A slim majority of a fractured Privacy and Civil Liberties Oversight Board (PCLOB) delivered a report (the “Report”) last week on the operation of Section 702 of the Foreign Intelligence Surveillance Act (FISA). Issued as the debate over the congressional reauthorization of Section 702 intensifies, the PCLOB’s divisions are reflected in the widely divergent positions expressed between the majority’s Report and a separate “statement” delivered by the PCLOB’s other members (included as Annex B to the Report). While a multitude of issues are illuminated in the positions expressed by the PCLOB’s competing factions, one particularly ill-advised recommendation generated immediate media headlines and is worthy of prompt examination.
In its “Recommendation 3,” the three member majority of the PCLOB says that “Congress should require FISC authorization of U.S. person query terms.” The recommendation advances an agenda item long-advocated by Section 702 opponents that would significantly degrade Section 702’s national security value if enacted by Congress.
I have written previously (here and here) describing how the Section 702 collection program works. After communications are collected, targeting a foreigner located abroad and following court-approved procedures, they are stored in a database of Section 702-acquired communications. Foreign intelligence information is extracted by “querying” that database, using one or more search terms to find and retrieve information from the vast collection of communications stored in that database. Query terms can include a “United States person query term” which is a term “reasonably likely to identify one or more specific U.S. persons.” The Foreign Intelligence Surveillance Court (FISC) is required to approve as consistent with the Fourth Amendment the querying procedures of each agency that has access to Section 702-acquired information. All four of those agencies’ querying procedures were approved in the FISC’s April 2023 Section 702 Opinion and Order.
The PCLOB majority now proposes requiring that the government secure a court order from the FISC before examining the contents of any communication retrieved from the Section 702 database using a U.S. person query term. This is a myopic and misguided mandate, one that the PCLOB’s minority stresses will “strangle the government’s ability to detect and thwart hostile actors already on American soil while effectively forcing additional investigation of U.S. citizens.” The Report presents its proposal as a policy recommendation because, as its majority members know and the PCLOB’s chair acknowledges, no court has ever held and applied to the government in any particular case a ruling that querying as used in Section 702 is an event requiring a separate Fourth Amendment analysis. While the Second Circuit noted in its decision in U.S. v. Hasbajrami that certain considerations surrounding querying using U.S. person identifiers “counsel in favor of considering querying a separate Fourth Amendment event,” the Second Circuit did not apply such a standard in Hasbajrami – ultimately concluding that the issues surrounding querying were so numerous and multifaceted that “we do not purport to answer them here, or even to canvas all of the considerations that may prove relevant or the various types of querying that may raise distinct problems.” In terms of evaluating how Fourth Amendment issues are addressed regarding Section 702 querying, then, the logical judicial source is the FISC, the court that addresses Section 702 issues with a regularity dwarfing all other federal courts combined. The FISC is no stranger to the question of whether querying requires a separate Fourth Amendment review: it has rejected this argument on four separate occasions – most recently in its April 2023 opinion when it stated that it would “respectfully adhere to the view” that Fourth Amendment objectives are properly served “by examining the reasonableness of such procedures as a whole” rather than isolating the querying process for separate Fourth Amendment inquiry.
Nevertheless, the PCLOB majority’s proposed ”Recommendation 3” would require the government to obtain a court order before examining, even for national security purposes, the results retrieved by querying the database of communications already lawfully acquired pursuant to electronic surveillance conducted under the authority of Section 702. To be clear, the recommendation is that Congress should require the government to obtain a court order from the FISC after actually conducting the U.S. person query of the Section 702 database and confirming the existence of responsive communications, but before accessing the content of those communications. The suggested timing for this new “order” requirement is perplexing since, for years, Section 702 opponents have insisted that a principal evil of the so-called “backdoor search” is that it invades privacy interests by compromising the anonymity of those U.S. person communicants whose identities otherwise remain unknown until a query retrieves their communications from the database. Now, according to the PCLOB chair, “although running a U.S. person query does create a privacy intrusion regardless of whether there is a hit, the privacy harm is much greater at the point personnel review the results that are returned when there is a hit.” This is a puzzling approach since no responsible Fourth Amendment analysis claims that it is acceptable to first search a property but defer obtaining a warrant until after incriminating evidence is revealed by the search because, at that point, “the privacy harm is much greater.”
