A guide to FISA §1881a: The law behind it all

Simply put, the National Security Agency is an intelligence agency. Its purpose is to monitor the world's communications, which it traditionally collected by using spy satellites, taps on cables, and placing listening stations around the world.

In 2008, by making changes to U.S. law, the U.S. Congress enabled the NSA to make U.S. industry complicit in its mission. No longer would the NSA have to rely only on international gathering points. It can now go to domestic companies who hold massive amounts of information on foreigners and order them to submit any information of interest to the NSA. This could include the content of communications, documents, photos, videos, or locations and other so-called metadata -- any information held by the companies. No warrant is required -- though there is a secret court review. But that review's primary purpose appears to be to provide assurances that Americans won't be targeted.

Below we carefully analyse the legal framework around these requests. We are grateful to the exceptional work of Caspar Bowden for identifying this issue over two years ago. For a video presentation of his work, go here.

Of particular concern is U.S. law's distinction between foreigners and U.S. citizens or residents -- legally referred to as "U.S. persons." In the U.S., where much of the modern industry of personal information processing exists, constitutional rights only apply to U.S. persons or those on U.S. soil. This divide gives too much latitude to intelligence agencies to use domestic companies as proxies for conducting global surveillance of foreigners.

About the Foreign Intelligence Surveillance Act § 1881a (a.k.a. FISA Amendments Act § 702)

FISA was established in 1978 in response to abuses in domestic intelligence surveillance powers. It has since been amended, most notably in 20081 with the introduction of section 1881a. Section 1881a sets forth the mechanism by which the U.S. government may target "persons reasonably believed to be located outside the United States to acquire foreign intelligence information."2 While section 1881a places certain limitations on that targeting, by and large it is a broad mandate for the U.S. intelligence services to collect a wide array of data from telecoms and Internet service providers regarding anyone who is a non-"United States person" outside the territorial boundaries of the U.S.

Who may be targeted?

The law authorizes surveillance to be used against any individual or group of non-U.S. persons outside of the U.S.

Section 1881a authorizes the targeting of any non-United States persons outside of the United States.3 A "United States person" is defined as a U.S. citizen, a permanent resident, an association that substantially consists of U.S. citizens or permanent residents, or a corporation incorporated in the U.S., so long as the corporation or association is not a "foreign power."4 A "foreign power" is broadly defined to include foreign governments, organizations controlled by foreign governments, factions of foreign nations, groups engaged in international terrorism or international proliferation of weapons of mass destruction (seemingly self-serving, circular provisions), or foreign-based political organizations.

This is not to suggest that information from United States persons may not be obtained via a § 1881a authorization, only that a United States person or a person known to be located in the U.S. may not be "intentionally" targeted.5 And if a communication is at issue, it is fair game as long as at least one of the parties to the communication is outside of the U.S.6

For what purposes can these powers be used?

The law explicitly allows for the collection of foreign intelligence information, a broad category in and of itself, and it also leaves room for other purposes for the authorized surveillance.

The stated purpose of a section 1881a authorization is to allow for the acquisition of "foreign intelligence information,"7 which is defined as:

• information that relates to, and if concerning a United States person is necessary to, the ability of the United States to protect against --
  • actual or potential attach or other grave hostile acts of a foreign power or an agent of a foreign power;
  • sabotage, international terrorism, or the international proliferation of weapons of mass destruction by a foreign power or an agent of a foreign power;
  • clandestine intelligence activities by an intelligence service or network of a foreign power or by an agent of foreign power; or
• information with respect to a foreign power or foreign territory that relates to, and if concerning a United States person is necessary to --
  • the national defense or the security of the United States; or
  • the conduct of the foreign affairs of the United States.

This definition is very broad, and could capture significant political speech, especially under the category of "information with respect to a foreign power or foreign territory that relates to . . . the conduct of the foreign affairs of the United States." It could allow for the monitoring of foreign governments, politicians, civil society organisations, or community leaders.8  At its extreme, entire groups or sections of societies could arguably be targeted so long as they have a political bent and are generating information that relates to the conduct of the foreign affairs of the United States.

Nothing in this language would prevent a directive being issued to a domestic company to submit information on a foreign political organization protesting at a meeting of the G8, the WTO, or against a US-supported foreign government (so long as the protest was not on U.S. soil).

Furthermore, in seeking approval from the Foreign Intelligence Surveillance Court ("FISC"), the U.S. government need only certify that a "significant purpose" of the acquisition is "to obtain foreign intelligence information."9 This means that there may be other purposes for collecting information. In the past the NSA has monitored the conduct of foreign companies.10

From which companies can the government obtain information?

Any telecommunications company or Internet service provider.

A section 1881a acquisition involves "obtaining foreign intelligence information from or with the assistance of an electronic communication service provider."11 An "electronic communication service provider" is, essentially, any telecommunications service or online service provider. The phrase is defined by reference to several other terms that appear in other U.S. laws, such as the Wiretap Act and the Stored Communications Act.12 Of particular significance is the inclusion of the term "remote computing service." A "remote computing service" provides the public with "computer storage or processing services by means of an electronic communications system,"13 and is commonly interpreted as encompassing most major Internet service providers, such as Google, Facebook, Yahoo! And Twitter. An electronic communication service provider may also include cable companies.

