us. FOREIGN INTELLIGENCE UNITED STATES SUHVEIUANCE COURT FOREIGN INTELLIGENCE SURVEILLANCE COURT D.C. Docket Number: OPINION AND ORDER This matter comes before the Court on an application of the Government for authority for the National Security Agency (NBA) to collect information regarding e-mail and certain other forms of Internet communications under the pen register and trap and trace provisions of the Foreign Intelligence Surveillance Act of 197$ (PISA or the Act). Title 50, United States Code (U.S.C.), 1801-1811, 1841+1846. This application seeks authority for a Derived from: Pleadin in the above--ca tioned docket neclassmy - much broader type of collection than other pen register/trap and trace applications and therefore presents issues of first impression.' For that reason, it is appropriate to explain why the Court concludes that the application should be granted as modified herein. Accordingly, this Opinion and Order sets out the bases for the Court's findings that: (1) the collection activities proposed in the application involve the installation and use of "pen registers" andfor "trap and trace devices" as those terms are used in PISA, 50 U.S.C. 1841-1846; (2) the application, which specifies restrictions on the retention, accessing, use, and dissemination of information obtained from these collection activities, "satisfies the requirements" of 50 U.S.C. 1842 for the issuance of an order "approving the installation and use of a pen register or trap and trace device," id. 1842(d}(1}, subject to modifications stated herein;' and (3) the installation and use of these pen registers and/or trap and trace devices pursuant to 1 The a lication was filed in two steps: an application filed on followed by an addendum filed on For ease of reference, the following discussion refers to both submissions collectively as the application. 2 The Court has authority in this case to "enter an ex parte order as requested, or as modified." 50 U.S.C. 1s42(d)(1). . 2 this Opinion and Order will comply with the First and Fourth Amendments. In making these findings, the Court relies on factual representations made in the application, which was submitted by the Attorney General as applicant and verified by the Director of the NSA in the separate declaration of the DIRNSA (Attachment A to the application); and in the declaration of the -- the application). The Court has given careful consideration to the arguments presented in the Government's memorandum of law and fact {Attachment to the application). By letter dated_ the Court directed the Government to respond to two questions necessary to its ruling on this application. The Court relies on the Government's responses to these questions. which were provided in a letter submitted on The Court also relies on information and arguments presented in a briefing to the Court on --which addressed the current and near-term threats posed by 3 One of these questions concerned First Amendment issues presented by the application. The other concerned the length of time that the Government expected the collected information to retain operational significance. These questions and the Government's responses are discussed more fully below. 3 investigations conducted by the Federal Bureau of Investigation to counter those threats, the proposed collection activities of the NSA (now described in the instant application), the expected analytical value of information so collected in efforts to identify and track operatives and the legal bases for conducting these collection activities under FISA's pen register/trap and trace provisions." The principal statutory issues in this matter are whether the proposed collection constitutes the installation and use of "pen registers" and/or "trap and trace devices" and, if so, whether the certification pursuant to 50 U.S.C. 1842{c){2} is adequate. These issues are addressed below. I. THE PROPOSED COLLECTION IS A FORM OF PEN REGISTER AND TRAP AND TRACE SURVEILLANCE. For purposes of 50 U.S.C. 1841-1846, FISA adopts the definitions of "pen register" and "trap and trace device" set out 4 This briefing was attended by (among others) the Attorney General; the the Director of the the Counsel to the President; the Assistant Attorney General for the Office of Legal Counsel; the Director of the Terrorist Threat Integration Center and the Counsel for Intelligence Policy. 4 4e in 18 U.S.C. 3127. See 50 U.S.C. 1841(2). Section 3127 gives the following definitions: (3) the term "pen register" means a device or process which records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, provided, however, that such information shall not include the contents of any communication, but such term does not include any device or process used by a provider or customer of a wire or electronic communication service for billing, or recording as an incident to billing, for communications services by such provider or any device or process used by a provider or customer of a wire communication service for cost accounting or other like purposes in the ordinary course of business; (4) the term "trap and trace device" means a device or process which captures the incoming electronic or other impulses which identify the originating number or other dialing, routing, addressing, and signaling information reasonably likely to identify the source of a wire or electronic communication, provided, however, that such information shall not include the contents of any communication. These definitions employ three other terms -- "electronic communication," "wire communication," and "contents" - that are themselves governed by statutory definitions "set forth for such terms in section 2510" of title 18. 18 U.S.C. 3127(1). Section 2510 defines these terms as follows: (1) "Electronic communication" is defined at 1B U.S.C. 2Sl0{l2] as "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photoopticll system that affects interstate or foreign commerce. but does not include -- (A) any wire or oral communication."5 "Wire communication" is defined at 13 U.S.C. 2510(1) E15 any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception . . . furnished or operated by any person engaged in providing or operating such facilities for the transmission of interstate or foreign communications or communications affecting interstate or foreign commerce. "Contents" is defined at 1B U.S.C. 2510(8) to "include[] any information concerning the substance, purport, or meaning" of a "wire, oral, or electronic communication."' While the definitions of "pen register" and "trap and trace device" each contain several elements, the application of these 5 The other exclusions to this definition at 5 (D) are not relevant to this case. 5 Different definitions of "wire communication" and "contents" are provided at 50 U.S.C. 1801(1), However, the definitions set forth in 1801 apply to terms used in this suhchapter," in 50 U.S.C. 1801-1811 (FISA subchapter on electronic surveillance), and thus have no bearing on the meaning of "wire communication" and "contents" as used in the definitions of "pen register" and "trap and trace device" applicable to 1841-1846 (separate FISA subchapter on pen registers and trap and trace devices). 6 definitions to the devices described in the application presents two primary questions: (1) Does the information to be obtained constitute "dialing, routing, addressing, or signaling information" that does not include the "contents" of any communication? (2) Does the means by which such information would be obtained come within the definition of "pen register" or "trap and trace device?" In addressing these questions, the Court is mindful that "when the statute's language is plain, the sole function of the courts - at least where the disposition required by the text is not absurd -- is to enforce it according to its terms-" Lamie V. United States Trustee, 124 S. Ct. 1023, 1030 (2004) (internal quotations and citations omitted}. A. The Information to Be Obtained Is "Dialing, Routing, Addressing, or Signaling Information" and Not COITC ent The Government uses the umbrella term "meta data" to dccigrate the categories of information it proposes to collect. Also, the address from which an e-mail was Sent and are not part of the e--mail's "contents." 3 This is the first a lication presented to this Court for authority to under pen register/trap and trace authority. The Court understands that FBI devices implementing prior pen register/trap and trace surveillance authorized by this Court have not obtained gag Memorandum of Law and Fact at 23-24 n.14. The fact that prior applications did not seek authority for this specific form of collection sheds no light on the merits of the instant application. 10 but this isolated fact does not provide "information concerning the substance, purport. or meaning" of the e~mail. 18 u.s.c. The DIRNSA Declaration mentions other types of information that are not described in the application as forms of meta data to be collected." The Court understands such references to pertain to information or inferences that could be gleaned from accumulating meta data in Categories - - above and/or analyzing meta data. perhaps in conjunction with information from other sources. This Opinion and Order authorizes only the collection of information in Cateqorie Ci .- The finding that the meta data do- not constitute "ccAtenL" is ale supports by essurarre that meta data "does not include information from either the 'sub'ect' or I I DIRNSA Dec aration at 3 n.1. These references in the DIRNSA Declaration include PEICBII1 emen ll B. The Methods Ev which NBA Proposes to Information Involve the Use of "Pen Req;sters" and "Trap and Trace Devices." NSA proposes to obtain meta data in the above-described categories I I I 12 Because the application of the definitions of "pen register" and "trap and trace device" to this means of collection involves a similar analysis for meta data in Categories - - groups of information are discussed separately below. 