If The NSA Can't Keep Call Records, Should Phone Companies Do It?

Jun 8, 2014

Perhaps the most controversial spying program revealed by former National Security Agency contractor Edward Snowden was the agency's hoarding of Americans' phone records.

Congress wants to change that program.

The House has passed legislation that would end the NSA's bulk collection of Americans' calling data and let phone companies hold the records instead.

As a Senate panel found last week, that proposal could run into trouble.

The reform passed by the House would require the NSA to have a judge's order before going to the phone companies for individual calling records. That's a big change from what the agency has been doing — collecting that data on its own and holding it for five years.

Sen. Dianne Feinstein, D-Calif., who chairs the Intelligence Committee, has been a staunch defender of the NSA's current program.

"I happen to believe it is lawful and that it has been effective," she said. "But I recognize that the situation is such that change is needed."

So late last week, Feinstein held a hearing to examine how the House bill would change the law. Seated at the witness table was NSA Deputy Director Richard Ledgett. Feinstein wanted to know if he thought existing law requiring phone companies to hold on to their billing records for a year and a half worked for the NSA.

"We believe that the 18-month retention period would be sufficient," Ledgett said. "If the companies were to change their practices, we'd advise the committee."

"So you're saying you're confident that the companies will retain the call records for 18 months?" Feinstein asked.

"We actually can't say that," Ledgett answered. "They'll retain the records for as long as their business requirements dictate they retain their records."

Sen. Angus King, I-Maine, pointed out that the bill does not require phone companies to retain their records for any set period of time. When Verizon Vice President Michael Woods took the witness chair, King asked about a minimum requirement for holding on to calling records.

"We would be very much opposed to it," Woods answered.

Woods told King that most people now have unlimited calling plans, so Verizon no longer has much need to hang on to its calling records — nor does it want to.

"Our general principal in these records is that we do not keep them for longer than the business purpose, because we have learned that the longer we keep records beyond what we need them, the greater the risks to the privacy of our customers," Woods said.

If the phone companies don't keep those records, there's no way for the NSA to know if they'll be there if needed, potentially crippling the agency's ability to track contacts. Even forcing the companies to hold the records is problematic, according to another witness, Harley Geiger of the Center for Democracy and Technology.

"A data-retention mandate would be an enormous burden, both in terms of technological infrastructure, particularly for small companies and startups, but it would also result in loss of user trust and potential problems with privacy and data breach," Geiger said. "We urge you not to go down the road of a data-retention mandate."

Copyright 2014 NPR. To see more, visit http://www.npr.org/.

Transcript

RACHEL MARTIN, HOST:

Perhaps the most controversial spying program revealed by former National Security Agency contractor Edward Snowden was the collection of Americans' phone records. Congress wants to curb some of the NSA's powers. The House has already passed legislation that would end the bulk collection of Americans' calling data. Last week, a Senate panel dated the bill. As NPR's David Welna reports, that's where the proposal could run into some trouble.

DAVID WELNA, BYLINE: The key to the reform passed by the House requires that the NSA go to the phone companies with a judge's order to consult individual calling records. That's a big change from what the agency has been doing - collecting that data on its own and holding it for five years. Dianne Feinstein, the Democrat who chairs the Senate Intelligence Committee, has been a staunch defender of the NSA's current program.

(SOUNDBITE OF HEARING)

SENATOR DIANNE FEINSTEIN: I happen to believe it is lawful and that it has been effective. But I recognize that the situation is such that change is needed.

WELNA: So late last week, Feinstein held a hearing to look at the change that's passed in the House. Seated at the witness table was the NSA's deputy director, Richard Ledgett. Feinstein wanted to know if he thought existing law requiring phone companies to hold onto their billing records for a year and a half worked for the NSA.

(SOUNDBITE OF HEARING)

RICHARD LEDGETT: Madame Chairman, we believe that the 18-month retention period would be sufficient. If the companies were to change their practices, we'd advise the committee.

FEINSTEIN: So you're saying you're confident that the companies will retain their call records for 18 months?

LEDGETT: We actually can't say that, ma'am.

FEINSTEIN: Well, that's a...

LEDGETT: They'll retain their records for as long as their business requirements dictate they retain their records. And they may - they could change their business models and change the need for that.

WELNA: Main Independent Angus King pointed out there's nothing in the House bill requiring phone companies to retain their records for any set period of time. When Verizon communications Michael Woods took the witness chair, King asked the phone company executive about a minimum requirement for holding onto calling records.

(SOUNDBITE OF HEARING)

SENATOR ANGUS KING: How would you feel about a provision that said 18 months or two years of retention?

MICHAEL WOODS: We would be very much opposed to it.

WELNA: Woods told King that most people now have unlimited calling plans. So Verizon no longer has much need to hang onto their calling records, nor does it want to.

(SOUNDBITE OF HEARING)

WOODS: We are opposed to being compelled to collect records for that are completely unconnected with our business.

KING: We're not - nobody is asking you to collect records. It's a question of maintaining records you already to have.

WOODS: You know, our general principle in these records is that we do not keep them for longer than the business purpose because we have learned that the longer we keep records beyond what we need them, the greater risk to the privacy of our customers.

WELNA: So if the phone companies don't want to keep those records, there's no way for the NSA to know if they'll be there if needed. That could cripple the agencies ability to track contacts by using phone records. Even forcing the companies to hold the records is problematic according to another witness, Harley Geiger of the Center for Democracy and Technology.

(SOUNDBITE OF HEARING)

HARLEY GEIGER: A data retention mandate would be an enormous burden both in terms of technological infrastructure, particularly for small companies and startups, but it would also result in loss of user trust and potential problems with privacy and data breach. So we urge you not to go down the road of a data retention mandate.

WELNA: So the simple fix in the House bill of having the NSA rely on the phone companies for data may not be that simple after all. David Welna, NPR News. Transcript provided by NPR, Copyright NPR.