Can electronic communication service providers be held liable for disclosing information in response to a § 1881a directive?

No.

Electronic communications service providers cannot be sued "for providing any information, facilities, or assistance in accordance with a directive issued" pursuant to section 1881a.14

What process must the government follow to undertake this surveillance?

The government secretly submits a certification describing the surveillance (at a high level) to the FISC for approval. Once the certification is approved (and sometimes prior to approval), the government can issue a directive for immediate compliance to any electronic communication service provider. The company must immediately provide the Government with all information, facilities, or assistance necessary to accomplish the acquisition of information. No warrant is required, and the main purpose of the certification appears to be to provide assurances that only non-United States persons outside the U.S. will be targeted.

The Attorney General and the Director of National Intelligence ("DNI") have the ability to jointly authorize surveillance pursuant to section 1881a.15 Generally, prior to beginning the surveillance, the Attorney General and DNI must provide a written certification to the FISC.16Where exigent circumstances exist, however, a certification may be submitted after the targeting begins.17

The certification must include a number of elements,18 including assurances

• that only non-U.S. persons outside the U.S. are being targeted,
• that a "significant purpose of the acquisition is to obtain foreign intelligence information," and
• that the information will be obtained "from or with the assistance of an electronic communications service provider."19

Yet, the Attorney General and DNI need not identify the specific premises at which the acquisition will be directed or conducted -- in other words, the specific service provider need not be identified.20

Once presented with the certification, the FISC reviews it to determine if it "contains all the required elements," and if the targeting and minimization procedures are reasonably designed to meet the requirements of the statute (that United States persons or those in the U.S. are not being targeted, or their non-public information unduly retained and disclosed).21 Certifications that meet these basic requirements are approved, allowing any proposed surveillance to move forward (or continue if it had already begun due to exigent circumstances).22

Once an acquisition has been authorized, the Attorney General and DNI may direct any electronic communication service provider to "immediately provide the Government with all information, facilities, or assistance necessary to accomplish the acquisition" in secret and designed to minimize interference with the services being provided to the target.23 The government will compensate the service provider for its assistance.24

If the FISC finds that one of the required elements is missing from the certification, or the targeting or minimization procedures are not sufficient, it may allow the government to correct these deficiencies within 30 days.25 The government may also appeal any decision of the FISC and, while it appeals, the sought surveillance is allowed to continue.26

Can electronic communication service providers object to a § 1881a directive?

Yes, but only on limited grounds.

An electronic communication service provider may file a petition with the FISC to set aside or modify a directive under this section 1881a.27 The FISC judge may only grant the petition if "the directive does not meet the requirements of this section, or is otherwise unlawful."28 Given that the requirements of section 1881a are limited, and the Fourth Amendment does not protect non-United States persons outside of the U.S., see below, this standard of review would seem to leave little basis on which a service provider could successfully set aside a directive.

Either the government or the service provider may appeal any decision of the FISC to the Foreign Intelligence Surveillance Court of Review, and ultimately to the Supreme Court of the United States.29 All proceedings are conducted in secret.30

A service provider that fails to comply with a section 1881a order may be held in contempt of court.31

How long does the authorization last?

One year, but it can be renewed.

An initial authorization may last "for a period up to 1 year."32 The government may seek re-authorization by submitting a renewed certification to the FISC at least 30 days prior to the expiration of the previous authorization.33

Are there rules regarding how collected information should be retained or disclosed?

There are very limited safeguards and they only apply to United States persons.

Section 1881a does not contain any retention or disclosure limitations on information obtained about non-U.S. persons located outside the U.S.

For U.S. persons, the Attorney General must establish minimization procedures. Those procedures are supposed to limit or prevent the acquisition, retention and disclosure of non-public information regarding United States persons.34

However, if evidence of a crime is obtained, procedures are supposed to be in place for its retention and dissemination for law enforcement purposes, regardless of whether the evidence relates to non-United States person located outside the U.S.35

How does the U.S. Constitution's Fourth Amendment apply to section 1881a?

It doesn't, at least when it comes to non-United States persons outside the U.S.

Though section 1881a states that an acquisition "shall be conducted in a manner consistent with the fourth amendment to the Constitution of the United States,"36 this is not much comfort to non-U.S. persons. The U.S. Supreme Court has held the Fourth Amendment does not protect citizens of other countries when they are outside of the United States. See United States v. Verdugo-Urquidez, 494 U.S. 259, 274-275A (1990).

Is this process secret?

Yes.

Everything, from the initial request for authorization, to any appeal, to the method of acquisition must be kept confidential.37

Semiannual and annual assessments are provided to certain Congressional committees, the Foreign Intelligence Surveillance Court, the Attorney General and the Director of National Intelligence.38