Last week, Just Security published an essay by Senator Ron Wyden in which he attempts to explain why the provisions of the Government Surveillance Reform Act of 2023 (GSRA), which he has co-sponsored with a coterie of other legislators, provides needed and effective reforms to government surveillance programs, including Section 702 of the Foreign Intelligence Surveillance Act (FISA).
In reality, as I explain here, the GSRA is seriously flawed legislation that would undermine the utility and flexibility of FISA Section 702—arguably the most important intelligence collection program available to the U.S. government—while simultaneously imposing a series of other misguided “reforms” impairing the operation of other U.S. intelligence and law enforcement activities. As I did with my last piece, however, I limit this reply to addressing the series of errors Senator Wyden makes in advancing his defense of the GSRA’s proposed reforms to FISA Section 702 in two particularly critical areas: requiring a warrant prior to undertaking U.S. person (USP) queries of the Section 702 database and revising the standard for “reverse targeting.”
U.S. person queries of Section 702 collection and the GSRA’s warrant requirement
Senator Wyden suggests that the GSRA has elicited “a certain amount of confusion,” but I am not confused. I understand exactly the harm that this bill will inflict upon the utility and flexibility essential to the operation of Section 702—harm that Wyden masks through distorted statistics about USP queries to minimize the deleterious impact of the GSRA’s warrant requirement on Section 702 operations.
I begin with Wyden’s ominous noting that the number of Section 702 targets “has expanded dramatically” since Section 702 was last reauthorized in 2018. True enough, but context is critical here. Presenting an accurate perspective of the scope of Section 702 surveillance requires understanding that worldwide internet usage is increasing “by roughly 500,000 users per day,” considerably expanding the number of foreign communicants potentially meeting the criteria for a Section 702 target. By the end of 2022, the United Nations estimated the worldwide population at 8 billion people. International internet usage is estimated at 62% of that world population, or roughly 4.9 billion users. USPs, who cannot be targeted under Section 702, constitute approximately 307 million of these users, but the remaining 4.6 billion internet users worldwide represent the theoretical pool of potential foreign targets in a world riddled with challenges to U.S. national security. To put the alleged “expansion” of Section 702 surveillance into more accurate perspective in the context of this explosive international growth in internet usage, the 246,073 Section 702 targets in CY 2022 represent approximately 0.00005% of non-USP internet users worldwide. In other words, there is a five one-hundred-thousandths percent chance that any particular non-USP internet user will be a Section 702 target. Most importantly, given Section 702’s prohibition against targeting USPs, the “dramatic expansion” of Section 702 targets that Wyden highlights has resulted in exactly the same number of USP targets since Section 702 was last reauthorized. And that number is ZERO.
Nonetheless, Wyden says this growth in targeting leads to an increased likelihood of incidentally acquiring the communications of “innocent” Americans while suggesting that the government’s disclosure that Section 702 collection extends to “foreign governments and related entities” attests to a further risk of collecting the communications of “innocent” Americans communicating with those “foreign governments and related entities.” First, I suggest that most would find it unstartling that an intelligence collection program specifically targeting foreign targets likely to possess, retain, or disseminate foreign intelligence includes “foreign governments and related entities.” More importantly, the FBI—and make no mistake, the GSRA’s warrant requirement is directed particularly at the activities of the FBI—receives access to only a small fraction of the communications acquired from the total number of Section 702 targets. This is an absolutely critical factor in any fair evaluation of Wyden’s insistence on a warrant requirement for USP queries.
Although unmentioned by Senator Wyden, the FBI actually has access only to that small part of the Section 702 database retained by the National Security Agency (NSA) containing communications generated by the particular targets that the FBI has nominated for collection. This amounts to 3.2% of that total database according to the 2023 Annual Statistical Transparency Report released by the Office of the Director of National Intelligence (ODNI). This represents roughly 8,000 of the 246,073 Section 702 targets in CY 2022 and, notably, the FBI nominates for collection only those targets associated with open, fully predicated national security investigations—the most serious class of investigation in the FBI’s investigative hierarchy. So, it is important to understand that the USP communications incidentally acquired as a result of targeting FBI-nominated targets are generated by those USPs communicating with subjects of the FBI’s most serious national security investigations and may not be the “innocent” Americans Wyden describes. It is, of course, the function of the FBI and the rest of the Intelligence Community to protect the homeland against any harm intended by these foreign targets and any of their co-conspirators. The use of USP queries is an important, and essential, part of that effort. Significantly, in 2022, the first full year reflecting the impact of multiple remediation efforts initiated by the FBI with respect to its querying practices, FBI queries using USP query terms (e.g., terms employing USPER identifiers such as names, addresses, telephone numbers) declined by nearly 96%. But, candidly, neither the magnitude of any reduction in FBI queries nor efforts made to improve FBI querying practices will ever be enough for Senator Wyden and his cohorts supporting the GSRA.
