Document regarding the Section 702 2018 Certification - ODNI A4.ttJorized fo� Release united Stitt• Foreton lntoltlg•nc• - Surv•U11noe Ccmrt T8F f:JllOROT;i;i81:\101t08JVflOFORfl OCT 1 8 2018 UNITED STATES LeeAnn Flynn Hall, Clerk of Court FOREIGN INTELLIGENCE SURVEILLANCE COURT WASHINGTON, D.C. MEMORANDlJM OPINION AND ORDER The Foreign Intelligence Surveillance Court today addresses the "Government's Ex Pru1e Submission of Reauthorization Certifications and Related Procedures, Ex Parte Submission of Amended Certifications, and Request for an Order Approving Such Ce11ifications and Amended Certifications," filed on March 27, 2018 ("March 27, 2018, Submission"), and the "Government's Ex Parle Submission of Amendments to DNI/AG 702(h) Certifications and Related Procedures, Ex Parte Submission of Amendments to DNJ/AG 702(g) Ce1iifications, and Request for an Order Approving Such Amended Certifications," filed on September 18, 2018 - - IGI•SECl 2018, Amendments as described in§ 702(h)(3)- specifically, the certifications becomee effective on October 18, 2018, or the date upon which the Court issues an ordere - - IOf•31!:Cltl!,J))!Jf))OftCOfUU!>l'ORH DATE: Oct 8, 2019 - Authorized Public Release Page 9 of 138 Page9 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I Seee The statement described in§ 702(h)(2)(E) is not required because there was no "exigent circumstances" determination under§ 702(c)(2).) • _J " I' • •- I • • ti • ~ ~ ' I . • ~•••. I o,f The Comi therefore finds that the 2018 Certifications contain all the required statutory elements. Similarly, the Court has reviewed the certifications in the Prior 702 Dockets, as amended by the 2018 Certifications, and finds they also contain all the elements required by the statute . Those amendments have the same effective dates as the 2018 Ce11ifications. See Ill. TARGETING PROCEDURES AND SCOPE OF ACQUISITION Section 702(d)( I) requires targeting procedures to be "reasonably designed" to "ensure that any acquisition authorized under[§ 702(a)] is limited to targeting persons reasonably believed to he located outside the United States" and to "prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States." Additiona1Ly, the government uses the targeting procedures to ensure acquisitions do "not intentionally target a United States person reasonably believed to be located outside the United States." § 702(b)(3). Pursuant to §e702(i)(2)(B), the Court assesses whether the targeting procedures satisfy those criteria. Thee Comt must aJso assess whether the targeting procedures, along with the querying and minimization procedures, are consistent with the requirements of the Fourth Amendment. See §e702(i)(3)(A)-(B).e ln January 2018, Congress enacted the FISA Amendments Reauthorization Act of 2017 ("Reauthorization Act"), Pub. L. No. 1 I 5-118, 132 Stat. 3 (2018). The Reauthotization Act - - ·1 TOI•:Jl!@MT118fXOBOOUfUOF8Rff DATE: Oct 8, 2019 - Authorized Public Release Page 10 of 138 Page 10 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'P6f SEettE'fMS1,1,0ftCON;INOPORN enacted Section 702(b)(5), which contains a limitation on the acquisition of"communications that contain a reference to, but are not to or from, a target of an acquisition authorized" under Section 702(a), which acquisition is colloquially refen-ed to as "abouts" collection. Reauthorization Act § 103(a){3). It specifically imposed, with na1Tow exceptions for exigent circumstances, a requirement of congressional notification and a 30-day congressional-review pe1iod before the government can resume abouts collection u11der Section 702. See id. §eI 03(b )(1 )-{4 ). This Opinion refers to that requirement as the "abouts limitation." In addition,e the government must "fully and currently inform" the Judiciary and Intelligence Committees of the House and Senate of "significant noncompliance ... conceming any acquisition of abouts communications." § 702(m){4) (enacted by Reauthorization Act§ J 03(b)(5)). A. Backi:round on Section 702 Acquisition The govemment targets a person under Section 702 by tasking for acquisition one or more selectors (e.g., identifiers for email or other electronic-commu11ication accounts) associated with that person. Section 702 encompasses different fonns of acquisition. The government may acquire information "upstream," as it transits the facilities of an Internet backbone carrier, as well as "downstream," from systems operated by providers of service April 26, 2017, Opinion at 15. Traditional telephone communications may also be acquired upstream, but those acquisitions have not presented issues regarding scope of acquisition in the way that upstream Intemet acquisitions have. In the following discussion, "upstream" collection refers to upstream acquisition of Internet communications under Section 702. 'f'OP SECRE'fWSl,'fORCONf:P�OFORN DATE: Oct 8, 2019 - Authorized Public Release Page 11 of 138 Page 11 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - I01•tJl!Clll!lI;;JI;;OltCOfUf8ifPOftff• NSA is the only agency to conduct upstream collection under Section 702, while both the NSA and FBI have roles in downstream. Under the procedures, NSA is the lead agency in making targeting decisions under Section 702. The FBI Targeting Procedures Targeting Procedures § I. l at 1. "Thus, the FBI Targeting Procedures apply in addition to the See Docket No NSA Targeting Procedures," em. Op., Sept. 4, 2008 ("September 4, 2008, Opinion") at 20 (emphasis in original). It is worth highlighting two salient features of upstream collection as conducted prior to March 17, 2017, that bear on the issues raised by the abouts limitation: (I)eNSA sometimes acquired "multiple communication transactions," or "MCTs,"e through upstream collection. An MCT is a bundle of communications transiting part of the See April 26, 2017, Opinion at 15-16. ("Active user" refers to the user of a communication service to or from whom an MCT is in transit when it is acquired. See id. at 16.) (2)eIn addition to infonnation in transit to or from a tasked selector, NSA acquirede communications, including MCTs, about - i.e., containing a reference to - a tasked selector. For example, if a single email message within an MCT contained a reference to a tasked email account, the entire MCT could be acquired, including numerous additional email messages that Page 12 DATE: Oct 8, 2019 - Authorized Public Release Page 12 of 138 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - I OfI SECREI))31))0REUMI40FURI◄ -I did not contain a reference to a tasked selector. See id. For that reason, and because such MCTs could be acquired regardless of whether the active user was a Section 702 target, those additional email messages could be wholly unrelated to any target. See id. at 16-17. As a result, upstream collection as conducted prior to March 17, 2017, was "more likely than other fonns of Section 702 collection to contain information of or conceming United States persons with no foreign intelligence value." Id. at 17 (internal quotation marks and citation omitted). Heightened restrictions were accordingly placed on NSA's retention, use, and dissemination of infonnation acquired through upstream collection, including a prohibition on queries that used U .S.-person identifiers as query terms. See id. at 17-18. Beginning in October 2016, while the 2016 Ce11ifications were pending before the FISC, the government reported that NSA had violated that querying prohibition much more frequently than had been previously disclosed. The FISC discussed this issue at length in its opinion ultimately approving the 2016 Certifications, which were amended by the government to address that non-compliance. See id. at 14-30. Specifically, the government chose to stop acquiring abouts communications under Section 702 and memorialized that change in amended procedures for the 2016 Certifications. For example, the NSA Targeting Procedures were amended to state that "[a]cquisitions conducted under these procedures wi11 be limited to communications to or from persons targeted in accordance with these procedures." 20 l 6 NSA Targeting Procedures, as Amended, Mar. 30, 2017, § I at 2 (emphasis added). Consistent with that provision, NSA limited acquisition of MCTs to situations where a Section 702 target was the active user or, put another way, a sender or recipient of the entirety of each MCT acquired. NSA's cunent minimization - iflOft 8E@RE'tWSl:'/ORCON:'l'JOF01lN DATE: Oct 8, 2019 - Authorized Public Release Page 13 of 138 Page 13 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 5P8P 81!l@ltl95P11:'8t#8ftOOPVNOFOllff procedures {"2016 NSA Minimization Procedures") were amended to state that Internet transactions acquired after March 17, 2017, "that are not to or from a person targeted in accordance wit11 NSA's section 702 targeting procedures are unauthorized acquisitions and therefore will he destroyed upon recognition." 2016 NSA Minimization Procedures, as Amended Mar. 30, 2017, § 3(b)(4)b at 4. Relying on those changes, the Court approved the amended 20I 6 Certifications and procedures. See April 26, 2017, Opinion at 23-30, 95. The 2016 NSA Minimization Procedures (as amended in March 2017 and approved in April 2017) required the sequestration and destruction of all upstream Internet collection during the timeframe affected by the compliance incident. Aside from infmmation retained subject to restticted access for litigation-hold purposes (see, e.g., Gov't Fifth Update Regarding Info. Acquired On or Before Mar. 17, 2017, Pursuant to NSA's Section 702 Upstream Internet Collection, July 18, 2018, at 5-8) NSA has completed the necessary destruction. The government is not seeking Court approval to resume what it regards as the acquisition of abouts communications under the 2018 Certifications and accompanying procedures. The Court nonetheless identified issues concerning the potential applicability of the abouts limitation to some information within the proposed scope of acquisition under the 2018 Certifications and appointed amici to address the following: (a)eDo the preconditions on acquiring "abouts communications" imposed by Sectione I 03(b) of the [Reauthorization Act] apply only to forms of acquisition that thee government discontinued under Section 702 in March 2017?e (b)eIf the answer to (a) is "no," do any fonns of acquisition to be conducted under thee 2018 Certifications involve a uisition of abouts communications, with particulare consideration ofe - ifOP 8ti8M�%'011%'8ROOfl:fffOFONl DATE: Oct 8, 2019 - Authorized Public Release Page 14 of 138 Page 14 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - T8f 81)O!l!IJT:Vf!ll:1:10noor l:tfJOFOIWJ Order Appointing Amici Curiae, Apr. 23, 2018, at 4. The Court appreciates the he]pfuJ briefing it received from amici and the government on these issues. B. Analysis The Court's examination will begin wit! agreement between the government and amici that such collection comports with the abouts limitation. escribed in element (b)(i) above. It The Court next addresses examines that infonnation as acquired upstream (in-transit) and then as acquired dmvnstream With respect to the Court concludes, again based on substantial upstream collectio agreement between amici and the government, that � lllection wi11 be conducted in a manner that complies with the limitation. The govenunent and amici disagree as to whether the abouts limitation has any application to downstream collection. The Court, for reasons stated below, concludes that it does and addresses the application of the limitation to various types of downstream collection. The Court concludes that I• • • I •' ...• I • comports with the abouts limitation becaus - - ?@I1111ff@@ft@lf;':1811':tOft@ON:tPH:)fOftfl DATE: Oct 8, 2019 - Authorized Public Release Page 15 of 138 Page 15 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - I01' SECRE I11SfoORLOMNOFORN consistent with the limitation. '.J;QP 8ii6Ril1Ui61MQAGON 'JlOFQBiPtl DATE: Oct 8, 2019 - Authorized Public Release Page 16 of 138 Page 16 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release IOI SE@lllillSZ:GIE@GihllGl 8Nf - - IOI■SECJCEI//SillbRLOIUJQOJ•b]CJ4 I DATE: Oct 8, 2019 - Authorized Public Release Page 17 of 138 Page 17 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release Amici agreed with the government, and the Court accepts, that the NSA's is consistent with the abouts limitation. See, e.g., Br. of Amici Curiae ("Amici Brief'), May 31, 2018, at 40 ("[TJhe Government offers what to us are persuasive arguments that Amici conclude that the safeguards - - I I lbi I SELKEI))Jl))OICCUMl◄Ul GIG< DATE: Oct 8, 2019 - Authorized Public Release Page 18 of 138 Page 18 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release ill avoid intentional acquisition of abouts "ensure tha cmmmmications." Amici Brief at 41-42; see also§ 702(b)(5) (authorized acquisition may not intentionally acquire abouts communications). The Cou1i is equally satisfied on the record before it that · s reasonably designed to avoid the acquisition ofo abouts communications (or any other non-target communications) and to require the destruction of any no1Harget communications unintentionally obtained through such collection. Amici make two sets of recommendations First. they recommend that the Comi require the will only acquire government to explain to the Cout1 why communications to or from a Section 702 target, and to repo11 on the methods it uses to audit to detennine what percentage, if any, of information communications acquired are neither to nor from a Section 702 target, and the results of that auditing. See Amici Brief at 43. The Court adopts these recommendations, in part ) as reflected in the repo1ting requirements set out at the end of this opinion. ... &£&2!2 - ..- il!Z211 - SUI - --111111 IFIM - l 52 I DATE: Oct 8, 2019 - Authorized Public Release Page 19 of 138 Page 19 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release . IOf SELKE III"tJJOftCOnn•ePORH Second, amici recommend that the Cow1 require the government to brief Congress Id. at 43-44. Amici do not identify any paiiicular reason to think ordinary oversight processes are inadequate for this subject, and the Court sees no need to dictate the tenns of executive-branch disclosures to Congress. The Court anticipates that congressional committees ofjurisdiction will receive copies of this opinion. See 50 U.S.C. § 1871(c)(I) (requiring Attomey General to submit to specified Congressional committees any decision, order, or opinion of this Court that includes a "significant construction or interpretation of any provision of law"). Congress will then have an infonned opportunity to decide for itself what further infonnation it may desire pertinent changes to the targeting procedures an under Section 702. It will then examine the acquisition of such infonnation through both upstream collection and downstream collection, The Court concludes that, while the abouts limitation potentially applies to both upstream and downstream collection, the government may use both of those means to ·thout acquiling abouts commw1ications. - IJOPfilB iRBIJJililJl;fQftOOtl11:QFQl\tl DATE: Oct 8, 2019 - Authorized Public Release Page 20 of 138 Page20 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - a. ODNI Authorized for Public Release - 1et 9E@ltt'.lffJ'il8100ft00fl:1iOFOHfI • Background The government's submission refers to pursuant to Section 702 The government made what it regards as clarifying edits to its Section 702 _ I,bl SLCKEIJlSiJlbk@OHIHOPOll!U ■ DATE: Oct 8, 2019 - Authorized Public Release Page 21 of 138 Page 21 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release The Brief of Amici Curiae was pa11icularly helpful in this regard. See Amici Brief at 30-33. ffl[B)P ilfi!PH fi!.Sfi;l;ffH;l;fAH fJAftJ:IJIJAFAlilir. DATE: Oct 8, 2019 - Authorized Public Release Page 22 of 138 Page 22 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f'OP Sl!!CRl!YtWSl#ORCON,':PfOFORN DATE: Oct 8, 2019 - Authorized Public Release Page 23 of 138 Page 23 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - TOP Sfi€1HS•om VOACON/JlQF-'Rt'J DATE: Oct 8, 2019 - Authorized Public Release Page 24 of 138 Page 24 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release The Court must now consider whether acquisitio ·s consistent with the abouts limitation. It is necessary to analyze that issue separately for each pertinent fonn of acquisition. Amici contend, and the government does not contest, that such cases involve acquisition of "communications." In support of that conclusion, amici point to the broad definition of "electronic communication" in the Electronic Communications Privacy Act (ECPA), l 8 U.S.C. § 2510( 12) (1986), as '"any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, lflfil:P &illiilJ!i'lt liillfl DATE: Oct 8, 2019 - Authorized Public Release '·,n I IAlt A fil11,T 'PJAliilAlt ,r Page 25 of 138 Page 25 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - Ff8P 0B OllBiiJiW811%181lOOti:'JfOFORll photoelectronic or photooptical system that affects interstate or foreign commerce; subject to ce11ai11 exce tions." Amici Brief at 26. This Court has reviously w1derstood that definition to For purposes of the abouts limitation, it is impo11ant that all of the above-described communications would be in transit to or from a person who is accessing or using the account in question - i.e., the active user- at the time they could be acquired by upstream collection. So long as the active user is properly targeted under Section 702, the acquired communications would be to or from that target and therefore would fall outside the abouts limitation. And generally speaking, the active user of the account in question will be an authorized Section 702 target if the account is properly tasked for acquisition under Section 702. That is because, with a all users of a facility tasked for acquisition under natTow exception for Section 702 are considered targets. See April 26, 20 I 7, Opinion at 16 n.18; 2016 NSA Minimization Procedures, as Amended Mar. 30, 2017 § 4(c)(3) at 6 n. l ("any user of a tasked selector is regarded as a person targeted for acquisition"). (If a tasking of a facility is found to be - - EliOP SFGPFTt'.Sl'.'APCON'NOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 26 of 138 Page 26 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I