Image: Kishore Newton – stock.adobe.com
Unless Congress acts soon, the most vital tool in the intelligence community’s arsenal against foreign terrorism, one that also provides “some of the most valuable intelligence on some of [the nation’s] most challenging targets,” will expire at the end of the current calendar year, namely collection under Section 702 of the Foreign Intelligence Surveillance Act (FISA). Unlike the other intelligence collection authorities provided in FISA, Section 702 is not permanent, requiring periodic reauthorization by Congress. Added in 2008, Section 702 permits the U.S. government to acquire critical intelligence from foreign targets using U.S. telecommunications services. Controversial from the start, Section 702 is now the subject of focused congressional attention as well as harsh criticism, heightened by some of the disclosures revealed in a recently released Foreign Intelligence Surveillance Court (FISC) opinion.
Why Section 702’s reauthorization is so contentious
Since its enactment, ACLU and fellow civil liberties activists have unsuccessfully challenged the constitutionality of Section 702, insisting that the section “creates a situation ripe for abuse, and undermines the balance of power between the branches of government” as well as “creates a massive end run around the Fourth Amendment’s warrant requirement.”
The traditional critics are now joined by members of the House of Representatives who condemn what they style as the “weaponization” of the federal government. In a March 2023 release, the Brennan Center, joined by 14 other signatories representing a roster of Section 702 opponents, put out a statement maintaining that Section 702 “has become a rich source of warrantless government access to Americans’ phone calls, texts and emails.” In another recent article, a director of the Brennan Center labeled Section 702 as “the go-to domestic spying tool for the FBI,” while a February 2023 article in Wired described the debate over reauthorizing Section 702 as “an existential fight over the U.S. government’s ability to spy on its own citizens.”
This contention—that Section 702 is used to spy on Americans—is grounded in events that occur after the government lawfully collects communications by targeting non-U.S. persons reasonably believed to be located outside the United States; i.e., those foreigners who are reasonably believed to possess or communicate foreign intelligence information and who have no Fourth Amendment rights. However, Section 702 is not used to target Americans. In fact, targeting Americans, whether inside or outside the United States, is specifically prohibited under the provision. What is true is that if U.S. persons are communicating with foreign targets, those communications will be “incidentally” acquired in connection with the lawful acquisition of the communications of those foreign targets. It is this “incidental” collection, and the FBI’s potential retrieval of those communications through the process of “querying” the database where Section 702 collection is stored, that lies at the heart of the “domestic spying” allegation.
How Section 702 actually works
Section 702 authorizes the government to target the communications of foreigners reasonably believed to be located outside the United States but, simultaneously, forbids targeting any U.S. person, whether or not they are located in the United States. However, Congress always has recognized that “it is simply not possible to collect intelligence on the communications of a party of interest without also collecting information about the people with whom, or about whom, that party communicates including, in some cases, non-targeted U.S. persons.” Congress acted to protect the privacy rights of those “non-targeted U.S. persons” by requiring that “the Attorney General adopt, and the Foreign Intelligence Surveillance Court (FISC) review and approve, procedures that minimize the acquisition, retention, and dissemination of nonpublicly available information concerning unconsenting U.S. persons.”
These minimization procedures, along with targeting and querying procedures (the latter representing a requirement Congress added as part of its 2017 reauthorization of Section 702), and the Acquisition Guidelines developed by the Attorney General in consultation with the Director of National Intelligence (DNI), comprise the statutory architecture that Congress created to protect the Fourth Amendment rights of those “non-targeted U.S. persons” whose communications are incidentally collected during lawful Section 702 acquisitions. The targeting, minimization, and querying procedures applied to any Section 702 acquisition must be reviewed and determined by the FISC to be consistent with the requirements of the Fourth Amendment.
Once the FISC approves a Section 702 certification, the Attorney General and the DNI issue one or more “directives” to electronic communication service providers, ordering that they furnish the government those communications to or from a list of tasked selectors (e.g., email addresses or telephone numbers)used by the targets of the authorized acquisitions. The carriers are compensated at “the prevailing rate” for providing “information, facilities, or assistance” in accordance with a directive. Communications responsive to the identified selectors are provided to the National Security Agency (NSA), which is principally responsible for the operational implementation of Section 702 and the keeper of the database of communications acquired pursuant to Section 702 surveillance.
