OTI’s Reform Priorities for Section 702 of the FISA Amendments Act

Congress has until December 31 to renew the FISA Amendments
Act or it will expire, and with it, the highly controversial, large-scale
surveillance authorities under Section 702. As Congress debates whether to
renew Section 702, it must consider needed reforms so that surveillance will be
narrowly tailored to the law’s stated purpose – stopping both terrorism and
espionage – and so that millions of Americans’ communications will no longer be
swept up in its net.

The Open Technology Institute’s Section 702 reform priorities
include:

Limit the Scope of
Collection Under Section 702: Currently, the NSA engages in large-scale
surveillance of Americans’ communications under Section 702. This overbroad
surveillance is possible due to the breadth of the definition for “foreign
intelligence information,” collection of which must be a significant purpose of
the surveillance. Additionally, the scope of surveillance under Section 702 is
overbroad because of the NSA’s “upstream” surveillance program and “about”
collection.

• Narrowly Tailor
  the Definition of Foreign Intelligence Information: When Section 702 became
  law in 2008, it was sold to Congress and the public as authorizing surveillance
  that was necessary to stop terrorist threats and espionage. To this day, the
  Office of Director of National Intelligence argues for reauthorization of
  Section 702 stressing its necessity to national security,
  even calling it the “crown jewel” of the intelligence community’s
  surveillance authorities. Yet, Section 702 permits surveillance that goes well
  beyond protecting national security. The definition for foreign intelligence
  information also permits surveillance that is merely relevant
  to the foreign affairs of the United States. The “foreign affairs” provision of the definition of  foreign intelligence information is not
  necessary to national security, and allows the NSA to sweep up the
  communications of political or human rights activists, journalists, students,
  and business people working abroad, and it should be struck from the authorized
  purposes for surveillance under Section 702. 

• End “Upstream”
  Surveillance: Upstream surveillance is the term for the NSA’s practice of
  wiretapping the internet backbone – the underseas fiber optic cables across
  which about 80% of global internet traffic transits – and
  scanning the data for communications to,from, or about their target, though at
  the end of April the NSA stopped “about” collection. This practice is incredibly privacy-invasive, as it subjects
  everyone’s communications to automated scans by the NSA. When Congress debated
  the passage of Section 702, it never considered whether the NSA should have
  such broad authority to intercept internet communications and nothing in the
  statute suggests this type of surveillance is appropriate. Congress should reform Section 702 to make clear that “upstream”
  surveillance is not authorized.

• Prohibit “About”
  Collection: Short of eliminating “upstream” surveillance altogether,
  Congress should prohibit “about” collection. As part of its “upstream”
  surveillance, the NSA scans the contents of all of the communications that
  transit the internet backbone for communications that merely reference, or are
  “about”, the target. Compliance issues with upstream surveillance date back to
  2011 when the FISC shut it down until the NSA could remedy the problems. This
  April, the NSA announced that, as a result of
  still-persistent compliance issues, it would stop the practice of “about”
  collection and delete its stores of US person communications that were obtained
  via that form of surveillance. It claimed that the threat to Americans’ privacy
  outweighed any value from the collection. Considering
  the harmful impact “about” collection has on Americans’ privacy, it is
  indefensible to allow space for the NSA to restart this practice. Congress
  should pass a reform bill that includes a prohibition against “about”
  collection.

Enhance
Post-Collection Protections for Americans’ Communications that are Swept Up
Under Section 702: While narrowing the scope of surveillance under
Section 702 is critically important, it will still result in a large quantity
of incidental collection of Americans’ communications. For this reason,
enhancing the protections for that information once it is in the intelligence
community’s databases is also essential. This happens through limiting the
purposes for which the information can be used, and ensuring that if the FBI
searches the information using a US person identifier, they have a warrant
authorizing that search.

• Establish Limits
  on Use of Communications Collected Under Section 702: DOJ asserts that the
  FBI has the authority to use Americans’ communications collected under Section
  702 for investigations and prosecutions into any crime whatsoever since they
  were lawfully obtained. In response to public outcry following the Snowden
  revelations, DOJ issued new minimization procedures that offered one
  additional protection: it may only use communications collected pursuant to
  Section 702 in proceedings, such as prosecutions, with the approval of the
  Attorney General. This limitation is wholly insufficient. The intelligence
  community justifies the collection of large quantities of Americans’
  communications under Section 702 by arguing that it is reasonable since the
  surveillance is targeting foreign intelligence information. Congress should ensure that information
  collected under Section 702, which is obtained pursuant to a standard that
  falls far short of the probable cause standard required in criminal
  investigations, can only be for the purpose for which it was collected: foreign
  intelligence investigations.