T8P Oli OlllJT:ttQI1101l@ONI110FQRi'il improper for some other reason - e.g., because one of its users is a U.S. person - further a uisition would be unauthorized, but not due to the abouts limitation.) its procedures, as described above, now require it to limit acquisition to communications to or from a person targeted under Section 702. For example, Amici agree that, so limited, acquisition consistent with the abouts limitation. See Reply Br. of Amici Curiae ("Amici Reply"), June 29, 2018, at 4 (acknowledging that account infonnation "acquired as a resuJt of colJecting communications to or from a targeted account would "plainly fall outside" the abouts Jimitation). - 'JiQP SlsQA.l!i'J11.'6,l!:'OA.60J)f'A.JCFCPN DATE: Oct 8, 2019 - Authorized Public Release Page 27 of 138 Page 27 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release the Court holds that u stream collection under Section 702 may the abouts limitation. Amici make two recommendations with respect to upstream collection generally: (i) the government should be required to report on how it will comply with the abouts limitation when it tasks any new type of selector to upstream collection; and (ii) the Court should ensure that the government is systematically auditing compliance with the abouts limitation in such collection. See Amici Brief at 34-35. The Court agrees with amici's first recommendation, and it is reflected in the reporting requirements included at the end of this opinion. As to the second, the government is directed to include infonnation in any such report describing steps that will be taken to ensure that tasking the new type of selector will acquire only communications to or from a target. To the extent compliance problems arise in such collection, the government will apprise the Court in response to its compliance-reporting obligations, and the Court will have the opportunity to respond to the situation. c. Downstream Collection The government raises a threshold issue about whether the abouts limitation has any application to downstream collection at alt. After answering that general question affirmatively, falls within the Court then assesses whether the downstream acquisition the abouts limitation. - - I fOl!l 8R@8Hl9'8Ji8RfI I8f•Olfl@llt!!t!l DATE: Oct 8, 2019 - Authorized Public Release Page 28 of 138 Page 28 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IOP SECRE IhSl)}dRCONJNOFUM◄ (i) Applicability of Abouts Limitation to Downstream Collection Relying on legislative history, the government posits that Congress intended that limitation to apply only to reinstatement of upstream abouts collection, as previously conducted by NSA and discontinued in March 2017, and not to affect downstream collection. See Gov't Response at 1-2. For example, a report of the Senate Select Committee on Intelligence (SSCI) described Section 103 of the Reauthorization Act as "codif{ying] the Intelligence Communitis (JC's) current prohibition on a subset ofFISA collection under [Section 702] known as 'Abouts' Upstream collection." S. Rep. No. 11 S-182 at 1 (2017). A report ofthe House Permanent Select Committee on Intelligence (HPSCl) stated: The Committee understands that the targeting procedures currently used by the NSA to conduct acquisitions pursuant to FISA Section 702 prohibit the acquisition of communications that are not "to" or "from" a FISA Section 702 target. The new limitation established by Section [103) is intended to codffy only current procedures and is not. intended to affect acquisitions currently being conducted under FJSA Section 702. H.R. Rep. No. 115-475, pt. I, at 20 (2017} (emphasis added). Amici point out that the same general expectation was reflected in statements made by multiple members during floor debate on the Reauthorization Act. See Amici Brief at 22-23 & nn.24-25. The government would have us take those statements to the bank. Amici largely concede the point of congressional intent, but argue that Congress might not have understood what particular kinds of info1mation are acquired under Section 702. See id. at 28. They note that the legislative his�o1y of the Reauthorization Act does not discuss hey assert that silence with respect to a form of acquisition of which Congress - - 181•8J!@tt.E'f;'f81f/@ilt@ON:1U.•)F01Uf DATE: Oct 8, 2019 - Authorized Public Release Page 29 of138 Page 29 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IOP SELKEI)}S])}ORCOMNOFURN might not have been aware should not be taken to suggest that the abouts limitation does not apply. See id. at 17. The government, in response, points to, among other things, legislative history of the FJSA Amendments Act of 2008 and litigation involving challenges to directives I .'J t t nee that Congress is fully on notice that the government acquires I nder Section 702. See Gov't Response at 2-4, 7. The Court is not well positioned to assess congressional understanding on this point. In any event, it must be mindful that "(t]he starting point in disceming congressional intent is the existing statutory text." Laime v. U.S. Trustee, 540 U.S. 526, 534 (2004); accord. e.g.. Sebelius v.eCloer, 133 S. Ct. 1886, 1893 (2013) ("As in any statutory construction case, '[w]e start, ofe course, with the statutory text .... "') (quoting BP America Production Co. v. Burton, 549 U.S. 84, 91 (2006)). The plain meaning of that text must be given effect if "the disposition required by the text is not absurd." Laime, 540 U.S. at 534. Here, the text of Section 702(b)(5) does not distinguish between upstream and downstream collection or otherwise refer to how acquisition is conducted. The provision merely describes communications that are not to or frome a target, but contain a reference to a target, and subjects the intentional acquisition of such communications to the notification and delay requirements of Section l 03(b) of the Reauthorization Act. The Court discerns no absurdity in applying the abouts limitation, by its terms, to downstream collection and will adve1i to legislative history below only insofar as ambiguities are confronted in doing so. See Barnhill v. Johnson, 503 U.S. 393, 401 (1992)e ("appeals to statutory history are well taken only to resolve statutory ambiguity") (internal quotation marks omitted); see also Mohamad v. Palestinian Authority, 132 S. Ct. 1702, 1709 - - TOP 8t!@M'f;"'91;1:18tHJON:'N8FOftff DATE: Oct 8, 2019 - Authorized Public Release Page 30 of 138 Page 30 FISC Opinion, Oc t 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 161■SEEi&I;; SlhGit@UM14GI 6164 (2012) ("[R]eliance on legislative history is unnecessary in light of the statute's unambiguous language.") (internal quotation marks omitted); United States v. Gonzales, 520 U.S. 1, 6 (1997) ("Given the straightforward statutory command, there is no reason to resort to legislative history."). (ii) he above analysis of how upstream acquisition of such communications comports with the abouts limitation applies equally to effected downstream. The Court concludes that the downstream acquisition of such communications does not implicate the abouts limitation. amici and the govemment disagree as to whether the abouts limitation applies to this information. The govemment asserts that, consistent with longstanding practice, acquisitions 'f6f SECM'fh'Slf,'6RCOPffNOfiilOIU� DATE: Oct 8, 2019 - Authorized Public Release Page 31 of 138 Page 31 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release under Section 702 can and do include lt is worth noting that "communications" for pur oses of the abouts limitation. The Court does not understand the govemment to assert that 'fOP tn,e1t@'f;'ifJL\181t@ON,'NOFOIUJ DATE: Oct 8, 2019 - Authorized Public Release Page 32 of 138 Page 32 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release he Court finds in re clearly communications for purposes of the abouts limitation. For their acquisition to be autho1ized under the 2018 Certifications, such communications must be to or from a target. The statutory provisions describing the abouts limitation do not speak to this question, so the Court looks next to the broader statutory text and framework of Section 702. Upon a detennination of exigent circumstances under Section 702(c)(2) or the issuance of a FISC order w1der Section 702(j)(3), "the (AG] and [DNI] may authorize jointly, for a period of up to 1 year from the effective date of the autho1ization, the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence infonnation." §o702(a). FISA does not define "foreign intelligence information" in tenns of the nature of theo information itself, but rather the national-security purposes it may serve: for example, the definition includes "infonnation that relates to, and if concerning a United States person is - IOfI Jl!ettftf:HJI/J Oll:00fl:1i8F8ftff DATE: Oct 8, 2019 - Authorized Public Release Page 33 of 138 Page 33 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 98P 0HON•;l;IQl,V8ftO0fl/H0f0Rrt necessary to, the ability of the United States to protect against ... international terrorism, ... the international proliferation of weapons of mass destruction, [and] ... clandestine intelligence activities" by foreign powers and their agents, as well as "infonnation with respect to a foreign power or foreign territory that relates to, and if concerning a United States person is necessary to ... the national defense or the security of the United States." 50 U.S.C. § 1801 (e)(1 )(B)-(C), (2)(A). Notwithstanding this broad charge to acquire "foreign intelligence infonnation" in furtherance of national-security objectives, there are limitations on how acquisitions authorized under Section 702(a) may be conducted and against whom they may be directed. The abouts limitation is now one of them. It appears in Section 702{b) along with five other limitations on acquisitions authorized under Section 702(a). One of those other limitations, like the abouts limitation, applies to a certain type of communication and provides that an acquisition "may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States." § 702(b)(4). The other limitations do not refer to communications. Three of them prohibit the intentional targeting of persons under certain circumstances- e.g., a U.S. person reasonably believed to be outside the United States or anyone known to be in the United States, § 702(b )( 1 )·(3) - while the remaining one states that acquisitions shall be conducted in a manner consistent with the Fourth Amendment. � § 702(b)(6). The statute also provides the means of accomplishing acquisitions authorized under Section 702(a): the AG and DNI "may direct, in writing, an electronic communication service - - IOf•SECREI;;:,u,01tcon,ne1•01tu DATE: Oct 8, 2019 - Authorized Public Release Page 34 of 138 Page 34 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release provider to ...immediateJy provide the Govemment with all infonnation, facilities, or assistance necessary to accomplish the acquisition in a manner that will protect the secrecy of the acquisition and produce a minimum of interference with the services" provided to the target of acquisition. See§ 702(i)(1 )(A). Section 701 of FISA (codified at SO U.S.C. § 1881) defines "electronic communication service provider" to include among other entities: (1) "a telecommunications canier," as that term is defined at 47 U.S.C. § 153.e See§ 70I(b)(4)(A);e (2)e"a provider of electronic communication service, as that tem1 is defined at [18e U.S.C. § 2510(15)]." § 701(b)(4)(B). Section 2510 defines "electronice communication service" as "any service which provides to users thereof thee ability to send or receive wire or electronic communications." J 8 U.S.C.e §e2510(15). It defines "electronic communication," in turn, as "any transfer ofe signs, signals, writing, images, sounds, data, or inteHigence of any naturee transmitted in who]e or in part by a wire, radio, electromagnetic, photoelectronice or photooptical system that affects interstate or foreign commerce," but excJudinge "any wire or oral communication" and certain other types of communications note pertinent here. See § 2510(12); ore (3) "any other communication service provider who has access to wire ore electronic communications either as such communications are transmitted or ase such communications are stored." § 701 (b)(4)(D).e The govemment clearly may acquire communications under Section 702 subject to the I I ii .I DATE: Oct 8, 2019 - Authorized Public Release Page 48 of 138 - Page48 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 1f8P S@CR@111f,1EIIXOM!CON/fiOFORf l See page 6 above. Each agency's procedures nonetheless make clear that the querying and minimization procedures are to be read and applied together. See, e.g.• NSA Querying Procedures§ I at 1 ("These querying procedures should be read and applied in conjunction with [the separate] minimization procedures, and nothing in these procedures penuits any actions that would otherwise be prohibited by those minimization procedures."); FBI Querying Procedures §e1 at 1 (same); NSA Minimization Procedures§ I at 1 (''These minimization procedures apply ine addition to separate querying procedures.... [They] should be read and applied in conjunction with those querying procedures, and nothing in these procedures pennits any actions that would otherwise be prohibited by those querying procedures."); FBI Minimization Procedures§ I.A at 1 (same). The Court therefore will assess whether each agency's minimization procedures, in conjunction with the corresponding querying procedures, satisfy§ 180l(h). B. Recordkeeping Reguirement for U.S.-Person Query Terms The statute's text plainly requires the relevant agencies, including the FBI, to keep records of U.S.-person query terms used to query Section 702 infonnation. The FBI's practice of keeping records of all query tenns in a manner that does not differentiate U.S.-person terms from other tenns is inconsistent with that requirement. The Court begins with the statute and a textual analysis and then separately explains why the government's arguments regarding text, legislative history, and policy considerations do not alter the outcome. I.e Backeround As noted above, the querying procedures must "include a technical procedure whereby a record is kept of each United States person query tem1 used for a query." § 702(f)(l)(B). The - - iJ0P Q!QQllliifll:'1'01?QRQOJJ1tiOFQIHf DATE: Oct 8, 2019 - Authorized Public Release Page 49 of 138 Page49 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 101•Sl!:Cftl!:1"""'etteen,,u,,ettN querying procedures for each agency define "United States person que1y tenn" as "a term that is reasonably likely to identify one or more specific United States persons," which "may be either a single item of infonnation or inforn1ation that, when combined with other infonnation, is reasonably likely to identify one or more specific United States persons." CIA Querying Procedures§ III.A at 1; NCTC Querying Procedures§ Ill.A at 1; FBI Querying Procedures §eIII.A at 1; NSA Querying Procedures§ III.A at l. Depending on context, "names or uniquee titles," "government-associated personal or corporate identification numbers," 1d "street address, telephone, an ould all constitute United States-person query tenns. See CIA Querying Procedures§ ULA at 2; NCTC Querying Procedures§ III.A at 2; FBI Querying Procedures §eIll.A at 2; NSA Querying Procedures§ IlJ.A at 2.e Each agency's querying procedures require the agency to "generate and maintain an electronic rec-0rd of each United States person query tenn used for a query of unminimized infonnation acquired pursuant to section 702." CIA Querying Procedures§ IV.B.1 at 3; NCTC Querying Procedures§ IV.B.l at 3; FBI Querying Procedures§ IV.B.1 at 4; NSA Querying Procedures§ IV.B.1 at 4. If, however, "it is impracticable" for a particular system "to generate an electronic record," or if "an unanticipated circumstance ... prevents the generation" of an electronic record, the agency "must generate and maintain a written record of each United States person query tenn that contains the same information required for electronic records." CIA Querying Procedures§ JV.B.3 at 4; NCTC Querying Procedures§ IV.B.3 at 4; FBI Querying Procedures§ IV.B.2 at 4; NSA Querying Procedures§ IV.B.2 at 4. Agencies may run queries on TAP SFCPET/JSI//OPCOtJ IIJOEOP):- DATE: Oct 8, 2019 - Authorized Public Release Page 50 of 138 Page 50 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release ,_ JOI SECRElllbliiGJl@Cll!!IOL Ski systems that do not generate electronic records only when necessary for "technical, analytical, operational, or security reasons." CIA Querying Procedures§ IV.BJ at 4; NCTC Querying Procedures§ N.B.3 at 4; FBI Querying Procedures§ IV.B.2 at 4; NSA Querying Procedures §eIV.B.2 at 4. The agencies must maintain their electronic and written records for at least fivee years from the date of the query (or in the case of NSA for at least five years from the date of approval to use a United States-person query teim to query content infonnation). See CIA Querying Procedures§ IV.B.4 at 4; NCTC Querying Procedures§ IV.B.4 at 4; FBI Querying Procedures§ IV.B.3 at 4-5; NSA Querying Procedures§ IV.B.3 at 4. For the CIA, NCTC, and the FBI, the electronic record must include "the query term(s) used," "the date of the query," and "the identifier of the user who conducted the query." CIA Querying Procedures§ IV.B.l at 3; NCTC Querying Procedures§ IV.B.1 at 3; FBI Querying Procedures§ IV.B.1 at 4. NSA 's use of United States-person query terms "to identify and select unminimized section 702-acquired content,, infonnation requires prior approval by its Office of General Counsel. See NSA Querying Procedures§ N.A at 3. The duration of such approvals may not exceed one year, but may be extended in increments of one year. Id. The electronic record for NSA' s use of a United States-person query term accordingly must include "the query term(s) used or approved"; "the date of the query or approval of the query terms(s)"; "the identifier of the user who conducted the query or sought approval of the query term(s)"; and "in the case of content queries, the approving official in NSA 's Office of General Counsel and duration of the approval." § IV.B.l at 4. - - T8F QIIOMIT#QIOOftQO)UflOliOIUI DATE: Oct 8, 2019 - Authorized Public Release Page 51 of 138 Page 51 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release . IOI SECREl)JSIJJORCOICJJCOI Ofo◄ Unlike the other agencies, the FBI "intends to satisfy the record-keeping requirement by keeping a record of all queries" of un-minimized Section 702 infonnation. See FBI Querying Procedures § JV .B.3 at 4 n.4 (emphasis added). The re..c;ulting FBI records, in other words, will not distinguish between United States-person query tenns and other query tenns. See March 27, 2018, Memorandum at 27. In fact, the government represents that the FBI already keeps records of all Section 702 query tenns without distinguishing between U.S.