Robert Litt, General Counsel of the Office of the Director of National Intelligence, has offered a new analysis for the Fourth Amendment in the Information Age, grounded in two cases arising from the NSA’s domestic surveillance programs.1 As opposing counsel or amicus in the cases he cites in his argument, I thought it would be useful to respond.

The first case Mr. Litt discusses is Jewel v. National Security Agency, in which I am counsel for the plaintiffs.2 Jewel arises, in part, out of the NSA’s collection and search of the content of communications from fiber optic cables that form the Internet’s backbone. Mr. Litt claims that Congress formally authorized this program,3 which the government calls UPSTREAM, by passing Section 702 of the FISA Amendments Act in 2008—a contention with which I strongly disagree.4

The second case is Klayman v. Obama, where I argued on behalf of the amici in support of the plaintiffs in the D.C. Circuit.5 Klayman arises from the NSA’s mass telephone records collection conducted until late 2015 under Section 215 of the USA PATRIOT Act.6 Telephone records collection is also at issue in three cases where my organization, the Electronic Frontier Foundation (“EFF”), represents the plaintiffs: Jewel,7 First Unitarian Church of Los Angeles v. NSA8 and Smith v. Obama.9

Like Mr. Litt, I am not a legal academic but, like him, I have the practical experience of having handled numerous lawsuits involving the Fourth Amendment and national security, in my case for over 20 years. Also like Mr. Litt, I do not propose a comprehensive theory of the Fourth Amendment. Instead, this Essay responds to his suggestions and points to what I submit is a better starting point—the International Principles on the Application of Human Rights to Communications Surveillance, also known as the Necessary and Proportionate Principles10—for considering the problems he raises with Fourth Amendment doctrine.

Mr. Litt makes two initial statements with which I agree. First, he notes that the “reasonable expectation of privacy” test currently employed in Fourth Amendment jurisprudence is a poor test for the digital age. Second, he states that the “third-party doctrine”—under which an individual who voluntarily provides information to a third party loses any reasonable expectation of privacy in that information—should not be an on-off switch for the Fourth Amendment. On this second point, Mr. Litt wisely recognizes that some members of the Supreme Court are uneasy with the third-party doctrine.11 His misgivings about the third-party doctrine are most welcome; many in the government, including the Department of Justice in Klayman, continue to claim that all constitutional protection shuts off whenever data is entrusted to a service provider.

From there, however, our paths diverge quite sharply.

Mr. Litt argues that since the “reasonable expectation of privacy” formulation is not well suited to digital surveillance, it should simply be eliminated. This would leave a “reasonableness” balancing test to carry the entire weight of the Fourth Amendment’s protection against governmental intrusions. He says that a court in each case should balance the “actual harm” suffered by the individual affected by the surveillance with the governmental interests in conducting the surveillance.12 This argument throws the baby out with the bathwater. By abandoning the “reasonable expectation of privacy” standard without a suitable replacement, Mr. Litt also implicitly suggests abandoning the foundational constitutional protection against general warrants,13 as well as the rule that a warrantless search of someone with a reasonable expectation of privacy is per se unconstitutional unless an exception applies.14

Eliminating the per se rule and the prohibition on general warrants would also help the government evade one of the strongest arguments against UPSTREAM surveillance in Jewel v. NSA. There, the government has admitted that it conducts warrantless full-content searches of a large number of nonsuspect Americans’ communications that travel over the Internet backbone—contrary to Mr. Litt’s contentions that such factual assertions are purely hypothetical.15 The government calls this “about” searching, since it searches the content of communications for messages that are “about” targets, in addition to the searching it does for messages to or from the targets themselves.16 There are FISA court orders signing off on this activity at a very high programmatic level.17 But these orders do not address the suspicionless collection and search of Americans’ international communications, nor the large “incidental” collection and search of Americans’ fully domestic communications without any probable cause.

