February 5, 2016
PCLOB Releases Update on Government's Implementation of the PCLOB Recommendations on Section 215 and Section 702
The bipartisan Privacy and Civil Liberties Oversight Board (PCLOB) has released a report that provides an update on the progress the government has made toward implementing agency recommendations. The "Recommendations Assessment Report" outlines the status of 22 recommendations PCLOB made as part of two separate reports.
In 2014, the Privacy and Civil Liberties Oversight Board (“PCLOB”) issued reports on the government’s Section 215 and Section 702 surveillance programs. Combined, these two reports made 22 recommendations to ensure that these programs appropriately balance national security with privacy and civil liberties.
In January 2015, the PCLOB released an assessment of the status of these recommendations, which included descriptions of efforts that were being made by the government to implement them. This document is an update on the status of these PCLOB recommendations.
All of the PCLOB’s 22 recommendations have been implemented in full or in part, or the relevant government agency has taken significant steps toward adoption and implementation.
As a result, since the release of these two reports, important measures have been taken to enhance the protection of Americans’ privacy and civil liberties and to strengthen the transparency of the government’s surveillance efforts, without jeopardizing our counterterrorism efforts.
Implementation of these recommendations is the result of both action on the part of relevant government agencies and passage of the USA FREEDOM Act, which was enacted in June, 2015. The USA FREEDOM Act addressed most of the recommendations in PCLOB’s Section 215 report. In addition, the Administration has been working to implement all of the recommendations in the Board’s Section 702 report.
The PCLOB is an independent, bipartisan agency within the executive branch, charged with ensuring that the federal government’s efforts to prevent terrorism are balanced with the need to protect privacy and civil liberties. The Board’s analyses of the Section 215 and 702 programs from a legal and policy perspective informed the Board’s recommendations. While most of the recommendations were directed at the executive branch, and in particular, elements of the Intelligence Community, some recommendations were directed at Congress or the Foreign Intelligence Surveillance Court (“FISC” or “FISA court”). For each of the Board’s 22 recommendations, this document explains the recommendation; describes the steps taken to implement it; and offers the Board’s assessment of how fully it has been adopted.
Overall, the Board continues to find the Administration and the Intelligence Community responsive to its recommendations.
While nine of the 22 recommendations are still in the process of being implemented or have been only partially implemented, the Board looks forward to continued consultation with the Administration and the Intelligence Community regarding their efforts.
Highlights of implementation of PCLOB’s Section 215 recommendations:
- Consistent with PCLOB’s recommendation, the USA FREEDOM Act ended the NSA’s bulk telephone records program conducted under Section 215. Enactment of this legislation also addressed recommendations to enable the FISA court to hear independent views on novel and significant matters and to expand opportunities for appellate review of FISA court decisions.
- As recommended by PCLOB, the USA FREEDOM Act also includes additional requirements for public reporting to promote transparency. The public reporting will include information regarding the appointment of individuals to provide independent views before the FISA court as well as statistical information about government surveillance. In addition, the Act permits further statistical reporting by private companies regarding the frequency with which they receive government demands for their data.
- As recommended by PCLOB, the government has taken significant steps toward developing principles and criteria for intelligence transparency for the Intelligence Community. Highlights of implementation of PCLOB’s Section 702 recommendations:
- As part of the annual process of reauthorizing the Section 702 program, the government submitted revised targeting and minimization procedures for approval by the FISA court. These revised procedures, all of which were approved by the court, include changes designed to address several recommendations in the Board’s report.
- In seeking annual recertification of the Section 702 program, the government submitted all the supplemental materials recommended by the PCLOB in Recommendations 4 and 5, thereby facilitating the FISA court’s assessment of the Section 702 program.
Section 215 Report Recommendations
Recommendation 1: End the NSA’s Bulk Telephone Records Program
Status: Implemented (USA FREEDOM Act)
Text of the Board’s Recommendation:
The government should end its Section 215 bulk telephone records program. (1)
Explanation for the Recommendation: The Board concluded that the Section 215 bulk telephone records program lacks a viable legal foundation under Section 215, implicates constitutional concerns under the First and Fourth Amendments, raises serious threats to privacy and civil liberties as a policy matter, and has shown only limited value. As a result, the Board recommended that the government end the program. Without the current Section 215 program, the government would still be able to seek telephone calling records directly from communications providers through other existing legal authorities.
Discussion of Status: The USA FREEDOM Act, enacted on June 2, 2015, ended the bulk telephone records program, along the lines of the Board’s recommendation. The Act established a new system under Section 215 for government access to call detail records in terrorism investigations. To obtain call detail records under the new system, the government must identify a “specific selection term” that is reasonably suspected of being associated with terrorism, and it can obtain only records of calls up to two “hops” from that number, with FISC approval. The NSA began operation of the new system on November 30, 2015.
(1) Board Members Rachel Brand and Elisebeth Collins did not join this recommendation.
Recommendation 2: Immediately Add Additional Privacy Safeguards to the Bulk Telephone Records Program
Status: Implemented in part; Superseded by USA FREEDOM Act
Text of the Board’s Recommendation: The government should immediately implement additional privacy safeguards in operating the Section 215 bulk collection program.
Explanation for the Recommendation: The Board recommended that the government immediately implement several additional privacy safeguards to mitigate the privacy impact of the present Section 215 program. The Board noted that the recommended changes can be implemented without any need for congressional or FISC authorization.
