Section 702 of FISA: Targets, Queries, and the 2026 Sunset

Section 702 of FISA is a federal surveillance authority that lets the U.S. government collect the communications of non-U.S. persons located outside the country when those communications pass through American digital infrastructure. Congress added it to the Foreign Intelligence Surveillance Act through the FISA Amendments Act of 2008. Instead of getting a separate court order for each foreign target, the Attorney General and the Director of National Intelligence jointly authorize collection under annual certifications approved by the Foreign Intelligence Surveillance Court. The authority is set to expire on April 20, 2026, unless Congress reauthorizes it again.¹

Who Section 702 Can Target

The statute at 50 U.S.C. § 1881a draws a hard line. A target must be a non-U.S. person and must be reasonably believed to be located outside the United States. U.S. citizens, lawful permanent residents, and certain U.S. corporations cannot be targets under Section 702, no matter where they are in the world.²

The government also has to show that collecting a target’s communications will yield “foreign intelligence information,” which 50 U.S.C. § 1801(e) defines to include information about foreign attacks, international terrorism, weapons proliferation, clandestine intelligence activities, the international drug trade, and information about a foreign power or territory relating to national defense, national security, or foreign affairs.³

Each target is chosen individually. Analysts have to document why a specific person is expected to possess or receive foreign intelligence before collection begins. The intelligence community pushes back on the label “bulk collection” on this basis, because every selector goes through a multi-step approval.⁴ The scale is still large. The most recent Statistical Transparency Report, covering 2025, estimated roughly 349,823 foreign targets, up from 291,824 in 2024 and 268,590 in 2023.⁵

How the Government Actually Collects the Data

Once the FISC signs off on the annual certifications, the NSA uses two collection methods.

The first is downstream collection, formerly known as PRISM. The government sends written directives to electronic communication service providers such as email and messaging companies, listing specific identifiers like email addresses or phone numbers. The provider is legally compelled to hand over communications tied to those selectors.⁶

The second is upstream collection, which captures communications as they move across the internet backbone rather than pulling stored data from a provider’s servers. The NSA acquires messages sent to or from a Section 702 selector as data flows through major routing points.⁷ The NSA once also collected messages that merely mentioned a target’s selector in the body of the message, even when neither the sender nor the recipient was a target. It stopped this “about” collection in April 2017 and deleted the vast majority of the upstream internet data it had gathered, limiting upstream collection to communications sent directly to or from a foreign target.⁸

Providers that comply with a directive receive compensation at the prevailing rate and legal immunity. They must also keep the acquisition secret. A provider that believes a directive is unlawful can challenge it before the FISC, with a judge required to begin review within five days, but the provider must keep complying while the challenge is pending unless a court orders otherwise.⁹

Annual Certifications Instead of Individual Warrants

Section 702 replaces per-target court orders with annual program approvals. The Attorney General and the Director of National Intelligence submit certifications to the FISC describing the broad categories of foreign intelligence they plan to collect over the coming year. The certifications do not name specific targets.¹⁰

Alongside the certifications, the government must submit three sets of procedures: targeting procedures (how it picks who to monitor), minimization procedures (how it handles U.S. person data that gets swept up incidentally), and querying procedures (how it searches through what it has collected). The FISC evaluates whether these procedures comply with the statute and the Fourth Amendment, and if it approves, it issues an order authorizing the program for up to one year.²

The court can demand changes to any procedure it finds deficient, and it has done so. This is where meaningful judicial oversight sits under Section 702: not at the level of each foreign target, but at the level of the rules that govern the entire program.

