Editor’s Note: This is part two in a multi-part series on foreign intelligence surveillance reform. Part one is available here.
Section 702 was added to the Foreign Intelligence Surveillance Act in 2008 to allow the U.S. government to acquire critically important intelligence from foreign targets that use U.S. communications services. As the Director of the National Security Agency (NSA), General Paul Nakasone, recently explained at a public forum sponsored by the Privacy and Civil Liberties Oversight Board (PCLOB), “FISA Section 702 is irreplaceable” and plays an “outsized role in protecting the nation” by “providing some of the most valuable intelligence on some of our most challenging targets.” From its statutory construct to its practical application to its expansive compliance regimen, the Section 702 surveillance program represents a carefully configured national intelligence undertaking of “irreplaceable” value to the national security. However, Section 702 is not a permanent surveillance authority; it requires periodic reauthorization by Congress and is currently scheduled to expire on December 31, 2023. The most important foreign intelligence “reform” question of this year is what this indispensable authority will look like by the end of the 2023 congressional reauthorization debate.
In a recent Just Security article (the first in a series on foreign intelligence reform) Elizabeth Goitein from the Brennan Center for Justice described Section 702 of the Foreign Intelligence Surveillance Act (FISA) as “a go-to domestic spying tool for the FBI” and predicted that this intelligence collection authority, ”will not be renewed without a major overhaul” while describing General Nakasone’s comments as “tone deaf” “boilerplate.” Some background, and a differing perspective, on the debate over Section 702 is merited.
On the day it became law in 2008, the ACLU and other privacy and civil liberties organizations sued to have Section 702 declared unconstitutional. That challenge was rejected by the Supreme Court on standing grounds and, since then, Congress has reauthorized Section 702 twice (2012 and 2017) despite intense opposition from many of these same critics. In recent weeks, the Supreme Court turned aside yet another ACLU challenge to Section 702, and every court to have considered the question has affirmed the program’s constitutionality. Indeed, the “back door” search issue and the other challenges raised by Section 702’s opponents are not new.
This is, most assuredly, a very critical year for Section 702. The usual consortium of conservative libertarians and civil liberties advocates who have historically opposed Section 702 is now joined by those in the House of Representatives who have expressed concerns regarding the “weaponization” of the federal government.
Among the alleged flaws that may have prompted some defenders of Section 702 to remain silent or accept that Section 702 will not exit the reauthorization process in a form resembling its present configuration is the contention that the FBI is employing Section 702 as a “domestic spying tool” through its massive use of “warrantless” “back door” searches. In any reform discussion, however, it is imperative that the NSA and other agencies that do not have a law enforcement mission be addressed separately from the FBI, and with respect to the latter, there are targeted, sensible reforms regarding use of Section 702-acquired information for non-national security investigations that would avoid throwing the baby out with the bathwater.
How Section 702 Works
Understanding how the term “warrantless” – often used by Section 702 opponents – applies in this context first requires understanding the underlying design of Section 702, which permits the government to acquire foreign intelligence information by targeting the communications of non-U.S. persons reasonably believed to be located outside the United States. These non-U.S. person targets have no rights under the Fourth Amendment so no warrant is needed to collect communications obtained pursuant to an authorized Section 702 acquisition. The targeting of any U.S. person, anywhere, at any time is specifically prohibited by Section 702. However, as Congress recognized, Section 702 acquisitions of foreign communications would also “incidentally” acquire the communications of those U.S. persons who happen to communicate with foreign targets, and these communications, like those of the foreigners actually targeted, are stored in the Section 702 database retained by NSA which is the “lead” agency for Section 702 collection.