Discussion of Status: The Board proposed that four new safeguards be implemented if the bulk telephone records program were to continue for any period of time. In the Recommendations Assessments Report released by the Board in January 2015, the Board described how the Administration had partially implemented the recommendation. Now that Recommendation 1 has been fully implemented through enactment of the USA FREEDOM Act, Recommendation 2 has been superseded. There is no longer a Section 215 bulk telephone records program to which additional privacy safeguards could be applied.
Recommendation 3: Enable the FISC to Hear Independent Views on Novel and Significant Matters
Status: Implemented (USA FREEDOM Act)
Text of the Board’s Recommendation: Congress should enact legislation enabling the FISC to hear independent views, in addition to the government’s views, on novel and significant applications and in other matters in which a FISC judge determines that consideration of the issues would merit such additional views.
Explanation for the Recommendation: Although the FISC continues to review applications for individualized FISA warrants, in the past decade it has also been called upon to evaluate requests for broader collection programs, such as the Section 215 telephone records program, and to review extensive compliance reports regarding the implementation of the surveillance authorized under Section 702. This expansion of the FISC’s jurisdiction has presented it with complex and novel issues of law and technology. Currently, these issues are adjudicated by the court based only on filings by the government, supplemented by the research and analysis of the judges and their experienced legal staff.
The Board believes that, when FISC judges are considering requests for programmatic surveillance affecting numerous individuals or applications presenting novel issues, they should have the opportunity to call for third-party briefing on the legal issues involved. In addition to assisting the court, a mechanism allowing FISC judges to call upon independent expert advocates for a broader range of legal views could bolster the public’s trust in its operations and in the integrity of the FISA system overall.
Discussion of Status: Section 401 of the USA FREEDOM Act established a process for hearing independent views that is largely consistent with the Board’s recommendation. This provision closely mirrors the Board’s proposal regarding “the establishment of a panel of outside lawyers to serve as Special Advocates before the FISC in appropriate cases.” Like the Board’s proposal, the USA FREEDOM Act authorizes the presiding judge of the FISC to appoint a panel of at least five private sector attorneys, eligible for security clearances and with relevant professional experience, to participate in matters that a FISC judge determines involve a novel or significant interpretation of the law, including the application of law to new technologies. (Alternatively, a FISC judge may issue a written finding that such appointment is not appropriate in a given case.) Under the USA FREEDOM Act, these individuals are designated to serve “as amicus curiae” rather than as “Special Advocates” as in the Board’s proposal, but the legislation does provide that the amici will be tasked with making arguments addressing privacy and civil liberties, and will have access to relevant materials, including government applications, petitions, and motions. Unlike the Board’s proposal, the Act does not mandate that the amici be “permitted to participate in all proceedings related to that application or matter” or “have access to all government filings” (emphasis added). Our report notes, however, that the FISC has the power to establish specific rules regarding the Special Advocate’s or amici’s participation through its internal Rules of Procedure. The FISC has begun appointing individuals to serve as amici in particular matters, and in November 2015, the FISC designated a standing panel of five individuals to serve as amicus curiae as required under the Act.
Recommendation 4: Expand Opportunities for Appellate Review of FISC Decisions
Status: Implemented (USA FREEDOM Act)
Text of the Board’s Recommendation: Congress should enact legislation to expand the opportunities for appellate review of FISC decisions by the FISCR and for review of FISCR decisions by the Supreme Court of the United States.
Explanation for the Recommendation: Over the past decade, the FISC has generated a significant body of law interpreting FISA authorities and other potentially applicable statutes, and analyzing related constitutional questions. However, FISC opinions have been much less likely to be subject to appellate review than the opinions of ordinary federal courts; to date, only two cases have been decided by the Foreign Intelligence Surveillance Court of Review (“FISCR”). There should be a greater opportunity for appellate review of FISC decisions by the FISCR and for review of the FISCR’s decisions by the Supreme Court of the United States. Providing for greater appellate review of FISC and FISCR rulings will strengthen the integrity of judicial review under FISA. Providing a role for the Special Advocate in seeking that appellate review will further increase public confidence in the integrity of the process.
Discussion of Status: Section 401 of the USA FREEDOM Act expands the opportunities for appellate review of FISC decisions by the FISCR and for review of FISCR decisions by the Supreme Court of the United States. Like the Board’s proposal, the Act authorizes the FISC, after issuing an order, to certify a question of law to be reviewed by the FISCR. Similarly, the Act authorizes the FISCR to certify a question of law to be reviewed by the U.S. Supreme Court. In each circumstance, the higher court would decide whether to review the question certified by the lower court. The USA FREEDOM Act provides fewer guarantees than the Board’s proposal that any participating amicus curiae will be allowed to participate in the appellate review process — both in the decision about whether to certify a question of law for review, and in the proceedings that take place once a question has been certified. Unlike the Board’s proposal, the Act provides no mechanism for an amicus curiae to request certification of a FISC or FISCR decision, and it provides no mechanism by which an amicus curiae can challenge the FISC’s decision not to certify a legal question for appellate review. The Board notes that FISC and FISCR rules of procedure could be revised to provide such mechanisms. In addition, under the Board’s proposal, when a legal question is accepted for review by the FISCR, the Special Advocate would be permitted to participate in the matter, just as in the FISC. By contrast, under the USA FREEDOM Act, such participation is permitted only when the FISCR also determines that the matter presents a novel or significant interpretation of the law. The Act also provides that upon certification of a matter to the U.S. Supreme Court, the Court “may appoint an amicus curiae” designated under the provisions of the Act.
