The FISA Reauthorization Should Codify Safeguards for Non-U.S. Persons

When the news stories broke about the leaks by Edward Snowden in the summer of 2013, I was serving my first days as the acting secretary at the Department of Commerce, where the functions include sustaining the free flow of information across borders. The second day’s stories in the Washington Post and the Guardian were about the PRISM program—the collection of information from international electronic communications traffic conducted under Section 702 of the Foreign Intelligence Surveillance Act (FISA). I knew right away our work on data flows was in trouble.

For the third time since then, Title VII of the FISA, which includes Section 702, is up for congressional reauthorization, or it will expire on Dec. 31 of this year. The FISA was enacted in 1978 in reaction to congressional investigations and litigation about U.S. government surveillance of Americans. It establishes safeguards for “U.S. persons,” those inside U.S. boundaries as well as U.S. citizens and resident aliens outside those boundaries. Section 702, by its terms “targeting certain persons outside the United States other than United States persons,” was added to the FISA as a new Title VII in 2008 in the wake of President George W. Bush’s controversial warrantless President’s Terrorist Surveillance Program, to provide legal authority, oversight, and safeguards for surveillance of non-U.S. persons in light of the significant expansion of the reach of communication technology. It was reauthorized in 2015 and again in 2018.   

The current reauthorization debate focuses primarily on increasing protections for U.S. persons whose information is incidentally captured in the communications collected under Section 702. Some additional protections for the use and dissemination of this information are in order, something advocated on both sides of the spectrum for different reasons.

In this piece, though, I focus instead on safeguards for non-U.S. persons to codify changes in U.S. surveillance law and practices that began with the response to the Snowden leaks in 2013. I previously advocated in Lawfare for the codification of President Biden’s Executive Order 14086, which placed more precise boundaries on the meaning of “foreign intelligence” under the FISA and added predicates and procedures for collection as well as a novel administrative review process for non-U.S. persons in certain countries. The Privacy and Civil Liberties Oversight Board, as well as a coalition of advocacy groups, have made similar recommendations. In this article, I provide a road map for carrying out these suggestions.

The International Reaction to Section 702

Those second-day news stories about the PRISM program reported that the National Security Agency (NSA) was “tapping directly into the central servers of nine leading U.S. Internet companies,” accompanied by an NSA slide containing the logo of each company mentioned. The reporting about direct access to the servers of these companies was inaccurate and was clarified a few days later. Even so, I knew from my engagement with European counterparts that the story would feed a perception abroad that the NSA had a fire hose gathering all emails, text messages, and other electronic communications to the United States. Sure enough, the story set off a firestorm abroad that soon jeopardized transatlantic data flows.

Such perceptions of the reach of U.S. surveillance and the scope of collection under Section 702 are vastly exaggerated. But it is correct that the Fourth Amendment does not protect foreign nationals outside the borders of the United States. The FISA’s protection of these non-U.S. persons is only a by-product of the safeguards in place to protect U.S. persons—which require the government to define the legitimate purposes of foreign intelligence surveillance, mandate meaningful procedural steps in the surveillance approval process, detail specifications for data minimization and retention, and differentiate between U.S. and non-U.S. persons only once collected information is queried. This difference in safeguards undermines trust in the U.S. rule of law, American companies, and the stability of data flows between the European Union and the United States.

These doubts are obvious from the two decisions by the Court of Justice of the European Union (CJEU) that have invalidated decisions by the European Commission to allow such data flows under frameworks deemed “adequate” under EU data protection laws. On the basis of a record that contained only a bare allegation on the heels of the Snowden leaks that U.S. surveillance was “mass and undifferentiated,” the first judgment faulted the commission’s first adequacy decision for failing to consider U.S. surveillance safeguards and assess whether they provided EU residents with protections essentially equivalent to those under EU law. 

The second case, decided in 2020, presented a new adequacy decision that was based on the commission’s review of U.S. surveillance law. The case also followed significant changes that had been made to U.S. law and surveillance procedures in response to the Snowden affair. President Obama issued Presidential Policy Directive 28 (PPD-28) in 2014, which explicitly extended safeguards and remedies to non-U.S. persons. In 2015, Congress amended the FISA to codify many of the procedures adopted in the wake of the Snowden stories and PPD-28 to declassify FISA Court opinions and provide for reports on surveillance by the attorney general, director of national intelligence, and providers of communications. The CJEU, however, found that the FISA goes beyond “what is necessary in a democratic society,” while providing little description as to the meaning behind the “in a democratic society” benchmark. 

Since then, the U.S. has done even more to extend protection to non-U.S. persons. President Biden’s 2022 Executive Order 14086 extends protections provided to American citizens to non-U.S. persons by treating their data “in the same manner that [they would] comparable information concerning United States persons.” This order enabled a new Data Privacy Framework arrived at a year ago. The U.S. commitments for protections of personal information and remedies for both the commercial sector and government access provided the foundation for a European Commission decision on July 10, 2023, deeming U.S. safeguards “adequate” for purposes of EU data protection law. 

