UNCLASSIFIED

UNCLASSIFIED

9th & 10th Biannual Reports 

on the Activities of the 

National Security Agency/ 

Central Security Service

Civil Liberties, Privacy, and Transparency Office

January – December 2022
UNCLASSIFIED

UNCLASSIFIED 2

Message from the Director

As the Director of Civil Liberties, Privacy, and Transparency (CLPT) for the National Security 

Agency/Central Security Service (NSA/CSS), I am honored to present the Agency’s Biannual Reports for 

January through December 2022, as required by Section 1062 of the Intelligence Reform and Terrorism 

Prevention Act (IRTPA) of 2004 (Public Law 108-458). Section 1062 requires the NSA/CSS CLPT Office 

issue an unclassified report at least semi-annually, containing the following information:

• The number and types of reviews the CLPT Office has undertaken;

• The types of advice the CLPT Office provided and the responses given to such advice;

• The number and nature of complaints the CLPT Office received concerning alleged violations of 

civil liberties and privacy; and 

• A summary of the disposition of such complaints, the reviews and inquiries conducted, and the 

impact of the activities of the CLPT Office.

NSA/CSS is committed to protecting and incorporating safeguards for civil liberties and privacy, 

consistent with its mission to protect and defend the Nation. This report provides a summary of the work the 

former NSA CLPT Director, Rebecca Richards, and the CLPT Office’s dedicated team of privacy 

professionals accomplished throughout a twelve month period, and represents a combination of the 9th and 

10th Biannual Reports.

From January through December 2022, we conducted more than 1000 reviews of NSA/CSS activities, 

programs, and practices for civil liberties and privacy impacts. Additionally, our office notified external 

overseers of NSA/CSS activities through written explanations, oral briefings, and applicable documents in 

131 specific instances. In January, we hosted our third Privacy Day in observance of International Data 

Privacy and Protection Day, focusing on the role the protection of civil liberties and privacy plays in building 

trust and confidence in NSA/CSS. We engaged in NSA’s review and implementation of Enhancing 

Safeguards for United States Signals Intelligence (SIGINT) Activities (EO 14086) and worked with 

the Committee on National Security Systems to complete the Privacy Baseline in its Security Categorization 

and Control Selection Instruction (CNSSI 1253). Finally, our office reviewed the collection and handling of 

Personally Identifiable Information (PII) spanning multiple NSA/CSS mission areas. 

Overall, the NSA/CSS CLPT Office ensures the Agency conducts its vital foreign intelligence and 

cybersecurity missions in a manner that protects civil liberties and privacy, and promotes appropriate 

transparency. I am proud of our team’s accomplishments during this period and the additional transparency 

regarding the Agency’s activities this report summarizes.

THOMAS D. STUCK

Director, Civil Liberties, Privacy, and Transparency
UNCLASSIFIED

UNCLASSIFIED 3

Table of Contents

I. Overview Of The National Security Agency Civil Liberties, Privacy, And Transparency Program.. 4

II. Type & Number Of Activities Undertaken From January – December 2022.................................... 5

III. Type Of Advice Provided And The Response Given To Such Advice ............................................ 7

IV. Internal & External Outreach............................................................................................................ 7

V. Questions, Concerns, Complaints, & Redress ................................................................................... 9

VI. Conclusion ...................................................................................................................................... 10
UNCLASSIFIED

UNCLASSIFIED 4

I. OVERVIEW OF THE NATIONAL SECURITY AGENCY CIVIL LIBERTIES, 

PRIVACY, AND TRANSPARENCY PROGRAM

The CLPT Office focuses on civil liberties, privacy, and transparency issues, particularly as 

they relate to authorities and capabilities NSA/CSS uses to conduct its activities. It develops and 

supports policies that bridge gaps between current laws and technology. The CLPT Office also 

engages and collaborates with mission elements and staff throughout NSA/CSS to improve 

processes to safeguard civil liberties and privacy; document existing civil liberties and privacy 

protections; and increase transparency with the workforce, the public, key stakeholders, and 

overseers. The CLPT Office includes a team of professionals to assist and support the CLPT 

