U.S. Department of Justice [Type text] United States Attorney Southern District of New York 86 Chambers Street New York, New York 10007 January 9, 2015 BY E-MAIL David McCraw Jeremy Kutner Legal Department The New York Times Company 620 8th Avenue, 18th Floor New York, NY 10018 Re: New York Times Company v. U.S. Department of Justice, 14 Civ. 3776 (AT) Dear Mr. McCraw and Mr. Kutner: On behalf of the United States Department of Justice (the “Government”), we enclose one document pursuant to the schedule so-ordered by the Court on August 28, 2014, as modified by the Court’s Order on December 19, 2014, in the above-referenced FOIA case. Please find attached documents Bates-labeled DOJ-OIG-00931 to DOJ-OIG-01213. Information in these documents has been redacted pursuant to certain FOIA exemptions, including 5 U.S.C. §§ 552(b)(1), (b)(3), (b)(5), and (b)(7)(E). Where redactions have been made, the applicable exemption is marked on each document. The Government reserves its right to modify or supplement the exemptions listed for information that has been redacted from these documents. If you have any questions, please let us know. Sincerely, PREET BHARARA United States Attorney Southern District of New York By: Encls. /s/ Emily Daughtry __ JOHN D. CLOPPER EMILY DAUGHTRY Assistant United States Attorneys Tel.: (212) 637-2716/2777 Fax: (212) 637-2702 john.clopper@usdoj.gov emily.daughtry@usdoj.gov US. Department of Justice Of?ce of the Inspector General (U) A Review of the Federal Bureau of Investigation?s Activities Under Section 702 of the Foreign Intelligence Surveillance Act Amendments Act of 2008 Oversight and Review Division Office of the Inspector General September 20 12 Date . Classifie By: - IA AN 709 1 Derived NSCG 15 Jun 09 Declassify On: Reason: 1.4 I Declassify omw DOJ-016-00931 TOP FISA (U FOUO) THIS DOCUMENT CONTAINS INFORMATION FROM FOREIGN INTELLIGENCE SURVEILLANCE ACT (FISA) COLLECTION. THIS INFORMATION, AND ANY INFORMATION DERIVED THEREFORM, MAY NOT BE USED IN ANY FOREIGN OR DOMESTIC CRIMINIAL, ADMINISRATIVE, OR OTHER PROCEEDING WITHOUT THE ADVANCE AUTHORIZATION OF THE ATTORNEY GENERAL. IF CONCERNING U.S. THIS INFORMATION MAY BE DISSEMINATED TO A FOREIGN GOVERNMENT ONLY WITH PRIOR AUTHORIZATION FROM FBIHQ. ANY REPRODUCTION, DISSEMINATION, OR COMMUNICATION (INCLUDED BUT NOT LIMITED TO, ORAL BRIEFINGS) OF THIS INFORMATION MUST BE ACCOMPANIED BY A STATEMENT OF THESE RESTRICTIONS. - (U ALL CLASSIFICATION MARKINGS IN THIS REPORT ARE BASED ON THE DESIGNATIONS OF THE AGENCIES THAT PROVIDED INFORMATION TO THE OIG FOR THIS REVIEW. THE OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE COORDINATED THIS CLASSIFICATION PROCESS AND CONVEYED THE CLASSIFICATION DESIGNATIONS TO THE OIG, AND THE OIG INCORPORTATED THOSE DESIGNATIONS INTO THIS REPORT. TOP FISA DOJ-016-00932 TOP SEC FISA TO FISA DOJ-016-00933 TABLE OF CONTENTS TABLE OF CONTENTS .. i page intentially left blank (U) EXECUTIVE SUMMARY .. ix 1. (U) Introduction .. ix 11. (U) Background .. Xi A. (U FOUO) Section 702 of the FISA Amendments Act of 2008 xi B. (E Roles of the FBI, the NSA, and the CIA in the 702 rogram (U) The Targeting Activities Under Section 702 ..xiv A. (U FOUO) The Targeting Procedures ..XV 1. Findings and Recommendations Relating to the Review and Evaluation of the Suf?ciency of the Foreignness Determinations b1, b3, 2. Findings and Recommendations Relating to b7E the (S) 3. (S) ..xx1 4. (U Planned Implementation of FBI Nomination Activities ?Jodi B. Findings and Recommendations Relating to Selectors sed Persons Who Have Traveled in the United States ..xxii C. (U Findings and Recommendations Relating to Statutory Reporting Requirements for FBI Targeting Activities .. xxiv IV. (U The Post-Targeting Activities Under Section 702 xxvii A. (U FOUO) The Standard Minimization Procedures .. B. FBI Retention of Section 702-Acquired Information 1. W?Findings Relating to Early Dual Routing and tentio Issues .. xxix 2. Winding Relating to Access to and Purging of 02-Acquired Data Retained in - .. C. FBI Dissemination of Section 702-Acquired 131, 133, Information .. 13713 DOJ-016-00934 TOP SEC FISA 1. MLFindings Relatin to Storage of Section 702 Intelligence Reports ini .. b1: b3: 2. (U FOUO) Findings Relating to Application of the 13713 Standard Minimization Procedures to Disseminated ntelli ence Reports 3. Findings and Recommendations Relating to reatment of 702-Acquired Metadata in Disseminated Intelligence Reports .. D. (U FOUO) Findings and Recommendations Relating to Statutory Reporting Requirements for FBI Dissemination Activities .. V. (U) Conclusion .. (U) CHAPTER ONE: INTRODUCTION .. I. (U FOUO) Methodology of OIG Review .. 4 II. (U) Organization of this Report .. 5 (U) CHAPTER TWO: BACKGROUND .. 7 1. Transition of b7E . 7 A. (U FOUO) The Terrorist Surveillance Program .. 7 B. (U FOUO) FISA Court Orders .. 9 C. (U FOUO) The Protect America Act .. 1 II. (U) The FISA Amendments Act of 2008 .. 14 A. (U The Authorization to Collect Foreign Intelligence Information .. 15 Section 702 .. 15 2. Sections 703 and 704 .. 21 B. (U FOUO) Immunity Provisions .. 22 111. (U FOUO) The Role and Organizational Structure Under Section 702 .. 22 IV. (U The Evolving Use of Section Section 702 Compared to Traditional FISA .. 24 B. (W) The Plans to Nominate Selectors for Section 7 02 Coverage .. 25 ii TOP DOJ-016-00935 TOP FISA (U) CHAPTER THREE: THE ROLE IN THE SECTION 702 II. TARGETING PROCESS .. 27 b1, b3, (U FOUO) Procedures Governing the Targeting Process .. FOUO) Targeting Procedures Under the FAA .. 30 1. (W) Overview of the Targeting Procedures .. 31 2. (U FOUO) Overview of the Targeting 33 s. me) The FBrs_ and the .. 35 C. (U FOUO) The Documentation of Its Targeting Process 37 (U FOUO) The Methodology for Reviewing the 702 Team?s Targeting Activities .. 38 A. Summary of and Inspection Division Oversight of FBI Targeting Activities .. 39 1. (U FOUO) NSD Compliance Reviews .. 39 2. (U FOUO) Inspection Division Quarterly Audits .. 40 B. (U FOUO) OIG Methodology for Reviewing the Targeting Activities .. 42 (MP) The Application of Its Targeting Procedures: Review of the Foreignness Determinations .. 43 A. W) Background: The Application of its Targeting Procedures .. 44 B. The Receipt of Nominated Selectors From the NSA .. NSA Nominations of Selectors to the I During the OIG Review Period .. 50 C. W) Preliminary Review of th_ for b7E Suf?ciency of the Foreignness Determination .. 53 1. Review of the Selector Identi?cation .. 54 2. ($7413.13) Review of the Foreignness Determination .. 55 3. (U FOUO) Change to the Preliminary Review Process 71 IV. The Application of its Targeting ProceduresBackground= (5) 1?1 der the-PAA .. 72 TOP DOJ-016-00936 1. The Role and Standard of Diligence When- ..72 (3) b1, 2. HOW the FBI Decided b3, ..73 (5) mg B. ..74 1. b1, ..77 b3, 2. b7E ..79 c. m_ ..80 1. Relevance Judgments ..82 2. Subjects of Field Of?ce Investigations .. 83 D. ..84 b7?E E. ~86 (8) F. Issues Pertaining to Multiple Databases .. 87 1. ..(5) b3: (8) b7E (S)b1,b3Other U.S.-Issues ..111 mg 1' ..111(5) 2- b7E iv TOPS DOJ-016-00937 VI. (U) Statutory Reporting Requirements for FBI Targeting Activities 114 A. (U) Annual Reporting under Section .. 115 B. (U OIG Review of FBI Reportable Incidents .. 1 17 1. OIG Methodology .. 117 2. FOUO) OIG Conclusions Regarding FBI Reportable Incidents .. 122 VII. (U) OIG Analysis .. 128 A. (U Application of its Targeting Procedures .. 128 1. (S The Review and Evaluation of the Suf?ci of the Foreignness Determinations .. 129 2. Reasonableness of the (3) b1 Practices .. 133 b3(U) The Compliance with its Annual Reporting Requirements under Section 702(l)(3)(A) .. 138 CHAPTER FOUR: THE POST-TARGETING ACTIVITIES: ACQUISITION, ROUTING, RETENTION, MINIMIZATION, AND DISSEMINATION OF SECTION 702 INFORMATION .. 143 I. (U FOUO) Standard Minimization Procedures .. 143 A. Acquisition .. 145 B. (U FOUO) Retention .. 147 C. (U Dissemination .. 149 II. FBI Acquisition of Section 702 Data .. 150 A. -150 (verv1ew 0- I 150 (S) b7E . Upstream Collection .. 151 DOJ-016-00938 TOP RN FISA B. Retention of and Access to Unminimized 702 Data 168 1. (S) .. 168 bl,b3, 2. .. 169 b7E 3. Management of 702 .. 171 IV. FBI Dissemination of Section 702?Acquired Information .. 174 A. (U FOUO) De?nition of Certain Terms .. 174 1. (U FOUO) Dissemination .. 174 2. .. 175 b7E 3. ..176 4. U.S. Person .. 176 B. W) Role of the 702 Team in Disseminations of 7 O2-Acquired Information .. 176 1. Marking Policies .. 177 2. The Section 702 Case Coordination Process .. 178 3. W) Storage of Section 702 Intelligence Reports .. 182 b1, 133, C. W) Application of its Standard Minimization b7E Procedures to Disseminations of Section 702?Acquired Information .. 183 l. NSD and ODNI Minimization Reviews .. 183 2. b1, b3, b7E .15.) 185 V. (U) Statutory Reporting Requirements for FBI Dissemination Activities .. 192 1. (U) Annual Reporting under Section (ii) and (iv) .. 193 2. FOUO) OIG Review of the Number of Disseminated Intelligence Reports Containing a Reference to a U.S. Person Identity .. 194 3. (U FOUO) Disseminations of Previously Undisclosed U.S. Person Identities .. 206 VI. (U) OIG Analysis .. 207 A. MR FBI Policies for Dual Routing Requests and Retention of Section 702?Acquired Data .. 207 B. (U FOUO) Minimization and Dissemination Issues .. 208 vi TOP DOJ-016-00939 TOP SE FISA 1. Maintenance of Disseminations Contai Section 702-Acquired Information .. 208 FOUO) OIG and FBI Reviews under Section 702(l)(2) and (3) .. 210 (U) CHAPTER FIVE: CONCLUSIONS AND RECOMMENDATIONS .. 215 I. (U) FBI Targeting Activities Under Section 702 .. 215 A. (U FOUO) Application of its Targeting Procedures .. 215 1. (W) The FBl?s Review and Evaluation of the Suf?ciency of the Forei nness Determinations .. The Practice for (S) ME .. 220 B. (U FOUO) Compliance with its Annual Reporting Requirements under Section 7 O2(l)(3) (A) .. 222 11. (U FBI Post?Targeting Activities .. 224 A. (53333) FBI Policies for Dual Routing Requests and Retention of Section 7 O2?Acquired Data .. 225 B. .. .. 227 b1,b3Malntenance of Dissemlnations Containin 702-Ac uired Information .. 228 2. (S) .. 228 C. (U FOUO) Compliance with its Annual Reporting Requirements under Section and (ii) .. 229 V11 DOJ-016-00940 TOP PAGE INTENTIALLY LEFT BLANK DOJ-016-00941 (U) EXECUTIVE SUMMARY1 I. (U) Introduction The Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008 (FAA) was signed into law on July 10, 2008. The FAA was enacted as part of Congress?s effort to modernize the Foreign Intelligence Surveillance Act of 1978 (FISA), codi?ed at 50 U.S.C. 1801?1885. The FAA followed earlier efforts to enhance the nation?s ability to gather signals intelligence in the wake of the terrorist attacks of September 1 1, 2001. In October 2001, the President authorized a highly classi?ed program, known as the President?s Surveillance Program, to conduct electronic surveillance of certain communications into and out of the United States without seeking orders from the Foreign Intelligence Surveillance Court (FISA Court).2 Beginning in 2004, this program was transitioned in stages to FISA Court supervision through a series of FISA orders. However, according to b3 a former senior Justice Department of?cial familiar with these events, in May ME 2007, the FISA Court imposed rigorous procedural requirements on the government?s foreign surveillance authority, causing the National Security Agency (NSA) to place fewer forei selectors under covera than it wanted to.3 To address concerns that (TS) Congress enacted the Protect America Act of 1 (U FOUO) At the request, we provided a previous draft of this report to the FBI so that it could conduct a privilege review before the draft report was circulated to other agencies. Unless otherwise indicated, redactions to this ?nal report are based on the Department of Justice?s assertions of the attorney?client privilege. The FBI has also requested the following notice: (U FOUO) This report contains FBI information that belongs disseminated further without express authorization by the FBI. If authorized, any dissemination of this information must be made on a strictly need-to?know basis and is not considered a release to the public. Information determined to be exempt under FOIA (5 U.S.C. 552 as amended by the OPEN Government Act of 2007), or any other privilege, including, but not limited to information protected by the deliberative process privilege, remains exempt or privileged under a limited release to other members of the Intelligence Community and Congress. As the report is classified TS the report or any portion thereof can be released only to individuals with the requisite national security clearance and a need to know. 2 (U FOUO) The FISA Court was established under the FISA statute to review the government?s applications to exercise FISA authority and grant orders approving such applications. 50 U.S.C. 1803. 3 A ?selector? is either a telephone number or an identifier used for Internet communications, such as an e-mail account. DOJ-016-00942 2007 (PAA), a temporary legislative measure designed to streamline collection of foreign intelligence from targets located outside the United States. The FAA expired on February 16, 2008, and Congress thereafter enacted the FAA, key provisions of which are set to expire on December 31, 2012. Section 702 of the FAA generally governs the acquisition of foreign intelligence information from or with the assistance of an electronic communications service provider by targeting non-United States persons reasonably believed to be located outside the United States. Acquisitions under Section 702 are conducted through electronic surveillance or a search of stored communications.4 (U FOUO) This report describes the Of?ce of the Inspector General?s (OIG) review of the Federal Bureau of lnvestigation?s (FBI) activities under Section 702 of the FAA. The OIG assessed the policies and procedures for conducting targeting and post?targeting activities under Section 702 from September 2008 through early 2010. As required by Section 702(l)(2) and (3), the OIG also reviewed the number of targets that were later determined to be located in the United States at the time of acquisition and the number of disseminated intelligence reports containing a reference to a US. person identity, including identities disseminated in response to requests for US. person identities not referred to in the original reporting. (U FOUO) To conduct its review, the OIG interviewed approximately 45 individuals, including FBI personnel who administer the 702 Program and senior FBI of?cials in the Counterterrorism Division and Of?ce of General Counsel. We also interviewed attorneys in the Department of Justice?s National Security Division (NSD), and of?cials in the National Security Agency (NSA) and the Of?ce of the Director of National Intelligence. In addition, we reviewed thousands. of documents related to the 702 activities and conducted various statistical and other analyses based on data provided to us by the FBI and other agencies. 4 As used throughout this Executive Summary and the report, ?electronic surveillance? generally refers to the interception of electronic communications as they are transmitted. A search of ?stored communications? generally refers to the acquisition of electronic communications that are in electronic storage, such as on an Internet service provider?s (ISP) servers. DOJ-016-00943 H. (U) Background A. Section 702 of the FISA Amendments Act of 2008 (U FOUO) Section 702(a) of the FAA authorizes the targeting of persons reasonably believed to be located outside of the United States to acquire foreign intelligence information, without an individualized FISA Court order.5 (U FOUO) The af?rmative authorization contained in Section 702(a) is limited by several prohibitions set forth in Section 702(b). The chief prohibition is that an acquisition authorized under Section 7 02(a) may not intentionally target a United States person.6 Section 702(b) also prohibits the intentional targeting of any person ?known at the time of acquisition to be located in the United States,? and the intentional targeting of a person ?reasonably believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States? the prohibited practice commonly referred to as ?reverse targeting.? The requirements of Section 702 that the acquisition target non-United States persons reasonably believed to be located outside the United States at the time of acquisition form what the Intelligence Community commonly refers to as the ?foreignness? requirement. The foreignness requirement is designed to ensure that all persons located in the United States, and United States persons located anywhere, are afforded the protections and procedural requirements for acquisitions under other sections of the FAA and the individualized court order provisions of traditional FISA. (U FOUO) Section 702(0) requires that acquisitions made pursuant to Section 702(a) must conform to targeting and minimization procedures adopted by the Attorney General, in consultation with the Director of National Intelligence. The targeting procedures must be reasonably designed to meet the foreignness requirements of Section 702, and the minimization procedures must meet the statutory rules in FISA that apply to information acquired 5 (U FOUO) Section 7 01(a) incorporates the same definition of ?United States person? as provided in Title I of FISA: (U) ?United States person? means a citizen of the United States, an alien lawfully admitted for permanent residence . . . an unincorporated association a substantial number of members of which are citizens of the United States or aliens lawfully admitted for permanent residence, or a corporation which is incorporated in the United States, but does not include a corporation or an association which is a foreign power, as de?ned in subsection (2), or (3) of this section. (U) 50 1801(i). 