​The National Security Agency’s (NSA) program that collects Americans’ phone records in bulk is illegal, a federal appeals court ruled Thursday morning. In an almost 100-page decision, the three-judge panel of the U.S. Court of Appeals for the Second Circuit ruled that the “program exceeds the scope of what Congress has authorized” in the USA Patriot Act. 

Section 215 of the Patriot Act “cannot bear the weight the government asks us to assign to it, and...it does not authorize the telephone metadata program,” wrote Judge Gerard E. Lynch in the court’s decision, explaining that the provision of the Patriot Act that allows the FBI to collect business records relevant to counterterrorism investigations cannot be used to allow systematic bulk collection of domestic calling records.

The Section 215 program requires telecommunications providers—like Verizon—to produce call detail records, every day, on all telephone calls made through its systems or using its services where one or both ends of the call are located in the United States. These records include metadata—or the length of calls, the phone number from which the call was made, and the number called—and can also reveal the user or device making or receiving a call through unique identity numbers associated with the equipment. 

This metadata is then aggregated into a repository—or data bank—that can later be queried by the federal government using metadata identifiers. These identifiers can be phone numbers it believes, based on “reasonable articulable suspicion,” to be associated with a foreign terrorist organization. 

The identifier is used as a “seed” to search the data bank, which produces phone numbers—and the metadata associated with those numbers—that have been in contact with the seed. This process is called the first hop. The NSA can then also search for numbers—and associated metadata—that have been in contact with the numbers from the first hop, called a second hop.

The program operated in secret until former NSA contractor Edward Snowden leaked documentation to news agencies in the summer of 2013 detailing Verizon’s participation in the program. The federal government then acknowledged that the program had been collecting information in bulk since at least May 2006, when the Foreign Intelligence Surveillance Court (FISC) authorized it to do so. 

The American Civil Liberties Union (ACLU), the ACLU Foundation, the New York Civil Liberties Union, and the New York Civil Liberties Union Foundation—all Verizon customers—filed suit against the government officials responsible for administering the telephone metadata program on June 11, 2013, after it had been made public.

They challenged the program on statutory and constitutional grounds, requesting that the court declare the program exceeded its Section 215 authority and that it violates the First and Fourth Amendments. 

Their case eventually reached the U.S. Appeals Court, which declared the program illegal “comfortably in the full understanding that if Congress chooses to authorize such a far-reaching and unprecedented program, it has every opportunity to do so, and to do so unambiguously.” 

Despite the federal government’s claims, the court ruled that the “statutes to which the government points [to authorize the telephone metadata program] have never been interpreted to authorize anything approaching the breadth of the sweeping surveillance at issue here.” 

Section 215 “does not permit an investigative demand for any information relevant to fighting the war on terror, or anything relevant to whatever the government might want to know,” the court explained. “It permits demands for documents ‘relevant to an authorized investigation.’ The government has not attempted to identify to what particular ‘authorized investigation’ the bulk metadata of virtually all Americans’ phone calls are relevant.”

The telephone metadata records sought “are not even asserted to be relevant to any ongoing ‘systematic examination’ of any particular suspect, incident, or group; they are relevant, in the government’s view, because there might at some future point be a need or desire to search them in connection with a hypothetical future inquiry,” the court added.

The court further explained that if it adopted the interpretation the federal government asked it to for relevant telephone metadata collection, it could be used to collect and store in bulk “any other existing metadata available anywhere in the private sector, including metadata associated with financial records, medical records, and electronic communications (including e-mail and social media information) relating to all Americans.”

The court also criticized the federal government’s argument that the telephone metadata program had been authorized by Congress as only a limited number of members had a comprehensive understanding of the program and its legal basis. 

“Finding the government’s interpretation of the statute to have been ‘legislatively ratified’ under these circumstances would ignore reality,” the court said. “The widespread controversy that developed, in and out of Congress, upon the public disclosure of the program makes clear that this is not a situation in which Congress quietly but knowingly adopted the FISC’s interpretation of Section 215 because there was no real opposition to that interpretation.”

The court's ruling puts increased focus on Congress, which is currently debating reauthorizing Section 215 as it expires on June 1. Today's ruling essentially invited Congress to "wake up" and reexamine how the Patriot Act is being used, says Robert Cattanach, a partner at Dorsey & Whitney. "The court, in essence, challenged Congress to vote the practice up or down when it considers whether to reauthorize the act."

If Congress reauthorizes the program without making significant changes, it could trigger the U.S. Supreme Court's interest if the government appeals today's ruling, he adds.

If Section 215 is "reauthorized in substantially the same form as it currently exists...the similarities of this case to the Supreme Court's recent decision in Amnesty International v. Clapper make it more likely that the Supreme Court would consider review," he explains. "In Clapper, the Court dismissed a similar challenge because it found that the actual harm threatened by a general collection of telephone records was insufficiently direct and particularized​ to any individual to justify judicial review."