Officer, to include the duties of this position as the NSA Transparency Officer in accordance with

Intelligence Community Directive (ICD) 107, “Civil Liberties, Privacy, and Transparency.” The 

CLPT Officer advises the Director of NSA (DIRNSA), NSA/CSS senior leadership, and mission 

managers on emerging areas where new intelligence capabilities and challenges intersect with civil 

liberties and privacy questions. Through engagement, training, awareness, and advice, the CLPT 

Office underscores and reminds members of the NSA/CSS workforce of their individual 

responsibility to protect civil liberties and privacy while promoting transparency within and outside 

the Agency.

To ensure NSA/CSS affirmatively considers civil liberties, privacy, and transparency in its 

decisions, CLPT works extensively across the Agency to facilitate internal engagement and 

coordination with subject matter experts from the Cybersecurity, Capabilities, Engagement & 

Policy, Operations, Research, Business Management and Acquisition, and Workforce Support 

Activities Directorates. Each of these directorates has further designated a liaison to the CLPT 

Office to provide expertise on directorate priorities.

In addition to fulfilling the legal requirements of IRTPA Section 1062, the CLPT Officer serves 

as the NSA Senior Component Official for Privacy, as Department of Defense (DoD) Instruction 

5400.11, “DoD Privacy and Civil Liberties Programs,” 29 January 2019 requires. During this 

reporting period, the CLPT Officer also served as a member of the Federal Privacy Council (FPC), 

the principal interagency forum Executive Order (EO) 13719 established to improve privacy 

practices across the Federal Government.

The CLPT Officer carries out this mission to ensure civil liberties, privacy, and transparency 

receive appropriate consideration in the course of the Agency’s missions, and in executing both 

statutory and policy requirements. The CLPT Officer conducts seven major activities: 

• Advise NSA/CSS senior leaders and mission managers regarding the protection of civil 

liberties and privacy;

• Review and assess policy, procedures, technology, and operations on incorporating civil 

liberties and privacy protections and safeguards in mission and non-mission systems;

• Maintain an effective mechanism for receiving complaints or indications of possible abuses 

of civil liberties and privacy;

• Provide training and guidance to NSA/CSS affiliates regarding their responsibilities to 

identify and protect the privacy of Personally Identifiable Information (PII) and U.S. person 

information (USPI), including the requirements of the Privacy Act of 1974;
UNCLASSIFIED

UNCLASSIFIED 5

• Receive and respond to incidents involving actual or potential breaches of PII in classified 

and unclassified environments and comply with reporting requirements;

• Review and investigate NSA/CSS policies, procedures, and operations to determine whether 

they incorporate the protections and safeguards necessary to protect civil liberties and 

privacy; and

• Provide appropriate transparency into the civil liberties and privacy protections present in 

NSA/CSS activities to mission partners; executive, legislative, and judicial branch 

overseers; and the American public, including reporting independently to DIRNSA and 

external executive and legislative branch entities.

II. TYPE & NUMBER OF ACTIVITIES UNDERTAKEN FROM JANUARY – 

DECEMBER 2022

During the reporting period, the CLPT Office conducted 1025 reviews of NSA/CSS activities, 

programs, and policies for civil liberties and privacy impacts as shown in Table 1, which displays 

the data in two six-month periods, consistent with past reports. Additionally, the CLPT Office 

notified external overseers of NSA/CSS activities through written explanations, oral briefings, and 

applicable documents in 131 specific instances. The CLPT Office remains a vital component and 

resource for NSA affiliates to address privacy concerns. The total number of CLPT inquiries, 

assessments and notifications to overseers in 2022 is shown in Table 1.

Table 1 –Activities

Types of Review Jan. – Jun. Jul. – Dec.

