Editor’s Note: This is part of a multi-part series on the FISA Section 702 reauthorization and reform debate.
On its website, the American Civil Liberties Union (ACLU) presents “Five Things to Know About NSA Mass Surveillance and the Coming Fight in Congress.” The “Coming Fight in Congress” refers to the debate that already has begun over the reauthorization of Section 702 of the Foreign Intelligence Surveillance Act (FISA). Section 702 permits the U.S. government to acquire critical intelligence from foreign targets using U.S. telecommunications services. Unlike the other collection authorities provided in FISA, Section 702 requires periodic reauthorization by Congress. The most compelling national security question this year is whether Congress will reauthorize Section 702 and, if so, what form that reauthorization will take.
With the surveillance program scheduled to sunset at the end of 2023 unless renewed, an odd pairing of opponents of Section 702 on the left (who have long expressed disdain for U.S. intelligence agencies) and the “Freedom Caucus” Republicans in the House of Representatives, who have expressed their own, very different, concerns regarding the “weaponization” of the federal government, are opposing its reauthorization.
While the ACLU focuses on five “things,” its most serious allegation is that “Section 702 has morphed into a domestic surveillance tool,” so we address this issue first.
- “Section 702 has morphed into a domestic surveillance tool.”
Significantly, even Section 702’s critics generally concede that the acquisition of the communications of foreign targets pursuant to a FISC-approved certification is lawful. Among those critics, not all are opposed to Section 702 as a foreign intelligence collection program but, instead, take issue with some of the ways in which Section 702-acquired data is used. For the ACLU and others, the most serious of the allegations of misuse of Section 702-acquired data is the charge that the program has morphed into a domestic spying tool, and opponents have made this “domestic surveillance tool” claim a centerpiece of their opposition to Section 702’s reauthorization. The ACLU says that Section 702 “is frequently used today to pursue domestic investigations of all kinds,” that “FBI agents routinely run ’backdoor’ searches looking for information about Americans as part of criminal investigations, including those that have nothing to do with national security,” and that the “standard for conducting backdoor searches is so low that, without any showing of suspicion, an FBI agent can type in an American’s name, email address, or phone number, and pull up whatever communications the FBI’s Section 702 collection has vacuumed into its database over the past 5 years,” an opportunity that, the ACLU states, represents “a free pass for accessing constitutionally protected communications that would otherwise be off limits to the FBI, unless it got a warrant.” The term “backdoor” search is the pejorative term used by Section 702 opponents to describe the process used when government analysts search or “query” the database of Section 702-acquired communications to retrieve foreign intelligence information or also, in the case of the FBI, evidence of crime.
The FBI has access only to that small part of the Section 702 database retained by the National Security Agency (NSA) containing communications generated by the particular targets that the FBI has nominated for collection – 3.2% of that total database according to the 2023 Annual Statistical Transparency Report (ASTR) released by the Director of National Intelligence. This represents roughly 8,000 of the 246,073 Section 702 targets in 2022 and, notably, the FBI nominates for collection only those targets associated with open, fully predicated national security investigations – the most serious class of investigation in the FBI’s investigative hierarchy. Significantly, in June 2021, the FBI reconfigured its technical systems to change the default setting to require its personnel to affirmatively “opt-in” to run any query against that limited part of the Section 702-acquired communications database to which FBI personnel have access. In 2022, the first full year reflecting the impact of this and other remediation efforts, FBI queries using U.S. person (“USPER”) query terms (e.g., terms employing USPER identifiers such as names, addresses, or telephone numbers) declined by nearly 96% (see figure 9).
The querying requirements added to Section 702 by Congress in 2017 contain specific provisions directed to the querying activities of the FBI, including what is known as the “F(2) requirement.” That provision mandates that, in cases unrelated to the national security, the FBI obtain a probable cause-based order from the Foreign Intelligence Surveillance Court (FISC) before accessing the contents of communications in the Section 702 database using a USPER query term that is not designed to find and extract foreign intelligence information. The F(2) requirement does not apply to querying the Section 702 database using USPER query terms for evidence of a crime related to national security, nor does it apply to queries designed to find and extract foreign intelligence information.
FISA requires that significant judicial decisions interpreting Section 702 be made publicly available in redacted form. The redacted FISC opinions released over the past several years have not been kind in addressing FBI querying activities. Information contained in those FISC opinions shows, for example, that, until June 2021 when it both reconfigured its technical systems and revised its “batch” query procedures, the FBI ran batch queries without having the requisite specific factual bases to believe that those queries were reasonably likely to return foreign intelligence information or evidence of a crime. A “batch query” is where the FBI runs multiple query terms at the same time using a common justification for all of the query terms. However, each of the query terms used in a batch query is counted as a separate query and each term must individually satisfy the FBI’s FISA Query Guidance. Because of this multiple sequencing function that counts each query separately and requires each query term be supported by a specific factual basis to support the reasonable belief that the term will retrieve foreign intelligence information or evidence of crime, a single error or a few errors in a single batch job may, and did, produce thousands of improper queries substantially affecting the overall FBI compliance rate.