-person query tenns and non­ U.S.-person query tenns and contends that Section 702(f)(I)(B) requires no change. See id. at 26. 2. Application of Section 702({)(1)(8) to FBI Recordkeeping Practices The issue presented by the FBl's current recordkeeping is straightforward: Is the requirement for "a technical procedure whereby a record is kept of each United States person query tenn used for a query" satisfied by a procedure that results in records that do not indicate whether tenns are United States-person query tenns? The plain meaning of the statutory text suggests that the answer is "no." a. Textual Analysis A "record" serves to memorialize information. See, e.g., Black's Law Dictionary (I0th ed. 2014) (defining "record" as, among other things, "1. A documentary account of past events, usu. designed to memorialize those events"); Webster's II New College Dictionary 927 (2001) (defining "record" as "l. a. An account, as of infonnation, set down esp. in writing as a way of preserving knowledge. b. Something on which such an account is made... 2. Jnfonnation or data on a specific subject collected and preserved"). Section 702{f)( 1 )(B) identifies "each United marSFCRET((SJ(PRCON'NOFARN DATE: Oct 8, 2019 - Authorized Public Release Page 52 of 138 Page 52 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - fJiOPfiiillliTf!61'.'0RCOt:'.DJOFOPN States person query tem1 used for a que1y" as the infonnation that must be memorialized. The government argues that records that document all terms used to query Section 702 information, regardless of whether the te1m is a United States-person query tenn or not, satisfies Section 702(t)(l)(B) because that provision "does not include any other tenn, such as 'separately' or 'segregated,' specifying that United States person query tenns must be retained apart from other queries." March 27, 2018, Memorandum at 27; see also Gov't Response at 28-29 (statute "does not include any additional language specifying that U.S. person query tenns must be retained separate and apart from other queries"). The government's argument, however, misses the essential aim of the recordkeeping requirement, which is to memorialize when a United States-person query tem1 is used to query Section 702 infonnation. Just as records of all applicants admitted to a university are not records of out-of-state applicants admitted if they do not differentiate out-of-state from in�state, records that do not memorialize whether a query tenn used to query Section 702 data meets the definition of a United States­ person query tenn do not preserve the infom1ation specifically required by Section 702(f)( l)(B). Section 702(f)(J)(B), moreover, imposes a recordkeeping requirement only for queries that use United States-person que1y terms, not for all que1ies. It is not reasonable to expect Congress to have focused on the circumstance of an agency's generating records for all its Section 702 query tenus and to have explicitly reiterated that, in such a case, the records must document which of those query tenns are United States-person query tenns. The language Congress chose to enact clearly conveys that the records are meant to memorialize when United Sflfilt? .'itilPH P.lifl/JI.GH:'JIAH PAfJ:'l'J Af>Afth DATE: Oct 8, 2019 - Authorized Public Release Page 53 of 138 Page 53 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - 5f8P 8E@RE5fh181:1;10R@ON:'�fOFOWI States�person query terms are used, and the FBI is obligated to keep records that do so, regardless of whether it also keeps records for other query terms. The government also argues that, in light of an exemption from certain aspects of public reporting required by Section 603 ofFISA (codified at 50 U.S.C. § 1873), Section 702(f)(l)(B) should not be read as requiring the FBI to alter its current rec-0rdkeeping practices. Section 603 requires the DNI to repo1t publicly on, among other things, "the number of search tenns conceming a known United States person used to retrieve the unminimized contents of electronic communications or wire communications obtained" under Section 702 and "the number of queries concerning a known United States person of unminimized noncontents infonnation relating to electronic communications or wire communications obtained" under Section 702, §e603(b)(2)(B)-(C); however, "information or records held by, or queries conducted by," the FBIe are explicitly exempted from that reporting, except insofar they relate to FISC orders issued under Section 702(f)(2). See§ 603(d)(2)(A). The government attributes this exemption of FBI queries to congressional recognition that the FBI lacked the capacity to provide the relevant information. See March 27, 2018, Memorandum at 29 (quoting H.R. Rep. No. 114-109, pt. 1, at 26 (2015) ("the FBI is exempted from repo1ting requirements that the agency has indicated it lacks the capacity to provide")). The government suggests that because Congress generally exempted FBI queries from the DNI's annual reporting (only requiring reporting for FBI queries that relate to Section 702(f)(2) orders), the recordkeeping requirement of Section 702(f)(l)(B) should be read to make similar allowances for the FBI's limited capabilities. See March 27,2018, Memorandum at 30 'f'OP 9ECRf;'fh'Slh'ORCONi'NOFORN DATE: Oct 8, 2019 - Authorized Public Release Page 54 of 138 Page 54 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IIGI■SECMf;;91;;61tl!8JM(8fi8Rff (Congress ·•presumably would have included such queries in the statistics required to be reported in the annual DNI report" if it had "intended for FBI to distinguish and separately track United States person queries."). The premise of the government's argument is that the only purpose for keeping records that identify United States-person query tenns is to satisfy the DNI's reporting obligations. That premise is belied by the government's own briefing, which acknowledges oversight of the agencies' querying practices as another purpose of Section 702(f)(l )(B)'s recordkeeping requirement. See March 27, 2018, Memorandum at 27. Because the recordkeeping requirement serves a purpose separate from the reporting obligations, there is no inconsistency between exempting from public repo1ting the number of U.S.-person queries conducted by the FBI and requiring the FBI to keep records that identify which Section 702 query ten11s are United States-person query terms. The explicit exemption set forth in Section 603(d)(2)(A) demonstrates, moreover, that if Congress intended for Section 702(t)(l )(B) to make similar allowances for the FBI, it would have been easy to provide for them expressly. In support of its position, the govemment also cites Section 112 of the Reauthorization Act, which requires the Inspector General of DOJ to repo1t to Congress on the FBJ's implementation of querying procedures within one year of their approval by the FISC. See March 27, 2018, Memorandum at 31. In addition to requiring the Inspector General to assess several aspects of FBI' s implementation of the querying procedures, Section 112 requires the Inspector General to assess any impediments, including operational, technical, or policy impediments, for Lhe [FBI] to count (A)ethe total number of queries where the FBI subsequently accessed informatione acquired w1der ... section 702;e TOP SECftE'fh'SIHORCONtNOFOR:N DATE: Oct 8, 2019 - Authorized Public Release Page 55 of 138 Page 55 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f 811 S661l:IHW61:4'QACQN,~0'60;A:i>l (B)ethe total number of such queries that used known United States person ident{fiers; ande (C) the total number of queries for which the [FBI] received an order of thee Foreign Intelligence Surveillance Court pursuant to [Section 702(f)(2)].e § l 12(b)(8) (emphasis added). The government argues that Congress recognized "the limitationse of FBI systems' technical record-keeping function" when it enacted Section 112, and that this provision makes clear it "did not intend to impose any new obligation on the FBI to differentiate queries based on United States person status." March 27, 2018, Memorandum at 31; see also Gov't Response at 30 ("lf, as amici claim, the Reauthorization Act newly mandates that FBI separately track U.S. person query terms, a new statutory directive requiring an IG report discussing 'impediments, including operational, technical or policy impediments' to do that very thing would be pointless."). The government's ar&,,ument ignores that Section l 12(b)(8)(C) of the Reauthorization Act directs the Inspector General to rep01i on impediments to the FBI's counting ofU.S.-person queries for which it receives a FISC order under Section 702(f)(2) - information the DNI is explicitly required to report under Section 603 ofFISA, as amended by the Reauthorization Act. See FISA § 603(b)(2)(B) & (d)(2)(A), as amended by Reautho1ization Act §e102(b)(2)(B)(ii).e Amici contend that Congress did not acquiesce in cuITent FBI practices, but rather imposed new recordkeeping requirements and deputized the Inspector General to scrutinize how the FBI implements them . See Amici Brief at 80-81. Amici have the better of the exchange. Congress can sensibly be understood to have directed the Inspector Genera] to assess impediments toward the FBl's counting queries that employ U.S.-person identifiers as query - - TOP t!tlH!!R@'.f1,IJIOt%'0ROOfll'JIQFQftll DATE: Oct 8, 2019 - Authorized Public Release Page 56 of 138 Page 56 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 'ifl8P S@CJRElfh'SIOORCJON,'J>JO�RN tenns (Reauthorization Act§ 112(b)(8)(B)), while simultaneously requiring the FBI and other agencies to maintain records necessary to perfom1 that count. b. Le�islative History The government further argues that the legislative history of the Reauthorization Act supports its conclusion that the FBI's recordkeeping is consistent with Section 702(f)(l)(B). Even if one assumes arguendo that the statute is reasonably susceptible to the government's interpretation, such that ambiguity justifies recourse to legislative history,� Part JII.B.2.c(i) above, the government's arguments are unavailing. The government points to the following statement in a HPSCI report: [Section 702(f)(] )(B)] does not impose a requirement that an Intel1igence Community element maintain records of United States person que,y terms in any particular manner, so long as appropriate records are retained and thus available for subsequent oversight. This section ensures that the manner in which [an agency] retains records of United States person query terms is within the discretion of the Attorney General, in consultation with the Director of National Intelligence and subject to the approval of the FISC. H.eRep. No.115-475, pt. 1, at 18 (emphasis added) (quoted in March 27, 2018, Memorandum ate 27). The government suggests that the FBl's recordkeeping practices reflect a pennissible exercise of the discretion of the AG and the DNI «to detennine how an agency would keep records of queries in a manner that allows for meaningful oversight." March 27, 2018, Memorandum at 27 (emphasis added). But the issue presented is whether the FBI's records will memorialize the infom1ation required by the statute. The passage from the HPSCI report cJearly indicates that, however records are kept, they must be ''records of United States query tenns." It provides no reason to think that (I) HPSCJ understood "records of United States person query - - I Ibi•.9ECRfJIJHUlibl\COftftePeftU DATE: Oct 8, 2019 - Authorized Public Release ~ Page 57 of 138 Page57 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release tenns" to include records that do not indicate whether query tenns are United States-person query te1ms, or (2) HPSCI intended to leave that detennination to executive-branch discretion. In addition, the first sentence of the paragraph from which the above quotation is taken describes the required records in language that closely tracks the statutory text: "Section 201 [ of the Reauthorization Act] further mandates that all querying procedures include a provision requiring that a record is kept for each Ui1ited States person que1y term usedfor a query of FISA Section 702 data." H. Rep. No. 115-475, pt. 1, at 18 (emphasis added). HPSCI's reiteration of the "U.S. person" nature of query terms that must be recorded makes clear that the discretionary manner in which an agency keeps the required records does not include the freedom to decide not to record the fact that a query tennis a United States-person query tem1. The report's reference to "subsequent oversight," moreover, is consistent with an intent that the records document use of United States-person query tenns, as such, particularly in view of HPSCI's acknowledgment "that certain lawmakers and p1ivacy advocates wo1ry about the ability of the Intelligence Community to query lawfully acquired data using query tenns belonging to United States persons." Id. at 17. Such oversight would be best served if the records indicate whether a particular query tennis a United States-person query tenn - i.e., a term reasonably likely to identify one or more specific U.S. persons. The govemment also relies on a statement in the same report that "the Committee believes that the Intelligence Community should have separate procedures documenting their current policies and practices related to the querying oflawfully acquired FISA Section 702 data." Id. at 17-18 (emphasis added) (quoted in March 27, 2018, Memorandum at 28). The -TOD £FCDFT//£1//0DCOJ>J/J>:J OFOJlJ\1- DATE: Oct 8, 2019 - Authorized Public Release Page 58 of 138 Page 58 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release rpe,r z,:eettE'f//SJfJ'0ft€0U,1',0fil0RU government argues that, because "Congress understood the FBI's existing practice ... and the limitations of FBI systems' technical record-keeping," the reference to query procedures that document current policies and practices demonstrates HPSCI's intent that the FBI need not alter its recordkeeping in response to Section 702(t)(1 )(B). See March 27, 2018, Memorandum at 26, 28. But the report's generic reference to current po]icies and practices of the Intelligence Community appears in a discussion of the general requirement to adopt querying procedures, not the specific recordk:eeping requirements of Section 702(f)(1 )(B). The report, furthermore, does not mention any technical limitations of FBI systems or desc1ibe, let alone endorse, the FBI­ specific practice of keeping records that do not identify which query terms are United States­ person query tenns. Neither the plain language of the statute nor the plain language of the report cited by the government supports its contention that Congress intended no changes to FBI's existing querying practices in response to the Reauthorization Act. c. Policy Considerations Finally, the government contends that requiring the FBI to maintain records that differentiate United States-person query tenns from other Section 702 query tenns will have adverse consequences. See Supplemental FBI Declaration at 8-15. In his declaration, the Director of the FBI does not desctibe as a source of difficulty any "limitations of FBI systems' technical record-keeping functions." March 27, 2018, Memorandum at 26, 28. Instead, he posits that such a requirement would leave the FBI with two possible means of implementation, neither of which is desirable. Under one option, FBI personnel would conduct research in FBI holdings to infom1 their assessments of which proposed query tenns are United States-person query tenns 'i>0P Sli!CM'¥J¥S1,¥8R0OM,'l'i8F91L'I DATE: Oct 8, 2019 - Authorized Public Release Page 59 of 138 Page 59 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f 8P 813 CJH:il35FOS l:':'9RCOl'Ul>J Oi>OR'\l for pu1poses of Section 702(t)(l)(B). See Supplemental FBI Declaration at 8-9. The Director anticipates that approach would divert resources from investigative work, delay assessment of threat infonnation, and discourage its personnel from querying W11ninimized FISA infonnation, to the dettiment of public safety. Id. at 9-12. He also describes an alternative approach whereby persom1el would be allowed to forgo such research and rely solely on their "personal knowledge" in making those assessments. Id. at 12. The Director expects that practice would "result in inconsistent and unreliable infonnation in FBl systems," id., thereby complicating other aspects of the FBl's work - e.g., implementing its Section 702 targeting procedures. Id. at 13-14. The Director also expresses concern that such an approach would be inconsistent with the FBJ's "strong culture that places great emphasis on personnel consistently conveying true and accurate infonnation." Id. at 14. All of those points raise policy considerations regarding the advisability ofrequiring the FBI to keep records that identify United States-person query terms it has used to query Section 702 infonnation. The Court, it should be emphasized, makes no detennination as to the advisability of a particular policy on this subject. Regardless of how persuasive the FBI 's considerations may be, the Court is not free to substitute its understanding of sound policy- or, for that matter, the understanding of the Director of the FBI - for the clear command of the statute. See 14 Penn Plaza LLC v. Pyett, 556 U.S. 247,270 (2009) ("Absent a constitutional banier, 'it is not for us to substitute our view of ... policy for the legislation which has been passed by Congress."') (quoting Florida Dept. of Revenue v. Picadilly Cafeterias, Inc., 554 U.S. 33, 52 (2008)); Bamhart v. Sigmon Coal Co, 534 U.S. 438, 462 (2002) ("We will not alter - - •or 01]@ftl)1WOU1Qllfil0)J!)IQFOIUI DATE: Oct 8, 2019 - Authorized Public Release Page 60 of 138 Page60 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f6P Sl!:CftE'tWSIJ'f6ftCON{NOFOfttJ the (statutoryJ text in order to satisfy the policy preferences of the Commissioner [ of Social Security]."); Herb's Welding, Inc.v. Gray, 470 U.S. 414,427 (1985) ("[l]fCongress' ... decisions are mistaken as a matter of policy, it is for Congress to change them. We should not legislate for them."). In sum, the Coutt is it is merely enforcing what Section 702(t)(l )(B) plainly imposes. d. Conclusion In sho1t, the Court should follow the "'first canon "' of statutory construction: to presume that Congress says in a statute what it means and means in a statute what it says. Barnhart, 534 U.S. at 461-62 (quoting Connecticut Nat'! Bank v. Germain, 503 U.S. 249, 253-54 (1992)). Section 702(f)(l )(B) plainly states that the querying procedures must include "a technical procedure whereby a record is kept of each United States person query te1m used for a query." That requirement is not satisfied by procedures under which the FBI does not keep such records in a readily identifiable manner. The Court accordingly finds that the FBI Querying Procedures do not comport with Section 702(f)(l )(B). The Supplemental FBI Declaration touches on another point that the Court will address because it may bear on curing this deficiency. Section III.B of the FBI Querying Procedures provides for certain presumptions regarding U.S.