Watching the Watchers: The Future of the Privacy and Civil Liberties Oversight Board

Audio of this conversation is available via your favorite podcast service.

Barely a month into the second Trump presidency, to say the new administration has brought some disruption would be an understatement. Entire agencies have been demolished. Senior figures in the Pentagon, inspector generals across federal agencies, and rank-and-file government workers have been summarily fired in a chaotic and, according to federal judges, likely illegal manner.

Amidst all the chaos, you might not have noticed when the Trump administration terminated all three Democratic members of the Privacy and Civil Liberties Oversight Board, or PCLOB, an independent intelligence watchdog charged with monitoring the government's compliance with procedural safeguards around its surveillance activities.

The removal of the Democratic board members leaves the PCLOB with only one active member, the sole remaining Republican appointee, Beth Williams. Here's Williams describing the role of the PCLOB at the annual State of the Net conference, which took place on February 11th (I was in the front row for her remarks):

The board, as you may know, is also known as PCLOB, in what is widely understood to be one of the worst shortened names in Washington, and that's quite a feat. For those of you who are unfamiliar with our agency, PCLOB was established by the September 11th Commission Act of 2007. Our mission is to ensure that the federal government's efforts to prevent terrorism are balanced with the need to protect privacy and civil liberties.

Williams went on to explain the board's current status, projecting business as usual.

We are open for business. Our work conducting important, independent oversight of the intelligence community has not ended just because we are currently subquorum. In fact, the board has been subquorum several times before, most recently from 2021 to 2022. Even then, our staff continued its important work as recently as three years ago. The staff produced recommendations regarding CIA activity conducted pursuant to Executive Order 12333 under what the board called “deep-dive two.” You're welcome to review these staff recommendations on our website. This time, however. We're in a stronger position than ever before to continue our mission work during a subquorum period.

But while Williams pointed to work still underway, she did acknowledge that the board is substantially limited in what it can do until it reaches a quorum.

It is true, of course, that without at least three members, the Board cannot act at its fullest capacity. Among other things, until I am joined by two more members, the board can't officially open new projects. But that does not mean we cannot lay the groundwork for them. Let me turn now to a few of our current projects and talk a bit about what I hope our future projects will be.

Williams brought up in particular the role the PCLOB plays in ensuring US surveillance practices are aligned with EU legal standards, which is important for cross-border data flows.

A particular note to this audience, as I mentioned, the PCLOB staff is going to continue diligently working on the board-approved oversight project on enhancing safeguards for US signals intelligence as established by EO 14086. This is in conjunction with what's known as the EU-US transatlantic data privacy framework.

She went on to explain how the staff is working to ensure the US meets its obligations, but then she announced the PCLOB will join the administration's investigation of government efforts on mis and disinformation, a priority for Trump and the MAGA right.

Our domestic terrorism work is proceeding along two lines of effort. First, how do the government's counter-disinformation efforts impact the free speech of American citizens? And second, Do the government's efforts to counter domestic terrorism uniquely affect the privacy and civil liberties of particular groups?

Williams asserted, without providing much detail, that there is substantial evidence that the government pressured social media and other companies to “censor” Americans' free speech, and said she would continue to pursue more information about the short-lived Disinformation Governance Board in the Department of Homeland Security, another obsession of the MAGA right. She said the board would continue to work on issues regarding facial recognition, and on Section 702 of the Foreign Intelligence Surveillance Act, or FISA.

As you may be aware, the Board published a detailed 300-page report on Section 702 in the fall of 2023. Those familiar with our work may know that my former colleague, Member Richard DeZinno, and I wrote an extensive separate statement that functioned largely as a minority report. In our separate statement, we were highly critical of the FBI. We specifically called out the troubling FISA abuses that predicated the national security investigation related to the 2016 presidential transition.

And Williams went on to defend the independence of the board.

Of course, I am only one person. But the board has been led in similar circumstances before in 2017 and 2018, one Republican led the board in 2021 and 2022. Two Democrats were the only members. One of my board colleagues who is speaking at this conference later today was one of those two Democrats. Just last week, he said, quote, Americans should not be fooled into thinking that board members have partisan agendas. Just because there's only one member now does not mean our work stops or ceases to be meaningful.

After the conference, I spoke to the former board member she quoted: Travis LeBlanc. LeBlanc is the current co-chair of the Global Cyber Data Privacy Practice at Cooley. What follows is a lightly edited transcript of the discussion.

Justin Hendrix:

Travis, what does it mean for the Privacy and Civil Liberties Oversight Board not to have a quorum?