6 (U FOUO) The procedures for targeting United States persons outside the United States under the FAA are set forth in Sections 703 and 704 of the Act. DOJ-016-00944 through electronic surveillance and physical search. Section 702(g) requires the Attorney General and the Director of National Intelligence to ?le written certi?cations with the FISA Court attesting to the fact that appropriate targeting and minimization procedures are in place, with copies of the procedures attached.7 These certi?cations are subject to judicial review and provide the primary mechanism by which the FISA Court conducts its judicial oversight of the implementation of Section 702. (T5) bl, b3, b7E (U FOUO) Section 702 also requires extensive reporting and oversight concerning activities authorized under the statute. Section 707(b)(l) requires the Attorney General to provide Congress with a Section 702 Semiannual Report that includes: 0 (U FOUO) all certi?cations submitted during the reporting period; 0 (U FOUO) the reasons for the exercise of any exigent circumstances authority under Section 702(c)(2); 0 (U FOUO) any directives issued during the reporting period and a description of any action taken to enforce them; 0 (U FOUO) a description of any judicial review of the certi?cations and any targeting and minimization procedures during the reporting period; 0 (U copies of any compliance review conducted by the Attorney General; 0 (U FOUO) copies of any procedures implementing Section 702; and 0 (U FOUO) a description of any incidents of noncompliance by the Intelligence Community or by the providers. 7 (U FOUO) Unlike traditional FISA applications seeking authority to conduct electronic surveillance within the United States, the certi?cations are ?not required to identify the speci?c facilities, places, premises, or property at which an acquisition authorized under subsection will be directed or conducted.? Section 702(g)(4). ISA DOJ-016-00945 Section requires the Attorney General and the Director of National Intelligence to conduct semiannual assessments of the compliance with its targeting and minimization procedures. Section 702(l)(2)(B) and (C) requires the Inspector General to review certain FBI activities related to US. persons. Section 702(l)(3)(A) requires the Director of the FBI to also conduct annual reviews of certain FBI activities concerning U.S. persons. B. Roles of the FBI, the NSA, and the CIA in the 702 Program The FBI and the NSA are the only agencies authorized to acquire foreign intelligence information under Section 702. The Central Intelligence A ency CIA) participates in Section 702 (S) 131,133,137}; The NSA is the lead agency in the 702 Program and during the review eriod was the onl a ency with the formal authority to initiate? an _under FISA Court-approved FAA procedures. Thus, durin our review period, the NSA initiated all such (S) (S) (S b1, b3, b7E WThe FBI conducts two general activities under Section 7 02. First, it ap roves the requests to acquire (S) bl, b3, . b7E Before approvmg the NSA 3 requests, the FBI must (3) the foreignness of the presumed user of the designated account to ensure that the targeted user is a non-US. person reasonably believed to be located outside the United States. When the NSA seeks to acquire the communications of desi nated tar ets, (S) Second, the FBI acquires from the participating (5) providers and routes the raw unminimized data to the NSA and, at the directionnoted, a ?selector? is either a telephone number or an identi?er used for Interne mu ications, such as an e-mail account. Because the tar eting activities b1 b3 under the 7 02 Program are limited to acquiring#from (S) domestic ?(service prov1 ers (usu Internet service providers), the b7E term ?selector, as use roug out his report, refers to an identifier for Internet communications, such as an e-mail address. DOJ-016-00946 The FBI retains a (S) portion of the raw data for analysis and dissemination as ?nished intelligence bl, 133? products. 7E These two basic activities, which are discussed below and in detail in Chapters Three and Four of the report, are carried out by ersonnel in the Counterterrorism Division?s These personnel are drawn rimarily from the b1, b3, b7E two of ?ve units within We refer to these personnel as the 702 Team. The 702 Team is sup orted also works closely with attorneys from the FBI Of?ce of General Counsel (OGC), including attorneys we refer to in this report as the Operations Attorney and the Policy Attorney. (U) The Targeting Activities Under Section 702 The rim role acquire the This process (S) begins with the determination, based on intelligence from other a encies b1, and its own anal sis of signals intelligence already collected, that i (3) b3, a selector (typically an e?mail address) may yield foreign b7E intelligence information. The NSA applies its FISA Court-approved targeting procedures to determine that the account is used by a non?US. person reasonably believed to be located outside the United States. The NSA ma a selector (Ts) When the NSA targets a selector the FBI, through rovides technical assistance (TS) only. When the NSA nominates a selector (T5) the 702 Team must ?rst a the own tar etin rocedures before conductin the (TS) b1, b3, b7 TheNSA?nominauonsare 1.. forwarded to the 702 Team in two ways: (1) by ?selector sheets? that are e- b3, mailed to the 702 Team each day, and 2 through an FBI system called PRISM, b7?E (S) ISA DOJ-016-00947 (S) (S) TOP FISA A. The Targeting Procedures The 702 Team?s are responsible for applying the FISA Court-approved targeting procedures to the nominated selectors. The work of these is reviewed by supervisory special agents or the Unit Chief, and in some instances, by attorneys in the Of?ce of General Counsel and of?cials in the NSD, for a ?nal determination as to whether a can proceed. To implement the eneral re uirements of its tar eting procedures, the FBI developed for? which rovide the 702 Team step?by-step procedures for (5) b1, b3, b7E processing NSA (5) b1, b3, b7E the FBI has two primary obligations under its targeting procedures. First, the FBI must review and evaluate the suf?ciency of the explanation for its reasonable belief that the user of the nominated account is located outside of the United States, and the information that the NSA provides concerning the user?s non-United States person status. The targeting procedures state that this suf?ciency review will be done ?in consultation with? the NSA. The second of the two primary obligations under its require the FBI to conduct The targeting procedures do not obligate the FBI to conduct an independent, de novo analysis of a target?s US. person status and location. Rather, unless the FBI the targeting procedures state that ?the FBI will acquire In addition, the b7E targeting procedures state that the will . . . be responsible for determilguhg that a signi?cant purpose of the acquisition is to obtain foreign intelligence xv TOP SEC FISA (S) b1, b3, DOJ-016-00948 TOP A information.? In View of these provisions, the 702 Team approaches its targeting responsibilities with considerable deference to the targeting judgments. (U FOUO) We concluded that overall the 702 Team has implemented its targeting procedures with commendable deliberation, thoroughness, and professionalism. Our more speci?c ?ndings regarding the targeting activities are summarized below. 1. W). Findings and Recommendations Relating to the Review and Evaluation of the Suf?ciency of the Foreignness Determinations (The? Factor (5) The OIG determined that approximately 8 percent of nominations submitted to the FBI during the review eriod were based b1, b3, on the factor, which is de?ned in the as follows: (TS) b7E (T5) 9 After reviewing a draft of this report, the NSA objected to this characterization of the uthority to the extent it suggests that the NSA lacks the (S) fundamental authority- . (S) b1, b3, b7E xvi DOJ-016-00949 WW TS b1,b3, b7E TS) b1, b3, b7E WE). However, the OIG reviewed pleadings, memoranda, transcripts, and court opinions provided by the NSD establishing that, in multiple contexts other than the FAA, the FISA Court has previously approved TS b1, b3, b7E The documents we reviewed also included an August 2008 ?ling with the FISA Court in support of the first FAA certi?cation demonstrating that the FISA Court was aware of the use of - (TS) b1, b3, to establish foreignness. NSD of?cials told the OIG that they are b7E con?dent the FISA Court is aware that, using the factor in the Ts) context of the (TS) to establish its reasonable belief that the user of a designated account is located outside the United States at the time of acquisition. bl, b3, b7E 10 WThe targeting procedures remained unchanged throughout the 016?s review period. xvii TOP DOJ-016-00950 TOP bl b3 9 b7E Notably, senior members of the 702 Team suggested that the FBI may interpret ?factor more strictly if it uses this factor to b1, b3, support its own nominations in the future. The OIG agrees that the FBI shoul b7E carefully consider how it intends to use the factor, if at all, when(S) it assumes the responsibility of nominating its own selectors for 702 coverage. The OIG also determined that approximately one percent of NSA nominations were predicated on foreignness explanations that used data older than one year. FBI witnesses generally agreed that foreignness information that was at least one year old raised questions about the suf?ciency of the foreignness determination, yet the OIG found no indication that the 702 Team ever contacted the NSA for additional, possibly more recent information when asked to approve such nominations. Both the NSA and the FBI told the OIG that the information on the selector sheets represents the most current information available to the NSA at the time of nomination. However, we determined that the NSA sometimes develops more recent information about a targeted user?s eligibilit for 702 coverage after the nomination has been submitted butd (3) b1, b3, We therefore recommend that the FBI b7E consider issuing guidance advising when the 702 Team should seek more current information from the NSA about a targeted user?s eligibility for Section 702 coverage. This guidance should ensure that the requests to the NSA for more current information will be made in a consistent manner. 2. Findin and Recommendations Relating to the b1, b3, (S) b7E The second of the two primary obligations under its tar etin procedures is to (S) The tar eting procedures require 113;?? the FBI to conduct these (S) FBI Targeting Procedures, 1} 4. b1, b3, b7E DOJ-016-00951 b1, b3, b7E 5) . The set forth deta?ed procedures for the 702 Team to follow in conducting its b1, b3, Each of the process is b7E Generally, the- quire the 702 Team 5 an b1, b3, b7E b1, b3, b7E b1, b3, b7E TOP DOJ-016-00952 TOP b1, b3, b7E b1, b3, b7E (3) b1, b3, b7E Accordin to the Lead Program Coordinator for the 702 Team, this enhanced has (S) been incorporated into the training that 702 Team personnel must complete before they may conduct and will be added to a forthcoming (3) updated version of the (S) b. Documentatibn of Targeting Activities (3) along with the selector sheet b1, b3, and the completed checklist, in a selector ?le. As discussed below, the b7E contents of the selector ?le form the basis for the decision Whether to approve the request to conduct ?for the (S) nominated selector. The OIG found the 702 Team?s documentation of its targeting activities to be extremely thorough and well-organized. b1, b3, c. Gapi? We identi?ed one gap in the 702 Team?s procedure for_ -that we believe can readily be remedied to improve the quality of the tar eting activities at ve little cost in terms of time or resources. Under the blTOP DOJ-016-00953 TO ISA bl, b3, b7E (S) bl, b3, b7E W). Taking into account the volume of selectors nominated by the NSA and the complexity of the we concluded that the (3) b1) generally were conducted with the reasonableness S) required by the targeting procedures, and that the FBI met this standard of b7E diligence consistently throughout our review period. b1, 3. b3) b7E bl, b3, b7E (TS) bl, b3, b7E xxi DOJ-016-00954 b1 TS b7E 4. IFOUO) Planned Implementation of FBI Nomination Activities As discussed in Chapter Two of the report, the FBI plans to greatly expand its role in the 702 Program in 2012 by nominating selectors for Section 702 coverageWDuring the review period, several procedural and technical issues remained to be worked out before the FBI could begin nominating selectors, which witnesses told us was expected to begin in early 2013. While ?nalizing this report the OIG learned that the FBI began nominating its ?rst selectors in April 2012. B. Findings and Recommendations Relating to Selectors Used by Persons Who Have Traveled in the United States WThe review of the application of its targeting rocedures included an assessment of how the FBI processed nominations b1, b3, The targeting procedures (8) b7E impose no obligations on the FBI regarding accounts used ersons who are found to have traveled in the United States prior to a (S) However, in late 2007 the ODNI Civil Liberties Protection xxii TOP SEC ISA DOJ-016-00955 ISA Of?cer raised concerns that the b1 b3 b7E To address these concerns, the FBI implemented a ecial review process for nominations involving targeted users who have (S) b1, b3, b7E During the review period, the OGC consulted with attorneys in the NSD when conducting these reviews. The OIG identi?ed approximatel that had (TS) been subject to some level of FBI analysis fo our review(TS) period. We determined that the FBI never rejected a nominated selector based explicitly on - concerns during the review period. We also (TS) b1} 133? conducted a careful review of selector ?les and concluded that although the b7E OGC collected all the information relevant to making a? (T5) determination for each selector it reviewed, there did not appear to be a discernable set of rinci les idin the FBI anal sis of However, we believe that the process was not a meaningless exercise. The NSA Ts withdrew several selectors after learning that the FBI had found (TS) and would be submitting the nomination to the FBI OGC for review. The OIG also analyzed nominations for involving tar ets who had bl, b3, b7E DOJ-016-00956 b1, b3, b7E The FBI and other participating agencies have initiated a reassessment of the review rocess for nominations involvin selectors b3 used by persons who have The OIG b7E believes that this reassessment should continue, and that the FBI should consider the following factors. bl, First, we believe that the review rocess need not be in?exibl invoked for all nominations that involve (S) Second, meaningful FBI b1, OGC scrutiny should be applied to nominations involving targeted users with a b3, (5) b7E Third, FBI OGC review should be re uired as art of any FBI plan to nominate accounts for a- (5) under Section 702 where it has been determined (3) that the resumed users The OIG therefore recommends that the FBI continue to b1, b3, conduct additional reviews of nominations involving targeted users who have b7E and that the FBI document the guiding principles for conducting these reviews. The FBI should also use these reviews to evaluate the issues previously raised by the OGC with regard to - (5) r0 riateness (S) C. IFOUO) Findings and Recommendations Relating to Statutory Reporting Requirements