\n
![](\"https:\/\/i0.wp.com\/www.rsoftsolution.com\/blog\/wp-content\/plugins\/RSSPoster_PRO\/cache\/b5ab9_facebook-app.jpg?w=640&ssl=1\")
<\/p>\n
\n<\/p>\n
The\u00a0American Civil Liberties Union (ACLU) has put out a\u00a0fresh call<\/a>\u00a0for tech companies to push\u00a0for reform of the surveillance regime in\u00a0the U.S., warning of the added urgency\u00a0given new\u00a0U.S. President Donald Trump \u2014 who has already been demonstrably hostile to foreigners\u2019 privacy rights<\/a>\u00a0in his first few days\u00a0in office.<\/p>\n Late last week one of the ACLU\u2019s staff attorneys\u00a0was cross-examined\u00a0in the High Court\u00a0in Ireland as an expert witness in a piece of litigation\u00a0focused on\u00a0Facebook\u2019s use of\u00a0a data transfer mechanism to authorize its processing of\u00a0Europeans\u2019 data in the\u00a0U.S. The court\u00a0hearing started last Tuesday<\/a> and is expected to last for three weeks.<\/p>\n The\u00a0complaint against Facebook\u00a0pivots on whether US government surveillance activity undermines European privacy protections\u00a0\u2014 as the region\u2019s\u00a0top court, the CJEU, previously ruled<\/a> to be\u00a0the case regarding a prior\u00a0data transfer mechanism (Safe Harbor).<\/p>\n The Irish High Court is considering whether to refer similar concerns about the legal robustness of so-called Standard Contractual Clauses (SCCs) \u2014 an alternative mechanism for authorizing EU-US personal data transfers \u2014 to the CJEU.<\/p>\n The Irish data protection commissioner is pushing for the referral<\/a>, after reaching a provisional view in May 2016 that U.S. law does not adequately protect Europeans\u2019 data. It\u2019s not the only European body with serious concerns<\/a> here, either.<\/p>\n Despite Facebook being the focus of the legal complaint, the\u00a0case has much wider\u00a0significance given scores of other companies also make use of SCCs to authorize\u00a0transatlantic data flows \u2014 which means that\u00a0should the mechanism fail, many businesses, not just Facebook, will\u00a0need to change how they operate in order to comply with European law.<\/p>\n In a blog post<\/a>\u00a0discussing its role in the\u00a0litigation, the ACLU makes this point, warning that: \u201cIf the European courts ultimately conclude that the U.S. surveillance regime lacks essential protections for E.U. citizens, companies like Facebook may have more difficulty transferring their users\u2019 private data to the United States \u2014 at least until the U.S. adopts badly needed reforms to its surveillance laws.\u201d<\/p>\n \u201cThere are several ways that tech companies could push for stronger protections for their users\u2019 data in the face of U.S. government spying,\u201d it\u00a0adds, going on to suggest tech firms actively lobby members of Congress to enact surveillance reforms.<\/p>\n The ACLU is especially urging action on a portion of the Foreign Intelligence Surveillance Act (FISA) called\u00a0Section 702 \u2014 which has been used by US intelligence agencies to justify collecting data in bulk, such as via the NSA\u2019s PRISM program<\/a>\u00a0\u2014 noting that Section 702\u00a0is due to expire\u00a0this year.<\/p>\n (PRISM refers to the program whereby US intelligence\u00a0agencies apparently tap the customer data of a raft of tech companies, including Facebook, though exactly how they gain access to user\u00a0data remains unclear, given all tech firms named in the Snowden disclosures as being part of PRISM claimed to have no knowledge of it.)<\/p>\n \u201cTech companies, including Facebook, make contributions to dozens of candidates for the House of Representatives and Senate, including politicians who have introduced anti-privacy measures in the past or have advocated for the resurrection of mass surveillance programs. The message to lawmakers should be clear: If they do not support pro-privacy policies, they should no longer expect to receive Facebook support. Surveillance reform must remain a high priority for tech companies,\u201d the ACLU\u00a0writes.<\/p>\n \u201cNow that President Trump has the keys to the US surveillance state, it\u2019s more important than ever that tech companies work with us in the fight for surveillance reform,\u201d it adds.<\/p>\n TechCrunch\u00a0contacted Facebook for comment\u00a0\u2014 and to\u00a0ask whether it supports\u00a0the ACLU\u2019s calls to reform US\u00a0surveillance law \u2014\u00a0but the company declined to make a statement.\u00a0\u201cAs is an on-going legal case, we are not able to comment on what was said in court,\u201d said a spokeswoman.<\/p>\n Facebook\u00a0makes use of both\u00a0SCCs and the newer EU-US Privacy Shield for authorizing its EU-US flows of personal data. And\u00a0is arguing in the Irish court<\/a> that safeguards and remedies available in the U.S. for EU citizens vis-a-vis their data privacy rights are at least equivalent to those provided by the EU.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n Late last week the ACLU\u2019s Ashley Gorski was called as an expert witness in the Irish High Court action on behalf of\u00a0privacy campaigner Max Schrems \u2014 who filed the original PRISM-related complaints against Facebook. (An expert report compiled for the court by Gorski can be found online\u00a0here<\/a>.)