Recommendation 5: Take Full Advantage of Existing Opportunities for Outside Legal and Technical Input in FISC Matters
Text of the Board’s Recommendation: The FISC should take full advantage of existing authorities to obtain technical assistance and expand opportunities for legal input from outside parties. Explanation for the Recommendation: FISC judges should take advantage of their ability to appoint Special Masters or other technical experts to assist them in reviewing voluminous or technical materials, either in connection with initial applications or in compliance reviews. In addition, the FISC and the FISCR should develop procedures to facilitate amicus participation by third parties in cases involving questions that are of broad public interest, where it is feasible to do so consistent with national security.
Discussion of Status: As described in connection with Recommendation 3 above, the FISC has obtained legal input from outside experts pursuant to the USA FREEDOM Act. Further, based on conversations with FISA court personnel, the Board understands that efforts are underway for the court to designate one or more individuals to serve as amici who have technical expertise, in addition to the already appointed panel of individuals with legal expertise.
Recommendation 6: Publicly Release New FISC and FISCR Decisions that Involve Novel Legal, Technical, or Compliance Questions
Text of the Board’s Recommendation: To the maximum extent consistent with national security, the government should create and release with minimal redactions declassified versions of new decisions, orders and opinions by the FISC and FISCR in cases involving novel interpretations of FISA or other significant questions of law, technology or compliance. Explanation for the Recommendation: FISC judges should continue their recent practice of drafting opinions in cases involving novel issues and other significant decisions in the expectation that declassified versions will be released to the public. This practice has facilitated declassification review. The government should promptly create and release declassified versions of these FISC opinions.
Discussion of Status: The government has continued to declassify and release additional opinions over the past year. In addition, the USA FREEDOM Act now requires that the government will conduct a declassification review of each new decision of the FISC and FISCR “that includes a significant construction or interpretation of any provision of law,” including decisions interpreting the term “specific selection term” under the new system for accessing call detail records, and that the government will make declassified versions of these opinions publicly available to the greatest extent practicable. The Board also notes that the FISA court maintains its own website where, at least since April 2014, it has been posting public filings including briefs and declassified opinions and orders.
Recommendation 7: Publicly Release Past FISC and FISCR Decisions that Involve Novel Legal, Technical, or Compliance Questions
Status: Being implemented
Text of the Board’s Recommendation: Regarding previously written opinions, the government should perform a declassification review of decisions, orders and opinions by the FISC and FISCR that have not yet been released to the public and that involve novel interpretations of FISA or other significant questions of law, technology or compliance.
Explanation for the Recommendation: The government should create and release declassified versions of older opinions in novel or significant cases to the greatest extent possible consistent with protection of national security. This should cover programs that have been discontinued, where the legal interpretations justifying such programs have ongoing relevance. Although it may be more difficult to declassify older FISC opinions drafted without expectation of public release, the release of such older opinions is still important to facilitate public understanding of the development of the law under FISA. The Board acknowledges the cumulative burden of these transparency recommendations, especially as the burden of review for declassification may fall on the same individuals who are responsible for preparing new FISA applications, overseeing compliance with existing orders, and carrying out other duties. The Board urges the government to develop and announce some prioritization plan or approach. We recommend beginning with opinions describing the legal theories relied upon for widespread collection of metadata from Americans not suspected of terrorist affiliations, to be followed by opinions involving serious compliance issues.
Discussion of Status: The Intelligence Community has continued to declassify and release previously issued FISC decisions and related materials over the past year. These have been posted both on the FISA court’s website and on the Intelligence Community’s website, IC on the Record. The Intelligence Community has advised us that it remains committed to implementing this recommendation, and that it will continue to conduct declassification reviews of both older and more recent opinions.
Recommendation 8: Publicly Report on the Operation of the FISC Special Advocate Program
Status: Implemented (USA FREEDOM Act)
Text of the Board’s Recommendation: The Attorney General should regularly and publicly report information regarding the operation of the Special Advocate program recommended by the Board. This should include statistics on the frequency and nature of Special Advocate participation in FISC and FISCR proceedings.
Explanation for the Recommendation: Should the government adopt our recommendation for a Special Advocate in the FISC, the nature of that advocate’s role must be transparent to be effective. The FISC should publicly disclose any rules the court adopts governing the advocate’s participation in proceedings. In addition, the Attorney General should regularly and publicly report statistics on the frequency of Special Advocate participation, including the number of times Special Advocates have sought review of FISC decisions in the FISCR and the U.S. Supreme Court.
Discussion of Status: Section 603 of the USA FREEDOM Act requires the Administrative Office of the United States Courts annually to report to the intelligence and judiciary committees of Congress on the number of times that an amicus curiae is appointed, the identity of the appointee, the number of times that a FISC judge determines that participation of an amicus curiae is not appropriate, and the text of the written findings supporting such determinations. The Act also requires that this information be reported publicly — except for any written findings supporting any decision not to appoint an amicus curiae.
Recommendation 9: Permit Companies to Disclose Information about Their Receipt of FISA Production Orders, and Disclose More Detailed Statistics on Surveillance
Status: Implemented (USA FREEDOM Act)
Text of the Board’s Recommendation: The government should work with Internet service providers and other companies that regularly receive FISA production orders to develop rules permitting the companies to voluntarily disclose certain statistical information. In addition, the government should publicly disclose more detailed statistics to provide a more complete picture of government surveillance operations.
Explanation for the Recommendation: One important way to understand and assess any government program is numerically — to categorize its critical elements and count them. Periodic public reporting on surveillance programs is a valuable tool promoting accountability and public understanding. We believe that publication of additional numerical information on the frequency with which various surveillance authorities are being used would be possible without allowing terrorists to improve their tradecraft. In recent years, U.S. companies have begun publishing reports showing, country by country, how many government demands they receive for disclosure of user data. Because we believe this kind of reporting can be useful in building and maintaining public trust, we recommended that the government work with companies to permit disclosure of more detailed information. In addition, the Board recommended that the government report more detailed information. To ensure that government reports are meaningful, the government would have to distinguish between particularized programs and those involving bulk collection. In the case of targeted programs, the government should disclose how many orders have been issued and how many individuals have been targeted.
