Phone Carriers Tight-Lipped On How They Will Comply With New Surveillance Law

The new USA Freedom Act prevents the bulk collection of phone call metadata by the NSA. AT&T, Verizon and other carriers will keep phone call metadata on their servers, and give it to the NSA if subpoenaed by the Foreign Intelligence Surveillance Court, often called the FISA Court. To be clear, phone companies do not have a new mandate to collect or store metadata — the numbers called and time and length of those calls.

Jennifer Granick, Director of Civil Liberties at Stanford University's Center for Internet and Society, says, "The phone companies may already have data retention obligations under the Communications Act, but there's no additional obligation as a result of USA Freedom having passed." What's new under the law is an obligation to provide a "two-hop function," identifying people two steps — or "hops" — removed from the target. With court approval, the NSA gets the phone records of a targeted individual; then every number in contact with that individual; and then every number in contact with that wider circle. "Now the phone companies will be the place where that analysis of who's in contact with whom is taking place," Granick says. The phone companies may develop their own system for retrieving the data, or NSA could create the software code for them. The bill doesn't specify.