In her response essay, Marcy Wheeler keys on an important, and serious, consequence of the unauthorized disclosures and their aftermath: the developing adversarial relationship between the government and the private sector. Now past the first year of the disclosures, it is clear that companies on the receiving end of orders or directives issued under the Foreign Intelligence Surveillance Act (FISA) may be more likely to challenge them in the future. At least one company has already increased its challenges to requests for data from the government issued under National Security Letters or the Electronic Communications Privacy Act (ECPA). But Wheeler is wrong to suggest that – whatever it is the government may have done to effect the collection of foreign intelligence information overseas (which has happened for decades and continues to occur under Executive Order 12333) – somehow “violated…the deal” that was reached through the FISA Amendments Act of 2008 (FAA). Instead, the information that has been released and declassified over the last year has demonstrated that the FAA has been implemented consistently with how it was described in the public record of legislative text and Congressional hearings that took place up to its passage in 2008.
It is also not accurate to describe the steps the Obama Administration has taken as “refus[ing] to do anything” to limit NSA surveillance. Indeed, the President has already implemented significant reforms to the telephone metadata program, including requiring advance approval from the Foreign Intelligence Surveillance Court (FISC) before querying the data, and limiting the extent of analysis of that data. His Presidential Policy Directive-28 (PPD-28), issued in January 2014, limits the categories of bulk collection the NSA may collect. He has adopted the Surveillance Review Group’s principle of “risk management,” to more formally involve foreign policy implications, for example, in making collection decisions. And he has directed that procedures and rules be changed in order to add privacy protections for foreigners in how the NSA handles information it has acquired. Although it is too soon to assess how the details of some of these and other changes will be implemented, their significance should not be underestimated.