Discussion of Status: Title VI of the USA FREEDOM Act both requires further public reporting by the government and permits further transparency reporting by private companies, and thus covers both parts of the Board’s recommendation.
Recommendation 10: Inform the PCLOB of FISA Activities and Provide Relevant Congressional Reports and FISC Decisions
Status: Being implemented
Text of the Board’s Recommendation: The Attorney General should fully inform the PCLOB of the government’s activities under FISA and provide the PCLOB with copies of the detailed reports submitted under FISA to the specified committees of Congress. This should include providing the PCLOB with copies of the FISC decisions required to be produced under Section 601(a)(5) [of FISA].
Explanation for the Recommendation: Beyond public reporting, FISA requires the Attorney General to “fully inform” the Senate and House intelligence and judiciary committees regarding the government’s activities under certain sections of FISA, including Section 215. FISA also requires the government to provide the congressional committees with copies of “all decisions, orders, or opinions” of the FISC or FISCR that include “significant construction or interpretation” of the provisions of FISA. These two reporting requirements facilitate congressional oversight. The Board urges the government to extend this complete reporting to the PCLOB as well, to facilitate the Board’s oversight role.
Discussion of Status: The Intelligence Community and the Justice Department have provided the PCLOB with many of the congressional reports and FISC decisions described above. Although not all such documents have yet been provided, the Intelligence Community and the Justice Department have also taken steps to implement a standing production system, under which documents submitted to Congress will be routinely provided to PCLOB as well. The Justice Department made the first production to PCLOB in what has been represented to be a new standing production system in January 2016.
Recommendation 11: Begin to Develop Principles for Transparency
Text of the Board’s Recommendation: The Board urges the government to begin developing principles and criteria for transparency.
Explanation for the Recommendation: Transparency is one of the foundations of democratic governance. Our constitutional system of government relies upon the participation of an informed electorate. This in turn requires public access to information about the activities of the government. Transparency supports accountability. It is especially important with regard to activities of the government that affect the rights of individuals. In addition to the specific transparency measures outlined in Recommendations 6 through 10, the Board urges the Administration to commence the process of articulating principles and criteria for deciding what must be kept secret and what can be released as to existing and future programs that affect the American public.
Discussion of Status: In February 2015, the Office of the Director of National Intelligence (“ODNI”) released Principles of Intelligence Transparency for the Intelligence Community describing four broad principles to guide the Intelligence Community’s work. On October 27, 2015, the ODNI released an Implementation Plan for these principles, setting forth a series of priorities and action items.
Recommendation 12: Disclose the Scope of Surveillance Authorities Affecting Americans
Status: Being implemented
Text of the Board’s Recommendation: The scope of surveillance authorities affecting Americans should be public. (2)
Explanation for the Recommendation: The Administration should develop principles and criteria for the public articulation of the legal authorities under which it conducts surveillance affecting Americans. If the text of the statute itself is not sufficient to inform the public of the scope of asserted government authority, then the key elements of the legal opinion or other document describing the government’s legal analysis should be made public so there can be a free and open debate regarding the law’s scope. This includes both original enactments such as Section 215’s revisions and subsequent reauthorizations. The Board’s recommendation distinguishes between “the purposes and framework” of surveillance authorities and factual information specific to individual persons or operations. While sensitive operational details regarding the conduct of government surveillance programs should remain classified, and while legal
interpretations of the application of a statute in a particular case may also be secret so long as the use of that technique in a particular case is secret, the government’s interpretations of statutes that provide the basis for ongoing surveillance programs affecting Americans can and should be made public. This includes intended uses of broadly worded authorities at the time of enactment as well as post-enactment novel interpretations of laws already on the books.
Discussion of Status: Intelligence Community representatives have continued to advise us that they are committed to implementing this recommendation, as reflected in the transparency principles described above. In our Recommendations Assessments Report last year, we noted that in connection with the Board’s July 2014 report on the Section 702 surveillance program, the Intelligence Community worked closely with the Board to declassify a great deal of information about the scope and nature of that surveillance program. We also note that the Intelligence Community has continued to publish information online at IC on the Record, and the NSA has recently released a new Transparency Report outlining the agency’s implementation of the USA FREEDOM Act. While the broad nature of our recommendation makes it difficult for us to assess its implementation, we believe that key leadership within the Intelligence Community is committed to implementation.
(2) Board Members Rachel Brand and Elisebeth Collins did not join this recommendation.
Section 702 Report Recommendations
Recommendation 1: Revise NSA Procedures to Better Document the Foreign Intelligence Reason for Targeting Decisions
Status: Implemented in part
Text of the Board’s Recommendation: The NSA’s targeting procedures should be revised to (a) specify criteria for determining the expected foreign intelligence value of a particular target, and (b) require a written explanation of the basis for that determination sufficient to demonstrate that the targeting of each selector is likely to return foreign intelligence information relevant to the subject of one of the certifications approved by the FISA court. The NSA should implement these revised targeting procedures through revised guidance and training for analysts, specifying the criteria for the foreign intelligence determination and the kind of written explanation needed to support it. We expect that the FISA court’s review of these targeting procedures in the course of the court’s periodic review of Section 702 certifications will include an assessment of whether the revised procedures provide adequate guidance to ensure that targeting decisions are reasonably designed to acquire foreign intelligence information relevant to the subject of one of the certifications approved by the FISA court. Upon revision of the NSA’s targeting procedures, internal agency reviews, as well as compliance audits performed by the ODNI and DOJ, should include an assessment of compliance with the foreign intelligence purpose requirement comparable to the review currently conducted of compliance with the requirement that targets are reasonably believed to be non-U.S. persons located outside the United States.
