The Foreign Intelligence Surveillance Act (FISA) of 1978 provides a statutory mechanism by which the federal government may obtain a court order authorizing the use of electronic surveillance to collect foreign intelligence information.¹ In 2008, Congress enacted the FISA Amendments Act, which added a new Title VII to FISA to provide additional procedures for directing electronic surveillance or other types of intelligence collection at persons while they are located outside the United States.² Title VII of FISA is scheduled to sunset on December 31, 2023.³

Title VII of FISA generally addresses electronic surveillance and other methods of acquiring foreign intelligence information that target persons while they are outside the United States. With respect to overseas targets, Title VII includes provisions that authorize surveillance of U.S. persons while they are abroad (Sections 703 and 704).⁴ The provisions of Title VII relating to non-U.S. persons (Section 702),⁵ however, have garnered the most attention over the life of Title VII and in past reauthorization debates.

The main focus on Section 702 is likely due to its relatively more flexible requirements, compared to other federal statutory frameworks that authorize wiretapping. Since the late-1960s, a cornerstone of the American legal framework for government wiretapping has been the requirement that surveillance be authorized by a warrant or court order issued by a neutral and detached magistrate and accompanied by factual determinations about the particular target of surveillance that are supported by probable cause.⁶ In contrast, surveillance under Section 702 does not require a court to make particular findings for each individual target of surveillance, although courts still play a role in Section 702 through the review and approval of procedures used by the government to identify individual surveillance targets and the access to and use of collected information.⁷

This CRS Report provides a brief summary of the original electronic surveillance authorities under Title I of FISA as they existed before 2008. It then explains the new procedures provided under Title VII and how they differ from electronic surveillance orders authorized under Title I of FISA (hereinafter referred to as "traditional FISA").

Traditional FISA

The Foreign Intelligence Surveillance Courts

From FISA's inception, a central feature of its framework is the use of specialized courts to hear applications for the use of FISA's investigative authorities and to issue orders authorizing the same. FISA establishes both a Foreign Intelligence Surveillance Court (FISC), which generally hears the government's ex parte applications to use FISA's investigative authorities, and a Foreign Intelligence Surveillance Court of Review (FISCR), which hears government appeals from the FISC.⁸

In 2015, Congress amended FISA to expressly authorize the presiding judges of the FISC and FISCR to jointly designate five individuals who are eligible to serve as an amicus curiae.⁹ Each court may appoint an amicus curiae to assist with the review of any application or review that presents a novel or significant interpretation of the law.¹⁰ In 2018, Congress included express authority for the FISC or FISCR to compensate appointed amici at a rate the court considers appropriate.¹¹ During the debate preceding the 2018 reauthorization, Congress also considered legislation to expand the scope of the amici's role before the FISC, including authorizing amici to make an application to the FISC or FISCR to refer a decision to the FISCR or the Supreme Court, respectively.¹²

Key FISA Definitions

FISA uses particular definitions of the terms "electronic surveillance," "U.S. person," and "agent of a foreign power." This section summarizes these key terms, which are important to understanding how Title VII's provisions differ from traditional FISA.

"Electronic Surveillance"

FISA's definition of "electronic surveillance" includes four categories.¹³ Each category of electronic surveillance varies based on the target of the acquisition, the type of communication being acquired, and the location where the communication is being acquired. The four categories involve:

• 1. Acquisitions of wire or radio communications by targeting a specific U.S. person who is presently in the United States.
• 2. Acquisition of the contents of a wire communication to or from a person in the United States, if such acquisition occurs in the United States.
• 3. Acquisition of the contents of any radio communication where both the sender and all intended recipients are located within the United States.
• 4. Installation or use of an electronic, mechanical, or other surveillance device in the United States to acquire information, other than from a wire or radio communication.¹⁴

All four categories of electronic surveillance generally require some connection to the United States, requiring either the target or the acquisition to be in the United States. When the target is overseas, neither the first nor third category of electronic surveillance applies as they either require the target or all parties to the conversation to be within the United States. Conversely, the second and fourth categories of electronic surveillance may apply to an overseas target, but only if the acquisition occurs within the United States. As a result, acquisitions that neither take place within the United States nor target a person who is in the United States generally fall outside the scope of FISA's definition of electronic surveillance.

