The new USA Freedom Act prevents the bulk collection of phone call metadata by the NSA. AT&T, Verizon and other carriers will keep phone call metadata on their servers, and give it to the National Security Agency if subpoenaed by the Foreign Intelligence Surveillance Court, often called the FISA Court.
To be clear, phone companies do not have a new mandate to collect or store metadata — the numbers called and time and length of those calls.
"The phone companies may already have data retention obligations under the Communications Act, but there's no additional obligation as a result of USA Freedom having passed," says Jennifer Granick, director of civil liberties at Stanford University's Center for Internet and Society.
What's new under the law, she says, is an obligation to provide a "two-hop function," identifying people two steps — or "hops" — removed from the target. With court approval, the NSA gets the phone records of a targeted individual; then every number in contact with that individual; and then every number in contact with that wider circle.
"Now the phone companies will be the place where that analysis of who's in contact with whom is taking place," Granick says.
The phone companies may develop their own system for retrieving the data, or NSA could create the software code for them. The bill doesn't specify.
Phone companies also have a new right under the Act to publicly disclose, in aggregate numbers, how many National Security Letters — or orders to provide metadata — they've received from the FISA court. Disclosing government requests for metadata used to be prohibited. Granick isn't sure what to expect: "It's voluntary, so what are the providers going to actually do?"
NPR asked the major telephone and cellular carriers if they plan to regularly disclose NSA requests or if they plan to change what data they store. The carriers are not commenting to us, or to their business partners.
For example, CREDO Mobile uses the Sprint network to serve its customers. CREDO Vice President Becky Bond says her company hasn't been privy to Sprint's plans.
"We do not know how the major carriers have addressed the providing of telephone metadata," she says. "We don't know how they plan to implement this going forward under USA Freedom."
CREDO is known for taking politically progressive stands. Bond says the new law recognizes that American consumers want privacy. She hopes carriers will take its passage as a wake-up call, to "step up and do everything within their legal rights to protect the privacy of their customers who so clearly demanded it in this fight."
Phone companies and the NSA have 180 days to implement the new setup, and either side can complain to lawmakers if it's not working out.
Copyright 2021 NPR. To see more, visit https://www.npr.org.