1. The Methods of Collectinq Cate_qories_ - Fall Within the Plain Meanincr of Statutorv The above-described means of collecting information in Categories - - satisfies each of the elements of the applicable statutory definition of a "pen register." It consists of "a device or pgocess which records or decodes" non-content routing or addressing information "transmitted by an instrument or facility from which a wire or electronic communication is 1 1 "Transmit" means To convey or dispatch from one person, thing, or place to another. . . . 4. Electron. To send {a signal}, as by wire or radio." Webster's II New Colleqe Picrinnafiy l171 (2001). 13 Finally, the proposed collection does not involve "any device or process used . . . for billing, or recording as an incident to billing, for communications services . . . or . . . for cost accounting or other like purposes," which is excluded from the definition of "pen register" under section 3127(3). Accordingly, based on "the language employed by Congress and the assumption that the ordinary meaning of that language accurately expresses the legislative purpose," Engine Mfrs. Ass'n v. South Coast Air Quality Mqmt. Dist., 124 S. Ct. 1756, 1761 (2004) {internal quotations and citation omitted), the Court concludes that the means by which the NSA proposes to collect for east cf ieftrencs, this Opinion and Order generally speaks of "electronic communications." The communication involved will usually be an "electronic communication" under the above-quoted definition at 18 U.S.C. 2510{12). In the event that the communication consists of an "aural transfer," "a transfer containing the human voice at any point between and including the point of origin and the point of reception," ig. 25lO{l8), then it could fall instead under the above--quoted definition of "wire communication" at 2510(1). In either case, the communication would be "a wire or electronic communication," as required to fall within the definitions at 3127(3) and 3l27(4}. -- 14 meta data in Categories - - - above falls under the definition of "pen register" at section 3127(3}. The application also seeks authority to collect at least some of the same meta data by the same means under the rubric of a "trap and trace device" as defined at section 3127(4). Although it appears to the Court that all of the collection authorized herein comes within the definition of "pen register," the Court additionally finds that such collection, as it pertains to meta data in Categories I I (for example, information from the "from" line of an e-mail), also satisfies the definition of "trap and trace device" under section 3127(4). Under section 3127(4), a "trap and trace device" is "a device or process which captures the incoming electronic or other impulses which identify the originating number or other [non- content] dialing} routing, addressing, and signaling information reasonably likely to identify the source of a wire or electronic communication." As discussed above, the proposed collection would use a device or process to obtain non-content meta data I Thus, based on the plain meaning of "Capture" is defined as, inter alia, . . . 3. To succeed in preserving in a permanent form." Webster's II New College Dictionarv 166 (2001). Sue a resu argue to vio ate oar ina princip of statutory construction that we must give effect, if possible, to every clause and word of a statute." Williams v. Taylor, 529 U.S. 362, 404 {2000) (internal quotations and citation omitted). 16 the applicable definitions, the proposed collection involves a form of both pen register and trap and trace surveillance. The Court accordingly finds that the plain meaning of sections 3127(3) and 3127(4) encompasses the proposed collection of meta data. Alternatively, the Court finds that any ambiguity on this point should be resolved in favor of including this proposed collection within these definitions, since such an interpretation would promote the purpose of Congress in enacting and amending FISA regarding the acquisition of non-content addressing information. Congress amended PISA in 1998, and again in 2001, %r1 to relax the requirements for Court--authorized surveillance to obtain non-content addressing information through pen register and trap--and--trace devices, recognizing that such information is not protected by the Fourth Amendment. page 29 below. As part of the USA PATRIOT Act in 2001, Congress also amended FISA to provide for Court orders for the production of "any tangible things," such as business records, under the same relevance standard as was adopted for pen register/trap and trace authorizations. _gg Pub. L. No. Title II, 215, 115 Stat. 290, codified at 50 U.S.C. 1861. like other forms of meta data, is not protected by the Fourth Amendment because users of e-mail do not have a reasonable expectation of privacy in such information. gee pages 59-62 below. It is a form of non-content addressing information, which Congress has determined should receive a limited form of statutory protection under a relevance standard if obtained through pen register/trap and trace devices pursuant to 50 1842, and/or through compelled production of business records toll records for 1ong--distance phone calls) under 50 U.S.C. 1861. A narrow reading of the definitions of "pen register" and "trap--and-trace device" to exclude would 19 remove this particular type of non~content addressing information from the statutory framework that Congress specifically created for it. Based on such a narrow interpretation, this information could not be collected through pen register/trap and trace surveillance, even where it unquestionably satisfies the relevance standard. Nor could this information be obtained under the business records provision, because it is not generally retained by communications service providers. page 41 below. There is no indication that Congress believed that the availability of nonvcontent addressing information under the relevance standard should hinge on the technical means of collection. If anything, the legislative history, see 147 Cong. Rec. 511000 {daily ed. Oct. 25, 2001) {statement of Sen. Patrick Leahy) {supporting clarification of "the statute's proper application to tracing communications in an electronic environment . . . in a manner that is technology neutral"), and the adootion of an identical relevance standard for the production of business records and other tangible things under section 1861, suggest otherwise. Accordingly, the Court alternatively finds that, if the application of sections 3127(3) and 3127(4) to the -- were thought to be ambiguous, such 20 ambiguity should be resolved in favor of an interpretation of the definitions of "pen register" and "trap and trace device" that encompasses the proposed collection. 3. The Proposed Collection is Consistent with other Provisions of FISA Nothing that is fairly implied by other provisions of FISA governing pen register and trap and trace surveillance would prevent authorization of the proposed collection as a form of pen register/trap and trace surveillance. One provision requires that an order authorizing a pen register or trap and trace surveillance specify "the identity, if known, of the person to whom is leased or in whose name is listed the telephone line or other facility to which the pen register or trap and trace device is to be attached or applied." 50 U.S.C. Plainly, there is no requirement to state the identity of such a person if it is not "known." However, this provision might still be read to imply that Congress expected that such facilities would be leased or listed to some particular person, even if the identity of that person were unknown in some cases. However. even if Congress had such a general expectation, the language of the statute does not require that there be such a person for every facility to which a pen register or trap and trace device is to be attached or applied. Drawing the contrary conclusion 21 from the wording of would make the applicability of the statute depend on the commercial or tdministrative practices of particular communications service providers -- a result that here would serve no apparent purpose of Congress. Qf. Smith v. Maryland, 442 U.S. 735, 745 (1979) (finding that the "fortuity of whether or not the phone company elects to make [for its own commercial purposes] a quasiv permanent record of a particular number dialed" is irrelevant to whether the Fourth Amendment applies to use of a pen register)." 1" this Similarly, for purposes of the subchapter on pen register/trap and trace surveillance, PISA defines an "aggrieved person," in relevant part, as any person "whose communication instrument or device was subject to the use of a pen register or trap and trace dEViCe . . . to capture ircoming electronic or other communications impulses." 