September 30, 2015

NSA's Legal Authorities

(Updated: December 8, 2022)

Since the start of the Snowden-revelations, we not only learned about the various collection programs and systems of the National Security Agency (NSA), but also about the various legal authorities under which the agency collects Signals Intelligence (SIGINT).

Bceause these rules are rather complex, the following overview will show which laws and regulations govern the operations of the NSA, showing what they are allowed to collect where and under which conditions. Also mentioned are various collection programs that run under these authorities.

The overview provides a general impression of the most important elements of the various laws and regulations and does not pretend to be complete in every detail. For example, provisions for emergency collection are not included. Also, some of these laws and regulations govern the work of other US intelligence agencies too, but here the focus is on the NSA.







Diagram with a decision tree showing the various legal authorities
under which NSA can collect Signals Intelligence (SIGINT)
(Click to enlarge)



 Inside the US - Targeted collection - US persons 
 

Section 105 FISA

- Effective since October 25, 1978.
- For communications of US citizens and foreigners, whether through a "facility" or individually, inside the US, for which there's a probable cause that they are agents of a foreign power or connected to an international terrorist group. Initially also for foreigners outside the US using an American webmail provider.
- Collection takes place at telephone and internet backbone switches, wireless networks, Internet Service Providers and data centers at over 70 locations inside the United States.
- Requires an individualized warrant from the FISA Court (which takes between four and six weeks), but if no US person will likely be overheard, only a certification by the Attorney General is required.
- Collection programs: BLARNEY, COWBOY (under FAIRVIEW), PERFECTSTORM (under STORMBREW)
 

Section 703 FISA Amendments Act (FAA)

- Effective since July 10, 2008; expires on December 31, 2017.
- For communications of a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court.
- Collection takes place inside the United States (see Section 105 FISA).
- In practice, NSA apparently uses section 704 instead of 703 for collection against US persons overseas.



 Inside the US - Targeted collection - Foreigners 
 

Transit Authority

- Effective since 1988.*
- Based upon an extra measure contained in EO 12333.
- For the content and metadata of communications with both ends foreign: originating and terminating in foreign countries, but transiting US territory.
- Collection takes place inside the US, at major fiber-optic cables and switches operated by American telecommunication providers.
- Data may apparently be shared with other US intelligence agencies.
- Collection programs: FAIRVIEW, STORMBREW, SILVERZEPHYR (under OAKSTAR), ORANGEBLOSSOM (under OAKSTAR)

 

Section 702 FISA Amendments Act (FAA)

- Effective since July 10, 2008; expired on December 31, 2017, but was reauthorized in January 2018 for another 6 years, which is until the end of 2023.
- For communications to or from foreigners who are reasonably believed to be outside the United States.
- Requires an annual certification by the Attorney General (AG) and the Director of National Intelligence (DNI), which has to be approved by the FISA Court. Certifications are known that have been approved for:

- Counter-Terrorism (CT, since 2007)
- Foreign Government (FG, since 2008; including some cyber threats since 2012)
- Counter-Proliferation (CP, since 2009)
- Cyber Threats (planned in 2012)*


- Companies get a directive ordering them to cooperate. In return they are granted legal immunity and are compensated for reasonable expenses.
- Dissemination rules differ slightly per certification. Ordinarily, US person identifiers have to be masked, but unevaluated data may be shared with FBI and CIA, and foreign data may be shared with the 5 Eyes partners.
- Unencrypted data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director.

Section 702 FAA has two components, each with slightly different rules:
 

Downstream Collection (PRISM)
- Only internet communications "to" and "from" specific e-mail addresses or other types of identifiers. Filtering only allowed for selectors, not for keywords.
- Collection is done by the FBI's DITU, which acquires the data from at least 9 major American internet companies. This results in both stored and future communications.
- Raw (unminimized) data may be shared with FBI and CIA.
- Data are retained for a maximum of 5 years.
- NSA is permitted to use US person identifiers for querying already-collected data when there's a reasonable expectation that this will return foreign intelligence.*
- Collection program: PRISM

 
Upstream Collection
- Both internet and telephone communications. The internet communications may be "to", "from" and "about" specific e-mail addresses or other types of identifiers, including IP addresses and cyber threat signatures. The "about" collection of one end foreign e-mails and texts was halted on April 28, 2017 as this pulled in purely domestic e-mails as well.
- Collection takes place inside the US, at major telephone and internet backbone switches. This only results in future communications.
- Raw (unminimized) data may not be shared outside NSA.
- Data are retained for a maximum of 2 years.
- Collection programs: FAIRVIEW, STORMBREW



 Inside the US - Bulk collection - US persons 
 

Section 402 FISA (PR/TT)

