Section 702 of the Foreign Intelligence Surveillance Act (FISA) expires on December 31, 2023 unless Congress acts to renew it either in its present form or as amended. The urgency of the potential expiration of America’s most important foreign intelligence collection tool barely weeks away has prompted a legislative proposal by Senator Ron Wyden (D-OR) and his legislative co-sponsors, called the Government Surveillance Reform Act of 2023 (GSRA).
The GSRA proposes that Section 702 be renewed, but it also mandates a host of changes that impair the agility of Section 702 as an intelligence tool. (Other sections of the bill addressing different intelligence collection or law enforcement activities and having little or nothing to do with Section 702 are not discussed here). A detailed review of the Section 702 collection program incorporating the origins and legal analyses underlying the program appears in the Journal of National Security Law & Policy’s recently published FISA Section 702’s Challenging Passage to Reauthorization in 2023. What follows here is an effort to concisely address the most significant changes to Section 702 in the GSRA.
The GSRA’s Court Order Requirement for U.S. Person Queries
Certainly, the most controversial of the proffered changes is the requirement that the government obtain a probable cause-based court order before querying the database containing Section 702-acquired communications in any circumstance where the compelled production of such information in a law enforcement setting would require the issuance of a warrant. Put more succinctly, the GSRA wants the government to obtain a probable cause-based court order before using a U.S. person query term to find and retrieve communications from the Section 702 database. Long-time critics of Section 702 have trumpeted this reform as ending the “backdoor search” – the pejorative term critics coined to describe this type of querying activity.
Accordingly, it is appropriate to begin by noting that the “backdoor search” is arguably not a “search” at all, in the legal sense of representing an event requiring separate Fourth Amendment analysis. Those who coined the term “backdoor search” point to a 2019 decision (pp. 68-79), United States v. Hasbajrami, in which the Second Circuit held that, in certain circumstances, Section 702 querying implicates Fourth Amendment concerns. The Second Circuit instructed the district court on remand to determine, on the facts of Hasbajrami’s case, whether querying the Section 702 database was lawful when evaluated in the context of the Fourth Amendment’s overall requirement of reasonableness. In contrast, the Foreign Intelligence Surveillance Court (FISC), which addresses more Section 702 issues than all other federal courts combined, has repeatedly rejected the proposition (pp. 86-87) that the “querying of information lawfully acquired under Section 702 be considered a distinct Fourth Amendment event requiring a reasonableness determination independent of the other circumstances of acquisition.” The FISC reiterated this stance most recently in its April 2023 opinion when it stated (p. 73), after acknowledging the Second Circuit’s contrary opinion, that it would “respectfully adhere to the view that Fourth Amendment objectives are properly served… by examining the reasonableness of such procedures as a whole” rather than isolating the querying process for separate Fourth Amendment inquiry.
Consequently, when critics talk about “200,000 of these ‘backdoor searches’… last year alone,” they are simply describing the process of using a U.S. person identifier to query the Section 702 database, which only contains communications already lawfully acquired pursuant to a FISC-authorized Section 702 acquisition. Viewed from this perspective, the term “backdoor search” seems a bit disingenuous when used to describe the querying of lawfully acquired communications already in the government’s possession. No violation of any U.S. person’s constitutional rights occurs in this process.
In September, a bare majority of the Privacy and Civil Liberties Oversight Board (PCLOB) issued a report acknowledging that there is no legal requirement mandating a court order before querying the Section 702 database using U.S. person identifiers (p. 184). The report recommended that, as a policy initiative, Congress require that the government secure a court order before examining the contents of any communication retrieved from the Section 702 database using U.S. person identifiers as querying terms (pp. 205-208). In notable contrast to the GSRA, however, the PCLOB recommendation proposed that the government be permitted to run the query first and, only if the query identified the presence of responsive communications, then obtain the court order before examining the contents of those communications. Significantly, the PCLOB majority’s suggested standard for issuing such an order is whether the query is “reasonably likely to retrieve foreign intelligence information” – a chasm apart from the GSRA’s onerous probable cause standard.