Explanation for the Recommendation: This recommendation is designed to ensure that when the NSA selects a target for surveillance under Section 702, a valid foreign intelligence purpose supports the targeting decision. The Board’s review of the Section 702 program showed that the procedures for documenting targeting decisions within the NSA, and the procedures for reviewing those decisions within the executive branch, focus primarily on establishing that a potential target is a non-U.S. person reasonably believed to be located abroad. The process for documenting and reviewing the foreign intelligence purpose of a targeting decision is not as rigorous, and typically agency personnel indicate what category of foreign intelligence information they expect to obtain from targeting a particular person in a single brief sentence that contains only minimal information about why the analyst believes that targeting this person will yield foreign intelligence information. However, the “foreign intelligence purpose” determination is a critical part of the statutory framework under Section 702. Changes to the targeting procedures that provide more guidance to analysts and require more explanation regarding the foreign intelligence purpose of a targeting will help analysts better articulate this element of their targeting decisions. When analysts articulate at greater length the bases for their targeting decisions, the executive branch oversight team that later reviews those decisions will be better equipped to meaningfully review them.
Discussion of Status: As part of the annual certification process for the Section 702 program, the government submitted revised NSA targeting procedures for approval by the FISC. These revised procedures included changes designed to address Recommendation 1 of the Board’s Section 702 report. The Court approved these revised procedures as part of the annual certification process. The Board agrees that the revised procedures implement subpart (b) of this recommendation, but find that subpart (a) is only partially implemented. The revised targeting procedures specify in somewhat more detail the procedure, but do not add or clarify substantive criteria, for determining the expected foreign intelligence value of a particular target. The NSA also has updated its internal guidance and training for analysts to implement the revised procedures. This guidance included exemplars and the supporting rationale for an improved description of the foreign intelligence that the analyst expects to receive by the tasking. NSA has shared the updated TAR guidance with the FBI and CIA to ensure that they provide NSA with the required documentation in support of their targeting nominations. The Board has been advised that now that the NSA’s updated targeting procedures have been approved, the compliance audits conducted by the DOJ/ODNI oversight teams include review of the written explanations documenting the foreign intelligence purpose for targeting determinations. This has facilitated the oversight team’s assessment of whether the individual targeting decisions made by NSA analysts under Section 702 were justified by a foreign intelligence purpose.
Recommendation 2: Update the FBI’s Minimization Procedures to Accurately Reflect the Bureau’s Querying of Section 702 Data for Non–Foreign Intelligence Matters, and Place Additional Limits on the FBI’s Use of Section 702 Data in Such Matters
Text of the Board’s Recommendation: The FBI’s minimization procedures should be updated to more clearly reflect the actual practice for conducting U.S. person queries, including the frequency with which Section 702 data may be searched when making routine queries as part of FBI assessments and investigations. Further, some additional limits should be placed on the FBI’s use and dissemination of Section 702 data in connection with non–foreign intelligence criminal matters. (3)
Explanation for the Recommendation: Even though FBI analysts and agents who solely work on non–foreign intelligence crimes are not required to conduct queries of databases containing Section 702 data, they are permitted to conduct such queries and many do conduct such queries. This is not clearly expressed in the FBI’s minimization procedures, and the minimization procedures should be modified to better reflect this actual practice. The Board believes that it is important for accountability and transparency that the minimization procedures provide a clear representation of operational practices. In addition, in light of the privacy and civil liberties implications of using Section 702 information, collected under lower thresholds and for a foreign intelligence purpose, in the FBI’s pursuit of non–foreign intelligence crimes, the Board believes it is appropriate to place some additional limits on what can be done with Section 702 information. Discussion of Status: As part of the annual certification process for the Section 702 program, the government submitted revised FBI minimization procedures for approval by the FISC. These revised procedures included changes designed to address Recommendation 2 of the Board’s Section 702 report. The court approved these revised procedures as part of the annual certification process. The Board agrees that the changes implement the Board’s recommendation.
(3) Board Chairman David Medine and Board Member Patricia Wald joined this recommendation but in a separate statement recommended requiring judicial approval for the FBI’s use of Section 702 data in non– foreign intelligence matters. Board Members Rachel Brand and Elisebeth Collins would require an analyst who has not had FISA training to seek supervisory approval before viewing responsive 702 information and would require higher-level Justice Department approval before Section 702 information could be used in the investigation or prosecution of a non–foreign intelligence crime.
Recommendation 3: Require NSA and CIA Personnel to Provide a Statement of Facts Explaining their Foreign Intelligence Purpose Before Querying Section 702 Data Using U.S. Person Identifiers, and Develop Written Guidance on Applying this Standard
Status: Being implemented
Text of the Board’s Recommendation: The NSA and CIA minimization procedures should permit the agencies to query collected Section 702 data for foreign intelligence purposes using U.S. person identifiers only if the query is based upon a statement of facts showing that it is reasonably likely to return foreign intelligence information as defined in FISA. The NSA and CIA should develop written guidance for agents and analysts as to what information and documentation is needed to meet this standard, including specific examples.(4)
Explanation for the Recommendation: Under the NSA and CIA minimization procedures for the Section 702 program, analysts are permitted to perform queries of databases that hold communications acquired under Section 702 using query terms that involve U.S. person identifiers. Such queries are designed to identify communications in the database that involve or contain information relating to a U.S. person. Although the Board recognizes that NSA and CIA queries are subject to rigorous oversight by the DOJ’s National Security Division and the ODNI (with the exception of metadata queries at the CIA, which are not reviewed by the oversight team), we believe that NSA and CIA analysts, before conducting a query involving a U.S. person identifier, should provide a statement of facts illustrating why they believe the query is reasonably likely to return foreign intelligence information. (5) Implementing these measures will help to ensure that analysts at the NSA and CIA do not access or view communications acquired under Section 702 that involve or concern U.S. persons when there is no valid foreign intelligence reason to do so.