50 U.S.C. The term "whose" suggests a relationship between some person and "a communication instrument or device" that was "sub ect to the use . . In eed, the use of different language implies that these phrases can refer to different objects, so that the definition of "aggrieved person" sheds no light on whether a "facility" under is necessarily associated with an individual user. 22 The Court is satisfied that this Opinion and Order complies with the specification requirements of The Court recognizes that, by concluding that these definitions do not restrict the use of pen registers and trap and trace devices to communication facilities associated with individual users, it is finding that these definitions encompass an exceptionally broad form of collection. Perhaps the opposite result would have been appropriate under prior statutory language." However, our "starting point" must he "the existing Prior to amendments in 2001 by the USA PATRIOT Act, Public Law 107-55, Title II, 2l6(c), 1B U.S.C. 3127(3) defined "pen register" as "a device which records or decodes electronic or other impulses which identify the numbers dialed or otherwise transmitted on the telephone line to which such device is attached," and 3127(4) defined "trap and trace device" as a "device which captures the incoming electronic or other impulses which identify the originating number of an instrument or device from which a wire or electronic communication was transmitted." 18 U.S.C.A. 3127(3), (4) Despite this textual focus on telephone communications, especially in 3127(3), many {though not all] courts cxpaniively construed both definitions to af"ly as well to e-mail communications. Memorandum of Law and at . -2r' 5-. . .) fi6? 23 statutory text," not "predecessor statutes," Lgmig, 124 S. Ct. at 1030, and analysis of that text shows that collecting information in Categories - - I above by the means described in the application involves use of "pen registers" and "trap and trace devices."" Of course, merely finding that the proposed collection falls within these definitions does not mean that the requirements for an order authorizing such collection have been met. We turn now to those requirements. After the USA PATRIOT Act: The Big Brother That Isn't, 97 Nw. U. L. Rev. 607, 633-36 (2003). Extending these prior definitions to bulk collection regarding e--mail communications would have required further departure from the pre-USA PATRIOT Act statutory language. The legislative history of the USA PATRIOT Act indicates that Congress sought to make the definitions of "pen register" and "trap and trace device" "technology neutral" by confirming that they apply to Internet communications. gee footnote 45 below. It does not suggest that Congress specifically gave thought to whether the new definitions would encompass collection in bulk from communications facilities that are not associated with individual users. The silence of the legislative history on this point provides no basis for departing from the plain meaning of the current definitions. See Sedima. S.P.R.L. v. Imrex Co., 473 U.S. 479, 495 n.l3 (1985). 24 II. THE STATUTORY REQUIREMENTS FOR ISSUING AN ORDER AUTHORIZING THE PROPOSED PEN REGISTER AND TRAP AND TRACE SURVEILLANCE HAVE BEEN MET. Under FISA's pen register/trap and trace provisions: Notwithstanding any other provision of law, the Attorney General . . . may make an application for an order . . . authorizing or approving the installation and use of a pen register or trap and trace device for any investigation to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism . . ., provided that such investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution which is being conducted by the under such guidelines as the Attorney General approves pursuant to Executive Order No. 12333, or a successor order. 50 U-S.C. This authority "is in addition to the authority . . . to conduct . . . electronic surveillance" under 1801-1811. lg. Such applications shall include, inter alia, a certification by the applicant that the information likely to be obtained is foreign intelligence information not concerning a United States person or is relevant to an ongoing investigation to protect against international terrorism . . ., provided that such investigation of a United States person is not conducted solely on the basis of activities protected by the first amendment to the Constitution. gg. "Upon an application made pursuant to this section, the judge shall enter an ex parte order as requested, or as modified, approving the installation and use of a pen register 25 or trap and trace device if the judge finds that the application satisfies the requirements of 1842]-" id. Obviously, the application has been made by the Attorney General, has been approved by the Attorney General, 1B42(c), and has been submitted in writing and under oath to a judge of this Court. 1842{h){1). The application, at 5, identifies the DIRNSA as "the Federal officer seeking to use the pen register or trap and trace device." The application also contains a certification by the Attorney General, at 26, containing the language specified in 1B42(c)(2). The Government argues that FISA prohibits the Court from engaging in any substantive review of this certification. In the Government's view, the Court's exclusive function regarding this certification would be to verify that it contains the words required by l842(c)(2); the basis for a properly worded certification would be of no judicial concern. gee Memorandum of Law and Fact at 28~34. The Court has reviewed the Government's arguments and authorities and does not find them persuasive." However, in For example, the Government cites legislative history that "Congress intended to 'authorize[] FISA judges to issue a pen register or trap and trace order upon a certification that the information sought is relevant to'" an FBI investigation. 4o 25 this case the Court need not, and does not, decide whether it would be obliged to accept the applicant's certification without any explanation of its basis. Arguing in the alternative, the Government has provided a detailed explanation of 1) the threat bulk collection described in the application is believed necessary as a means for NSA 3) how that information will contribute to FBI and 4} what safeguards will be observed to ensure that the information collected will not be used for unrelated purposes or Memorandum of Law and Fact at 30 (quoting 5. Rep. No. 105-135, at 27 (1998). However, authorizing the Court to issue an order when a certification is made, and requiring it to do so without resolving doubts about the correctness of the certification, are quite different. The Government also cites United States v. Hallmark, 911 F.2d 399 ?10" Cir. 1990), in arguing that the Court should not review the basis of the certification. However, the Hallmark court reserved the analogous issue under Title 13 - "the precise nature of the court's review under 18 U.S.C. 3123" of the relevancy certification in an application for a law enforcement pen register or trap and trace device -- and expressed "no opinion as to whether the court may, for instance. inquire into the government's factual basis for believing the pen register or trap and trace information to be relevant to a criminal investigation." at 402 n.3. 27 otherwise misused. The Government also provides legal arguments that, under these specific circumstances, the proposed collection satisfies the relevancy requirement of despite its resulting in the collection of meta data from an enormous volume of communications, the large majority of which will be unrelated to international terrorism. In view of this record, the Court will assume for purposes of this case that it may and should consider the basis of the certification under 1B42(c)(2). Nonetheless, the Court is mindful that PISA does not require any finding of probable cause in order for pen register and trap and trace surveillance to be authorized. In this regard, the statutory provisions that govern this case contrast sharply with those that apply to other forms of electronic surveillance and physical search." Before Congress amended FISA in 1998 to add 1841-1846, this Court could authorize pen register and trap and trace surveillance only upon the same findings as would be required to authorize interception of the full contents of To issue an electronic surveillance order, the Court must find "probable cause to believe that . . . the target of the electronic surveillance is a foreign power or an agent of a foreign power" and "each of the facilities or places at which the electronic surveillance is directed is being used. or is about to be used, by a foreign power or an agent of a foreign power." 50 U.S.C. Similar probable cause findings are required for warrants authorizing physical search under id. 1824(a}(3}. 28 communications. See S. Rep. 105-185, at 27 (1998). When it originally enacted 1841--1846 in 1998, Congress recognized that pen register and trap and trace information is not protected by the Fourth Amendment and concluded that a lower standard for authorization "was necessary in order to permit, as is the case in criminal investigations, the use of this very valuable investigative tool at the critical early stages of foreign intelligence and international terrorism investigations." is. These 1998 provisions included a form of a "reasonable suspicion" standard for pen register/trap and trace authorizations." As part of the USA PATRIOT Act in 2001, Congress lowered the standard again, to the current requirement of relevance." Given this history, it is obvious that Congress intended pen register Under the provisions enacted in 1998, a pen register or trap and trace application had to include "information which demonstrates that there is reason to believe" that a communication facility "has been or is about to be used in communication with," inter alia, "an individual who is engaging or has engaged in international terrorism or clandestine intelligence activities." Public Law 105-272 601(2). The legislative history of the USA reflects that, "in practice," the standard passed in 1998 was "almost as burdensome as the requirement to show probable cause required . for more intrusive techniques" and that the FBI "made a clear case that a relevance standard is appropriate for counterintelligence and counterterrorism investigations." 