The scope of this “incidental” collection is significant because Section 702 is a large, programmatic surveillance program collecting hundreds of millions of communications from its foreign targets (232,432 in 2021, for example), so the number of “incidentally” acquired U.S. person communications is also sizeable. These aggregate numbers for Section 702 collection are largely irrelevant to the “back door” search issue because the FBI receives access only to the communications generated by the particular targets that the FBI has nominated for collection. In 2021, for example, this afforded the FBI access to only 4.4% of those Section 702 targets – or roughly 10,000 of the 232,432 foreigners targeted. FBI practice is to target those foreigners considered relevant to its fully predicated national security investigations – and the incidental U.S. person communications included in the FBI’s access to this limited part of the Section 702 database are those of American “friends, relatives, and colleagues” communicating with these FBI-nominated foreign targets.
Congress predicated its construct of Section 702 upon accepted doctrine that a reasonable search or seizure meets the requirements of the Fourth Amendment, and then created a statutory and compliance architecture to satisfy that standard under which the Section 702 program operates. This includes targeting, minimization, and querying procedures that afford U.S. person communications privacy protections consistent with the government’s need to obtain, produce and disseminate foreign intelligence. Those procedures must be approved by the Foreign Intelligence Surveillance Court’s (FISC) as meeting the requirements of the Fourth Amendment before they are implemented. This structure for Section 702 collection has repeatedly been confirmed as fulfilling the Fourth Amendment’s standard of “reasonableness” even in the context of the scope of incidental collection that Congress understood to be an acknowledged feature of programmatic Section 702 collection.
Section 702 opponents, however, generally dismiss both the FISC and what they insist is the truncated, constitutionally deficient judicial review process that Congress provided for Section 702 certifications, which “detail[] the type of information to be collected.” Notably, however, while Section 702 limits the matters subject to review by the FISC to the certification and targeting, minimization, and querying procedures used with a Section 702 acquisition, it imposes no strictures on the latitude afforded the FISC in conducting its review. The language used by Congress in Section 702 directs the FISC to satisfy itself that these targeting, minimization, and querying procedures are “consistent with [Section 702] and with the fourth amendment to the Constitution of the United States.” The FISC is statutorily unfettered with regard to the process it pursues to reach its conclusion and, consequently, it does not limit its review to the statutory procedures as written but extends that review to include an examination of how those procedures have been and will be implemented in practice.
To be clear, this Fourth Amendment review is not undertaken by administrative functionaries beholden to the Intelligence Community or broader executive branch; the FISC is populated by life-tenured federal district judges who are appointed to the FISC by the Chief Justice of the U.S. Supreme Court for seven-year terms. In examining every Section 702 certification, these judges consider “every identified compliance incident reported by the government through notices and reports, other reports concerning implementation and compliance information such as the number of targets and other statistical information, the results of oversight reviews, and assessment of compliance trends.”
Once communications are obtained pursuant to an authorized Section 702 acquisition, those communications are stored in the Section 702 database. That database represents a sort of primordial “stew” the contents of which are accessed by “querying,” which NSA’s Querying Procedures (approved by the FISC) describe as “the use of one or more terms to retrieve the unminimized contents … of Section 702-acquired information from an NSA system.” In other words, the content of any particular communication in the Section 702 database, including the incidentally collected communications of U.S. persons, is unknown until a query is initiated that extracts that communication from the database.
No court order is needed to search the Section 702 Database using U.S. person query terms to find foreign intelligence information
It is the querying of the Section 702 database using a “U.S. person” query term (meaning terms that are “reasonably likely to identify one or more specific U.S. persons”) that is of most concern to Section 702’s critics. There is no dispute regarding the government’s legal authority using Section 702 to acquire the communications of targeted non-U.S. persons located outside the United States. If one’s view of querying is that only the initial Section 702 acquisition is a Fourth Amendment search or seizure (this Fourth Amendment interpretation to the querying of the database was clearly expressed in U.S. v. Mohamud (D. Or. June 24, 2014), aff’d, 843 F.3d 420 (9th Cir. 2016) (“subsequent querying of a § 702 collection, even if U.S. person identifiers are used, is not a separate search and does not make a § 702 search unreasonable under the fourth Amendment”)), any subsequent querying of those lawfully acquired communications requires no separate Fourth Amendment justification.