The communications of U.S. persons corresponding with a Section 702 target using a tasked selector will be “incidentally” collected as part of the authorized acquisition of the target’s communications. The scope of “incidental” collection is not insignificant because Section 702 is a large, programmatic surveillance program collecting hundreds of millions of communications from its 246,073 foreign targets. Therefore, the number of “incidentally” acquired U.S. person communications is also sizeable. It is this “incidental” collection of U.S. person communications and the subsequent handling of those communications that lies at the heart of the allegations of “domestic spying.”
The Section 702 database maintained by NSA represents a sort of primordial vat where communications collected pursuant to FISC-approved certifications reside anonymously until retrieved by “querying.” What is querying? The FBI’s Querying Procedures describes it as “the use of one or more terms to retrieve the unminimized contents … of Section 702-acquired information that is located in an FBI system.” The DNI’s most recent Annual Statistical Transparency Report describes a “query as a basic analytic step foundational to efficiently and effectively reviewing data lawfully collected and already in the government’s possession.” In other words, the content of any particular communication in the Section 702 database and the identities of the participants in that communication, including the incidentally collected communications of U.S. persons, are unknown unless and until a query is initiated that extracts that communication from the database.
Significantly, the FBI Querying Procedures limit queries to retrieving contents located in “an FBI system,” and the FBI receives access only to those communications actually generated by the particular targets that the FBI has nominated for collection. In calendar year 2022, for example, this gave the FBI access to only 3.2% of those Section 702 targets—or a fraction comprising roughly 8,000 of the 246,073 foreigners targeted. The FBI nominates for collection only those targets associated with open, fully predicated national security investigations—the most serious class of investigation in the FBI’s investigative hierarchy. Accordingly, the U.S. person communicants in those communications will be those Americans communicating with foreigners targeted by virtue of being the subjects of those predicated national security investigations.
Consequently, the argument that Section 702 has become “a rich source of warrantless government access” representing “a massive end run around the Fourth Amendment” incorporates a questionable assumption. Namely, that the FBI’s querying of the limited part of the Section 702 database to which it has access, which contains only communications that have already been lawfully acquired pursuant to a FISC-approved surveillance, somehow requires separate Fourth Amendment justification. After all, if retrieving and examining the contents of communications already lawfully collected and now stored in a government database is not a separate “back door search” that violates the Fourth Amendment as Section 702’s opponents allege, then the critical legal presumption required to support that allegation is essentially neutralized. And, while some commentators and at least one federal appellate court have taken the view that the process of querying the Section 702 database represents a separate Fourth Amendment event, this is not the consensus legal view and, significantly, is a position rejected by the FISC itself. That court declined to hold that the “querying of information lawfully acquired under Section 702 be considered a distinct Fourth Amendment event requiring a reasonableness determination independent of the other circumstances of acquisition.” In the FISC opinion most recently released by the DNI, the FISC reiterates its rejection of “treating querying as a Fourth Amendment event” in favor of “adhering to the view that those objectives are properly served, at least in the context of the FISC’s review of procedures under § 702(j) (3)(A)-(B), by examining the reasonableness of such procedures as a whole.”
The FBI querying process
The FBI Querying Procedures require that each query of information acquired pursuant to Section 702 be “reasonably likely to retrieve foreign intelligence information, as defined in FISA, or evidence of a crime unless otherwise specifically exempted in these procedures.” Recently, the FBI released redacted copies of its “FBI FISA Query Guidance” describing the three-step FBI querying standard as requiring (1) that the query have an authorized purpose of retrieving foreign intelligence information or evidence of a crime, (2) that the query be reasonably designed to retrieve foreign intelligence or evidence of a crime, and (3) that the query be “justified” by a specific factual basis supporting a belief that the query will return foreign intelligence information or evidence of a crime.
Query terms can include a “United States person query term” which is a term “reasonably likely to identify one or more specific U.S. persons.” It is the FBI’s use of a U.S. person query term or identifier to extract information that is evidence of a crime from the Section 702 database that opponents have labeled a “back door search” and in violation of the Fourth Amendment.
