Legal Loophole for AT&T? Not So Fast ...

One of the questions to emerge in press analysis of Wednesday's court hearing in the EFF's case against AT&T is whether the company might be legally immunized if the attorney general wrote a secret letter authorizing the alleged internet wiretaps.

Declan McCullagh at CNET News.com parsed the AT&T lawyer's oral arguments carefully, and concluded that the company may have received certification from the Justice Department under this section of Title 18 U.S.C. 2511.

(2)(a)(ii) Notwithstanding any other law, providers of wire or electronic communication service, their officers, employees, and agents, landlords, custodians, or other persons, are authorized to provide information, facilities, or technical assistance to persons authorized by law to intercept wire, oral, or electronic communications or to conduct electronic surveillance, as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978, if such provider, its officers, employees, or agents, landlord, custodian, or other specified person, has been provided with --

(A) a court order directing such assistance signed by the authorizing judge, or (B) a certification in writing by a person specified in section 2518 (7) of this title or the Attorney General of the United States that no warrant or court order is required by law, that all statutory requirements have been met, and that the specified assistance is required, setting forth the period of time during which the provision of the information, facilities, or technical assistance is authorized and specifying the information, facilities, or technical assistance required.

But the aforementioned Foreign Intelligence Surveillance Act (FISA) only allows temporary surveillance without a court order when the target is purely foreign communications, and where "there is no substantial likelihood that the surveillance will acquire the contents of any communication to which a United States person is a party." That clearly couldn't apply to wiretapping of AT&T's domestic internet service.

The law also requires the attorney general to "immediately transmit under seal to the court" a copy of the certification. We know that the FISA court learned about the NSA programs at the same time as the rest of us last year, so such a transmission never took place.

EFF lawyer Cindy Cohn raised this in an e-mail to Dave Farber's IP list.

As you might expect, we at EFF disagree strongly with the implication of Declan's CNET News.com article that the existence of a "certification" by the Attorney General authorizing surveillance by the telcos is a magic bullet that will automatically kill the EFF case against AT&T. The possible certifications are an issue in the case, of course, but there are strong arguments on our side that Declan failed to mention, likely because he didn't ask any of us. Most prominently:

1. All of the certification provisions are strictly time-delimited.

None of the possibly applicable provisions allow surveillance longer than a few days before the DOJ has to go to the FISA court for authorization; and

2. All of the certification provisions envision a specific target of the surveillance -- they do not provide authority for the sort of wholesale ongoing turning over of customer communications and call data that we assert is happening here.

(...)

And of course it's still not clear that there were any certifications at all. The USA Today article seems to indicate that there are none and AT&T and the government have both steadfastly refused to answer that critical threshold question.

So if the Justice Department wrote AT&T a letter certifying that "all statutory requirements have been met," it would be lying to the phone company.

If this happened (and there's no evidence it did), the natural follow-up question seems to be, can AT&T be held liable for taking the Justice Department at its word, or did it have an obligation to -- for example -- look up the FISA and ask how the wholesale tapping of the internet could possibly be in compliance?

For more on Wednesday's hearing, check out Ryan's excellent coverage here.