for FBI Targeting Activities (U FOUO) Section 7 provides that, ?with respect to acquisitions authorized under subsection [the shall review the number xxiv DOJ-016-00957 TOP of targets that were later determined to be located in the United States and, to the extent possible, whether communications of such targets were The FBI is also required to conduct an annual review of the identical information. See Section As of February 2012, when a draft of this report was given to the FBI for its review, the FBI had submitted one annual report that covered the period of September 1, 2008, through bl, b3, August 31, 2009 (the 2009 reporting period), effectively the ?rst year of FBI b7E operations under the FAA. 11 In that report the FBI stated that it ?did not discover . . . [and] did not receive any reports from either NSA or CIA during the relevant reporting eriod indicatin that the FBI had acquired subsection of a person who was later (5) determined to be located in the United States at the time of the acquisition.? However, in conducting its statutorily mandated review, the OIG determined that durin our review eriod for tar etin activities, (S) including several acquisitions where we are con?dent based 113;?? on the information available to us that the incidents met the statutory reporting criteria. For example, we found several instances in which the FBI acquired _communications on the same day that the NSA (S) determined through analysis of intercepted communications that the person was in the United States. We found other instances in which the NSA reviewed the contents of communications and similarly determined (3) that the targeted user was in the United States when the acquisition occurred. Most of these I acquisitions occurred during the 2009 reporting period, and for that reason we believe that the annual report was de?cient. (5) b1, b3, b7E The OIG made these determinations by reviewing reports that the NSA is required to submit to the NSD by its targeting procedures whenever it acquires the communications of a person who is later determined b1, b3, to be in the United States or a US. person at the time of acquisition. We b7E com ared these reports to FBI records of its acquisitions of - (S) As noted, for several of these acquisitions, the NSA 11 (U FOUO) On May 22, 2012, the FBI transmitted two annual reports to Congress that covered the periods of September 1, 2009, to August 31, 2010, and September 1, 2010, to August 31, 2011, respectively. The OIG received copies of these documents but was unable to fully assess their contents prior to releasing this report. XXV TOP SEC DOJ-016-00958 TOP SA information shows that the user of the tar eted selector was in the United States on the day the user?s were acquired. For other (5) b1, b3, acquisitions, the data contains a strong indication that the user was likely in b7E the United States on the day the user?s communications were acquired, but the information available to the OIG was not suf?cient to determine with certainty that each of the incidents in fact met the statutory reporting criteria. We believe that the expertise in analyzing presumed users?_in (S) the targeting context can be applied to determine whether a user was in the United States at the time an acquisition occurred, and therefore ineligible for coverage under Section 702. In July 2011, the OIG met with senior FBI Counterterrorism Division, OGC, and Inspection Division of?cials to present our preliminary ?ndings and the methodology we used to reach them. The FBI of?cials stated b1, b3, at that time that the FBI was still exploring how to compile the requisite b7E information for its 2010 reporting period. They also expressed concern about being required to report on acquisitions for particular selectors that may also be the subject of separate reporting by the NSA, resulting in what they characterized as (5) ML The OIG does not believe there is any merit to this concern. First, the statute unambiguously requires this accounting from ?the head of each element of the intelligence community conducting an acquisition under [Section See Section 7 The FBI and the NSA both conduct acquisitions under Section 702, and therefore both a encies are re uired to I submit these reports. bl, b3, (5) b7E hese distinctions, it is understandable that Congress would want to assess these acquisitions separately. Third, to the extent there are reportable acquisitions for both agencies arising from the conduct or_ that fact can be noted in the annual reports. (U FOUO) The OIG recommends that the FBI amend its 2009 annual report and ensure that it ful?lls its reporting obligations under Section without delay. (5) bl, b3, b7E DOJ-016-00959 ORN FISA S) b1, b3, b7E We therefore recommend that the FBI consult with the NSA about whether and under What circumstances the FBI should receive information developed after the NSA has requested a of a selector. At a (S) minimum, we believe that the FBI should re uest that the NSA rovide it with copies of all reports required under (S) and that the FBI should use these reports when meeting the statutory reporting requirements of Section N. The Post-Targeting Activities Under Section 702 6 FBI conducts in the 702 (T5) route them in the form of raw unminimized data to the NSA and, at the direction, to the FBI and the CIA. The acquisition 131,133, and routing of 702 data from the roviders on behalf of the Intelli ence Community is conducted by (TS) The second basic activity that th Pro am is to See FISA Court Memorandum inion, W). - routes all the Section 702 data it acquires from the 131,133, roviders to the NSA and at the direction? (5) b7E On October 14, 2009, the FBI began to request that a portion of the raw 702-acquired data also be ?dual routed? to the FBI so that it could retain this data for analysis and dissemination in intelligence reports. Prior to b1, acquisitions are re erre to as ?upstream co ection ecause ey occur at NSA co ection sites b3, located ?upstream? from the domestic providers. Upstream collection is conducted without the b7E technical involvement of the FBI. xxvi i DOJ-016-00960 ISA October 2009, none of the Section 702 data that the FBI acquired for the NSA was dual routed to and retained by the FBI. Section 702 data that is dual routed to the FBI ismaintained in alon with other FISA-acquired (5) ministered by The FBI is required to acquire, retain and disseminate Section 702 information in accordance with its FISA Court- b1, b3, approved Standard Minimization Procedures (SMPs). b7E the information. A. The Standard Minimization Procedures As required by the FISA statute, the SMPs are ?speci?c procedures that are reasonably designed in light of the purpose and technique of the particular surveillance or physical search to minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information.? See 50 U.S.C. 1801(h) 85 1821(4). Though initially designed to apply to information of or concerning a United States person that was collected under traditional FISA, the SMPs were adapted to Section 702 through Attorney General-approved language that conforms relevant provisions to Section 702. The FBI has also developed various internal guidance documents to explain how 702-acquired data must be handled by FBI personnel. The SMPs provide that the FBI may only acquire 702 information in accordance with its targeting procedures, and must purge from its systems any communication it has acquired and retained that is inconsistent with the targeting and acquisition limitations set forth in Section 702(b). The retention provisions of the SMPs restrict access to 702- acquired information to authorized users who have been trained on the requirements of the SMPs and Section 7 02. The SMPs provide that authorized users may access raw FISA-acquired information on a continuing basis only as necessary to determine whether it reasonably appears to be foreign intelligence information, to be necessary to understand foreign intelligence information or to assess its importance, or to be evidence of a crime (the SMP minimization standards). Once information has been assessed as meeting SMP minimization standards, it may be disseminated that is, made more broadly available outside of - However, if the information is ?of or concerning? a United (5) States person, the SMP Policy Implementation Guidelines (SMP bl, b3, b7E TOP SE DOJ-016-00961 TOP Guidelines (3) b1 b3 13 b7E Under the SMP Guidelines, only case coordinators in- (where the 702 Team is located) are authorized to mark 702-acquired information in - In practice, however, the burden is on the operators in (3) b1, the ?eld to apply SMP minimization standards to the information they wish to b3, have marked. Thus, the 702 Team case coordinators defer considerably to the b7E knowledge and judgment of the requesting agents and concerning which marking to apply and why the marking is justi?ed. B. W). FBI Retention of Section 702-Acquired Information For the FBI to retain 702?acquired data for its own analysis, it must ?rst request the NSA to allow the data to be ?dual routed? to the FBI. The OIG examined the evolution of the Section 702 dual routing and retention policies and practices through April 2010, as well as how the data is maintained in and purged from FBI systems. 1. Findings Relating to Early Dual Routing and Retention Issues The FBI did not be in to re uest dual routin of 702 data until October 14, 2009the information of or concerning a U.S. person does not meet the SMP minimization standards, the FBI must ?strike or substitute a characterization? for the person?s identity before the information may be disseminated. SMPs, Section xxix TOP FISA DOJ-016-00962 TOP SEC (WThe NSA is required by its targeting procedures to conduct post-targeting analysis of data acquired under Section 702, whereas the FBI is not explicitly required by its SMPs to review the 702 data that it retains. 15 (U FOUO) Art Cummings, the Executive Assistant Director for the National Security Branch at the time of the policy change, retired from the FBI in April 2010. He declined the request for an interview. TOP SEC A DOJ-016-00963 TOP (S) 131,133, b7E (3) b1, b3, b7E The OIG concluded that the careful design and implementation of the means by which 702 data would be housed, accessed, and tagged was not matched with a clear, timely, and well?considered policy from FBI executive managers concerning the dual routing and retention of this data. It was not until after the automatic dual routing request process was in place for several weeks that the executive management ?rst began to focus in b1, b3, earnest on whether the FBI should amass 702 counterterrorism data in- (S) b7E rather than on a selector-speci?c basis. We believe these policy issues should have been more fully considered in advance of initiating the dual routing and retention process in October 2009. 2. Winding Relating to Access to and Purging of 702-Acquired Data Retained in - (3) Section 702-acquired data that the FBI retains for analysis is stored in ,Irg?ich is administered by When the FBI ?rst prepared to retain 702 data, 702 Team worked with and the FBI OGC to make b1, sure that the 702 data would be labeled as 702-ac uired to distinguish it from b3 the traditional FISA data that is also housed in (SDhe FBI also controlled b7}; access ri to the 702 data In addition, the FBI Authorized users of 6 required to along with each 702?acquired communication when the communication is used outside of - such as in a disseminated intelligence report, so the data can (5) be traced in the event it must later be purged. WThe 702 Team is responsible for tracking 702 data that must be purged from I systems. The FBI typically learns that 7 02-acquired data must be purged when the NSA determines through post-targeting analysis that TOP SA DOJ-016-00964 the targeted communicant was in the United States or a U.S. person at the time of acquisition, and therefore not eligible for 702 collection. The NSA conveys this information to the FBI through urge reports. The 702 Team 131,133, tracks the tainted data by consulting with i, which maintains access logs b7}; of 'each authorized user?s activity in 430d then follows up with authorized users who may have included the data 1n disseminations to ensure that the data has been destroyed. - is responsible for purging the data from - (5) The 01G found that the 702 Team was diligent and thorough in tracking tainted 702 data and notifying authorized users and -personnel to destroy it. C. Dissemination of Section 702-Acquired Information The FBI de?nes ?dissemination? to mean ?providing information to foreign of?cials and entities, and federal, state, local, and tribal of?cials and entities, as well as sharing within the FBI when (or at the time) the b1 b3 acquired information is loaded into a FBI system which allows for broad b7?E access in the FBI SMP Guidelines, App. B. The FBI (5) provided the OIG with all disseminated intelligence reports containing 7 02 information from the inception of the pro ram throu A ril 2010. Each intelligence report was in the form of an that (S) had been loade (S) 1. W). Findings Relatin to Storage of Section 702 b1: b3> Intelligence Reports in b7E In addition to having exclusive authority to mark 702?acquired data in as meeting SMP minimization standards, the 702 Team is also (S) responsible for maintaining disseminated intelligence reports that contain 702 data. The 702 Team maintains these reports through an administrative case b1, b3, filing system in - using one administrative sub?le for reports containing (5) ME 7 O2?acquired U.S. person information and another sub?le for reports that do not. Each disseminated report must identify the correct sub?le in the text of the report so that the document can be found through a text ?for (5) auditing and oversight purposes. The OIG found that relatively few disseminated intelligence reports were either mis?led, mislabeled, or both, potentially affecting oversight and the reporting to Congress, both of which rely on accurate ?ling in-. (S) DOJ-016-00965 2. (U Findings Relating to Application of the Standard Minimization Procedures to Disseminated Intelligence Reports (U FOUO) The NSD and ODNI jointly conduct reviews to assess the compliance with its SMPS. During our review period, these compliance assessments concluded that ?all references to United States persons reviewed were consistent with the applicable minimization procedures. ?16 (S) b1, b3, b7E OIG found that operators in the ?eld generally gave careful consideration to how the information met the minimization standard. 