NSA's Legal Authorities

(Updated: October 7, 2016)

Since the start of the Snowden-revelations, we not only learned about the various collection programs and systems of the National Security Agency (NSA), but also about the various legal authorities under which the agency collects Signals Intelligence (SIGINT).

Bceause these rules are rather complex, the following overview will show which laws and regulations govern the operations of the NSA, showing what they are allowed to collect where and under which conditions. Also mentioned are various collection programs that run under these authorities.

The overview provides a general impression of the most important elements of the various laws and regulations and does not pretend to be complete in every detail. For example, provisions for emergency collection are not included. Also, some of these laws and regulations govern the work of other US intelligence agencies too, but here the focus is on the NSA.

Collection INSIDE the US:

Targeted collection - US persons & foreigners:

- Section 105 FISA

- Section 703 FISA Amendments Act (FAA)

Targeted collection - Foreigners:

- Transit Authority

- Section 702 FISA Amendments Act (FAA)

- PRISM Collection
- Upstream Collection

Bulk collection - US persons:

- Section 402 FISA (PR/TT)

- Section 215 USA PATRIOT Act (BR FISA)

- USA FREEDOM Act

Collection OUTSIDE the US:

Targeted collection - US persons:

- Sections 704 & 705 FISA Amendments Act (FAA)

Targeted & Bulk collection - Foreigners:

- Executive Order 12333

- Classified Annex Authority (CAA)
- Special Procedures governing Communications Metadata Analysis (SPCMA)

Diagram with a decision tree showing the various legal authorities
under which NSA can collect Signals Intelligence (SIGINT)
(Click to enlarge)

- Inside the US - Targeted collection - US persons -

 

Section 105 FISA
- Effective since October 25, 1978.
- For communications of US citizens and foreigners, whether through a "facility" or individually, inside the US, for which there's a probable cause that they are agents of a foreign power or connected to an international terrorist group. Initially also for foreigners outside the US using an American webmail provider.
- Collection takes place at telephone and internet backbone switches, wireless networks, Internet Service Providers and data centers at over 70 locations inside the United States.
- Requires an individualized warrant from the FISA Court (which takes between four and six weeks), but if no US person will likely be overheard, only a certification by the Attorney General is required.
- Collection programs: BLARNEY, COWBOY (FAIRVIEW), PERFECTSTORM (STORMBREW)
 

Section 703 FISA Amendments Act (FAA)
- Effective since July 10, 2008; expires on December 31, 2017.
- For communications of a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court.
- Collection takes place inside the United States (see Section 105 FISA).

- Inside the US - Targeted collection - Foreigners -

 

Transit Authority
- Effective since ?
- Probably based upon a presidential directive that has to be re-authorized regularly, but the 2009 STELLARWIND report says NSA is authorized to acquire transiting phone calls under EO 12333.
- For communications with both ends foreign: originating and terminating in foreign countries, but transiting US territory.
- Collection takes place inside the US, at major fiber-optic cables and switches operated by American telecommunication providers.
- Data may apparently be shared with other US intelligence agencies.
- Collection programs: http://stephaniefulke.blogspot.com /2015/08/fairview-collecting-foreign.html">FAIRVIEW, STORMBREW, SILVERZEPHYR (OAKSTAR), ORANGEBLOSSOM (OAKSTAR)

 

Section 702 FISA Amendments Act (FAA)
- Effective since July 10, 2008; expires on December 31, 2017.
- For communications to or from foreigners who are reasonably believed to be outside the United States.
- Requires an annual certification by the Attorney General (AG) and the Director of National Intelligence (DNI), which has to be approved by the FISA Court. Certifications are known that have been approved for:

- Counter-Terrorism (CT, since 2007)
- Foreign Government (FG, since 2008; including some cyber threats since 2012)
- Counter-Proliferation (CP, since 2009)
- Cyber Threats (planned in 2012)

- Companies get a directive ordering them to cooperate. In return they are granted legal immunity and are compensated for reasonable expenses.
- Dissemination rules differ slightly per certification. Ordinarily, US person identifiers have to be masked, but unevaluated data may be shared with FBI and CIA, and foreign data may be shared with the 5 Eyes partners.
- Unencrypted data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director.