Travis LeBlanc:

Without a quorum, the board is unable to conduct business at the board level. Under the PCLOBS statute, there have to be at least three board members to conduct business. And have a quorum. Currently, there is only one board member, Beth Williams. She is a part-time board member who is at the agency and, therefore, is unable to issue board guidance, board reports. She can issue a statement in her own name, but it would just be in her individual official capacity … it would not be at the board level and would not reflect a bipartisan, independent review of any of the issues that the PCLOB normally has to confront. 

Justin Hendrix:

And what business are you most concerned about going essentially undone at the moment?

Travis LeBlanc:

The PCLOB has several oversight projects that are currently ongoing. The one that was most advanced was an investigation into the use of biometrics in aviation security, which generally would include agencies such as Customs and Border Protection or the Transportation Security Administration [TSA].

You could think of this investigation as one that looks at issues like the use of facial recognition technology by the TSA. I'm sure just about all of us who've traveled through airports have probably experienced the ability to use facial recognition at TSA checkpoints to verify your identity. It is opt-in currently, although the former TSA administrator now has indicated that he'd like to make it mandatory. We've been looking at facial recognition in aviation for several years now, and that is a report, for example, that the board could not put out right now without a quorum.

Other issues that the board is working on involve open source—the use of information by the FBI, in particular, of open source information. There are also two new projects that have been opened. One is the board is looking at section 702 of the Foreign Intelligence Surveillance Act [FISA] to prepare for the reauthorization of that provision next year, about a year from now.

Historically, the PCLOB has put out the seminal report looking at section 702 and unfortunately, the board will not be able to do that in 2026 without a quorum. Another final project that I'll mention. There are others out there, but one final one that I'll mention involves the use of tactical terrorism response teams (TTRTs) by the Department of Homeland Security.

These TTRTs are deployed at the border and oftentimes are collecting a lot of sensitive information, for example, from a phone that might be on a person crossing the border. Many US persons, Americans, may not know that at the border they don't have the same Fourth Amendment protections as they have in other places in the country.

And so when you're at the border, even if you're a US citizen, the government doesn't necessarily need a subpoena or a search warrant. to get access to your personal phone and or laptop that you may have with you. There are concerns about the sharing of information gathered there, the targeting of people.

And so that's another investigation for which the board could not put out a report without a quorum.

Justin Hendrix:

I want to switch gears just a moment and ask you a little bit about EU-US data privacy, and the framework, and the role that PCLOB played in that. What might be the immediate impacts on data transfers between Europe and the US? I suppose if you were at the European Commission or you put yourself in the shoes of a counterpart in Europe, what would you be thinking about knowing that PCLOB is essentially in the circumstances it is in at the moment?

Travis LeBlanc:

PCLOB is very involved in the negotiations and resolution over data transfers between Europe and the United States.

I served on the board for nearly six years, and during that time, we participated in several of the European reviews on the United States’ adequacy status. And a couple of years ago, President Biden issued Executive Order 14086, which is one of the most significant reforms of signals intelligence activities that have happened in the history of the country in that executive.

There are several commitments that are made about the legitimate basis for the exercise of signals intelligence, as well as the direction for a framework that would allow Europeans in particular to have and seek redress in the United States for concerns about the misuse of their personal data by the United States government.

That order encourages—it doesn't instruct—the PCLOB because we are an independent agency, it encourages the PCLOB to support the redress mechanism by making recommendations on judges for a new data protection review court that would consider redress claims brought by Europeans. It also encourages the PCLOB to conduct a review of the redress process and, in particular, the data protection review court to ensure that it is complying with governing procedures and policies, the executive order, and the broader data privacy framework. The PCLOB is given that role and the PCLOB accepted those roles. So, the president encouraged it, the PCLOB has formally accepted those roles to do exactly what the president encouraged us to do. This has been critical to the negotiations.

And to the data privacy framework with Europe because the PCLOB is an independent agency and has built a reputation as being fair and transparent. And the US government, when it's talking to the Europeans about the broad oversight mechanism that we have in the United States, often highlights the PCLOB as one of the central features of our oversight of intelligence activities in the United States, the gutting of the board and in particular removing the Democrats and the US Taking the position that all board members must serve at the pleasure of the president shows and demonstrates to the Europeans that the PCLOB actually isn't independent, and while in this instance, the decision appears to have been made solely because we were Democrats, it's not a far leap that in the future if a Democratic board member were to draft an opinion or a statement that the administration disagreed with that would be a terminal offense.