3. Findings and Recommendations Relating to Treatment of 702-Acquired Metadata in Disseminated Intelligence Reports b1, b3, b7E 16 However, the joint assessment team identified four disseminations that did not include the FISA warning statement (or caveat?) required by (S) 50 U.S.C. 1825(c) and The warning statement advises that FISA- acquired information may only use in a criminal proceeding with the advance b1, b3, b7E authorization of the Attorney General. ii a DOJ-016-00966 b1Findings and Recommendations Relating to Statutory Reporting Requirements for FBI Dissemination Activities (U Section 702(l)(2) (B) provides that, ?with respect to acquisitions authorized under subsection [the shall review the number of disseminated intelligence reports containing a reference to a United States- person identity and the number of United States-person identities subsequently disseminated by the element concerned in response to requests for identities that were not referred to by name or title in the original MThe FBI is also required to conduct an annual review that provides an ?accounting? of the identical information. See Section 702(l)(3) (A) DOJ-016-00967 and As noted above, the FBI submitted one annual report that covered the period of September 1, 2008, through August 31, 2009 (the 2009 reporting period). Because the FBI did not begin retaining 702?acquired data until after the 2009 reporting period, it reported that it ?did not disseminate any intelligence reports containing a reference to a United States-person identity derived from acquisitions conducted under [Section during that period. For the same reason, the FBI also reported that it did not disseminate any U.S. person identities that were not referred to by name or title in original reporting. In conducting its statutorily mandated review, the OIG reviewed the intelligence reports that the FBI disseminated between December 2009 (S) and April 2010. These reports would fall within the annual reporting period for September 1, 2009, through August 31, 2010'. However, as of February 2012, the FBI had not conducted this statutorily required annual reviewThe FBI submitted its annual reports for September 1, 2009, through August 31, 2010, and September 1, 2010, through August 31, 2011, on May 22, 2012. DOJ-016-00968 acacc?g?oa EOE A389 93 ,2 3 a a Eb Tang 7- FISA (S) b1, b3, b7E V. (U) Conclusion m. The OIG believes that in general the FBI responsibly implemented its Section 702 targeting procedures during our review period. (S) bl, b3, b7E The OIG found that the FBI generally conducted its post- targeting activities responsibly as well, and approached its authority to retain and disseminate 702?acquired data with deliberation and foresight from the standpoint of ensurin com liance with the re uirements and limitations of b1 b3 b7E Section 702. (S) (S) bl, b3, b7E DOJ-016-00970 bLb2~b7E Lastly, we found that the FBI has not'met all of its statutory annual reporting requirements under Section 702. As of February 2012, the FBI had issued one annual report that covered various Section 702 activities from September 2008 through August 2009. However, the OIG found that this report was de?cient because it did not provide the number of targets whose stored communications were acquired and who were later determined to be in the United States at the time of acquisition, as required by the statute. We also determined that through at least February 2012, the FBI had failed to provide Congress with subsequent annual reports about its Section 702 activities. In addition, we concluded that the FBI lacked the guidance necessary to ensure that the personnel who will be responsible for compiling these annual reports are able to do so with a consistent understanding of the reporting requirements of Section 702. We recommend that the FBI correct de?ciencies in its ?rst annual report, and that FBI OGC issue guidance necessary for meeting its annual reporting requirements in a timely manner. (U FOUO) Based on our ?ndings, we made seven recommendations designed to improve the conduct of its activities under Section 702. The FBI and the National Security Division have provided comments to these recommendations, which are appended to this report. The OIG intends to closely monitor the progress in implementing these recommendations. DOJ-016-00971 (U) CHAPTER ONE INTRODUCTION (U FOUO) The Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008 (FAA) was signed into law on July 10, 2008. The FAA was enacted as part of Congress?s effort to modernize the Foreign Intelligence Surveillance Act of 1978 (FISA), codi?ed at 50 U.S.C. 1801-1885. WThe FAA followed earlier efforts to enhance the nation?s ability to gather signals intelligence in the wake of the terrorist attacks of September 1 l, 2001. In October 2001, the President authorized a highly classi?ed program, known as the President?s Surveillance Program, to conduct electronic surveillance of certain communications into and out of the United States without seeking orders from the Foreign Intelligence Surveillance Court (FISA Court).20 This program was transitioned in stages to FISA Court supervision beginning in 2004. However, according to a former senior Justice Department of?cial familiar with these events, in May 2007, the FISA Court imposed rigorous procedural requirements on the government?s foreign surveillance authority, causing the National Security Agency (NSA) to place fewer foreign selectors under coverage than it wanted to.21 To address concerns that the Intelligence Community was unable to swiftly collect critical foreign intelligence, Congress thereafter enacted two major amendments to the original FISA statute. The ?rst of these amendments was the Protect America Act of 2007 (PAA), a temporary legislative measure that expired on February 16, 2008. It was followed by the FAA, key provisions of which are set to expire on December 3 1, 2012. (U The FAA authorizes the collection of foreign intelligence information from persons reasonably believed to be located outside of the United States. This portion of the FAA contains separate sections authorizing such collection under three different circumstances: targeting non-U.S. persons outside the United States (Section 702); acquisitions inside the United States targeting U.S. persons outside the United States (Section 703); and other acquisitions targeting U.S. persons outside the United States (Section 704). 20 (U The FISA Court was established under the FISA statute to review the government?s applications to exercise FISA authority and grant orders approving such applications. 50 U.S.C. 1803. 21 MA ?selector? is either a telephone number or an identifier used for Internet communications, such as an e-mail account. DOJ-016-00972 ISA (U FOUO) Section 702, which is the focus of this report, allows the Attorney General and the Director of National Intelligence to jointly authorize, for up to 1 year, the targeting of non-U.S. persons reasonably believed to be located outside the United States. To exercise this authority, the Attorney General and the Director of National Intelligence must adopt targeting and minimization procedures that govern how targets are determined to be non- U.S. persons outside the United States and how the information acquired may be retained and disseminated. The statute places limitations on the government?s targeting authority by prohibiting the intentional targeting of persons known to be in the United States at the time of acquisition, and the targeting of persons outside the United States where the purpose of the acquisition is to obtain the communications of ?a particular, known person reasonably believed to be in the United States? (a practice known as ?reverse targeting?). The targeting and minimization procedures adopted by the Attorney General and the Director of National Intelligence are subject to FISA Court review and approval. Wec?on 702 also requires the government to certify that ?the acquisition involves obtaining foreign intelligence information from or with the assistance of an electronic communication service provider.? Under Section 702, foreign intelligence is obtained from these U.S.-based electronic communications service providers (U.S. providers) either by conducting electronic surveillance of communications as they are transmitted, or by conducting a search of communications that are in electronic storage after they have been transmitted. The Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) are the only agencies authorized to acquire foreign intelligence information under Section 702. The NSA is the lead agency in the 702 Program and, durin the review period, was the only agency with the formal authori to i Ei?Eb?? under FISA Court-a roved targetin rocedures. Thus, during our review period, the NSA (S) (S) (5) b1, b3, b7E TOP DOJ-016-00973 The FBI then a hes 1ts FISA b1, b3, Court-ap roved targeting procedures to determine whether (58 b7E theNSA?s s) determination that the presumed user of the account is a non?U.S. person located outside the United States. mime FBI is also responsible for routing to the NSA all communications ac uired from roviders under Section 702, (S) The 702? b1, acquired information may be routed well, but only b3, upon request and subject to the approval of the NSA. b7E The FBI retains this information for analysis and dissemination in connection with its national security investigations. (U This report describes the Of?ce of the Inspector General?s (OIG) review of the use of the authorities provided in Section 702 of the FAA. Section authorizes the OIG to review the compliance with its targeting and minimization procedures. The OIG also conducted this review pursuant to its authority under the Inspector General Act of 1978, as amended, codi?ed at 5 U.S.C. App. 3. (U The compliance with its targeting and minimization procedures is subject to mandatory reviews that are conducted jointly by the Department of Justice (DOJ) and the Of?ce of the Director of National Intelligence (ODNI). The OIG sought to avoid replicating the DOJ and compliance reviews, and instead concentrated on assessing the policies and procedures that the FBI implemented to carry out its targeting and post- targeting activities. (U FOUO) This report also discusses the ?ndings with respect to three reviews we are required to conduct under Section 702(l)(2)(B) and (C) concerning the acquisition and dissemination of U.S. person information. Speci?cally, with respect to acquisitions authorized under Section 702(a), the OIG is required to review: b1, 22 After reviewing a draft of this report, the NSA objected to this b3 characterization the to the extent it suggests that the NSA lacks I (S) pursuant to Section 702. (S) 7B 3 To FISA DOJ-016-00974 TOP 0 (U FOUO) ?the number of targets that were later determined to be located in the United States, and to the extent possible, whether communications of such targets were reviewed?; 0 (U FOUO) ?the number of disseminated intelligence reports containing a reference to a United States-person identity?; and 0 (U FOUO) ?the number of United States-person identities subsequently disseminated . . . in response to requests for identities that were not referred to by name or title in the original (U FOUO) The FBI is also required by Section 702(l)(3) to provide annual reports concerning this same U.S. person information. I. Methodology of OIG Review WDu?ng the course of this review, the OIG interviewed approximately 45 individuals, including FBI personnel who administer the 702 b1? b3: Program (referred to in this report as the 702 Team), senior FBI b7E Counterterrorism Division of?cials, ersonnel in the (5) Ed the who help support 702 ope a ions, former FBI General Counsel Valerie Caproni, and other Of?ce of General Counsel attorneys who provided legal advice to the FBI concerning Section 702 during our review period.23 In addition, we interviewed several National Security Division attorneys, National Security Agency of?cials, and of?cials in the Of?ce of the Director of National Intelligence. We also reviewed thousands of documents, including b1, b3, approximatel individual ?les documenting the processing of NSA (S) b7E requests- approximately- (3) disseminated intelligence reports, FISA Court ?lings, Of?ce of Legal Counsel memoranda, FBI guidance documents and training materials, National Security Division compliance reports, and e-mails among FBI and other officials discussing the 702 Program. b1, Wm addition to conducting interviews and examinin documents, b3) the IG conducted various statistical analyses of the (S) b7E using random sampling and other analytic techniques. 23 (U Art Cummings, the Executive Assistant Director for the National Security Branch until his retirement from the FBI in April 2010, declined the request for an interview. 4 DOJ-016-00975 TO A H. (U) Organization of this Report (U FOUO) In Chapter Two of this report we brie?y describe how certain intelligence?gathering activities ?rst authorized by the President in 2001 were brought under FISA Court supervision, followed by Congress?s effort to modernize the FISA statute through the Protect America Act of 2007 and the FISA Amendments Act of 2008. We also discuss the legal provisions of Section 702, and provide an overview of the FBI of?ces and personnel who administer the 702 Program for the FBI. In Chapter Three we describe the tar etin activities with respect to NSA nomination. . The (T3) review cried for these tar etin activities is from Se tember 2008, - (TS) b1, b3, through TS {3713 (TS) ?rst assess how the FBI inrocessed the in r-roximately two-thirds of these requests for which it and then how it _o rocessed the balance of the reuests (TS) We also (Ts) review the special procedures that the FBI develo ed fo TS) involving ersons who had (T3) (T8) Lastly, we provide our review 0 the number that (T5) were acquired when the presumed user of the targeted account was later determined to be in the United States at the time of acquisition, as required by Section 7 W111 Chapter Four we describe the post?targeting activities, which involve the acquisition, routing, retention, purging, minimization, and dissemination of 7 02?acquired information. The review period for these activities extends through April 2010. However, because the FBI did not begin to retain 702 data until October 2009, we were only able to examine approximately seven months of information related to these post-targeting activities. We describe the policies and practices surrounding the eventual participation in the routing and retention process as a recipient of 702?acquired data, and how those policies and practices changed over time. We also describe the role of the 702 Team and other FBI personnel in the acquisition, retention, and dissemination process, and assess the application of its Standard Minimization Procedures and relevant guidance to disseminated intelligence reports containing 702 information. Lastly, we provide our review of the number of disseminated intelligence reports containing a reference to a US. person identity, as required under Section TO A DOJ -016-0097 6 (U FOUO) In Chapter Five we provide our conclusions and recommendations. Based on our ?ndings, we made seven recommendations designed to improve the conduct of its activities under Section 702. The FBI and the National Security Division have provided comments to these recommendations, which are appended to this report. The OIG intends to closely monitor the progress in implementing these recommendations. DOJ-016-00977 (U) CHAPTER TWO BACKGROUND (U FOUO) In this chapter, we describe the transition of certain foreign intelligence?gathering activities from presidential authority under what was known as the ?Terrorist Surveillance Program,? which was in operation from 2001 through early 2007, to activities approved and supervised by the FISA Court during 2007 . We then describe how efforts to modernize the Foreign Intelligence Surveillance Act of 1978 (FISA) through legislation and continued FISA Court supervision of these activities led to the enactment of the Protect America Act of 2007 (PAA), and later the FISA Amendments Act of 2008 (FAA). (U FOUO) We also provide an overview of Section 702 of the FAA, which authorizes the government to target non?U.S. persons reasonably believed to be located outside the United States to acquire foreign intelligence information, subject to certain limitations and in accordance with FISA Court- approved targeting and minimization procedures. Finally, we provide an overview of the FBI of?ces and personnel who administer the 702 Program for the FBI, as well as a brief description of how the FBI has used Section 702 in the past, and how it intends to use the statute in the future. b7E I. Transition of A. The Terrorist Surveillance Program (U FOUO) Following the terrorist attacks of September 1 l, 2001, the President authorized the National Security Agency (NSA) to use its signals intelligence capabilities to detect and prevent further attacks against the United States. The classi?ed activities that the President authorized and the information derived from them fell into distinct categories that collectively came to be known as the ?President?s Surveillance Program? One category of activity under the PSP was publicly con?rmed by the President in December 2005 following a series of media reports about the surveillance program.25 That activity, called the ?Terrorist Surveillance Program? or 24 (U FOUO) A detailed description of this program may be found in a classi?ed OIG report entitled, Review of the Department of Justice?s Involvement with the President?s Surveillance Program? (July 2009). 25 (U FOUO) The first media account of the NSA surveillance activities appeared in a series of articles published in The New York Times between December 16 through 19, 2005. See ?Bush Lets U.S. Spy on Callers Without Courts,? James Risen and Eric New York Times, December 16, 2005. 