Yesterday the Second Circuit declared the NSA’s bulk telephone metadata program unlawful. Specifically, it ruled that it was unauthorized by section 215 of the USA PATRIOT Act (and thus did not reach the constitutional law questions). At the same time, however, it declined to grant an injunction that would have halted the program and instead sent the case back to the district court to reconsider the issues. As the Second Circuit recognized, many of the issues — many of which could may be mooted by congressional action (or inaction) between now and June 1, when this key statutory provision is set to expire.
The program’s continuing operation, at least for the next few weeks, has prompted commentators such as Orin Kerr to describe the ruling as “merely symbolic.” I disagree. To be sure, the telephony metadata program has long been given outsized attention relative to its impact and importance. But the ruling has significant import nonetheless —not just for what it means for the continued operation of the program, but for the range of interconnected areas that the opinion addresses. Below are four key, and substantive, implications of the ruling.
1. Collection Matters
The Second Circuit resoundingly rejected the government’s argument that there is no cognizable injury until data is actually analyzed and reviewed. According to the government, appellants had no standing because they could not establish that the metadata associated with their telephone calls (i.e. the numbers called, received, and duration of the call) had actually been analyzed, rather than merely collected; absent subsequent review, the suffered no injury in fact. The government makes analogous arguments with respect to other forms of bulk collection: Don’t worry — we have robust limitations as to who can access the data and why.
The Second Circuit was not persuaded, and rightly so. As the Second Circuit concluded, collection is properly analyzed as a government seizure. If the collection is unlawful, then “appellants have suffered a concrete and particularized injury,” even without a subsequent review by human actors. In other words, collection matters, even if the subsequent use restrictions are robust and strictly followed. That’s because we have a separate privacy interest not just in how the government uses our data, but in the government’s collection of our data in the first place.