On October 19, Yahoo publicly petitioned U.S. Director of National Intelligence James Clapper to declassify a federal order allegedly requiring it to scan all of its users’ incoming email messages. In the open letter, Yahoo’s general counsel Ron Bell argues that Yahoo may not legally admit the order’s existence, and therefore cannot respond to critical reports about the alleged scanning program. The dispute could become an early test of new declassification rules included in the USA FREEDOM Act of 2015 (the “Act”).
Reuters first described the order in an October 4 article sourced from three anonymous former Yahoo employees. According to the report, either the National Security Agency or Federal Bureau of Investigation requested that Yahoo implement a system to scan all messages received through its Yahoo Mail service for an undisclosed phrase, and Yahoo executives allegedly agreed to comply with the request without its security team’s knowledge. The report alleges that Yahoo’s security team’s discovery of the covert scanning system in May 2015 ultimately led its chief information security officer to resign. Yahoo has since called the Reuters article “misleading” and denied that the scanning system exists.
For its part, Director Clapper’s office has framed the Yahoo allegations in terms of the Foreign Intelligence Surveillance Act (“FISA”), and stated that its FISA surveillance targets specific individuals and “does not involve bulk collection or use generic key words or phrases.” Surveillance orders under FISA require an ex parte showing of probable cause to the Foreign Intelligence Surveillance Court (the “FISC”).
Despite the FISC’s secrecy (its orders and opinions are classified by default), an order authorized under FISA may now be subject to declassification. Specifically, the Act revised FISA to require, among other things, a declassification review of any such decision or order “that includes a significant construction or interpretation of any provision of law.” 50 U.S.C. § 1872(a). To succeed under the statute, Yahoo would need to demonstrate its standing to enforce the government’s obligation, then show that the order meets this significance standard on textual grounds (rather than, for example, on the grounds of its breadth alone). If the order were issued prior to the Act’s enactment, the government would likely repeat its argument in Electronic Frontier Foundation v. Department of Justice (3:16-cv-02041, N.D. Cal.) that the Act does not require retrospective declassification reviews.
Nevertheless, if Yahoo were to succeed in such a claim, it could compel the publication of either the order itself or a summary. 50 U.S.C. §§ 1872(a), (c). Given the secrecy that attends FISC proceedings, such a claim may indeed already be pending.