Section 702 FAA has two components, each with slightly different rules:
 

PRISM Collection
- Only internet communications "to" and "from" specific e-mail addresses or other types of identifiers. Filtering only allowed for selectors, not for keywords.
- Collection is done by the FBI's DITU, which acquires the data from at least 9 major American internet companies. This results in both stored and future communications.
- Raw (unminimized) data may be shared with FBI and CIA.
- Data are retained for a maximum of 5 years.
- NSA is permitted to use US person identifiers for querying already-collected data when there's a reasonable expectation that this will return foreign intelligence.*
- Collection program: http://stephaniefulke.blogspot.com /2014/04/what-is-known-about-nsas-prism-program.html">PRISM

 
Upstream Collection
- Both internet and telephone communications. The internet communications may be "to", "from" and "about" specific e-mail addresses or other types of identifiers, including IP addresses and cyber threat signatures.
- Collection takes place inside the US, at major telephone and internet backbone switches. This only results in future communications.
- Raw (unminimized) data may not be shared outside NSA.
- Data are retained for a maximum of 2 years.
- Collection programs: http://stephaniefulke.blogspot.com /2015/08/fairview-collecting-foreign.html">FAIRVIEW, STORMBREW

- Inside the US - Bulk collection - US persons -

 

Section 402 FISA (PR/TT)
- Effective since October 25, 1978.
- Since July 14, 2004, orders from the FISA Court allowed the NSA to collect domestic internet metadata in bulk under this authority. These metadata included the "to", "from", and "cc" lines of an e-mail, as well as the e-mail’s time and date.
- Only for Counter-Terrorism purposes.
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Query results could only be accessed by specially trained NSA analysts, and could only be shared for a counter-terrorism purpose.
- Data were being retained for a maximum of 5 years.
- Collection terminated in December 2011 for "operational and resource reasons" and all data were deleted, as the requirements could also be fulfilled under 702 FAA and SPCMA authorities.*
- Collection programs: ?

 

Section 215 USA PATRIOT Act (BR-FISA)
- Effective since October 26, 2001; expired as of May 31, 2015.
- Since 2006, orders from the FISA Court allowed the NSA to collect domestic telephone metadata in bulk under this authority. These metadata included the originating and receiving phone number, the date, time and duration of the call, and, since 2008, the IMEI and IMSI number.
- Only for Counter-Terrorism purposes: there must be a Reasonable and Articulable Suspicion (RAS) that the query term belongs to a foreign terrorist organization. The Emphatic Access Restriction (EAR) tool ensured that analysts only did queries on RAS-approved selectors.*
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Query results could only be accessed by specially trained NSA analysts, and could only be shared when a manager certifies the data are for a counter-terrorism purpose.
- Data were retained for a maximum of 5 years. Remaining data will be deleted after receiving direction from the appropriate court.
- Collection programs: http://stephaniefulke.blogspot.com /2015/08/fairview-collecting-foreign.html">FAIRVIEW, STORMBREW

During a 180-day transition period, the NSA continued the collection of bulk telephony metadata under section 215 USA PATRIOT Act, which was until November 29, 2015. In this period, telephony metadata could only be queried after a judicial finding that there is a Reasonable, Articulable Suspicion (RAS) that the selector is associated with an international terrorist group. The results had to be limited to metadata within 2 (instead of 3) hops of the seed term.

 

USA FREEDOM Act
- Effective since June 2, 2015.
- Allows the NSA to request metadata from telephone companies based upon specific selection terms for which there's a Reasonable, Articulable Suspicion (RAS) that they are associated with a foreign power or an international terrorist group. These metadata may consist of "session-identifying information", like originating and receiving numbers, IMSI, IMEI and telephone calling card numbers, and the date, time and duration of the call. Collection of, and contact chaining on location data is prohibited.
- Requires a warrant from the FISA Court approving specific telephone numbers or other identifying selectors.
- NSA provides these selectors to the telecommunication providers, who have to produce the results of their queries (one or two hops from the initial selector) in a useful format, on a daily basis, and for a period of up to 180 days.
- Companies providing these data are granted legal immunity and will be compensated for reasonable expenses.
- All records that are not foreign intelligence information have to be destroyed promptly.
- Query results may be fully shared with CIA and FBI.
- Also, foreign terrorists may be tracked for up to 72 hours when they enter the US, with authorization by the Attorney General.

- Outside the US - Targeted collection - US persons -

 

Section 704 & 705 FISA Amendments Act (FAA)
- Effective since July 10, 2008; expires on December 31, 2017.
- Collection takes place outside the United States.
- Data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director. Inadvertent collection of US data has to be destroyed upon recognition, but the Attorny General can authorize exceptions.

The differences for these sections are:

Section 704 FAA
- For collection against a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court, for a period of up to 90 days.
 

Section 705(a) FAA
- For communications of a US person reasonably believed to be outside the United States.
- Requires an individualized warrant from the FISA Court.
- Collection may take place both inside and outside the United States.


Section 705(b) FAA
- For communications of a US person reasonably believed to be outside the US, when there is already an existing FISA Court order for collection against this person inside the US under section 105 FISA.
- Requires authorization by the Attorney General.