Giving “the Quality of Law” to Protection of non-U.S. persons

Congress has the opportunity to address this jeopardy in the reauthorization of the FISA. Codification of certain safeguards adopted in Executive Order 14086 would obviate doubts about the durability or force of the changes to intelligence community practices made by the executive order. Furthermore, incorporating the safeguards into law would advance emerging norms on government access in a digitized world that functions on instantaneous transmission of terabytes of rich information. It is in the interest of the U.S. and other open and democratic societies and economies that this transmission be trusted and safe everywhere.  

In fact, the U.S. has been the global leader in establishing protections for the data of people outside its borders. PPD-28 was the first time any nation has done so expressly. Subsequently, a few other countries have moved toward this norm: The German Constitutional Court has interpreted Germany’s constitution as applying to subjects of surveillance outside the country, and the Netherlands provides the same protections to everyone. The U.S. has been in the vanguard when it comes to transparency about its intelligence collection, a process precipitated by the Snowden revelations and then formalized in PPD-28 and 2015 amendments to the FISA and reinforced by Executive Order 14086. The U.S. was also a significant actor in developing the 2022 Organization for Economic Cooperation and Development (OECD) Declaration on Government Access to Personal Data Held by Private Sector Entities, a set of principles and safeguards agreed to by the 38 OECD member states. 

Thus, rather than a concession to Europeans, updating Section 702 would affirm a U.S strength. As the U.S. seeks to build a new rules-based international order in concert with democratic allies, codification of norms on government access to information worldwide would underscore U.S. leadership and draw a strong contrast with China’s surveillance state.

It would not be the first time Congress has acted to update norms for foreign intelligence surveillance for the modern era. As noted above, Section 702 originated as a response to the global reach of surveillance and post-Sept. 11 overreach, and then Congress expanded oversight and transparency (Title VI) to codify post-Snowden practices. Codifying aspects of Executive Order 14086 would be a similar update. A few key steps would do much to embed essential aspects of the executive order in the statute.

First and foremost, in line with the recent recommendation of the PCLOB that “Congress should codify the twelve legitimate objectives for signals intelligence collection under Executive Order 14086,” incorporating these objectives into the definition of “foreign intelligence information” (18 U.S.C. § 1801) would have a broad effect on the operation of Section 702. This term shapes the scope of authority to acquire intelligence (50 U.S.C.§ 1802(a)(1)); the showing required to obtain court authorization (50 U.S.C.§ 1804(a)); the objectives of minimization procedures that the attorney general is required to adopt (50 U.S.C.§ 1801(h); and Foreign Intelligence Surveillance Court (FISC) oversight of minimization (50 U.S.C. § 1881a(h),(j)). The effect of these provisions would be reinforced by adding the acquisition of foreign intelligence information to the requirements for targeting procedures under Section 702 (50 U.S.C. § 1881a(d)(1)). In its 2023 report, the PCLOB submits that codification of the overarching purposes in Executive Order 14086 would reinforce FISC and PCLOB oversight by providing explicit authority to review compliance with regard to non-U.S. persons.  

In addition to the purposes, the definition of foreign intelligence information should incorporate the more specific objectives that Section 2(c)(ii)(B) of the executive order applies to “bulk collection.” Moreover, Executive Order 14086 contains a reservation of authority for the president to add to the list based on “new national security imperatives,” such as emerging threats; these will be disclosed unless that presents a national security risk. Since this reservation involves the exercise of presidential national security authority, Congress’s power to legislate may be limited, but it could add a provision for reporting undisclosed changes to congressional intelligence committees, as done elsewhere in the FISA. A coalition of privacy and civil liberties groups has called for “reasonable limits on the scope of surveillance” as part of reauthorization. Those limits should avoid tinkering with the language of Executive Order 14086. That language has been fully litigated in the interagency process that led up to the executive order and subsequently reflected in the internal regulations and procedures of the intelligence community and law enforcement agencies. 

It has also been reviewed at length by the European Commission and required review by the European Council and European Data Protection Board prior to adoption of the commission’s adequacy decision. More than 2,500 U.S. and EU companies have certified their compliance with the framework. An untold number of others conduct EU-U.S. data transfers on the basis of contract clauses, or “binding corporate rules,” that, under EU data protection laws, require assessments of the risk that the data will be subject to U.S. surveillance. While the executive order would remain binding on federal agencies as long as it remains in effect, significant variance from the executive order language could introduce some uncertainty into these data transfer arrangements. That would significantly undermine the benefits of codification, and Congress should be mindful of this pitfall.

Second, reauthorization should incorporate the other most significant language in the executive order, the declaration that signals intelligence activities shall be conducted only to the extent and in a manner that is proportionate to the validated intelligence priority for which they have been authorized, with the aim of achieving a proper balance between the importance of the validated intelligence priority being advanced and the impact on the privacy and civil liberties of all persons, regardless of their nationality or wherever they might reside.