Federal Surveillance: FISA, Section 702, and Your Rights

Federal surveillance laws run on four main tracks: the Foreign Intelligence Surveillance Act (FISA) for intelligence gathering inside the United States, Section 702 of FISA for targeting non-U.S. persons abroad, Title III of the Omnibus Crime Control and Safe Streets Act for criminal wiretaps, and Executive Order 12333 for foreign collection overseas. Each track has its own warrant standard, its own oversight body, and its own limits on what the government can do with information about you. The rules have shifted significantly in the last decade, with bulk phone metadata collection ending, Section 215 of the PATRIOT Act expiring, and Section 702 up for reauthorization again in 2026.

FISA and the Foreign Intelligence Surveillance Court

The Foreign Intelligence Surveillance Act of 1978 authorizes intelligence collection targeting foreign powers and their agents inside the United States.¹ To get a FISA warrant, the government has to show probable cause that the target is an agent of a foreign power and that the surveillance will produce foreign intelligence information. That statutory category is broad, covering hostile foreign acts, international terrorism, weapons proliferation, clandestine intelligence activities, and international drug trafficking.

Applications go to the Foreign Intelligence Surveillance Court (FISC), a body of 11 federal district judges designated by the Chief Justice who review applications in secret.² In 2023, the court reviewed 363 traditional FISA applications, approving 270, modifying 78, and rejecting 14. Outright denials are rare, but modifications are common enough that the court is doing something more than rubber-stamping.

Section 702: Targeting Non-U.S. Persons Abroad

Section 702 of FISA, at 50 U.S.C. § 1881a, works differently from a traditional FISA warrant. The Attorney General and the Director of National Intelligence jointly authorize the targeting of non-U.S. persons reasonably believed to be located outside the United States, and that authorization runs for up to a year at a time.³ There is no individual court order for each target. The statute explicitly prohibits intentionally targeting anyone known to be inside the United States.

Collection under Section 702 happens two ways. “Downstream” collection (once known as PRISM) works through directives served on email providers and similar companies, compelling them to hand over communications tied to a targeted selector like an email address.⁴ “Upstream” collection pulls communications from internet infrastructure directly. The NSA previously collected communications that were merely “about” a target and voluntarily stopped that practice; upstream is now limited to communications sent directly to or from a target.⁵

The FISC’s role for Section 702 is not target-by-target approval. The court reviews annual certifications from the Attorney General and the DNI along with the targeting, minimization, and querying procedures agencies use to handle the resulting data.

Congress passed the Reforming Intelligence and Securing America Act (RISAA) in April 2024, reauthorizing Section 702 for two years. The authority expires again in 2026, which keeps it one of the most actively contested surveillance powers in federal law.

Title III: The Wiretap Act for Criminal Investigations

Title III of the Omnibus Crime Control and Safe Streets Act, usually called the Wiretap Act, governs electronic surveillance in domestic criminal cases.⁶ FISA is for intelligence; Title III is for building a criminal case. A Title III application has to identify the specific offense under investigation, describe the communications to be intercepted and the facilities involved, name the target if known, and explain why normal investigative techniques have failed or are unlikely to succeed.⁷ A federal judge reviews the application and must find probable cause.

The “exhaustion” requirement, meaning the government has to show less intrusive methods were tried or wouldn’t work, exists because real-time interception of conversations is among the most invasive tools available to law enforcement. Title III is deliberately harder to satisfy than an ordinary search warrant.

Executive Order 12333

Executive Order 12333, signed in 1981 and amended several times since, is the framework for intelligence collection that operates largely outside the FISA warrant process. It directs the intelligence community to use “all means, consistent with applicable Federal law” to obtain intelligence protecting the United States, with an emphasis on collection undertaken abroad.⁸ It is the primary authority for much of the NSA’s foreign signals intelligence and the CIA’s overseas human intelligence work. Because 12333 governs collection outside U.S. borders and targeting non-U.S. persons, it receives less judicial oversight than FISA, which is why civil liberties groups treat it as the least transparent piece of the framework.

National Security Letters

National Security Letters are a separate mechanism that doesn’t require any court approval. The FBI can issue an NSL to a phone or internet provider for subscriber information (names, addresses, billing records) if an agent certifies in writing that the information is relevant to an authorized investigation to protect against international terrorism or espionage. The investigation cannot be based solely on activities protected by the First Amendment.⁹ NSLs historically came with gag orders that barred the recipient from disclosing the request, though legal challenges have loosened those restrictions.

NSLs sit on the same legal foundation as much other government access to private-sector data: the third-party doctrine, discussed below.

Emergency Exceptions

Both FISA and Title III allow surveillance without a prior court order in genuine emergencies. Under Title III, an officer specially designated by the Attorney General can authorize immediate interception when there is an imminent threat of death or serious physical injury, conspiratorial activity threatening national security, or organized crime activity.⁷ The government then has 48 hours to file a formal application. If the court denies it, interception must stop immediately and any evidence obtained is generally inadmissible.

What Changed After 2015

The post-9/11 expansion of surveillance authorities has been partly rolled back. The USA FREEDOM Act of 2015 ended the NSA’s bulk collection of domestic phone metadata under Section 215 of the PATRIOT Act. It replaced bulk collection with a targeted approach requiring the government to base each request for phone records on a “specific selection term” identifying a particular person, account, or device.¹⁰ Collection was also limited to two “hops” from the initial target, down from three.

The scaled-down program didn’t last either. The NSA suspended its Call Detail Records program in early 2019 and deleted the records it had collected, citing limited intelligence value against ongoing data integrity problems.¹¹ On March 15, 2020, Section 215 itself expired after Congress failed to agree on reauthorization terms. It has not been renewed.