Congress addressed the issue of the FBI’s so called “back door” searches in conjunction with its 2017 reauthorization of Section 702 by adding querying procedures to the panoply of requirements governing the conduct of Section 702 acquisitions. Those procedures include a requirement (the “F(2)” requirement”) that, in connection with a predicated criminal investigation opened by the FBI unrelated to the national security, the FBI may not, without a court order, access the content of communications in the Section 702 database using a U.S. person query term that is not designed to find and extract foreign intelligence information. To obtain a court order from the FISC, the FBI must demonstrate probable cause that the U.S. person query term will produce (1) evidence of criminal activity, (2) contraband or the fruits or instrumentalities of crime, or (3) property designed for use or intended for use in committing a crime.
Simultaneously, however, Congress circumscribed this new F(2) querying requirement by adding a “Rule of Construction” that permits the FBI: (1) to review, without a court order, the results of any query that was “reasonably designed to find and extract foreign intelligence information, regardless of whether such foreign intelligence information could also be considered evidence of a crime,” and (2) to “access the results of queries conducted when evaluating whether to open an assessment or predicated investigation relating to the national security.”
Moreover, as emphasized in the “Rule of Construction” found in Section 702, when the FBI queries the Section 702 database using a query term (whether a U.S. person identifier or otherwise) that is designed to find and extract foreign intelligence information, no separate court order (either an F(2) order or otherwise) is required. This is because the foreign intelligence focus of the query triggers a “reasonableness” assessment under the Fourth Amendment that recognizes both the existence of a foreign intelligence exception exempting the query from the law enforcement-based warrant requirement, and the application of court-approved minimization and querying procedures serve to make the query’s intrusion into individual privacy interests “reasonable” when balanced against the government’s interest in national security—an interest repeatedly recognized by the courts as being of the “highest order.”
Summarizing, then, the Fourth Amendment does not require a court order before initiating a query of the Section 702 database using a U.S. person identifier that is reasonably designed to retrieve foreign intelligence information. Alternatively, when the FBI uses a U.S. person query term to access the Section 702 database in connection with a predicated criminal investigation not related to national security, it must first secure an F(2) court order from the FISC.
The new querying mandates added in 2017 have not allayed the objections of Section 702 critics. In practice, since 2017, the FBI has yet to seek an order under the F(2) querying requirement and, in April 2023, the DNI reported that there had been five “identified instances” in 2021, and an additional instance in 2022, where a FISC order “was required pursuant to Section 702(F)(2) but not obtained” prior to reviewing the results of a USP query. Executive branch compliance reviews and opinions issued by the FISC also have revealed that the FBI’s challenging record of complying with its FISC-approved Querying Procedures is occurring at a rate significantly greater than the cumulative querying totals for NSA, CIA and the National Counterterrorism Center (NCTC)—the only other agencies having access to that database. In calendar year 2021, for example, while the NSA, CIA and NCTC collectively queried that database 12,748 times for content and non-content information using U.S. person identifiers, FBI queries using U.S. person identifiers of the smaller fraction of the Section 702 database to which it has access were estimated as “fewer than 3,394,053.” While the methodology and parameters used to produce these FBI querying statistics are somewhat arcane—the 2022 Annual DNI Statistical Transparency Report devotes four pages to explaining them—it is apparent that, by any standard of measurement, the FBI’s querying of unminimized Section 702 content dwarfs the cumulative querying totals of the NSA, CIA and NCTC.
The 2023 Annual DNI Statistical Transparency Report continues to reflect a sizeable gap in the frequency with which the FBI queries the Section 702 database as compared to the cumulative totals of the NSA, CIA, and NCTC. But it also represents the first set of querying statistics reflective of the multiple compliance-related changes implemented to improve the FBI’s querying performance. These remediation efforts include a revised counting methodology designed to eliminate the duplicate counting of queries that distorted previous FBI querying figures. As shown in the table that follows, the compliance remediation measures produced a significant numerical decline in the FBI’s reported use of U.S person queries in 2022, as well as revised reduced querying figures for prior years. The FBI measures its querying activities over a different 12-month cycle than the other agencies (December 1-November 30 as opposed to the calendar year) and its “de-duplicated” counting methodology produced a figure of 119,383 U.S. person queries over the yearly period extending through November 30, 2022—a reduction of nearly 96% from the querying totals reported for 2021.