In November 2021, the FBI issued comprehensive guidance on conducting FISA queries to its national security workforce that incorporates the June 2021 compliance remediation measures. That guidance reveals that all queries of raw Section 702 collection must have the purpose of, and be reasonably tailored to, retrieving foreign intelligence information or evidence of a crime, and be supported by a specific factual basis showing that the query is reasonably likely to retrieve foreign intelligence information or evidence of a crime. FBI procedures also require that, prior to reviewing any Section 702-acquired content retrieved using a USPER query term, FBI personnel document that the query was reasonably likely to retrieve foreign intelligence information or evidence of a crime. If the latter, a fair summary of those querying procedures is that agents cannot run queries in connection with purely domestic crimes unless there is a specific factual basis supporting a belief that the Section 702 database will have information relevant to those crimes. Of the 119,383 queries using USPER identifiers run by the FBI in 2022, only 16 were used with queries having as their sole purpose the return of evidence of crime. Juxtaposed against these compliance requirements and statistics, the ACLU saying that evidence of “domestic investigations of all kinds” will be retrieved in response to a query of the FBI’s Section 702 database is a clear overstatement.
Cumulatively, since June 2021, the FBI has clarified its standards for a USPER query, reconfigured its technical systems to ensure that users specifically opt in to access unminimized Section 702-acquired information, and mandated that personnel record the specific factual basis for a query using a USPER identifier before accessing the contents of communications retrieved by such a query. All of these changes were directed to correcting the most frequent causes for non-compliant querying activity, and the FISC has expressed its encouragement in these “heightened documentation requirements, several system changes, and enhanced guidance, training, and oversight measures” as “having the desired effect.” That the FISC would make these observations and reach these conclusions undermines the ACLU’s argument on the FBI’s use of Section 702 as “a domestic surveillance tool.” Moreover, there is a false accusation that the CIA also uses its access to Section 702 data to “examine the private communications of Americans it is investigating” – this is simply wrong, because the CIA can only query using USPER identifiers for foreign intelligence information.
None of the foregoing is offered to rationalize or excuse the FBI’s past querying problems, or occasional errors or compliance problems – but those are transparently addressed under existing law and guidelines and the record is improving over time. Relying on older, past compliance incidents to excoriate the current improved FBI querying practices is like arguing that a traffic intersection remains too dangerous based upon accident statistics compiled before the “Stop” sign was installed.
- “The NSA uses Section 702 to conduct at least two large-scale surveillance programs.”
Apparently intended to accentuate the intrusiveness of Section 702, this is a misleading exaggeration. As the Privacy and Civil Liberties Oversight Board (PCLOB) more accurately describes: “[t]here are two types of Section 702 acquisition: what has been referred to as ’PRISM’ collection and ’upstream’ collection.” In 2017, “PRISM” was rebranded as “downstream” collection, but the operating characteristics of this form of acquisition remained the same.
In downstream collection, the government sends a selector, such as an email address, to a U.S.-based electronic communications service provider, such as an Internet service provider (e.g., Microsoft, Google and Yahoo), and the provider is compelled to give the communications sent to or from that selector to the government. Downstream collection does not include the acquisition of telephone calls, and all data collected is sent to the NSA.
Upstream collection occurs with the compelled assistance of providers (e.g., Verizon, AT&T) that control the telecommunications “backbone” over which telephone and internet communications transit. Upstream collection includes telephone calls in addition to internet communications (e.g., email and text messages). The principal difference in the collection activity is the point along the transmission path where acquisition of any particular communication occurs.
Thus, contrary to the ACLU’s characterization, the government always has used its Section 702 authority to conduct a single electronic surveillance program to target non-USPERs reasonably believed to be located outside the U.S. to acquire foreign intelligence information using two collection techniques (“upstream” and “downstream”).
- “Section 702 surveillance is expanding.”
According to the 2023 ASTR, there were 246,073 Section 702 non-USPER targets in 2022. The number of targets has increased each year (other than in 2020) since the first installment of the ASTR appeared in 2014. More foreign targets almost certainly mean more incidental collection of USPER communications, and Section 702 opponents tend to fixate on this numerical growth. Presenting an accurate perspective of the scope of Section 702 surveillance, however, requires understanding that worldwide internet usage is increasing “by roughly 500,000 users per day,” considerably expanding the number of foreign communicants potentially meeting the criteria for surveillance under a FISC-approved Section 702 certification. Most of this growth in internet usage consists of non-USPER users living outside of the United States. International internet usage is estimated at roughly 4.9 billion users, of which 4.6 billion are non-USPERs abroad, representing the theoretical pool of potential foreign targets.