- Effective since October 25, 1978.
- Since July 14, 2004, orders from the FISA Court allowed the NSA to collect domestic internet metadata in bulk under this authority. These metadata included the "to", "from", and "cc" lines of an e-mail, as well as the e-mail’s time and date.
- Only for Counter-Terrorism purposes.
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Query results could only be accessed by specially trained NSA analysts, and could only be shared for a counter-terrorism purpose.
- Data were being retained for a maximum of 5 years.
- Collection terminated in December 2011 for "operational and resource reasons" and all data were deleted, as the requirements could also be fulfilled under 702 FAA and SPCMA authorities.*
- Collection programs: FAIRVIEW

 

Section 215 USA PATRIOT Act (BR-FISA)

- Effective since October 26, 2001; expired as of May 31, 2015.
- Since 2006, orders from the FISA Court allowed the NSA to collect domestic telephone metadata in bulk under this authority. These metadata included the originating and receiving phone number, the date, time and duration of the call, and, since 2008, the IMEI and IMSI number.
- Only for Counter-Terrorism purposes: there must be a Reasonable and Articulable Suspicion (RAS) that the query term belongs to a foreign terrorist organization. The Emphatic Access Restriction (EAR) tool ensured that analysts only did queries on RAS-approved selectors.*
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Query results could only be accessed by specially trained NSA analysts, and could only be shared when a manager certifies the data are for a counter-terrorism purpose.
- Data were retained for a maximum of 5 years. Remaining data will be deleted after receiving direction from the appropriate court.
- Collection programs: FAIRVIEW, STORMBREW


During a 180-day transition period, the NSA continued the collection of bulk telephony metadata under section 215 USA PATRIOT Act, which was until November 29, 2015. In this period, telephony metadata could only be queried after a judicial finding that there is a Reasonable, Articulable Suspicion (RAS) that the selector is associated with an international terrorist group. The results had to be limited to metadata within 2 (instead of 3) hops of the seed term.
 

USA FREEDOM Act (USAFA or UFA)

- Effective since June 2, 2015, expires on March 15, 2020.
- Allows the NSA to request metadata from telephone companies based upon specific selection terms for which there's a Reasonable, Articulable Suspicion (RAS) that they are associated with a foreign power or an international terrorist group. These metadata may consist of "session-identifying information", like originating and receiving numbers, IMSI, IMEI and telephone calling card numbers, and the date, time and duration of the call. Collection of, and contact chaining on location data is prohibited.
- Requires a warrant from the FISA Court approving specific telephone numbers or other identifying selectors.
- NSA provides these selectors to the telecommunication providers, who have to produce the results of their queries (one or two hops from the initial selector) in a useful format, on a daily basis, and for a period of up to 180 days.
- Companies providing these data are granted legal immunity and will be compensated for reasonable expenses.
- All records that are not foreign intelligence information have to be destroyed promptly.
- Query results may be fully shared with CIA and FBI.
- Also, foreign terrorists may be tracked for up to 72 hours when they enter the US, with authorization by the Attorney General.
- In the Summer of 2019, the NSA suspended the program and subsequently deleted all the data collected under this authority.



 Outside the US - Targeted collection - US persons 
 

Section 704 & 705 FISA Amendments Act (FAA)

- Effective since July 10, 2008; expires on December 31, 2017.
- Collection takes place outside the United States.
- Data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director. Inadvertent collection of US data has to be destroyed upon recognition, but the Attorny General can authorize exceptions.

The differences for these sections are:


Section 704 FAA
- For collection against a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court, for a period of up to 90 days.
 

Section 705(a) FAA
- For communications of a US person reasonably believed to be outside the United States.
- Requires an individualized warrant from the FISA Court.
- Collection may take place both inside and outside the United States.


Section 705(b) FAA
- For communications of a US person reasonably believed to be outside the US, when there is already an existing FISA Court order for collection against this person inside the US under section 105 FISA.
- Requires authorization by the Attorney General.



 Outside the US - Targeted & Bulk collection - Foreigners
 

Executive Order 12333

- Effective since December 4, 1981.
- For communications between foreigners outside the US.
- Requires no external approvals, except for fitting NSA's mission as set by the US government and prioritized by the National SIGINT Committee.
- Collection takes place outside the US and for all foreign intelligence purposes. However, Presidential Policy Directive 28 (PPD-28) from January 17, 2014, limits bulk collection to the following 6 purposes:
- Espionage and other threats by foreign powers
- Threats from terrorism
- Threats from weapons of mass destruction
- Cybersecurity threats
- Threats to US or allied armed forces
- Threats from transnational crime
- Data may be shared with other US intelligence agencies, as well as with foreign partner agencies.
- Dissemination of US person identifiers is only allowed when necessary and personal information should not be inappropriately included in intelligence reports.
- Unencrypted data from targeted collection are retained for up to 5 years, unless it is determined that continued retention is required; encrypted data are retained for an unlimited period of time.
- Any incidentally collected communications have to be deleted after five years, unless they meet a number of exceptions.*
- Collection programs: OAKSTAR, WINDSTOP (incl. INCENSER, MUSCULAR, etc), RAMPART-A (incl. SPINNERET, MOONLIGHTPATH, AZUREPHOENIX, etc), DANCINGOASIS, MYSTIC, and many more.

