ANNEX VII

OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE OFFICE OF GENERAL COUNSEL

WASHINGTON, DC 20511

December 9, 2022

Leslie B. Kiernan

General Counsel

U.S. Department of

Commerce 1401 Constitution

Ave., NW Washington, DC 20230

Dear Ms. Kiernan,

On October 7, 2022, President Biden signed Executive Order 14086, Enhancing Safeguards for United States Signals Intelligence Activities, which bolsters the rigorous array of privacy and civil liberties safeguards that apply to U.S. signals intelligence activities. These safeguards include: requiring signals intelligence activities to meet enumerated legitimate objectives; explicitly barring such activities for the purpose of specific prohibited objectives; putting in place novel procedures for ensuring that signals intelligence activities further these legitimate objectives and do not further prohibited objectives; requiring that signals intelligence activities be conducted only following a determination, based on a reasonable assessment of all relevant factors, that the activities are necessary to advance a validated intelligence priority and only to the extent and in a manner that is proportionate to the validated intelligence priority for which they have been authorized; and directing Intelligence Communjty (IC) elements to update their policies and procedures to reflect the Executive Order's required signals intelligence safeguards. Most significantly, the Executive Order also introduces an independent and binding mechanism enabling individuals from "qualifying states," as designated pursuant to the Executive Order, to seek redress if they believe they were subjected to unlawful U.S. signals intelligence activities, including activities violating the protections found in the Executive Order.

President Biden's issuance of Executive Order 14086 marked the culmination of well over a year of detailed negotiations between representatives from the European Commission (EC) and the United States and directs the steps the United States will take to implement its commitments under the EU-U.S. Data Privacy Framework. Consistent with the cooperative spirit that produced the Framework, it is my understanding that you have received two sets of questions from the EC about how the IC will implement the Executive Order. I am happy to address these questions with this letter.

Section 702 of the Foreign Intelligence Surveillance Act of 1978 (FISA Section 702)

The first set of questions concerns FISA Section 702, which allows the collection of foreign intelligence information through the targeting of non-U.S. persons reasonably believed to be located outside the United States with the compelled assistance of electronic communication service providers. Specifically, the questions concern the interplay between that provision and Executive Order 14086, as well as the other safeguards that apply to activities conducted pursuant to FISA Section 702.

To begin, we can confirm that the IC will apply the safeguards set forth in Executive Order 14086 to activities conducted pursuant to FISA Section 702.

In addition, numerous other safeguards apply to the Government's use of FISA Section 702. For example, all FISA Section 702 certifications must be signed by both the Attorney General and Director of National Intelligence (DNI), and the Government must submit all such certifications for approval by the Foreign Intelligence Surveillance Court (FISC), which is comprised of independent, life-tenured judges who serve non-renewable seven-year terms. The certifications identify categories of foreign intelligence information to be collected, which must meet the statutory definition of foreign intelligence information, through the targeting of non-U.S. persons reasonably believed to be located outside the United States. The certifications have included information concerning international terrorism and other topics, such as the acquisition of information concerning weapons of mass destruction. Each annual certification must be submitted to the FISC for approval in a certification application package that includes the Attorney General's and DNI's certifications, affidavits by certain heads of intelligence agencies, and targeting procedures, minimization procedures, and querying procedures that are binding on the Government. The targeting procedures require, among other things, that the IC reasonably assess, based on the totality of the circumstances, that the targeting will likely lead to the collection of foreign intelligence information identified in a PISA Section 702 certification.

Moreover, when collecting information pursuant to FISA Section 702, the IC must: provide a written explanation of the basis for their assessment, at the time of targeting, that the target is expected to possess, is expected to receive, or is likely to communicate foreign intelligence information identified in a PISA Section 702 certification; confirm that the targeting standard as set forth in PISA Section 702 targeting procedures remains satisfied; and cease collection if the standard is no longer satisfied. See U.S. Government Submission to Foreign Intelligence Surveillance Court, 2015 Summcuy ofNotable Section 702 Requirements, at 2-3 (July 15, 2015).