"U.S. Person"

FISA defines "U.S. person" to include both individuals and organizational entities.¹⁵ With respect to individuals, a U.S. person includes U.S. citizens or aliens lawfully admitted for permanent residence.¹⁶ As for organizations, FISA defines U.S. person to include corporations incorporated in the United States and unincorporated associations that have a substantial number of individual members who are U.S. citizens or lawfully admitted permanent residents.¹⁷

"Agent of a Foreign Power"

FISA's definition of "agent of a foreign power" has different elements depending on whether the agent is a U.S. person or a non-U.S. person. A non-U.S. person may be an agent of a foreign power if:

• The person acts in the United States as an officer or employee of a foreign power, or as a member of a group engaged in international terrorism, irrespective of whether the person is inside the United States;
• The person acts for or on behalf of a foreign power that engages in clandestine intelligence activities in the United States contrary to U.S. interests, when the circumstances show that such person may engage in such activities, or when such person knowingly aids or abets any person in the conduct of such activities or knowingly conspires with any person to engage in such activities; or
• The person engages in the international proliferation of weapons of mass destruction or activities in preparation therefor.

In contrast, any person (including a U.S. person) may be an agent of a foreign power if:

• The person knowingly engages in unlawful clandestine intelligence-gathering activities for or on behalf of a foreign power;
• The person, under the direction of an intelligence service or network of a foreign power, knowingly engages in any other clandestine intelligence activities for or on behalf of such foreign power, which activities involve or are about to involve a violation of the criminal statutes of the United States;
• The person knowingly engages in sabotage or international terrorism, or activities in preparation therefor, for or on behalf of a foreign power;
• The person knowingly aids or abets any person in, or conspires with any person to engage in, the conduct of activities described in the above; or
• The person knowingly enters the United States under a false or fraudulent identity for or on behalf of a foreign power or, while in the United States, knowingly assumes a false or fraudulent identity for or on behalf of a foreign power.

FISA Applications for Electronic Surveillance

Under Title I of FISA, the government may apply to the FISC for an order authorizing the government to conduct electronic surveillance against a particular target.¹⁸ The government must include information in its application about, among other things, the identity of the target, the applicant's reasons for believing that the target is a foreign power or an agent of a foreign power, and that the facilities at which surveillance will be directed are being used, or are about to be used, by a foreign power or agent of a foreign power.¹⁹

Title I of FISA also requires the Attorney General to adopt procedures to minimize the acquisition and retention and prohibit the dissemination of nonpublic information of nonconsenting U.S. persons, consistent with the need to obtain, produce, and disseminate foreign intelligence information.²⁰ In particular, the minimization procedures must prohibit the dissemination of nonpublic information that would identify a U.S. person, unless such person's identity is necessary to understand foreign intelligence information or assess its importance.²¹ The minimization procedures may allow the retention of information that is evidence of a crime and the dissemination of such information for law enforcement purposes.²²

If the FISC finds that probable cause exists to support the application's determinations, it shall issue an order authorizing electronic surveillance for up to 90 days if the target is a U.S. person, up to 120 days if the target is a non-U.S. person, or up to one year if the target is a foreign government, a faction of a foreign nation, or an entity openly directed or controlled by a foreign government.²³ At the end of the order's duration, the FISC may grant extensions, which may be for up to one year if the target is not a U.S. person.²⁴

FISA's Place in American Federal Wiretapping Law

FISA is one of several federal laws that govern the use of electronic surveillance for legitimate investigative purposes. The principal others are the U.S. Constitution's Fourth Amendment,²⁵ the Electronic Communications Privacy Act (ECPA),²⁶ and Executive Orders 12333²⁷ and 14086.²⁸ Each of these, and how they may overlap or interact with FISA, are discussed briefly below before examining Title VII's provisions in detail.

Fourth Amendment

The Constitution's Fourth Amendment provides a right "of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures."²⁹ In domestic criminal law investigations, "reasonableness" generally requires law enforcement officers to obtain a court-issued warrant before conducting a search,³⁰ but courts have recognized exceptions to the warrant requirement.³¹ When the warrant requirement does not apply, government activity is generally subject to a "reasonableness" test under the Fourth Amendment.³²

