Reauthorization of the FISA Amendments Act
Released: 2013-04-08T00:00:00

Reauthorizations of expiring provisions of the Foreign Intelligence Surveillance Act (FISA) have been an annual occurrence in Congress since 2009. Prior to 2012, the legislative debate and reauthorizations largely dealt with three amendments to FISA that are commonly linked to the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act). Most recently, in 2011, these three provisions were extended until June 1, 2015. For a more detailed discussion of these three provisions, see CRS Report R40138, Amendments to the Foreign Intelligence Surveillance Act (FISA) Extended Until June 1, 2015 , by [author name scrubbed].

In contrast, the reauthorization debated and passed in 2012 deals with Title VII of FISA, as added by the FISA Amendments Act of 2008. Title VII is only tangentially related to the subjects of the previous years' debates in that it amends the same statute. Therefore, the legislative activity in prior years should be conceptually separated from the current debate and legislation that would address the expiration of Title VII of FISA at the end of this year. This report describes the changes that were made by the FISA Amendments Act within the context of the government's authority to conduct surveillance for foreign intelligence purposes.

On December 30, 2012, President Obama signed H.R. 5949 , the FISA Amendments Act Reauthorization Act of 2012, which extends Title VII of FISA until December 31, 2017.

Overview of FISA and Other Laws Governing Surveillance

The Foreign Intelligence Surveillance Act (FISA) provides a statutory framework by which government agencies may, when gathering foreign intelligence information, obtain authorization to conduct wiretapping or physical searches, utilize pen registers and trap and trace devices, or access specified business records and other tangible things. Authorization for such activities is typically obtained via a court order from the Foreign Intelligence Surveillance Court (FISC), a specialized court created by FISA to act as a neutral judicial decision maker in the context of activities authorized by the statute.

Title VII, added by the FISA Amendments Act of 2008, provides additional procedures for the acquisition of foreign intelligence information regarding persons who are believed to be outside of the United States. These provisions affect both U.S. persons as well as other non-U.S. persons. Specifically, the FISA Amendments Act added

a new procedure for targeting non-U.S. persons abroad without individualized court orders; a new requirement to obtain an individualized court order when targeting U.S. persons abroad; and new procedures that can be used to obtain court orders authorizing the targeting of U.S. persons abroad for electronic surveillance, the acquisition of stored communications, and other means of acquiring foreign intelligence information.

FISA is just one of several federal laws that govern the use of electronic surveillance for legitimate investigative purposes. The principal others are the Electronic Communications Privacy Act (ECPA), Executive Order 12333, and the Fourth Amendment. Each of these, and the manner in which they may overlap or interact with FISA, will be discussed briefly before turning to the provisions added by the FISA Amendments Act.

Electronic Communications Privacy Act (ECPA)

ECPA provides three sets of general prohibitions accompanied by judicially supervised exceptions to facilitate law enforcement investigations. The prohibitions address (1) the interception of wire, oral, or electronic communications (wiretapping); (2) access to the content of stored electronic communications and to communications transaction records; and (3) the use of trap and trace devices and pen registers (essentially in-and-out secret "caller id" devices).

In some circumstances, the use of surveillance activities for foreign intelligence purposes might fall within the scope of the activities prohibited by ECPA. There are two exceptions to ECPA's general prohibitions that address this situation.

First, if the activity in question falls within the definition of electronic surveillance under FISA, then it may be conducted if the government complies with FISA's procedures. For example, the interception of a domestic telephone call is the type of activity that would generally be prohibited by ECPA. It would also qualify as electronic surveillance under FISA. Therefore, if the government obtained a court order from the FISC authorizing the interception of that call, it would be a lawful surveillance activity notwithstanding the general prohibition against wiretapping found in ECPA.

Second, if the activity in question is not electronic surveillance, as that term is defined in FISA, but involves the acquisition of foreign intelligence information from international or foreign communications, then it is not subject to ECPA. For example, the interception of an international telephone call would not be considered electronic surveillance for purposes of FISA if the target were the person on the non-domestic end of the conversation and the acquisition would not occur on United States soil. So long as the purpose of that acquisition was to acquire foreign intelligence information, then it would not be subject to the general prohibitions in ECPA.