-person status. FBI Querying Procedures§ III.B at 3. The Declaration, however, discounts their potential utility in alleviating the problems anticipated by the FBI because "they would genera11y require FBJ personnel to evaluate information in FBI holdings before applying a presumption." Supplemental FBI Declaration at 13 n. 7. But the government can revise those procedures to address specifically what, if any, - - IOP SECREI}}$))}0kCO!tJ!U)Pt!Jffl4 DATE: Oct 8, 2019 - Authorized Public Release Page 61 of 138 Page 61 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification • ODNI Authorized for Public Release - •or Ol!@ftl!�1:'01JIJIOR@OfHf8F8Nf I steps its personnel need to take before relying on presumptions in deciding what tenns to treat as United States-person query tenns for purposes of Section 702(f)( 1 )(B). Such revised procedures, of course, wou]d be subject to FISC review pursuant to Section 702(i). In any event, there are clearly some queries for which FBI personnel know they are using United States-person query tenns, and the obligation to keep adequate records of those te1ms pursuant to Section 702(f)( 1 )(B) will be readily apparent. Finally, the Court does not ho]d that the FBI must immediately deploy a comprehensive technical means of generating appropriate records. So long as it is taking serious steps toward implementing such teclmical means, it may rely on "written" records, as desciibed at FBI Querying Procedures § IV.B.2 at 4. C. FBI Querying Practices and Statutory and Constitutional Requirements The Court next independently finds that tl1e FBI's repeated non-compJiant queries of Section 702 infonnation preclude (1) a determination that its minimization and querying procedures are reasonably designed to minimize the retention, and prohibit the dissemination, of private information concerning U.S. persons, consistent with the government's foreign­ intelligence needs, and (2) a finding that such procedures are consistent with the requirements of the Fourth Amendment. This section begins by describing the role of querying rules within minimization procedures and discussing the reasonableness of the FBl's querying standard, as written. The Court then reviews numerous instances of non-compliance with that standard and three factors that contribute to the Court's concerns about the FBI's querying practices. The Court then - I or 8R@A!i@IJj'.JIQtt'OABUfliJJOPOIUl DATE: Oct 8, 2019 - Authorized Public Release Page 62 of 138 Page62 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 'f6P Sl!J@ftl5'fh:SIOOR!CON:1N8F8Rf4 considers steps the government has taken to respond to non-compliant queries, including requiring FBI personnel to obtain attorney approval before examining content infonnation returned by certain categorically justified queries, and concludes they are insufficient to suppmt the required findings. Finally, the Court examines amici's proposal regarding FBI documentation of query justifications, adoption of which the Court believes would remedy the deficiency. 1. Querying and Effective Minimization The Foreign Intelligence Surveillance Court of Review (FISCR) has instructed: By minimizing retention, Congress intended that "infonnation acquired, which is not necessary for obtaining[,] producing, or disseminating foreign intelligence infom1ation, be destroyed where feasible." Furthenuore, u[e]ven with respect to information needed for an approved purpose, dissemination should be restricted to those officials with a need for such infom1ation." In Re Sealed Case, 3 JO F.3d 717, 731 (FISCR 2002) (per curiam) (quoting H.R. Rep. No. 951283, pt. 1 at 56 (1978) and adding emphasis; internal citations omitted). Notwithstanding that preference for destruction of non-pertinent information when feasible, the F[SC has approved minimization procedures that pe1mit retention for considerable pe1iods of time, even after infonnation has been reviewed and not found to relate to foreign intelligence or evidence of crime. See, e.g.. 2016 FBI Minimization Procedures§ Ill.G.l .bat 23 (such information may be retained for up to 15 years, with enhanced access controls in place after ten years). The FBI minimization procedures now before the Cou1t propose the same approach. See September 18, 2018, FBI Minimization Procedures§ III.D.4.c at 17 (same). The reasonableness of such a retention period rests in part on the "complex and time-intensive nature - - 'il?OP 06ilillii' ':11>I11QRCON C>IQEQP)I DATE: Oct 8, 2019 - Authorized Public Release Page 63 of 138 Page 63 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOf•SELKEI})sm ORCOl◄JICOJI6ftU of piecing together, and making sense of, the myriad pieces of information gathered during a lengthy surveillance." United States v. Mubayyid, 521 F. Supp. 2d 125, 134 (D. Mass. 2007) (finding retention of FISA intercepts for ten years reasonable in circumstances of case). But it also importantly depends on querying rules and other access restrictions that guard against the p.and indiscriminate review and use ofU.S.-person information. See Order, May 17, 2016 ("May 17, 2016, Opinion") at 25 ("because raw FISA-acquired infonnation nay be accessible by large numbers of persons in the FBI for a wide variety of investigative and analytical purposes, it is especially impmtant for U.S. person infonnation on those systems to be subject to appropriate access restrictions," including querying rules); id. at 43 ("substantive standards for s.querying data" "guard against indiscriminate or improper accessing or use of U.S. person information"); em. Op. and Order, Nov. 6, 2015 ("November 6, 2015, Opinion") at 24 (relying on "several important restrictions" of CIA and NSA minimization procedures for §a702, "[m]ost notably" that all tenns used to query the contents of communications must bea "reasonably likely to return foreign intelligence infom1ation") (internal quotation marks omitted). The govemment notes that agency personnel do not need to run queries to find and examine Section 702 infonnation concerning United States persons. They can, for example, review Section 702 data on a communication-by-communication basis and thereby encounter U .S.-person infom1ation. See Gov't Response at 14-15. Despite the availability of that alternative, the rules for U.S.-person queries - i.e., queries that use a "United States person query term" as defined at FBI Querying Procedures §Ill.A-are important to proper minimization of - - TOP 8@eR:E1'¢110tJ;f8'.R@ONfN8FORN DATE: Oct 8, 2019 - Authorized Public Release Page 64 of 138 Page64 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - IIbl•SECltZ lll31l:c5R@c5ff;lf8fi!8ftff - Section 702 infonnation. The government's own submissions emphasize the operationa1 importance of the FBI being able to query infonnation and the large number of que1ies of FISA infonnation conducted by the FBI. See, e.g., Supplemental FBI Declaration at 6 ("[ d]atabase queries are a critical tool," and in one system during fiscal year 2017, FBI ran approximately 3.1 million queries "against raw FISA-acquired infonnation ..., including section 702-acquired information"). Given the importance and prevalence of querying, it is a logical focus for efforts to balance protection of U.S. persons' privacy interests against foreign-intelligence needs. The enactment of Section 702(f) indicates Congress drew a similar conclusion. Indeed, the rules for U.S.-person queries are especially important for minimization of Section 702 information. Section 702 provides a means for the government to target individuals who are reasonably believed to be non-U.S. persons located outside the United States. See §e702(b)(1), (3) (prohibiting intentional targeting of U.S. persons and any persons located insidee United States); (d)(l)(A) (requiring targeting procedures reasonably designed to ensure only persons reasonably believed to be located outside United States are targeted). The government may acquire the full contents of communications under Section 702 without a finding of probable cause, as is needed for electronic surveillance and physical search w1der FISA. See 50 U.S.C. §§ l 805(a)(2), I 824(a)(2). When the government queries Section 702 data to identify ande examine infonnation about a particular U.S. person, moreover, it typically has an investigative or analytical interest regarding that person, who necessarily was not a target of the acquisition. As suggested by amici, it can also result in a further intrusion into the privacy of such U.S. persons, who may have enjoyed "the protection of anonymity" until inforn1ation concerning them was - - IJOP iii ill.iii flil'.'.92GOll '.tIOEOPN DATE: Oct 8, 2019 - Authorized Public Release Page 65 of 138 Page 65 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release retrieved by use of an individualized U.S.-person query directed at them. See Amici Reply at 9. And FBI queries intended to retrieve evidence of crime may be conducted in the course of law­ enforcement investigations that are unrelated to national-security threats. The FBI's querying practices under Section 702 are especially important because the FBI conducts many more U.S.-person queries than the other agencies. In 2017, NCTC, the CIA, and NSA collectively used approximately 7500 terms associated with U.S. persons to query content information acquired under Section 702, see Amici Brief at 51 n.47; Gov't Response at 32, while during the same year FBI personnel on a single system ran approximately 3.1 million queries against raw FISA-acquired information, including section 702-acquired information. See Supplemental FBI DecJaration at 6. (As explained above in Part IV .B. l, FBI records do not differentiate between U.S.-person query tem1s and other query tenns, but given the FBI's domestic focus it seems likely that a significant percentage of its queries involve U.S.-person query tenns.) The large number of U.S.-person queries run by the FBI makes its querying practices significant, despite its receiving only a small percentage of the total information acquired under Section 702. See Gov't Response at 26-27 (it was reported in October 2017 that FBI received infonnation for approximately 4.3% of persons targeted under Section 702). 2. The FBl's Querying Standard The FBI Querying Procedures require: "Each query of FBI systems containing unminimized content or noncontent 1nfonnation acquired pursuant to section 702 of [PISA] must be reasonably like(}' to retrieve.foreign intelligence i�formation, as defined by FISA, or evidence ofa crime, unless otherwise specifically excepted in these procedures." FBI Querying ICCSFGPET((SJ 119969N019FOPN DATE: Oct 8, 2019 - Authorized Public Release Page 66 of 138 Page66 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - II01IIQIU!IRBT!i81:;i8ROOHJIOliiftfl - Procedures§ IV.A. 1 at 3 (emphasis added). (Certain of those exceptions are discussed below in Part IV.D.) As written and in the context of restrictions on the use and disclosure ofU.S.-person information within the FBI Minimization Procedures, that querying standard is consistent with the statutoiy definition of minimization procedures; however, as implemented by the FBI, it is not. The minimization procedures now in effect a1ticulate the standard for FBI queries of Section 702 infonnation differently: "To the extent reasonably feasible," FBI personnel "must design" queries of unminimized Section 702 information "to find and extract foreign intelligence information or evidence of a crime." 2016 FBl Minimization Procedures § IIJ.D at 11. The government represents that "[i]n practice, the applicable standard remains the same .... " March 27, 2018, Memorandum at 24. Counsel for the government has characterized the FBI querying standard as a high one, having three elements: (1) a query cannot be "overly broad," but rather must be designed to extract foreign-intelligence infonnation or evidence of crime; (2) it must "have an authorized purpose" and not be run for personal or improper reasons; and (3) there must be "a reasonable basis to expect [it] will return foreign intelligence infonnation or evidence of crime." July 13, 2018, Proposed Tr. at 9; see also March 27, 2018, Memorandum at 25 (there must be "a reasonable basis to believe the query is likely to return foreigri intelligence information or, in the case of the FBI only, evidence of a crime."). The FBI querying standard - as written and as explicated in the manner summarized above - presents no impediment to finding that the FBI Querying Procedures and FBI Minimization Procedures satisfy the definition at § 180 I (h). Queries that are reasonably likely to - - JjQRiitieGPST11ti:111APGAN'NOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 67 of 138 Page67 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - I·OP SECREI11SiJJORCOMNOllORI•- return foreign-intelligence infom1ation, are conducted for that purpose, and avoid overbreadth should contribute to the minimization of private lJ.S.-person infonnation, consistent with foreign-intelligence needs, as contemplated by§ 180l(h)(l). (The same conclusion holds for the querying standards applied by the other agencies, which require queries to "be reasonably likely to retrieve foreign intelligence information," unless specifically excepted. See NCTC Querying Procedures§ IV.A at 3; CIA Querying Procedures§ IV.A at 3; NSA Querying Procedures§ IV.A at 3.) FBI queries that are reasonably likely to retum evidence of c1ime comport with § 180 I (h) for reasons explained at pages 30-36 of the November 6, 2015, Opinion and adopted herein. 3.e Non-Compliance with the Ouervin2 Standard FISC review of minimization procedures under Section 702 is not confined to the procedures as written; rather, the Court also examines how the procedures have been and will be Mem. Op., Apr. 7, 2009, at 22•24; Docket Nos. em. Op., Aug. 30, 2013, at 6-11. In this case, the government contends that the FBl's implementation of the querying standard has provided appropdate protection for U.S. persons' privacy. See Gov't Response at 32-33. For reasons explained below, the Court does not agree. Since April 2017, the government has reported a large number of FBI queries that were not reasonably likely to return foreign-intelligence infonnation or evidence of crime. In a number of cases, a single improper decision or assessment resulted in the use of query terms corresponding to a large number of individuals, including U.S. persons. In brief: • During March 24-27, 2017, the FBI' nducted queries using identifiers for over 70,000 communication facilities "associated with" -•or - Ol!