Thursday, March 27, 2014

Does the White House NSA Proposal Enable A Retention-Free Phone Plan?

While the details of President Obama's proposal to change the NSA's § 215 metadata program are still extremely limited, the proposal on its face appears to create an opportunity for an enterprising, aggressive telephone company to offer a retention-free phone plan - the "Snowden Plan" we'll call it.

How so?

The White House proposal purports to leave the telephone records at the telecoms only "for the length of time they currently do today."  As fleshed out by Charlie Savage, the Administration appears to intend to rely upon the FCC's 18-month "retention of telephone toll records" regulation at 47 CFR § 42.6.  Yes, remarkably, this is the same 18-month retention period that the Obama Administration has been actively pretending did not exist (see earlier post here) when it repeatedly and unambiguously asserted that government retention was necessary because the telephone companies "have no legal obligation" (really, watch that clip) to keep such records and only retain them for their own business purposes.

If the Administration now wants to change course and rely upon this same regulation, it should provide an incentive for at least one phone company to aggressively utilize the government's earlier attempts to undermine it, in order to create the most privacy-friendly phone plan allowed by law.

As I said, the Administration is now on the record, repeatedly, as asserting that --  absent the FISC orders -- only the business purposes of the telephone companies control retention. Verizon has argued today (h/t Emptywheel) that going forward companies should also not be required "to store data for longer than . . . they already do for business purposes."  There are legitimate "business purposes" for retaining phone data for at least some period, such as the need for records in resolving billing disputes with customers. However, post-Snowden a potentially more powerful business purpose would be to promote a popular phone plan that utilizes its own "minimization procedures" by limiting retention of such phone data to hours or minutes and finding alternative ways to serve other business needs.

What about the regulation?  Well, in complaining about the problems with the regulation years ago, the DOJ acknowledged plausible interpretations that could avoid the retention period. In particular, in 2006 the DOJ acknowledged the age of the regulation and its outdated usage of "toll records" noting that as telephone carriers have
increasingly moved away from classic billing models, in which charges are itemized and billed by type of service, to non-measured, bundled, and flat-rate service plans, some carriers have claimed that call records under such new plans are not covered by Section 42.6 because they are not "toll records." Therefore, these carriers have argued that no records need be retained.
The fact that the regulation did not substantively change following this could arguably be viewed as a "ratification" of such interpretations similar to that urged by the government in arguing that Congress knowingly "ratified" the Executive's secret interpretations of § 215.  Our enterprising telecom could explore these and other ways of avoiding the regulatory retention requirement that are both creative and legal.

I realize of course that this would not necessarily avoid other requirements under the proposal (for example, once a number is identified to the telecom it may have to produce "ongoing and prospective" records).  And the Administration can figure out a way either to shore up the regulation or buttress it with statute, but it seems to me that a telecom could create some good will by at least attempting to be aggressive in proposing such a plan to customers. Doing so could also have the ancillary benefit of helping to smoke out the real angles of the proposal that will undoubtedly require a lot more of telecoms than what is in their business interests and details that are surely already more thought out than the White House has disclosed.

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.