Querying the Data

Collecting communications and searching through them are treated as separate legal events. Four agencies receive raw Section 702 data: the NSA, CIA, FBI, and the National Counterterrorism Center. Analysts can query the collected data using specific identifiers, but each query must be reasonably likely to retrieve foreign intelligence information.¹¹

The FBI faces the tightest restrictions because it operates domestically and is most likely to encounter U.S. person information. When FBI personnel use a search term that identifies a U.S. person, they must first get approval from a supervisor or attorney, provide a written statement explaining the factual basis for the query, and record the search term, date, and who ran it. The only exception to the approval requirement is when an agent reasonably believes the query could help address an immediate threat to life or serious bodily harm.¹

Queries aimed at especially sensitive identifiers require higher-level sign-off. Searching for communications of an elected official, a political candidate, a journalist, or a leader of a religious organization requires approval from the FBI Deputy Director or an FBI attorney, depending on the category.¹

The FBI is also barred from running queries “solely designed to find and extract evidence of criminal activity.” Agents cannot use the Section 702 database as a general-purpose criminal investigation tool. The ban has exceptions for threats to life and for situations where information has to be produced for litigation or discovery obligations.¹

What Happens to Americans’ Communications

Because Section 702 targets foreign nationals, the government is not supposed to be collecting Americans’ communications. In practice, it does. When a foreign target emails or calls someone in the United States, that person’s side of the conversation gets swept in. Minimization procedures are the rules for handling this incidentally collected domestic data.

The core principle is identity masking. When analysts write intelligence reports based on Section 702 data, they must replace the names of U.S. persons with generic labels such as “U.S. Person 1” unless the identity itself is foreign intelligence, is necessary for the recipient to understand the intelligence, or is evidence of a crime.¹²

The NSA’s default retention period is five years from the expiration date of the certification that authorized the collection. After that, data containing U.S. person communications must be destroyed unless the NSA’s Director of Operations determines in writing that a specific category needs to be kept longer for authorized intelligence purposes.¹³ Dissemination rules restrict analysts from sharing identifiable U.S. person information with other parts of the government unless a specific exception applies.

Oversight and the Compliance Record

Section 702 involves all three branches, though critics argue none of them sees the full picture. The FISC reviews annual certifications and procedures, but its proceedings are largely secret and are held without the target present. Congress in 2015 required the FISC to appoint independent amicus curiae in cases presenting novel or significant interpretations of the law, and at least five individuals must be designated as eligible to serve. The court is also required to appoint an amicus when reviewing Section 702 certifications and procedures if none has already been appointed. Amici are expected to have expertise in privacy and civil liberties and in intelligence collection, and their role is to argue for individual rights.¹⁴

On the executive side, the Department of Justice conducts regular compliance reviews, and the DOJ Inspector General has issued detailed reports on FBI querying practices, repeatedly finding problems with how agents document their justifications for U.S. person queries. The FBI has reported approximately 98 percent query compliance as of early 2024, and Director Christopher Wray told the Senate Intelligence Committee that the most recent DOJ review found 99 percent compliance.¹⁵ Whether that sounds reassuring depends on the denominator. Applied to hundreds of thousands of queries, even a small percentage translates to thousands of potential violations.

Congress also requires the Director of National Intelligence to publish an annual Statistical Transparency Report under 50 U.S.C. § 1873, disclosing figures such as the estimated number of Section 702 targets, the number of U.S. person search terms used to query collected data, and the number of FBI investigations opened based on Section 702 information.¹⁶

What the 2024 Reforms Changed

Congress reauthorized Section 702 in April 2024 through the Reforming Intelligence and Securing America Act, known as RISAA. The debate was dominated by years of documented FBI compliance failures, and most of RISAA’s operational changes hit the FBI.

