Section 215 Lives on as a Zombie Authority

Director George A. Romero said of his horror masterpiece, The Night of the Living Dead, that “if it doesn’t scare you, you’re already dead.”
 
Section 215 of the PATRIOT Act – the “business records” provision – should at least concern you. This surveillance authority sunsetted on March 15, 2020, after Congress failed to renew it. And yet, somehow, it continues to roam the landscape. As it does, significant questions about how this oddly enduring authority is being practiced deserve an answer.
 
Section 215 was the legal authority under which federal intelligence agencies obtained secret orders from the Foreign Intelligence Surveillance Court to review personal information from “tangible things.” This broad category could include location data, medical records, travel records, and more, in paper form or from electronic communications relating to any transaction.

The FBI in the past used Section 215 authority to collect phone logs cataloging records of calls and texts, and internet logs revealing the identities of people who visited particular web pages, and other sensitive data. After Congress prohibited bulk acquisition of records in 2015, Section 215 prompted agencies to use a “specific selection term” to narrow the scope of their investigations. The government uses “unique identifiers” like email addresses extracted from data to target individuals within collected data. 
 
Congress chose to let Section 215 expire in 2020, shutting it down entirely and requiring the government to use a more narrowly tailored authority called pen register/trap and trace orders.
 
But five years after Section 215’s expiration, the program continues to operate as a zombie authority.

• The law’s expiration clause allows continued use of this authority for investigations that were ongoing at the time of expiration or to investigate “offenses or potential offenses” that occurred before the sunset. This is a broad standard that grants agencies considerable authority to link any current target to past activities.

 
There is evidence that Section 215 is enjoying a robust afterlife. According to the most recent ODNI Statistical Transparency Report:

• The number of business records orders and the estimated targets of such orders ranged between five and eleven in 2022, 2023 and 2024.
  
  
• Yet, somehow, the estimated number of unique identifiers used to communicate information collected under 215 authority ranged from 55,431 in 2022, to 5,412 in 2023, and 63,260 in 2024.

Source: Statistical Transparency Report, 2024, Office of the Director of National Intelligence

​The many unanswered questions about Section 215’s afterlife activities cry out for oversight. Congress should require the government to answer:
​

• Why are there so many unique identifiers for such few targets?

 

• Is this disparity because the source of the collection is communications metadata?

 

• Or is it an overly generous interpretation of what constitutes a “contact”?

 

• Or is this number simply skewed because the targets are associated with malicious hacking? 

The answers to these questions may be innocuous. But when a legal authority continues to produce such large and unexplained numbers five years after its expiration, Congress needs to start asking questions.

DONATE & HELP US PROTECT YOUR PRIVACY RIGHTS