Government action constitutes a search when it intrudes upon a person's "reasonable expectation of privacy," which requires both that an individual "seeks to preserve something as private" and this subjective expectation of privacy is one that "society is prepared to recognize as reasonable."³³ As a general rule, the Fourth Amendment requires the government to show "probable cause" and obtain a warrant issued by a "neutral and detached magistrate" before conducting a search.³⁴ The U.S. Supreme Court first held that the recording or interception of electronic communications by law enforcement constitutes a search for purposes of the Fourth Amendment in its 1967 decision in Katz v. United States.³⁵ Since then, lower courts have similarly applied Fourth Amendment protections to the contents of email communications.³⁶ In 2018, the Supreme Court held that law enforcement's collection of seven days of a customer's historical location information from his cellular telephone provider constituted a Fourth Amendment search.³⁷

The Supreme Court has not expressly addressed whether the warrant requirement categorically applies to the government's collection of foreign intelligence. In a 1972 case, the Supreme Court held that warrantless electronic surveillance for purposes of domestic intelligence gathering violated the Fourth Amendment, despite the government's assertion of a national security rationale.³⁸ The Court indicated that its conclusion might have been different, however, if the case had involved the electronic surveillance of foreign powers or their agents, within or outside the United States.³⁹

The Supreme Court has also held that the Fourth Amendment (and, in particular, its warrant requirement) does not apply extraterritorially.⁴⁰ In United States v. Verdugo-Urquidez, the Court held that the Fourth Amendment does not apply to extraterritorial actions by law enforcement, at least where the defendant is a citizen and resident of a foreign country with "no voluntary attachment to the United States" and the place searched was located abroad.⁴¹ Lower courts have extended Verdugo-Urquidez's holding to conclude that the Fourth Amendment's warrant requirement does not apply to the surveillance of United States citizens abroad.⁴²

The Electronic Communications Privacy Act (ECPA)

Following Katz v. United States, Congress enacted a federal statute, now known as the Electronic Communications Privacy Act (ECPA),⁴³ which generally prohibits government wiretapping except where the government has obtained a court order supported by probable cause and authorizing such surveillance against the target.⁴⁴ Court orders under ECPA are available only when the government is investigating the commission of certain predicate offenses specifically listed in the statute.⁴⁵ In some cases, the use of surveillance activities for foreign intelligence purposes might fall within the scope of the activities prohibited by ECPA. There are two exceptions to ECPA's general prohibitions that address this situation.

First, if the activity falls within FISA's definition of electronic surveillance, then it is not prohibited by ECPA if the government complies with FISA's procedures.⁴⁶ For example, the government could lawfully intercept a domestic phone call, which falls under FISA's definition of electronic surveillance, using FISA's traditional procedures even though ECPA generally prohibits such wiretapping.

Second, if that activity does not qualify as electronic surveillance, as that term is defined in FISA, but involves the acquisition of foreign intelligence information from international or foreign communications, then it is not subject to ECPA.⁴⁷ For example, the interception of an international telephone call would not be considered electronic surveillance for purposes of FISA if the target were the person on the non-domestic end of the conversation and the acquisition did not occur on United States soil. So long as the purpose of that acquisition was to acquire foreign intelligence information, then it would not be subject to ECPA's general prohibitions.

Although both exceptions result in the non-application of ECPA, they differ in one important aspect that is particularly relevant to understanding how Title VII altered FISA. Both ECPA and FISA provide that the two statutes constitute the exclusive means of conducting electronic surveillance, as defined in FISA.⁴⁸ As a result, using the procedures under FISA is compulsory for those activities that qualify as electronic surveillance but cannot be accomplished by ECPA. For example, if the government wishes to pursue electronic surveillance for foreign intelligence purposes that do not relate to a predicate offense required under ECPA, the government must generally comply with FISA. In contrast, before the FISA Amendments Act, the government was not required to use FISA's procedures for wiretapping activities that did not qualify as electronic surveillance, and which were also exempt from ECPA's general prohibition on wiretapping because they involved the collection of foreign intelligence information from international or foreign communications.⁴⁹

Executive Orders 12333 and 14086

Issued in 1981, Executive Order 12333 addresses all U.S. foreign intelligence surveillance activities, including those which may fall outside of FISA's statutory scheme, such as activities conducted overseas targeting non-U.S. persons.⁵⁰ Section 2.5 of Executive Order 12333,⁵¹ as amended,⁵² delegates to the Attorney General the power to approve the use of any technique for intelligence purposes within the United States or against a U.S. person abroad. If a warrant would be required for law enforcement purposes, the executive order requires the Attorney General to determine in each case there is probable cause to believe that the technique is directed against a foreign power or an agent of a foreign power.⁵³ The authority delegated by Executive Order 12333 must be exercised in accordance with FISA, but also extends to activities beyond FISA's reach.

