Cybersecurity and privacy risk assessment of point-of-care systems in healthcare: A use case approach

Hepting v. AT&T
Court	United States District Court for the Northern District of California
Full case name	Hepting v. AT&T Corporation
Decided	July 20, 2006
Citation	439 F.Supp.2d 974
Holding
Private telecommunications firms that conduct surveillance of customers under government orders are granted retroactive immunity from prosecution by the FISA Amendments Act; and the U.S. government cannot claim state secrets privilege when ordering such surveillance.
Court membership
Judge sitting	Vaughn Walker
Keywords
Foreign Intelligence Surveillance Act, state secrets privilege

National Security Agency surveillance
Map of global NSA data collection as of 2007, with countries subject to the most data collection shown in red
Programs Pre-1978 ECHELON MINARET SHAMROCK PROMIS Since 1978 Upstream collection BLARNEY FAIRVIEW Main Core ThinThread Genoa Since 1990 RAMPART-A Since 1998 Tailored Access Operations Since 2001 OAKSTAR STORMBREW Trailblazer Turbulence Genoa II Total Information Awareness President's Surveillance Program Terrorist Surveillance Program Since 2007 PRISM Dropmire Stateroom Bullrun MYSTIC Databases, tools etc. PINWALE MARINA Main Core MAINWAY TRAFFICTHIEF DISHFIRE XKeyscore ICREACH BOUNDLESSINFORMANT GCHQ collaboration MUSCULAR Tempora
Legislation Safe Streets Act Privacy Act of 1974 FISA ECPA Patriot Act Homeland Security Act Protect America Act of 2007 FISA Amendments Act of 2008
Institutions FISC Senate Intelligence Committee National Security Council
Lawsuits ACLU v. NSA Hepting v. AT&T Jewel v. NSA Clapper v. Amnesty Klayman v. Obama ACLU v. Clapper Wikimedia v. NSA US v. Moalin
Whistleblowers William Binney Thomas Drake Mark Klein Thomas Tamm Russ Tice Edward Snowden
Publication 2005 warrantless surveillance scandal Global surveillance disclosures (2013–present)
Related Cablegate Surveillance of reporters Mail tracking UN diplomatic spying Insider Threat Program Mass surveillance in the United States Mass surveillance in the United Kingdom
Concepts SIGINT Metadata
Collaboration United States CSS CYBERCOM DOJ FBI CIA DHS IAO Five Eyes CSEC GCHQ ASD GCSB Other DGSE BND

Hepting v. AT&T, 439 F.Supp.2d 974 (N.D. Cal., 2006), was a class action lawsuit argued before the United States District Court for the Northern District of California, filed by Electronic Frontier Foundation (EFF) on behalf of customers of the telecommunications company AT&T. The plaintiffs alleged that AT&T permitted and assisted the National Security Agency (NSA) in unlawfully monitoring the personal communications of American citizens, including AT&T customers, whose communications were routed through AT&T's network.^[1]

The District Court initially ruled that private telecommunications firms that conduct surveillance of customers under government orders can be sued by customers, while the U.S. government cannot claim state secrets privilege to avoid explaining its justifications for such surveillance. However, by the time the case had finished its journey through the courts, the question had become moot because telecommunications firms had received retroactive immunity from such lawsuits via the FISA Amendments Act of 2008.^[2]

In 2006, journalists revealed a widespread warrantless wiretapping operation in the United States, in which government security officials worked with telecommunications firms to surveil the personal communications of citizens under the guise of protecting the country against terrorism.^[3] At about the same time, former AT&T engineer Mark Klein revealed that the company had allowed the National Security Agency (NSA) to install a NarusInsight surveillance system in its San Francisco switching center (Room 641A), which was capable of monitoring billions of bits of Internet traffic per second, including the playback of telephone calls routed on the Internet, and in effect spying upon the entirety of the communications of many American citizens and businesses who use the Internet.^[4][5]

The Electronic Frontier Foundation (EFF) initiated a class action lawsuit on behalf of aggrieved AT&T customers, with one named Tash Hepting volunteering to be named in the suit.^[6] According to the EFF, "They [the NSA] could not do what they are doing without the help of companies like AT&T. We want to make it clear to AT&T that it is not in their legal or economic interests to violate the law whenever the president asks them to."^[7]

On behalf of AT&T customers, EFF sought injunctive relief against AT&T for cooperating with such surveillance, and aggregated monetary damages allowed under the Foreign Intelligence Surveillance Act, the Communications Assistance for Law Enforcement Act, and related statutes. These damages would exceed $100,000 for each instance of surveillance, creating potentially ruinous liability for AT&T, considering the EFF's claims about the scope of AT&T's cooperation in the surveillance of large numbers of customers.^[8]

The case was heard at the United States District Court for the Northern District of California in 2006. AT&T requested that the court dismiss the case because the EFF did not have standing to sue, nor did any of its customers because none could prove that they had been surveilled personally.^[9] The National Security Agency (NSA) and the U.S. government worked on behalf of AT&T in the suit, with the government stating that it intended to invoke the state secrets privilege in a bid to dismiss the action.^[10] The U.S. Department of Justice filed a motion to dismiss the case on those grounds.^[9]

Judge Vaughn Walker of the District Court rejected the government's motion, holding that "[t]he government has opened the door for judicial inquiry by publicly confirming and denying material information about its monitoring of communications content."^[11] As a result, the government parties were ordered to furnish evidence that the surveillance of citizens was necessary for national security. AT&T was ordered to do the same regarding its cooperation with the program.^[1]

AT&T, with continuing assistance from the Department of Justice, appealed this order to the Ninth Circuit in 2007.^[12] While that case was in progress, Congress passed the FISA Amendments Act in 2008.^[13] That statute granted retroactive immunity to telecommunications companies for past violations of the original Foreign Intelligence Surveillance Act of 1978, which in turn required warrants for such activities.^[14]

Shortly thereafter, the Ninth Circuit dismissed the government's appeal and remanded the case back to the District Court, to determine the likelihood of success in light of the immunity gained by AT&T from the FISA Amendments Act.^[12][15] The government filed another motion to dismiss the case, this time citing a specifically-written provision in the new statute that rendered any such legal actions moot.^[16][17]

The EFF opposed the motion to dismiss, asserting that the FISA Amendments Act's retroactive immunity provision was unconstitutional.^[18] In 2009, Judge Walker dismissed the case on the grounds that such a dismissal was required under the newly-passed FISA Amendments Act.^[2]

The EFF in turn appealed this ruling, with the dispute again being heard at the Ninth Circuit.^[19] In 2011, that court dismissed the appeal because the EFF could not argue that AT&T had any legal liability for cooperating with the NSA surveillance, especially in light of the retroactive immunity against lawsuits enabled by the FISA Amendments Act.^[20] The EFF attempted yet another appeal to the United States Supreme Court, but in 2012 that court refused to grant certiorari,^[21] thus affirming the lower court decision that the NSA's warrantless wiretapping program did not violate American law.

One outcome of Hepting v. AT&T is the ability of the National Security Agency to claim that its mass surveillance program is a "reasonable" search under the Fourth Amendment, per an under-examined claim that doing so is necessary for preventing terrorism.^[22] The retroactive immunity gained by telecommunications firms that cooperate with the program has attracted professional criticism because this allows the parties involved to avoid the constitutional implications of their actions.^[23] Meanwhile, the use of state secrets privilege as allowed in the Hepting case enables the government to avoid Fourth Amendment discussions as well.^[24][25]

• Jewel v. National Security Agency
• President's Surveillance Program
• Litigation over global surveillance
• Mass surveillance in the United States
• Room 641A