But some courts (such as the Second Circuit in 2019) and commentators say that the querying of the Section 702 database using U.S. person identifiers is a separate search that implicates the Fourth Amendment, and Section 702’s critics insist that the FBI’s querying of that part of the Section 702 Database to which it has access using a U.S. person query term to obtain “evidence of a crime” in pursuit of its law enforcement functions does require separate Fourth Amendment justification. Goitein goes even further, based on past NSA compliance issues (her examples date from 2017 and 2011), to argue that the querying of the Section 702 database using U.S. person query terms by any of the four agencies having access to all or, in the FBI’s case, some part of that database “requires the government to obtain a probable cause court order before performing U.S. person queries.” In her view, where a U.S. person query term is used to query the Section 702 database in a “foreign intelligence investigation,” the government must obtain a FISA Title I order from the FISC. Alternatively, where the U.S. person query is used for a law enforcement purpose, a warrant based upon probable cause must be secured from a federal magistrate judge.
Even accepting the premise that searching the Section 702 database of communications already lawfully acquired under the authority of a FISC-approved Section 702 certification constitutes yet another search, the Fourth Amendment’s “reasonableness” standard simply does not require a FISA Title I order to use a U.S. person query term to find and extract foreign intelligence information.
NSA, the focal point for Section 702 collection, is a foreign intelligence agency with no law enforcement mission. Congress specifically provided that Section 702 acquisitions targeted at non-U.S. persons reasonably believed to be located outside the United do not require a Title I court order. Equally significantly in terms of the Fourth Amendment analysis, as noted earlier, the NSA Querying Procedures, approved by the FISC as meeting the requirements of the Fourth Amendment, provide that the only purpose for which NSA analysts can query the Section 702 database is to retrieve foreign intelligence information.
Courts have recognized that this foreign intelligence focus triggers an entirely different “reasonableness” assessment under the Fourth Amendment than that used either for law enforcement purposes or to assess whether a U.S. person can be targeted as an “agent of a foreign power” under FISA Title I. This analysis recognizes both the existence of a foreign intelligence exception that exempts the query from the law enforcement-based warrant requirement, and that the application of the court-approved minimization and querying procedures serves to make the query’s intrusion into individual privacy interests “reasonable” when balanced against the government’s interest in national security – an interest repeatedly recognized by the courts as being of the “highest order.”
There also are serious adverse practical consequences to obtaining a FISA Title I order whenever a U.S. person query term is used in “foreign intelligence investigations.” The Fourth Amendment reasonableness analysis that accepts the compliance architecture as a proxy furnishing acceptable privacy protections in connection with querying the Section 702 database also recognizes as reasonable the government’s need for flexibility to act with dispatch in serving the government’s paramount interest in protecting the national security. The debilitating impact of obtaining a FISA Title I order whenever a U.S. person query term is used to find and extract foreign intelligence from the Section 702 database is starkly demonstrated by these numbers: in 2021, the FISC issued a total of 430 orders authorizing FISA Title I surveillance while the NSA, CIA and NCTC conducted 12,748 queries of the Section 702 database using U.S. person query terms designed to find and extract foreign intelligence. Requiring the government to seek a FISA Title I court order for these 12,748 queries would overwhelm the 10 current members of the FISC and cripple the Intelligence Community’s ability to provide crucial intelligence to policy makers on a timely basis – a practical reality of which Section 702 opponents are assuredly aware.