In 2022, President Joe Biden issued Executive Order 14086, "Enhancing Safeguards for United States Signals Intelligence Activities."⁵⁴ Executive Order 14086 imposes limits on the conduct of signals intelligence collection by executive agencies, and also includes a redress mechanism under which individuals may seek review of alleged violations of, among other things, the Constitution, FISA, or Executive Orders 12333 or 14086.

Executive Order 14086 obliges executive agencies to conduct signals intelligence activities only in pursuit of "legitimate objectives," such as understanding or assessing the capabilities, intentions, or activities of a foreign government; protecting against terrorism, espionage, cybersecurity threats, or the development of weapons of mass destruction; or protecting the integrity of elections, political processes, and United States infrastructure from foreign governments.⁵⁵ Executive Order 14086 expressly prohibits the use of signals intelligence to pursue the objectives of suppressing criticism or dissent; suppressing privacy interests; suppressing a right to legal counsel; or disadvantaging individuals based on ethnicity, race, gender, gender identity, sexual orientation, or religion.⁵⁶

Executive Order 14086 also limits the use of "bulk" surveillance to a smaller subset of similarly enumerated permissible objectives, and only after a determination that the information cannot reasonably be obtained through targeted collection.⁵⁷ For purposes of this limitation, "bulk surveillance" is defined as the collection of large quantities of signals intelligence data that are acquired without the use of discriminants (for example, specific identifiers or selection terms).⁵⁸ Executive Order 14086 also includes provisions to limit the dissemination, retention, and access of or to personal data obtained through signals intelligence.⁵⁹

Under the redress mechanism established by Section 3 of Executive Order 14086, individuals may submit complaints to the Civil Liberties Protection Officer within the Office of the Director of National Intelligence, who is directed to investigate and, as necessary, remediate complaints.⁶⁰ Executive Order 14086 also directs the Attorney General to establish a Data Protection Review Court (DPRC) to review the Officer's determinations upon the request of either the complainant or the executive agency.⁶¹ Unlike the FISC and FISCR, the DPRC does not include federal judges, or even federal employees, but is instead comprised of data privacy and national security legal practitioners selected by the Attorney General.⁶² The DPRC may also be assisted by a designated "special advocate" who shall, among other things, advocate on behalf of a complainant's interests.⁶³

Title VII of FISA

As discussed above, acquisitions that neither take place within the United States nor target a person who is in the United States generally fall outside the scope of FISA's definition of electronic surveillance. For example, the targeting of an international communication of a person who is abroad through an acquisition that also occurs overseas is not the type of electronic surveillance covered under FISA. Conversely, targeting the communications of the same person through an acquisition that occurs within the United States is the type of electronic surveillance covered under FISA.

These divergent outcomes turn on the geographic location in which acquisition of the communication occurs, and are independent of the nationality of the target. Under FISA's traditional Title I electronic surveillance authorities, if a foreign intelligence acquisition constitutes electronic surveillance, the government is generally required to obtain a court order to specifically authorize surveillance of the target. Extending the example above, this means that the targeting of a U.S. person abroad would not require an electronic surveillance court order if the acquisition is overseas, while the targeting of a non-U.S. person abroad would require one when the acquisition is domestic. This disparity leads to varying privacy protections based solely on where the acquisition of the communication occurs rather than the nationality of the target.

As a general matter, the main effect of Title VII on FISA's legal framework is to apply FISA's protections to overseas targets dependent based on the target's nationality, and not the location where the acquisition occurs. Title VII accomplishes this end through three main changes:

• First, it creates a procedure for targeting non-U.S. persons abroad without individualized court orders, even if the acquisition occurs within the United States;⁶⁴
• Second, it imposes a requirement to obtain an individualized court order when targeting U.S. persons abroad, even if the acquisition occurs abroad;⁶⁵ and
• Third, it provides procedures that can be used to obtain court orders authorizing the targeting of specific U.S. persons abroad for electronic surveillance, the acquisition of stored communications, and other means of acquiring foreign intelligence information.⁶⁶

Each of these elements is discussed in the following sections.