7 TO DOJ -016-0097 8 authorized the NSA, . b7E 1ntercept the content of communications into and out of the United States where there was a reasonable basis to conclude that at least one of the communicants was a The TSP and the other intelligence activities authorized by the President under the PSP were legally controversial because these activities traditionally were viewed to be governed by the FISA statute.26 Subject to certain statutory exceptions, and until it was amended in 2007 by the PAA, FISA generally required the approval of the FISA Court whenever the government sought to acquire, for foreign intelligence purposes, ?the contents of any wire communication to or from a person in the United States, without the consent of any party thereto, if such acquisition occurs in the United States.? For the FISA Court to grant authority to conduct electronic surveillance, the government would ?rst have to establish probable cause to believe that the target of the surveillance is a ?foreign power? or an ?agent of a foreign power,? and that ?each of the facilities or places at which the electronic surveillance is directed is being used, or is about to be used? by the target. FISA imposed similar legal requirements to conduct a physical search, including of stored electronic communications. (U When FISA was enacted in 1978, most international telephone calls were carried by satellite. Under FISA, the interception of such calls constituted ?electronic surveillance? only if the acquisition intentionally targeted a US. person in the United States, or if all participants to the communication were located in the United States. Thus, government surveillance of satellite communications that targeted foreign persons outside the United States generally was not considered electronic surveillance, and the government was not required to obtain a FISA Court order authorizing the surveillance, even if one of the parties to the communication was in the United States. In the mid-19805, however, ?ber optic technology began to replace satellites as the primary means for transmitting international (and domestic) communications. Because many of these communications were now ?wire communications? routed through and acquired inside the United States, 2" (U FOUO) Proponents of this View cite 18 U.S.C. which states, in relevant part, that the (U) procedures in [chapter 119 and 1 1 of title18] and the Foreign Intelligence Surveillance Act of 1978 shall be the exclusive means by which electronic surveillance, as de?ned in section 101 of such Act, and the interception of domestic wire, oral, and electronic communications may be conducted. 8 DOJ -016-0097 9 this change in technology brought most electronic communications within de?nition of ?electronic surveillance.? Consequently, the government was required to obtain FISA Court orders to conduct electronic surveillance it previously had been authorized to conduct outside of FISA. (U FOUO) Under the TSP, the President authorized electronic surveillance to be conducted without the particularized probable cause showings to the FISA Court required under FISA. According to a Justice Department memorandum publicly released on January 19, 2006, the TSP was ?supported by the President?s well-recognized inherent constitutional authority as Commander in Chief and sole organ for the Nation in foreign affairs to conduct warrantless surveillance of enemy forces for intelligence purposes to detect and disrupt armed attacks on the United States.? The Department further maintained that the program was lawful because, in the wake of the September 11 terrorist attacks, Congress had passed an Authorization for the Use of Military Force, which ?con?rms and supplements? the President?s inherent power to conduct warrantless surveillance during wartime. B. (U FOUO) FISA Court Orders Beginning in 2004, the PSP activities authorized by the President were transitioned in stages to FISA authority under a series of orders issued by the FISA Court. The last of the activities to come under FISA Court order was the TSP. The transition of the TSP from presidential authority to FISA Court orders was precipitated in part by the disclosure of the program in a series of articles in The New York Times in December 2005. The government?s application to the FISA Court for this electronic surveillance authority was premised on a novel and expansive interpretation of the FISA statute. As noted, FISA generally required the government to establish probable cause to believe that the target of the surveillance is a ?foreign power? or an ?agent of a foreign power,? and that ?each of the facilities or places at which the electronic surveillance is directed is being used, or is about to be used? by the target. In its post?TSP ?lings with the FISA Court, the government proposed that the term ?facilities? be interpreted far more broadly than how the term ordinarily had been applied.27 The government also requested that senior NSA of?cials, rather than a FISA b1, b3, Court judge, be authorized to make individualized ?ndings of probable cause to b7E determine that a particular telephone number or e-mail address was bein used by a member or agent of the targeted entity? (T5) 27 nder the FISA statute, the term ?facilities? generally was understood to apply to speci?c telephone numbers or e-mail addresses (collectively referred to as ?selectors?). DOJ-016-00980 TOP ISA b1, b3, b7E and that the communication was to or (T3) from a foreign country. FISA Court Judge Malcolm Howard granted the government?s application as to foreign selectors on January 10, 2007.28 On January 17, 2007, Attorney General Alberto Gonzales wrote to Senators Patrick Leahy and Arlen Specter, respectively the Chairman and Ranking Minority Member of the Senate Judiciary Committee, to inform them that due to Judge Howard?s order approving the government?s application, collection under the TSP would cease. On March 20, 2007, the government ?led an application to renew Judge Howard?s January 10 Order. The renewal application was ?led with Judge Roger Vinson, the FISA Court ?duty judge? during that week. In an April 3, 2007 Memorandum and Order, Judge Vinson wrote that he could not grant the government?s renewal application. He determined, based on past practice under FISA and the Congressional intent underlying the statute, that the FISA Court, not senior NSA of?cials, must make the necessary probable b1, cause determinations. He also rejected the government?s broad construction of 1,3) the term ?facilities,? concluding that the electronic surveillance to be conducted 1375 by the government was directed at eci?c tele hone numbers and e-mail as) While sympathetic to the government?s stated need for enhanced ?speed and ?exibility? in responding to terrorist threats, Judge Vinson concluded that requirements re?ected a balance struck by Congress between privacy interests and the need to obtain foreign intelligence information, and until Congress took legislative action on FISA to respond to the government?s concerns, the FISA Court was bound to apply procedures. In denying the government?s application, Judge Vinson urged the government to seek a 60?day extension of Judge Howard?s foreign selectors order, which the government subsequently sought and obtained. The government later submitted a revised renewal application and, on May 3 1, 2007, obtained authority from Judge Vinson to conduct electronic surveillance on foreign selectors. This authority, however, was considerably narrower than the authority initially sought from and granted by Judge Howard. Although the government was allowed to conduct electronic surveillance targeting selectors reasonably believed to be used outside the United States and for which probable cause existed to believe were being used 28 Judge Howard declined to authorize? of (TS) b1, b3, selectors used by persons in the United States (domestic selectors) in manner proposed by b7E the government in its application. 10 DOJ-016-00981 b1, b3, or about to be used by? (TS) has associated terrorist entities, the FISA Court and not the NSA - would make the probable cause determinations as to each selector. Under the May 31, 2007 Order, the FISA Court initially approved approximately -foreign selectors for which the NSA previously (TS) had found probable cause to conduct electronic surveillance under the terms of the earlier FISA Court Order. However, according to a former senior Justice Department of?cial familiar with these events, the rigorous nature of the FISA b1, b3, Court?s probable cause review of new selectors submitted to the various FISA b7E Court judges following Judge Vinson?s May 31, 2007 Order caused the NSA to place fewer foreign selectors under coverage than it wanted to. This factor and the comparatively laborious process for targeting foreign selectors under Judge Vinson?s Order combined to accelerate the government?s efforts to amend the FISA statute to streamline and modernize the government?s surveillance authorities within the United States directed at persons located outside the United States. The PAA, and its successor, the FAA, accomplished many of these objectives. The PAA, described brie?y below, was signed into law on August 5, 2007. Because the PAA effectively superseded Judge Vinson?s May 31, 2007, foreign selectors Order, the government did not seek to renew the Order when it expired on August 24, 2007. C. The Protect America Act The Protect America Act of 2007 (PAA), Pub. L. No. 1 1055, was enacted as a temporary measure to address the legal impediments that existed under FISA to the swift acquisition within the United States of communications to or from targeted foreign selectors.29 The PAA accomplished this by amending FISA to exclude from the statute?s de?nition of ?electronic surveillance? the interception of communications to or from targeted foreign selectors. (U FOUO) Under the FISA statute?s original de?nition of ?electronic surveillance,? FISA Court authorization generally was required to intercept any communication to or from a ?particular, known United States person who is in the United States? if the communication was acquired by targeting that person. Such authorization also was necessary to acquire other communications (such as those acquired by targeting persons outside the United States) if the 29 (U FOUO) The PAA was signed into law on August 5, 2007. It was set to expire 180 days after its enactment, or on February 1, 2008. However, Congress passed a bill, signed by the President on January 31, 2008, extending the PAA for 15 days so that discussions on new legislation could continue. No agreement on new legislation was reached during that period, and the PAA expired on February 16, 2008. 11 DOJ-016-00982 communication was a ?wire communication to or from a person in the United States? and the acquisition occurred inside the United States. (U FOUO) The PAA amended FISA by providing: ?Nothing in the de?nition of electronic surveillance . . . shall be construed to encompass surveillance directed at a person reasonably believed to be located outside the United States.? The effect of this amendment was to exclude from the individualized FISA Court application and order requirements of FISA any communication acquired by targeting a person overseas, regardless of where the communication was intercepted, whether the communication traveled by a wire, or whether the target was a known United States person determined by the Attorney General to be an agent of a foreign power located outside the United States. (U In place of these individualized FISA Court applications and orders, the PAA inserted a new legal mechanism to govern the acquisition of communications from persons ?reasonably believed to be located outside the United States.? The PAA provided that the Attorney General and the Director of National Intelligence may authorize the acquisition of foreign intelligence information concerning such persons for up to one year, provided these of?cials certi?ed that there were reasonable procedures in place for the government to determine that a target was reasonably believed to be outside the United States and that the acquisition of the foreign intelligence therefore was not ?electronic surveillance? under the amended de?nition of the term. Unlike traditional FISA, the PAA did not require the Attorney General and the Director of National Intelligence to identify the speci?c facilities or places at which the acquisition of foreign intelligence information was directed. (U In order to authorize such acquisition of foreign intelligence information, the Attorney General and the Director of National Intelligence also were required to certify that the minimization procedures to be used with respect to such acquisitions comported with the procedures adopted by the Attorney General for minimizing information obtained by electronic surveillance under FISA.30 As discussed in Chapters Three and Four, these targeting and minimization requirements are central features of the intelligence-gathering and sharing activities conducted under Section 702 of the FISA Amendments Act as well. 30 (U FOUO) FISA generally requires that with respect to electronic surveillance the Attorney General shall adopt ?speci?c procedures . . . that are reasonably designed in light of the purpose and technique of the particular surveillance, to minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence 50 U.S.C. 1801(h). .1. 12 DOJ-016-00983 (U FOUO) In addition to addressing targeting and minimization requirements in the certification, the Attorney General and the Director of National Intelligence also were required to certify that the acquisition involved obtaining the foreign intelligence information from or with the assistance of a communications service provider having access to the communications, either as the communications were transmitted or while they were stored, and that a ?signi?cant purpose of the acquisition is to obtain foreign intelligence (U FOUO) The PAA left unchanged the procedures for acquiring foreign intelligence information by targeting foreign powers or agents of foreign powers in the United States, as well as the procedures under Executive Order 12,333 (E.O. 12,333) Section 2.5, to obtain Attorney General approval before acquiring foreign intelligence information against a US. person outside the United States. The ?rst PAA certi?cation was ?led with the FISA Court on August 9, 2007. were ?led with the FISA Court under the PAA. The FISA Court reviewed these certi?cations and approved them, allowing the government to continue the b1, b3, activities authorized by the Attorney General and the Director of National b7E Intelligence to acquire foreign intelligence information concerning persons reasonably believed to be outside the United States without individualized FISA Court approval for up to one year. These acquisitions were conducted by the NSA. As of January 31, 2008, the PAA certi?cations also authorized the FBI to After the PAA expired on (3) February 16, 2008, the government?s foreign intelligence acquisition authority under the statute gradually lapsed as the individual certi?cations expired. The ?nal PAA certi?cation expired in April 2009DOJ-016-00984 1, b3, b7E The role under the PAA thus became virtually identical to its current role under the Section 702 persons reasonably believed to be outside the United States. (U FOUO) Although the Department Viewed the PAA as an adequate temporary ?x to those provisions of FISA seen as outdated because of changes in telecommunications technology, Department and other Intelligence Community of?cials continued to press Congress for more permanent modernization legislation. The result of these efforts was the FISA Amendments Act of 2008. II. (U) The FISA Amendments Act of 2008 (U FOUO) The FISA Amendments Act of 2008 (FAA) was signed into law as Public Law 1 10-261 on July 10, 2008. According to the legislative history, Congress had two primary goals in passing the FAA. First, Congress wanted to provide a sound statutory framework, consistent with the Constitution, enabling the targeting of persons reasonably believed to be located outside of the United States for the acquisitions of foreign intelligence information, while simultaneously affording additional protections to United States persons whose communications are targeted for collection or collected incidentally. In striking this balance, Congress discarded the rede?nition of the term ?electronic surveillance,? which had excluded from individualized order requirement all persons outside the United States, including US. persons, and instead promulgated a speci?c authorization for the acquisition of communications from non-US. persons located outside the United States without an individualized order. The result was a sharply narrowed statute under which US. persons overseas could no longer be mccordin to an attorne in the Of?ce of General Counsel who participated in the W), the document took a long (S) time to negotiate, and was not in ize until ter PAA expired. However, the attorney stated that the - remained in effect after the PAA expired because certifications issued (S) 1? under the PAA were valid for one year, and thus the use of PAA authority extended beyond the b3) expiration. This attorney also stated that the- remains in effect under the FAA to (S) b7E the extent it is relevant to the provisions. Thus, provisions in the- concerning (5) targeting the accounts of US. persons, which is prohibited under the FAA, are considered void. 14 DOJ-016-00985 targeted without an individualized warrant, as had been possible prior to the FAA. (U FOUO) Second, Congress wanted to provide civil immunity for those electronic communication service providers who had provided assistance to the Intelligence Community under the PSP pursuant to written assurances that the program had been authorized by the President and determined to be lawful. See, Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2007, S. Rep. No. 110-209 (Oct. 26, 2007). (U Consistent with these two goals, the FAA contains two primary provisions: an authorization to collect foreign intelligence information by targeting non-US. persons located overseas, including explicit limitations on that authority and an oversight regime to monitor its use; and a mechanism to extend immunity to qualifying electronic communication service providers for prior participation in the PSP. A. The Authorization to Collect Foreign Intelligence Information (U FOUO) The FAA authorizes the collection of foreign intelligence information from persons reasonably believed to be located outside of the United States. The Act contains separate sections authorizing such collection under three different circumstances: targeting non-US. persons outside the United States (Section 702); acquisitions inside the United States targeting U.S. persons outside the United States (Section 703); and other acquisitions targeting U.S. persons outside the United States (Section 704).32 These provisions, and in particular Section 702, which is the focus of this review, are summarized below. 