Under current doctrine, since Americans have a reasonable expectation of privacy in the content of their communications, full-content searching is per se unconstitutional unless an exception to the warrant requirement applies. None does. In order to prevail, therefore, the government must convince the Supreme Court to read a broad national security “special needs” exception into the Fourth Amendment authorizing mass, suspicionless seizure and full-content searches of millions of nonsuspect Americans’ most private international and domestic communications. That is a tall order: the Court would effectively have to create an implied national security exception to the Fourth Amendment that would admittedly affect billions of communications by millions of innocent Americans.

Such a large implied exception does not readily align with history: the Fourth Amendment contains no national security exception, even though it was adopted in the shadow of the Revolutionary War. Further, the Fourth Amendment was expressly intended to prevent general warrants.18 The FISA Court of Review—where the government alone presents its case and the arguments and decisions are kept secret—has recognized some form of a national security exception.19 But the government may not wish to see the Supreme Court, whose proceedings are adversarial and highly public, consider whether to create such a large and unprecedented exception.

Moreover, Mr. Litt’s balancing test is unbalanced at its inception. According to his argument, courts can only evaluate the “actual harm” to a single person from mass surveillance because his reformulation retains the caselaw holding that Fourth Amendment rights are personal and cannot be asserted vicariously.20 Meanwhile, Mr. Litt’s formulation would allow the government to present its interest broadly without also showing “actual” increased safety of Americans as a result of the surveillance, much less the individual safety of the plaintiff. Indeed, Mr. Litt likens the increased safety to an insurance policy, which protects its holder even when no claim is ever filed.21

In practice, the government almost always claims that details of the “actual” surveillance of a person, or even whether a person’s communications are included in the surveillance, are protected by the state-secrets privilege, making it even more difficult for the individual to show particularized harm. As a result, it is difficult to imagine a situation where the government would not prevail under Mr. Litt’s framing.

More importantly, Mr. Litt’s central claim is that there can be no actual harm when a person’s communications are seized by the government and searched, even with content searching, as long as computers but not humans conduct the search. He says that communications are “unseen and unknown” until they turn up in search results that are shown to a human, adding that only an “infinitesimal fraction” of the communications is ever seen by a human.22

This argument—what I call the “human-eyes” theory of the Fourth Amendment—is where we most seriously disagree. Mr. Litt’s “human-eyes” theory would effectively authorize a surveillance state in which a person’s every action and interaction could be technologically monitored and algorithmically analyzed without violating the Fourth Amendment, as long as a human only saw “suspicious” information selected by the technology.

There are four key problems with the “human-eyes” theory.23

First, Mr. Litt dismisses concerns about mass surveillance and its chilling effects as “overheated rhetoric.”24 Yet recent research confirms what we intuitively know to be true: the specter of mass government surveillance is enough to chill completely legal activities online if individuals feel that they might draw governmental attention.25 The very existence of mass surveillance programs constricts individual liberty and democratic activity, regardless of whether a person is ultimately targeted. This concern is reflected in the First Amendment right of association as well as the Fourth Amendment’s prohibition on unreasonable searches and seizures. In the landmark domestic surveillance case, United States v. U.S. District Court (Keith), the Supreme Court recognized the risk, noting that in national security cases, there is often a “convergence of First and Fourth Amendment values not present in cases of ‘ordinary crime.’”26 Because of this convergence, Jewel and First Unitarian Church of Los Angeles v. NSA both raise First and Fourth Amendment issues.27 The latter case contains evidence from a number of advocacy organizations such as Greenpeace, the National Lawyers Guild, and Second Amendment groups, all of which experienced reductions in calls to their public “help” lines and other associational communications after the NSA’s telephone records program became broadly public.28

Second, assurances that computer searches are safer and less invasive than human searches are not credible. Computers are generally more efficient than humans and will search every single word or bit of information where a human would likely not be able to do so. They are also generally less able to sufficiently judge the context of communications in order to exclude false positives. Moreover, computers are only as careful as their programmers and the algorithms, training data, and other methods they use. Thus, use of computers in “bad” searches can lead to dramatically worse results. For instance, shortly after Edward Snowden leaked information from the NSA, one story explained that due to a coding error, all of the people in the 202 area code, which covers Washington, D.C., were returned in response to a search that was meant to target foreigners abroad.29

