By VINDU GOEL and CHARLIE SAVAGE
SEPT. 11, 2014
The federal government was so determined to collect the Internet communications of foreign Yahoo customers in 2008 that it threatened the company with fines of $250,000 a day if it did not immediately comply with a secret court order to turn over the data.
The threat — which was made public Thursday as part of about 1,500 pages of previously classified documents that were unsealed by a federal court — adds new details to the public history of a fight that unfolded in secret at the time, as Yahoo challenged the constitutionality of a statute that legalized a form of the Bush administration’s program of warrantless surveillance of foreigners — and lost. Under the Foreign Intelligence Surveillance Act, companies that receive data requests are prohibited by law from talking about the substance of specific requests or even acknowledging they occurred.
Yahoo’s 2008 challenge to the warrantless surveillance law and an appeals court’s rejection of that challenge were first reported by The New York Times last year, shortly after Edward J. Snowden, a former National Security Agency contractor, exposed a more extensive government surveillance program called Prism through classified documents leaked to The Washington Post and The Guardian.
The documents released on Thursday show that the government expected Internet providers to begin complying with orders under the law — which Congress later replaced with another statute called the FISA Amendments Act — before the intelligence court had approved the procedures for targeting specific accounts and protecting any private information about Americans collected incidentally in the course of the warrantless surveillance aimed at people abroad.
The records also provide perhaps the clearest corroboration yet of the Internet companies’ contention that they did not provide the government with direct access to vast amounts of customer data on their computers.
When the Snowden revelations surfaced last summer, there were reports that the government had direct access to look into the databases of Internet companies for any information they wanted, which the companies have denied. Instead, they said, the government had to send them a lawful request for information on a specific individual and only then would they hand it over.
In a document reporting on its compliance with the 2008 order to turn over customer data, Yahoo said it had begun surveillance on the requested accounts, beginning with the government’s highest-priority targets. That indicates that the government was sending Yahoo the names of the people it was investigating and waiting for the company to send the information, as opposed to directly accessing Yahoo’s servers.
Over all, the cache of documents shows how Yahoo fought the government and eventually lost its appeal. That helped set the stage for a vast expansion of the federal government’s surveillance of Internet users through the secret Prism program. Ultimately, Yahoo and seven other companies had to give data to the government under the program.
Yahoo described the government’s threat to seek fines in a blog post on Thursday. A Yahoo spokesman further explained that the court ordered it to comply while its appeal was pending.
Proceedings in front of the Foreign Intelligence Surveillance Court are usually secret, and Yahoo had been pressing for months for the declassification and release of the documents.
“We consider this an important win for transparency, and hope that these records help promote informed discussion about the relationship between privacy, due process and intelligence gathering,” Ron Bell, Yahoo’s general counsel, wrote in the blog post.
The Justice Department has posted many of the documents online and Yahoo said it would work to make more of them available to the public.
Yahoo brought its challenge after the 2007 enactment of the Protect America Act, which gave the first, temporary legalization to a form of the Bush administration’s warrantless surveillance program. It authorized the government to collect, from domestic networks and providers, the communications of people thought to be located abroad.
In 2008, the Protect America Act expired and Congress replaced it with the FISA Amendments Act, which reauthorized a more permanent version of the program. The 2008 law extended some protections for Americans abroad — an issue Yahoo had concerns about — by limiting the targets of the warrantless surveillance to noncitizens abroad.
While Yahoo’s challenge was technically to the Protect America Act, however, most of its concerns applied equally to the FISA Amendments Act. The rulings by the Foreign Intelligence Surveillance Court and its review panel upholding the Protect America Act became an important, though secret, precedent for the constitutionality of expansive government surveillance powers.
Yahoo did not seek Supreme Court review of the issue. One complication, the Yahoo spokesman noted, was that the Protect America Act had expired and such a challenge might have had to start over again addressing the FISA Amendments Act. The spokesman did not say how much the litigation had cost, but said it was considerable.
In 2012, Congress reauthorized the FISA Amendments Act, and that same year a constitutional challenge to the law, brought by Amnesty International and other plaintiffs, reached the Supreme Court. But the justices dismissed the case without examining the merits on the grounds that the plaintiffs could not prove they had been wiretapped and so lacked standing.
Yahoo’s only victory was that the intelligence courts agreed that it had standing to file a challenge on behalf of its users, rejecting the Bush administration’s argument that it could not raise the concerns in court, the newly disclosed documents show.
The American Civil Liberties Union praised the court’s decision to release the documents.