<\/p>\n In her\u00a0report Gorski argues against Facebook\u2019s position, asserting that U.S. law fails to provide adequate safeguards for Europeans\u2019 data protection rights\u00a0on account of an \u201cextremely permissive\u201d surveillance regime, which also offers \u201cno viable avenue to obtain meaningful redress for the rights violations resulting from this surveillance\u201d.<\/p>\n On\u00a0Section 702, she writes that it \u201ceffectively exposes every international communication \u2014 that is, every communication between an individual in the United States and a non-U.S. person abroad \u2014 to potential surveillance\u201d, noting for example that it authorized the NSA\u2019s Upstream surveillance program (which\u00a0directly taps Internet infrastructure to siphon data).<\/p>\n \u201cThrough Upstream surveillance, the NSA has generalized access to the content of communications, as it indiscriminately copies and searches through vast quantities of personal metadata and content,\u201d she writes. \u201cBased on the public information concerning the scope of Upstream surveillance, I believe that there is a substantial likelihood that this surveillance results in the NSA\u2019s accessing, copying, and searching of data transmitted from Facebook Ireland to Facebook in the United States.<\/p>\n \u201cWhile some or all of this data may be encrypted, that would not prevent the NSA from copying, examining, and seeking to decrypt the intercepted Facebook data. As noted\u2026\u00a0above, when the agency collects encrypted communications under Section 702, it can retain those communications indefinitely, and public disclosures indicate that the NSA has succeeded in circumventing encryption protocols in various contexts.\u201d<\/p>\n Gorski\u2019s report also looks at\u00a0the role of Executive Order 12333, signed by former US president Ronald Regan in December 1981, as\u00a0the \u201cprimary authority under which the NSA gathers foreign intelligence\u201d.<\/p>\n \u201cDespite its breadth, surveillance under EO 12333 has not been subject to meaningful oversight by either the U.S. Congress or U.S. courts,\u201d she argues. \u201cSurveillance programs operated under EO 12333 have never been reviewed by any court. Moreover, these programs are not governed by any statute, including FISA, and, as the former Chairman of the Senate Intelligence Committee has conceded, they are not overseen in any meaningful way by Congress.<\/p>\n \u201cEO 12333 and its accompanying regulations place few restrictions on the collection of U.S. or non-U.S. person information. The order authorizes the government to conduct electronic surveillance abroad for the purpose of collecting \u2018foreign intelligence\u2019 \u2014\u00a0a term defined so broadly that it appears to permit surveillance of any non-U.S. person, including surveillance of their communications with U.S. persons.\u201d<\/p>\n Gorski argues that\u00a0limitations on how the U.S. government can use data collected in bulk for surveillance purposes are \u201cbroadly defined\u201d \u2014 resulting in the data being very broadly searchable, and the NSA being able to deploy \u201ca wide array of keywords\u201d to sift data it has acquired in\u00a0bulk (aka \u201cbulk searching\u201d).<\/p>\n \u201cEven \u201ctargeted\u201d forms of EO 12333 surveillance are extremely permissive, as the executive order authorizes the government to target non-U.S. persons abroad for virtually any \u201cforeign intelligence\u201d reason, broadly defined,\u201d she adds.<\/p>\n \u201cRecent disclosures indicate that the U.S. government operates a host of large-scale programs under EO 12333, many of which appear to involve the collection of vast quantities of U.S. and non-U.S. person information. These programs have included, for example, the NSA\u2019s collection of billions of cell-phone location records each day; its recording of every single cell phone call into, out of, and within at least two countries; and its surreptitious interception of data from Google and Yahoo user accounts as that information travels between those companies\u2019 data centers located abroad.\u201d<\/p>\n On\u00a0PPD-28 \u2014 an executive branch directive issued by US president Obama in January 2014, which was viewed favorably by EC officials because it imposed certain constraints on use of bulk collected comms data, and on the retention and dissemination of the comms of non-U.S. persons \u2014\u00a0Gorski\u2019s view is that the directive is ineffective, arguing it has\u00a0\u201cfew meaningful reforms\u201d that\u00a0can also \u201ceasily be modified or revoked by the next U.S. President\u201d.<\/p>\n Of\u00a0PPD-28\u2019s list of limitations, she writes: \u201cTaken together, these categories are very broad and open to interpretation, and they effectively ratify the practice of bulk, indiscriminate surveillance.