This leads to the next questions regarding Senator Wyden’s “facts” regarding Section 702. Information is extracted from the Section 702 database of lawfully acquired communications by querying that database using terms that, under the querying procedures of the particular agency, may include USP identifiers, such as names, email addresses, and telephone numbers. The FBI’s Querying Procedures, for example, describe querying as “the use of one or more terms to retrieve the unminimized contents … of Section 702-acquired information,” and the most recent Annual Statistical Transparency Report (ASTR) released by the Director of National Intelligence explains querying “as a basic analytic step foundational to efficiently and effectively reviewing data lawfully collected and already in the government’s possession.” In 2022, the FBI conducted 119,383 queries using USP identifiers designed to retrieve contents and non-contents (e.g., metadata) of communications contained within that part of the Section 702 database to which it has access.
The GSRA requires the FBI to obtain a court order (essentially, a warrant) before querying its part of the Section 702 database using a USP identifier to retrieve the content of any communication. As I explain here, such a requirement would present the Foreign Intelligence Surveillance Court (FISC) with thousands of new requests for court orders—a workload it is institutionally incapable of handling. It must also be said, although never directly acknowledged by Wyden in his essay, that courts, specifically including the FISC, have repeatedly held that the Fourth Amendment does not require such a court order in connection with the use of USP query terms to retrieve information from the database of communications already lawfully acquired by targeting foreign targets under Section 702. This point was emphasized by the President’s Intelligence Advisory Board (PIAB) in its recent report where it describes a warrant requirement for USP queries as “unjustified.”
Wyden, however, dismisses the arguments that the GSRA’s constitutionally unnecessary warrant requirement will create an unacceptable burden for the FISC. He insists that, since the GSRA only requires a warrant for USP query terms designed to retrieve content, “only a small fraction of these queries would require a warrant.” Going still further, he inexplicably mixes apples and oranges by suggesting that the GSRA’s “permissive” approach to metadata (i.e., non-content) queries confirms the minimal burden that the warrant requirement will actually produce on the FISC because “U.S. intelligence agencies informed the Privacy and Civil Liberties Oversight Board (PCLOB) that only 1.58% of the FBI’s U.S. person queries of Section 702 result in access to the content of communications.” The conflation of metadata and content is baffling, as is Wyden’s erroneous pronouncement that “[n]one of these queries would require a warrant under the GSRA” (emphasis in Wyden’s essay) when the language he quotes refers specifically to content queries for which the GSRA unambiguously requires a warrant. Finally, it is essential to understand that, contrary to Senator Wyden’s assurances, the GSRA requires a warrant not only for the 1.58% of FBI content queries that actually return content but also for the 98.42% of FBI content queries that do not return content. This is because the GSRA’s warrant must be obtained prior to running any query designed to retrieve content, and the FBI cannot know what the query will return until it is run after procuring the GSRA-mandated warrant.