@ltl!if,�'01;iJIOROOUIJt0JiOBPf DATE: Oct 8, 2019 - Authorized Public Release Page 68 of 138 Page 68 FISC Opinion, Oct. 2018 I Of SELKE I ))31))0RCOIUl ◄ Uit01Cf4 )ersons with access to FBI facilities and systems. See Nov. 22, 2017, Notice at 2. roceeded with those queries notwithstanding advice om 1e ice o eneral Counsel (OGC) that they should not be conducted without approval by OGC and the National Security Division (NSD) of the Department of Justice. Id. at 3. The FBI did not examine the results of those queries. Id. [Most of the notices of non-compliant queries cited herein have a title including the language: "Notice of Compliance Incident[ s] Regarding FBI' s Querying of Raw FISA-Acquired Jnfonnation Including Infonnation Acquired Pursuant to Section 702 of FISA, and Storage of those Query Results.'' Those notices are dted in the fonn of "[Filing Date] Notice." If multiple notices were filed on the same date, their citations are distinguished by reference to the relevant FBI office.] Apr. 12, 2018, Notice at 2. The 1 10 con uc e 1ose quenes advised he did not intend to run them against raw FISA information, but nonetheless reviewed raw FISA infonnation returned by them. Id. • On February 5 and 23, 2018, the FBl's approximately 30 queries regarding potential persons who here the subject of a investigation was See June 7, 2018, Notice at 2-3. • On February 21, 2018, the FBI's queries to retrieve info1111ation on persons - n d e r consideration as potential sources o May 21, 2018, Notice at 2-3. The government acknowledges that such queries generally resulted fi:om "fundamental misunderstandings by some FBI personnel [about] what the standard 'reasonably likely to return foreign intelligence information' means." July 13; 2018, Proposed Tr. at 49. I 61 BIS@llf51!191:i 0Ri!SOH:¥f0ifl8Aff DATE: Oct 8, 2019 - Authorized Public Release Page 69 I 31 i!IE@UISl!iSl!i OR@Off:HOFORff In addition, the government has reported queries of infonnation believed to have been obtained under Title I or V of FISA (not Section 702) that it characterizes as potentially non­ compliant. See Prelim. Notice of Possible Compliance Incident Regarding FBI's Querying of pr. 27, 2018, Notice"). Those Raw FISA-Acquired Infonnation, Apr. 27, 2018 queries were govemeq by a querying standard that requires FBI personnel, "'[t]o the extent reasonably feasible,"' to "'design ... queries to find and extract foreign intelligence information or evidence of a crime."' Id. at l (quoting Standard Minimization Procedures for FBI Electronic Surveillance and Physical Search Conducted Under PISA, May 17, 2016, § lll.D.3.b at 18). The government understands that standard "to mean that the query te1111s must be reasonably likely to return foreign intelligence information,' pril 27, 2018, Notice at 2, which is equivalent to the Section 702 standard for foreign-intelligence queries. Specifically, the government reported that an unspecified FBI unit "conducted what may be considered queries against raw FISA-acquired [metadata] ... using what appear to be identifiers of approximately 57,000 individuals who work (The notice also refers to "queries of the 57,000 identifiers," vice ''individuals." Id.) The date of the queries is not provided, though it is reported that the FBI infon11ed NSD of them on April 13, 2018. Id. As of April 27, the government was examining whether the queries were reasonably likely to return foreign-intelligence infonnation. Id. At the argument on September 28, 2018, cow1sel for the government advised that internal discussions of the adequacy of the justification for those queries were continuing and agreed to update the Court within 60 days. Sept. 28, 2018, Proposed Tr. at 30-31. TQP SFGPET 11SJ 110PCON'NOEAPN DATE: Oct 8, 2019 - Authorized Public Release Page 70 TOP fJECIHJH'/i'fJlh'ORCON,'NOf:ORN The government has also disclosed misapplications of the FBI querying standard that are similar to those described above, except that they involved queries of Section 702 data to return infonnation for just one person: conducted a guery See May 1, 2018, Notice at 2-3. onducted a query on before servmg a classified order on onducted a query on a • On November 11, 2017, the FBI' potential recipient of a FISA order. Apr. 24, 2018, Notice at 2. The government has reported a number of other non-compliant queries of Section 702 infonnation by the FBI, which do not appear to result from comparable misunderstandings of the querying standard. Those include: • A small number of cases in which FBI personnel apparently conducted queries for improper personal reasons - for example, a contract linguist who ran queries on himself: other FBI employees, and relatives. See Jan. 30, 2018, Notice at 1-2. • A number of instances in which FBI personnel inadve1tently ran queries against Section 702 infonnation. See, e.g.• May 8, 2018, Notice ov. 27 2017 Notice • A set of queries (overlapping to some extent with the set of inadve1tent queries nts or material. of Section 702 data) apparently inte1 May 4, See, e.g., May 17, 2018, Notice at 2 2018, Notice at 2 1iQR liiiliiiCIHilif((tiJJ((QPGONNOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 71 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - •or 1!113@!1tlfJ;'.:IQl;l;l8ROQff11QJiQRiltl Those instances of non-compliant queries, in the Comt's view, do not present the same level of concern as those that evidence misw1derstanding of the querying standard. It would be difficult to completely prevent personnel from querying data for personal reasons. As a general rnle, inadvertent queries of Section 702 infonnation and queries intended to retrieve finished intelligence reports or other FBI work product do not seem likely to return raw 702 infonnation or, if they happen to do so, to result in personnel examining U.S.-person infonnation contained therein, the above-described queries regarding notwithstanding. 4. Factors Contributine to the Court's Concerns Of serious concem, however, is the large number of queries evidencin a misunderstanding of the querying standard -- or indifference toward it: queries were conducted against the advice of FBI OGC. That concern is heightened by three factors: (I) limitations on the govemment's oversight mechanisms; (2) the FBI's policy to encourage routine and maximal querying of Section 702 infom1ation; and (3) apparent complications in applying the querying standard. The Court discusses each. a. Limitations on Oversieht As noted above, in 2017 the FBI conducted over three million queries of PISA-acquired See Supplemental FBI Declaration at 6. In infonnation on just one system contrast, during 2017 NSD conducted oversight of approximately 63,000 queries ii 274,000 queries in an FBI system - See Gov't Response at 36. - . I01 Jl!Cltl!:Pn9t;elt@t)N:fff8P8Mi DATE: Oct 8, 2019 - Authorized Public Release nd Page 72 of 138 Page 72 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release _ , IOP SECREI})Si,JURCOl◄JNUl1 - 01 DATE: Oct 8, 2019 - Authorized Public Release Page 83 of 138 Page 83 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release T 0 f .@Jl3 01lllT,';l(JIN0 no OHJ JO 13 0 Rf l b. Fourth Amendment Deficiency Applying the totality-of-circumstances analysis the FlSC employed in previous Section 702 proceedings, the Court finds that the FBI Minimization Procedures and Querying Procedures are similarly unreasonable under the Fourth Amendment. (i) Applicable Fourth Amendment Framework The Fourth Amendment states: The light of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, sha11 not be violated, and no Wan-ants shall issue, but upon probable cause, supported by Oatl1 or affinnation, and particularly describing the place to be searched, and the persons or things to be seized. U.S. Const. amend. IV. "The touchstone ofthe Fourth Amendment is reasonableness." In re Certified Question of Law, 858 F.3d 591,604 (PISA Ct. Rev. 2016) (per curiam) ("In re Certified Question"). Although "[t]he wa1rnnt requirement is genera11y a tolerable proxy for 'reasonableness' when the govemment is seeking to unearth evidence of criminal wrongdoing> ... it fails properly to balance the interests at stake when the government is instead seeking to preserve and protect the nation's security from foreign threat." Id. at 593. Accordingly, a warrant is not required to conduct surveillance "to obtain foreign intelligence for national security purposes ... directed against foreign powers or agents of foreign powers reasonably believed to be located outside the United States." See In re Directives Pursuant to Section 105B ofFISA, 551 F.3d 1004, 1012 (FISA Ct. Rev. 2008) ("In re Directives"). The FISC has repeatedly reached the same conclusion - I IStt@Cllli:SL 5121 161 SE@flbi!lblll DATE: Oct 8, 2019 - Authorized Public Release Page 84 of 138 Page 84 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f8P SECftE1ifY/St,1#8RCONs'l'4OFOftN regarding Section 702 acquisitions. See, e.g., November 6, 2015, Opinion at 36�37; September 4, 2008 Opinion at 34-36. In assessing the reasonableness of a governmental intrusion under the Fomth Amendment, a court must "balance the interests at stake" under the "totality of the circumstances." In re Directives, 551 F.3d at 1 OJ 2. In prior reviews of Section 702 procedures, the FISC has assessed the reasonableness of the government's procedures as a whole, rather than separately analyzing the reasonableness of discrete fmms of action taken thereunder, such as querying. See, e.�.. November 6, 2015, Opinion at 39 (assessing ''the combined effect" of the targeting and minimization procedures ). Amici, however, argue that the Court should regard querying as a separate Fourth Amendment event subject to its own reasonableness analysis. See Amici Brief at 57-59. First, they contend that the Reauthorization Act mandates that the querying procedures be constitutional in their own right. Id. at 48 ("Section I 01 requires the Attorney General, in consultation with the DNI, to establish Querying Procedures relating to 702-acquired infonnation that comport with the Fourth Amendment" and citing § 702(f)). Amici also point to Section 702(f)(2), which requires the FBI, in specified narrow circumstances, to obtain a FISC order before examining content information retrieved by querying Section 702 data, as mandating a change to the Court's analysis. � id. Amici argue that by enacting that requirement "Congress has acknowledged the reality that FBI agents querying databases containing raw 702 infonnation for a variety of purposes are, in effect, undertaking new 'searches,' some of which now require a court order." Amici Brief at 56-57. �OP 0@CIU,�'{0lh'ORCJON{l\l8F8ftfJ DATE: Oct 8, 2019 - Authorized Public Release Page 85 of 138 Page 85 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - •ifOP QIU.iRBif;f:161#QftOOfl '.JfQfCDll Amici also argue that reviewing querying as an independent Fourth Amendment event would be in line with evolving case law. See id. at 57 (citing Riley v. California, 134 S.Ct. 2473, 2493 (2014), as "requiring law enforcement to obtain a warrant before searching a cell phone lawful1y seized incident to arrest"); see also id. at 58 (citing Walter v. United States, 447 U.S. 649, 654 (1980), United States v. Mulder, 808 F.2d 1346 (9th Cir. 1987), United States v. Bowman, 215 F.3d 951 (9th Cir. 2001) and United States v. Runyan, 275 F.3d 449,461 (5th Cir. 2001 ), for the proposition that "even if law enforcement comes into possession of an object lawfully because it has been seized or searched by a private party, subsequent actions taken by law enforcement to inspect or review the object's contents constitute separate events for purposes of the Fourth Amendment"). Amici also point to the recent holding in Carpenter v. United States. 138 S.Ct. 2206 (2018), for further support. See July 13, 2018, Proposed Tr. at 37. They analogize (1) a cellular-phone provider's collection of cell-site location infom1ation (CSU) to the govemment's acquisition of Section 702 infonnation, and (2) the provider's subsequent compiling and production to the govemment of CSU revealing the location of a particular suspect over time to the FBI' s subsequent querying of Section 702 information for a particular U.S. person. Based on those analogies, they contend that the Supreme Court's holding in Ca1:penter that the governmenfs obtaining and accessing CSU info1mation involved a search under the Fourth Amendment has implications for whether querying Section 702 data might also be a Fourth Amendment search. See id. The Court has considered these authorities and declines to find that they require that querying of infonnation lawfully acquired under Section 702 be considered a distinct Fourth -wniR '11i'AIUl:i1? 116iilJ IIAAC(iUJ'])IQli'QAll DATE: Oct 8, 2019 - Authorized Public Release Page 86 of 138 Page 86 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release [)ijtp iii liMl'fI'ii'fQftOOtl'lUQifQPN Amendment event requiring a reasonableness detennination independent of the other circumstances of acquisition. With regard to the Reauthorization Act, the provisions cited by amici reflect congressional views on the reasonableness of ce1tai11 querying practices and strongly suggest congressional recognition that Fourth Amendment concerns are implicated by the querying of Section 702 info1mation. Their effect, however, is to expand statutory protections, not the scope of what constitutes an independent search under the Fourth Amendment. The Court also declines to find that the case law cited by amici mandate that queries of Section 702 infmmation be considered distinct Fourth Amendment events. Three of the cases involved prope1ty voluntarily provided to law enforcement by a third party and subsequent law­ enforcement searches that exceeded the scope of the p1ior examination by that third party. See Walter, 447 U.S. at 654-57 (finding that FBI's screening of fihns that had been contained in shipment mistakenly sent to and opened by third party violated Fourth Amendment); Runyan, 275 F.3d at 464 (finding that police examination of compact disks that had not been viewed by third patty who turned them over violated Fourth Amendment); Bowman, 215 U.S. at 963 (government conceded that viewing of film contained in footlocker provided by third party exceeded third party's prior examination). In Mulder, the court found that toxicology lab tests of tablets, which a hotel employee had turned over to law enforcement, exceeded the scope of the "field test" exception to the warrant requirement. Mulder, 808 F.2d at 1348-49 (citing United States v. Jacobsen, 466 U.S. 109, 123 (1984)). None of these cases is instructive regarding circumstances like those present in this case, which involve the government's examination of - - IOII SE@llbliteJIIOROOfUIOPONf DATE: Oct 8, 2019 - Authorized Public Release Page 87 of 138 Page 87 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 5Ji8P 0OOllfi1WOl,~'8ftCJ8M'N8FOlliii information lawfully acquired under a statutory framework that requires a judicial detennination that the totality of attendant circumstances, including the govemment's acquisition, retention, use, and dissemination of such information, is reasonable under the Fourth Amendment. In any event, the Court arrives at the same conclusions as amici, albeit under a totality-of­ circumstances analysis: the FBI's procedures are unreasonable under the Fourth Amendment and the amici's proposal to require the FBI to document the basis for its queries in certain additional circumstances,� Part IV.C.7 below, would cure that deficiency. (ii) Reasonableness Under the Totality of Circumstances Under the totality-of-circumstances approach, a court must balance "'the degree to which [governmental action] intrudes upon an individual's privacy'" against "'the degree to which it is needed for the promotion of legitimate governmental interests.'" In re Certified Question, 858 F.3d at 604-05 (quoting Wyoming v. Houghton, 526 U.S. 295,300 (1999)). "The moree important the government's interest, the greater the intrusion that may be constitutionally tolerated." In re Directives, 551 F.3d at 1012. If the protections that are in place for individual privacy interests are sufficient in light of the governmental interest at stake, the constitutional scales wi11 tilt in favor of upholding the government's actions. If, however, those protections are insujficienJ. to alleviate the risks o.fgovernment error and abuse, the scales will tip toward a finding of unconstitutionality. Id. (emphasis added). The Cout1 regards the privacy interests at stake as substantial. As described above in Part IV.C.3, the FBI has conducted tens of thousands of unjustified queries of Section 702 data. Based on the infonnation available - e.g., queries for TAP SFCPPZ?ff?J ffARGOIJ llJAFOPI DATE: Oct 8, 2019 - Authorized Public Release Page 88 of 138 and for Page 88 FISC Opinion, Oct. 2018 - - I '.JJQP .,1Hs\1Us1W�l,'£QRG0��0:60.IUI I l ■ I I I I I I I I persons with access to FBI facilities - it appears that many subjects of those queries were U.S. persons. Beyond that, it is difficult on the record before the Court to assess to what extent U.S.­ person infonnation was returned ru1d examined as a result of those queries. At a minimum, however, the reported querying practices present a serious risk of unwarranted intrusion into the private communications of a large number of U.S. persons. The Court believes that serious risk weighs substantially in the assessment of reasonableness. The goal of the Fourth Amendment is to protect individuals from arbitrary governmental intrnsions on their privacy. See Camenter, 138 S. Ct. at 2213 ( "' basic purpose"' of the Fourth Amendment "'is to safeguard the privacy and security of individuals against arbitrary invasions by governmental officials'") (quoting Camara v. Municipal Court of City and County of San Francisco, 387 U.S. 523,528 (1967)). The FBI's use of unjustified queries squarely implicates that purpose: the FBI searched for, ru1d presumably examined when found, private communications of particular U.S. persons on arbitrary grounds Part IV.C.3 above. The government is not at liberty to do whatever it wishes with those U.S.-person communications, notwithstanding that they are "incidental collections occurring as a result of' authorized acquisitions. In re Directives, 551 F.3d at 1015. The FISCR in In re Directives relied on the governmenfs assurance "that it does not maintain a database of incidentally collected infonnation from non-targeted United States persons" when it held on the facts of that case that "incidentally collected communications of non-targeted United States persons do not violate the 5Jil8P BE ODOFJill%'81XODOON:'JJOf301lJJ DATE: Oct 8, 2019 - Authorized Public Release Page 89 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - •or 81!@1\l!T;:'OlhOR@Ofl:1i8F8RP1 Fou11h Amendment." Id. ln this matter, while the FBI may not maintain a separate database of U.S.-person communications acquired under Section 702, it routinely queries raw Section 702e data in order to identify and examine communications of pa1ticular U.S. persons. Whether those querying practices adequately protect the privacy of those U.S. persons, or instead unjustifiably invade U.S. persons' privacy, bears on the analysis of reasonableness under the Fomth Amendment. See In re Certified Question, 858 F.3d at 609 (examining intra-FBI restrictions on access to information acquired pursuant to a FISA pen register/trap-and-trace authorization as part of assessment of Fou1th Amendment reasonableness). Under the totality-of-circumstances framework, the Court must take into account protections afforded by other provisions of the government's procedures and assess whether their combined effect is reasonable under the Fourth Amendment. Those protections include requirements in the targeting procedures that "direct the govemment's acquisitions toward communications that are likely to yield foreign intelligence information" and "substantial restrictions on the use and dissemination of infonnation derived from queries.>' November 6, 2015, Opinion at 41-42. Compliance with those provisions mitigates the intrusion on U.S. persons' privacy resulting from unjustified queries, either by limiting the scope of infom1ation acquired and therefore subject to querying or limiting the further use or disclosure of U.S.-person infonnation retumed by queries. The Court nonetheless views as substantial the intrusion on U.S. persons' privacy inherent in FBI personnel's examination of infonnation- especially content information - returned by unjustified U.S.-person queries. 