The statute now requires FBI personnel to obtain supervisory or attorney approval before running any query using a U.S. person identifier. Before RISAA, this approval step existed as internal FBI policy for some queries but was not uniformly required by law. RISAA also requires a written statement of the factual basis for each such query and mandates that the FBI record the query term, the date, and the identity of the analyst who ran it.¹

RISAA also blocks the FBI from pulling raw, unminimized Section 702 data into its analytic systems unless the targeted person is relevant to an existing, open, fully predicated national security investigation. This narrows the pipeline of data flowing into FBI databases and prevents agents from browsing Section 702 material during preliminary assessments or unrelated cases.¹

One RISAA provision drew sharp criticism from technology companies and civil liberties groups: an expansion of which entities can be compelled to assist with collection. RISAA broadened the definition of “electronic communication service provider” to include any service provider with access to equipment used to transmit or store communications. Critics argued the language is vague enough to cover data centers, cloud storage companies, landlords of buildings that house communications equipment, and potentially even cleaning staff with physical access to server rooms. The full impact of the expanded definition remains unclear as of early 2026.

The Fourth Amendment Question

The Fourth Amendment question at the center of Section 702 has never been definitively resolved by the Supreme Court. The government collects communications without a traditional warrant, and some of those communications belong to Americans. The government’s position is that no warrant is needed to target foreigners abroad and that the FISC certification process is a reasonable substitute for individualized judicial approval. Privacy advocates argue that querying U.S. person data, at minimum, is a separate search that should require a warrant.

Federal courts have started addressing this with more clarity. In 2019, the Second Circuit Court of Appeals recognized that Section 702 queries involving people in the United States trigger separate Fourth Amendment scrutiny. In January 2025, a federal district court in the Eastern District of New York went further in United States v. Hasbajrami, holding that warrantless queries of Section 702 data violated the Fourth Amendment. These rulings do not bind the entire country, and the government can appeal, but they signal growing judicial skepticism about backdoor searches of intelligence databases.

The April 2026 Sunset

Section 702 authority expires on April 20, 2026, under the sunset written into RISAA.¹ If Congress does not reauthorize before that date, the authority does not necessarily shut off overnight. Any FISC order already in effect on the sunset date remains valid until it expires, and the court can continue administering previously authorized procedures until those orders run out. In practice, that creates a wind-down period rather than an abrupt cutoff.

The intelligence community treats Section 702 as one of its most valuable collection authorities, and the ODNI has repeatedly described it as critical to identifying terrorism threats, cyber intrusions, and weapons proliferation efforts.⁴ Privacy and civil liberties groups have pushed for a warrant requirement for U.S. person queries, a reform Congress considered but rejected during the 2024 reauthorization. Whether the next reauthorization produces stronger privacy protections or extends the status quo will depend heavily on how the compliance record looks when Congress takes up the question again.

1
Congress.gov. FISA Section 702 and the 2024 Reforming Intelligence and Securing America Act
2
Office of the Law Revision Counsel. 50 USC 1881a – Procedures for Targeting Certain Persons Outside the United States Other Than United States Persons
3
Office of the Law Revision Counsel. 50 USC 1801 – Definitions
4
Intelligence.gov. FISA Section 702
5
Intelligence.gov. Statistical Transparency Report
6
National Security Agency/Central Security Service. FISA – Section: FISA Section 702
7
National Security Agency/Central Security Service. NSA Stops Certain Section 702 Upstream Activities
8
National Security Agency/Central Security Service. NSA Stops Certain Foreign Intelligence Collection Activities Under Section 702
9
Office of the Law Revision Counsel. 50 USC 1881a – Procedures for Targeting Certain Persons Outside the United States Other Than United States Persons
10
Office of the Director of National Intelligence. ODNI Releases April 2024 FISC Opinion on FISA 702 Recertifications
11
Department of Justice Office of the Inspector General. A Review of the Federal Bureau of Investigation’s Querying Practices Under Section 702 of the Foreign Intelligence Surveillance Act
12
IC on the Record. Protecting U.S. Person Identities in FISA Disseminations
13
Intelligence.gov. NSA 2023 Minimization Procedures
14
Office of the Law Revision Counsel. 50 USC 1803 – Organization and Procedures
15
Federal Bureau of Investigation. Foreign Intelligence Surveillance Act (FISA) and Section 702
16
Office of the Law Revision Counsel. 50 USC 1873 – Annual Reports