Section 702: Targeting Non-U.S. Persons Abroad

Section 702 offers an alternative procedure for acquiring foreign intelligence information despite the requirements of Title I of FISA or ECPA. Section 702 may only be used to target non-U.S. persons who are reasonably believed to be outside the United States, for the purpose of obtaining foreign intelligence information.⁶⁷ Additionally, Section 702 permits only acquisitions of information from or with the assistance of an electronic communication service provider.⁶⁸

Surveillance under Section 702 is subject to FISC supervision through the court's review of a certification submitted jointly by the Attorney General and the Director of National Intelligence (DNI). Except in exigent circumstances,⁶⁹ the government may not conduct acquisitions under Section 702 unless the FISC issues an order after finding that the certification complies with statutory requirements. The key components of the certification reviewed by the FISC are the targeting procedures, minimization procedures, and querying procedures that the government intends to use to govern the selection of targets and the retention, dissemination, use, and querying of information collected under Section 702.⁷⁰

Targeting Procedures

Unlike traditional FISA orders authorizing electronic surveillance, Section 702 does not require the FISC to make probable-cause determinations with respect to individual targets of surveillance or the facilities at which surveillance will be directed.⁷¹ Instead, Section 702 directs the Attorney General, in consultation with the DNI, to develop targeting procedures that intelligence officials will use to identify targets for surveillance under Section 702.⁷² As stated by one federal court, "judicial review of Section 702 functions as a form of programmatic pre-clearance."⁷³

The FISC then reviews these targeting procedures to ensure they are reasonably designed to limit targets to persons reasonably believed to be located outside the United States and to prevent the intentional acquisition of communications in which all parties are known to be in the United States.⁷⁴ Additionally, the government may not intentionally target any persons in the United States or U.S. persons who are abroad.⁷⁵ The government may also not engage in "reverse targeting," in which an overseas non-U.S. person is targeted with the purpose of targeting a particular, known person reasonably believed to be within the United States.⁷⁶

For calendar year 2021, the Office of the DNI estimated that there were 232,432 non-U.S. persons targeted under Section 702.⁷⁷

Directives

After identifying a target with the FISC-approved targeting procedures, the government may issue directives to electronic communication service providers requiring them to provide the government with "all information, facilities, or assistance" needed to conduct the surveillance in a manner that does not undermine its secrecy.⁷⁸ A 2014 report by the Privacy and Civil Liberties Oversight Board describes how the government has used Section 702 directives to implement downstream and upstream collection programs.⁷⁹ In downstream collection, the government typically directs consumer-facing communications service providers—such as internet service providers (ISPs), telephone providers, or email providers—to provide all communications "to or from" a "selector" (e.g., an email address) associated with a Section 702 target.⁸⁰ Upstream collection similarly involves the collection of all communications "to or from" a selector, but the requests are directed at telecommunications "backbone" providers (i.e., companies that operate the long-distance, high-capacity internet cables that interconnect with ISPs' local networks).⁸¹

"About" Collection

On top of collecting communications "to or from" the selector of a particular target, upstream collection has at times included collection of internet communications "about" the selector (e.g., where the target email address is referenced in the body of an email to which the target is not a party).⁸² Declassified FISC opinions from 2011 found that "about" collection resulted in the estimated collection of "tens of thousands of wholly domestic communications each year" by the National Security Agency (NSA) due to technical limitations in how the government implemented "about" collection.⁸³ Specifically, "about" collection was implemented by capturing larger transactions containing multiple discrete communications, in which the selector appeared somewhere in the larger transaction.⁸⁴

Upon being notified of this over-collection, the FISC then evaluated whether the previously approved targeting procedures were no longer reasonable given the prohibition in Section 702 against intentionally acquiring communications in which the parties are all known to be in the United States.⁸⁵ The FISC first held that the NSA's acquisition of wholly domestic communications through "about" collection was intentional because the NSA knew its technological limitations prevented it from avoiding the over-collection.⁸⁶ However, the FISC noted that the statute only prohibited intentional collection of wholly domestic communications where the government knew the parties to a communication were all located in the United States.⁸⁷ The FISC further noted that, due to technological limitations involved with acquiring these multi-communication transactions, it would be impossible for NSA to know at the time it acquires the transaction whether the sender and all intended recipients of any particular discrete communication contained within the transaction are located inside the United States.⁸⁸ Thus, the court held that targeting procedures continued to be "reasonably designed to prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States," even though NSA knew with certainty that its collection would result in the acquisition of wholly domestic communications.⁸⁹