'fOP 91!lCHlffh'91f>'ORCONi'fl�0FO�� DATE: Oct 8, 2019 - Authorized Public Release Page 90 of 138 Page90 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - liQR 61iC:AJi1i((fiiif110:ACON NOEOPN On the other side of the balance, it must be acknowledged that acquiring "forei!,'11 intelligence with an eye toward safeguarding the nation's security serves ... a particularly intense interest." In re Certified Question, 858 F.3d at 606 (internal quotation marks omitted). For that reason, the FISCR has observed that "the government's investigative interest in cases arising under FISA is at the highest level and weighs heavily in the constitutional balancing process." Id. at 608. The Court must also consider, however, the degree to which the governmental action in question is needed for the promotion of the relevant governmental interest. Id. at 605. Here, the relevant governmental action is the FBl's continuing to run queries without taking further measures to ensure they actually satisfy the querying standard FBl personnel are supposed to apply. Whether the balance of interests ultimately tips in favor of finding the procedures to be inconsistent with the Fourth Amendment is a close question. Reasonableness under the Fourth Amendment does not require perfection. See In Re Directives, 551 F.3d at J 015 ("the fact that there is some potential for en·or is not a sufficient reason to invalidate" surveillances as unreasonable under the Fourth Amendment). Nonetheless, if "the protections that are in place for individual privacy interests are ... insufficient to alleviate the risks of government error and abuse, the scales will tip toward a finding of unconstitutionality." kl at 1012. Here, there are demonstrated risks of serious error and abuse, and the Court has found the govenunent's procedures do not sufficiently guard against that risk, for reasons explained above in the discussion of statutory minimization requirements. - w o » QDCDPT((OJ((OD COIJ0JOPODne:- - DATE: Oct 8, 2019 - Authorized Public Release Page 91 of 138 Page 91 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release Finally, for reasons explained below, the government has not made a persuasive case that the documentation requirement proposed by amici, which would provide a fw1her check against unjustified intrusions on the privacy of U.S. persons and should also enhance oversight of FBI quelies, would impede the FBI's ability to respond to national-security threats. On the current record and subject to future oversight of the FBJ's querying practices, the Court believes that its adoption would remedy the statutory and Fourth Amendment deficiencies discussed above. TI1e Court accordingly finds that the FBJ's querying procedures and minimization procedures are not consistent with the requirements of the Fourth Amendment. 7.e Amici's Documentation Proposal as a Remedy The government offers§ IV.A.3 in part as an alternative to a proposal made by amici. See September l 8, 2018, Memorandum at 21. Amici propose that FBI personnel be required to document in writing their bases for believing that queries of Section 702 data using U.S.-person query tenns were reasonably likely to return foreign-intelligence infonnation or evidence of crime before they examine content infonnation returned by such queries. See Amici Brief at 69, 72. (Amici alternatively discussed a more far-reaching requirement to document the basis for queries before they are conducted, see July 13, 2018, Proposed Tr. at 34, but stated at the September 28, 2018, argument that the above-described option would be adequate. The FISC declined to adopt a pre-querying documentation requirement in a prior Section 702 proceeding, see November 6, 2015, Opinion at 39-41, though the record in that case did not reflect similar problems with the FBI's querying practices.) -ffOf s@eR�'fih01#8RCONs 1'�OF8Wl1 DATE: Oct 8, 2019 - Authorized Public Release Page 92 of 138 1 Page 92 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'FOP SFJCRl!l'Fh'Sln'ORCOl'Hl'J0FOAl>I Like§ IV.A.3, the documentation requirement proposed by amici would apply only when a query has returned Section 702-acquired content infonnation that FBI perso1mel wish to examine. The amici proposal is further limited to U.S.-person queries. Because of those limitations, it applies only to the subset of queries that are particularly likely to result in significant intrusion into U.S. persons' piivacy. In contrast to§ IV.A.3, the documentation requirement proposed by amici would impose a less onerous requirement on FBI personnel who wish to examine such contents (written memorialization of the basis for the query vs. attorney approval), but in a larger number of cases (U.S.-person queries vs. categorical batch queries). In the Court's assessment, the documentation requirement proposed by amici would facilitate oversight of queries likely to have intruded on U.S. persons' privacy interests by providing contemporaneous documentation of why FBI personnel believed the querying standard was satisfied. The requirement to create that documentation would also help ensure that FBI perso1mel, in fact, have thought about the querying standard and articulated why they believe it has been met. By so doing, it would prompt FBI personnel - much more frequently than the attorney-approval process under § IV .A.3 to recall and apply the guidance and training they have received on the querying standard. Over time and with review by oversight personnel, those written statements may also suggest how to improve that guidance and training, or even the fonnulation of the standard in the querying procedures. The government, however, objects that such a requirement would not be effective and would unduly burden and hinder the FBI's work. Regarding effectiveness, the government contends that such a documentation requirement would not have prevented the most serious - �OP 8:ECRBT,¥Sl,¥8ROON�J9F91ltJ DATE: Oct 8, 2019 - Authorized Public Release Page 93 of 138 Page93 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release repo1ted instan 1-compliance, such as the queries performed at for persons witl July 13, 2018, Proposed Tr. at 12. In the government's estimation, the relevant personnel in those cases mistakenly but genuinely thought they had a sufficient basis for the queries, so they would have docwnented that basis and proceeded to examine the content infonnation retrieved. See Gov't Response at 36-37; July 13, 2018, Proposed Tr. at 9-10. The Court has not heard from the personnel who conducted those non-compliant queries and is not well positioned to assess what courses of action they would have taken if they had been obligated to state in writing why they thought the queries were justified. But it accords with common sense and experience that some persons in comparable circumstances may, as amici suggest, realize their queries "could not be justified" when they are required to a1ticulate the justification. See Amici Brief at 54. The government further objects that requiring a written justification to examine the contents provided in response to U.S.-person queries of Section 702 infonnation "would substantially hinder the FBI's ability to investigate and protect against threats to national security." Supplemental FBI Declaration at 17. Different fo1ms of hindrance are claimed. First, the government identifies burdens and potential enor costs associated with identifying which tenns are U.S.-person query tenns. Jd. at 15; July 13, 2018, Proposed Tr. at 13, 15. But those are the same burdens and costs anticipated by the government with regard to the statutory obligation to keep records that differentiate U.S.-person query tem1s from other tenns. See Part IV.B.2.c above. If for some reason, moreover, FBJ personnel are in doubt about -xon SFCPJ?T//SJ((OPCO}]/:O,J OFOPJ>l DATE: Oct 8, 2019 - Authorized Public Release Page 94 of 138 Page 94 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - • I01 BEERE)))5fllUICCOl4:U8P8MI ■ whether a particular query used a U.S.-person que1y tenn, they can always choose to document the justification for the query rather than try to resolve that doubt. The government also assesses that "there is a substantial likelihood" that the impact on the FBI's "resources and operations'' of amici's documentation proposal "would be significant." Supplemental FBI Declaration at 16. The government is not, however, able to quantify that impact. Id. at 15-16. For example, given the above-described FBI recordkeeping practices, it cannot say how often the FBI conducts U.S.-person queries, nor can it state how often queries return content information acquired under Section 702, id. at 6 n.3, or how often FBI personnel review PISA infonnation returned in response to a query. Id. at 15-16. The government does acknowledge, however, that a U.S.-person query of Section 702 infonnation may not return any such inforn1ation, and even if it does, the FBI may not review it. See Gov't Response at 35 n.41. In either of those situations, the documentation requirement would not apply. The government nonetheless contends that "a requirement that FBl must include a written justification prior to reviewing any section 702-acquired results that are returned using a U.S. person query term would ... hinder the FBI's ability to perfom1 its national security and public safety missions." Supplemental FBI Declaration at 15 (emphasis added). But the burden associated with documenting the basis for any pa1ticular query should be minimal. FBI personnel must detennine that every query they conduct is reasonably likely to return foreign­ intelligence information or evidence of a crime before they run it. See Gov't Response at 33-34 ("The lack of a requirement for written documentation of the query justification does not mean that FBI personnel are not required to have a justification for each query" and they are "required - - 'JOP 66 '91Ut'J./ 'ii''QRCQN 'l>1QEQRN DATE: Oct 8, 2019 - Authorized Public Release Page 95 of 138 Page 95 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release T8P 91BCRl!~'J'91:'f8RCOPVNOfiOllN to have a justification for each query of raw PISA-acquired infonnation, as each query has to meet the substantive query standard ...."). For that reason, memorializing the basis for a query should involve no additional research or analysis. Nor should composing the written statement be time consuming. The Court contemplates a bdef statement of the query justification - in many cases it should suffice to succinctly complete a sentence that starts "This query is reasonably likely to return foreign-intelligence infonnation [or evidence of crime] because ...." At the heart of the government's objections to the documentation requirement proposed by amici is an understandable desire to ensure that FBI personnel can perform their work with the utmost efficiency and "connect dots" in an effort to protect the national security. Given the lessons learned fol1owing 9/11 and the Fort Hood shooting, as well as the FBI's significant reliance on queries to effectively and efficiently identify threat streams in its holdings, the FBI is extremely concerned about anything that would impede, delay, or create a disincentive to querying FBI databases. Supplemental FBI Declaration at 7 (emphasis added). But amici's documentation proposal would in no way affect the FBI's ability to query its databases. Only if a U.S.-person query returns Section 702 content infonnation and the FBI decides to review that infonnation is the documentation requirement triggered. Non-content metadata, which may help the FBI "connect the dots," will be immediately available without having to document the basis for a query. And FBI personnel could dispense with the otherwise-required documentation if needed to protect against an immediate threat to human life. See FBI Querying Procedures§ II at 1. The Court regards amici's documentation proposal as a measured and reasonable response to the statutory and Fourth Amendment deficiencies it has found in the FBI's implementation of its querying standard. The Court believes that adopting and implementing - Ff?OP 0O@RO'IW0f;l;l8:RO9N,'Jl9f181Ul DATE: Oct 8, 2019 - Authorized Public Release Page 96 of 138 - Page 96 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - :POP f!IIH.iltB:P;f:!il#8ft00fl/UQFQBfl that proposal, in combination with the other protections of the FBI Querying Procedures and FBI Minimization Procedures, would satisfy the definition of "minimization procedures" at § 1801 (h) and render those procedures consistent with the requirements of the Fout1h Amendment. Indeed, while other modifications to the procedures could have the same effect, it is difficult to conceive of their doing so while imposing so modest a burden on the FBI's work. D. Exemptions in the Minimization and Queryine Procedures The minimization and querying procedures proposed by the government contain several exemptions for activities relating to oversight and training, as well as activities responsive to congressional mandates. Although the Cou1t assessed that the oversight and training exemptions included in the March 27, 2018, Submission were unreasonably broad, it concludes that the revised exemptions in the September 18, 2018, Submission comport with the statutory requirements and the Fourth Amendment. 1. Exemptions for Oversight Activities One broad category of exemptions proposed by the govenunent in March 20 J 8 concerned oversight activities conducted by independent executive-branch entities or the agencies themselves. The first type of exemption, which is not new, addresses oversight conducted by independent executive-branch entities. This exemption is included in each of the four sets of minimization procedures. For example, Section I ofNSA's proposed minimization procedures provides: "Nothing in these procedures shall restrict the lawful oversight functions of [NSD, ODNI] or the applicable Offices of the blspectors General, or the provision by NSA of the - - TOP OH@R<81Ji{J10f;%'O1tOON:IJ.fOFOWf DATE: Oct 8, 2019 - Authorized Public Release Page 97 of 138 Page 97 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - Ie, "l!!elll!JIIIJJ!Hn 81tCOU:1ft'JF8Mf - assistance necessary for these entities to perform their lawful oversight functions." March 27, 2018, NSA Minimization Procedures§ 1 at I; see also March 27, 2018, FBI Minimization Procedures§ I.G at 4; March 27, 2018, CIA Minimization Procedures§ 6.f at 4; March 27, 2018, NCTCMinimization Procedures § 6.e at 4. The initially proposed querying procedures contained a similar provision, see March 27, 2018, Querying Procedures § lI eI at 1, which is canied forward in the amended que1ying procedures for each agency submitted in September 2018. See FBI Que1ying Procedures§ IV.Cat 5; NSA Querying Procedures§ IV.Cat 5; CIA Querying Procedures§ JV.Cat 4; and NCTCQuerying Procedures§ JV.Cat 4. The second type of exemption - for oversight conducted by the agencies themselves was quite broad as initially proposed by the government. For example, the exemption initially proposed for FBI provided: • . • • • [N]Shing in these p1WCNures • • I shall restrict the FI• I's :,eria • •nnan~. If lawful llversight functions llf' its per~ ne] or systems, which includes activities perfonned: in sup)91 I• f Fi• l' s investigatisi and remediatial of a Jlllll,sible • •• 11 af Memorandum at 6. In addition, the government limited the exemption for training queries to quedes the agency detennines are necessary to the training of its personnel regarding proper implementation of FISA and FISA procedures, and to pennit the use ofU.S.-person identifiers to perform such queries only when there is a particular need to do so in the conduct of such training. See FBI Querying Procedures§ IV.C.1 at 5; NSA Querying Procedures§ IV.C. l at 4; CIA Querying Procedures§ IV.CJ at 4; NCTC Querying Procedures§ JV.C.1 at 4. - - $OP iGGAsi'fHilUQUCQNNOFORN I. • I DATE: Oct 8, 2019 - Authorized Public Release I Page 105 of 138 Page 105 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - WII 1111.l■ilHlliili@llilf@FfDPI These modifications appear to meaningfully limit the types oftraining activity exempted from otherwise-applicab]c rules. In light of the long-tenn non-compliance with the querying standard during training sessions conducted by the FBI's however, it appears prudent to clarify the Court's understanding of the limited exemption from the querying procedures sought for queries conducted using U.S.-person query tenns deemed necessary for effective training. It is not apparent why U.S.-person query terms that are known to objectively meet the general querying standard (i.e., reasonably likely to retrieve foreign­ intelligence information or evidence of a crime) should not be used whenever U.S.-person query terms are necessary to effective training. Trainers should pre-select U.S.-person query tem1s known to return foreign-intelligence infom1ation to prevent any unnecessary querying ofU.S.­ person identifiers unassociated with national-security investigations. The deviation from the querying standard for training queries should be understood to permit the use of queries conducted for training rather than foreign-intelligence purposes, but which nevertheless are reasonably likely to return foreign-intelligence infonnation or evidence of a crime. 