Executive Order 12333: Powers, Oversight, and 2022 Safeguards

Executive Order 12333 is the presidential directive that governs how the United States conducts foreign intelligence and counterintelligence. President Ronald Reagan signed it on December 4, 1981, and it remains the foundational legal architecture for intelligence operations that fall outside the Foreign Intelligence Surveillance Act.¹ The order assigns each intelligence agency a specific mission, sets ground rules for what may be collected and how, and establishes protections that apply when information about Americans is caught up in foreign-focused collection.

What the Order Actually Does

EO 12333 has three main jobs. It defines the U.S. Intelligence Community and divides work among its members. It authorizes categories of collection and imposes limits on the methods used. And it sets rules for handling information about U.S. persons, backed by procedures each agency must have approved by the Attorney General.¹

The Intelligence Community operating under this framework consists of 18 organizations: the Office of the Director of National Intelligence, the CIA, nine Department of Defense elements, and seven elements inside other federal departments such as Justice, State, Treasury, Homeland Security, and Energy.² Each element has a functional lane. The CIA collects, analyzes, and disseminates foreign intelligence and counterintelligence, including through clandestine human sources, and is the default agency for presidentially approved covert action; it is prohibited from performing internal security functions inside the United States.³ The NSA runs signals intelligence, collecting and analyzing information derived from electronic communications, radar, and other foreign signals.⁴ The FBI is the lead for domestic counterintelligence and for foreign intelligence collection inside the United States; when foreign intelligence not otherwise obtainable has to be gathered on American soil, the order generally routes that work to the Bureau rather than to overseas agencies.

How EO 12333 Differs From FISA

The most important thing to understand about EO 12333 is where it sits relative to the Foreign Intelligence Surveillance Act. FISA, particularly Section 702, governs surveillance conducted from within the United States using domestic communications infrastructure. The FISA Court approves general targeting and minimization procedures, and Congress receives regular reports.

EO 12333 covers the vast majority of signals intelligence collection that happens overseas. Collection under this authority is not reviewed by the FISA Court or any other court. Congressional oversight is more limited than for FISA programs. In practice, most NSA collection worldwide operates under EO 12333, not FISA. When the NSA intercepts communications transiting foreign networks or taps into data flows between overseas data centers, that activity sits under EO 12333’s executive authority.

Public reporting has identified programs run under this authority that included interception of internet traffic between major tech companies’ overseas data centers, collection of millions of email and messaging address books, and large-scale cellphone location tracking. Civil liberties organizations have criticized the absence of judicial review for programs of that scale.

What Agencies Can Collect

The order authorizes two broad categories of information: foreign intelligence, meaning information about the capabilities, intentions, or activities of foreign governments, organizations, or persons; and counterintelligence, meaning information gathered to protect against espionage, sabotage, or other clandestine activities by foreign powers. Permitted methods include human intelligence, signals intelligence, open-source research, publicly available information, voluntary cooperation with private entities, and overhead reconnaissance such as satellite imagery. Each collection method must be authorized by the head of the responsible agency, and every agency has to stay within its assigned lane.

Targeted Versus Bulk Collection

EO 12333 does not prohibit bulk collection, but it requires agencies to use the least intrusive techniques feasible. Targeted collection focuses on specific individuals, groups, or communications. Bulk collection gathers large volumes of data without predefined targets, relying on later analysis to surface relevant intelligence.

Presidential Policy Directive 28, issued in 2014, layered additional limits on how bulk-collected signals intelligence may be used, restricting permissible uses to six categories: detecting espionage, terrorism, weapons of mass destruction threats, cybersecurity threats, threats to U.S. or allied armed forces, and transnational criminal threats. PPD-28 explicitly prohibits using bulk-collected data to suppress dissent, discriminate based on race or religion, or give commercial advantages to U.S. companies. Those six categories limit how collected data may be used, not the purposes for which the collection itself may occur.

