Movement on Section 702 of the Foreign Intelligence Surveillance Act (FISA)

Following months of intense debate, an attempted filibuster, and close votes in both the House and Senate, Congress last week finally extended Section 702 of the Foreign Intelligence Surveillance Act (FISA).

First enacted in 2008, Section 702 is a surveillance law that permits the targeting of foreign individuals overseas.  The authority has engendered international attention and criticism from civil libertarians and was due to sunset on January 19, 2018.  By passing the FISA Amendments Reauthorization Act of 2017, Congress averted the sunset and extended the program for another six years.  The Act also, however, put in place some additional procedural limitations on the Executive Branch’s use of Section 702.  For instance, subject to a number of exceptions for various heinous crimes, the Act requires the FBI to obtain a court order supported by a finding of probable cause to access communications that are retrieved using a U.S. person query in certain circumstances—specifically, if the query was in connection with a criminal investigation unrelated to national security and not designed to find foreign intelligence information.

Through these and other limitations, the Act appears to be an attempt to split the difference between those who wanted to extend the program in its current form (some, indefinitely) and those sought to curtail it.  The provision that generated the most debate gives the Director of National Intelligence authority to reinstate the acquisition of “abouts communications” (communications that contain a reference to a target), which was terminated by the Executive Branch in early 2017.  This authority is limited by Foreign Intelligence Surveillance Court review and a requirement for review by congressional committees.

The Act also contains several provisions that extend beyond the Section 702 program, including:

• Privacy and Civil Liberties Oversight Enhancements.  The Act permits the largely vacant Privacy and Civil Liberties Oversight Board to exercise the chairman’s authority with a unanimous vote if the chairman’s position is unfilled.  At a time when the Administration has yet to fill many government posts, it also mandates that NSA and FBI appoint senior privacy and civil liberties officers.
• Whistleblower Protection. The Act implements certain whistleblower protections for contractors in the Intelligence Community and at the FBI.
• Classification Study.  The Act requires the Comptroller General to study the classification system, in particular, ways to reduce overclassification and the value of polygraph testing.
• Foreign Intelligence Challenges. Finally, within 270 days, the Attorney General (in coordination with the Director of National Intelligence) is directed to report to Congress on challenges to the effectiveness of foreign intelligence surveillance – including trends such as, specifically, “the use of encryption” and “the current and future ability of the United States to obtain, on a compulsory or voluntary basis, assistance from telecommunications providers or other entities.”  These reporting requirements, particularly regarding encryption and private sector “assistance,” should be viewed in light of the FBI Director’s recent statement on January 9th that, while the FBI “supports information security measures, including strong encryption[,] . . . . information security programs need to be thoughtfully designed so they don’t undermine the lawful tools we need to keep this country safe.”

A particular topic of interest is how the extension of Section 702 might affect the U.S.-E.U. Privacy Shield. The European Union took note of the Section 702 debate in its first annual review of the Privacy Shield last  October and expressed a hope that it would codify in some way the protection of people outside the United States established by President Obama’s Presidential Policy Directive 28 in 2014.  However, the Act essentially reauthorizes what was in effect when the European Commission approved the Privacy Shield in the first place.  Thus, other privacy-related issues are likely to be more important when the Privacy Shield undergoes its annual review in the Fall—in particular, whether the Privacy and Civil Liberties Oversight Board is fully functioning (something the Act’s provisions might facilitate, in certain circumstances) and whether there is a presidentially-appointed, Senate-confirmed State Department privacy ombudsman in place.