3. Exemptions for Responding to Congressional Mandates Each set of proposed minimization procedures includes new language regarding agency compliance with congressional mandates that would require the agency to deviate from otherwise-applicable rules. The new language describes the types of process that would bigger this exemption as "a subpoena or similar process consistent with congressional oversight. " See September 18, 2018, NSA Minimization Procedures§ 2(b)(3) at 2 ("Nothing in these procedures shall restrict: ... the retention, processing, analysis, or dissemination of infonnation necessary to TOD £J?CDFTf/Slf/OPCObI0TOFOPJ!::. DATE: Oct 8, 2019 - Authorized Public Release Page 106 of 138 Page 106 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 5F8P SE@llflif:':'81s1f81l08PUPI8fl8ft,r comply with an order of a court within the United States or a specific congressional mandate, such as a subpoena or other similar process consistent with congressional oversight") (emphasis added); see also September 18, 2018, FBI Minimization Procedures § J.G at 4; September 18, 2018, CIA Minimization Procedures§ 6.h at 4-5; September 18, 2018, NCTC Minimization Procedures§ A.6.d at 4. The proposed querying procedures also permit queries the agency determines are necessary to comply with "a specific congressional mandate, such as a subpoena or similar process consistent with congressional oversight[.Y' NSA Querying Procedures §eIV.C.3 at 5; FBI Querying Procedures§ JV.C.3 at 5; CIA Querying Procedures§ IV.C.3 at 4;e NCTC Querying Procedures§ IV.C.3 at 4. The Court has previously observed that procedures that pennit exemptions "based on unspecified mandates could undennine the Court's ability to find that the procedures satisfy statutory requirements." See Ap1il 26, 2017, Opinion at 53 (citing November 6, 2015, Opinion at 22)e(internal quotation marks omitted). ln approving this provision in 2015, the Courte emphasized that the language, which at that time referred to "specific constitutional, judicial or legislative mandates," must be interpreted nan-owly to include only those mandates containing language "that clearly and specifically requires action in contravention of an othenvise-applicab]e provision of the requirement of the minimization procedures," and directed the government to report any action taken in reliance on this provision. See April 26, 2017, Opinion at 53 (internal citation omitted). The government sought to modify this provision in September 2016 to describe the contemplated activity requiring a departure as "necessary to comply with a specific congressional 'fOP 91'3Eftl'31fM91h10RCONi':Pi8F8RPi DATE: Oct 8, 2019 - Authorized Public Release Page 107 of 138 Page 107 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release mandate or order of a court within the United States.» See id. at 53-54. The Court approved the revised language hut reiterated its expectation that the provision be narrowly interpreted, id., and directed the government to provide prompt written notification of any instance in which an agency acted in contravention of othe1wise-applicable minimization procedures in reliance on that provision. See id. at 96-97. To date, the government has not relied on the exemption for activities responsive to a specific congressional mandate. The government did, however, receive a congressional request to calculate the number of communications of U.S. persons that have been acquired pursuant to Section 702. That request "was not in the fom1 of a subpoena or other legal process" and therefore would not have constituted a legal mandate for purposes of the exemption. See id. at 54. The govemment asserted, however, that any action it undertook in response to the request in contravention of otherwise-applicable minimization requirements would be pe1mitted under the lawful-oversight exemption. Id. Although the Court believed both provisions could be clearer, it did not take issue with the government's interpretation. The Comi did, however, direct the government to provide prompt notification of any instance in which an agency acts in contravention of otherwise-applicable minimization requirements to respond to an oversight request from any outside entity other than the executive-branch entities specified in the procedures. See M.. at 55, 97. The government filed a notice of such actions taken in an effort to respond to the above-described congressional request. See Report on NSA Action Pursuant to Section 1 of Section 702 Minimization Procedures in Response to Oversight Request of - - TORiliiGPFT({f!ffOPGON0IOFORN DATE: Oct 8, 2019 - Authorized Public Release Page 108 of 138 Page 108 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IClI Bl!@ill§ r;;Ol!i lJIQCOrt:H8f8Rff Congress, June 19, 2017 (advising that NSA conducted quelies of Section 702 data in attempt to provide requested estimates). ln response to the government's March 2018 submission (which described the exempted activity as that "necessary to comply with a specific congressional mandate," see. e.g.. March 27, 2018, NSA Minimization Procedures § 1 at 1), amici asse11ed that the exemption concerning congressional mandates did not adequately protect privacy interests because it was not clear whether a letter from a single member of Congress could be considered a mandate for purposes of the exemption. See Amici Brief at 67. Amici also recommended that the Court's interpretation of the tenn as directives in "the fonn of a subpoena or other legal process" be added to the querying procedures. Id. at 67-68. And, given the government's historical intent to rely on the "lawful oversight function" exemption when a congressional request for infonnation does not qualify as a "mandate," amici argued that the congressional-mandate exemption appeared to be superfluous, unless it could be narrowed in a way that made it distinct from the "lawful oversight" exception. Id. at 68. In response to these concerns, the government proffered the revisions to the congressional-mandate language noted above - i.e., adding the descriptor "such as a subpoena or other similar process consistent with congressional oversight" in both the minimization procedures and querying procedures. The Court believes that the requirement that such process be "consistent with congressional oversight" sufficiently circumscribes the type of mandate subject to the exemption. - FfOPOOOROIFOBIX81l@0Pl{l'l0F9R.l1 DATE: Oct 8, 2019 - Authorized Public Release Page 109 of 138 - Page 109 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOf SECREI})$i})bkCOMl◄OIIOftl4 The Court also believes that the modifications made to the lawful-oversight functions provision (discussed above) help claiify the respective spheres of that exemption and the exemption for specific congressional mandates: responding to a congressional request is not among the specified lawful-oversight functions, and the provision pennitting deviations necessary to the conduct of unspecified lawful-oversight functions only applies to such functions of the agency over its personnel and systems. See, e.g.. September 18, 2018, FBI Minimization Procedures§ I.Hat 5. Should an agency rely on this provision to deviate from generally applicable rules to respond to a request from a member of Congress, it would be required to consult with NSD and ODNI beforehand and report promptly to the FISC the specific oversight activity involved. Id. § J.H at 5-6. Any such submission should also explain why the action taken constitutes lawful oversight of the agency's personnel or systems. The Cou11 is satisfied that the congressional-mandate provisions and lawful-oversight provisions of the procedures as now proposed adequately address the concerns raised regarding the potentia] breadth of the congressional-mandate exemption. Consistent with prior approvals, however, the Cou11 will require the government to promptly report the circumstances of any deviation from applicable minimization or querying procedures taken in reliance on the congressional-mandate provision. E. Other· Changes to the FBI Minimization Procedures The government proposes changes to the FBI's minimization procedures conceming retention of Section 702-acquired metadata and retention of unminimized Section 702 - 16fI OE@llt!lfiJl110f;%18R88fl1'Ji8P8R:ll DATE: Oct 8, 2019 - Authorized Public Release Page 110 of 138 Page 110 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release he Court assesses infonnation in copies of emails and instant messages in each proposal below. 1. Retention of Metadata In assessing the metadata proposals, it is useful to disting1.1ish between provisions relating to the use of metadata for link analysis and those relating to que1ies for other purposes. Metadata Used for Link Analysis a. Section IIJ.G.1 of the 2016 FBI Minimization Procedures currently exclude Section 702acquired metadata in systems used solely for link analysis from the retention timetables that generally apply to raw Section 702 infonnation in electronic storage. Sec 2016 FBI Minimization Procedures§ Ill.G.1 at 22. The govemment seeks to modify Section IIJ.G to pennit the FBI to indefinitely retain such metadata for purposes of link analysis on all electronic and data-storage systems and ad hoc systems. See September 18, 2018, FBI Minimization Procedures§ III.G.2 at 32. This change would hannonize the FBI's Section 702 minimization procedures with a parallel provision of the FBI's minimization procedures applicable to electronic surveillance and physical search under Titles I and 111 of FISA, which the Court approved in May 2016. See May 17, 2016, Opinion at 46-48. One incident of FBI over-retention of Section 702-acquired metadata was reported du1ing the prior authorization period and is worth noting here. In imp]ementing the change allowing indefinite retention of metadata acquired pursuant to Title l and III, the FBI mistakenly reconfigured its systems to eliminate the time Hmits on retention for all FISA-acquired metadata, including Section 702-acquired metadata that should have aged off systems not used solely for - - 'f@P Sl!@IU�'tW81,�tOft00Pf/NOPORPJ DATE: Oct 8, 2019 - Authorized Public Release Page 111 of 138 Page 11 J FISC Opinion, Oct. 2018 Document regarding the Section 7022018 Certification ODNI Authorized for Public Release - 1IOI■SECR£1))31))0REUIC140I OICl4 link analysis. See Preliminary Notice of Compliance Incident Involving Retention of Raw Section 702-Acquired Metadata by FBI, April 27, 2018, at 2-3 (reporting improper retention of unminimized Section 702-acquired metadata that should have been purged from systems not solely used for link analysis within five years of expiration of cel1ification under which it was obtained pursuant to Section lll.G. l of FBI's current Section 702 minimization procedures). The FBI remediated the violation by limiting access to the over-retained Section 702-acquired metadata to a tool used solely for link analysis. See Supplemental Notice of Compliance Incident Involving Retention of Raw Section 702-Acquired Metadata by FBI, July 2, 2018, at 2-3. That restriction would become unnecessary if the Court approves the proposed modification to Section III.G to pennit indefinite retention of Section 702-acquired metadata on systems other than thosee used so]ely for link analysis. In suppo1t of the modification to the FBI Title I and 1II minimization procedures requested in 2016, the government argued that the limitations on retention periods for FISA­ acquired metadata based on the nature of the system on which the metadata resides impaired the FBI's ability to use metadata in data-storage systems not solely used for link analysis without commensurately increasing privacy protections, and that the ability to conduct link analysis of metadata in other systems would enhance the FBI's capacity to make connections about targets and their networks. See Gov't Mot. to Amend Standard Minimization Procedures for FBI Electronic Surveillance and Physical Search Conducted Under FISA, May 17, 2016, at 35-38. The Court concluded that the FBl's compliance with the querying standard as well as other protections set fo1th in the applicable minimization procedures strikes a reasonable balance - T P .illf E 11 lllf 11.'iU ii lilll P RilTPiAIOAflf DATE: Oct 8, 2019 - Authorized Public Release Page 112of138 Page 112 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release between the government's foreign-intelligence needs and the protection of U.S. persons' privacy, and approved the modification. See May 17, 2016, Opinion at 47-48. The government presents similar arguments now. See March 27, 2018, Memorandum at 71-73. When evaluating the government's current request to add Section 702-acquired metadata to the cache of infom1ation indefinitely retained on all electronic-data storage and ad hoc systems, the Court must consider the same governmental and privacy interests in relation to the protections afforded by the applicable procedures. The FBl's procedures seek to protect privacy in a variety of ways. Most pe1iinent to the requested modification is the requirement that FBI personnel may only conduct queries of Section 702-acquired infonnation that are "reasonably likely to retrieve foreign intelligence infonnation" or "evidence of a crime." FBI Querying Procedures§ IV.A.I at 3. That standard applies to queries of Section 702-acquired metadata, not just content information. (For reasons discussed in Pa1t IV.B above, the Court has found the FBI's querying practices deficient and is contemporaneously ordering the government to correct that deficiency.) ln addition, any dissemination of metadata acquired under Section 702 that is of or concerning a U.S. person must meet the criteria of Section IV of the September 18, 2018, FBI Minimization Procedures, and disclosure for law-enforcement purposes must comply with Section III.H .2 of those procedures. Consistent with the May 2016 approval of the FBI's standard minimization procedures for electronic surveillance and physical search, the Court finds that the FBI's proposed Section 702 minimization and querying procedures provide sufficient protection for U.S.-person privacy - - TOP Ol!@ftl!Ffl/J10M18R@8f J:'Jlf8F8RJf DATE: Oct 8, 2019 - Authorized Public Release Page 113 of 138 Page 113 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - ,er Sft@ttft7Pl111s1,reR@Of4:'f4oroRH concerns related to the indefinite retention of Section 702-acquired metadata on all FBI datastorage and ad hoc systems when balanced against the important and substantial interests asserted by the government. The Court notes, however, that for purposes of evaluating Section 702 minimization procedures, the diminished privacy interest in non-content infonnation generally recognized (including by amici, see Amici Brief at 73), does not equate to no privacy interest. And, in a digital era in which U.S. persons share an expanded amount of data electronically, the type and volume of metadata associated with U.S. persons' communications acquired under Section 702 may also expand. It is not unreasonable to expect that the type of metadata available for querying across all FBI data-storage and ad hoc systems, particularly when retained indefinitely and aggregated over longer periods of time, could provide a cache of infonnation the use of which might implicate greater privacy concerns. Cf. Cawenter, 138 S.Ct. at 2215-17 ("the unique nature of cell phone location records" at issue distinguished it from other third-party records such as dialed numbers or negotiable instruments). Mindful of the need to consider the type and volume of metadata acquired under Section 702 and the manner in which the government uses such metadata when evaluating the sufficiency of the targeting, minimization, and querying procedures, the Court will require the government to describe the types of infonnation acquired by the FBI under Section 702 that the government regards as metadata and the extent to which such metadata can reveal location information about U.S. persons. b. Metadata Queried for Other Purposes As noted above, Section III.G.1 of the FBl's current minimization procedures permits the indefinite retention of Section 702-acquired meta.data only on systems used solely for link - - 1'QP OHGRID1' ':lfJl''QRGQJtl'JtlOI:t,MU•l DATE: Oct 8, 2019 - Authorized Public Release Page 114 of 138 Page114 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release TOP SECRETHSli'IORCONf:NOFO�, analysis. Section 702 metadata stored on other systems must be aged off those systems pursuant to the same retention limits applicable to the contents of the corresponding communications. Specifically, infonnation that has not been reviewed must be purged within five years of the date ofexpiration of the certification under which it was acquired, unless a specific extension is obtained. See 2016 FBI Minimization Procedures § III.G. l .a at 22. Infonnation that has been reviewed but not identified as meeting the retention standard - i.e., infonnation that reasonably appears to be foreign-intelligence infonnation, to be necessa1y to understand foreign-intelligence information or assess its impmtance, or to be evidence of a crime - must be access-restricted after ten years and purged after fifteen years, unless a specific extension is obtained. See id. §eUl.G. 1 .b at 23. Information that is subject to those access restrictions may be queried, bute personnel must obtain approval from a designated FBI official before accessing the results of the query. The government has advised that it intends to implement the ten-year access-restriction provision (under both the FBl's standard minimization procedures for electronic surveillance and physical search and its Section 702 minimization procedures) to allow immediate access to rnetadata responsive to a query, regardless of whether the query was run for purposes of link analysis or for other analytical purposes. See Letter Regarding FBI' s Implementation of Section III.D.4.c of Standard Minimization Procedures for FBI Electronic Surveillance and Physicale Search Conducted Under FISA, Feb. 5, 2018, at 2. The ten-year mark will be reached in November 2018 for data acquired under FISA Title I and Title Ill but not until September 2019 for Section 702 information. ld. at 1 n.1, 2. The government also advised that if access to a - - TOP OIJ 8RIJ'F;%101XOROON 'JIOF'il\itl DATE: Oct 8, 2019 - Authorized Public Release Page 115 of 138 Page 115 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IOf SECREI})$b}OKCUl◄if◄U)t0ft1' restricted communication is approved, the FBI intends to make the communication, including the contents, accessible in a non-restricted state "to all users who would otherwise be authorized to access such infonnation" in the pe1tinent system for six months or until fifteen years from the expiration of the authority under which the communication was acquired, whichever is sooner. Id. at 3. In order to fully assess the reasonableness of the intended action, FISC Presiding Judge Rosemary M. Collyer directed the government to, among other things, submit a written explanation of the basis for its assessment that access to the metadata results of queries that are not conducted for purposes oflink analysis is pennitted under the applicable retention limits and describe how metadata may be queried or analyzed for purposes of link analysis and how it may Order, be queried or analyzed for