Number of U.S. person queries of Section 702 combined contents/non-contents (FBI)
| Estimated number of U.S. person queries of Section 702 contents and non-contents | Duplicative counting used in 2022 DNI ASTR reporting CY 2021 querying activity | New de-duplicated counting method in 2023 ASTR and adjustments |
| December 2019-November 2020 | 1,324,057 | 852,894 |
| December 2020-November 2021 | 3,394,053 | 2,964,643 |
| December 2021-November 2022 | 204,090 | 119,383 |
| % Reduction 2022/2021 | 93.99% | 95.97% |
| % Reduction 2021/2020 | 84.59% | 86.00% |
The FBI’s “de-duplicated” total of 119,383 U.S. person queries still substantially exceeds the 8,340 total U.S. person queries of the Section 702 database made by the NSA, CIA, and NCTC in 2022. The FBI’s critics have seized on this persistent disparity, along with past disclosures of FBI compliance violations, to insist that the FBI uses its access to the Section 702 database to spy on Americans. It is a serious allegation requiring close scrutiny—and one that does not withstand that scrutiny.
A closer look at the charge that the FBI engages in “domestic spying”
The accusations of “domestic spying” leveled by critics require a careful examination of the actual circumstances, not the hyperbole, surrounding FBI conduct to provide the proper predicate for congressional consideration as to the reauthorization of Section 702.
While assiduous adherence to Section 702’s compliance procedures and guidelines is fundamental to public confidence in the Section 702 program, its opponents arguably oversell the claim that this list of fewer than a dozen compliance incidents is representative of “widespread violations” in a programmatic surveillance undertaking involving nearly a quarter million foreign targets and hundreds of millions of acquired communications. Notably, this list of compliance incidents is derived from documents representing two important components of the comprehensive compliance structure that Congress has created to oversee the Section 702 program—in this case: (1) the 2018, 2019, and 2020 opinions and orders issued by the FISC in connection with its required review of the Section 702 certifications and accompanying targeting, minimization, and querying procedures in those years; and (2) the 24th Joint Assessment of Compliance with Section 702 Procedures and Guidelines—the semiannual undertaking that Congress also requires as part of the Section 702 compliance regimen. In other words, all of these compliance violations were reported either to the FISC and/or to compliance authorities within the executive branch as part of the extensive compliance regimen employed to oversee the operation of the Section 702 program.
Upon closer examination, each of these compliance incidents seems less representative of a domestic spying effort than of a series of unintentional compliance errors principally traceable to misunderstandings and misapplications of the FBI’s querying procedures and the technical systems used with those procedures. In the 2019 and 2020 FISC opinions, from which several of the identified querying violations are drawn, the FISC acknowledges the FBI’s need for time to implement the mechanical and training systems required to comply with the new querying requirements first implemented in 2018 after the 2017 reauthorization of Section 702. The FISC observed that “a majority of these [noncompliant] queries occurred prior to the implementation of the FBI’s system changes and training” regarding those querying requirements, ultimately concluding that “the improper queries described above do not undermine [the FISC’s] prior determination that, with implementation of the documentation requirement, the FBI’s querying and minimization procedures meet statutory and Fourth Amendment requirements.”
The “documentation requirement” to which the FISC refers is the requirement to “document in writing why a query involving a U.S. person-query term is reasonably likely to return foreign intelligence information or evidence of a crime.” That requirement is now clearly enunciated in the FBI’s Querying Procedures and was in the process of being implemented at the time that the “widespread violations” cited by Section 702 opponents occurred.
Similarly, the Joint Assessment, which is the other source document for the FBI’s allegedly “widespread violations” of the Section 702 querying requirements, also covers a compliance period (12/1/19-5/31/20) that is “prior to the implementation of the FBI’s system changes and training.” Addressing the FBI querying issues identified during the compliance review, the Joint Assessment identifies these factors as contributing to the FBI querying issues: (1) unintentional “Batch Query Errors;” (2) other errors caused by misunderstandings of the query standard; (3) other query errors caused by a misunderstanding that a query would run against FISA-acquired data; (4) errors related to queries conducted solely for evidence of a crime; (5) errors related to queries conducted in connection with national security assessments; and (6) other errors caused by misunderstanding or lack of awareness.