Reviews for civil liberties and privacy impacts 548 477

Notifications, briefings, and applicable documents to external 

overseers

72 59

Total 620 536

Pages of classified documents reviewed and provided for oversight 

purposes

916 1572

Pages of classified documents reviewed for public release 659 523

339

253

599 620

383

473

639

536

0

100

200

300

400

500

600

700

2019 2020 2021 2022

Total Number

Total number of reviews, assessments, and notifications to overseers by year.

Figure 1 - Yearly Comparison of CLPT Office Activities

January - June

July - December
UNCLASSIFIED

UNCLASSIFIED 6

Reviews and Assessments for Civil Liberties and Privacy Implications

The CLPT Office reviews and assesses the civil liberties and privacy implications of NSA 

activities, contributes to the development of Agency policies, and provides input to oversight 

reports for the Office of the Director of National Intelligence (ODNI) and DoD. After the release 

of EO 14086 in October 2022, the CLPT office evaluated potential implementation strategies to 

increase privacy safeguards. Examples of other activities and documents the CLPT Office 

reviewed during the reporting period include:

• The collection and use of publicly available and commercially available information;

• Assessments of NSA IT systems, particularly unclassified systems and systems handling 

administrative PII; 

• DoD-related Privacy Act systems of records notices (SORNs) for NSA reference and use;

• Potential privacy incidents and proposed mitigations, reported quarterly to the DoD Senior 

Intelligence Oversight Official (SIOO); 

• Office of the Inspector General (OIG) reviews of the NSA privacy program as the Federal 

Information Security and Management Act (FISMA) requires; and

• The ODNI Annual Statistical Transparency Report (ASTR).

The CLPT Office incorporates Civil Liberties and Privacy Impact Assessments (CLPIAs) into 

the NSA/CSS risk management framework. NSA leadership uses this framework to assess risk 

related to activities with potential threats to life or limb, major new programs or initiatives, 

significant changes in direction, and activities with strategic implications. During this reporting 

period, the CLPT Office participated in more than 100 Risk Assessments of CLPT concerns. 

The CLPT Office also conducts CLPIAs in other contexts, evaluating collection activities, 

analytic tool development, information-sharing arrangements and decisions, compliance incidents, 

privacy incidents, and data retention decisions taking place outside any existing corporate process.

These reviews address details such as the amount and type of information associated with an 

activity; the scope of persons involved (such as whether there is inclusion of phone numbers, U.S. 

person status, and location); the purpose and anticipated uses for the data; the methodology of the 

activity; and the safeguards in place to mitigate potential risks to civil liberties and privacy.

During this reporting period, CLPT reviewed three cybersecurity mission areas regarding the 

collection and handling of PII, particularly USPI:

• Passive cybersecurity monitoring of unclassified networks;

• Conduct of adversary emulation, strategic vulnerability assessments, and targeted hunting 

of adversaries in authorized networks; and

• Unclassified collaboration in support of defense industrial base and national security 

systems.

Notifications, Briefings, and Applicable Documents to Overseers

The CLPT Office provides notifications, briefings, and a variety of applicable documents to the 

Privacy and Civil Liberties Oversight Board (PCLOB) related to its mission to ensure the Federal 

Government balances its efforts to prevent terrorism with the need to protect privacy and civil 

liberties.
UNCLASSIFIED

UNCLASSIFIED 7

The CLPT Office provided civil liberties and privacy subject matter expertise in four quarterly 

intelligence oversight reports during the reporting period. The CLPT office is also responsible for 

notifying the DoD Senior Agency Official for Privacy about reportable privacy breaches (whether 

or not the Agency had any such breaches during the reporting period is currently classified).

Review of FISA-Related Materials for release to the PCLOB and Public

The CLPT Office serves as the focal point and coordinator for the NSA/CSS stakeholder review 

of Foreign Intelligence Surveillance Act (FISA)-related materials. In this capacity, the CLPT Office

led the NSA/CSS review of 1,182 pages of documents for necessary redactions and ODNI release 

to Congress, the PCLOB, and the public.