• Close the
  Backdoor Search Loophole: Currently, FBI agents routinely use US person
  identifiers to search the database containing information collected pursuant to
  Section 702 to further criminal assessments and investigations that
  are wholly unrelated to national security. DOJ has testified before the FISC
  that it engages in these US person queries so regularly that it would be too
  burdensome to so much as require agents to record a justification for each.
  Indeed, the DOJ attorney analogized how the FBI engages in these warrantless
  backdoor searches to how everyday Americans do Google searches. Backdoor searches are so
  controversial that votes to prohibit them have overwhelmingly passed the House
  of Representatives in 2014 and 2015. Now that Congress must either pass a
  reform and reauthorization bill or let Section 702 expire, it should ensure
  that this loophole is closed permanently. Congress
  should require that FBI agents obtain a warrant before running a US person
  query in a database containing Section 702 information, and that queries be
  limited to those involving investigations that are aligned with the purpose for
  the collection. 

Increase
Transparency for the Government and Companies: While the USA FREEDOM
Act made many meaningful improvements to government and third party
transparency surrounding national security processes, more should still be
done.

• Increase
  Government Transparency: In 2011, Senator Wyden first asked the intelligence
  community for an estimate of the number of Americans’ communications that are
  incidentally swept up in surveillance under Section 702. Since then, the privacy community has joined in those calls,
  and members of the House Judiciary Committee have written to the
  Office of the Director of National Intelligence twice demanding that same information. This
  number, which may well be in the millions, is necessary to gauge the scale of
  impact that Section 702 surveillance has on Americans’ privacy. Despite
  numerous requests from civil society and members of Congress over the last six
  years, the intelligence community has not come forth with an estimate.
  Additionally, while the NSA and the CIA are required to report on the number of
  US person queries it makes in databases containing Section 702 information, the
  FBI is exempt for this requirement. The NSA
  and CIA made 30,355 of these queries for non-contents and 5,288 queries for
  contents in 2016 alone. Considering the DOJ testified before the FISC that the
  FBI makes these queries so frequently it’s akin to doing a Google search, reporting on the number of
  times they are conducted is essential to effective oversight. Congress must increase transparency
  around Section 702 surveillance by requiring annual estimates of the number of
  Americans whose communications have been incidentally swept up, and by removing
  FBI exemptions from reporting requirements. 

• Allow for More
  Robust Third Party Reporting: The USA FREEDOM Act established a framework
  for companies that receive various types of national security processes, like
  NSLs, Pen Register and 215 orders, and Section 702 directives, to report in
  large bands (ex. 0-999) the number of processes they received, and the number
  of customer selectors that were targeted. The law does not allow companies to
  report on the source of authority, such that a company could not say how many
  selectors were targeted solely under Section 702. Additionally, the bands in
  which companies may report do not allow enough granularity to assure users that
  their information is adequately protected. Finally, there is still debate as to
  whether the law currently allows a company that has not received a particular
  type of national security process to state as much on their semi-annual
  transparency report. Congress should
  amend reporting provisions to allow for third parties that receive national
  security processes to report, with granularity, the number of processes they
  receive, including zero if they have not received any, and the source of
  authority that was the basis for each demand.

In addition to these critical reforms, Congress
should consider other important reforms to Section 702, such as shortening
retention limits and removing the exception to those limits for encrypted
information; further reforming the FISC by strengthening the role of the
appointed amici so that they can raise concerns beyond issues about which the
FISC judges inquire, and empowering the amici to appeal adverse decisions by
the FISC judges to the FISA Court of Review; clarifying the notice requirement
to ensure that defendants are told if any information that was used in their
investigation came from Section 702 surveillance; and clearing the path for
litigation on the constitutionality of Section 702 surveillance by addressing the
standing requirement and limiting the executive branch’s ability to exercise
the state secrets privilege.