Discussion of Status: As part of the annual certification process for the Section 702 program, the government submitted revised NSA and CIA minimization procedures for approval by the FISC. These revised procedures included changes designed to address Recommendation 3 of the Board’s Section 702 report. The court approved these revised procedures as part of the annual certification process. The Board agrees that the changes in the minimization procedures implement the Board’s recommendation. The status of the CIA metadata queries remains the same as reported in the Board’s Recommendations Assessment Report of January 2015, namely with respect to the CIA’s metadata queries using U.S. person identifiers, the CIA accepted and plans to implement this recommendation as it refines internal processes for data management. Thus, the CIA’s new minimization procedures do not reflect changes to implement this recommendation with regard to metadata queries.
(4) Board Chairman David Medine and Board Member Patricia Wald joined this recommendation but in a separate statement recommended requiring judicial approval for the use of U.S. person queries of Section 702 data for foreign intelligence purposes.
(5) Board Member Elisebeth Collins would not extend a new requirement to this effect to metadata queries.
Recommendation 4: Provide the FISC with Documentation of Section 702 Targeting Decisions and U.S. Person Queries
Status: Substantially implemented
Text of the Board’s Recommendation: To assist in the FISA court’s consideration of the government’s periodic Section 702 certification applications, the government should submit with those applications a random sample of tasking sheets and a random sample of the NSA’s and CIA’s U.S. person query terms, with supporting documentation. The sample size and methodology should be approved by the FISA court.
Explanation for the Recommendation: Providing a random sample of targeting decisions would allow the FISC to take a retrospective look at the targets selected over the course of a recent period of time. The data could help inform the FISA court’s review process by providing some insight into whether the government is, in fact, satisfying the “foreignness” and “foreign intelligence purpose” requirements, and it could signal to the court that changes to the targeting procedures may be needed, or prompt inquiry into that question. The data could provide verification that the government’s representations during the previous certification approval were accurate, and it could supply the FISC with more information to use in determining whether the government’s acquisitions comply with the statute and the Fourth Amendment. Similarly, a retrospective sample of U.S. person query terms and supporting documentation will allow the FISC to conduct a fuller review of the government’s minimization procedures. Such a sample could allow greater insight into the methods by which information gathered under Section 702 is being utilized, and whether those methods are consistent with the minimization procedures. While U.S. person queries by the NSA and CIA are already subject to rigorous executive branch oversight (with the exception of metadata queries at the CIA), supplying this additional information to the FISC could help guide the court by highlighting whether the minimization procedures are being followed and whether changes to those procedures are needed.
Discussion of Status: The government proposed possible sampling methodologies to the FISC, and provided the FISC’s legal staff as well as the court’s judges with a briefing during which they reviewed a sample of tasking sheets and a sample of U.S. person queries. In its Memorandum Opinion and Order reauthorizing the Section 702 program, the court referred to this recommendation by the Board, and noted: The government adopted this recommendation, and in January 2015 it provided the Court’s legal staff with an extensive briefing on its oversight activities, as well as sample tasking sheets and query terms. The government offered to make additional tasking sheets and query terms available to the Court. At the Court’s request, the government provided an overview of its Section 702 oversight efforts to all of the Court’s judges in May 2015, which included a review of sample tasking sheets. These briefings confirmed the Court’s earlier understanding that the government’s oversight efforts with respect to Section 702 collection are robust. In considering the recertification of the Section 702 program, the FISC did not make any decision on a sampling methodology. To date the Court has not requested additional tasking sheets or queries beyond what was provided in January and May 2015.
Recommendation 5: Create and Submit to the FISC a Single Consolidated Document Describing All Significant Rules Governing Operation of the Section 702 Program
Status: Implemented by the executive branch
Text of the Board’s Recommendation: As part of the periodic certification process, the government should incorporate into its submission to the FISA court the rules for operation of the Section 702 program that have not already been included in certification orders by the FISA court, and that at present are contained in separate orders and opinions, affidavits, compliance and other letters, hearing transcripts, and mandatory reports filed by the government. To the extent that the FISA court agrees that these rules govern the operation of the Section 702 program, the FISA court should expressly incorporate them into its order approving Section 702 certifications. Explanation for the Recommendation: The government’s operation of the Section 702 program must adhere to the targeting and minimization procedures that are approved by the FISA court, as well as to the pertinent Attorney General guidelines and the statute itself. The government also makes additional representations to the FISA court through compliance notices and other filings, as well as during hearings, that together create a series of more rigorous precedents and a common understanding between the government and the court regarding the operation of the program. Such rules have precedential value and create real consequences, as the government considers itself bound to abide by the representations it makes to the FISA court. To the extent that the rules which have emerged from these representations and this interactive process govern the operation of the Section 702 program, they should be memorialized in a single place and incorporated into the FISC’s certification review. This consolidation of rules will also facilitate congressional oversight of the Section 702 program, and the Board views this recommendation as a measure to promote good government.