The NSA later announced in 2017 that it was no longer conducting "about" collection in its upstream collection activities in order to "retain the upstream collection that provides the greatest value to national security while reducing the likelihood that NSA will acquire communications of" persons who are not in contact with a foreign intelligence target.⁹⁰ During the 2018 reauthorization of Title VII, some legislative proposals would have barred the use of "about" collection under Section 702.⁹¹ Ultimately, Congress amended Section 702 to conditionally prohibit the resumption of "about" collection unless the Attorney General and DNI provide written notice of the intent to resume such collection to the House and Senate Judiciary and Intelligence Committees.⁹² A declassified FISC opinion from 2018 indicates the court construed this limitation as applying the use of "about" collection in either upstream or downstream collection.⁹³

Minimization Procedures

Section 702 uses the same definition of minimization procedures that FISA provides for traditional FISA electronic surveillance or physical searches.⁹⁴ Accordingly, such procedures must be adopted by the Attorney General and be reasonably designed to minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning nonconsenting U.S. persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information.⁹⁵

The same declassified FISC opinions addressing "about" collection discussed in the previous section also provide an example of how the minimization procedures operate.⁹⁶ For example, the procedures required the prompt destruction of a wholly domestic communication upon recognition unless the NSA Director makes a written determination that "the communication contains foreign intelligence information or evidence of a crime, or that it falls into another narrow exception permitting retention."⁹⁷ If a communication is a foreign communication that discusses or mentions a U.S. person, but contains no foreign intelligence, it must be destroyed as early as practical, but no later than five years from the Section 702 authorization's expiration.⁹⁸ Reports based on U.S. person communications may be disseminated only if the U.S. person's identity is deleted and replaced with a generic term or symbol.⁹⁹ In limited circumstances, such as where the U.S. person is engaged in international terrorism, the identity may be provided if required for the performance of official duties.¹⁰⁰

Although the FISC found these proposed minimization procedures to be sufficient with respect to ordinary collection of communications "to" or "from" the target, the court found these procedures to be deficient with respect to multi-communication transactions obtained through "about" collection, mainly because they failed to make provision for the prompt identification and segregation of irrelevant communications.¹⁰¹ As a result, communications that were potentially wholly domestic could be retained for up to five years, effectively maximizing the retention of such information inconsistent with FISA's mandate to minimize retention of U.S. person information.¹⁰²

Following the FISC's determination of a Fourth Amendment violation, the government presented revised minimization procedures to the FISC, which the court approved on November 30, 2011.¹⁰³ The revised minimization procedures addressed the court's concerns by requiring the segregation of those communications most likely to involve unrelated or wholly domestic communications; requiring special handling and markings for communications that could not be segregated; and reducing the retention period of upstream collection from five to two years.¹⁰⁴

Querying Procedures

In 2018, Congress amended Section 702 to require the Attorney General, in consultation with the DNI, to adopt querying procedures to govern how information collected under this Section is searched after it has been collected.¹⁰⁵ Such procedures must also include a technical procedure under which a record is kept of each U.S. person term used for a query.¹⁰⁶ If the Federal Bureau of Investigation (FBI) seeks to query the contents of information acquired under Section 702 using a U.S. person identifier for a criminal investigation unrelated to national security, it must first obtain an order from the FISC authorizing such query.¹⁰⁷ The court shall issue such an order if it determines that probable cause exists to believe the contents of communications sought would provide evidence of criminal activity; contraband, fruits of a crime, or other items illegally possessed by a third party; or property designed for use, intended for use, or used in committing a crime.¹⁰⁸ A court order for such a query is not required if the FBI determines there is a reasonable belief that such contents could help mitigate or eliminate a threat to life or serious bodily harm.¹⁰⁹ This court-order requirement does not apply to queries of Section 702 information by other agencies, or to queries by the FBI to obtain foreign intelligence information or to pursue investigations related to U.S. national security.¹¹⁰ For calendar year 2021, the FBI reported no such court orders obtained from the FISC, although compliance reviews identified four instances in which a court order appeared to be required.¹¹¹