\u201d<\/p>\n She also points out\u00a0that its limitations do not extend to \u201cother problematic types of mass surveillance\u201d, such as data acquired in bulk and held for a short period\u00a0\u2014 e.g. via the NSA\u2019s Upstream program.<\/p>\n Her\u00a0report goes on to consider\u00a0barriers to Europeans\u2019 being able to successfully seek redress for rights infringements resulting from the US surveillance regime, with Gorski arguing the\u00a0government \u201croutinely seeks to prevent individuals from obtaining redress for Section 702 and EO 12333 surveillance through civil litigation in U.S. courts\u201d.<\/p>\n On this she says the U.S. government has invoked and interpreted the \u201cstanding\u201d and \u201cstate secrets\u201d doctrines in such as way as to block any\u00a0adjudication of the lawfulness of its surveillance regime.<\/p>\n \u201cBecause virtually none of the individuals who are subject to either Section 702 or EO 12333 surveillance ever receive notice of that surveillance, it is exceedingly difficult to establish what is known as \u201cstanding\u201d to challenge the surveillance in U.S. court,\u201d she writes. \u201cWithout standing to sue, a plaintiff cannot litigate the merits of either constitutional or statutory claims.\u201d<\/p>\n \u201cBecause Section 702 and EO 12333 surveillance is conducted in secret, the U.S. government routinely argues to courts that plaintiffs\u2019 claims of injury are mere \u201cspeculation\u201d and insufficient to establish standing,\u201d she adds, pointing to a 2013 ruling in the\u00a0U.S. Supreme Court that Amnesty International USA and nine other plaintiffs lacked standing to challenge Section 702 \u201cbecause they could not show with sufficient certainty that their communications were intercepted under the law\u201d.<\/p>\n Another challenge in October 2015<\/a>, brought by\u00a0Wikimedia and others to Section 702 surveillance, was dismissed<\/a> by a U.S. district court on the same grounds \u2014 i.e. that the plaintiffs lacked standing.<\/p>\n She further\u00a0argues the U.S. government has\u00a0\u201cincreasingly sought to use the state secrets privilege not merely to shield particular information from disclosure, but to keep entire cases out of court based on their subject matter\u201d.<\/p>\n \u201cTo date, as a result of the government\u2019s invocation and the courts\u2019 acceptance of the standing and state secrets objections described above, no civil lawsuit challenging Section 702 or EO 12333 surveillance has ever produced a U.S. court decision addressing the lawfulness of that surveillance,\u201d she writes.<\/p>\n Another of her points is that the U.S. government has generally taken the position that non-U.S. persons located abroad have no right to challenge surveillance under the U.S. Constitution \u2014 dubbing that a\u00a0\u201csignificant\u201d detail, given the crux of the legal challenge (i.e. whether or not Europeans are getting \u2018essentially equivalent\u2019 protection for their rights under US law).<\/p>\n She also touches on one of the newer developments vis-a-vis\u00a0US-EU privacy law: the\u00a0creation of an Ombudsperson position, as part of\u00a0the Privacy Shield agreement reached between the EU and the US<\/a> to replace the invalidated Safe Harbor mechanism.<\/p>\n While this addition is one of the changes the European Commission has pointed to to argue its view that Privacy Shield is legally robust,\u00a0Gorski\u2019s take is that the Ombudsperson\u2019s \u201clegal authority and ability to provide meaningful redress are severely limited\u201d.<\/p>\n \u201cEven where the Ombudsperson does find that data was handled improperly, she can neither confirm nor deny that the complainant was subject to surveillance, nor can she inform the individual of the specific remedial action taken,\u201d she argues.<\/p>\n \u201cThere is no indication that the Ombudsperson can in fact require an executive-branch agency to implement a particular remedy. Nor is there any indication that she is empowered to conduct a complete and independent legal and factual analysis of the complaint \u2014 e.g., to assess whether surveillance violated the Fourth Amendment, as opposed to simply examining whether surveillance complied with the relevant regulations.\u201d<\/p>\n She also questions the independence of the\u00a0position, given the Ombudsperson is part of the State Department \u2014 and therefore \u201cnot entirely independent from the intelligence community\u201d against whose operations it will be fielding complaints.<\/p>\n \u201cIn short, an individual who complains to the Ombudsperson is extremely unlikely to ever learn how his complaint was analyzed, or how any non-compliance was in fact remedied. He also lacks the ability to appeal or enforce the Ombudsperson\u2019s decision,\u201d she adds.<\/p>\n In a sign of how much high level political concern\u00a0is being attached\u00a0to the legal challenge, the U.S. government last year applied to be an amicus in the case<\/a>\u00a0\u2014 and\u00a0was granted this status, with the judge writing<\/a>\u00a0the country has \u201ca significant and bona fide<\/em> interest in the outcome of these proceedings\u201d.<\/p>\n