Any reforms Congress addresses to FBI querying issues should be limited only to FBI queries not designed to retrieve foreign intelligence information
The ”back door” search issue, a term coined by Section 702 critics, was at issue during the last reauthorization of Section 702 in 2017, and Congress responded by adding additional querying procedures to the panoply of statutory requirements governing Section 702 acquisitions. Those querying procedures include the requirement that, in connection with a predicated criminal investigation opened by the FBI unrelated to the national security, the FBI may not access the content of communications in the Section 702 database using a U.S. person query term that is not designed to find and extract foreign intelligence information without first procuring an order from the FISC demonstrating probable cause that the USP query term will produce (1) evidence of criminal activity, (2) contraband or the fruits or instrumentalities of crime, or (3) property designed for use or intended for use in committing a crime.
While appearing to address the “back door” search issue on paper, these new querying mandates have not allayed the objections of Section 702 critics because, in practice, since 2017, the FBI has yet to seek a single order under the “F(2)” querying requirement and, in April 2022, the Office of the Director of National Intelligence reported that there had been four “identified instances” in 2021 where a FISC order “was required pursuant to Section 702(F)(2) but not obtained” prior to reviewing the results of a U.S. person query.
For the first time, the 2022 DNI Statistical Transparency Report also provided statistics about the scope of the FBI’s querying of that part of the Section 702 database to which it has access. While the methodology and parameters used to produce these FBI querying statistics are somewhat arcane — the Report devotes four pages to explaining them – it is apparent that, by any standard of measurement, the FBI’s querying of unminimized Section 702 content dwarfs the cumulative querying totals of the NSA, CIA and NCTC. This reflects, in significant part, the FBI’s unique role in both foreign counterintelligence and law enforcement, but it would be obtuse to ignore the statistics in the 2022 DNI Statistical Transparency Report reflecting a challenging compliance environment at the FBI.
Only a measured response, limited to identified problems, can avoid significant harm to this valuable national security intelligence program
Given the continuing nature of the FBI’s querying problems, it will not be a surprise to see Congress entertain some measure of reform to address these FBI querying issues. But prudence dictates that, with additional reporting on Section 702 forthcoming (e.g., the 2023 DNI Statistical Transparency Report, the Director of the Administrative Office of U.S. Courts Report on Foreign Intelligence Surveillance Courts’ Activities, and other compliance reports required by law), serious consideration of any substantive legislative change should await receipt and analysis of this additional information.
Most important, if legislative revisions of Section 702 follow, they should be directed solely to addressing known FBI compliance problems and focused exclusively on the FBI’s use of U.S. person query terms that are not designed to find and extract foreign intelligence information. By way of example only, and similarly to the crimes limitations for which electronic surveillance can be used for law enforcement purposes, Congress could (1) specifically limit the FBI’s use of information derived from Section 702 to “foreign intelligence crimes” to ensure a tighter nexus between Section 702’s foreign intelligence purpose and any prosecutions based, in whole or in part, on Section 702-derived information; (2) reexamine the “Rule of Construction” found in Section 702(f)(2)(F) with a view towards allowing access to the Section 702 Database only in connection with predicated FBI investigations, but not with assessments; and (3) analogous to current NSA standards, require that the FBI’s use of any USP query term used to find and extract foreign intelligence receive prior review and approval by the FBI Office of General Counsel and require periodic reapprovals. Such measures could be combined with statutory restrictions on Section 702 access within the FBI, and increased reporting and compliance mandates, to protect the privacy interests implicated by Section 702’s incidental collection of U.S. person communications.
To quote Susan Hennessy and Ben Wittes during the last Section 702 reauthorization cycle in 2017 that seems equally apt here, “start with panicky civil libertarians, sprinkle in some right-wing conspiracy theories about [the “weaponization” of the Intelligence Community], and polish it off with a healthy dose of congressional dysfunction and the result is bad surveillance policy in the name of reform.” But misdirected legislating is far too dangerous for a world menaced by Chinese belligerence, North Korean missiles, Iranian-sponsored terrorism and Russian aggression. Congress must proceed with caution, using a scalpel not a truncheon, and carefully tailor any reform to ensure that the indispensable value of Section 702 as the nation’s most important foreign intelligence collection authority is preserved.