When the National Security Agency collects data inside the United States, it’s regulated by the Foreign Intelligence Surveillance Act. There’s a degree of court supervision and congressional oversight.
When the agency collects data outside the United States, it’s regulated by Executive Order 12333. That document embodies the President’s inherent Article II authority to conduct foreign intelligence. There’s no court involvement, and there’s scant legislative scrutiny.
So, that’s the conventional wisdom. American soil: FISA. Foreign soil: EO 12333. Unfortunately, the legal landscape is more complicated.
In this post, I’ll sketch three areas where the NSA collects data inside the United States, but under Executive Order 12333. I’ll also note two areas where the NSA collects data outside the United States, but under FISA.
If you’re a visual learner, or you’d prefer a TL;DR, here’s a diagram.1
Transit Authority (Two-End Foreign Wireline Communications)
The United States is the world’s largest telecommunications hub. Internet traffic and voice calls are routinely routed through the country, even though both ends are foreign.
According to leaked documents, the NSA routinely scoops up many of these two-end foreign communications as they flow through American networks.2 The agency calls it “International Transit Switch Collection,” operated under “Transit Authority.” That authority stems from Executive Order 12333, not the Foreign Intelligence Surveillance Act.
How, you might wonder, is the program legal? Hasn’t Congress established “the exclusive means by which electronic surveillance . . . may be conducted” on American soil?
After poring over declassified and leaked materials, I haven’t found a clear explanation. So, working backward from the relevant statutes, here’s my best reconstruction of the NSA’s legal theory. Transit Authority is a three-step dance through FISA and the Wiretap Act, and I think it’s fairly persuasive.
1. This Isn’t “Electronic Surveillance” Under FISA
The term “electronic surveillance” has a precise (and counterintuitive) meaning in FISA. There are multiple parts to the definition; the component that directly addresses wireline intercepts is 50 U.S.C. § 1801(f)(2). It encompasses:
the acquisition . . . of the contents of any wire communication to or from a person in the United States . . . if such acquisition occurs in the United States
A two-end foreign communication is, of course, not “to or from a person in the United States.” When the NSA intercepts a two-end foreign wireline communication, then, it hasn’t engaged in “electronic surveillance.”3
Much of FISA is scoped to the term “electronic surveillance,” including some key exclusivity provisions. Just by navigating that definition, the NSA can largely escape FISA’s restrictions.
2. This Falls into the Wiretap Act’s Foreign Intelligence Exception
Since 1968, the Wiretap Act has been the primary statutory scheme that regulates government interception of communications content. As you would expect, “electronic surveillance” that is authorized by FISA is also allowed by the Wiretap Act.4 But what about an NSA interception, inside the United States, that doesn’t count as “electronic surveillance”?
Many legal observers have assumed that the Wiretap Act and FISA are coextensive.5 Even the Congressional Research Service concluded as much. If a government agency intercepts content inside the United States, the thinking goes, it has two options. It can follow the law enforcement procedures, under the Wiretap Act. Or it can follow the (often lax) foreign intelligence procedures, under FISA. That legal structure would make sense—but it’s not how the law stands.
There is, in fact, a doughnut hole between the Wiretap Act and FISA. It’s located in 18 U.S.C. § 2511(2)(f), and it provides:
Nothing contained in [the Wiretap Act, the Stored Communications Act, or the Pen Register Act] shall be deemed to affect the acquisition by the United States Government of foreign intelligence information from international or foreign communications . . . utilizing a means other than electronic surveillance as defined in [FISA] . . . .
Let me unpack that dense legalese. Assume an intelligence agency intercepts a one-end foreign communication inside the United States.6 If the interception isn’t covered by FISA, it still isn’t covered by the Wiretap Act. There’s a gap between the two statutory schemes.
3. These Aren’t “Domestic” Communications Under FISA and the Wiretap Act
Both the Wiretap Act and FISA include exclusivity provisions. The Wiretap Act text, in 18 U.S.C. § 2511(2)(f), reads:
[Procedures] in [the Wiretap Act, the Stored Communications Act, and FISA] shall be the exclusive means by which electronic surveillance, as defined in [FISA], and the interception of domestic wire, oral, and electronic communications may be conducted.