The GSRA requires that the government demonstrate both (1) that the query is reasonably likely to retrieve foreign intelligence information (Section 101); and (2) that there is probable cause to believe that the U.S. person associated with the identifier proposed as a query term is an “agent of a foreign power” as defined in FISA. If passed by Congress, this proposed mandate will suffocate the FISC and grind critical intelligence analysis to a halt. The FBI, at which GSRA’s warrant requirement is principally directed, ran nearly 120,000 U.S. person queries in 2022 (p. 24). By comparison, the FISC issued only 337 Title I FISA probable cause orders in 2022 (p. 12). Simply put, the FISC lacks the resources to address the tidal wave of applications that the GSRA’s new requirement would produce – especially given that the GSRA burdens the FISC with other new reporting and oversight duties while affording no additional resources.
The GSRA’s proposed restrictions on the use of U.S. person identifiers to query the Section 702 database ignores the findings of the President’s Intelligence Advisory Board (PIAB) that “U.S. person queries are necessary in order to identify foreign threats to the homeland” and imprudent restrictions will render the government “far less capable of identifying potentially harmful links between foreign threats and U.S. persons” (p. 5). Expressed more bluntly by Jamil Jaffer and former Attorney General Michael Mukasey in The Wall Street Journal, the GSRA’s proposed restrictions on querying the Section 702 database are “nonsensical and unduly burdensome.”
The FBI is the principal focus of the GSRA’s reforms, so it is relevant that the FBI only has access to Section 702-acquired communications for targets the FBI itself nominated for collection. In 2022, for example, this afforded the FBI access to only 3.2% of Section 702 targets – roughly 8,000 of the 246,073 foreigners targeted under Section 702 (pp. 18, 22). Significantly, the FBI nominates for collection only those targets associated with open, fully predicated national security investigations – the most serious class of investigation in the FBI’s investigative hierarchy. Accordingly, any U.S. persons in those communications are communicating with foreigners who are targeted as subjects of a predicated national security investigation. As Jaffer and Mukasey explained:
When the government gathers a non-American’s communications abroad, it’s also privy to his communications with Americans. This is a feature, not a bug. Foreign targets could be terrorists or intelligence officers, making it wholly reasonable to examine their communications with Americans, who could be bad actors themselves, accomplices, or intended victims.
The FBI’s record of compliance with Section 702’s regulations and procedures is admittedly challenging and deserves attention in the debate over its reauthorization. I have written here and here about reasonable, responsible reforms to address compliance issues without impairing its indispensable intelligence value. Those measures should not include a probable cause-based court order requirement that, in the words of a National Security Council spokesperson, is “operationally unworkable and would blind us to information already in our holdings that, often, must be acted upon in time-sensitive ways in order to prevent lethal plotting on U.S. soil, the recruitment of spies by hostile actors, the hacking of U.S. companies, and more.”
Other Questionable GSRA Reforms to FISA Section 702
While the warrant requirement for querying U.S. person identifiers represents the most imprudent revision to Section 702, the GSRA proposes other reforms that are also unwise, unnecessary, or both.
“Abouts” Collection
Section 103 of the GSRA repeals the current statutory language that allows NSA to resume “abouts” collection in certain limited circumstances. “Abouts” collection arises in the “upstream” portion of Section 702 surveillance and refers to communications in which an individual is referenced but did not himself send or receive the communication. “Abouts” collection has persistently concerned civil liberties and privacy advocates. Only NSA conducts “upstream” collection, and NSA terminated “abouts” collection in 2017. Congress codified that termination in the FISA Amendments Reauthorization Act of 2017, which added that the government “may not intentionally acquire communications that contain a reference to, but are not to or from” an authorized target. However, the Act permits the resumption of “abouts” collection pursuant to a specific set of authorizations by the Attorney General, the Director of National Intelligence (DNI), and the FISC, with “written notice” to Congress. This permission has never been invoked.
