Data Retention Requirements And Outsourced Analysis: Should Private Entities Become Government Surrogates In The Collection Of Intelligence?

INTRODUCTIONJune 5, 2013 marked the beginning of an extraordinary, though not unprecedented, period in the history of the American intelligence community. Following extensive (and unauthorized) revelations of U.S. "bulk collection" programs targeting telephone metadata, both the Executive Branch and Congress have embarked on a more or less comprehensive review of intelligence activities and the intricate regulatory structure that is meant to restrain these activities within Constitutional parameters. In many aspects, the present experience is similar to the experience in 1974-1978, when aggressive investigative journalism brought to light the extent to which U.S. intelligence agencies were engaging in questionable activities, including largely unsupervised domestic surveillance operations. In the 1970s, these disclosures led to extensive Congressional investigations, the promulgation of Executive Orders governing the conduct of all intelligence activities, and the creation of a statutory framework to govern intelligence surveillance activities conducted within the United States.The present instance of this reflective process, however, also introduces some significant new themes. In the 1970s, the clear impulse in response to the revealed abuses was to directly regulate government activity.1 Though the intelligence reforms of the mid-1970s occurred when the reputations of Executive Branch institutions were at a historically low ebb, there appeared to be a consensus that those government institutions, fitted out with proper oversight, could safely conduct intelligence activities. In the post-Snowden reform discussions, this consensus is much less in evidence. It may be that the perceived inadequacies of the 1970s-era oversight structure in the face of post 9/11 pressures fatally undermined the belief that some combination of regulatory, judicial, and Congressional oversight can be sufficient to control intelligence agencies. In any case, reform discussions now include the consistent theme that the collection, searching, and perhaps even analysis of potentially relevant data is best done by the private holders of that data not the government.My intention here is to briefly examine whether private entities should ever serve as government surrogates in the collection or analysis of data. Mindful of the limitations of writing while this topic is in "middiscussion," I will first examine the current proposals, and the assumptions underlying those proposals. Then, I will explore some of the issues that, in my view, militate against the surrogacy and note trends in communications technology that ought to be addressed in any reform discussions.I.THE PRESIDENT'S DATA RETENTION PROPOSALWithin weeks of the first Snowden disclosures, President Obama commissioned a special review group to examine the issues surrounding "bulk collection" of data and to make policy recommendations to him.2 Shortly thereafter, Congress requested that the pre-existing Privacy and Civil Liberties Oversight Board ("PCLOB") conduct an inquiry into the newly disclosed surveillance activities.3 Both bodies consulted widely with intelligence agencies, outside interest groups, academics, policymakers, and representatives of industry.The Presidential review group, known formally as the Review Group on Intelligence and Communications Technologies, released its report on December 12, 2013.4 The report contained numerous recommendations, but one that garnered particular attention was that bulk collection of telephony metadata might be replaced by a "system in which such metadata is held instead either by private providers or by a private third party."5 Less than a month later, on January 14, 2014, President Obama announced his proposals to reform U.S. intelligence collection operations.6 He issued a Presidential Decision Directive that made changes to the operational rules affecting intelligence collection.7 He then announced, conditionally, the end of bulk collection of telephony metadata pursuant to Section 215 of the USA PATRIOT Act and appeared to endorse (though noted certain difficulties) the Review Group's recommendation on non-government entities holding the metadata. …