How Congress Unknowingly Legalized PRISM In 2007

PRISM was started under President George W. Bush. (AP)

By Timothy B. Lee

On Sept. 11, 2007, the National Security Agency signed up Microsoft as its first partner for PRISM, a massive domestic surveillance program whose existence was reported by the Washington Post today. That’s barely a month after Congress passed, and President George W. Bush signed, the Protect America Act.

The Bush Administration portrayed the PAA as a technical fix designed to close a gap in America’s surveillance capabilities that had been opened by a then-recent ruling of the secretive Foreign Intelligence Surveillance Court (FISC). It proved to be much more than that.

While the details are still classified, reports suggested that the FISC had ruled that it was illegal for the government to intercept communications between two foreign endpoints if the communications happened to pass through the United States. Warning that the U.S. would suddenly lose the ability to continue its surveillance of terrorists, the administration pushed the PAA through Congress in a matter of days.

In reality, the PAA represented a sweeping change to American surveillance law. Before conducting surveillance, the PAA only required executive branch officials to “certify” that there were “reasonable procedures” in place for ensuring that surveillance “concerns” persons located outside the United States and that the foreign intelligence is a “significant purpose” of the program. A single certification could cover a broad program intercepting the communications of numerous individuals. And there was no requirement for judicial review of individual surveillance targets within a “certified” program.

Civil liberties groups warned that the PAA’s vague requirements and lack of oversight would give the government a green light to seek indiscriminate access to the private communications of Americans. They predicted that the government would claim that they needed unfettered access to domestic communications to be sure they had gotten all relevant information about suspected terrorists.

It now appears that this is exactly what the government did. Today’s report suggests that the moment the PAA was the law of the land, the NSA started using it to obtain unfettered access to the servers of the nation’s leading online services. To comply with the requirement that the government not target Americans, PRISM searches are reportedly “designed to produce at least 51 percent confidence in a target’s ‘foreignness’” — the lowest conceivable standard. PRISM training materials reportedly instruct users that if searches happen to turn up the private information of Americans, “it’s nothing to worry about.”

The Protect America Act included a short six-month sunset provision, triggering another heated debate in the midst of the 2008 Democratic primary campaign. But that debate focused more on the past than the future. The telecom industry sought retroactive immunity for their participation in warrantless surveillance programs prior to 2007, a request Congress did not grant with the PAA.

Retroactive immunity for telecom companies dominated the 2008 debate, overshadowing the more important issue of the sweeping new powers that Congress had just granted to the executive branch. When Congress finally passed the FISA Amendments Act in July 2008, it included both immunity and a four-year extension of the government’s warrantless spying powers. But few members of Congress realized the breadth of the surveillance powers they were effectively approving.

The FISA Amandments Act was re-authorized for another five years in 2012 with little controversy. It will come up for a vote again in 2017 — though Congress could always choose to revisit it earlier.