147 Cong. Rec. 911003 (daily ed. Oct. 25, 2001) (statement of sen. Leahy}. 29 4E and trap and trace authorizations to be more readily available than authorizations for electronic surveillance to acquire the full contents of communications. The Court also recognizes that, for reasons of both constitutional authority and practical competence, deference should be given to the fully considered judgment of the executive branch in assessing and responding to national security threats" and in determining the potential significance of intelligence- related information." Such deference is particularly See, Reno v. American-Arab Anti+Discrimination Comm., 525 U.S. 471, 491 (1999) court would be ill equipped to determine [the] authenticity and utterly unable to assess [the] adequacy" of the executive's security or foreign policy reasons for treating certain foreign nationals as "a special threat"); Regan v. Wald, 453 u.s. 222, 243 (1934) (giving "the traditional deference to executive judgment" in foreign affairs in sustaining President's decision to restrict travel to Cuba against a Due Process Clause challenge); of. Department of Navy v. Egan, 484 U.S. 518, 529 (1983) (outside body reviewing executive branch decisions on eligibility for security clearances could not "determine what constitutes an acceptable margin of error in assessing the potential risk"). The Supreme Court has observed that, in deciding whether disclosing particular information might compromise an intelligence source, what "may seem trivial to the uninformed. may appear of great moment to one who has a broad view of the scene and may put the questioned item of information in its proper context." CIA v. Sims, 471 U.S. 159, 178 (1985) (internal quotation and citation omitted). Accordingly, the decisions of "who must of course be familiar with 'the whole picture,' as judges are not, are worthy of great deference given the magnitude of the national security interests and potential --T9P 30 --T6P--SE appropriate in this context, where the Court is not charged with making independent probable cause findings. A. The Government Has Provided Information the Certification of Relevance. In support of the certification of relevance, the Government relies on the following facts and circumstances: The Threat Currentlv Posed risks at stake." at 179. For simplicity, this opinion standardizes the variant spellings of foreign names appearing in different documents submitted in support of the application. 4e%fl 31 TOP SECRET I-ICS COMINT NOFORN FBI Investigations to Track and Identif in the United States The Use of the Internet 4. The Scope of the Proposed Collection of Meta Data In an effort both to identify unknown and to track known communications, NSA seeks to acquire meta data, as described are described in detail in the application and the DIRNSA Declaration. In brief, they are: For ease of reference the term 's used to mean 35 TOP SECRET HCS COMINT NOFORN The raw volume of the proposed collection is enormous. NSA estimates that this collection will encompass terms, the proposed surveillance "will result in the collection of meta data pertaining to electronic communications, including meta data pertaining to communications of United States persons located within the United States who are not the subject of any FBI investigation." Application at 4. some proportion of these communications -- less than half, but still a huge number in absolute terms -- can be expected to be communications 39 - W110 bear no relation to How NSA Progoses to Use this Data to Track Known. As noted above, the purpose of this collection is to track known operatives and to identify unknown operatives of thr-sugh their Internet communications. NSA 1 ction of meta data from - 40 states that even identified operatives Through the proposed bulk collection, NSA would acquire an archive of meta data for large volumes of communications that, in NSA's estimation, represent a relatively rich environment for finding communications through later analysis .31 41 NSA asserts that more precisely targeted forms of collection against known accounts would_tend to screen out the "unknowns" that NSA.wants to discover, so that NSA needs bulk collection in order to identify unknown--communications. id. at 14 ("It is not possible . . . to target collection solely to known terrorist Ermail accounts and at the same time use the advantages of meta data analysis to discover the 15 ("To be able to fully exploit meta data, the data must be collected in bulk. know that terrorists' E-mails are located somewhere in the billions of data bits; what they cannot know ahead of time is exactly where.") NBA proposes to employ two analytic methods on the body of archived meta data it seeks to collect. Both these methods involve querying the archived meta data regarding a particular "seed" account. In the Government's proposal, an account would qualify as a seed account only if NSA concludes, "based on the factual and practical considerations of everyday life on which reasonable and prudent persons act, there are facts giving rise to a reasonable articulable suspicion that a particular known e- 42 Application at 19-20; accord DIRNSA Declaration at 19. The two methods are: (1) Contact chaininq. NBA will use computer algorithms to identify within the archived meta data all e-mail -- accounts that have been in Contact with the seed account. as well as all accounts that have been in contact with an account within the first tier of accounts that had direct contact with the seed account, and DIRNSA Declaration at 15-16. 43 An example may illustrate the claimed benefits of bulk collection and subsequent analysis of meta data. Without an archive of meta data, the Government could target prospective collection on that account, but information about past use would be unavailable. However, if an archive of meta data were available, NBA could use the newly discovered account as a "seed" account. Accounts previously in contact with the "seed" account could be identified and further investigation could be pursued to determine if the users of those accounts a Assuming that applicable legal requirements could be met, the Government also could collect the full contents of future messages by electronic surveillance of the account and of stored prior sen 1 However, 44 These avenues of discovery made possible by archived meta data provide the basis for NSA's assertion that bulk collection to accumulate a meta data archive "will substantially increase NSA's DIRNSA Declaration at 15. 6. How FBI Investigations would Benefit from the NSA's Collection and Analvsis The Government asserts that NSA's collection and analysis of this meta data will be relevant to BI investigations in two ways. First, ongoing FBI investigations may develop grounds for reasonable suspicion that particular accounts are used in furtherance of - The FBI may identify such accounts to NBA for use as "seed" accounts. Using the methods described above, NSA may obtain from the aiohivefl data other accounts that are in contact with. or appear to have the same user as, the "seed" account. This information may then be passed to the FBI as investigative leads in furtherance of its investigation. Memorandum of Law and Fact at 27-28. Alternatively, NSA.querying of the archived meta data based on information from sources other than the FBI may identify accounts that appear to he used by someone involved in -- 45 --activities. If such accounts are relevant to FBI investigative responsibilities for example, if it appears that their users are in the United States -- then NBA will provide information to the FBI, which may prove relevant to ongoing FBI investigations or provide the predicate for new investigations of persons involved i Under the proposed program, NSA estimates that roughly 400 accounts would be "tipped" to the FBI and annually, with an estimated twenty-five percent of that number associated with U.S. persons. DIRNSA Declaration at 20. 7. The Government's Proposed Procedures for Accessing, Retaining. and Disseminating Collected Information The application specifies proposed procedures and restrictions for accessing, retaining, and disseminating information from this bulk collection of meta data. Application at 18-24. These procedures and restrictions, with certain modifications, u-fl set out at pages 82-87 below. As long as the proposed collection satisfies the standard of relevance to an FBI investigation described in section ls42{a}{1}, dissemination of information to other agencies when it is relevant to their responsibilities is agpr-griitc. B. The Information_Io Be Obtained is Likelv to be Relevant to Onqoino FBI Investiqations to Protect Aqainst International Terrorism As shown above, the application and supporting materials demonstrate that the FBI has numerous pending investigations on subjects and that a major challenge faced by the FBI is the identification of within the The application and DIRNSA declaration provide detailed explanations of why NSA regards bulk collection of meta data as necessary for contact chaining and how those analytical methods can be expected to uncover and monitor unknown who could otherwise elude detection. The also explains why NBA has chosen the proposed- and selection criteria in order to build a meta data archive that will be, in relative terms. richly populated with related communications. On each of these points, the Court has received sufficient information to conclude that the Government's assessments are fully considered and plausibly grounded in facts submitted to the Court. Accordingly, the Court accepts for purposes of this application that the