Consequently, the GSRA’s proposed permanent ban on “abouts” collection seems superfluous and a bit myopic. When NSA ceased “abouts” collection in 2017, it cited “mission needs, current technological constraints, United States person privacy interests, and certain difficulties in implementation” as the reasons for its decision. Technological developments certainly make it plausible that both U.S. person privacy interests and implementation concerns might be resolved in a way that permits resuming “abouts” collection in a manner that adequately protects those U.S. person privacy interests. Given the impact on collection capabilities produced by the constant evolution in technology, permanently banning a collection activity of demonstrated intelligence value when that capability might one day be employed in a manner consistent with both intelligence needs and U.S. person privacy interests seems short-sighted.
Additional FISC Supervision of Section 702 Directives
Once the FISC approves a Section 702 acquisition, the Attorney General and the DNI may direct an electronic communication service provider (ECSP) to provide the information, facilities, and technical assistance necessary to accomplish the acquisition. In return, the ECSP is compensated for its services at prevailing commercial rates and afforded immunity from any legal liability predicated on the assistance provided. An ECSP may challenge a directive by petitioning the FISC, although there is no public record of any such challenge ever being filed.
Section 106 of the GSRA requires the government to demonstrate to the FISC that the ECSP’s requested technical assistance is “necessary, narrowly tailored to the surveillance at issue, and would not pose an undue burden on the [ECSP] or its customers.” This standard will require the FISC to immerse itself in the details of modern communications technology to assure that the assistance sought by the government from the ECSP is, in fact, “necessary, narrowly tailored to the surveillance at issue, and does not pose an undue burden to the ECSP and its customers.” The delay and expense precipitated by this mandate will only serve to further burden the FISC and impair the flexibility and timeliness that is essential to Section 702’s value as an intelligence tool.
The Requirement of a Foreign Intelligence Purpose
Presently, a certification seeking FISC approval for a Section 702 acquisition requires an attestation that a significant purpose of the acquisition is to obtain foreign intelligence information. The GSRA removes the modifier “significant” and mandates that the purpose, presumably meaning the sole purpose, of any Section 702 acquisition must be to obtain foreign intelligence information.
As the Foreign Intelligence Surveillance Court of Review observed in In re Sealed Case, attempting to distinguish between the foreign intelligence and law enforcement purposes of any particular electronic surveillance rests on suppositions that are “inherently unstable, unrealistic and confusing.” FISA defines “foreign intelligence information” as information related to nouns like “agent of a foreign power,” “sabotage,” and “international terrorism.” These nouns are themselves defined in terms of criminal conduct. For example, an “agent of a foreign power” is someone who knowingly engages in sabotage, international terrorism, or clandestine intelligence gathering activities that violate, or may violate, U.S. criminal statutes. Thus, the GSRA seems to foreclose using communications acquired pursuant to a FISC-approved Section 702 certification for any law enforcement purpose even though “foreign intelligence information” subsumes information on activities that violate or may violate U.S. criminal statutes. Further, such “unstable, unrealistic and confusing” distinctions threaten to resurrect “the wall” that disastrously impaired intelligence sharing before 9/11. The GSRA’s befuddling statutory construction will degrade national security by recreating unnecessary and artificial tension between foreign intelligence collection and law enforcement activities.
Like a holiday stocking hung especially for opponents of government surveillance, the GSRA is stuffed with proposed changes that will individually and collectively make the Section 702 collection program and other intelligence collection and law enforcement activities more difficult notwithstanding that not one of the impacted activities violates the Constitution. Those concerned with the reauthorization of Section 702 have been awaiting serious legislation that responsibly and reasonably addresses the statutory construct of the nation’s most indispensable intelligence collection program. Sadly, with the introduction of the GSRA, the wait for such reasonable and responsible Section 702 legislation continues.