service provider] to encompass new types of services offered by electronic communication providers that do not fall within the current ECSP definition.” 

The official said that a ruling by the Foreign Intelligence Surveillance Court last year involving an ECSP “well within the existing definition” had “concluded that a specific type of service it was offering was not covered by the definition and that only Congress could change that.”

“Increasingly, we’ve seen adversaries most concerned about routing their communications outside of the existing backbone communication service providers using service providers inside the United States that transmit and store communications in a way that doesn’t rely on traditional ECSPs that were contemplated when the statute was first enacted,” the official said.

Authored by the heads of the House Intelligence Committee — Reps. Mike Turner, R-Ohio, and Jim Himes, D-Conn. — the amendment, as adopted, did carve out exceptions for restaurants, hotels and some other facilities. A senior administration official said Tuesday that other “far-fetched examples” wouldn’t be allowed under the law’s targeting procedures.

A group that represents top tech companies is nonetheless worried about whom it could impact. The Information Technology Industry Council’s John Miller wrote on Tuesday that the expanded definition of electronic communication service provider must be removed.

“Although the effects of this amendment may be unintentional, its impacts would be very real,” wrote Miller, the senior vice president of policy, trust, data, and technology and the general counsel for the group. “The language in the amendment vastly expands the U.S. government’s warrantless surveillance capabilities, damaging the competitiveness of U.S. technology companies large and small, and arguably imperiling the continued global free flow of data between the U.S. and its allies.”

Wyden’s office suggested that as written, the provision could be stretched to affect the communication of journalists.

“The government suspects that Journalist X communicates with Foreign Official Y, perhaps because Y is quoted in X’s story,” a Wyden aide said via email, outlining the hypothetical. “The government uses the Turner provision to conscript someone who can get access to X’s laptop to extract all communications with Y.”

“It’s not reverse targeting under the current definition because the government has an interest in Y,” the aide said, referencing Section 702’s prohibition on targeting people overseas as a way of actually conducting surveillance on U.S. persons. “It’s not a search requiring a FISA warrant because 702 is the exception to the warrant requirement.”

The DOJ official said not getting a renewed law in place by Friday could cause problems for the program, despite the FISA court’s one-year certification last week.

“We know from experience that we would be facing an uncertain legal environment if the authority would lapse,” the official said. “As what happened in 2008 when a predecessor statute to 702 lapsed, we may see that providers, the private sector companies that are subject to receiving directives, might challenge whether they’re still covered. The consequence is that we lose collection.”

Senate Majority Leader Chuck Schumer, D-N.Y., took a procedural step on Tuesday to set the gears in motion for the chamber to take action on the Section 702 legislation.