Privacy groups skeptical of plan to limit NSA’s data access

The metadata collected via the surveillance programs includes the phone numbers that consumers call and the length of those calls, but not the content of the conversations.

Yet privacy groups caution that this may open the door for potential data retention mandates, something they have fought against in previous legislation.

“The acquisition of everyone’s telephone call records under Section 215 is illegal and it should be abandoned. If the government tries to require the phone companies to retain the data for five years, we would oppose that strongly because it creates huge privacy risks,” said Greg Nojeim, senior counsel at the Center for Democracy and Technology. “One of those risks is that the data, once retained for national security purposes, would almost certainly be made available for law enforcement and other purposes.”

Amie Stepanovich, director of the Domestic Surveillance Project at the Electronic Privacy Information Center, echoed a similar concern. She noted that phone companies do temporarily keep information on the phone numbers its customers call, the length of those calls and where those calls took place, but the concern rests with “how long the companies are keeping this information.”

“We would note that it is not within our privacy principles to mandate that companies maintain information for longer than they need [it],” Stepanovich said. “Anytime you have databases, you’re making the individuals in the databases vulnerable.”

Privacy advocates have battled against legislation that’s called for data retention in previous years. An earlier version of a bill by Rep. Lamar Smith (R-Texas) that aimed to crack down on child pornography online sparked opposition from privacy advocates because it included a provision that requires Internet service providers to store user data for 18 months, much longer than they currently store such information. The most recent version of Smith’s bill that passed the House Judiciary Committee last year, however, did not include that data retention requirement, which privacy groups lauded.

“If data retention mandates started with phone call records, it’s not clear where the mandate would end. Would it someday extend to phone call content? Would it include Internet records? It’s a very dangerous line to cross,” Nojeim said.  

A telecom executive said phone companies would discuss the idea raised by Schiff and others, but noted “there are some consumer privacy and cost concerns about a policy change like this.” The executive said the length of time that phone companies hold on to phone record data varies from company to company, but it ranges anywhere from seven to 15 days before they wipe that information from their systems.

For the intelligence community’s part, Alexander said the government is researching the feasibility of Schiff’s proposal to restructure the surveillance program, but warned that an immediate concern that comes to mind is “speed in crisis” and whether this would prevent authorities from getting data about potential terrorists quickly. He said intelligence officials would report back to the House Intelligence panel with their findings on the efficacy of phone providers storing the metadata versus the NSA.

FBI Director Robert Mueller raised similar concerns when testifying before the Senate Judiciary Committee last week during an oversight hearing, noting that authorities would have to approach several different carriers to get phone records on potential terrorists and doing so “would take an awfully long time.”

“There is no records retention requirement on telephone companies at this point,” Mueller said.

“You cannot wait three months, six months” to get the data, he said.

Both Schiff and privacy advocates reject that argument about speed.

“That’s certainly an issue that needs to be looked into, but I think it can probably can be done very expeditiously even if the telecom companies are in control of their own data. What it will depend on is whether the companies have the technology to maintain that data in a form which can be queried quickly, and if they don’t presently have that capability, we can help them develop that capability so they can respond very quickly,” Schiff said.