Discussion of Status: During the certification process, the government submitted a “Summary of Notable Section 702 Requirements” as part of its submission. The document includes references to hearing transcripts, compliance letters and reports filed with the FISC, and other relevant documents regarding the operation of the Section 702 program. As noted in the document’s introduction, it “is not inclusive of all currently applicable rules and requirements for the operation of the Section 702 program, but is intended as a reference guide to prominent concepts governing the program.” The FISC noted in its Memorandum Opinion and Order reauthorizing the Section 702 program that this document had been submitted, but the Court did not incorporate the filing into its order or otherwise refer to the filing.
Recommendation 6: Periodically Assess Upstream Collection Technology to Ensure that Only Authorized Communications Are Acquired
Text of the Board’s Recommendation: To build on current efforts to filter upstream communications to avoid collection of purely domestic communications, the NSA and DOJ, in consultation with affected telecommunications service providers, and as appropriate, with independent experts, should periodically assess whether filtering techniques applied in upstream collection utilize the best technology consistent with program needs to ensure government acquisition of only communications that are authorized for collection and prevent the inadvertent collection of domestic communications.
Explanation for the Recommendation: Upstream collection involves a greater risk that the government will acquire wholly domestic communications, which it is not authorized to intentionally collect under Section 702. Ensuring that the upstream collection process comports with statutory limits and with agency targeting procedures involves an important technical process of filtering out wholly domestic communications. The government acknowledges, however, that the technical methods used to prevent the acquisition of domestic communications do not completely prevent them from being acquired. Even if domestic communications were to constitute a very small percentage of upstream collection, this could still result in a large overall number of purely domestic communications being collected. Mindful of these considerations, the Board believes that there should be an ongoing dialogue, both within the government and in cooperation with telecommunications providers or independent experts, to ensure that the means being used to filter for domestic communications use the best technology. We also believe that the determination about whether this is the case should be continually revisited.
Discussion of Status: The NSA conducted a review based upon the Board’s recommendation. The NSA completed its review and determined that at this time the best technology is being used for filtering. The NSA has advised the Board that it will periodically review whether the existing study remains accurate. If technology has changed sufficiently to make the existing study no longer accurate, the NSA will conduct a new study.
Recommendation 7: Examine the Technical Feasibility of Limiting Particular Types of “About” Collection
Text of the Board’s Recommendation: The NSA periodically should review the types of communications acquired through “about” collection under Section 702, and study the extent to which it would be technically feasible to limit, as appropriate, the types of “about” collection.
Explanation for the Recommendation: In the upstream collection process, the NSA acquires not only Internet communications sent to and from the selector, such as an email address, used by a targeted person, but also communications that simply contain reference to the selector, sometimes in the body of the communication. These are termed “about” communications, because they are not to or from, but rather “about” the communication selectors of targeted persons. In addition, for technical reasons, “about” collection is needed even to acquire some communications that actually are to or from a target. Other types of “about” collection can result in the acquisition of communications between two non-targets, thereby implicating greater privacy concerns. Moreover, the permissible scope of targeting in the Section 702 program is broad enough that targets need not themselves be suspected terrorists or other bad actors. Thus, if the email address of a target appears in the body of a communication between two non-targets, it does not necessarily mean that either of the communicants is in touch with a suspected terrorist. While “about” collection is valued by the government for its unique intelligence benefits, it is, to a large degree, an inevitable byproduct of the way the NSA conducts much of its upstream collection. At least some forms of “about” collection present novel and difficult issues regarding the balance between privacy and national security. But current technological limits make any debate about the proper balance somewhat academic, because it is largely unfeasible to limit “about” collection without also eliminating a substantial portion of upstream’s “to/from” collection, which would more drastically hinder the government’s counterterrorism efforts. We therefore recommend that the NSA work to develop technology that would enable it to identify and distinguish among the types of “about” collection at the acquisition stage, and then selectively limit or modify its “about” collection, as may later be deemed appropriate.
Discussion of Status: As with the previous recommendation, the NSA conducted a review based upon the Board’s recommendation and concluded that no changes are practical at this time. The NSA has advised the Board that it will periodically review whether the existing study remains accurate. If technology has changed sufficiently to make the existing study no longer accurate, the NSA will conduct a new study.
Recommendation 8: Publicly Release the Current Minimization Procedures for the CIA, FBI, and NSA
Text of the Board’s Recommendation: To the maximum extent consistent with national security, the government should create and release, with minimal redactions, declassified versions of the FBI’s and CIA’s Section 702 minimization procedures, as well as the NSA’s current minimization procedures.
Explanation for the Recommendation: The Board believes that the public would benefit from understanding the procedures that govern the acquisition, use, retention, and dissemination of information collected under Section 702. The Board respects the government’s need to protect its operational methodologies and practices, but it also recognizes that transparency enables accountability to the public that the government serves. Therefore, the Board urges the government to engage in a declassification review and, to the greatest extent possible without jeopardizing national security, release unredacted versions of the FBI, CIA, and NSA minimization procedures.
Discussion of Status: The Intelligence Community released declassified versions of all three agencies’ thencurrent minimization procedures in February 2015.