“Batch Query” errors, in particular, can have a compounding impact on compliance performance. Batch query errors arise when users in the FBI system query multiple identifiers in sequential queries as part of a single “batch job.” These queries can be run from FBI headquarters or any of the FBI’s 56 field offices. As a result of this multiple sequencing function and the requirement that each and every identifier queried must independently satisfy the standard found in the FBI FISA Query Guidance, a single error or a few errors in a single batch job may result in thousands of improper queries such that the discovery of a single noncompliant batch query can substantially affect the overall FBI compliance rate. Indeed, the 24th Joint Assessment concluded that 37% of all FBI compliance incidents during the reporting period were the result of a single improper batch querying decision.
Not one of the compliance incidents identified in the 24th Joint Assessment or in the 2018, 2019, and 2020 FISC opinions represents an intentional violation of the compliance regimen that governs the operation of the Section 702 program—and they assuredly offer no support for allegations of “domestic spying.” The Joint Assessment repeatedly ties the identified compliance errors to “misunderstandings” or “lack of awareness” on the part of FBI personnel while reporting that the Justice Department’s National Security Division (NSD) and the Office of the Director of National Intelligence (ODNI) have developed further guidance on the query standard which includes “multiple examples of the application of the guidance to particular factual scenarios.”
This new guidance was first shared with the FBI in November 2021 (after the time periods covered by both the FISC opinions and the Joint Assessment that contain the compliance incidents identified in the Brennan Center “report”) and has been combined with a number of other measures to improve the FBI’s compliance record regarding the handling of Section 702-derived information. Those other measures include:
- At the direction of the FISC, in the fall of 2021, FBI systems were modified to require a case-specific justification for every query using a U.S. person query term before accessing any such content from Section 702 (i.e., the “documentation requirement” noted earlier and cited in the FISC’s November 2020 opinion and order);
- New restrictions issued in March 2022 requiring enhanced pre-approvals for certain “sensitive” queries, such as those involving elected officials, members of the media, academics, or religious figures —including a requirement for personal approval by the FBI’s Deputy Director for certain queries;
- New requirements implemented in June 2021 requiring FBI attorney approval prior to conducting a “batch job” that would result in 100 or more queries;
- Changing the default settings in FBI systems containing Section 702 data in June 2021 to require an affirmative “opt-in” to address the large number of inadvertent queries identified in reviews conducted by the NSD.
While the FBI has an admittedly checkered record of past compliance, and the mere disclosure of violations means little in the absence of discernible progress in remedying those violations, early returns on these changes have been positive. As the FISC noted in its April 2022 Section 702 opinion (only publicly released in redacted form in May 2023),
The Court is encouraged by the amendments to the FBI’s querying procedures and the substantial efforts to improve FBI querying practices, including heightened documentation requirements, several system changes, and enhanced guidance, training, and oversight measures. There are preliminary indications that some of these measures are having the desired effect.
While cautioning that compliance problems with the FBI’s querying of raw Section 702 data have been “persistent and widespread,” the FISC opinion recognizes that “perfect implementation is unrealistic” in a programmatic surveillance program of the size and complexity of Section 702, and ultimately finds “that the FBI’s minimization and querying procedures, as likely to be implemented, are consistent with the Fourth Amendment.” Similarly, the FBI querying statistics contained in the recently released 2023 Annual Statistical Transparency Report—reflecting a 96% reduction in the FBI’s use of U.S. person query terms in 2022, the first full year in which all of the aforementioned FBI compliance measures were in effect—are equally indicative of improved compliance performance. These improvements are also corroborated in a recent release by the FBI’s Office of Internal Auditing (OIA). In its first report documenting the FBI’s compliance performance following the remediation efforts implemented in 2021-2022, OIA announced that “the FBI had a 96% compliance rate for FISA queries, a 14% improvement from OIA’s first baseline audit, which was conducted before the reforms.”
Any Section 702 reforms should be focused upon additional improvements to FBI querying practices without impairing Section 702’s irreplaceable intelligence value
Section 702 opponents almost certainly will greet the new FBI querying numbers with skepticism, and the FBI’s past compliance performance arguably suggests caution before assuming that the more recent reforms augur well for longstanding compliance. Full disclosure requires acknowledging that the FISC’s April 2022 opinion recounts multiple compliance violations—numbering in the thousands, and this history of compliance problems has been, as the FISC observed, “persistent and widespread.” Nonetheless, these compliance incidents, like the FISC’s April 2022 opinion, predate the full implementation of the FBI’s compliance remediation efforts—changes that the FISC recognized as “having the desired effect.” Relying on older, past compliance numbers to excoriate current FBI querying practices is like arguing that a traffic intersection remains too dangerous based upon accident statistics compiled before the “Stop” sign was installed.