Although both exceptions result in the non-application of ECPA, they differ in one important aspect that is particularly relevant to understanding the changes wrought by Title VII of FISA. Both ECPA and FISA provide that the two statutes constitute the exclusive means of conducting electronic surveillance, as defined in FISA. As a result, using the procedures under FISA is compulsory for those activities that qualify as electronic surveillance but cannot be accomplished by, and are exempt from, ECPA. In contrast, prior to the FISA Amendments Act, FISA's procedures were generally never needed for wiretapping activities that did not qualify as electronic surveillance, and which were also exempt from ECPA because they involved international or foreign communications. However, as discussed below, the recently added Section 704 of FISA does make FISA's procedures compulsory when the target of such surveillance is a United States person. Those activities that remain beyond the scope of either ECPA or FISA are governed by Executive Order 12333 and the Fourth Amendment, discussed in the next two sections.

Executive Order 12333

Section 2.5 of Executive Order 12333, as amended, delegates to the Attorney General the power to approve the use of any technique for intelligence purposes within the United States or against a U.S. person abroad. If a warrant would be required for law enforcement purposes, the executive order requires the Attorney General to determine in each case that there is probable cause to believe that the technique is directed against a foreign power or an agent of a foreign power. The authority delegated by Executive Order 12333 must be exercised in accordance with FISA, but also extends to activities beyond FISA's reach.

Fourth Amendment

The Fourth Amendment to the U.S. Constitution protects against "unreasonable searches and seizures." In domestic criminal law investigations, it generally requires law enforcement officers to obtain a court-issued warrant before conducting a search. When the warrant requirement does not apply, government activity is generally subject to a "reasonableness" test under the Fourth Amendment.

The extent to which the warrant requirement applies to the government's collection of foreign intelligence is unclear. In a 1972 case, the Supreme Court invalidated warrantless electronic surveillance of domestic organizations on Fourth Amendment grounds, despite the government's assertion of a national security rationale. However, it indicated that its conclusion might be different in a future case involving the electronic surveillance of foreign powers or their agents, within or outside the United States. In a 2002 case, the Foreign Intelligence Surveillance Court of Review upheld FISA, as amended by the USA PATRIOT Act, against a Fourth Amendment challenge. The court assumed, without deciding the question, that FISA court orders do not constitute warrants for purposes of the Fourth Amendment analysis. Relying on a general reasonableness analysis, it nonetheless upheld such orders, emphasizing both the privacy protections in the statutory framework and the governmental interest in preventing national security threats.

Procedure for Targeting Non-U.S. Persons Abroad Without Individualized Court Orders Under Section 702

In late 2005, the New York Times reported that the federal government had "monitored the international telephone calls and international e-mail messages of hundreds, perhaps thousands, of people in the United States without warrants." Subsequently, President George W. Bush acknowledged that, after the attacks of September 11, 2001, he had authorized the National Security Agency to conduct a Terrorist Surveillance Program (TSP) to "intercept international communications into and out of the United States" by "persons linked to al Qaeda or related terrorist organizations" based upon his asserted "constitutional authority to conduct warrantless wartime electronic surveillance of the enemy." Now discontinued, the TSP appears to have been active from shortly after September 11, 2001, to January of 2007.

After the TSP activities were concluded in 2007, Congress enacted the Protect America Act (PAA), which established a mechanism for the acquisition, via a joint certification by the Director of National Intelligence (DNI) and the Attorney General (AG), but without an individualized court order, of foreign intelligence information concerning a person reasonably believed to be outside the United States. This temporary authority ultimately expired after approximately six months, on February 16, 2008. Several months later, the Congress enacted the FISA Amendments Act of 2008, which created separate procedures for targeting non-U.S. persons and U.S. persons reasonably believed to be outside the United States under a new Title VII of FISA. Section 702 provides procedures for targeting non-U.S. persons and is discussed in more detail below.

Scope of Acquisitions

Like its predecessor in the PAA, Section 702 permits the AG and the DNI to jointly authorize targeting of persons reasonably believed to be located outside the United States, but is limited to targeting non-U.S. persons. Once authorized, such acquisitions may last for periods of up to one year. Under subsection 702(b) of FISA, such an acquisition is also subject to several limitations. Specifically, an acquisition

may not intentionally target any person known at the time of acquisition to be located in the United States; may not intentionally target a person reasonably believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States; may not intentionally target a U.S. person reasonably believed to be located outside the United States; may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States; and must be conducted in a manner consistent with the Fourth Amendment to the Constitution of the United States.

