A Guide to the New FISA Bill, Part I

David Kris


Marty Lederman and Jack Balkin invited me to submit a post on the FISA modernization bill (H.R. 6304) that was passed on Thursday by the House of Representatives, and that appears to be on the verge of becoming law. To understand this new legislation, I think you need to appreciate three matters:

(1) some elements of the current version of FISA, which are what is at stake in the (soon to be concluded) debate over modernizing the statute;

(2) the main legal and operational arguments for and against modernizing FISA; and

(3) the Bush Administration’s actual efforts to modernize electronic surveillance, beginning with the NSA’s Terrorist Surveillance Program (TSP) in 2001, and ending with the new legislation.

Even in abbreviated, non-technical form, these three matters require some heavy lifting, so I’ll cover the first two today, and then address the third in a separate post that will appear tomorrow. Most of what I say in both posts comes wholesale from a previously published whitepaper and my book , both of which discuss these issues in much greater detail. (This allows me to avoid separate prepublication review of these posts; the government’s reviewers are usually very responsive, but it’s tough for them to keep up with the pace of the blogosphere, especially on a Friday night.)

1. Background on FISA

FISA is a very complex statute, but for present purposes it has three essential substantive elements. First, there is the bedrock probable-cause requirement that the “target” of the surveillance – the entity from or about whom the government seeks information – be either a “foreign power,” or an “agent of a foreign power.” These terms are defined in detail in the statute, but for present purposes it is enough to say that they mean more or less what you think they would mean. For example, a “foreign power” includes not only a foreign government, but also an international terrorist group, like al Qaeda; and an agent of a foreign power includes someone who works on behalf of a foreign power in certain specified ways, like Osama Bin Laden.

Second, there must be probable cause that the target of the surveillance – the foreign power or agent of a foreign power – is using or about to use the “facility” at which the surveillance will be directed. The term “facility” is not defined in FISA, but legislative history makes clear that it is the electronic analogue to “location” in an ordinary physical search; for example, the traditional examples of “facility” are either a 10-digit telephone number or a standard name@domain e-mail address.

Third, FISA dictates the use of specific “minimization procedures” that require the government, in the implementation of surveillance, to balance its foreign intelligence needs against Americans’ privacy interests. In particular, minimization procedures must be “reasonably designed in light of the purpose and technique of the particular surveillance, to minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information.” These minimization procedures can differ from case to case depending on the facts and circumstances, and they are in part classified to avoid suggesting countermeasures to our adversaries.

Procedurally, in general, FISA requires approval (and signatures) from two very senior government officials – for example, the Attorney General and the FBI Director – and a judge of the FISA Court, that the statutory requirements have been met for each target and facility being surveilled. By and large, the government has to get these written approvals before surveillance of any target or facility may begin (there are some exceptions).

Details aside, the key point is that FISA electronic surveillance is very different from ordinary foreign intelligence surveillance that is outside the statute’s scope. With respect to foreign intelligence surveillance not covered by FISA, the Director of National Intelligence sets general collection requirements – for example, “determine the order of battle of the army of the government of Zendar” – and the intelligence community collects against those requirements without case-by-case approval from the Attorney General or a judge. The collectors follow their own internal minimization and related procedures (set out in documents with names like DOD 5240-1R and USSID-18), but they undeniably enjoy more “speed” and “agility” in this realm than they do under FISA. This kind of surveillance, outside FISA’s scope, has in the past been referred to by at least one Attorney General as “vacuum-cleaner” surveillance; I use the term here in a non-pejorative sense, only as a convenient shorthand.

Fundamentally, this is what I think is at stake in the debate about FISA modernization: whether and to what extent the government will be subject to FISA’s individualized warrant requirement, rather than a vacuum-cleaner regime, for its foreign intelligence surveillance. The debate concerns not only the substantive standards for surveillance, but also the question of who applies those standards, in what manner, at what time, and subject to what minimization requirements.

2. Arguments for FISA Modernization

There are three main arguments for modernizing FISA, only the first of which has been advanced publicly with any force by the Bush Administration. This first argument is that FISA must be modernized because, in the years since 1978, the statute’s regulatory reach has been artificially expanded by the transition from satellite to fiber optic cable for carriage of transoceanic communications. Satellites use radio waves to carry international calls, and FISA does not regulate surveillance of international radio communications to or from the United States (unless the target of the surveillance is a particular, known, U.S. person who is located in the United States). But FISA does regulate surveillance of international wire or cable communications, to or from the United States, when conducted in this country (even if the target is a non-U.S. person). Thus, the government claims, surveillance of international communications that used to be conducted outside of FISA is now subject to the statute because of changing technology. A review of telecommunications history, detailed in my whitepaper, shows this claim to be exaggerated: the transition from satellite to cable was neither as dramatic, nor as unanticipated, as the government argues.

On the other hand, there is a second, related point that has not been as well understood. FISA was written to permit warrantless surveillance not only of international radio communications, but also of international wire or cable communications, if the wire surveillance was conducted outside the United States – e.g., in the Atlantic ocean. That is, FISA does regulate surveillance of international wire or cable communications, to or from the United States, when conducted inside this country. As long as no particular American in the U.S. is being targeted, however, FISA does not regulate surveillance of those same communications, on those same wires or cables, when conducted on a portion of the wire or cable located outside this country. Today, it appears, the government wants or needs to conduct such surveillance inside the United States, probably because it needs the assistance of the telecommunications providers and their equipment. Bringing the surveillance into this country, however, also brings it under FISA. One of the key issues in the debate about FISA modernization is whether that change in the location of the surveillance should continue to trigger the statute’s application.

Third and finally, there is the problem of e-mail. Nearly two years after launching its campaign for FISA modernization, the government publicly stated that FISA poses a problem for surveillance of e-mail. Here the evidence is clear: FISA regulates surveillance of e-mail more than it regulates surveillance of telephone calls. In particular, while FISA does not regulate (and has never regulated) surveillance of a foreign-to-foreign telephone call – e.g., a call from Paris to London – even if monitored inside the United States, it does regulate surveillance of a foreign-to-foreign e-mail message if acquired from electronic storage inside the United States. Most knowledgeable observers agree that this is an anomaly in need of correction – there is no substantial debate about this.

As it turns out, however, changing technology and increasing globalization make it very difficult to devise a narrowly tailored legislative solution to this recognized anomaly. With the advent of web-based communication and other developments, the government cannot always determine – consistently, reliably, and in real time – the location of parties to an e-mail message. Thus, a FISA exemption for foreign-to-foreign e-mail does not always help the government, because it cannot always verify the “to-foreign” part of the exemption. Without requiring such verification, however, the exemption may be too broad, potentially embracing domestic e-mail, which even the Director of National Intelligence has said should remain subject to traditional FISA. This is one of the main problems that has bedeviled efforts at FISA modernization.

Okay, that’s it for today. In tomorrow’s post, I will try to provide a chronology of FISA modernization, beginning with the Terrorist Surveillance Program (TSP), which circumvented the FISA statute, and ending with a discussion of the new bill as passed by the House on Thursday. Thanks for sticking with me this far.