proposed bulk collection of meta data is necessary for NSA to employ contact chaining The Court similarly accepts that those analytic tools are likely to generate useful investigative leads for ongoing efforts by the FBI (and other agencies) to identify and track- potentially including unidentified operatives in place to facilitate or execute imminent large scale attacks within the United States. The question remains whether these circumstances adequately support the certification that "the information likely to be obtained . . . is relevant to an ongoing investigation to protect against international terrorism," even though only a very small percentage of the information obtained will be from --communications and therefore directly to such an investigation. As the Government points out, the meaning of "relevant" is broad enough, at least in some contexts. to encompass information that may reasonably lead to the discovery of directly relevant information. Memorandum of Law and Fact at 34. Here, the bulk collection of meta data -- the collection of both a huge volume and high percentage of unrelated communications -- is necessary to identify the much smaller number of--communications. The Court is persuaded that, in the circumstances of this case, the scope of the proposed collection is consistent with the certification of relevance." In so finding, the Court concludes that, under the circumstances of this case, the applicable relevance standard does not require a statistical "tight fit" between the volume of proposed collection and the much smaller proportion of information that will be directly relevant to" The Government analogizes this case to ones in which the Court has authorized overbroad electronic surveillance under 50 U.S.C. 1801-1811. Memorandum of Fact and Law at 42-43. The Court has authorized the latter form of collection where it is not technologically possible to acquire situations are similar in that they both involve collection of an unusually large volume of non--foreign intelligence information as a necessary means of obtaining the desired foreign intelligence information. Yet there are also important differences between these cases. An overbroad electronic surveillance under 50 U.S.C. 1801-1811 requires probable cause to believe that the target is an agent of a foreign power and uses the particular facility at which surveillance will be directed. lBO5{a){3). In this case under 50 U.S.C. 1841-1846, no probable cause findings are required, and the bulk collection is justified as necessary to discover unknown persons and facilities, rather than to acquire communica ions to and from identified agents of a foreign power. Because of these differences, the authorization of bulk collection under 1841- 1846 should not be taken as precedent for similar collection of the full contents of communications under 1801-1811. investigations. In reaching this conclusion, the Court finds instructive Supreme Court precedents on when a search that is not predicated on individualized suspicion may nonetheless be reasonable under the Fourth Amendment. Memorandum of Law and Fact at 43-48." The Supreme Court has recognised a "longstanding principle that neither a warrant nor probable cause, nor, indeed, any measure of individualized suspicion, is an indispensable component of reasonableness in every circumstance." National Treasurv Emplovees Union v. Von Raab, 439 U.S. 656, 665 (1989); accord, Board of Educ. of Indeg. School.Dist. No. 92 of Pottawatomie County v. Earls, 536 U.S. B22, B29 (2002); United States v. Martinez--Fuerte, 428 U.S. 543, 560-61 (1976). specifically, the Court has held that, "where a Fourth Amendment intrusion serves special governmental needs, beyond the normal need for law enforcement, it is necessary to balance the individual's privacy expectations against the Government's For the reasons explained below at pages 59-65, the Court finds that there is no privacy interest protected by the Fourth Amendment in the meta data to be collected. Nevertheless, the Court agrees with the Government's suggestion that the balancing methodology used to assess the reasonableness of a Fourth Amendment search or seizure is helpful in applying the relevance standard to this case. Memorandum of Law and Fact at 50 interests to determine whether it is impractical to require a warrant or individualized suspicion in the particular context." Von Raab, 489 U.S. at 665-66; accordr Earls. 536 U.S. at 829. This balancing analysis considers "the nature of the privacy interest allegedly compromised" and "the character of the intrusion" upon that interest. Earls, 536 U.S. at B30, 832. The privacy interest in the instant meta data is not of a stature protected by the Fourth Amendment. gee pages 59-66 below. Moreover, the nature of the intrusion is mitigated by the restrictions on accessing and disseminating this information, under which only a small percentage of the data collected will be f. Earls, 536 U.S. at B33 {finding that seen by any person. restrictions on access to drug-testing information lessen the testing program's intrusion on privacy}. The assessment of reasonableness under the Fourth Amendment also considers "the nature and immediacy of the go:ernment's concerns and the efficacy of the [program] in meeting them." at 834. In this case, the Government's concern is to identify and track--operatives, and ultimately to thwart terrorist attacks. This concern clearly involves national 51 security interests beyond the normal need for law enforcement" and is at least as compelling as other governmental interests that have been held to justify searches in the absence of individualized suspicion. See. Earls (drug testing of secondary school students engaged in extracurricular activities); Michigan Den't of State Police v. Site, 496 U.S. 444 (1990) (highway checkpoints to identify drunk drivers); Von Raab (drug testing of Customs Service employees applying for promotion to sensitive positions); Skinner v. Railway Labor Executives' Ass'n, 489 U.S. 602 (1989) (drug and alcohol testing of railroad workers)." The Government's interest here has even greater "immediacy" in view of the above-described intelligence reporting and assessment regarding ongoing plans for large scale attacks within the United states. As to efficacy under the Fourth Amendment analysis, the Government need not make a showing that it is using the least intrusive means available. Earls, 536 U.S. at 837; Martinez- gee In Re Sealed Case, 310 F.3d 717, 744+46 (Foreign Int. Surv. Ct. Rev. 2002} (per curiam) (discussing the prevention of terrorist attacks as a special need beyond ordinary law enforcement). Moreover, the Government's need in this case could be analogized to the interest in discovering or preventing danger from "latent or hidden conditions," which may justify suspicionless searches- $eeL_e.q., Von Raab, 489 U.S. at 568. 46 52 -- Fuerte, 428 U.S. at 556-57 n.12. Rather, the question is whether the Government has chosen "a reasonably effective means of addressing" the need. Earls, 536 U.S. at 837. In structuring a program involving suspicionless search or seizure, in positioning roadblocks at certain points, "the choice among reasonable alternatives remains with the governmental officials who have a unique understanding of, and a responsibility for, limited public resources." gitg, 496 U.S. at 453-54; see also Martinez-Fuerte, 428 U.S. at 565 ("deference is to be given to the administrative decisions of higher ranking officials"). A low percentage of positive outcomes among the total number of searches or seizures does not necessarily render a program ineffective." In this case, senior responsible officials, whose judgment on these matters is entitled to deference, see pages 30-31 above, have articulated why they believe that bulk collection and archiving of meta data are necessary to identify and monitor . _operatives whose Internet communications would gee Sitz, 496 U.S. at 454 ("detention of the 126 vehicles that entered the checkpoint resulted in the arrest of two drunken drivers"); Martinez--Fuerte, 423 U.S. at 546 n.1, S54 (checkpoint near border to detect illegal migrants: out of "roughly 145,000 vehicles" temporarily "'seized.'" 171 were found to contain deportable aliens). S3 otherwise go undetected in the huge streams of- These officials have also explained why they - identified in the application. Based on these explanations, the proposed collection appears to be a reasonably effective means to this end. In summary, the bulk collection proposed in this case is analogous to suspicionless searches or seizures that have been upheld under the Fourth Amendment in that the Government's need is compelling and immediate, the intrusion on individual privacy interests is limited, and bulk collection appears to be a reasonably effective means of detecting and monitoring- related operatives and thereby obtaining information likely to be - to ongoing FBI investigations. In these circumstances, the certification of relevance is consistent with the fact that only a very small proportion of the huge volume of information collected will be directly relevant to the investigations. 39 Qfi. Martinez--Fuerte, 428 U.S. at 557 (requiring ieasohablc F"?pifiion For stews at highway aheckpoints "on major . . . '7 5 .11 (vf tends to be too heavy to allow the particularized study of a given cor"). 