Protections for U.S. Persons

Even though the order focuses on foreign intelligence, it recognizes that collection inevitably captures information about Americans. Its preamble states that the government has a “solemn obligation” to protect the legal rights of all United States persons, including privacy and civil liberties.³ Section 2.3 turns that obligation into rules about when U.S. person information may be collected, retained, or shared.

The order defines “United States person” broadly. It includes U.S. citizens, permanent resident aliens known to the agency, unincorporated associations substantially composed of U.S. citizens or permanent residents, and corporations incorporated in the United States, except for corporations directed and controlled by a foreign government.⁵ The protections reach domestic organizations and businesses, not just individual citizens.

Section 2.3 lists ten categories under which agencies may collect information about U.S. persons, each governed by Attorney General–approved procedures.¹ The main permitted categories are:

Publicly available information, or information collected with the person’s consent.
Information that itself constitutes foreign intelligence or counterintelligence, with domestic collection for this purpose generally routed to the FBI.
Information obtained during an authorized foreign intelligence, counterintelligence, international narcotics, or international terrorism investigation.
Information needed to protect targets, victims, or hostages of international terrorist organizations.
Information needed to safeguard intelligence sources and methods from unauthorized disclosure.
Information obtained incidentally that may indicate involvement in activities violating federal, state, local, or foreign laws.
Information acquired by overhead reconnaissance not directed at specific U.S. persons.

Incidental collection is where most controversy sits. When the NSA targets a foreign person’s communications, it picks up conversations with Americans on the other end. That American’s data enters intelligence systems because they communicated with a foreign target, not because anyone chose them. The order permits retaining incidentally collected information that meets criteria, but agencies have to apply minimization procedures that limit how it is stored and who may see it.

Section 2.4 requires the least intrusive collection techniques feasible when operating inside the United States or targeting U.S. persons abroad. Specific techniques such as electronic surveillance, non-consensual physical searches, mail surveillance, and monitoring devices require Attorney General–approved procedures. The CIA is barred from conducting electronic surveillance inside the United States except for training, testing, or countermeasures against hostile surveillance. Physical searches inside the country generally require the FBI to take the lead, with narrow exceptions for military counterintelligence and for CIA searches of a non–U.S. person’s property already lawfully in agency hands.⁶

The Assassination Ban

Section 2.11 contains the order’s best-known limit: “No person employed by or acting on behalf of the United States Government shall engage in or conspire to engage in assassination.”⁵ The prohibition applies to all U.S. government employees and anyone acting on the government’s behalf. President Ford first codified a version of it in Executive Order 11905, and every subsequent intelligence executive order has preserved it.

The order does not define “assassination.” Decades of legal interpretation have addressed where the line falls between an assassination and a lawful military strike or a targeted killing during armed conflict. The U.S. government has maintained that killing enemy combatants on a battlefield, or targeting specific terrorists under the laws of armed conflict, does not constitute assassination under Section 2.11. That interpretation gained significance after September 11, when the government began conducting targeted drone strikes against designated terrorists overseas.

Covert Action Rules

EO 12333 defines covert action, originally called “special activities,” as operations conducted abroad in support of foreign policy objectives where the U.S. government’s role is not intended to be apparent or publicly acknowledged.¹ Routine diplomacy and standard intelligence collection are excluded. Covert actions must not be intended to influence U.S. political processes, public opinion, or media.

Only the CIA may conduct covert action unless the President specifically determines another agency is better suited for a given objective. Before any covert action begins, the National Security Council reviews the proposal and submits a recommendation to the President. Congress is notified consistent with the oversight provisions of the National Security Act. Three checkpoints, in effect: NSC deliberation, presidential approval, congressional notice.

Who Oversees EO 12333 Activities

Accountability under EO 12333 rests on overlapping layers of internal and external review rather than on a court.

Inside the Agencies

Each intelligence agency has its own Inspector General and General Counsel responsible for auditing programs, reviewing collection and retention practices, and enforcing Attorney General–approved procedures. Agency manuals dictate the exact steps for handling, minimizing, and if necessary destroying U.S. person information. Violations can lead to administrative sanctions or the termination of specific programs.