Unpacking Wyden’s explanation further exposes more dissembling. First, unlike the querying statistics in the ASTR for NSA, Central Intelligence Agency (CIA), and the National Counterterrorism Center (NCTC)—the only three agencies besides the FBI with access to the Section 702 database—the FBI does not report content and non-content USP queries separately. For this reason, there is no way that the FBI querying numbers in the ASTR can be read to support Wyden’s view that the GSRA’s “permissive approach to metadata queries” assures that the FISC will be able to absorb the workload created by the GSRA’s proposed warrant requirement. In fact, interpolating the querying numbers for NSA, CIA, and the NCTC, which do report content and non-content queries separately, suggests a completely contrary conclusion. For example, in 2022, NSA, CIA, and the NCTC collectively reported conducting 4,684 USP queries designed to retrieve the content of communications and 3,656 USP queries designed to retrieve non-contents, producing a ratio of approximately 56% content queries and 44% non-content queries. Applying that same ratio to the 119,383 USP queries run by the FBI in 2022 would produce estimates of over 66,850 content queries and roughly 52,500 non-content (i.e., metadata) queries. As I wrote here, the FISC issued only 337 Title I FISA probable cause orders in 2022 so, simply put, no matter how much Senator Wyden conflates the numbers about the USP querying statistics, the FISC lacks the resources to address the tidal wave of applications for content querying orders that the GSRA’s new requirement will produce—especially given that the GSRA burdens the FISC with other new reporting and oversight duties while affording that court no additional resources.
In its recent report on Section 702, the PIAB stated, “U.S. person queries are necessary in order to identify foreign threats to the homeland” and imprudent restrictions will render the government “far less capable of identifying potentially harmful links between foreign threats and U.S. persons” Elaborating, the PIAB said that requiring a warrant, or any other form of court order, prior to conducting a USP query is not only “impractical” but “unjustified.” No amount of obfuscating rhetoric from Senator Wyden changes that accurate assessment.
Reverse targeting
The GSRA also would modify the language in Section 702 that prevents the government from targeting a foreigner as pretext for acquiring the communications of a particular USP. Currently, the government may not “intentionally target a person reasonably believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States.” As a practical matter, compliance with the reverse targeting prohibition has not been an issue in prior reauthorizations of Section 702—most likely because, as a matter of intelligence tradecraft, reverse targeting makes little sense since intelligence officers interested in a person in the United States will be naturally inclined to seek a court order providing access to all that target’s communications rather than the limited subset that might be acquired through reverse targeting. Mandated semiannual compliance assessments for Section 702 required by FISA have noted “the extreme rarity of reverse targeting incidents,” but the eternally suspicious sponsors of the GSRA like Senator Wyden seek to change the restrictive statutory language from barring targeting where the “purpose” is to target a particular known person in the United States to where a “significant purpose” is to target a particular known person in the United States.
The GSRA’s proposed change is alarmingly misguided because a fundamental reason for Section 702 is to facilitate the ability to ascertain whether foreign terrorists or intelligence services are communicating and plotting with persons in the United States. In such circumstances, a valuable and admittedly important purpose of Section 702 collection includes acquiring communications between foreign targets and those persons in the United States with whom these foreign targets are communicating. Recognizing the importance of this collection, Congress, in passing Section 702 in 2008, rejected precisely the “significant purpose” language now being exhumed and repackaged in the GSRA. Notably, this language is not limited to protecting communications to USPs; instead, the change would also prohibit surveillance where a significant purpose is to obtain the communications of foreign actors in which they identify their U.S. accomplices. Consequently, if this change becomes law, Section 702 could no longer be used to target Russian and Chinese intelligence actors overseas to see if they are talking to their contacts in the United States or terrorists communicating with their co-conspirators in the United States. Approving the language modification proposed in the GSRA would needlessly and dangerously close an invaluable window that Section 702 provides to protect the nation against a panoply of dangers including terrorism, espionage, nuclear proliferation, and cyberattacks.
While focusing in this reply on highlighting the specific inaccuracies in Senator Wyden’s recent essay addressing two features of the GSRA that would dramatically undercut two very important elements of FISA Section 702, there is plenty more in this bill that is problematic. Wyden pays lip service to the “important work” done by the Intelligence Community, but his legislative career has been characterized by a perpetual hostility to the collection programs that permit that community to do its critical work. The GSRA is another example of that hostility—a gift basket offered to longstanding opponents of government surveillance stuffed with proposed changes that will individually and collectively undermine the effectiveness of the Section 702 collection program and other intelligence collection and law enforcement activities in a world where the challenges to U.S. national security are on display every day.
George W. Croner was the principal litigation counsel in the Office of General Counsel at the National Security Agency (NSA). He is a senior fellow at the Foreign Policy Research Institute (FPRI) in its national security program and a member of CERL’s Advisory Council. You can follow him on Twitter (@GeorgeCroner) and find a list of his publications at FPRI.org.
Image: Yingyaipumi/stock.adobe.com