The similar FISA text, in 50 U.S.C. § 1812, says:
Except as [otherwise expressly authorized by statute,] the procedures of [the Wiretap Act, the Stored Communications Act, the Pen Register Act, and FISA] shall be the exclusive means by which electronic surveillance and the interception of domestic wire, oral, or electronic communications may be conducted.
Once again unpacking the legalese, these parallel provisions establish exclusivity for 1) “electronic surveillance” and 2) interception of “domestic” communications. As I explained above, intercepting a two-end foreign wireline communication doesn’t constitute “electronic surveillance.” As for what counts as a “domestic” communication, the statutes seem to mean a communication wholly within the United States.7 A two-end foreign communication would plainly flunk that definition.
So, there’s the three-step maneuver. If the NSA intercepts foreign-to-foreign voice or Internet traffic, as it transits the United States, that isn’t covered by either FISA or the Wiretap Act. All that’s left is Executive Order 12333.
Satellite Surveillance (One-End Foreign Wireless Communications)
A recently declassified 2008 oral argument contains this gem from the government’s counsel:
And one aspect of [surveillance outside FISA] is the satellite communications, where you have [individuals] outside the United States communicating by satellite, and those messages are picked up at a satellite dish inside the United States. And for decades those communications have been outside the FISA process . . . .
The context of the attorney’s argument hinted that the NSA would collect not just two-end foreign satellite communications under Executive Order 12333, like the Transit Authority, but also one-end foreign communications.8 A leaked diagram of the NSA’s authorities also suggests that domestic collection of one-end foreign satellite communications is outside FISA.9
I once more couldn’t find a public explanation, so I again attempted a statutory reconstruction. A very similar three-step legal theory would place one-end foreign radio communications under Executive Order 12333.
1. This Isn’t “Electronic Surveillance” Under FISA
Here’s the part of the “electronic surveillance” definition that bears on radio communications:
the intentional acquisition . . . of the contents of any radio communication . . . if both the sender and all intended recipients are located within the United States
In less legalese, a radio interception is “electronic surveillance” only if every party is inside the United States.10 The rule for wireline11 communication, by contrast, is more strict; there is “electronic surveillance” if any party is inside the United States.
2. This Falls into the Wiretap Act’s Foreign Intelligence Exception
This argument would be the same as for two-end foreign wireline communications.
3. These Aren’t “Domestic” Communications Under FISA and the Wiretap Act
Again, the same.
The law that results is quite counterintuitive. If a communication is carried by radio waves, and it’s one-end foreign, it falls under Executive Order 12333. If that same communication were carried by a wire, though, it would fall under FISA. (Specifically, the Section 702 upstream program.)
As for how this Executive Order 12333 authority might be used beyond satellite surveillance, I could only speculate. Perhaps intercepting cellphone calls to or from foreign embassies?12 Or along the national borders? At any rate, the FISA-free domestic wireless authority appears to be even broader than the Transit Authority.
Classified Annex Authority (Targeted Warrantless Surveillance)
A third area of Executive Order 12333, on American soil, is the “Classified Annex Authority” or “CAA.” Its source is a classified addition to Executive Order 12333, set out in an NSA policy document.13 The most recent revision, from 2009, reads:
Communications of or concerning a United States person14 may be intercepted intentionally or selected deliberately . . .
with specific prior approval by the Attorney General based on a finding by the Attorney General that there is probable cause to believe the United States person is an agent of a foreign power and that the purpose of the interception or selection is to collect significant foreign intelligence. Such approvals shall be limited to a period of time not to exceed ninety days for individuals and one year for entities.