Recommendation 9: Adopt Measures to Document and Publicly Release Information Showing How Frequently the NSA Acquires and Uses Communications of U.S. Persons and People Located in the United States
Status: Being implemented
Text of the Board’s Recommendation: The government should implement five measures to provide insight about the extent to which the NSA acquires and utilizes the communications involving U.S. persons and people located in the United States under the Section 702 program. Specifically, the NSA should implement processes to annually count the following: (1) the number of telephone communications acquired in which one caller is located in the United States; (2) the number of Internet communications acquired through upstream collection that originate or terminate in the United States; (3) the number of communications of or concerning U.S. persons that the NSA positively identifies as such in the routine course of its work; (4) the number of queries performed that employ U.S. person identifiers, specifically distinguishing the number of such queries that include names, titles, or other identifiers potentially associated with individuals; and (5) the number of instances in which the NSA disseminates non-public information about U.S. persons, specifically distinguishing disseminations that includes names, titles, or other identifiers potentially associated with individuals. These figures should be reported to Congress in the NSA Director’s annual report and should be released publicly to the extent consistent with national security.
Explanation for the Recommendation: Since the enactment of the FISA Amendments Act in 2008, the extent to which the government incidentally acquires the communications of U.S. persons under Section 702 has been one of the biggest open questions about the program, and a continuing source of public concern. The executive branch has maintained that it cannot provide such a number — because it is often difficult to determine from a communication the nationality of its participants, and because the large volume of collection under Section 702 would make it impossible to conduct such determinations for every communication that is acquired. The executive branch also has pointed out that any attempt to document the nationality of participants to communications acquired under Section 702 would actually be invasive of privacy, because it would require government personnel to spend time scrutinizing the contents of private messages that they otherwise might never access or closely review. As a result of this impasse, lawmakers and the public do not have even a rough estimate of how many communications of U.S. persons are acquired under Section 702. Based on information provided by the NSA, the Board believes that certain measures can be adopted that could provide insight into these questions without unduly burdening the NSA or disrupting the work of its analysts, and without requiring the agency to further scrutinize the contents of U.S. persons’ communications. We believe that the NSA could implement five measures, listed above, that collectively would shed some light on the extent to which communications involving U.S. persons or people located in the United States are being acquired and utilized under Section 702.
Discussion of Status: The NSA has advised the Board that for categories 9(4) and 9(5), as part of its reporting under the USA FREEDOM Act, the NSA will report statistics that are substantially similar to those requested by the Board. The NSA already reports similar statistics in classified reports to Congress (which the Board reviewed during its Section 702 inquiry), and the NSA has now agreed to make these numbers publicly available. Specifically, for category 9(4), the Board had recommended that the NSA report “the number of queries performed that employ U.S. person identifiers, specifically distinguishing the number of such queries that include names, titles, or other identifiers potentially associated with individuals.” The Justice Department already reports to Congress, in a classified semiannual report required by FISA, the number of metadata queries that use a U.S. person identifier, and also the number of U.S. person identifiers approved for content queries. The NSA will report these numbers publicly as part of its USA FREEDOM Act reporting, although it will not separately break out the number of such queries that include names, titles, or other identifiers potentially associated with individuals as described in subpart (4) of the Board’s recommendation. For category 9(5), the Board had recommended that the NSA report “the number of instances in which the NSA disseminates non-public information about U.S. persons, specifically distinguishing disseminations that includes names, titles, or other identifiers potentially associated with individuals.” As required by FISA, the NSA Director and NSA Inspector General already report to Congress, in classified annual reports, the number of disseminated NSA intelligence reports that refer to a U.S. person identity and the number of U.S. person identities released by the NSA in response to requests for identities that were not referred to by name or title in the original reporting. The NSA advises the Board that it also plans to declassify and publicly report these numbers as part of its USA FREEDOM Act reporting, although again, it will not separately break out the number of such queries that include names, titles, or other identifiers potentially associated with individuals as described in subpart (5) of the Board’s recommendation. The Board had recommended in subparts (1), (2), and (3) that the NSA report “(1) the number of telephone communications acquired in which one caller is located in the United States; (2) the number of Internet communications acquired through upstream collection that originate or terminate in the United States; (3) the number of communications of or concerning U.S. persons that the NSA positively identifies as such in the routine course of its work.” With regard to those subparts of the Board’s recommendation, the NSA has informed the Board that it has considered various approaches and has confronted a variety of challenges. However, the NSA has advised that it remains committed to developing and implementing measures that will, in the language of the Board’s recommendation, “provide insight about the extent to which the NSA acquires and utilizes” communications involving 26 U.S. persons and people located in the United States under the Section 702 program. The NSA seeks to work with Board staff to develop such measures, either through further refinement of the measures described in the Board’s recommendation or through development of alternative approaches.
Recommendation 10: Develop a Methodology to Assess the Value of Counterterrorism Programs
Status: Being implemented
Text of the Board’s Recommendation: The government should develop a comprehensive methodology for assessing the efficacy and relative value of counterterrorism programs.
Explanation for the Recommendation: Determining the efficacy and value of particular counterterrorism programs is critical. Without such determinations, policymakers and courts cannot effectively weigh the interests of the government in conducting a program against the intrusions on privacy and civil liberties that it may cause. Accordingly, the Board believes that the government should develop a methodology to gauge and assign value to its counterterrorism programs, and use that methodology to determine if particular programs are meeting their stated goals. The Board is aware that the ODNI conducts studies to measure the relative efficacy of different types of intelligence activities to assist in budgetary decisions. The Board believes that this important work should be continued, as well as expanded so as to differentiate more precisely among individual programs, in order to assist policymakers in making informed, data-driven decisions about governmental activities that have the potential to invade the privacy and civil liberties of the public.
Discussion of Status: The ODNI has advised the Board that it has been working to develop a comprehensive methodology for assessing efficacy, including a range of quantitative and qualitative metrics. The ODNI also advises that it will soon provide the Board with a report outlining this methodology. The Board looks forward to reviewing the report and working with the ODNI on this critical initiative.