On Wednesday, July 5, British nonprofit Privacy International filed suit in U.S. District Court for the District of Columbia against the National Security Agency (“NSA”), the Office of the Director of National Intelligence (“ODNI”), and other U.S. agencies under the Freedom of Information Act. The suit seeks a copy of the current agreement governing sharing of signals intelligence among the “Five Eyes” alliance of the United States, the United Kingdom, Canada, Australia, and New Zealand. If successful, this request could provide new insight to domestic and overseas privacy advocates on how intercepted information is shared and could influence regulators already wary of the United States’ practices in this area.
Privacy International’s suit arises from the long history of signals intelligence sharing between the United States and United Kingdom. In 1946, the countries executed an informal document, titled the United Kingdom-United States Communication Intelligence Agreement (the “UKUSA Agreement”), committing to share both signals intelligence itself and the techniques used to gather it. In 1955, the parties proposed a restatement of the UKUSA Agreement (which had by that time been joined by Canada, Australia, and New Zealand), and the NSA declassified records from those negotiations in 2010. These documents represent the most recent version of the UKUSA Agreement available to the public.
In its complaint, Privacy International seeks to compel the NSA, the ODNI, the State Department, and the National Archives and Records Administration to provide the text of the UKUSA Agreement now in effect, as well as records on the defendants’ rules and policies governing their sharing of intelligence gathered from “operations relating to foreign communications.” The 1955 UKUSA Agreement defines “foreign communications” to include “communications of the Government … of a foreign country, or of any person or persons acting or purporting to act therefor, and … [redacted] communications originated by nationals of a foreign country which may contain information of value.”
Of course, the rise of the Internet has given the NSA and its overseas partners opportunities to gather intelligence in ways not anticipated in 1955, and these new technologies create new difficulties in determining whether participants in a communication are indeed foreign nationals. The same difficulty prompted the enactment of the of the Protect America Act of 2007 and the FISA Amendments Act of 2008, each of which require the United States to take measures to minimize the chance of intercepting communications from U.S. persons. (The complaint likewise requests records describing these minimization procedures.) Privacy International argues that requiring the disclosure of any privacy safeguards mandated by, or implemented under, the current UKUSA Agreement will aid the public in understanding their rights and advocating for any needed improvements.
Updated information on the UKUSA Agreement, if released, could add to the international debate on privacy protections and surveillance. For example, in 2015, the European Court of Justice invalidated the U.S.-EU Safe Harbor, which had permitted the processing of European personal data in the United States due to NSA surveillance programs publicized by Edward Snowden. The Safe Harbor’s replacement, the Privacy Shield, is itself subject to at least two similar challenges under European law, and the European Commission will conduct its first annual review of the new regime later this year. Even the publicity accompanying Privacy International’s initial filing could draw attention to the U.S.’surveillance practices, which could in turn threaten the Privacy Shield’s continued viability.
To view a copy of the complaint, click here.