That provision appears to allow the Attorney General to unilaterally trump FISA. I’m not entirely confident that’s what it means, but it sure looks like it.15
I’m skeptical that the executive branch can just brush aside FISA, especially on American soil. In Justice Jackson’s famous phrasing, when the executive branch acts in clear violation of a legislative enactment, its “power is at its lowest ebb.” Nevertheless, the executive branch does appear to claim that Article II can override FISA, and it does appear to have invoked this Classified Annex Authority on occasion.16
Surveillance Targeting Americans Worldwide
Much like Executive Order 12333 can operate on American soil, FISA can operate on foreign soil. The first area that I’d like to flag is surveillance intentionally directed against Americans. If the NSA targets a U.S. person, anywhere in the world, that’s covered by FISA. And it generally requires a court order.17
There are two sources for this protection. U.S. persons inside the United States are covered by the traditional FISA “electronic surveillance” provisions, even if interception occurs outside the United States.18 U.S. persons outside the United States are protected by the FISA Amendments Act, which added new procedures for if the person or both the person and the interception are outside the United States.
International Interception of Purely Domestic Wireless Communications
There is a second area of extraterritorial FISA that I’d like to note. It’s subtle, narrow, and probably not of much practical importance. It’s even further emphasis, though, of the quirky statutory coverage.
So, here it is: If the NSA intercepts a wireless communication, outside the United States, and all the parties to that communication are inside the United States, that’s covered by FISA.19 It doesn’t matter if the target is a foreigner.
Closing Thoughts
I hope you’re persuaded that the division between FISA and Executive Order 12333 is far more complicated than where an interception occurs. It also depends on the communications medium, the location of the parties to the communication, the U.S. personhood of the target, and (allegedly) the Attorney General’s willingness to override FISA.
I hope you’re also persuaded that FISA’s coverage formula is a questionable fit for modern technology. The definition of “electronic surveillance,” in particular, hasn’t been updated for 35 years. It predates the popularity of the Internet and cellphones, which have respectively generated enormous volumes of two-end foreign wireline and one-end foreign wireless communications.
Surveillance reformers and oversight bodies have, rightly, begun to more closely scrutinize Executive Order 12333. In the process, it’s important to recognize that there are FISA-free zones in our own backyard.
1. An NSA authority diagram has leaked, but it’s less precise. That, along with a declassified training manual, provided helpful structure for FISA’s contours.
This diagram, and this post, are focused on communications content. I should note that Executive Order 12333 could also operate on American soil, for collection of one-end foreign metadata. The argument is very similar to the Transit Authority theory; intercepting metadata is not “electronic surveillance” because the definition requires content, and the rest is the same.
2. Leaks do not indicate whether this is a bulk surveillance program, or a massive—but targeted—surveillance program.
3. A separate part of the “electronic surveillance” definition, 50 U.S.C. § 1801(f)(1), covers intercepts targeting U.S. persons inside the United States. I’ve lumped that provision into the last part of this post.
4. Specifically, 18 U.S.C. § 2511(2)(e) excepts FISA “electronic surveillance” from the Wiretap Act, the Stored Communications Act, and the Pen Register Act.
5. A 2005 letter from leading legal scholars, for instance, emphasized that the Wiretap Act and FISA are the sole authorities for surveillance within the United States.
6. I assume the terms “international” and “foreign” mean, respectively, one-end foreign and two-end foreign. That would be consistent with how the intelligence community has used those terms elsewhere, as well as the term “domestic” used in the Wiretap Act and FISA. As for the “foreign intelligence information” requirement, that term has exceedingly broad meaning.
7. The term “domestic” in FISA appears to contrast with the terms “international” and “foreign,” noted above.
8. The attorney was making an argument about how the Fourth Amendment’s warrant requirement hasn’t previously applied to foreign intelligence surveillance within the United States, targeting U.S. persons outside the United States. For purposes of this post, I’m focusing on the FISA analysis, not the constitutional issues. As for one-end foreign satellite communications, the hint was that U.S. persons abroad would likely communicate with individuals inside the United States. These intercepts would, consequently, include some one-end foreign communications.