54 C. The Pertinent FBI Investigations of U.S. Persons Are Not Conducted solely Upon the Basis of First Amendment Activities. when the information likely to be obtained concerns a U.S. person, requires a certification that the "ongoing investigation . . . of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution." The certification in this case states that the pertinent investigation is not being conducted on such a basis. Application at 26. The application refers to numerous FBI National Security investigations "being conducted under guidelines approved by the Attorney General pursuant to Executive Order No. at 6. Those investigations are being conduc basis of activities of and unknown affiliates in the United States and abroad, and to the extent these subjects of investigation are United States persons, not solely on the basis of activities that are protected by the First Amendment to the Constitution. Thus. the certification and application contain the proper assurance that the relevant investigations of U.S. persons are 1B42(a)(l) permits the filing of applications for installation and use of pen register and trap and trace devices to obtain information relevant to certain investigations "under such guidelines as the Attorney General approves pursuant to Executive Order No. 12333, or a successor order." 55 -- not being conducted solely on the basis of activities protected by the First Amendment. However. the unusual breadth of this collection and its relation to the pertinent FBI investigations calls for further attention to this issue. In the usual case, the FBI conducts pen register and trap and trace surveillance of a particular communications facility a phone number or mail address) because it carries communications of a person who is the subject of an FBI investigation. The required certification typically varies depending on whether the subject is a U.S. person: if not, the certification will state. in the language of that the information likely to be obtained "is foreign intelligence information not concerning a United states person;" if the subject is a U.S. person, the certification will state that such information is "relevant to an ongoing investigation to protect against international terrorism ., provided that such investigation of a United States person is not conducted solely upon the basis of activities protected hv the first amendment to the Constitution." This usual practice conforms to the clear statutory purpose that pen register/trap and trace information about the communications of U.S. persons will not be targeted for collection unless it is relevant to an I 56 investigation that is not solely based upon First Amendment activities. In this case, the initial acquisition of information is not directed at facilities used by particular individuals of investigative interest, but meta data concerning the communications oi -- -- purpose is best effectuated at the querying stage, since it will be at a point that an analyst queries the archived data that information concerning particular individuals will first be compiled and reviewed. Accordingly, the Court orders that NSA apply the following modification of its proposed criterion for querying the archived data: qualify as a seed --only if NSA concludes, based on the factual and practical considerations of everyday life on which reasonable and prudent persons act, there are facts giving rise to a reasonable articulable suspicion that a particular know:-1' believed to be used bv a U.S. Derson shall not be regarded as solelv on the basis of activities that are protected bv the First i' 1 57 Amendment to the Constitution." For example, an e-mail account used by a U.S. person could not be a seed account if the only information thought to support the belief that the account is associated with' is that, in sermons or in postings on a web site, the U.S. person espoused jihadist rhetoric that fell short of "advocacy . . . directed to inciting or producing imminent lawless action and . . . likely to incite or produce such action." Brandenberg v. Ohio, 395 U.S. 444, 447 (1969) [per curiam). THE PROPOSED COLLECTION AND HANDLING OF META DATA DO NOT VIOLATE THE FIRST OR FOURTH AMENDMENTS. Because this case presents a novel use of statutory authorities for pen register/trap and trace surveillance, the Court will also explain why it is.satisfied that this surveillance comports with the protections of the Fourth Amendment and the First Amendment. A. Eougph Amendment Issues The foregoing analysis has observed at various points that the Fourth Amendment does not apply to the proposed collection of This modification will realize more fully the Government's suggestion that "[t]he information actually viewed by any human being . . . will be just as limited -- and will be based on the same targeted, individual standards -- as in the case of an ordinary pen register or tra and trace device." Government's Letter meta data. see, pages 19, 50-51 above. This section explains the basis for that conclusion. First, as a general matter, there is no reasonable expectation of privacy under the Fourth Amendment in the meta data to be collected. This conclusion follows directly from the reasoning of Smith v. Marvland, 442 U.S. 735 (1979), which concerned the use of a pen register on a home telephone line. In that case, the Supreme Court found that it was doubtful that telephone users had a subjective expectation of privacy in the numbers they dialed, id. at 742-43, and that in any case such an expectation "is not 'one that society is prepared to recognize as reasonable.'" at 743 [quoting Kat: v. United States, 339 U.s. 34?, 361 (1967)). The Court "consistently has held that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties," since he "assume[s] the risk" that the third party would reveal that information to the government. at 743-44." The Court found this principle applicable to dialed phone numbers, regardless of the automated means by which the call is placed and the "fortuity of whether or This principle applies even if there is an understanding that the third party will treat the information as confidential. See SEC v. Jerrv T. O'Brien. Inc., 467 U.S. 735, 743 (1934); United States V. Miller, 425 U.S. 435, 443 (1976). 59 not the phone company in fact elects to make a quasi-permanent record of a particular number dialed." is. at 744-45." The same analysis applies to the meta data involved in this application. Users of e--mai voluntarily expose addressing information for communications they send and receive to communications service providers. Having done so, they lack any legitimate expectation of privacy in such information for Fourth Amendment purposes." Moreover, the relevant statutes put this form of pen register/trap and trace surveillance on a par with pen register/trap and trace surveillance of telephone calls, on the While Smith involved a pen register, its reasoning equally applies to trap and trace devices that capture the originating numbers or' incoming calls. States v. Hallmark, 911 F.2d 399, 402 (l0" Cir. 1990). Qt. Guest v. Leis, 255 F.3d 325, 335-36 Cir. 2001] (users of computer bulletin board service lacked reasonable expectation of privacy in subscriber information that they provided to systems operator); United States v. Kennedv, 81 F.Supp.2d 1103, 1110 (D. Kan. 2000) {no reasonable expectation of privacy in subscriber information provided to United v. Hambrick, 55 F.Supp.2d 504, 508-09 Va. 1999} (no reasonable expectation of privacy in screen name and other information provided to ISP), aff'd, 225 F.3d 656 Cir. 2000} (Table). 60 premise that neither form of surveillance involves a Fourth Amendment search or seizure." This conclusion is equally well-founded for the proposed Smith analysis depends on the fact that a telephone pen register acquires addressing information for a call while it is being placed, rather than from Indeed, the controlling principle that voluntary disclosure of information to a third party vitiates any legitimate expectation that the third party will not provide it to the government -- has been applied to records See T. O'Brieni lnc., 467 U.S. at 743 {records of prior stock The USA PATRIOT Act amended 18 U.S.C. 3127 to clarify that its definitions of "pen register" and "trap and trace device" applied to Internet communications. gee Public Law 107- 56, Title II, 216(c); 147 Cong. Rec. 311000 {daily ed. Oct. 25, 2001) (statement of Sen. Leahy} (noting that prior statutory language was "il1--equipped" for Internet communications and supporting clarification of "the statute's proper application to tracing communications in an electronic environment . . . in a manner that is technology neutral"). Authorization to install su"h devices requires relevance to an investigation, but not any showing of probable cause. gee 18 U.S.C. (ordinary criminal investigation}; 50 U.S.C. (investigation conducted under guidelines approved under Executive Order 12333}. ew--m 61 Mmem% trading); Miller, 425 U.S. at 436-38, 443 (checks, deposit slips, and other bank recordsl." For these reasons, it is clear that, in ordinary circumstances, pen register/trap and trace surveillance of Internet communications does not involve a Fourth Amendment search or seizure. However, since this application involves unusually broad collection and distinctive modes of analyzing information, the Court will explain why these special circumstances do not alter its conclusion that no Fourth Amendment search or seizure is involved. First, regarding the breadth of the proposed surveillance, it is noteworthy that the application of the Fourth Amendment depends on the government's intruding into some individual's reasonable expectation of privacy. Whether a large number of persons are otherwise affected by the government's conduct is irrelevant. Fourth Amendment rights "are personal in nature, and cannot bestow vicarious protection on those who do not have 2 reasonable expectation of privacy in the place to be searched." 