Where the court order requirement does not apply, the standards for performing queries of Section 702 information are governed by the querying procedures approved by the FISC. The DNI has publicly released declassified versions of the querying procedures for the FBI, Central Intelligence Agency (CIA), the National Counterterrorism Center (NCTC), and the NSA.¹¹² Under NSA's querying procedures, the use of a U.S. person query term to search the contents of acquired communications must generally be approved by the NSA Office of General Counsel, based on a statement of facts establishing that the term is "reasonably likely to retrieve foreign intelligence information."¹¹³ NSA queries of metadata (i.e., non-content information) using a U.S. person query term similarly require a written statement, but are not subject to approval by the Office of General Counsel.¹¹⁴ NCTC and CIA querying procedures both generally require a written statement of facts showing that a U.S. person query term is reasonably likely to retrieve foreign intelligence information for both content or metadata queries.¹¹⁵

With respect to the FBI, its querying procedures reiterate the statutory court order requirement for non-foreign intelligence, non-national security U.S. person queries.¹¹⁶ For other U.S. person queries, FBI's querying procedures also require a written statement of facts showing that the query is reasonably likely to retrieve foreign intelligence information or evidence of a crime.¹¹⁷ FBI queries of metadata using a U.S. person term do not require a similar written statement.¹¹⁸

All four agencies' querying procedures also require recordkeeping of each U.S. person query term used by the agency, including the identity of the personnel who conducted the query.¹¹⁹ The agencies will maintain such records for at least five years in a manner to allow the National Security Division of the Department of Justice and the Office of the DNI to conduct oversight to ensure compliance with these procedures.¹²⁰ A declassified 2019 opinion from the FISCR addressed a prior version of the FBI's minimization procedures, under which records of queries did not distinguish between those that used U.S. person terms and those that did not.¹²¹ The court held that this conflicted with the statutory requirement that the querying procedures "include a technical procedure whereby a record is kept of each United States person query term."¹²²

For calendar year 2021, the Office of the DNI reported that NSA, CIA, and NCTC used 8,790 U.S. person query terms to search Section 702 contents.¹²³ CIA and NSA used 3,958 U.S. person query terms to search Section 702 metadata for the same period.¹²⁴ FBI reports these statistics differently, counting the total number of queries using U.S. person terms, as opposed to CIA, NSA, and NCTC's practice of counting the number of U.S. person terms used.¹²⁵ Between December 2020 and November 2021, FBI estimates it has conducted "fewer than 3,394,053" queries using a U.S. person term.¹²⁶

Constitutional Challenges

Several U.S. Courts of Appeals have issued opinions addressing constitutional challenges to Section 702.¹²⁷ These cases involve appeals from criminal defendants who have been notified by the government that incriminating evidence was gathered under Section 702.¹²⁸ Several of these defendants have moved to suppress such evidence, arguing it was gathered unconstitutionally. Typically, these cases evaluate Section 702 under the Fourth Amendment, but one case also addresses whether Section 702 violates Article III of the Constitution, which limits the jurisdiction of federal courts to deciding "cases" or "controversies."¹²⁹

With respect to the Fourth Amendment, the defendants have mainly argued that Section 702 is constitutionally defective because of the lack of a traditional warrant supported by an individualized finding of probable cause. In response, the Second, Ninth, and Tenth Circuits have unanimously held that where "the target of Section 702 surveillance is a foreign national located abroad having no substantial connections with the United States, that target is not entitled to Fourth Amendment protections," even if the acquisition occurs in the United States.¹³⁰ The government was thus not required to obtain a warrant before conducting the surveillance that targeted a non-U.S. person located abroad.

In Muhtorov v. United States, the Tenth Circuit also addressed the defendant's claims that Section 702 violates Article III of the Constitution. The defendant argued that Article III prohibits advisory opinions and requires that courts must adjudicate only "concrete legal issues, presented in actual cases, not abstractions."¹³¹ While acknowledging that the FISC's role under Section 702 is different than traditional Article III adjudication, the Tenth Circuit concluded that the FISC is not issuing advisory opinions under Section 702 because it applies legal principles to facts, and its determinations are legally binding and not merely advisory.¹³² The court held that the targeting, minimization, and querying procedures submitted by the government are "detailed factual submissions" that the court must measure against Section 702's requirements.¹³³ The courts' determinations are therefore "grounded in evidentiary submissions, not abstract and hypothetical questions."¹³⁴

Sections 703 and 704: Targeting U.S. Persons Abroad

As discussed above, Title VII establishes separate procedures for targeting non-U.S. persons and U.S. persons reasonably believed to be outside the United States.¹³⁵ Sections 703 and 704, detailed below, address the targeting of U.S. persons abroad for electronic surveillance and other types of acquisitions.