1. Section 702 a. Authorization and Limitations Section 702, which is codi?ed at 50 U.S.C. 1881a, et seq., authorizes the targeting of non-United States persons who are reasonably believed to be located outside of the United States to acquire foreign intelligence information, without an individualized order from the FISA Court.33 The af?rmative authorization contained in Section 702(a) states: 32 (U These provisions will expire on December 31, 2012, unless reauthorized by Congress. See FAA, Section 403(b)(1). 33 (U Section 701(a) incorporates the definition of ?United States person? provided in Title I of FISA: (Cont?d.) 15 DOJ-016-00986 TOP (U) AUTHORIZATION .?Notwithstanding any other provision of law, upon the issuance of an order in accordance with subsection (3) or a determination under subsection (2), the Attorney General and the Director of National Intelligence may authorize jointly, for a period of up to 1 year from the effective date of the authorization, the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence information. (U FOUO) The af?rmative authorization contained in Section 702(a) is strictly limited in several ways. Under the terms of subsection itself, any acquisition under Section 702(a) must be made pursuant to either a FISA Court order (through the approval of a ?certi?cation,? discussed below), or a determination that exigent circumstances exist, as de?ned in Section 702(c)(2) and subject to subsequent and expeditious action by the FISA Court.34 The plain language of subsection also requires that acquisitions pursuant to Section 702(a) must be conducted ?to acquire foreign intelligence information,? and that the person targeted for such acquisition be reasonably believed to be located outside the United States. Id. (U FOUO) Section 702(b) speci?es limitations to the authority to collect foreign intelligence information under subsection (a).35 The chief limitation (U) ?United States person? means a citizen of the United States, an alien lawfully admitted for permanent residence . . . an unincorporated associatiOn a substantial number of members of which are citizens of the United States or aliens lawfully admitted for permanent residence, or a corporation which is incorporated in the United States, but does not include a corporation or an association which is a foreign power, as de?ned in subsection (2), or (3) of this section. (U) 50 U.S.C. 1801(i). 3? (U FOUO) Section 702(c)(2) allows for the Attorney General and the Director of National Intelligence to determine that exigent circumstances exist when, ?without immediate implementation of an authorization under subsection intelligence important to the national security of the United States may be lost or not timely acquired and time does not permit the issuance of an order? from the FISA Court. See FAA 702(c)(2), 50 U.S.C. 1881a(c)(2). When such a determination is made, however, the Attorney General and the Director of National Intelligence must submit to the FISA Court a certification for such authorization ?as soon as practicable but in no event later than 7 days after such determination is made.? FAA 50 U.S.C. 1881a(g)(1)(B). 35 (U) The full text of Section 702(b) states: (U) Limitations?An acquisition authorized under subsection (U) (1) may not intentionally target any person known at the time of acquisition to be located in the United States; (Cont?d.) 16 TOP SA DOJ-016-00987 TOP A imposed by Section 702(b) is that the acquisition may not intentionally target a United States person; as discussed below, the targeting of United States persons under the FAA is addressed in Sections 703 and 704. Section 702(b) also speci?cally prohibits the intentional targeting of any person ?known at the time of acquisition to be located in the United States.? Together, these two limitations that the acquisition target non?United States persons reasonably believed to be located outside the United States at the time of acquisition form what the Intelligence Community commonly refers to as the ?foreignness? requirement. The foreignness requirement is designed to ensure that all persons located in the United States, and United States persons located anywhere, are afforded the protections of the more robust procedural requirements for acquisitions under other sections of the FAA and FISA. (U FOUO) Section 702(b) imposes other limitations and prohibitions designed to ensure that subsection is not used for surveillance directed at persons within the United States, or at United States persons. Speci?cally, acquisitions authorized under subsection may not intentionally target a person reasonably believed to be located outside the United States ?if the purpose of the acquisition is to target a particular, known person reasonably believed to be in the United States? the prohibited practice commonly referred to as ?reverse targeting.? Nor may Section 702(a) be used to intentionally acquire a communication if the sender and all intended recipients are known at the time of acquisition to be in the United States. Finally, Section 702(b) explicitly mandates that acquisitions made pursuant to Section 702(a) must be conducted in a manner consistent with the Fourth Amendment to the United States Constitution, which provides for ?[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.? (U) (2) may not intentionally target a person reasonably believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States; (U) (3) may not intentionally target a United States person reasonably believed to be located outside the United States; (U) (4) may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States; and (U) (5) shall be conducted in a manner consistent with the fourth amendment to the Constitution of the United States. 1 7 TOP DOJ-016-00988 b. Procedural Requirements of Section 702 (U FOUO) Section 702(c) requires that acquisitions authorized pursuant to Section 7 02(a) shall conform to ?the targeting and minimization procedures adopted in accordance with subsections (cl) and and ?upon submission of a certi?cation in accordance with subsection such certi?cation,? as explained below. FAA, Section 702(c)(1). (U FOUO) Section 702(d) requires the Attorney General, in consultation with the Director of National Intelligence, to adopt targeting procedures that are reasonably designed to ensure that the acquisition of foreign intelligence information pursuant to Section 702 complies with the limitations in subsections and Speci?cally, Section 702(d)(1)(A) requires that the procedures ?ensure that any acquisition authorized under subsection is limited to targeting persons reasonably believed to be located outside the United States,? and Section 702(d)(2)(B) requires that the procedures ?prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States.? These targeting procedures are subject to judicial review.36 (U Section 702(6) requires the Attorney General, again in consultation with the Director of National Intelligence, to adopt minimization procedures governing the retention and dissemination of information acquired under Section 702(a) that meet the statutory rules in FISA that are otherwise applicable to data acquired through electronic surveillance and physical searches. Those provisions of FISA provide that the minimization procedures must be designed to ?minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information.? The minimization procedures adopted under the FAA are subject to judicial review?"7 (U In addition to speci?c targeting and minimization procedures, Section 702(f) requires the Attorney General, in consultation with 36 At present, only the NSA and the FBI conduct acquisitions under Section 7 02, and thus are required to submit their targeting procedures to the FISA Court for reviewtargeting proce ures are discussed in Chapter Three. 37 The CIA, NSA, and FBI each receives raw Section 7 OQ-acquired data and is required to retain and disseminate such data in accordance with its own minimization procedures. Therefore, the FISA Court must review the minimization procedures of all three agencies. The minimization procedures are discussed in Chapter Four. Elg? DOJ-016-00989 the Director of National Intelligence, to adopt guidelines to ensure ?compliance with the limitations in subsection and to ensure ?that an application for a court order is ?led as required by [the Section These guidelines are known as the Attorney General?s Acquisition Guidelines. In addition to reiterating the targeting limitations of Section 702, these Guidelines provide that non?United States person reasonably believed to be located outside the United States may not be targeted under subsection 702(a) unless a signi?cant purpose of the targeting is to acquire foreign intelligence information that such person possesses, is reasonably expected to receive, and or is likely to communicate.? (U FOUO) Finally, Section 702(g) requires the Attorney General and the Director of National Intelligence to submit written certi?cations to the FISA Court, either prior to the implementation of an authorization under subsection or in the case of exigent circumstances, ?as soon as practicable but in no event later than 7 days after such determination is made.? Section (B). In addition to attesting to the fact that appropriate targeting and minimization procedures are in place, the certi?cations must also include copies of those procedures. Unlike traditional FISA applications seeking authority to conduct electronic surveillance within the United States, the certi?cations are ?not required to identify the speci?c facilities, places, premises, or property at which an acquisition authorized under subsection will be directed or conducted.? (U FOUO) These certi?cations, ?led ex parte and under seal, provide the primary mechanism by which the FISA Court conducts its judicial oversight of the implementation of Section 702. See FAA, Section 702(i) (establishing the FISA Court?s ?jurisdiction to review a certi?cation submitted in accordance with subsection and the targeting and minimization procedures adopted in accordance with subsections and and amendments to such certi?cation or such bl, b3, b7E 33 (U Except as discussed elsewhere in this report, subsections are not directly relevant to this review. In summary, those subsections address the Attorney General and the Director of National Intelligence?s authority to direct electronic communication service providers to provide the government with information and protect any records pertaining to acquisitions made under Section 702 (Section 702(h)); judicial review of certifications and procedures (Section and the FISA Court?s maintenance and security of records and proceedings (Section 702(k)). 19% DOJ-016-00990 (TS) b1, b3, Each certi?cation contains: I (S) I b1, (U FOUO) FBI targeting and minimization procedures; (5) (TS) b1, b3, b7E c. Oversight Requirements (U Section 707 and 702(l) provides for extensive oversight of the implementation of Section 702: 0 (U FOUO) Section 707(a) requires the Attorney General to submit semiannual reports to Congress that describe, among other things, the judicial review during the reporting period of all certi?cations and targeting and minimization procedures adopted under Section 7 02, and any instances of noncompliance with procedures and guidelines adopted under Section 702(d), and 0 (U FOUO) Section 702(l)(1) requires the Attorney General and the Director of National Intelligence to conduct semiannual assessments of the compliance with their targeting and minimization procedures and the Attorney General?s Acquisition - (TS) b1, b3, b7E 20 DOJ-016-00991 Guidelines. These assessments are submitted to the FISA Court and to Congress. 0 Section 702(l)(2)(B) and (C) requires the Inspector General to review FBI acquisitions of persons later determined to be located in the United States and disseminations of intelligence reports containing a reference to a U.S. person identity. These reviews are submitted to Congress, the Attorney General, and the Director of National Intelligence. 0 (U Section 702(l)(3) (A) requires the Director of the FBI to conduct annual reviews of FBI acquisitions of persons later determined to be located in the United States and disseminations of intelligence reports containing a reference to a US. person identity, among other requirements. These annual reviews are provided to the FISA Court, the Attorney General, the Director of National Intelligence, and Congress. (U FOUO) The OIG discusses each of these oversight requirements in Chapters Three and Four of this report. 2. Sections 703 and 704 (U FOUO) Whereas Section 702 pertains only to non-United States persons reasonably believed to be outside of the United States, Sections 703 and 704 authorize the targeting of United States persons for the acquisition of foreign intelligence information when those persons are reasonably believed to be located outside the United States. Section 703, codi?ed at 50 U.S.C. 1881b, et seq., addresses acquisitions of foreign intelligence information that target United States persons who are reasonably believed to be outside of the United States when the acquisition is conducted, and the acquisition ?constitutes electronic surveillance or the acquisition of stored electronic communications or stored electronic data that requires an order under this Act, and such acquisition is conducted within the United States.? (U FOUO) Section 704, codi?ed at 50 U.S.C. 1881c, addresses other acquisitions targeting United States persons outside the United States in circumstances where that person has a reasonable expectation of privacy and a warrant would be required if the acquisition occurred within the United States. This provision would cover, for example, the physical search of a United States person?s home or of?ce outside of the United States. (U FOUO) Our report is limited to the activities under Section 702. 