Acquisitions under Section 702 are also geared towards electronic communications or electronically stored information. This is because the certification supporting the acquisition, discussed in the next section, requires the AG and DNI to attest that, among other things, the acquisition involves obtaining information from or with the assistance of an electronic communication service provider. This would appear to encompass acquisitions using methods such as wiretaps or intercepting digital communications, but may also include accessing stored communications or other data. Such a conclusion is also bolstered by the fact that the minimization procedures required to be developed under Section 702 reference the minimization standards applicable to physical searches under Title III of FISA.

Certification Procedure

Section 702 requires the joint AG/DNI authorization to be predicated on either the existence of a court order approving of a joint certification submitted by the AG and DNI, or a determination by the two officials that exigent circumstances exist.

The certification is not required to identify the individuals at whom such acquisitions would be directed, but must attest, in part, that targeting procedures are in place that have been approved, have been submitted for approval, or will be submitted with the certification for approval by the FISC that are reasonably designed to ensure that an acquisition is limited to targeting persons reasonably believed to be located outside the United States, and to prevent the intentional acquisition of any communication where the sender and all intended recipients are known at the time of the acquisition to be located in the United States. The applicable targeting and minimization procedures are subject to judicial review by the FISC, but the court is not required to look behind the assertions made in the certification.

Generally, if the certification and targeting and minimization procedures meet the statutory requirements and are consistent with the Fourth Amendment, a FISC order approving them will be issued prior to implementation of the acquisition of the communications at issue. If the FISC finds deficiencies in the certification, targeting procedures, or minimization procedures, the court shall issue an order directing the government to, at the government's election and to the extent required by the court's order, correct any such deficiency within 30 days or cease, or not begin, the implementation of the authorization for which the certification was submitted.

Exigent Circumstances

In the absence of a court order described above, the AG and DNI may also authorize the targeting of persons reasonably believed to be non-U.S. persons abroad if they determine that exigent circumstances exist which would cause the loss or delay of important national security intelligence. A certification supporting such acquisition is required to be submitted to the FISC as soon as practicable, but no later than seven days after the determination of exigency has been made. Collection of information is permitted during the period before a certification is submitted to the FISC.

Comparison with Prior Law

As discussed above, surveillance activities that meet the definition of electronic surveillance in FISA must be authorized either under FISA or ECPA. Prior to the enactment of Section 702, FISA only permitted sustained electronic surveillance or access to electronically stored communications after the issuance of a court order that was specific to the target. Since Section 702 does not require an individualized court order, the most dramatic effect of its enactment compared to the traditional provisions of FISA has been in those situations in which Section 702 encompasses activities that qualify as electronic surveillance.

FISA defines several different categories of electronic surveillance, but only two are relevant to Section 702. The first is the acquisition, in the United States, of international wire communications, which are defined by FISA as communications where one endpoint of the captured communication is in the United States. Consequently, Section 702 provides a mechanism for the domestic acquisition, without a court order, of communications that persons in the United States, including citizens, would be a party to. Prior to the enactment of Section 702, such acquisitions would require a court order in all but emergency situations.

The second category of electronic surveillance to which Section 702 is applicable is the installation or use of an electronic, mechanical, or other surveillance device in the United States to acquire information, other than from a wire or radio communication, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes. Examples of such surveillance would include things such as hidden microphones and may also include access to stored communications. Section 702 may also permit access to electronically stored communication that does not qualify as electronic surveillance through the use of physical searches, so long as the information is acquired from or with the assistance of an electronic communication service provider. As with interception of international wire communications, such examples of electronic surveillance or access to stored communications would likely have required an individualized court order under FISA as it existed prior to Section 702.

Legal Challenges

Upon enactment of Title VII, a number of organizations brought suit challenging the joint authorization procedure for surveillance of non-U.S. persons reasonably believed to be abroad. The suit alleged that this authority violated the Fourth Amendment's prohibition against unreasonable searches. In order to establish legal standing to challenge Title VII, the plaintiffs had argued that the financial costs they incurred in order to avoid their reasonable fear of being subject to surveillance constituted a legally cognizable injury. However, on February 26, 2013, in Clapper v. Amnesty International , the United States Supreme Court held that the plaintiffs had not suffered a sufficiently concrete injury to have legal standing to challenge Title VII. Because the Court had no jurisdiction to proceed to the merits of the plaintiffs' claims, it did not decide the Fourth Amendment question.