Under EO 12333, there are several additional authorizations:
 

Classified Annex Authority (CAA)
- Effective since 1988.
- For communications of US persons outside the US, for whom there's probable cause that they are agents of a foreign power or engaged in international terrorism.
- Requires prior approval by the Attorney General, limited to a period of time of up to 90 days.
- Also for communications of a US person who is held captive by a foreign power or a terrorist group, which requires approval of the Director of NSA.
 

Special Procedures governing Communications Metadata Analysis (SPCMA)
- Effective since January 2011
- Allows contact chaining and other analysis on metadata already-collected under EO 12333, regardless of nationality and location, including US person identifiers.
- For the purpose of following or discovering valid foreign intelligence targets (i.e. not restricted to counter-terrorism).
- Only covers analytic procedures and does not affect existing collection, retention or dissemination (including minimization) procedures for US person information.
- SPCMA-enabled tools: ICREACH, Synapse Workbench, CHALKFUN
 

Raw SIGINT Availability Procedures
- Effective since January 2017
- Allows other US intelligence agencies to request access to content and metadata of US persons from already-collected raw SIGINT data sets from the NSA.
- Only for foreign intelligence or counterintelligence purposes and the requesting agencies may not use selectors or key word queries that will result in domestic communications (contact-chaining is not limited).
- In general, raw SIGINT obtained in this way may be retained for up to 5 years, but foreign communications may be retained permanently if US person information is minimized. Domestic communications have to be destroyed promptly upon recognition, except when they provide significant intelligence value. Further dissemination is only allowed after approval by NSA.
- Sharing tools: ICREACH



                         Information Assurance                        


Besides collecting Signals Intelligence (SIGINT), the NSA is also responsible for Information Assurance (IA). The latter mission is conducted under the following legal authorities:

National Security Directive 42
("National Policy for the Security of National Security Telecommunications and Information Systems", 1990)

Executive Order 13587
("Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information", 2011)




                  Computer Network Operations                   


The latest field in which the NSA is operating, Computer Network Operations (CNO), better known as hacking, is not governed by new legal authorities. Instead, the existing authorities for SIGINT and IA are used, ideally in a more effective way to "take advantage of the same expertise (analytical and technical) that is used to defend and exploit".*


- . - . - . - . - . - . - . - . -


Links and sources
- NSA OGC presentation: CNO Legal Authorities
- Paper by Mark M. Jaycox: No Oversight, No Limits, No Worries: A Primer on Presidential Spying and Executive Order 12,333 (2019)
- Emptywheel.net: 12333 info sharing working thread
- The New York Times: N.S.A. Gets More Latitude to Share Intercepted Communications
- Emptywheel.net: The Yahoo Scan: On Facilities and FISA
- Emptywheel.net: While It Is Reauthorizing FISA Amendments Act, Congress Should Reform Section 704
- IC on the Record: FACT SHEET: Implementation of the USA FREEDOM Act of 2015
- Emptywheel.net: Internet Dragnet Timeline - Phone Dragnet Timeline - 10 Goodies USA Freedom Act Gives the Intelligence Community
- Webpolicy.org: Executive Order 12333 on American Soil, and Other Tales from the FISA Frontier
- IC on the Record: Transition from the USA PATRIOT Act to the USA FREEDOM Act
- DNI.gov: Documents Regarding the Now-Discontinued NSA Bulk Electronic Communications Metadata
- Americanbar.org: Section 214 and Section 215 FISA
- National Research Council: Bulk Collection of Signals Intelligence: Technical Options (pdf) (2015)
- NSA Civil Liberties and Privacy Report about Targeted SIGINT Activities under EO 12333 (pdf) (2014)
- Privacy and Civil Liberties Oversight Board report about the Surveillance Program Operated Persuant to Section 702 FISA (pdf) (2014)
- Legal fact sheet: Executive Order 12333 (pdf) (2013)
- The Department of Defense Directive about NSA/CSS (pdf) (2010)
- NSA OGC: Course on legal compliance and minimization procedures (pdf)
- Memo about Reauthorization of the FISA Amendments Act (pdf)
- NSA OGC: FISA Amendments Act of 2008 - Section 702 - Summary Document (pdf)

No comments:

In Dutch: Meer over het wetsvoorstel voor de Tijdelijke wet cyberoperaties