21 DOJ-016-00992 B. FOUO) Immunity Provisions (U FOUO) The FAA also addresses liability relief for electronic communication service providers who have been alleged in various civil actions to have assisted the US. Government under the auspices of the PSP. Speci?cally, with a certi?cation from the Attorney General, the electronic communication service providers may avail themselves of ?ve statutory defenses, among them, that they acted pursuant to a written request or directive from an appropriate of?cial indicating that the activity in question was authorized by the President and determined to be lawful. See FAA Section In addition to applying retroactively, the immunity provisions of the FAA are not subject to sunset. IFOU0) The Role and Organizational Structure Under Section 702 The FBI conducts two eneral activities under Section 702. First, it approves the requests (S) sometimes called Second, the FBI (3) b1, b3, from participating providers and transmits them in the form b7E of raw unminimized data to the NSA and, at the direction, to "the FBI and the CIA.40 In accordance with its Standard Minimization Procedures, the FBI retains a portion of the raw data for analysis and dissemination as ?nished intelligence products. These two basic activities, discuSsed in detail in Chapters Three and Four of this report, are carried out by personnel in the Counterterrorism Division?s We refer to these personnel as the 702 Team. ?selectors.? provides operational su ort to the investi ative units at Head uarters and 7ST DOJ-016-00993 (FOUO) The 702 Team also worked closely with attorneys from the Of?ce of General Counsel?s National Security Law Branch (NSLB) during our review period. Among the NSLB attorneys with the most involvement in 702 matters was one attorney who provided advice on policy matters (the Policy Attorney) and another who counseled the team on how the legal requirements of Section 702 applied to the 702 Team?s procedures (the Operations Attorney). In addition to the Policy and Operations Attorneys, NSLB Section Chiefs Karen Davis Miller and Richard McNally also had substantial participation in the 702 Program during the review period. (S) b1, b3, b7E 23 ISA DOJ-016-00994 N. The Evolving Use of. Section 702 A. The Use of Section 702 Compared to Traditional FISA After acquiring electronic communications under Section 702 and with the approval, the FBI retains some of the 702 data b1, o_for analy31s and d1ssem1nation, pr1mar11y 1n connectlon (TS) with its international terrorism investigations. Prior to the PAA and FAA, the b3? FBI obtained this type of data from traditional FISA coverage. The PAA and b7E FAA allowed the Intelligence Community to transition many selectors covered under traditional FISA to coverage under these new and more streamlined legal authorities. During the relevant portion of the review period, the number of 702-acquired electronic communications retained by the FBI ?uctuated over time due to policy considerations (described in Chapter Four). However, the overall number of such communications was substantial, and approximated the number of electronic communications that the FBI collected and retained under traditional FISA. Figure 2-1 below shows the relative parity between the number of electronic communications that the FBI acquired and retained under Section 702 from October (TS) 2009, when the FBI began retaining 702 data in through April 2010. (T5) (5) b1, b3, b7E (TS) (TS(T8) The FBI has used information collected under Section 702 in several national security investigations. According to senior Counterterrorism b1 41 The OIG compiled this chart from numerical data provided by? (S) WM DOJ-016-00995 Division of?cials, (S) b1, b3, b7E b1, (TS) b3, b7E or example, in September 2009 the NSA reported to the FBI that a Pakistan-based al Qaeda operative targeted under Section 702 had been in contact with an e?mail account that the FBI determined was being used by Najibullah Zazi, a legal permanent resident living in Colorado. An FBI investigation revealed that Zazi and two associates planned to bomb the New York City subway lines. FBI agents arrested Zazi On September 19, 2009, and in February 2010 he pleaded guilty to multiple terrorism?related charges. B. The Plans to Nominate Selectors for Section 702 Coverage The FBI plans to greatly expand its role in the 702 Program this year by nominating selectors for Section 702 coverage. Because the nominations program was still being formulated during our review period, the OIG was unable to review these proposed activities in depth for this report. However, in Chapters Three and Four we identify certain FBI policies and practices under the 702 Program that may be affected by the nominations initiative, and thus brie?y summarize the nominations proposal below. b1, b3, b7E (5) b1, b3, Unlike b7E process, the FBI, and not the NSA, would be the owning agency for the selectors it nominates, and would assume the primary obligation to review the content of incoming communications to ensure that the targeted account remains legally eligible for 702 collection and continues to produce foreign intelligence information. 25 DOJ-016-00996 bl, b3, b7E (5) b1, b3, b7E bl, b3, b7E These Witnesses told us that the nominating activities were expected to begin in early 2013. While ?nalizing this report, however, the OIG learned that the FBI began nominating its ?rst selectors in April 2012. DOJ-016-00997 (U) CHAPTER THREE THE ROLE IN THE SECTION 7 02 TARGETING PROCESS In the preceding chapter, we outlined the two primary functions under Section 702 of the FAA. First, after the NSA applies its tar etin rocedures and nominates a selector? (3) the FBI must_ - To do so, the FBI reviews the suf?ciency of the foreignness b1 b3 determinations and (5) b7}; . Second, for any Section 702?authorized acquisition from an Internet service provider (ISP), he FBI acquires the targeted data from the provider, and transmits it in raw, unminimized form to the NSA and, at the direction, to the FBI and the CIA. The FBI retains the raw data in _for (5) analysis and, where appropriate, for dissemination as intelligence products. WThis chapter describes the first of these functions: the b1, b3, procedures for a rovin the tar etin of selectors that have been desi ated 13713 by the NSA- For (3) the targeting issues discussed in this chapter, the review period is from September 2008, when the ?rst _was (S) nominated to the FBI, through February 2010. W) In Section I of this chapter, we provide a brief description of the procedures that governed the targeting process, including the FISA Court- approved targeting procedures that formed the basis for the NSA to targetreview and approve, a selector for a (S) b7E Section II describes the methodology for reviewing the targeting activities. In Section we describe the application of its targeting procedures to review the suf?ciency of the foreignness determinations for nominated selectors. Section IV describes the application of its targeting rocedures (S) In Section we describe the rocedures for processing selectors used by targets who had . (5) Section VI describes the review of FBI acquisitions of (5) who were later determined to be in the United States, a review that both the OIG and the FBI are required to conduct pursuant to Section 702(l)(2) and (3). In Section VII we provide our analysis of the Section 702 targeting activities during the review period. 27 TOP DOJ-016-00998 I. Procedures Governing the Targeting Process The Section 702 targeting process whereby a selector is identi?ed for possible acquisition of communications, the foreign intelligence value of the acquisition is assessed, and a judgment is formed about whether the presumed user is a non-US. person reasonably believed to be located outside the United States is a FISA Court-approved process in which each agency has well de?ned and distinct responsibilities. The process is memorialized in three rimary documents: a (S) the FISA Court- approved targeting procedures; and the FISA Court-approved targetin rocedures. In addition, the FBI has developed (5) which are designed to translate the broad b1, mandates of the and the FBI Targeting Procedures into (3) b3, guidance for those members of the 702 Team who are responsible for b7E conducting the targeting activities under Section 702. This section summarizes the relevant provisions of these documents. A- 6) :33; (8) b1, b3, b7E b1, b3, b7E b1, b3, b7E DOJ-016-00999 4wth om mna ?mg 3 mun (3) bl, b3, b7E W). The respective roles of the NSA and FBI described in the MOU remained largely constant through the transition from the PAA to the FAA and continue today. With the exception of the _these roles (S)b1> b3) are made binding on the NSA and the FBI through their FISA Court-approved b7E targeting procedures, discussed below. B. IFOU0) Targeting Procedures Under the FAA Pursuant to Section 702(d)(1) of the FAA, all acquisitions of foreign intelligence information under Section 702 are conducted pursuant to targeting procedures promulgated by the Attorney General in consultation with the Director of National Intelligence. These procedures must be ?reasonably designed? to ?ensure that any acquisition authorized under [Section 702] is limited to targeting persons reasonably believed to be outside the United States,? and to ?prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States.? Section 702 (U FOUO) The targeting procedures are ?led as attachments to each certi?cation provided to the FISA Court pursuant to Section 7 02(g), and are speci?cally reviewed as part of that court?s certi?cation approval process. Sections 702(g)(2)(B) and The goal of the FISA Court?s review is to determine whether the procedures are consistent with the requirements of the FAA and the Fourth Amendment. MDuring the OIG review period, the NSA and FBI submitted separate targeting procedures all (5) of which were approved by the FISA Court.4 These procedures, which were conceived of and drafted collaboratively by the relevant agency and the National Security Division, serve as of?cial representations to the FISA Court b1, b3, b7E about the steps each agency will take to ensure that targeting pursuant to Section 702 is done in a manner consistent with the authorities and prohibitions of the statute. The following sections summarize these procedures. 4's (5) bl, b3, b7E DOJ-016-01001 TOP 1. Wei-view of the Targeting Procedures The tar eting procedures are a critical ?rst step in the process because they must be applied to (3) b1, b3, selectors before the selectors can be nominated to the FBI. The targeting b7E procedures, which have remained substantially unchanged since the enactment of the FAA, address two activities directly relevant to the role in the 702 program: I the manner in which the NSA determines that a person targeted under Section 702 is a non-United States person reasonably believed to be located outside the United States (?foreignness determination?); and the post-targeting analysis done by the NSA to ensure that it does not intentionally target a person known at the time of acquisition to be located in the United States or intentionally acquire any communication as to which the sender and all intended recipients are known at the time of acquisition to be located in the United States. (U FOUO) NSA Targeting Procedures at 1. The NSA targeting procedures address the targeting of both tele hone and Internet communications, (Ts) this section summarizes only those 131, b3, procedures relating to Internet communications. According to NSA documents b7E ?led in support of Section 702 certi?cations, the term ?Internet communications? includes communications that traverse the Internet, (TS) F) As to the determination that the target is reasonably believed to be located outside the United States, the NSA applies a ?totalit of the circumstances? anal sis based on one or more of the followin (TS) b1, b3, b7E 44 Wm addition to acquiring communications that are to or from a target, the NSA also ?seeks to acquire communications about the target,? meaning communications in (Cont?d.) 3 1 TOP OFORN FISA DOJ-016-01002 (TSFOUO) NSA Targeting Procedures at 4. The NSA targeting procedures also govern the assessment of the forei intelli ence ur ose of the tar etin which is an assessment of 1 b3) 7E (TS) b1, b3, b7E WE) When the post-targeting analysis reveals that a target has entered the United States or is a United States person, the targeting which the target is referred to in the content of a communication. Electronic communications ?about? a 702 target are only collected ?upstream? of U.S. providers, and the NSA has represented to the FISA Court that ?no about communications will be obtained by acquisitions conducted by the 32 TOP SEC DOJ-016-01003 procedures direct it to terminate any ongoing acquisition from the target ?without delay? to avoid the intentional targeting of persons known to be in the United States. The procedures also direct the NSA to report the incident to the DOJ and the ODNI, and to treat the acquisition in accordance with its minimization procedures. In cases where the post?targeting analysis yields information that is unclear as to the location of a target, the NSA targeting procedures direct the NSA to ?presume that the target has entered the United States? and terminate any ongoing acquisition from the target. 2. IFOU0) Overview of the Targeting Procedures The FBI also attaches its targeting procedures to each certi?cation presented to the FISA Court for approval, and like the NSA b1? b3? targeting procedures, the FBI targeting procedures remained unchanged during b7E the review period. These rocedures, which are a lied when the NSA nominates an accountH address three (5) primary activities: 0 Whe rocess for acquirin forei intelligence informa n, by targeting (5) electronic communications accounts designated by the NSA (?Designated Accounts?) as being used by non-United States bl? persons reasonably believed to be located outside the United b3? States; b7E 0 (U the documentation of that process; and 0 (U FOUO) compliance and oversight. FBI Tar etin Procedures at 1. b1, b3, b7E a. The Responsibility for Assessing the Foreignness Determinations Consistent with the MOU, the FBI targeting procedures carefully circumscribe the role in assessing the eligibility of the nomination for acquisition under Section 702. The targeting procedures require the FBI, ?in consultation with the NSA, [to] review and evaluate the suf?ciency of: explanation for its reasonable belief that the user of the Designated Account is located outside of the United States; and information provided by NSA concerning the Designated Account user?s non- United States person status.? Notably, the targeting procedures do not state that the FBI will assess the determination that a nomination will 33 DOJ-016-01004 TOP SECREW result in the acquisition of foreign intelligence information. Rather, the b1, b3, targeting procedures state that the will . . . be responsible for determining b7E that a signi?cant purpose of the acquisition is to obtain foreign intelligence information,? and that the NSA will ?represent to the FBI that a signi?cant purpose of acquiring the is to obtain foreign intelligence information.? According to 702 Team personnel, the FBI interprets these provisions to mean that while it will review and evaluate the suf?ciency of the foreignness determinations, it will play no role in assessing the purpose of acquiring communications from a nominated account. In addition to assessing the suf?ciency of the foreignness determinations, the FBI is also required under the targeting procedures to (S) (S) (8) However, the targeting procedures do not obligate the FBI to conduct an independent, de novo 131,133? anal sis of a tar et?s U.S. go erson status and location (3) b7E (S) (S) (5) b1, b3, b7E The result of these provisions is to make the approval. (5) a default position, with denial of a request justi?ed only when the FBI concludes, in consultation with the NSA, that the b1, foreignness determination is not suf?cient or when the FBI and the FBI and NSA cannot subsequently reach agreement about the eligibility of the account for targeting. 34 TOP A DOJ-016-01005 Finally, the FBI targeting procedures rovide that the NSA will advise? the FBI any time analysis of (S) or other technical data, indicates that a user of a b1 b3 from which were acquired by the (5) ME FBI pursuant to these procedures is actually located within the United States or is a United States person.? Upon receiving upon such noti?cation, the FBI must (S meaning that it must (S) b. Documentation of the Targeting Activities The FBI targeting procedures require the FBI to document its targeting activities. Speci?cally, the procedures require the FBI to retain the Ebb?? information it receives from the NSA concernin each tar et?s U.S. erson status and location. In addition, the FBI must (S) for each account nominated to it by the NSA. c. Compliance and Oversight The FBI targeting procedures contain provisions requiring the FBI to take speci?c steps to ensure compliance with and oversight of its targeting activities under Section 702. The FBI must develo and deliver training for all personnel involved in processing NSA to (8) b1? instruct them about their responsibilities under the statute and the targeting procedures. The FBl?s Inspection Division is required to conduct oversight of b7E the exercise of its targeting procedures, and of its training, ?at least once every quarter.? In addition, the targeting procedures require the DOJ and ODNI to ?evaluate the implementation of these procedures? at least once every sixty days. Lastly, the FBI must report any incidents of noncompliance with the targeting procedures by FBI personnel to the National Security Division (NSD), the FBI OGC, and the ODNI Civil Liberties Protection Of?cer within ?ve business days of learning of the incident. 