62 Steaqald v- United States, 451 U.S. 204, 219 (1981); accord, Rakes v- Illinois, 439 U.S. 128, 133 (1978) ("'Fourth Amendment rights are personal rights which . . . may not be vicariously (quoting Alderman v. United States, 394 U.S. 165, 174 (1969))- Since the Fourth Amendment bestows "a personal right that must be invoked by an individual," a person "claim[ing] the protection of the Fourth Amendment . . . must demonstrate that he personally has an expectation of privacy in the place searched, and that his expectation is reasonable." Minnesota v. Carter, 525 U.S. 83, 88 (1998). So long as no individual has a reasonable expectation of privacy in meta data, the large number of persons whose communications will be subjected to the proposed pen registerXtrap and trace surveillance is irrelevant to the issue of whether a Fourth Amendment search or seizure will occur. Regarding the proposed analytical uses of the archived meta not immediately available from conventional pen register/trap and 63 trace surveillance might itself implicate the Fourth Amendment." However, that suggestion would be at odds with precedent that the subsequent use of the results of a search cannot itself involve an additional or continuing violation of the Fourth Amendment. For example, in United States v. Calandra, 414 U.S. 33B (1974), it was argued that each question before a grand jury "based.on evidence obtained from an illegal search and seizure constitutes a fresh and independent violation of the witness' constitutional rights," and that such questioning involved "an additional intrusion" into the privacy of the witness "in violation of the The public disclosure of aggregated and compiled data has been found to impinge on privacy interests protected under the Freedom of Information Act (FOIA), even if the information was previously available to the public in a scattered, less accessible form. gee United States Dept. of Jusgice v. Reporters Comm. for Freedom of the Press, 439 U.S. 749 (1989) (FBI "rap sheets," including public--record information on arrests and disposition of criminal charges, qualified for "personal privacy" exemption from disclosure under FOIA, 5 U.S.C. but cf. Paul v. Davis, 424 U.S. 693, 712-13 (1976) (circulating a flyer publicizing an arrest for shoplifting did not violate constitutional right to privacy). In this case, because section 1842 authorizes the Attorney General to apply for pen registerftrap and trace authorities "[n]othwithstanding any other provision of law," 50 U.S.C. and states that the Court "shall enter an ex parte order . . . approving the installation and use of a pen register or trap and trace device" upon a finding "that the application satisfies the requirements of [section 1842]," ig, 1B42(d)(l), the Court has no need to consider how other statutes, such as the Privacy Act, 5 U.S.C. 552a, might apply to the proposed activities of the Government. --ma4 64 Fourth Amendment." 414 U.S. at 353 n.9 (internal quotations omitted). The Court rejected this argument, explaining: The purpose of the Fourth Amendment is to prevent unreasonable governmental intrusions into the privacy of one's person, house, papers, or effects. . . . That wrong . . . is fully accomplished by the original search without probable cause. Grand jury questions based on evidence obtained thereby involve no independent governmental invasion of one's person, house, papers, or effects . . . . Questions based on illeqallv obtained evidence are onlv a derivative use of the product of a past unlawful search and seizure. Thev work no new Fourth Amendment wrong. 414 U.S. at 354 {emphasis added); accord United States v. Verdugo-Urguidez, 494 U.S. 259, 264 (1990); United States v. Leon, 468 U.S. B97, 906 (1984); see also United States v. Jacobsen, 466 U.S. 109, 117 (1984) ("Once frustration of the original expectation of privacy occurs, the Fourth Amendment does not prohibit governmental use of the now nonprivate In this case, sophisticated analysis of archived meta data may yield more information ab:ut a person's Internet communications than what would at first be apparent. Nevertheless, such analysis would, like the grand jury questioning in Calandra, involve merely a derivative use of information already obtained, rather than an independent governmental invasion of matters protected by the Fourth 4 65 Amendment. Accordingly, the Court finds that the proposed collection and analysis does not involve a search or seizure under the Fourth Amendment. B. First Amendment Issues By letter dated-- the Court asked the Government to address "the general First Amendment implications of collecting and retaining this large volume of information that is derived, in part, from the communications of U.S. persons." In response, the Government acknowledges that surveillance that acquires "the contents of communications might in some cases implicate First Amendment interests, in particular the freedom of association," Government's Letter of-- at 1, but denies or minimizes the First Amendment implications of surveillance that only acquires non-content addressing information. The weight of authority supports the conclusion that Government information-gathering that does not constitute a Fourth Amendment search or seizure will also comply with the First Amendment when conducted as part of a good--faith criminal investigation. See Renorters Comm. for Freedom of the Press v. 593 F.2d 1030, 1051 Cir. 1978) (First Amendment protects activities "subject to the general and incidental 66 49 burdens that arise from good faith enforcement of otherwise valid criminal and civil laws that are not themselves" directed at First Amendment conduct; accordingly, subpoenas to produce reporters' telephone toll records without prior notice did not violate the First Amendment) (emphasis in original); United States v. Aguilar, 333 F.2d 662, 705 cir. 1939) {use of undercover informants "to infiltrate an organization engaged in protected first amendment activities" must be part of investigation "conducted in good faith; not for the purpose of abridging first amendment freedoms"); United states v. Gering, 716 F.2d 615, 620 Cir. 1983) {mail covers targeting minister at residence and church upheld against First Amendment challenge absent showing "that mail covers were improperly used and burdened . . . free exercise or associational rights"). Conversely, all investigative techniques are subject to abuse and can conceivably be used to oppress citizens and groups, rather than to further proper law enforcement goals. In some cases, bad faith use of these techniques may constitute an abridgment of the First Amendment rights of the citizens at whom they are directed. Reporters Comm., 593 F.2d at 1064." Part of Judge Wilkey's opinion in Reporters Qomm, categorically concludes that the First Amendment affords no protections against government-investigation beyond what is s@4a 67 Here, the proposed collection of meta data is not for ordinary law enforcement purposes, but in furtherance of the compelling national interest of identifying and tracking- and ultimately of thwarting terrorist attacks. The overarching investigative effort against- is not aimed at curtailing First Amendment activities and satisfies the "good faith" requirement described in the above- cited cases. However, the extremely broad nature of this collection carries with it a heightened risk that collected information could be subject to various forms of misuse, potentially involving ahridgement of First Amendment rights of innocent persons. For this reason, special restrictions on the accessing, retention, and dissemination of such information are necessary to guard against such misuse. gee pages below. with such restrictions in place, the proposed collection of non- provided by the Fourth and Fifth Amendments. id. at 1053w60. However, that part of the opinion was not joined by the other judge in the majority, who opined that the result of First Amendment analysis "may not always coincide with that attained by application of Fourth Amendment doctrine." ig. at 1071 n.4 (Robinson, J.). 68 content addressing information does not violate the First Amendment." IV. TO ENSURE LAWFUL IMPLEMENTATION OF THIS SURVEILLANCE AUTHORITY, NSA IS ORDERED TO COMPLY WITH THE PRGPOSE. RESTRICTIONS AND PROCEDURES, AS MODIFIED BY THE COURT. The proposed collection involves an extraordinarily broad implementation of a type of surveillance that Congress has regulated by statute, even in its conventional, more narrowly targeted form. To ensure that this authority is implemented in a lawful manner, NSA is ordered to comply with the restrictions and procedures set out below at pages 82-87, which the Court has adapted from the Government's application." Adherence to them The court in Paton v. La Prade, 459 F. Supp. 773, 780-82 (D.N.J. 1978), held that a mail cover on a dissident political organization violated the First Amendment because it was authorized under a regulation that was overbroad in its use of the undefined term "national security." In contrast, this pen register/trap and trace surveillance does not target a political group and is authorized pursuant to statute on the grounds of relevance to an investigation to protect against "international terrorism," a term defined at 50 U.S.C. laoltc). This definition has been upheld against a claim of First Amendment overbreadth. gee United States v. Falveg, 540 F. Supp. 1306, 1314-15 (E.D.N.Y. 1982). The principal changes that the Court has made from the procedures described in the application are the inclusion of a "First Amendment proviso" as part of the "reasonable suspicion" standard for an be used as the basis for querying archived meta data, see pages 57-58 above, the adoption of a date after which meta data may not be retained, gag pages 70-71 below, and an enhanced role for the NSA's Office of --4 69 will hulp EHLHTE that this information is used for the stated purpose of its collection - the identification and tracking of. their Internet communications - thereby safeguarding the continued validity of the certification of relevance under 1B42(c)(2). These procedures will also help effectuate 50 u.s.c. which directs that no information from a Court-authorized pen register or trap and trace device "may be used or disclosed by Federal officers or employees except for lawful purposes," and ensure that such use and disclosure will not abridge First Amendment rights. The Court's letter of -- asked the Government to explain "[f]or how long . . . the information collected under this authority [would] continue to be of operational value to the counter-terrorism investigation(s) for which it is collected." The Government's letter of-- stated that such information "would continue to be of significant operational value for at l=ast 18 months," based on NSA's "analytic judgment." _Letter at 3. During that period, meta General Counsel in the implementation of this authority, see pages 84-85 below. The Court recognizes that, as circumstances change and experience is gained in implementing this authority, the Government may propose other modifications to these procedures. 