Idea: Limit government surveillance by granting warrants for algorithms, not people

by Alan Cohen


All the controversy surrounding the surveillance of phone logs and internet use by the US National Security Agency (NSA) shows that it is very difficult to simultaneously make full use of technology to catch potential terrorist threats and to protect the civil liberties of individual citizens. Most of the debate has been polarized: The US government is or is not justified in doing what it’s done. But there is an innovative compromise position no one is discussing, one that (mostly) gives the best of both worlds.

Currently, if the NSA wants to listen in on the phone conversation of an American citizen, it needs a warrant for that particular citizen. However, to get large amounts of data on who calls whom (not the audio), it does not need a warrant, just as it does not need one to sift through information available on the internet. The system, as currently implemented, does have some checks and balances, but they are mostly checks and balances that could be easily reversed by a future president who found them tedious. The checks and balances are thus not very effective – there is a real risk here of too much surveillance and infringement of civil liberties.

At the same time, as someone who works with data, I really understand the need to have a huge database available in order to search effectively. (Someone put it well: in order to find a needle in a haystack, you need a haystack.) For example, perhaps we have analyzed the phone records of previous terrorist suspects and found a distinctive pattern: a series of very short calls every day for several weeks prior to the attack, directed to several countries in the Middle East, in Arabic, using the word jihad. We want to be able to identify if anyone new shows this pattern, and if so confirm that there is no imminent threat. You can’t do that if you don’t have the data, or if you need a separate warrant for every phone number in the database. The idea of individual warrants is antithetical to this type of surveillance.

But what if we required a warrant for a search algorithm, rather than an individual? If the government wanted to search a database for the above scenario, it could go to a judge (at a FISA court, i.e., confidential) and show the evidence that the algorithm was accurate and unlikely to pick up many non-terrorists (i.e., both sensitive and specific). Once permission was granted, NSA would have leave to use the algorithm. As appropriate, there could be additional limitations imposed (a warrant good for X months, or on calls originating in region Y, for example).

Of course, all this supposes that the government already has the data. In some cases this will need to be true, but in many cases – for example, with internet searches through Google, Facebook, etc. – the warrant would be to access external data through other companies. But since the government will have at least some data (e.g. logs of phone calls made, but not the audio), an additional system is needed to safeguard this data. I would propose an independent government agency tasked with ensuring the privacy of such data. Legal experts from the agency could argue in court against all proposed warrants. Actual searches in the database could require two authorizations, one from NSA and one from the new agency. The databases could be structured so as to include clear records of all access made, and audits could be conducted regularly to ensure there are no improper searches.

Such a system solves a number of problems. Up here in Canada, it has come out that there is a similar program, and everyone is worried that Canada is spying on Americans, and America on Canadians, and the two countries just exchange what they find to get around pesky rules forbidding spying on your own citizens. The requirement for a warrant could be construed broadly, to include even foreign-to-foreign phone calls, for example. (When I lived in Japan, I often called other numbers in Japan; NSA’s current rules suggest they would have been free to listen in on my phone calls, even though I am a US citizen.)

The core of the problem is that the current legal framework is based largely on two entities – countries and individuals – that are largely irrelevant to either the effective ways one uses a database to find terrorists, or to the privacy issues involved. By getting rid of these irrelevant legal structures in this case, we can both guarantee privacy and have an effective way to search for terrorists (or international criminals, improper use of tax havens, etc.)

Bonus idea: As for what to do with the NSA leaker, Edward Snowden, we need a way to (a) deter future potential leakers who may or may not be justified in using their own judgement to decide what government secrets to leak; and (b) recognize that he is different from a foreign spy and was acting in what he thought was the country’s best interest. My suggestion: he should go to jail for the crime he has committed, but his actions should lead to changes (such as those suggested above), and we should make sure there are ways available in the future to prosecute leaking to the domestic news media for idealistic reasons as a lesser crime than espionage or other sorts of leaks.