Procedures for Targeting U.S. Persons Abroad Using Court Orders Under Sections 703 and 704

As discussed above, the FISA Amendments Act created separate procedures for targeting non-U.S. persons and U.S. persons reasonably believed to be outside the United States. Sections 703 and 704, discussed in more detail below, address the targeting of U.S. persons abroad for electronic surveillance and other types of acquisitions.

Requirement for Court Order

As an initial matter, Section 704(a)(2) prohibits the intelligence community from targeting a U.S. person who is reasonably believed to be abroad unless authorized by the FISC or another provision of FISA. This prohibition only applies in circumstances where the target has a reasonable expectation of privacy and a warrant would be required if the acquisition was conducted in the United States for law enforcement purposes. Whether a "reasonable expectation of privacy" exists depends upon whether an "individual manifested a subjective expectation of privacy in [a] searched object" and whether "society is willing to recognize that expectation as reasonable." Although such a determination is inherently dependent upon the particular circumstances in a given case, it is likely that activities like physical searches and wiretaps conducted on foreign soil would require authorization from the FISC based on the target's "reasonable expectation of privacy."

Scope of Acquisitions

Having made the procedures of FISA compulsory in many foreign intelligence acquisitions in which U.S. persons abroad are targeted, Sections 703 and 704 then each establish procedures to provide the requisite FISC orders authorizing such acquisitions. The procedures under Section 703 apply only to electronic surveillance or the acquisition of stored electronic communications or data that would traditionally require an order under FISA. The procedures under Section 704 apply in all other situations where the target has a reasonable expectation of privacy and a warrant would be required if the acquisition was conducted in the United States for law enforcement purposes. However, because the requirements of Section 704 are less stringent than Section 703, the statute prohibits the use of the former when the procedures of the latter would apply.

Procedures

The judicial procedures under Sections 703 and 704 generally follow the same structure used by the procedures that already existed in FISA to obtain a court order authorizing electronic surveillance or physical searches of U.S. persons within the United States. The government must submit an application for surveillance that identifies the target and the facts and circumstances relied upon that would justify the belief that the target is a foreign power or an agent of a foreign power, which the FISC must find to be supported by probable cause. Because Title VII is intended to address targets that are outside of the United States, the court must also find that probable cause to believe that this geographical limitation has been met.

Both Sections 703 and 704 also provide authority for short-term acquisitions if the AG reasonably determines that an emergency situation exists and there is insufficient time to obtain a court order. Such emergency acquisitions must be followed up with a formal application within seven days.

Comparison of Sections 703 and 704

Although they are similar, the procedures under Sections 703 and 704 are not identical to each other. Less specificity is generally required of the information in the application submitted under Section 704. Section 704 also does not require a statement that the information sought cannot be obtained by normal investigative means. Section 704 also only requires the minimization procedures to address dissemination of acquired information. In contrast, Section 703 also requires the minimization procedures to address the acquisition and retention of information.

Comparison with Prior Law

In at least two important ways, the standard that must be met under Sections 703 and 704 before the FISC will issue an order authorizing an acquisition is less stringent than the standard that has been traditionally required under FISA.

First, FISA traditionally required an application to identify the facilities that will be searched or subject to electronic surveillance, and to demonstrate that those facilities are being used, or are about to be used, by the target. Second, FISA traditionally only permitted U.S. persons to be targeted if they are also linked to international terrorism or clandestine intelligence activities. Neither of these is required under Section 703 or Section 704.

Because all electronic surveillance was subject to FISA's standards under prior law, and Section 703 only applies to stored data if FISA would have traditionally required an order, it may be fair to characterize Section 703 simply as a relaxation of FISA's requirements when the target is a U.S. person abroad.

However, the situation is different when considering the effect of Section 704 on prior law. The general prohibition embodied in Section 704 requiring a court order supported by probable cause when targeting U.S. persons abroad expands the scope of FISA to areas that were previously beyond its scope. For example, targeting the international communications of a U.S. person located abroad was generally not considered electronic surveillance if the acquisition did not occur on U.S. soil. Therefore, while no court order would have been traditionally required under FISA, the addition of Section 704 brings that conduct within the ambit of the statute.

Sunset

On December 30, 2012, President Obama signed H.R. 5949 , the FISA Amendments Act Reauthorization Act of 2012, which extends Title VII of FISA until December 31, 2017. Absent intervening legislation, Title VII of FISA will be automatically repealed on that date. Transition procedures would apply to orders authorizing surveillance activities pursuant to Title VII that are in effect on December 31, 2017, and would permit the continued effect of such orders until their normal expiration dates.