And so, the idea that the PCLOB of the future could produce independent or nonpartisan expert reports is immediately called into question, because presumably, those reports would be reviewed by the current administration. And it would essentially be the product of the views of the administration, which would not have the indicia of independence that the Europeans have been looking for with the PCLOB or, frankly, even with the data protection review court because presumably all of those people would serve all those judges would serve at the pleasure of the president as well and also wouldn't have any protections from independence on a going-forward basis.

From what we've seen, there's concern that's being raised in Europe about whether the United States continues to offer adequate protections for the personal data of Europeans, given that the oversight mechanisms that were put in redress mechanisms that were put in place may not have the same independence to them as they did in the past.

Justin Hendrix:

We will see if the European Commission decides to take such concerns seriously and in some procedural way. I want to ask you—knowing that you only have a moment left—I read one report that suggested you might be considering legal action regarding the termination of the board positions. Is that right? If so, what would be the argument?

Travis LeBlanc:

Ed Felton and I have retained Arnold and Porter in connection with our unlawful terminations from the Privacy and Civil Liberties Oversight Board.

Justin Hendrix:

Speaking as a citizen. What would you most want your neighbor to understand about the PCLOB and what's missing at this moment? What's different about this particular lack of a quorum versus in the past?

Travis LeBlanc:

As technology has developed, it has become easier for the US government to obtain a massive trove of information on US persons as well as non-US persons. It has also become much easier for the government to share that information between agencies, between the federal and state and local governments, as well as between the US government and international governments. It has also become easier for the US government to lose that information, whether through an insider who releases it or through a vulnerability or cyber attack of some sort.

The risks to US persons, as well as non-US persons, from the misuse, abuse, and exfiltration of data are quite substantial. It is a national security issue, and it's an issue where there is only one agency that has been focused on it full-time. In fact, it's the only agency that has privacy in its name in an age where privacy is one of the key civil rights issues of the century. At this time, when there is so much risk, it is more important than ever to have an expert body that is there to look at matters, to advise on issues around any illegality or compliance infractions, and to be able to offer expert advice to Congress and the president on how to approach and address those issues on a going-forward basis.

Justin Hendrix:

Travis LeBlanc, thank you very much.

Travis LeBlanc:

Thank you, Justin.

Just days after I spoke to Travis LeBlanc, the lawsuit against the government he mentioned was filed. It asks the court to declare the terminations of the Democratic members of the PCLOB illegal and reinstate them to their former positions. The outcome of the case could have implications not only for the status of the fired members but for whether the PCLOB can plausibly claim to be independent from the executive branch.

To learn more, I spoke to one expert on the subject. Who I caught on the sidelines of RightsCon, The annual human rights and technology conference hosted this year in Taipei.

Greg Nojeim:

My name is Greg Nojeim. I am the director of the Security and Surveillance Project at the Center for Democracy and Technology in Washington, DC.

Justin Hendrix:

Of course, Greg, I'm not talking to you in Washington, DC. We happen to be in the Convention Center in Taipei at RightsCon, which bills itself as the world's leading summit on human rights in the digital age.

There is a lot of conversation here about a crisis that is Some thousands of miles away in the United States part of that crisis involves something that you've been covering very closely the removal of board members from the Privacy and Civil Liberties Oversight Board two members of the board who were terminated at the President's order filed a suit yesterday.

The document states that “the President's actions strike at the heart of the separation of powers. Not only do the plaintiff's removals eradicate a vital check on the infringement of ordinary American civil liberties, they also hobble an agency that Congress created to assist it with oversight of the executive branch.”

What's at stake in this legal fight over the PCLOB?

Greg Nojeim:

So the Privacy and Civil Liberties Oversight Board was established at the recommendation of the 9/11 Commission to ensure that when the government responds to terrorism, that its response balances security with privacy and civil liberties concerns.

That's the mission of the PCLOB. It was originally created as an entity within the executive branch in 2004. I'm sorry, not only in the executive branch, in the White House, in the Executive Office of the President. That didn't work out so well. The White House tried to edit their first report. It made 200 changes to their first report, prompting one of the members of the board to resign and call for it to become independent.

Congress responded a few months later. Making PCLOB independent of the White House.

Justin Hendrix:

So what do you regard is at stake right now in this suit? What could these two members of the PCLOB who have been terminated a third member Also, a reference in the suit, but did not join in the filing. What could be gained, or what could be lost, depending on how the court rules?