Requiring the IC to record in writing, and regularly affirm the validity of, its assessment that FISA Section 702 targets meet the applicable targeting standards facilitates the FISC's supervision of the IC's targeting activities. Each recorded targeting assessment and rationale is reviewed on a bimonthly basis by intelligence oversight attorneys in the Department of Justice (DOJ), who conduct this oversight function independently from foreign intelligence operations. The DOJ section performing this function is then responsible under a long-established FISC rule to report to the FISC any violations of the applicable procedures. This reporting, along with regular meetings between the FISC and this DOJ section regarding oversight of FISA Section 702 targeting, enables the FISC to enforce compliance with the FISA Section 702 targeting and other procedures and otherwise ensure that the Government's activities are lawful. In particular, the FISC can do this in a number of ways, including by issuing binding remedial decisions to terminate the Government's authority to collect against a particular target, or to modify or delay FISA Section 702 data collection. The FISC also can require the Government to provide further reporting or briefing on its compliance with targeting and other procedures or require changes to those procedures.

The "Bulk" Collection of Signals Intelligence

The second set of questions concerns the "bulk'' collection of signals intelligence, which is defined by Executive Order 14086 as ''the authorized collection of large quantities of signals intelligence data that, due to technical or operational considerations, is acquired without the use of discriminants (for example, without the use of specific identifiers or selection terms)."

With respect to these questions, we first note that neither FISA nor National Security Letters authorize bulk collection. With respect to FISA:

—

Titles I and III of FISA, which respectively authorize electronic surveillance and physical searches, require a court order (with limited exceptions, such as emergency circumstances) and always require probable cause to believe that the target is a foreign power or an agent of a foreign power. See 50 U.S.C. §§ 1805, 1824.

—

The USA FREEDOM Act of 2015 amended Title IV ofFISA, which authorizes the use of pen registers and trap and trace devices, pursuant to court order (except in emergency circumstances), to require the Government to base requests on a "specific selection term." See 50 U.S.C. § 1842(c)(3).

—

Title V of FISA, which permits the Federal Bureau of Investigation (FBI) to obtain certain types of business records, requires a court order based on an application that specifies that "there are specific and articulable facts giving reason to believe that the person to whom the records pertain is a foreign power or an agent of a foreign power." See 50 U.S.C. § 1862(b)(2)(B).

—

Finally, FISA Section 702 authorizes the ''targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence information." See 50 U.S.C. § 188la(a). Thus, as the Privacy and Civil Liberties Oversight Board has noted, the Government's collection of data under FISA Section 702 "consists entirely of targeting individual persons and acquiring communications associated with those persons, from whom the government has reason to expect it will obtain certain types of foreign intelligence,'' such that the "program does not operate by collecting communications in bulk." Privacy and Civil Liberties Oversight Board, Report on the Surveillance Program Operated Pursuant to Section 702 of the Foreign Intelligence Surveillance Act, at 103 (July 2, 2014).

With respect to National Security Letters, the USA FREEDOM Act of2015 imposes a "specific selection term" requirement on the use of such letters. See 12 U.S.C. § 3414(a)(2); 15 U.S.C. § 1681u; 15 U.S.C. § 1681v(a); 18 U.S.C. § 2709(b).

Further, Executive Order 14086 provides that "[t]argeted collection shall be prioritized" and that, when the IC does conduct bulk collection, the ''bulk collection of signals intelligence shall be authorized only based on a determination ... that the infom1ation necessary to advance a validated intelligence priority cannot reasonably be obtained by targeted collection." See Executive Order 14086, § 2(c)(ii)(A).

Moreover, when the IC determines that bulk collection satisfies these standards, Executive Order 14086 provides additional safeguards. Specifically, the Executive Order requires the IC, when conducting bulk collection, to "apply reasonable methods and technical measures in order to limit the data collected to only what is necessary to advance a validated intelligence priority, while minimizing the collection of non-pertinent information." See id. The Order also states that "signals intelligence activities," which include the querying of signals intelligence obtained by bulk collection, ·'shall be conducted only following a determination, based on a reasonable assessment of all relevant factors, that the activities are necessary to advance a validated intelligence priority." See id. § 2(a)(ii)(A). The Order further implements this principle by stating that the IC may only query unminimized signals intelligence obtained in bulk in pursuit of six permissible objectives, and that such queries must be conducted according to policies and procedures that "appropriately take into account the impact [of the queries] on the privacy and civil liberties of all persons, regardless of their nationality or wherever they might reside." See id. § 2(c)(iii)(D). Lastly, the Order provides for handling, security, and access controls for data collected. See id. § 2(c)(iii)(A) and§ 2(c)(iii)(B).

*****

We hope these clarifications are of assistance. Please do not hesitate to contact us if you have further questions about how the U.S. IC plans to impt'ement Executive Order 14086.

Sincerely,

Christopher C. FONZONE

General Counsel