Third, the “human-eyes” reformulation essentially writes the word “seizures” out of the text of the Fourth Amendment. The Supreme Court has long held that the prohibition against unreasonable seizures is grounded in property rights; for digital communications, the relevant possessory interest violated by a Fourth Amendment seizure is expressed as the right to “dominion and control” over property.30 In Jewel, the government usurps individuals’ “dominion and control” of their data by inspecting millions of nonsuspect communications as they travel across the fiber optic cables of providers like AT&T. The government attempts to skirt this problem by redefining “collection” as the point at which human eyes review the information. But this is inconsistent with plain meaning of the word “collection.”31 It is also inconsistent with the statutory law under Title III of the Omnibus Crime Control and Safe Street Act of 1968, which triggers a wiretap upon the “interception”32 of an electronic communication “through the use of any electronic, mechanical, or other device,”33 not at the point of human review.

Fourth, the government’s arguments in Jewel in support of the “human-eyes” theory rest chiefly on inapplicable case law around dog sniffs for evidence of contraband such as drugs. While there is no “dog-sniff” exception to the Fourth Amendment, several cases have held that in certain situations a sealed package or luggage in transit can be briefly inspected for signs of contraband. Yet even a brief detention for purposes of a dog sniff is a “seizure” under the Fourth Amendment.34 Moreover, dog sniffs are done to identify packages for detention; a warrant is needed to actually open the packages.35 The speed of the sniff is also viewed as a proxy for the limited information revealed to the government; a simple, quick sniff reveals less information than a more thorough search.36

The context of UPSTREAM surveillance is dramatically different. The duration of the seizure bears no relationship to its intrusiveness. Even if the government completes its wholesale copying, filtering, and full-text analysis in a blink of an eye, those actions are still highly invasive. And unlike the dog sniffs, the investigation opens the content of the messages to government inspection.37 Dog sniffs are also inapt comparisons because the only thing revealed in a contraband search is the presence or absence of illegal material. By contrast, mentioning the name of a U.S. target in an email or on a social network, which triggers UPSTREAM surveillance, is not onlylegal—it is fully protected speech.

Overall, Mr. Litt’s formulation misses the central goal of the Fourth Amendment to prevent general searches. His argument is that, as long as no responsive information is found, the fact that a seizure and search occurred does not matter, even if done without suspicion and on a massive scale. This might be right if the Framers such as James Otis only objected to searches of their houses that turned up evidence of a crime. They did not.38 In colonial times, of course, most of a person’s “papers” and other sources of information were located in the home, while today those papers regularly travel via a person’s ISP like AT&T and are stored digitally with services such as Facebook, Google, or Amazon. Nevertheless, the possessory privacy and dominion interest in the content of the information that Americans routinely store with such services and service providers—including medical records, financial information, business plans, and religious and personal communications—is no less important today than in the eighteenth century. While it might sound like historical science fiction, had the British troops instead employed robots able to search though a colonist’s house in a matter of seconds, it seems doubtful that Otis and his compatriots would have been unconcerned.

These arguments by the government have already been rejected in analogous circumstances. For instance, the government’s claim that using a “hash value” scan of a computer hard drive does not implicate the Fourth Amendment was rejected in United States v. Crist.39 A hash value is generated by an algorithm that can be used to confirm that two digital files or objects are the same. The Crist court noted: “By subjecting the entire computer to a hash value analysis—every file, internet history, picture, and ‘buddy list’ became available for Government review,” even though humans would only be involved if the computer came up with a match.40 Similarly, in Bourgeois v. Peters, a city requirement that every one of the 15,000 people who sought to attend an annual protest outside a military base pass through a magnetometer was found to be an unconstitutional search.41 A magnetometer only detects the presence of metal, providing no other information to the human monitoring it. Emphasizing the complete absence of any legal support for “the broad authority to conduct mass, suspicionless, warrantless searches,” the Eleventh Circuit explained that the city’s position “would effectively eviscerate the Fourth Amendment.”42 Indeed, the Fourth Amendment “establishes searches based on evidence—rather than potentially effective, broad, prophylactic dragnets—as the constitutional norm.”43