It is one thing to point out the FBI’s past failures, chastise its seemingly perpetual inability to correct the misunderstandings and misapplications of past FBI querying practices, and question whether the FBI possesses the institutional competence to ever get its querying house in order. It is quite another to falsely propagate that the nation’s most important foreign intelligence collection program is being used to deliberately spy on Americans. Such claims ignore Section 702’s carefully constructed statutory architecture, the Fourth Amendment jurisprudence issued by the FISC and other federal courts supporting that architecture, and the actual circumstances underlying past reported FBI compliance incidents and the remedial action that has been taken following them.
Ultimately, an overriding question as the debate over Section 702’s reauthorization continues to unfold is how much weight the nascent improvements in the FBI’s querying practices acknowledged by the FISC and reflected in the 2023 Annual Statistical Transparency Report carry with Congress. The aggressive hyperbole of claims that the FBI uses Section 702 as a “domestic spying tool” has gained considerable public attention. Politico, for example,has quoted the Republican chair of the House Intelligence Committee as saying “the FBI is absolutely the problem child in FISA and 702” while describing FBI “abuses” as “abhorrent.” The publication goes on to report that “lawmakers don’t believe that the FBI stays within the guardrails” governing the operation of the Section 702 program. This preconception was reflected in media reports addressing the recently released FISC opinion, many of which mirrored the Washington Post’s headline: FBI misused surveillance tool on Jan. 6 suspects, BLM arrestees, and others. Buried in the reporting was the fact that the FISC actually had approved the FBI’s minimization and querying procedures as satisfying the Fourth Amendment while being “encouraged” by the improvements produced by the FBI’s compliance remediation efforts. A crucial question as the debate over Section 702’s reauthorization proceeds is whether skeptical lawmakers can be persuaded that the FBI’s previous shortcomings are correctable and that the recent improvements in FBI querying practices attributable to the changes in the FBI’s compliance efforts can, with confidence, be expected to continue.
Should Congress elect to pursue additional “reforms” to Section 702, prudence dictates that any legislative revisions be directed exclusively towards the FBI and its use of U.S. person query terms that are not designed to find and extract foreign intelligence information. By way of example, Congress might consider: (1) similarly to the crimes limitations for which electronic surveillance can be used for law enforcement purposes, specifically limiting the FBI’s use of information derived from Section 702 to “foreign intelligence crimes” to ensure a tighter nexus between Section 702’s foreign intelligence purpose and any prosecutions based, in whole or in part, on Section 702-derived information; (2) reexamining the “Rule of Construction” found in FISA Section 702(f)(2)(F) with a view towards allowing access to the Section 702 database only in connection with predicated FBI investigations, but not with assessments; (3) incorporating into Section 702’s statutory querying procedures the basic requirements of the FBI’s FISA Query Guidance; and/or (4) as recently announced by the FISC, “substantially limiting the number of FBI personnel with access to unminimized Section 702 information.”
The reauthorization of America’s most important intelligence collection program should not turn on broad-brush partisan allegations about FBI querying activity that predates the serious remediation efforts that the FISC has described as “having the desired effect.” Instead, the crucial questions for Congress are whether the FBI is sufficiently correcting defects in its previous querying practices and whether those enhanced compliance efforts can, with confidence, be expected to continue —or whether additional measures like those described above are needed. When the final votes on reauthorization are counted, the essential utility of America’s most important foreign intelligence collection program might depend on those in Congress who can keep Section 702 “reform” focused on FBI querying practices and what the FBI already has accomplished in improving them.
George W. Croner was the principal litigation counsel in the Office of General Counsel at the National Security Agency (NSA). He is a senior fellow at the Foreign Policy Research Institute (FPRI) in its national security program and a member of CERL’s Advisory Council. You can follow him on Twitter (@GeorgeCroner) and find a list of his publications at FPRI.org.