The Intelligence Oversight Board

The Intelligence Oversight Board, a component of the President’s Intelligence Advisory Board within the Executive Office of the President, monitors intelligence activities for legality, reviews internal reports, and investigates potential misconduct. Agencies have historically maintained quarterly reporting of potential violations to the IOB.

The Privacy and Civil Liberties Oversight Board

The PCLOB is an independent agency established by the Implementing Recommendations of the 9/11 Commission Act of 2007. Its statutory mandate includes reviewing intelligence programs for their impact on privacy and civil liberties, holding public hearings, and reporting to Congress.⁷ The Board has conducted classified reviews of specific counterterrorism activities at the CIA and NSA and has advised agencies on updating their Attorney General–approved guidelines. Because EO 12333 is implemented by 18 different organizations across a wide range of activities, PCLOB oversight proceeds through targeted deep dives rather than comprehensive audits.

The 2022 Safeguards Under EO 14086

In October 2022, President Biden signed Executive Order 14086 to strengthen safeguards for signals intelligence conducted under authorities like EO 12333.⁸ Two new requirements changed how the government justifies surveillance.

Signals intelligence must now be “necessary to advance a validated intelligence priority,” based on a reasonable assessment of all relevant factors, and agencies have to consider whether less intrusive alternatives, including diplomatic and public sources, could achieve the same objective. Collection also has to be “proportionate” to the intelligence priority, taking account of the intrusiveness of the method, its duration, the sensitivity of the data, and consequences to individuals including unintended third parties.

EO 14086 also created a two-tier redress mechanism for individuals who believe their data was unlawfully collected through signals intelligence. First-level review goes to the Civil Liberties Protection Officer within the Office of the Director of National Intelligence, who investigates whether applicable safeguards were violated and orders binding remediation. Second-level review is handled by the Data Protection Review Court, established within the Department of Justice, which independently reviews the CLPO’s determinations.⁹ Available remedies include deleting unlawfully acquired data, removing results of improper queries on lawfully collected data, and restricting access to personal information. The mechanism was a central piece of the EU–U.S. Data Privacy Framework, built to address European concerns about American surveillance practices after Schrems II.

How the Order Has Been Amended

The 1981 text has been amended three times: by Executive Order 13284 in 2003, Executive Order 13355 in 2004, and Executive Order 13470 in 2008.³ The most consequential changes followed the Intelligence Reform and Terrorism Prevention Act of 2004, which created the position of Director of National Intelligence.¹⁰ EO 13470 in 2008 rewrote large portions of EO 12333 to formalize the DNI’s authority over the National Intelligence Program budget, priorities across agencies, and information-sharing guidelines throughout the community.¹¹ The 2008 amendments also recognized state, local, and tribal governments as intelligence partners and required analytic reports to meet standards that consider diverse viewpoints. The order’s core architecture, assigning missions, protecting U.S. persons through Attorney General–approved procedures, and relying on executive-branch oversight for overseas collection, is fundamentally the same as it was in 1981.

1
National Archives. Executive Order 12333 – United States Intelligence Activities
2
Office of the Director of National Intelligence. Members of the IC
3
Office of the Director of National Intelligence. Executive Order 12333 United States Intelligence Activities
4
National Security Agency. Signals Intelligence Overview
5
Department of Defense. Executive Order 12333 – United States Intelligence Activities
6
Federation of American Scientists. EO 12333 – United States Intelligence Activities
7
Privacy and Civil Liberties Oversight Board. Executive Order 12333 Public Capstone Report
8
Federal Register. Enhancing Safeguards for United States Signals Intelligence Activities
9
U.S. Department of Justice. The Data Protection Review Court
10
U.S. Government Publishing Office. Intelligence Reform and Terrorism Prevention Act of 2004
11
U.S. Government Publishing Office. Executive Order 13470 – Further Amendments to Executive Order 12333