III. TYPE OF ADVICE PROVIDED AND THE RESPONSE GIVEN TO SUCH ADVICE

During the reporting period, the CLPT Office continued to perform its advisory role. Below are 

examples of the types of advice this office provided and the responses it received. The CLPT

Office’s advice informs and steers senior leader decision-making in these sustained activities:

Issuance of two new NSA/CSS policies representing the next steps in enabling NSA/CSS and 

the United States SIGINT System (USSS) to implement Department of Defense Manual (DoDM) 

5240.01, “Procedures Governing the Conduct of DoD Intelligence Activities,” and the SIGINT 

Annex, DoDM S-5240.01A, “Procedures Governing the Conduct of DoD Intelligence Activities: 

Annex Governing Signals Intelligence Information and Data Collected Pursuant to Section 1.7(c) 

of E.O. 12333.”

• Policy 12-2, “NSA/CSS Mission Compliance and Intelligence Oversight:”

o As the SIGINT and cybersecurity missions evolved, it became necessary to have a 

unified mission compliance and intelligence oversight policy. This policy, which 

NSA stakeholders developed in conjunction with the CLPT Office, combines and 

underpins all compliance functions, roles, and responsibilities for the USSS. The 

Agency has a longstanding responsibility to protect privacy and civil liberties in the 

conduct of its mission activities. This unified and comprehensive policy will help 

make employee responsibilities in protecting privacy and civil liberties clearer and 

easier to implement. 

• Policy 12-3, “Protection of Civil Liberties and Privacy of U.S. Person Information When 

Conducting NSA/CSS Mission and Mission-Related Activities:”

o This policy, which NSA stakeholders developed in conjunction with CLPT, clarifies

the rules and procedures for protecting the civil liberties and privacy of U.S. citizens 

(i.e., USPI) during NSA/CSS and USSS mission and mission-related activities. 

IV. INTERNAL & EXTERNAL OUTREACH

A core function of the CLPT Office is to engage both internally and externally on how 

NSA/CSS protects civil liberties and privacy.

As Table 2 identifies, the CLPT Office supported activities through internal and external 

engagements on privacy protections for NSA/CSS activities. The CLPT Office actively participated 

in Intelligence Community (IC) CLPT meetings, IC Transparency Council meetings, and FPC 
UNCLASSIFIED

UNCLASSIFIED 8

meetings. Co-leading the FPC’s Agency Implementation Committee, the CLPT Officer focused on 

sharing best practices for protecting civil liberties and privacy across the Federal Government. 

During this reporting period, the CLPT Office hosted its third Privacy Day event to observe 

International Data Privacy and Protection Day at NSA/CSS on 28 January 2022, and brought focus 

to the role protecting civil liberties and privacy plays in building trust and confidence in NSA/CSS. 

This event emphasized that, for the Agency to be effective in its SIGINT and cybersecurity 

missions, it must have the trust and confidence of our nation’s leaders and the public. NSA Director 

General Paul Nakasone discussed the importance of engaging with diverse and divided perspectives 

and how doing so strengthens NSA’s role in protecting national security.

The CLPT Office continued to provide civil liberties and privacy training within NSA/CSS as 

well as for the broader IC and federal privacy community. The office began leading an interagency 

team in reviewing and incorporating the privacy control baseline from the National Institute for 

Standards and Technology (NIST) special publication, “Security and Privacy Controls for 

Information Systems (SP 800-53, Rev 5),” into the Committee for National Security Systems 

(CNSS) Instruction 1253, “Security Categorization and Selection for National Security Systems.”

This interagency group of privacy and security experts reviews updates and provides 

recommendations to the CNSS Safeguarding Working Group for inclusion in updated instructions.