Requirement for Court Order

Section 704(a)(2) prohibits the intelligence community from targeting a U.S. person who is reasonably believed to be abroad unless authorized by the FISC or another provision of FISA.¹³⁶ This prohibition applies only when the target has a reasonable expectation of privacy and a warrant would be required if the acquisition was conducted in the United States for law enforcement purposes.¹³⁷ Whether a "reasonable expectation of privacy" exists requires both that an individual "seeks to preserve something as private" and this subjective expectation of privacy is one that "society is prepared to recognize as reasonable."¹³⁸ Although such a determination is inherently dependent upon the particular circumstances of a given case, it is likely that activities like physical searches, voice and email wiretaps, or the collection of geolocation information conducted on foreign soil could require authorization from the FISC based on the target's "reasonable expectation of privacy."¹³⁹

Scope of Acquisitions

Having made the procedures of FISA compulsory in many foreign intelligence acquisitions in which U.S. persons abroad are targeted, Sections 703 and 704 then each establish procedures to provide the requisite FISC orders authorizing such acquisitions. The procedures under Section 703 apply only to electronic surveillance or the acquisition of stored electronic communications or data that would traditionally require an order under FISA. The procedures under Section 704 apply in all other situations where the target has a reasonable expectation of privacy and a warrant would be required if the acquisition was conducted in the United States for law enforcement purposes.¹⁴⁰ Because the requirements of Section 704 are less stringent than Section 703, the statute prohibits the use of the former when the procedures of the latter would apply.

Procedures

The judicial procedures under Sections 703 and 704 generally follow the same structure used by the procedures that already existed in FISA to obtain a court order authorizing electronic surveillance or physical searches of U.S. persons within the United States. The government must submit an application for surveillance that identifies the target and the facts and circumstances relied upon that would justify the belief that the target is a foreign power or an agent of a foreign power, which the FISC must find to be supported by probable cause.¹⁴¹ Because Title VII is intended to address targets outside the United States, the court must also find probable cause to believe that this geographical limitation has been met.¹⁴²

Both Sections 703 and 704 also authorize short-term acquisitions if the Attorney General reasonably determines that an emergency exists and there is insufficient time to obtain a court order.¹⁴³ Such emergency acquisitions must be followed up with a formal application within seven days.¹⁴⁴

Comparison of Sections 703 and 704

Although they are similar, the procedures under Sections 703 and 704 are not identical. Less specificity is generally required of the information in the application submitted under Section 704. Section 704 also does not require a statement that the information sought cannot be obtained by normal investigative means. Section 704 also only requires the minimization procedures to address dissemination of acquired information.¹⁴⁵ In contrast, Section 703 requires the minimization procedures to address the acquisition and retention of information.

Comparison with Traditional FISA

In at least two important ways, the standard that must be met under Sections 703 and 704 before the FISC will issue an order authorizing an acquisition is less stringent than the standard that has been traditionally required under FISA (in those situations where the activity qualifies as electronic surveillance and is therefore subject to FISA).

First, FISA traditionally required an application to identify the facilities to be searched or subject to electronic surveillance, and to show that those facilities are being used, or are about to be used, by the target. Second, FISA traditionally permitted U.S. persons to be targeted only if they are also linked to international terrorism or clandestine intelligence activities.¹⁴⁶ Neither Section 703 nor Section 704 contains these requirements.

Because all electronic surveillance was subject to FISA's standards under prior law, and Section 703 only applies to stored data if FISA would have traditionally required an order, it may be fair to characterize Section 703 simply as a relaxation of FISA's requirements when the target is a U.S. person abroad. The situation is different when considering the effect of Section 704 on prior law. The general prohibition embodied in Section 704 requiring a court order supported by probable cause when targeting U.S. persons abroad expands the scope of FISA to areas that were previously beyond its scope. For example, targeting the international communications of a U.S. person located abroad was generally not considered electronic surveillance if the acquisition did not occur on U.S. soil. Therefore, while no court order would have been traditionally required under FISA, the addition of Section 704 brings that conduct within the statute's ambit.

Effect of Sunset

Title VII of FISA is scheduled to sunset on December 31, 2023.¹⁴⁷ The sunset provision also includes special "transition procedures" that would apply to orders authorizing surveillance activities under Title VII that are in effect on December 31, 2023,¹⁴⁸ and would permit the continued effect of such orders until their normal expiration dates.