9. A footnote in the diagram notes that satellite interception stations (“FORNSAT”) within the United States are not governed by FISA’s one-end foreign provision (Section 702), which would mean they are governed by Executive Order 12333.
10. Again, if the target is a U.S. person inside the United States, then it’s still “electronic surveillance.” See note 3 above.
11. The term “wire communication,” in FISA, means a wireline communication. In the Wiretap Act, and the Electronic Communications Privacy Act in general, it (confusingly) has a different meaning. There, the term means audio communictions, where any part of the transmission involves a wire.
12. There’s corroboration for this in the leaked NSA authority diagram. It suggests that some NSA Special Collection Service sites, within the United States, are regulated by Executive Order 12333. Leaked documents indicate that SCS surveils foreign embassies within the United States.
13. Specifically, NSA/CSS Policy 1-23 § 4.A.I.(a)(4). That document implements DoD Directive 5240.01, which in turn implements Executive Order 12333.
14. In this context, the term U.S. person is explicitly expanded to include aliens inside the United States.
15. The NSA’s authority diagram, as well as a training document, suggest that the Classified Annex Authority only applies to foreigners inside the United States. It’s unclear what the textual basis for that restriction would be, though, in NSA/CSS Policy 1-23 itself. Perhaps, as a matter of discretion, the Department of Justice chooses to not invoke CAA for U.S. persons. That discretion could change, of course.
A separate provision of NSA/CSS Policy 1-23, section 4.A.I.(d)(3), suggests that compliance with FISA is always mandatory. I think the best reading of that provision, placed in context, is that it deals with the emergency scenario of targeted foreigners who enter the United States. Under those circumstances, prompt FISA compliance is usually required.
16. This intelligence community view that Article II can trump FISA is consistent with declassified Department of Justice Office of Legal Counsel memos on the subject. Given that the NSA’s basic training materials describe the Classified Annex Authority, it seems safe to assume that CAA has been used on occasion.
17. These provisions do not protect an American against “incidental” collection, where they are a party to a communication but another party is targeted outside FISA. The scope of incidental collection can be massive; it can, for instance, involve popular foreign websites.
As interpreted by the executive branch, these provisions also do not appear to protect an American against bulk extraterritorial interceptions. Those programs, such as bulk one-end foreign Internet interception in the United Kingdom, appear to involve a two-step process. Interceptions are, initially, conducted under Executive Order 12333. (That is, there is no FISA procedure or reporting.) Then, if an NSA analyst wishes to explicitly single out an American’s data, a FISA court order is usually required.
18. The “electronic surveillance” definition, in 50 U.S.C. § 1801(f)(1), does not expressly encompass interceptions outside the United States. Ordinarily, statutory provisions are presumed to not have extraterritorial effect. What more, that provision is scoped to areas where “a warrant would be required for law enforcement purposes.” Under modern doctrine, that probably doesn’t cover international interceptions. Nevertheless, the executive branch appears to consistently read the provision to apply to interceptions outside the United States. Public statements and NSA training documents both reflect that view.
I think that’s the right reading of FISA, for four reasons. First, it’s confirmed by FISA’s legislative history. Senate reports 95-604 and 95-701, for instance, expressly note that the original protection for domestic Americans was intended to apply to extraterritorial interceptions. Second, the part of the “electronic surveillance” definition that addresses wire communications specifies that it only covers domestic interceptions. The implication is that other parts of the definition do cover extraterritorial interceptions. If that weren’t the case, the wire communications caveat would be surplusage. Third, the presumption of extraterritoriality is still somewhat vindicated. This particular provision only protects U.S. persons inside the United States. Fourth, the doctrine around extraterritorial warrants is more modern than FISA, so Congress could not have been considering that limitation at the time.
19. The source of this protection is the “electronic surveillance” definition. That’s because the part of the definition covering purely domestic wireless interception, 18 U.S.C. § 1801(f)(3), is not limited to domestic interceptions. The textual reasoning is the same as for extraterritorial interceptions targeting domestic U.S. persons, and it’s also confirmed by legislative history.