But even Crist, which involved the investigation of a single device that had been suspected of containing contraband, and Bourgeois, which was based on past incidents of illegal action, do not accurately reflect the breadth and the complete lack of suspicion involved in the NSA programs Mr. Litt defends. The expansion is twofold: both the number of nonsuspect people subject to review and the number of nonsuspect communications reviewed are far greater.

Mr. Litt relies on agency “minimization procedures” as a key factor in his “reasonableness” balancing test.44 Of course, those, too, are generally kept secret—less than they used to be, as Mr. Litt points out, but they are still not fully transparent. But more importantly, there is still no opportunity for the public to know, much less a petitioner to challenge, whether the procedures that exist on paper in fact operate to sufficiently minimize the impact on non-suspects inside or outside the United States. We do know that the government minimization procedures allow reuse of information for domestic criminal investigations.45 But even such fundamental questions as how often Americans’ information comes up in searches remain unknown despite many requests for information, including by House Committee members.46 In the words of Supreme Court Chief Justice Roberts: “The Founders did not fight a revolution to gain the right to government agency protocols.”47 It is cold comfort for our constitutional rights to rest on secret, agency-promulgated procedures with no chance for adversarial investigation or challenge.

Mr. Litt’s argument is that core protections of the Fourth Amendment itself are not suited to the digital age. He embraces broad searches of nonsuspects’ communications and suggests that the legitimacy of digital surveillance should be largely decided based on internal agency procedures, rather than constitutional principles. Yet faced with a clash between these principles and advanced technology in Kyllo v. United States, the Supreme Court reaffirmed that the doctrine must keep pace with technology to “assure[] preservation of that degree of privacy against government that existed when the Fourth Amendment was adopted.”48

The Court’s statement in Kyllo leads me to revisit where Mr. Litt and I agree. We each believe that the reasonable expectation of privacy test and the third-party doctrine should go. What should replace them? In my view, the “necessary and proportionate” formulation, which is grounded in principles of international law, can provide a means to consider a wider and more relevant range of issues. Indeed, EFF and a coalition of other organizations recently applied this formulation to communications surveillance.49 As the name implies, the necessary and proportionate principles consider the proportionality of the surveillance, including how many innocent or non-targeted people are affected, and its necessity, including whether other potentially less invasive means have been exhausted. Relevant to Mr. Litt’s concerns, this formulation also replaces the outdated lines between information stored locally and that held by third parties, and avoids the problems with the “reasonable expectation of privacy.” It focuses instead on whether the government is going to obtain otherwise private information. It uses the concept of “protected information,” which “includes, reflects, arises from, or is about a person’s communications and . . . is not readily available and easily accessible to the general public.”50

The Necessary and Proportionate Principles are just a starting point, but I submit that they are more in keeping with the Supreme Court’s admonition in Kyllo that any changes in the doctrine must preserve privacy. What is clear is that if we are going to address where the Fourth Amendment should be in the digital age, we must do better than a free-form balancing test where the government will always be perched on the heavy end of the scales, and where the substitution of computers for humans somehow eliminates our Fourth Amendment right to be secure from unreasonable seizures and searches of our most private communications.

Cindy Cohn is the Executive Director of the Electronic Frontier Foundation. Thanks to Andrew Crocker, Lee Tien, Sophia Cope, and Christine Bannan for their editorial assistance.

Preferred Citation: Cindy Cohn, Protecting the Fourth Amendment in the Information Age: A Response to Robert Litt, 126 Yale L.J. F. 107 (2016), http://www.yalelawjournal.org/forum/ protecting-the-fourth-amendment-in-the-information-age.