The standard the majority proposes for FISC approval is whether the query is “reasonably likely to retrieve” foreign intelligence information – the standard long found in NSA’s Querying Procedures. Where the query is undertaken to retrieve evidence of a crime, something only the FBI’s procedures permit due to the FBI’s dual role in both counterintelligence and domestic law enforcement, the standard would assess whether the query is “reasonably designed to retrieve” evidence of a crime. This standard, too, already governs FBI querying practices. Substantively, then, the PCLOB’s Recommendation 3 adds a new requirement for FISC approval to the currently applicable querying standards, but, this proposed mandate is no benign layer of administrative inconvenience. Applied in practice, this “policy” proposal will suffocate the FISC and grind critical intelligence analysis to a halt. Why? Because the FBI ran nearly 120,000 U.S. person queries in 2022, and estimates that approximately 2% of those queries returned content. This would produce roughly 2400 applications to the FISC under the PCLOB proposal. In 2022, the FISC’s workload produced 337 Title I FISA orders, the adjudication of each involving a careful review and analysis. Simply put, the FISC lacks the judicial time and other resources required to address such a sizable increase in its workload.
It bears noting that the PCLOB chair would apply a heightened “probable cause” standard to these U.S. person queries, perpetuating her erroneous insistence that law enforcement warrant concepts apply in the foreign intelligence context. As the FISC has counseled, however, “although the warrant requirement is a tolerable proxy for ‘reasonableness’ when the government is seeking to unearth evidence of criminal wrongdoing … it fails to properly balance the interests at stake when the government is instead seeking to preserve and protect the nation’s security from foreign threat.” Instead, courts have recognized that the correct Fourth Amendment analysis for electronic surveillance conducted for foreign intelligence purposes examines the programmatic purpose served by that surveillance, whether that purpose serves a legitimate objective beyond routine law enforcement, and whether that purpose would be “frustrated” by insisting upon a warrant. Thus, the foreign intelligence focus of Section 702 surveillance triggers an entirely different “reasonableness” assessment under the Fourth Amendment than that used for law enforcement purposes. This analysis recognizes both the existence of a foreign intelligence exception that exempts the query from the law enforcement-based warrant requirement, and that the application of court-approved minimization and querying procedures serves to make the query’s intrusion into individual privacy interests “reasonable” when balanced against the government’s interest in national security—an interest courts have repeatedly recognized as being of the “highest order.” Application of the law enforcement warrant requirement and its probable cause standard championed by the PCLOB chair simply does not serve as a tolerable proxy for reasonableness in evaluating a U.S. person query initiated to acquire foreign intelligence information to protect the national security.
As the PCLOB’s minority members have argued, the U.S. person queries that return content are among the most critical to producing the intelligence analysis essential to national security. These are the queries that help the government identify both victims and conspirators of potential attacks. Picture this scenario: NSA or CIA is aware from Executive Order 12333 collection conducted outside the United States that a prominent foreign academic has been recruited by the Russians to serve as a malign influence asset. The asset is tasked to meet with a small group of identified current and former U.S. government officials in the Executive Branch and in Congress. CIA queries the Section 702 database, using U.S. person identifiers, and discovers that there is information about several of the identified U.S. persons in the Section 702 database that has been incidentally collected by the targeting of non-U.S. persons located outside the United States. While the Russian asset travels to the United States, has his meetings with U.S. persons as directed by the FSB, and returns home, CIA is doing the paperwork necessary to secure FISC approval to examine the content retrieved from the Section 702 database. The opportunity to act on the Section 702 information and warn the targets that they are about to meet with a Russian malign influence asset evaporates.
This is but one hypothetical example of the consequences all too likely to attend the misguided recommendation advanced by the PCLOB majority. Echoing the statement released by the National Security Council, Congress should take note that this PCLOB recommendation is “operationally unworkable and would blind us to information already in our holdings that, often, must be acted upon in time-sensitive ways in order to prevent lethal plotting on U.S. soil, the recruitment of spies by hostile actors, the hacking of U.S. companies, and more.”