- Outside the US - Targeted & Bulk collection - Foreigners -

 

Executive Order 12333
- Effective since December 4, 1981.
- For communications between foreigners outside the US.
- Requires no external approvals, except for fitting the http://stephaniefulke.blogspot.com /2014/09/nsas-strategic-mission-list.html">mission and the goals set for NSA by the government.
- Collection takes place outside the US and for all foreign intelligence purposes. However, Presidential Policy Directive 28 (PPD-28) from January 17, 2014, limits bulk collection to the following 6 purposes:

- Espionage and other threats by foreign powers
- Threats from terrorism
- Threats from weapons of mass destruction
- Cybersecurity threats
- Threats to US or allied armed forces
- Threats from transnational crime

- Data may be shared with other US intelligence agencies, as well as with foreign partner agencies.
- Dissemination of US person identifiers is only allowed when necessary and personal information should not be inapproprately included in intelligence reports.
- Unencrypted data from targeted collection are retained for up to 5 years, unless it is determined that continued retention is required; encrypted data are retained for an unlimited period of time.
- Collection programs: OAKSTAR, http://stephaniefulke.blogspot.com /2014/11/incenser-or-how-nsa-and-gchq-are.html#windstop">WINDSTOP (incl. http://stephaniefulke.blogspot.com /2014/11/incenser-or-how-nsa-and-gchq-are.html">INCENSER, MUSCULAR, etc), http://stephaniefulke.blogspot.com /2014/10/the-german-operation-eikonal-as-part-of.html#rampart-a">RAMPART-A (incl. SPINNERET, MOONLIGHTPATH, AZUREPHOENIX, etc), http://stephaniefulke.blogspot.com /2014/05/nsas-largest-cable-tapping-program.html">DANCINGOASIS, MYSTIC, and many more.

Under EO 12333, there are two additional authorizations:
 

Classified Annex Authority (CAA)
- Effective since 1988.
- For communications of US persons outside the US, for whom there's probable cause that they are agents of a foreign power or engaged in international terrorism.
- Requires prior approval by the Attorney General, limited to a period of time of up to 90 days.
- Also for communications of a US person who is held captive by a foreign power or a terrorist group, which requires approval of the Director of NSA.
 

Special Procedures governing Communications Metadata Analysis (SPCMA)
- Effective since January 2011
- Allows contact chaining and other analysis on metadata already-collected under EO 12333, regardless of nationality and location, including US person identifiers.
- For the purpose of following or discovering valid foreign intelligence targets (i.e. not restricted to counter-terrorism).
- Only covers analytic procedures and does not affect existing collection, retention or dissemination (including minimization) procedures for US person information.
- SPCMA-enabled tools: ICREACH, Synapse Workbench, CHALKFUN

- Information Assurance -

Besides collecting Signals Intelligence, the NSA is also responsible for Information Assurance (IA). This mission is conducted under the following authorities:

- National Security Directive 42 ("National Policy for the Security of National Security Telecommunications and Information Systems", 1990)

- Executive Order 13587 ("Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information", 2011)

- . - . - . - . - . - . - . - . -

Links and sources
- Emptywheel.net: The Yahoo Scan: On Facilities and FISA
- Emptywheel.net: While It Is Reauthorizing FISA Amendments Act, Congress Should Reform Section 704
- IC on the Record: FACT SHEET: Implementation of the USA FREEDOM Act of 2015
- Emptywheel.net: Internet Dragnet Timeline - Phone Dragnet Timeline - 10 Goodies USA Freedom Act Gives the Intelligence Community
- Webpolicy.org: Executive Order 12333 on American Soil, and Other Tales from the FISA Frontier
- IC on the Record: Transition from the USA PATRIOT Act to the USA FREEDOM Act
- DNI.gov: Documents Regarding the Now-Discontinued NSA Bulk Electronic Communications Metadata
- Americanbar.org: Section 214 and Section 215 FISA
- National Research Council: Bulk Collection of Signals Intelligence: Technical Options (pdf) (2015)
- NSA Civil Liberties and Privacy Report about Targeted SIGINT Activities under EO 12333 (pdf) (2014)
- Privacy and Civil Liberties Oversight Board report about the Surveillance Program Operated Persuant to Section 702 FISA (pdf) (2014)
- Legal fact sheet: Executive Order 12333 (pdf) (2013)
- The Department of Defense Directive about NSA/CSS (pdf) (2010)
- NSA OGC: Course on legal compliance and minimization procedures (pdf)
- Memo about Reauthorization of the FISA Amendments Act (pdf)
- NSA OGC: FISA Amendments Act of 2008 - Section 702 - Summary Document (pdf)