Snowden disclosures and NSA surveillance reform

Snowden disclosures force limits on bulk telephone collection without ending foreign-intelligence surveillance

On 5 June 2013 the Guardian disclosed a secret court order requiring Verizon Business Network Services to provide the US National Security Agency with telephone metadata. The disclosure brought an ongoing system of bulk domestic phone-record collection to public attention. People whose calling patterns were gathered were not necessarily suspected of wrongdoing: the rationale for collection was that large datasets could later be searched for intelligence leads. The resulting invasion of ordinary people's communications privacy connected expansion of the surveillance state with the scale of digital surveillance. The disclosures also challenged the public's ability to scrutinise decisions that had been made through classified interpretations of federal law and secret judicial orders.

On 6 June 2013 reporting expanded to PRISM, a programme for obtaining data from internet communications providers under a different legal authority. A Guardian article published on 7 June described a classified presentation and quoted companies disputing the characterisation that government officials had unrestricted direct access to their servers. This dispute matters because collection of telephone metadata under Section 215 of the Patriot Act and acquisition of foreign-intelligence content under Section 702 of the Foreign Intelligence Surveillance Act involved different categories of records, targets and legal procedures. Edward Snowden identified himself publicly as the source of the disclosures on 9 June 2013. The material sparked hearings, litigation and sustained disagreement over secrecy, counterterrorism efficacy and constitutional constraints.

On 23 January 2014 the Privacy and Civil Liberties Oversight Board released a review of the Section 215 telephone-record programme and the operations of the Foreign Intelligence Surveillance Court. The oversight body offered twelve recommendations to strengthen privacy and civil-liberties protections. On 2 July 2014 the same board issued a separate report concerning surveillance under Section 702 and proposed ten additional recommendations. These reviews documented problems of statutory authority, safeguards and transparency while acknowledging a continuing national-security mission. The distinction is important: the board did not conclude that all intelligence collection should stop; it examined where the scope of collection and review failed to match legal necessity or effective oversight.

On 2 June 2015 President Barack Obama signed the USA FREEDOM Act. The legislation restricted bulk collection of telephone-call records under the previous framework and instituted a more targeted mechanism involving telecommunications providers, subject to court-approved selection terms. The law also made changes involving transparency and participation in Foreign Intelligence Surveillance Court proceedings. The shift affected one controversial programme and did not amount to abolition of all communications monitoring. Agencies retained authorities for foreign-intelligence collection, and disputes about how to interpret those authorities continued. Later criticism of intelligence surveillance therefore cannot be reduced to the claim that the 2015 statute either fixed every privacy risk or left the earlier collection programme entirely unchanged.

The political fault line cut across conventional party divisions. National-security officials argued that investigating foreign terrorist networks requires access to communications intelligence and carefully supervised investigative tools. Civil-liberties organisations objected that secret, population-scale collection left people unable to challenge intrusions and encouraged mission creep. Congress's 2015 reform demonstrated that particular powers could be narrowed through legislation; the 2014 oversight reports showed that the legitimacy of other powers depended on targeting, minimisation rules and independent review. Personal-data protection was therefore reshaped by public exposure and legislative bargaining rather than by a single court ruling. The enduring institutional achievement was a public argument over practices previously unknown to most affected people; the enduring vulnerability was that surveillance technology and national-security authorities continued to evolve faster than public oversight.