January 11, 2018

S. 139 – FISA Amendments Reauthorization Act

NOTEWORTHY

Background: The FISA Amendments Act of 2008 updated the law to reflect the vast changes in communications technology that had taken place over the prior 30 years since the Foreign Intelligence Surveillance Act was first enacted. These updates were reauthorized at the end of 2012, and they expire at the end of this year. This bill reauthorizes these updates for another six years, while providing additional transparency and reporting requirements. S. 139 passed the House by a vote of 256-164.

Floor Situation: This bill is now the pending business of the Senate.

Executive Summary: A critical part of the update was to add a new section 702 to FISA. This section authorizes a program of surveillance activities targeting non-U.S. persons reasonably believed to be located outside the United States for the purpose of acquiring foreign intelligence information with the assistance of electronic communications service providers. The program has helped stop terrorist attacks inside the United States and remove senior ISIS leaders from the battlefield. Much of what we know about Russia’s intrusion into the 2016 presidential election comes from this program. The use of these authorities is subject to a comprehensive regime of extensive and substantial oversight by all three branches of government.

OVERVIEW OF THE ISSUE

An RPC policy paper providing an overview of the topic is available here. An ODNI overview is available here.

NOTABLE BILL PROVISIONS

Section 101 – Querying procedures and U.S. person queries

The first part of this section requires the attorney general and director of national intelligence to adopt querying procedures “consistent with the requirements of the fourth amendment.” The procedures will be subject to judicial review by the FISA court, making them similarly situated to the minimization and targeting procedures. For these purposes, a query is defined as a search designed to retrieve “communications of or concerning” U.S. persons that were acquired in the use of the section 702 authority, i.e., incidental collection.

The section goes on to require the FBI to obtain a court order approving “access” to the “contents of communications” retrieved by a query using U.S. person identifier information “that was not designed to find and extract foreign intelligence information” when the query is to be performed “in connection with a predicated criminal investigation ... that does not relate to the national security of the United States.”

These additional protections are provided despite an observation in a House Intelligence Committee report accompanying an earlier version of this bill saying courts have determined “the act of querying lawfully acquired FISA Section 702 data is lawful and permitted under the Fourth Amendment.”

The need to obtain a court order shall not apply in instances where the FBI determines “there is a reasonable belief that such contents could assist in mitigating or eliminating a threat to life or serious bodily harm.”

The section requires a record be kept for each U.S. person query term used for a query. The House Intelligence Committee report said this section “does not impose a requirement that an Intelligence Community element maintain records of [U.S.] person query terms in any particular manner.”

Section 102(a) – Use provisions of U.S. person information

It provides an exclusionary rule that information may not be used against a U.S. person in any criminal proceeding unless one of the two following things:

1.       A warrant was obtained under the provisions of section 101, or

2.      In cases where a warrant was not obtained, its use comports with current Justice Department guidelines on the matter, which are essentially codified by this section.

In the latter instance, the attorney general must decide that the criminal proceeding involves national security, or other specific, named conduct, such as death, kidnapping, serious bodily injury, or human trafficking. Such a decision/determination by the attorney general is not subject to judicial review. 

Section 102(b) – Disclosure provisions

This section requires the current mandatory reporting requirements to include information on the number of instances in which the bureau opened an investigation of a U.S. person “(who is not considered a threat to national security) based wholly or in part on” an acquisition of information through the use of section 702 authorities.

Section 103 – “Abouts” collection

To understand this section requires a review of certain technical elements of 702 collection. Internet communications are collected in two ways: 1) “upstream” and 2) “downstream” – what was once known as PRISM collection.  

The downstream collection is where the government compels a private sector company to give to the government communications sent to or from a certain “selector,” such as an email address. NSA receives all downstream data. CIA, NCTC, and FBI receive some of it.

Upstream collection is when information is gathered from the communications infrastructure over which internet communications transit, sometimes referred to as the “Internet backbone.” This is done with the assistance of the private sector companies that maintain these networks. Only the NSA has access to this upstream collection.

In the past, communications were acquired in the upstream that were to, from, or about a selector. An “about” collection is when an email communication that mentions a certain selector, but is neither to nor from that selector, is collected. Such an email would be between people who are not themselves the targets of section 702 collection.

Early last year, NSA issued a statement saying it “will no longer include any upstream internet communications that are solely ‘about’ a foreign intelligence target. Instead, surveillance will now be limited to only those communications that are directly ‘to’ or ‘from’ a foreign intelligence target.”

The genesis of this development stemmed from FISA court concern with certain upstream compliance incidents involving U.S. person information. As the FISA court explained, they pertained mostly to using “U.S.-person identifiers to query the results of Internet ‘upstream’ collection, even though NSA’s Section 702 minimization procedures prohibited such queries.” There are complicated technical matters at issue in this quandary. The court concluded that the NSA decision to terminate “abouts” collection addressed the court’s concerns because this action “should substantially reduce the acquisition of non-pertinent information concerning U.S. persons pursuant to Section 702.”

Such a decision is not without cost. NSA said that it did not have the ability with available technology “to stop collecting ‘about’ information without losing some other important data.” Namely, it would also exclude “some of the relevant communications directly ‘to or from’ its foreign intelligence targets.”

Section 103 of the bill addresses the state of the law and current practice, while allowing for operational flexibility as technology develops. It says that if the attorney general and DNI “intend to implement the authorization of the intentional acquisition of abouts communications,” they shall inform Congress and wait 30 days before implementing that decision. Part of this notice shall include a copy of the certification from the FISA court “authorizing the intentional acquisition of abouts communications.” There are emergency procedures provided for performing an abouts collection during this 30-day period.

Section 201 – Reauthorization

Reauthorizes Title VII of FISA, which includes section 702, until December 31, 2023.

Section 202 – Increased penalties for unauthorized use of classified information

Increases the penalties for the unauthorized removal and retention of classified materials from up to one year in prison to up to five years.

Section 204 – GAO study on protecting classified information

Requires GAO to conduct a study on the classification system and methods, particularly whether sensitive information is property classified, and the effect of modern technology on the storage and protection of classified information.

Administration Position

The Administration issued a Statement of Administration Policy expressing its policy preference of “a clean and permanent extension of section 702 of FISA,” along with its support for this bill.