Case: In re DNI/AG 702(h) Certification 2024-A and Its Predecessor Certifications [FISC Dockets 702(j)-24-01; 702(j)-24-02; 702(j)-24-03]

Background

Section 702 of the Foreign Intelligence Surveillance Act (FISA) Amendments Act of 2008, 50 U.S.C. § 1881a, permits the Attorney General (AG) and the Director of National Intelligence (DNI) to conduct foreign intelligence surveillance targeting the communications of non-U.S. persons located abroad. The government need not establish probable cause that the target of electronic surveillance is a foreign power or agent of a foreign power, nor must the government specify the nature and location of the facilities or places that surveillance will occur. Communications of U.S. citizens and residents are frequently collected "incidentally" if those U.S. persons are communicating with or about a targeted foreigner.

Section 702 requires that the AG, through the Department of Justice (DOJ), and DNI, through the Office of the Director of National Intelligence (ODNI), submit annual “certifications” that define the categories of foreign actors that may be appropriately targeted. By law, these certifications must include specific targeting and minimization procedures adopted by the AG in consultation with the DNI. These certifications must be approved by the Foreign Intelligence Surveillance Court (FISC) before Section 702 surveillance may be conducted. For a more in-depth overview of the certification process, see In re DNI/AG 702(i) Certification 2008. For the previous year’s certification, see In re DNI/AG 702(h) Certification 2023-A and Its Predecessor Certifications [FISC Docket 702(j)-23-01; 702(j)-23-02; 702(j)-23-03].

This entry summarizes the 2024 certification, which was assigned to Judge Anthony J. Trenga of the FISC. The government submitted its request for certifications on March 5, 2024, and the court approved the request on April 4, 2024.

Review of Written Procedures

First, the Court reviewed the targeting procedures to determine whether they were they were reasonably designed to ensure that acquired data was limited to persons “reasonably believed to be located outside the US.” The Court reviewed both NSA and FBI targeting procedures, and determined that both sets of procedures were identical to ones proposed and approved in the 2023 Certification, and were therefore consistent with statutory requirements under FISA. 

Second, the Court considered minimization procedures, which aim to minimize the acquisition, retention, and subsequent dissemination of nonpublic information without consent, and within certain guidelines. These definitions apply to electronic surveillance and physical search, and focus on protecting US persons’ data, as Section 702 information may only target persons reasonably believed to be non-US persons located outside the US. The Court noted, however, that the large number of Section 702 facilities “suggests that, despite … limits on acquisition, large amounts of private U.S.-person information are likely to be acquired under Section 702.” The Court reviewed the minimization procedures of the four agencies (FBI, NSA, CIA, and National Counterterrorism Center), and determined that they were identical to the ones submitted and approved by the Court in 2023, and therefore satisfied the definition of minimization procedures.

Finally, the Court reviewed the querying procedures, which aim to limit queries of unminimized data to those that are “reasonably likely to retrieve foreign intelligence information,” or, for the FBI, “evidence of a crime.” The FBI’s 2024 querying procedures modified previous 2023 querying procedures by requiring users to enter a “written statement of the specific factual basis to believe that the query is reasonably likely to retrieve foreign intelligence information or evidence of a crime” before querying. While the provision is more stringent than the previous provision (which only required the statement to review or access information after the querying), the Court noted that, since the FBI already required users to enter the statement pre-query in late 2023, the modified procedure effectively codified existing practice. The FBI had also modified 2024 querying procedures to require prior approval for three categories of queries with heightened privacy concerns. In particular, the new procedures require approval from an FBI attorney before conducting any batch queries (i.e. compilations of multiple queries at the same time in one "batch"). At the same time, the batch querying tool was reconfigured to require users to indicate compliance with the policy before running a batch query. The Court noted that both policies were likely to improve compliance with the querying standard and enhance privacy protection for US persons.

The Court concluded that the 2024 targeting, minimization, and querying procedures of the submitted certifications were identical to, or improved upon, earlier procedures. The Court held that they were therefore consistent with FISA's requirements and the Fourth Amendment.

Review of Implementation and Compliance

Next, the Court reviewed the agencies’ implementation and compliance with the written procedures. First, the Court indicated that the CIA had developed "a new capability" meant "to help CIA personnel review large volumes of information efficiently." The details were redacted, but the Court held that this new capability did not qualify as a "query" under FISA, and met statutory and constitutional requirements.

In terms of compliance, the Court noted that certain contexts appear repeatedly in noncompliant queries across field offices, including support of domestic terrorism assessments, criminal investigations without a foreign nexus, and vetting of human sources. It also noted that, while the government has not reported the same level of large-scale, suspicion-less queries which contributed to a finding of deficiency in 2018, there were reports of some FBI personnel repeatedly misapplying the querying standard. The Court noted that the FBI should continue to prioritize proper application of the standard with training and oversight.

Ultimately the Court approved the certification with certain reporting requirements. This case is now closed, and the next certification will occur in 2025.