Greg Nojeim:

What's at stake is oversight of the government's anti-terrorism efforts, and protecting Americans' privacy and civil liberties, and privacy and civil liberties around the world. The PCLOB has issued some very strong reports. For example, its report on the Patriot Act, Section 215—a big grant of authority to the federal government. Its report declared that the government's interpretation of that statute was way overbroad. When the government said that the statute could be used to collect the phone records of every person within the United States, of every call made within, or even outside the United States. So they've been pretty bold when they see unconstitutional or illegal conduct.

Firing the members of the PCLOB almost guarantees that they can't play that role. They will worry that if they make a recommendation contrary to the president's vision of his own power. that they will be fired. So, how do they make that recommendation? I think it really hobbles their credibility, it hobbles their ability to do the job that Congress gave them, and it hobbles our rights.

Justin Hendrix: Depending on which way this goes, this could set the, could set the PCLOB in a different trajectory, one way or the other. What are the two options before the court here?

Greg Nojeim: So the court is being asked. to reinstate the fired members and they bring claims based on due process and on the separation of powers primarily.

And they point out that when they were originally created, the statute said that the members serve at the pleasure of the president. That language was specifically deleted, and it's in place of that language, Congress said the PCLOB "shall be independent." So they have a fairly strong case.

If they don't win, if they don't win, then the only hope for having a credible oversight body like the PCLOB is that Congress would pass a law and the President would sign it. That guarantees their independence and insulation from arbitrary firing.

Justin Hendrix:

So that kind of puts it in the zone of, it sounds like, decisions that many courts are being asked to make at the moment about the limits of the executive power.

Greg Nojeim:

That, that's what's at stake. That's a very good way to put it. The PCLOB, I think, is particularly important in part because of what I said about its role in protecting Americans' rights. It also has a role in the EU-US data privacy framework. That's the framework that was put in place so that Europeans could be comforted that when their data was transferred by a US tech company. to the United States, it would be protected at a level similar to that which they enjoy in Europe. PCLOB was given a significant oversight role for the US government's commitments made in that data privacy framework. You look at the decision that the European Commission issued saying that the US. provides an adequate level of protection, it mentions PCLOB 31 times. And it stresses PCLOB's independence. It sure doesn't look very independent today. And the PCLOB can't act as contemplated in that framework because it doesn't have a quorum anymore of members. It has one member. It's one Republican.

The bipartisan nature of the PCLOB has been... it's been destroyed. And so it either has to be restored by Congress or restored in the court case.

Justin Hendrix:

And that one board member, Beth Williams, is named in this suit as a defendant. The suit claims she "unlawfully ordered PCLOB staff to stay past the close of business on the night of Thursday, January 23rd, 2025 to effectuate the anticipated removals of other fellow board members." Is there anything at stake for the current makeup of the board under its single member?

Greg Nojeim:

I noticed that in the complaint, too. It says something about the ability of the board to function collegially if reconstituted.

It also says something about the ability of the government to recruit good people to serve on the PCLOB. You don't want to serve with someone who you can't trust, and [00:29:00] you don't want to serve on a board that isn't going to be free to be aggressive defenders of rights.

Justin Hendrix:

What do you expect will be the timing from here?

Is this a type of decision that will have to be made quickly by the court, or should we expect this to drag out for a bit?

Greg Nojeim:

I'm not sure about how quickly the court can act. I don't think that the plaintiffs asked for a preliminary injunction. I think that they are on the regular course of business.

However, it's important to note that one of the two plaintiffs, their holdover term on the PCLOB only lasts a year. So that plaintiff will the case will be irrelevant to that person at Felton if it drags on for more than a year. My view is the court should act quickly because a lot is at stake. Justin it's [00:30:00] important also to note that PCLOB has dropped below quorum in the past.

The first time, it took almost five years to restore a quorum. The next time, it took, I think it was eight months. Another time, it took five months. So, Who is the president? Even if this litigation is dragging on and Congress hasn't acted, I'm worried about the PCLOP ever becoming an effective oversight body again without a congressional action.

It seems quite possible that the president would simply fill the remaining seats with people who are sympathetic to the president. That's been his modus operandi since he got back into office. Fire the people who might be who might object. On legal grounds to some of the actions he's taken, bring in people who will agree.

What does that mean for this board? I think it means that it couldn't be effective.

Justin Hendrix:

I guess also notable that Travis LeBlanc, Edward Felton were nominated by Trump, despite the fact that they are Democrats.

Greg Nojeim:

Yep. They were nominated by Trump. They were confirmed overwhelmingly in the Senate.

And there was no justifications cited for firing them that related to their performance or to any malfeasance. It's just a one line note saying you're fired. Sounds familiar this day and age.

Justin Hendrix:

Greg, thank you very much.

Greg Nojeim:

Thank you.