Permanent Record

ACLU v. Clapper
, a
suit challenging the legality of the NSA’s phone records collection program. The
court ruled that the NSA’s program had violated even the loose standards of the
Patriot Act and, moreover, was most probably unconstitutional. The ruling
focused on the NSA’s interpretation of Section 215 of the Patriot Act, which
allowed the government to demand from third parties “any tangible thing” that it
deemed “relevant” to foreign intelligence and terror investigations. In the court’s
opinion, the government’s definition of “relevant” was so expansive as to be
virtually meaningless. To call some collected data “relevant” merely because it

---

might become relevant at some amorphous point in the future was
“unprecedented and unwarranted.” The court’s refusal to accept the
government’s definition caused not a few legal scholars to interpret the ruling as
casting doubt on the legitimacy of all government bulk-collection programs
predicated on this doctrine of future relevance. In the wake of this opinion,
Congress passed the USA Freedom Act, which amended Section 215 to
explicitly prohibit the bulk collection of Americans’ phone records. Going
forward, those records would remain where they originally had been, in the
private control of the telecoms, and the government would have to formally
request specific ones with a FISC warrant in hand if it wanted to access them.
ACLU v. Clapper
was a notable victory, to be sure. A crucial precedent was
set. The court declared that the American public had standing: American citizens
had the right to stand in a court of law and challenge the government’s officially
secret system of mass surveillance. But as the numerous other cases that resulted
from the disclosures continue to wend their slow and deliberate ways through the
courts, it becomes ever clearer to me that the American legal resistance to mass
surveillance was just the beta phase of what has to be an international opposition
movement, fully implemented across both governments and private sector.
The reaction of technocapitalists to the disclosures was immediate and
forceful, proving once again that with extreme hazards come unlikely allies. The
documents revealed an NSA so determined to pursue any and all information it
perceived as being deliberately kept from it that it had undermined the basic
encryption protocols of the Internet—making citizens’ financial and medical
records, for example, more vulnerable, and in the process harming businesses
that relied on their customers entrusting them with such sensitive data. In
response, Apple adopted strong default encryption for its iPhones and iPads, and
Google followed suit for its Android products and Chromebooks. But perhaps
the most important private-sector change occurred when businesses throughout
the world set about switching their website platforms, replacing http (Hypertext
Transfer Protocol) with the encrypted https (the S signifies security), which helps
prevent third-party interception of Web traffic. The year 2016 was a landmark in
tech history, the first year since the invention of the Internet that more Web
traffic was encrypted than unencrypted.
The Internet is certainly more secure now than it was in 2013, especially
given the sudden global recognition of the need for encrypted tools and apps.
I’ve been involved with the design and creation of a few of these myself,
through my work heading the Freedom of the Press Foundation, a nonprofit

---

organization dedicated to protecting and empowering public-interest journalism
in the new millennium. A major part of the organization’s brief is to preserve and
strengthen First and Fourth Amendment rights through the development of
encryption technologies. To that end, the FPF financially supports Signal, an
encrypted texting and calling platform created by Open Whisper Systems, and
develops SecureDrop (originally coded by the late Aaron Swartz), an open-
source submission system that allows media organizations to securely accept
documents from anonymous whistleblowers and other sources. Today,
SecureDrop is available in ten languages and used by more than seventy media
organizations around the world, including the