American Civil Liberties Union

This week, a wide range of organizations filed friend-of-the-court briefs in support of the ACLU’s clients in our warrantless wiretapping challenge.

Today, we filed our brief with the Supreme Court in our lawsuit challenging the FISA Amendments Act, the 2008 law that ratified and expanded the National Security Agency’s warrantless wiretapping program.  (You can read our brief here.)

The Foreign Intelligence Surveillance Act – FISA – is a post-Watergate statute that was meant to rein in and regulate domestic surveillance undertaken in the name of national security. In 2008, Congress amended the statute, giving the National Security Agency unprecedented power to conduct dragnet surveillance of Americans’ international communications. The ACLU immediately challenged the law, but the government has tried to keep our case out of court.

It’s back. On Wednesday the House of Representatives is scheduled to vote on a five-year reauthorization of the FISA Amendments Act (FAA), the 2008 law that legalized the Bush administration’s warrantless wiretapping program and more. It permits the government to get year-long orders from the secret Foreign Intelligence Surveillance Act (FISA) court to conduct dragnet surveillance of Americans’ international communications—including phone calls, emails, and internet records—for the purpose of collecting foreign intelligence.  The orders need not specify who is going to be spied on or even allege that the targets did anything wrong.  The only guarantees that the FAA gives are that no specific American will be targeted for wiretapping and that some (classified) rules about the use of intercepted information will be followed.

A few links that have caught our eye this past week:

Paul Rosenzweig has posted a nice piece on Lawfare on the reasons to be skeptical of the need for cybersecurity regulation. He breaks cybersecurity down into its constituent parts (as we have urged) of cybercrime, cyber espionage, and truly catastrophic “digital Pearl Harbor” attacks. He suggests that the first two do not justify regulation, and (like us) is skeptical about the degree of risk of the third. In explaining that skepticism, he provides an elegant analysis of the electric grid, the taking down of which is a frequent cyber-attack scenario, and makes the point that the pro-regulation viewpoint “mistakes vulnerability for risk”—in other words, there can be a vulnerability in a system, but still a low risk that anyone will actually be able to or try to exploit it.