A legal constant of the Section 702 program is that no USPER can be a surveillance target. Consequently, the “expansion” of Section 702 surveillance, at least insofar as measured by the increase in foreign targets, reflects the myriad foreign intelligence imperatives confronting U.S. policymakers. This, coupled with the rapid expansion in internet usage around the world, significantly increases the number of non-USPERs who may possess, transmit and/or receive foreign intelligence information as defined in FISA. Indeed, it would be surprising if the number of Section 702 targets has not increased in response to such issues as the Russian invasion of Ukraine, Chinese threats to Taiwan, the fentanyl crisis, persistent interference in U.S. elections by foreign actors, Russia’s global program of malign influence, political instability in central and west central Africa, Iranian nuclear efforts, North Korean nuclear and missile proliferation concerns, destabilizing impacts of climate change, and persistent cyber threats to U.S. critical infrastructure, to name but a few.
- “Section 702 violates our constitutional rights, but the courts have failed to intervene.”
The gravamen of the ACLU’s insistence that Section 702 is unconstitutional is its belief that “backdoor” searches are unconstitutional unless supported by a warrant based upon probable cause. No court has ever endorsed this position, so it is unsurprising that “the courts have failed to intervene.” It is true that courts have sometimes dismissed challenges to Section 702 prior to reaching the merits. But other courts have found that no constitutional violation has occurred because the collection and use of communications acquired during authorized Section 702 surveillances are “reasonable” under the Fourth Amendment. As the FISC has said:
“The touchstone of the Fourth Amendment is reasonableness [and] although [t]he warrant requirement is generally a tolerable proxy for reasonableness when the government is seeking to unearth evidence of criminal wrongdoing … it fails to properly balance the interests at stake when the government is instead seeking to preserve and protect the national security.”
In the view of the ACLU and other Section 702 opponents, however, a separate Fourth Amendment event is triggered by the use of a USPER identifier or query term to retrieve those communications once stored in the Section 702 database. While some commentators and one federal court of appeals have suggested that such a retrieval has Fourth Amendment implications separate from the initial seizure of the communication, this is not the consensus legal view and, significantly, represents a viewpoint rejected by the FISC, which declined to find that the “querying of information lawfully acquired under Section 702 be considered a distinct Fourth Amendment event requiring a reasonableness determination independent of the other circumstances of acquisition.” In the recently released FISC opinion from April 2022, the FISC again rejects the view that the use of USPER querying terms to find and extract communications acquired during lawful Section 702 acquisitions represents a separate Fourth Amendment event.
Analytically, however, accepting this debatable premise for the sake of argument does not alter the constitutional analysis supporting the conclusion that no “warrant” or other form of court order must be secured before initiating or reviewing the results of a query reasonably designed to find and extract foreign intelligence information. Courts (including, the FISC in its most recently released redacted opinion), instead, have recognized that the appropriate consideration in evaluating the retrieval of information acquired from an electronic surveillance conducted to acquire foreign intelligence is the programmatic purpose served by that surveillance, whether that purpose serves a legitimate objective beyond routine law enforcement, and whether that purpose would be frustrated by insisting upon a warrant. Thus, the foreign intelligence focus of Section 702 collection triggers an entirely different “reasonableness” assessment under the Fourth Amendment than that used either for law enforcement purposes or, for example, to determine whether a USPER can be targeted as an “agent of a foreign power” under FISA Title I. This analysis recognizes both (1) the existence of a foreign intelligence exception that exempts the query from the law enforcement-based warrant requirement, and (2) that the application of court-approved targeting, minimization, and querying procedures serves to make the query’s intrusion into individual privacy interests “reasonable” when balanced against the government’s interest in national security – an interest repeatedly recognized by the courts as being of the “highest order.”
The courts have not “failed to intervene” to protect Americans’ constitutional rights. Rather, the ACLU has failed to convince the courts to accept its questionable view of what constitutes a “reasonable” search under the Fourth Amendment when the programmatic purpose of that search is to acquire foreign intelligence information to protect the national security.
- “Congress has the power to stop Section 702 surveillance.”
Agreed. Congress created Section 702, has twice reauthorized Section 702, and can end the Section 702 surveillance program either by affirmatively extinguishing its authority or by allowing that authority to lapse on December 31, 2023. The ACLU insists that the courts’ failure to accept its challenges to Section 702’s constitutionality leaves it to Congress to “reform” the surveillance program, and calls for the inclusion of several “reforms” – each of which is deserving of brief comment.
- “Putting an end to rampant backdoor searches” by requiring FBI agents to obtain a warrant before searching Section 702 databases for Americans’ private information.”