Externally, the CLPT Officer supported ODNI with media and civil society engagements 

related to the release of FISA materials, supported ODNI in efforts related to European Court of 

Justice decisions on privacy protections, taught classes about civil liberties and privacy at various 

academic institutions, and engaged in domestic and international conferences related to protecting 

civil liberties and privacy at NSA/CSS. These engagements promoted transparency and allowed

NSA/CSS to understand public concerns about its activities and their potential impact on civil 

liberties and privacy. The CLPT Office’s training and engagements in 2022 are shown in Table 2.

Table 2 – Internal and External Outreach

Types of Outreach Jan. – Jun. Jul. – Dec.

Training and Awareness 5 3

Internal Engagements 30 35

External Engagements 38 29

Total 73 67
UNCLASSIFIED

UNCLASSIFIED 9

V. QUESTIONS, CONCERNS, COMPLAINTS, & REDRESS

For the purpose of this report, questions, concerns, or complaints submitted to the CLPT Office 

must include a written allegation of harm or violation of privacy or civil liberties protections. These 

are concerns a member of the public, NSA/CSS affiliate, or other Government official raises about 

the administration or operation of an NSA/CSS program. 

Members of the public may contact CLPT via a form posted on www.nsa.gov to ask questions 

or submit written complaints alleging violation of privacy or civil liberties protections in 

administering NSA/CSS programs and operations. Additionally, NSA/CSS affiliates may submit 

questions, concerns, and complaints to CLPT via an internal email or anonymous web form. During 

this reporting period, CLPT also received three referrals from the NSA Office of the Inspector 

General (OIG), as shown in Table 3 below.

During this reporting period, CLPT received questions on a variety of topics, including: 

collection and use of PII, particularly Social Security numbers; requests for Privacy Act Statements 

based on specific collection; input on survey tools; and policies related to the need to encrypt PII. 

CLPT reviewed each question, concern, or complaint and provided written guidance regarding civil 

liberties and privacy concerns. If an activity might have been a PII incident or breach, CLPT 

conducted an assessment. In cases that required additional guidance or mitigation, CLPT worked

closely with the NSA Office of the General Counsel (OGC) and the affected organization. 

In reviewing questions, concerns, and complaints, CLPT determines whether there is a civil 

liberties and privacy issue to evaluate and answer, or the inquiry is more appropriate for another 

office to review and answer. CLPT also reviews submissions to determine whether it should refer 

a question, concern, or complaint to the OIG, and similarly, the OIG may refer privacy-related 

issues to CLPT. During this reporting period, CLPT also received a number of unclassified inquiries 

through the nsa.gov public website that Table 3 and the metrics below do not include. 

64 56

93

73 66

87

102

67

0

20

40

60

80

100

120

2019 2020 2021 2022

Total Number 

Total Number of Trainings and Internal & External Engagements 

Figure 2 - Yearly Comparison of Internal and 

External Outreach 

January - June

July - December
UNCLASSIFIED

UNCLASSIFIED 10

49

95

200

173

61 87

293

173

0

50

100

150

200

250

300

2019 2020 2021 2022

Total Number 

Total Number of Inquiries

Figure 3 - Yearly Comparison of Inquires

January - June

July - December

Table 3 – Requests, Concerns, and Referrals

Requests, Concerns, and Referrals Jan. – Jun. Jul. – Dec.

Information requests to the CLPT Office 10 14

Civil liberties and privacy questions 160 159

Concerns alleging violations of privacy and civil liberties protections 0 0

Requests for redress 0 0

Complaints, concerns, and queries that required whistleblower 

protections 0 0

Referrals to and from the OIG 3 0

Total Reviewed and Closed 173 173

VI. CONCLUSION

In accordance with Section 1062 of the IRTPA, this report summarizes the activities of the 

NSA/CSS CLPT Office from January – December 2022. The CLPT Office will continue to 

engage and collaborate within NSA/CSS and externally with Congress, the PCLOB, and other 

Federal agencies to protect privacy and civil liberties and promote transparency.