other purposes. See Docket Nos. July 26, 2018, at 3. The Court anticipates that the infonnation regarding the actual implementation of these provisions provided by the government will sif,mificantly inform the Court's evaluation of the reasonableness of the government's actions in the context of Titles I and Ill and, beginning in 2. under Section 702. Retention on Email and Instant-Messa The government seeks modifications to the FBI's 702 minimization procedures that would permit the FBI to retain unminimized Section 702 infom1ation in certain repositories that do not comply with the FBI's current minimization procedures. The government seeks these modifications as part of an effort to address such noncompliance, which was first reported to the Couit in the context of infonnation acquired pursuant to Titles I and III of FISA in December 2016. - TOP 8@Clt@'tW81X8RCON,'P�8f'8Wl DATE: Oct 8, 2019 - Authorized Public Release Page 116 of 138 Page 116 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release Tor ~~Cltl!fMSIMt,ftCONtN0 ¥'6ft"N In December 2016, the government infonned the Court that FBI systems containing classified email and instant messages might be retaining unminimized FISA information in violation of FBI' s standard minimization procedures. See April 26, 2017, Opinion at 88 n.70. In March 2017, the government identified the same systems as presenting compliance issues under the FBI's 702 minimization procedures. See Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of FISA, Mar. 17, 2017 ("March 2017 Quarterly Report,,) at 78-79.e According to that report, all email messages on the FBl's secret-level email system are naintained by the FBI' etained i FBI in responding to discovery requests. Id. Tha management and FOIA processing, and by the FBI's is also storing instant messages from FBI's investigative purposes. Id. secret-level instant-messaging system in a separate system used primarily for investigative purposes. See id. at 79. The Aptil 26,2017, Opinion directed the government to report the extent to which unminimized FISA, including Section 702, info1mation was being retained on those systems and to assess whether such retention complied wit11 applicable minimization requirements; and to the extent that noncompliance was found,to describe the remediation steps the government was taking. See April 26, 2017, Opinion at 97-98. h1 subsequent months, the government provided the Com1 additional details regarding the FBl's retention of Section 702 and other FISA infom1ation on those systemse, and reported ane additional discovery - namely, that the FBI's was instant messages on the FBl's top secret enclave. See March 27, 2018, Memorandum at 80. In 'POP s"ett"'l½'91//8RCONfl',8F8RN DATE: Oct 8, 2019 - Authorized Public Release Page 117 of 138 Page 117 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release December 2017, the govemment notified the Court that the FBI intended to prohibit users from placing unminimized FISA-acquired information in classified instant messages, but because FBI personnel needed the ability to include unminimized Section 702 and other FISA information in classified emails, that practice would not be prohibited. See Supplemental Information Regarding Retention of Raw PISA-Acquired Infonnation in Certain FBI Special Purpose Systems, Dec. 14, 2017, at 2. The government further advised that the FBI was working on a solution that would require instant messages and emails (except for those subject to litigation holds) to age off within five years. See id. at 2-3. Recognizing these measures would not bring the FBI into full compliance with the minimization procedures, the govemment advised the Court it also intended to seek modifications to the applicable procedures. See id. at 3. In the March 27, 2018, Submission, tl1e government proposed changes to the FBJ's current Section 702 minimization procedures. The first change would prohibit the further placement of unminimized Section 702-acquired information in classified-email and instant­ message systems. See March 27, 2018, Memorandum at 81-82. Even though the FBI assesses there is still an operational need to place such information on classified email systems, the rovemment is prepared to take that step because of its inability to delete information from the mail system and instant-message repositories in confonnance with the generally applicable retention limits while stiU retaining infonnation subject to a litigation hold. See id. at 81-82. Because the non-compliant systems will not ingest any additional unminimized Section 702-acquired information, the volume of information "over-retained" in those systems willa effectively be capped. - - 130P 6fii!IUii7c'lil'.'.ORCCllltJOEOPtl DATE: Oct 8, 2019 - Authorized Public Release Page 118 of 138 Page 118 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release With regard to info1mation already in mail system and instant-message repositories, the govemment contends that it is not currently possible to globally search for messages containing unminimized Section 702-acquired infonnation. Id. at 82-83. The government therefore proposes two new provisions to the FBl's Section 702 minimization procedures, which would permit the indefinite retention of unminimized Section 702-acquired infonnation on these systems notwithstanding othe1wise-appiicable retention limits. See • I " . "I " ystem") and § III.F.6 at 31-32 (''FBI-Designated Systems") (exempting those systems from specified retention rules). Although no maximum retention period would apply to either system, access to the databases would be limited to "FBI personnel who require access to perform their official duties or assist in a lawful and authorized governmental function, including system administrators and other technical personnel, and who have received training on these minimization procedures and the Querying Procedures." Id. §§ III.F.5 at 30 and Hl.F.6 at 31. The proposed provisions also require that the FBI maintain records of all personnel who have been granted access to such repositories and all accesses to such repositories. Id. at 30-32. Finally, FBI personnel authorized to access these repositories may do so only "to assist in investigations, and to respond to inquiries related to records management and discovery," and may only query those systems to find and provide infonnation, which may include raw FISA- TAD £FCDFTI/SI//OPCA7'r:1!N OFOPLJ DATE: Oct 8, 2019 - Authorized Public Release Page 119 of 138 Page 119 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release acquired infonnation, in furtherance of such inquiries, functions, and investigations. Id. Any queries in those repositories must also comply with the querying standard described above. Id. Amici expressed several concerns regarding the government's proposal, including lack of specificity regarding who may have access to mail system and instant-message repositories, the purposes for which those repositories are used, and the justification for exempting them from U.S.-person masking requirements. See Amici Brief at 92-94. Amici also recommended that the FBI be required to provide a w1itten statement justifying access. Id. at 94. The Cowi shares amici's concerns to some extent but is also cognizant of the general nature and purpose of these systems, which do not include the retention ofumninimized Section 702 information in any amount approaching the quantity found in systems primarily used by the FBI for analytical and investigative work. ln that light, the proposed modifications to the FBI's minimization procedures greatly mitigate the potential impact of indefinite retention of umninimized Section 702 infonnation in those systems. The necessity of categorically exempting them from any limits on retention, however, is not apparent. The Court will t11erefore approve proposed Sections l1I.F.5 and III.F.6 subject to the following: in the event the FBI recognizes unminimized Section 702-acquired infonnation in a system defined by Section JII.F.5 or IJI.F.6, and seeks to retain such information in that system, the govemment shall report in its next quarterly report concerning compliance matters under Section 702: ( 1) whether the infonnation could be retained on an FBI classified-email or instant-messaging system as described in Section lJJ.F.4, or in connection with litigation matters as described in Section Page 120 DATE: Oct 8, 2019 - Authorized Public Release Page 120 of 138 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOI•SECICEl))SJ))Gfl@O:tll!GlGIGt IIl.1.3; and (2) if not, the reason retention of the infonnation in that system is necessary to the purposes served by the system. F. Conclusion For the reasons stated in Parts JV.Band V I .C above, the Coui1 finds that the FBJ Querying Procedures do not comply with the recordkeeping requirement at § 702(f)(l )(B) and that, in view of the FBI's querying practices, the FBI Querying Procedures and FBI Minimization Procedures do not, as implemented, satisfy the definition of "minimization procedures" at 50 U.S.C. § 1801 (h) and are unreasonable under the Fou11h Amendment. In other respects, the government's querying and minimization procedures, including those provisions examined in Parts JV.D and IV.E above, comport with applicable statutory requirements and the Fourth Amendment. In particular, the changes to the FBI Minimization Procedures that provide more detailed guidance on the storage and handling of infonnation on various types of systems and related organizational changes to those procedures, see March 27, 2018, Memorandum at 43-70, 74-75, present no impediment to making those findings. V. OTHER NON-COMPLIANCE Although the other instances of non-compliance reported by the government do 119t beare significantly on the Court's disposition of these matters, it is desirable to touch briefly on the current status of two additional matters discussed in the April 26, 2017, Opinion, as well as two more recent matters. - - li'OP OD ODlili'fflilffORQQ)lI,iIQECRtl DATE: Oct 8, 2019 - Authorized Public Release Page 121 of 138 Page 121 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification A. ODNI Authorized for Public Release Incidents Addressed in the April 26, 2017. Opinion Several significant compliance issues were addressed in the Apiil 26, 2017, Opinion, four of which were not fully resolved at the time of the Opinion: (1) issues a1ising from NSA's upstream co11ection of Internet communications, see April 26, 2017, Opinion, at 78-81 ; (2)eimproper disclosure of unminimized Section 702 infonnation by the FBI, kt at 83-87;e (3)econcerns about the frequency of NSA's post-tasking review of contents, kt at 75-78; ande (4)ethe potential over-retention of unminimized Section 702 infonnation by the FBIe Id. at 87-89. The first and fourth issues are discussed above in Part III.A and Part IV.E.2, respectively. The other two are discussed briefly below. 1. Freguency of NSA's Post-Taskin¥ Review of Contents NSA 's targeting procedures require that analysts take reasonable steps to confirm that a selector continues to be used by a non-U.S. person located outside the United States. Such steps may include content review, as weJI as ascertaining whether a tasked facility is being used inside ee NSA Targeting Procedures§ II at 6-7. NSA's targeting procedures provide that content review "will be conducted according to analytic and intelligence requirements and priorities" and do not require analysts to review the contents of communications acquired from tasking a particular selector at fixed intervals. See id. at 7. The government has advised the Court, however, that NSA fol1ows a policy whereby such content review is perfonned no later fter the first acquisition and at intervals of 'FOP 86CR6'F/,'6lh'QACQl'J,1l'IQF8R"l DATE: Oct 8, 2019 - Authorized Public Release Page 122 of 138 Page 122 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 1ereafter. See Update Regarding Post-Targeting Content no more th a Reviews, Sept. 13, 2016, at 2. As indicated in the April 26, 2017, Opinion, the Court has had concerns about the govemment's ability to monitor analysts' compliance with this policy. See April 26, 2017, Opinion at 76-77 (citing Supplement Letter Regarding Post-Targeting Content Reviews, Mar. 13, 2017 (indicating that NSA ha or monitoring compliance with the policy in only one of its Section 702 repositories and therefore does not comprehensively monitor or velify analysts' compliance with the policy)). To address the Court's concern, the government undettook to include in its quaiterly reports any instances in which a failure to conduct timely content review in accordance with this policy was discovered, whether or not such failwe resulted in a violation of the targeting procedures themselves (e.g., a delayed detasking resulting from the failure to conduct timely post-targeting content review). April 26, 2017, Opinion at 77. The infonnation submitted in the six quarterly repo11s filed since April 2017 revealed several instances in which NSA did not comply with the policy, only a small fraction of which led to violations of the targeting procedures. See, e.g., Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of PISA, Sept. 14, 2018 ("September 2018 Quarterly f failure to conduct timely post-targeting content review, ikely resulted in delayed detasking); see also Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of FISA, June 15, 2018 ("June 2018 Quarterly Report") at 101 (reporting f failure to conduct timely post-targeting content review, ssociated with delayed detaskings); Qua1terly Report to FISC Concerning -xon SFCPFT/JSI/{ODCONNOFOPI:'- DATE: Oct 8, 2019 - Authorized Public Release Page 123 of 138 Page 123 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - I I 1QllOON:'tiOfQIUl Sfi0P 81UiJllliTi!Jl8I1l1 Compliance Matters Under Section 702 of FISA, Mar. 16, 2018, at 91 (reportin failure to conduct timely post-targeting content review ssociated with delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of PISA, Dec. IS, 2017 ("December 2017 Quarterly Repo1i") at 89 (reportin failure to conduct timely post-targeting content review ssociated with delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of FISA, Sept. 15, 2017 ("September 2017 Quarterly Report") at 81 (reporting of failure to conduct timely post-targeting content review, ssociated with delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section f 702 of FISA, Jw1e 16, 2017 ("June 2017 Qua1ierly Report") at 99 (reportin failure to conduct timely post-targeting content review delayed detaskings). The qua11erly reports also revealed that in several of these incidents the CIA or the FBI was responsible for conducting post-targeting content review but did not conduct timely reviews. See. e.g., June 2017 Quarterly Report at 99 n.54 (identifying incidents for which FBI had responsibility for conducting timely post-targeting content review); September 2017 Qualierly Report at 81 n.39 (same); September 2018 Quarterly Report at 64 & n.40 (identifying incident in which CIA had responsibility for conducting timely post-targeting content review). In addition, in June 2018, the government notified the Court that because ofreliability issues, NSA had disabled two features of the system used to remind analysts of their obligations 'fOP se@Rt!:Ffh191//0RCON{Pi9FOll'l DATE: Oct 8, 2019 - Authorized Public Release Page 124 of 138 Page 124 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 'liOP 81!l@Rl!l'li;%'81XOROOM'flOF@RPl to conduct post-targeting content review. See Supplemental Letter Regarding Post Targeting Content Reviews, June 12, 2018, at I. Despite these setbacks, the Couit does not view the reported deviations from the policy as presenting significant concems, principally because ( 1) only a small fraction of the deviations from NSA's post-tasking content review policy resulted in an improper delay in detasking; and (2)ethe number ofmissed or untimely reviews repo1ted, regardless of whether a delay ine detasking resulted, is small when viewed in relation to the total number of cuffent taskings. See, M:., September 2018 Quarterly Report at 1, 97 (repo1ting ·cilities under task at any given time between June 1, 2018, and August 31,201 timely posMargeting content review during the same period). The Court notes, however, that compliance with NSA's post-targeting content-review policy remains an area susceptible to improvement. The govemment is encouraged to continue to explore additional means of prompting analysts to conduct the content reviews required by NSA's policy ai1d, to the extent the FBI or the CIA is responsible for conducting such review, to ensure compliance with the policy. The government is also expected to continue to report instances of non-compliance with the policy in its quarterly reports. 2. he FBI allowed The April 26, 2017, Opinion also discussed unauthorized personnel to access Section 702 infonnation, only one of which presented a continuing issue of concern to the Court. See April 26, 2017, Opinion at 83-87. That matter involved the provision of unminimized Section 702 infom1ation pet1aining to - IGI SELKEI;;SfoORCOl4J14bl GIG4 DATE: Oct 8, 2019 - Authorized Public Release Page 125 of 138 Page 125 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - ff8POH@lt.811;1;I81,VOll0OfI'.JIOFOIVI ontractor that was developing software intended to facilitate review of Section 702 information. See Quarterly Report to FISC Concerning Compliance Matters Under Section 702 ofFISA, Sept. 15, 2016, at 131. At the time of the Court's April 2017 decision, eturned the infonnation in question to the FBI, but the FBI still planned personnel to install the software on an FBl system. See April 26, 2017, Opinion at 86. The Court ordered the government to report (1) the results of an investigation it had undertaken to detem1ine whether there were other instances of improper access or disclosures, and (2) to report the circumstanc nticipate § 6 at 13- l 4. On May 29, 2018, Judge Collyer held a hearing to learn how the go�ernment proposed to address acklog. She directed the govemment to report on its progress in writing every two weeks. Page 129 DATE: Oct 8, 2019 - Authorized Public Release Page 129 of 138 FISC Opinion, Oct. 2018 Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOI■SELICEIHJ())bltCOIOUOP