Third-Party Data and the Carpenter Limit

A lot of what the government collects doesn’t come from wiretaps at all. It comes from companies that already hold your data. The third-party doctrine says that if you voluntarily share information with a business, you generally lose your Fourth Amendment expectation of privacy in that information. The Supreme Court established the rule for bank records in 1976 and extended it to dialed phone numbers three years later in Smith v. Maryland.¹² That’s the doctrinal underpinning of pen registers, NSLs, and much subpoena-based collection.

The Supreme Court cracked the doctrine in 2018. In Carpenter v. United States, the Court held that the government generally needs a warrant to obtain historical cell-site location information from a wireless carrier, even though the data is technically held by a third party.¹³ The majority reasoned that detailed location records reveal an intimate picture of a person’s life that goes well beyond what someone knowingly “shares” by carrying a phone. The Court explicitly declined to disturb its older bank-records and dialed-number rulings, so Carpenter‘s reach is narrow. It does establish that the third-party doctrine has limits when technology generates comprehensive records of personal behavior.

Your Rights If You’re Surveilled

The Fourth Amendment Baseline

The Fourth Amendment prohibits unreasonable searches and seizures and requires warrants supported by probable cause that particularly describe what will be searched and seized. Courts have applied those protections to evolving technology, and Carpenter confirmed the Fourth Amendment keeps pace with technology that generates detailed personal records, even when a company holds them.¹³

Notice and the Right to Challenge

If the federal government intends to use FISA-derived evidence against you in any proceeding, it has to notify you first.¹⁴ The same requirement applies when a state government tries to use FISA-derived information. Once notified, you can move to suppress the evidence, arguing the surveillance violated the Fourth Amendment or the FISA order was improperly granted. Courts have entertained challenges to Section 702-derived evidence on similar grounds.¹⁵

Winning that challenge is difficult. The underlying applications and court orders are classified, so you and your lawyer generally won’t see the full basis for the surveillance. Courts review the classified materials in camera, and your argument has to be built on limited information.

Minimization Procedures and Retention Limits

Minimization procedures govern what agencies do with information about U.S. persons that gets swept up incidentally during foreign intelligence collection. Under Section 702, agencies must destroy U.S. person information at the earliest point it can be identified as not relevant to the authorized purpose. Even relevant U.S. person information cannot be retained more than five years from the expiration of the certification authorizing its collection.¹⁶ Disseminating a U.S. person’s identity outside the collecting agency is limited to narrow circumstances, such as when the identity is necessary to understand the intelligence or when the information constitutes evidence of a crime.

For raw signals intelligence more broadly, the NSA’s primary content repository operates on a five-year retention period, after which data must be deleted.¹⁷ Data the NSA determines it was never authorized to collect must be purged immediately regardless of age. Specific retention timelines vary by collection authority and come from a mix of statutes, minimization procedures, internal policies, and court orders.

Who Watches the Watchers

Oversight of federal surveillance is split among the FISC, Congress, agency inspectors general, and one dedicated independent board.

Congressional oversight sits in the Senate Select Committee on Intelligence and the House Permanent Select Committee on Intelligence. Federal law requires the President to keep these committees “fully and currently informed” of all intelligence activities, including any illegal activity and corrective actions taken.¹⁸ The statute also blocks agencies from withholding information from the committees on the ground that it would constitute unauthorized disclosure of classified material.

Inspectors general run independent audits. The Department of Justice OIG audits DOJ programs, including surveillance activities, and reports to both the Attorney General and Congress.¹⁹ The NSA has its own Inspector General. IG reports have been the source of much of what is publicly known about compliance failures in surveillance programs.

The Privacy and Civil Liberties Oversight Board (PCLOB) is an independent executive branch agency tasked with reviewing counterterrorism programs that affect civil liberties. Its public reports on the Section 215 phone metadata program and Section 702 collection are among the most detailed unclassified analyses of how these programs operate.⁴

1
Office of the Law Revision Counsel. 50 USC 1801 – Definitions
2
Foreign Intelligence Surveillance Court. About the Foreign Intelligence Surveillance Court
3
Office of the Law Revision Counsel. 50 US Code 1881a – Procedures for Targeting Certain Persons Outside the United States
4
Privacy and Civil Liberties Oversight Board. Report on the Surveillance Program Operated Pursuant to Section 702
5
National Security Agency. NSA Stops Certain Section 702 Upstream Activities
6
Office of the Law Revision Counsel. 18 USC 2516 – Authorization for Interception of Wire, Oral, or Electronic Communications
7
Office of the Law Revision Counsel. 18 US Code 2518 – Procedure for Interception of Wire, Oral, or Electronic Communications
8
Office of the Director of National Intelligence. Executive Order 12333 United States Intelligence Activities
9
Office of the Law Revision Counsel. 18 US Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records
10
United States Department of Justice. Joint Statement on the Declassification of the Renewal of Collection Under Section 215 of the USA Patriot Act as Amended by the USA Freedom Act
11
Privacy and Civil Liberties Oversight Board. Report on the Governments Use of the Call Detail Records Program Under the USA Freedom Act
12
Justia. Smith v Maryland, 442 US 735 (1979)
13
Legal Information Institute. Carpenter v United States
14
Office of the Law Revision Counsel. 50 US Code 1806 – Use of Information
15
National Security Agency. Judicial Oversight of Section 702 of the Foreign Intelligence Surveillance Act
16
Office of the Director of National Intelligence. NSA Section 702 Minimization Procedures
17
NSA Office of the Inspector General. Unclassified Summary Special Study of NSA Controls to Comply With Signals Intelligence Retention Requirements
18
Office of the Law Revision Counsel. 50 USC 3091 – General Congressional Oversight Provisions
19
U.S. Department of Justice Office of the Inspector General. About the Office