As discussed earlier, there is no constitutional requirement that a warrant or any form of court order be obtained prior to using a USPER query term that is reasonably designed to find and extract foreign intelligence information from the Section 702 database.
Moreover, as a practical matter, a mandate requiring a court order prior to initiating any query using a USPER identifier would effectively eliminate the use of USPER query terms in those situations requiring the flexibility and dispatch that are of particular importance to the timely production of foreign intelligence for U.S. policymakers. The repercussions are reflected in these numbers: in 2022, the FISC issued a total of 337 FISA Title I surveillance orders while the NSA, CIA and NCTC (setting aside the FBI for the moment) conducted 8,340 queries using USPER query terms to find and extract foreign intelligence. We can reasonably speculate that these queries were related to a variety of topics, to include among other things defending U.S. critical infrastructure against cyberattacks, threats to the safety of U.S. personnel, and counterintelligence threats. Requiring the government to seek a FISA Title I court order prior to initiating any of these 8,340 queries, as the ACLU suggests, would overwhelm the 11 current members of the FISC and cripple the Intelligence Community’s ability to provide crucial intelligence to policy makers on a timely basis – a practical reality of which the ACLU is almost certainly aware.
- “Narrowing the scope of Section 702 surveillance by imposing stricter rules on whom the government can target, thereby limiting the number of Americans whose communications are swept up in the course of this spying.”
The provisions of Executive Order 14086 issued in October 2022 adequately address the scope of U.S. signals intelligence activities, which includes the operation of the Section 702 surveillance program. Those provisions define both the legitimate and prohibited objectives of signals intelligence activities as well as specifically addressing privacy and civil liberties safeguards.
- “Limiting how long the government can retain information collected under Section 702 and how NSA shares that information with other agencies.”
Limits on the retention of Section 702 information are included in the minimization procedures originated by all four agencies having access to Section 702 information, and those retention provisions are reviewed by the FISC in connection with the FISC’s statutorily required review of the minimization procedures accompanying every Section 702 certification seeking authorization for Section 702 surveillance. While Congress certainly has the authority to examine retention and dissemination issues, these areas are addressed in considerable detail in the extensive compliance and regulatory regime that governs Section 702 – one of the most thoroughly regulated programs operated by the U.S. government.
- “Ensuring that the government notifies individuals when Section 702 is used against them in court and provides those individuals with sufficient information to obtain full and fair court review.”
Section 702 incorporates the provisions found in Section 106 of Title I of FISA regulating the use in any judicial proceeding of information acquired during a FISA surveillance. FISA Section 106 requires disclosure to any “aggrieved person” of any information derived from FISA electronic surveillance that the government intends to use in a proceeding against such person. In a criminal proceeding, a defendant may move to suppress the use of any such electronic surveillance, and the trial court makes the determination of whether the surveillance was lawful.
When the government seeks to use Section 702-acquired information in a criminal proceeding against any USPER, Congress has supplemented the protections found in FISA Section 106 by requiring either (i) that the FBI have first obtained an F(2) order from the FISC, or (ii) that the Attorney General make a determination that (a) the criminal proceeding “affects, involves or is related to the national security of the United States,” or (b) the criminal proceeding involves a narrow range of statutorily specified serious crimes.
Reasonable minds can differ on what is needed to assure a “full and fair court review,” but FISA already regulates the use of information derived from any FISA electronic surveillance, and then augments those protections with additional safeguards where information acquired during a Section 702-authorized surveillance and is to be offered into evidence against any USPER.
- “Increasing transparency about the number of Americans’ communications searched and collected through Section 702 surveillance.”
The question of the number of USPER communications acquired during the surveillance of Section 702 foreign targets is one that has been front and center in every reauthorization debate. Increased transparency on this issue is a worthy goal and, considering that technological advancements may offer, or soon offer, methodologies that produce a number, or some informed numerical range, for measuring the scope of this incidental collection, the call for disclosure of this metric is likely to escalate. Congress may be unwilling to renew Section 702 without production, or at least a definitive timetable for production, of the “incidental” collection data that in years past the Executive Branch has described as “impractical” or “infeasible” to generate. Executive branch representatives advocating for the renewal of Section 702 will almost certainly be pressed on this as the 2023 reauthorization debate proceeds.
* * *
The debate over renewing America’s most important intelligence collection program must produce an outcome that preserves the immense value of this intelligence tool while protecting the privacy and civil liberties of American citizens. This delicate exercise requires considerable legislative circumspection best achieved in an environment that describes the full context of Section 702’s operation, recognizes that federal courts have found Section 702’s operation to be constitutional, and rejects the allegation that the purpose of Section 702 is its use as a domestic surveillance tool against Americans.