70 data would be available to online for authorized querying. After 13 months, NSA "believes that there continues to be operational value in retaining e-mail meta data . . . in an 'off-line' storage system," since "in certain circumstances" information of that age could "provide valuable leads for the investigation into However, the value of such information "would diminish over time," so that assesses that meta data would have operational value in off--line storage for a period of three years, and could be destroyed after that time (that is, a total of four and one-half years after it was initially collected)." lg. In accordance with this assessment, NBA is ordered to destroy archived meta data collected under this authority no later than four and one-half years after its initial collection. it it it Accordingly, a verified application having been made by the Attorney General of the United States for an order authorizing installation.and use of pen registers and trap and trace devices pursuant to the Foreign Intelligence Surveillance Act of 1978 (FISH or the Act), Title 50, United States Code (U.S.C.), 1841-1846, and full consideration having been given 71 to the matters set forth therein, the Court finds, on the grounds explained above, that: 1. The Attorney General is authorized to approve applications for pen registers and trap and trace devices under the Act and to make such applications under the Act. 2. The applicant has certified that the information likely to be obtained from the requested pen registers and trap and trace devices is relevant to an ongoing investigation to protect against international terrorism that is not being conducted solely upon the basis of activities protected by the First Amendment to the Constitution. United States and abroad are the subjects of National Security investigations conducted by the Federal Bureau of Investigation (FBI) under guidelines approved by the Attorney General pursuant to Executive Order No. 12333. 4. The pen registers and trap and trace devices- that at 52 The Government has re resented that it is overwhelmin 1 likely The Government has re resented that it is overwhelmingly TOP '75 The Government has represented that the majorit Because electronic communications will TOP SECRET HCS COMINT NOFORN TOP SECRET HCS COMINT NDFORN WHEREFORE, the Court finds that the application of the United States registers and trap and trace devices, as described in the application, satisfies the requirements of the Act and specifically of 50 U.S.C. 1842 and, therefore, IT IS HEREBY ORDERED, pursuant to the authority conferred on this Court by the Act, that the application is GRANTED, AS MODIFIED HEREIN, and it is FURTHER ORDERED, as follows: (1) Installation and use of pen registers and trap and trace devices as requested in the Government's application is authorized for a period of ninety days from the date of this Opinion and Order, unless otherwise ordered by this Court, as follows: installation and use of pen registers and/or trap and 80 trace devices as described above to collect all addressing and routing information reasonably likely to identify the sources or destinations of the electronic communications identified EDOVE on Collection of the contents of such communications as defined by 18 U.S.C. 2510(8) is not authorized. identified above, including the "from," The authority granted is within the United States. (3) As requested in the application -(specified persons) are directed to furnish the NSA with 57 Although the application makes clear that the assistance of these specified persons is contemplated, it does not expressly request that the Court direct these specified persons to assist the surveillance. However, because the application, at 24, requests that the Court enter the proposed orders submitted with the application and those proposed orders would direct the specified persons to provide assistance, the application effectively requests the Court to direct such assistance. flfifis 81 4 any information. facilities, or technical assistance necessary to accomplish the installation and operation of pen registers and trap and trace devices in such a manner as will protect their secrecy and produce a minimum amount of interference with the services each specified person is providing to its subscribers. Each specified person shall not disclose the existence of the investigation or of the pen registers and trap and trace devices to any person, unless or until ordered by the Court, and shall maintain all records concerning the pen registers and trap and trace devices, or the aid furnished to the NSA, under the security procedures approved by the Attorney General will be furnished to each specified person and are on file with this Court. (4) The NBA shall compensate the specified person{s} referred to above for reasonable expenses incurred in providing zuch assistance in connection with the installation and use of the pen registers and trap and trace devices herein. (5) The NBA shall follow the following procedures and restrictions regarding the storage. accessing, and disseminating of information obtained through use of the pen register and trap and trace devices authorized herein: --T B2 a. The NBA shall store such information in a manner that ensures that it will not be commingled with other data. b. The ability to access such information shall be limited to ten specially cleared and to specially cleared administrators. The NSA shall ensure that the mechanism for accessing such information will automatically generate a log of auditing information for each occasion when the information is accessed, to include the accessing user's login, IP address. data and time, and retrieval request. c. Such information shall be accessed only through queries using the contact chaining methods described at page 43 above. Such queries shall be performed only on the basis of a particular known -after the NSA has concluded, based on the factual and practical considerations of everyday life on which reasonable and prudent persons act, that there are facts giving rise to a reasonable articulable suspicion that he need bv 3 *:-erscn Fl shall. latati with 83 activities that are protected by the First Amendment to the Constitution. Queries shall only be conducted with the approval of one of the following NSA officials: the Program Manager, Counterterrorism Advanced Analysis; the Chief or Deputy Chief, Counterterrorism Advanced Analysis Division; or a Counterterrorism Advanced Analysis Shift Coordinator in the Analysis and Production Directorate of the Signals Intelligence Directorate. d. Because the implementation of this authority involves distinctive legal considerations, Office of General Counsel shall: i} ensure that with the ability to access such information receive appropriate_training and guidance regarding the querying standard set out in paragraph c. above, as well as other procedures and restrictions regarding the retrieval, storage, and dissemination of such information. ii) monitor the designation of individuals with access to such information under paragraph b. above and the functioning of the automatic logging of auditing information required by paragraph b. above. 4 84 to ensure appropriate consideration of any First Amendment issues, review and approve proposed queries of meta data in online or "off-line" storage based on seed accounts used by U.S. persons." e. The NSA shall apply the Attorney General-approved guidelines in United States Signals Intelligence Directive 18 (Attachment to the application) to minimize information concerning U.S. persons obtained from the pen registers and trap and trace devices authorized herein. Prior to disseminating any U.S. person information outside of the NBA, the Chief of Customer Response in the NSA's Signals Intelligence Directorate shall determine that the information is related to counterterrorism information and is necessary to understand the counterterrorism information or to assess its importance. f. Information obtained from the authorized pen registers and trap and trace devices shall be available The Court notes that, in conventional pen register/trap and trace surveillances, there is judicial review of the this case, the analogous ecision use a par 1cu ar evmai as a seed account takes place-- In these circumstances, it shall be incumbent on NSA's 0 ice of General Coun<