3- million?o b7E and the The 702 Team developed (5) to provide practical, step?by?step guidance to the 702 (8) Team about how to conduct under the targeting bl, b3, b7E (S) 35 DOJ-016-01006 (U The SOPs have been in place since the PAA, well before the FBI began processing stored communications search requests under the FAA in September 2008. FBI representatives who were personally involved in the drafting of the original SOPs told us that the document was the result of collaboration between the FBI OGC and the 702 Team. Section Chief Karen Davis Miller of the Policy, Training, Litigation and Oversight Section stated that the SOPs were developed under then-FBI General Counsel Valerie Caproni?s direction, and she characterized Caproni?s concern as wanting to ensure that the 702 Team would have clear? directions about what they were to do.45 Miller also told us that the 702 Team and the FBI OGC agreed that the SOPs should be drafted with compliance and future oversight reviews in mind. b1 b3 b7E (S) The SOPs also address the 702 Team?s review of the suf?ciency of the foreignness determinations for nominated selectors, but do not (S) provide the same level of detail for this suf?ciency review b1 b3 b7E (S) This form, known as the ?checklist,? is used to document action taken under the SOPs on every selector nominated the NSA b1 b3 (3) b7E 45 (U Valerie Caproni served as FBI General Counsel from August 2003 until her resignation from the FBI in September 2011DOJ-016-01007 b1, b3, largely because it has been well designed to re?ect_ of the (S) b7E operators. b1 b3 b7E (U FOUO) In addition to the SOPs and the checklist, the 702 Team views the OGC as an important source of guidance when conducting the targeting activities under Section 702. Nearly every FBI representative we interviewed emphasized that the 702 Team is encouraged to contact the FBI OGC with any questions about the statute, the targeting procedures, or the SOPs. C. The Documentation of Its Targeting Process Consistent with the requirements of the targeting procedures, the 702 Team has implemented a system to retain and organize selector-speci?c information provided by the NSA, the completed checklists, and any associated documentation. The core of the system is a series of paper files known as (S) each of which contains all of the relevant information used by the FBI when processing an NSA . b1 Each selector ?le contains three common elements. First, each ?le contains a b3 ?selector sheet.? b7E (S) that are relevant to the assessment of the foreignness determinations. (8) b1 b3 b7E DOJ-016-01008 (5) b1, b3, b7E b1, b3, b7E (S) b1, b3, b7E (S) b1, b3, b7E (S) b1, b3, b7E 11. The Methodology for Reviewing the 702 Team?s Targeting Activities (U FOUO) Before describing how the OIG conducted its review of the targeting procedure activities, we ?rst summarize the oversight conducted by the joint ODNI compliance review teams and by the InspectiOn Division. The results of these oversight efforts form the foundation for certain factual assumptions that the OIG used in conducting its review of the targeting activities, as described in subsection below. 38 TOP DOJ-016-01009 TOP SE A. IFOU0) Summary of and Inspection Division Oversight of FBI Targeting Activities 1. NSD Compliance Reviews The Attorney General is required by Section 707 to submit to Congress semiannual reports concerning the compliance with its targeting and minimization procedures under Section 702.47 For targeting activities, each Semiannual Report contains the results of NSD compliance reviews, conducted jointly with ODNI, which document any compliance incidents occurring under Section 702 during the semiannual reporting period. A ?compliance incident? generally involves a failure to comply with applicable targeting procedures, whether or not such failure results in an improper acquisition. The reviews are conducted at the NSA, CIA, and the FBI. During the period covered by this review, joint ODNI compliance assessment teams produced four semiannual reports of the targeting and minimization activities under Section 702. (S) b1, b3, b7E (5) b1, b3, b7E of?cials told the OIG that based on their experience b1 b3 con ucting these reviews, the 702 Team personnel thoroughly prepared the b7?E ?les for the reviews and accurately identi?ed (3) (TS) b1, b3, b7E 47 (U FOUO) These Semiannual Reports are in addition to the Semiannual Assessments conducted under Section 7 As NSD of?cials described them, Semiannual Assessments provide a ?30,000 foot look at the overall compliance program and the trends discovered related to the program.? DOJ-016-01010 SI A bl, (TS) b3, In addition to reporting basic statistical information about the number and disposition. the ODNI compliance reviews (3) we examined for this report focused closely on the 702 Team?s compliance with 131, its targeting procedures, with particular emphasis on ensuring that the 702 133, Team fully b7E (S) selectors identi?ed the Team (8) b1, b3, b7E 2. Inspection Division Quarterly Audits (U FOUO) The targeting procedures require the Inspection Division to conduct ?periodic reviews . . . to evaluate the implementation of the procedures and the training given to relevant personnel.? These reviews must be conducted at least quarterly. (S) b1, b3, b7E DOJ-016-01011 b1, (TS) b3? b7E WAS with the ODNI compliance assessments, and consistent with the oversight requirement in the targeting procedures, the Inspection Division audits focused on whether the 702 Team adhered to it (3) (5) b1, b3, b7E (S) the compliance occurrences discussed in the Inspection Division audits involved errors that either had been identi?ed and reported to NSD by the 702 Team or discovered by ODNI assessment teams during the course of their oversight activities. In these instances, the audit teams primarily assessed whether appropriate corrective action had been taken. During the review period, the Inspection Division audits broadened to include areas that the ODNI assessments do not include. In November 2009, the audits be an includin reviews of th b1, b3, the FBI entity responsible for b7E maintaining unminimized 702 data. These audits focused on compliance with its training requirements and internal procedures, including veri 'n that an im roperly obtained data was purged from the In February 2010, the audits began including reviews (5) compliance with its training (S) of the requirements and internal procedures as well. (TSISA DOJ-016-01012 (U FOUO) The compliance assessments and Inspection Division audits indicate that the rate of compliance with its targeting procedures is above 99 percent. B. IFOUO) OIG Methodology for Reviewing the Targeting Activities (8) b1, b3, b7E b1, b3, b7E b1, b3, b7E 50m The OIG review team consulted with a statistician from the b1(T5) Audlt D1v131on 1n de51gn1ng its random sam le. b3, b7E 42 DOJ-016-01013 TOP SE SA each selector in this random sample, we extracted relevant information from b1> b3, the and entered it into a_roSS further analysis b7E (TS) Mum, the OIG reviewed speci?c interest to the review, such as selectors (S) b1, b3, b7E selectors for which the NSA had withdrawn (5) For these categorical reviews, we often reviewed all or substantially all of the selectors of each we could ?nd, althou for one cate ory, the withdrawn selectors, (S) (U FOUO) Fourth, the OIG requested and reviewed other relevant documents and information, including e-mails, ECs, internal guidance, and FISA Court ?lings that further illuminate the targeting activities during b7E the review period. These documents were provided by many FBI components, including -OGC, -and- as well as by Department components such as NSD and the Of?ce of Legal Counsel. In addition to documenta review, the OIG interviewed several members of the 702 Team, (5) bl, b3, b7E Finally, the 702 Team provided the OIG a comprehensive demonstration of how it a lies its tar etin rocedures durin which the OIG b1, b3, observed ?fmm the NSA, and had the ortunity to ask questions of members of the 702 Team as - applied the targeting procedures to - (S) The Application of Its Targeting Procedures: Review of the Foreignness Determinations In this section we describe how the NSA a lies its tar etin procedures to nominate selectors to the FBI for (S 3:33, and how those nominations are conveyed to the FBI. We then 43 DOJ-016-01014 describe the preliminary review of the suf?ciency of the foreignness determinations. A. Wackground: The Application of its Targeting Procedures As described above, before sending a nomination_ (5) b1, to the FBI, the NSA 1s respons1ble for applying 1t_S 3 targeting procedures and determining that that the presumed user of the b7?E nominated account is a non?US. person reasonably believed to be located outside the United States (the ?foreignness determination?). In interviews with the OIG, NSA personnel who are directly involved in the Section 702 targeting process described how the targeting procedures are implemented.51 (S) b1, b3, b7E (S)b1, b3, b7E 51 (U The OIG interviewed the following NSA personnel: the Section 702 Implementation Lead in the Of?ce of the Director of Compliance a Technical Director in the Signals Intelligence Directorate (SID) Special Source Operations group; a former Chief of the SID Oversight and Compliance group now staffed to the Monitoring and Assessments group of a former Chief of FAA Procedures and Analytic Support Of?ce of SID Oversight and Compliance, now also staffed to the Monitoring and Assessments group of the Deputy General Counsel for Operations; and a line attorney in the Of?ce of General Counsel with extensive experience with both the FAA and FAA Section 702. The review bene?tted substantially from the cooperation. 52 (U FOUO) However, the analyst does not have discretion with regard to detasking accounts if it is determined that the presumed user is a US. person or located in the United States. Upon recognizing such cases, NSA officials stated that the NSA detasks collection from the account immediately. 44 DOJ-016-01015 b1 b3 b7E (S) FOUO) b7E This review includes, among other things, checking the cited source for the analyst?s foreignness determination to verify that the analyst has a reasonable basis for the foreignness assessment, and often to verify that the analyst has included in the foreignness explanation the most current relevant information available to the NSAThe Receipt of Nominated Selectors From the NSA (W Once the NSA has applied its targeting procedures, it forwards a nomination to the FBI for those selectors for which it wants TOP DOJ-016-01016 system called 1- _Saln(- are parts of an administrative system that The 702 Team most commonly uses in three waysAfter reviewing a draft of this report, the FBI told the OIG that while this paragraph accurately describes one use of -during the review period, the FBI no longer uses -in this manner. 46 TOP SEC b7E DOJ-016-01017 ADP hawSEES. .u m3 a mug :3 Amv 4w? b1)b7E b1, b3, b7E b7E 55M Certain identifying information relating to the targeted selector and the NSA analyst has been redacted from this image. 48 SI ISA DOJ-016-01019 -. DOJ-016-01020 (TSWNSA Nominations of Selectors to the FBI During the OIG Review Period F) For the review period of September 1, 2008 through February 28, 2010, the 702 Team identi?ed and produced to the OIG (Ti) selector sheets indicating that an account had been nominated by the NSA for 1,133, a?pursuant to Section 702.56 As shown in b7E I (TS) b1, b3, b7E (Cont?d.) 50 DOJ-016-01021 Figure 3-2 below, the analysis of the number of nominations varied from month to month, indicates that the b1, (TS) b3, b7E (TSDOJ-016-01022 and Tan 1.3 C. Preliminary Review of the for b7E Suf?ciency of the Foreignness Determination - (S) b1, b3, b7E (S) bLbi WE Consistent with the - and the targeting procedures, th state that the review of foreignness ?is not an (S) entirely separate and independent review, but rather a review to determine whether NSA has provided a reasonable ex lanation? of the presumed user?s location outside the United States. The therefore instruct the SSA that (S) the SSA ?can assume the facts provided are accurate (5) b7}: At the same time, the also direct the SSA to (3) contact the NSA for additional information if ?the SSA does not agree that the foreignness explanation . . . is suf?cient? or does not understand it, and to document the contact. This directive is consistent with the requirement in the targeting procedures that ?[t]he FBI, in consultation with NSA, will review and evaluate the suf?ciency of? the foreignness determination. (TSDOJ-016-01024 (TS) b1, b3, b7E Below we describe this preliminary review in more detail and provide select data about its implementation by the 702 Team. We focus on the two issues which the Lead and Assistant Program Coordinators described as the primary focus of the preliminary review: the adequacy of the identi?cation of the targeted selector; and the basis for the determination that the presumed user is a non-US. person reasonably believed to be located outside the United States. 1. Review of the Selector Identification (TS) 1: b3: b7E (S) b1, b3, b7E (TS) b1, b3, b7E 54 FISA DOJ-016-01025 . A 2. Review of the Foreignness Determination (S) b1, b3, Below we examine the 702 Team?s review b7E of the foreignness determinations, and we identify two circumstances in which the members of the 702 Team expressed discomfort with or raised questions about the foreignness determinations: where the NSA bases its forei nness determination on a- b7E TS the SSA reviews these ?elds to con?rm that the NSA has assessed the target to be b1, b3, located outside the United States, and to be a non-US. person. (Ts) b7E b1, b3, b7E b1, chording to the second - Unit Chief during our review b3, period and the 02 Team Lead and Assistant Program CoordinatorsTOP FISA DOJ-016-01026 bacg?g?c? a? um ?mg.m3 .Hn? A?mun .ma.H? at mnnamn.? an amn? n?h? mun .Mn dm OB mm 3.609 :?Why .?ma (TS) bl, b3, b7E Shortly thereafter, on_ 2008, the FISA Court (Ts approved the ?rst FAA Section 702 certi?cation, and with it the ?rst set of Section 702 targeting procedures. Those targeting procedures speci?cally addressed the (TS) b1, b3, b7E bl, b3, b7E bl, b3, b7E (3) (TS) b1, b3, b7E noted that it had ?no reason to question the presumption that the vast majority of persons who are located overseas are not United States persons and that most of their communications are with other, non?United States persons, who are also located overseas.? The court called this a ?common sense presumption.? In re Directives, Docket Number 1058(g): 07-01, at 87 8; n.81 (FISA Court, April 25, 2008). 6O DOJ-016-01031 (TSb7E (8) Given the 702 Team?s longstanding discomfort with the OIG examined how the NSA used its nominations to the FBI, and how the 702 Team reviewed that cited this factor. 62 (T5) b1, b3, b7E DOJ-016-01032 (S) in b1, b3, b7E (S) (TS) b1, b3, b7E b1, b3, b7E (TS) b1, b3, b7E (TS) b1, b3, b7E 6 2 TOP SEC FISA DOJ-016-01033 b1,b3, I (S) b7E b1,b3, b7E b1,b3,b7E b1,b3,b7E DOJ-016-01034 mmcg?g?cm? munmha amp .HAmv mun, .mL .3 mg .3 n3 Ame the PAA NF The Role and Standard of Diligence When b1, b3, b7E Accordin to 0G erviewed, the ractice and its (9 1. attorneys we int 72 TOP A b1, b3, b7E DOJ-016-01043 TOP FISA dates back to the PAA, prior to the drafting of the - (5) Section Chief Karen Davis Miller told the OIG that the FBI, at General Counsel Caproni?s direction, insisted that the FBI have an active role in the process for 131,133, approving because the- were being (S) b7E conducted under the authorit . Ca roni also told us that because (5) was her View at the time the ?rst tar eting procedures were drafted that ?the FBI was responsible - - the FBI therefore had to ?exercise due Caproni, Miller, and the Policy Attorney each emphasized that ?due dili ence? does not require that the FBI (5) Caproni stated that a ?presumption of regularity? applies b1 b3 to the and that ?there is no reason to (3) ME presume that the NSA is not upholding its constitutional duty? with respect to the rights of United States persons, or otherwise violating the FAA or its own FISA Court-approved targeting procedures. The Policy Attorney stated that the and other documents governing the interagency targeting process were (S) carefully drafted to make it clear that the FBI would only (3) (S) This concept of ?due diligence? regarding the (S) b1, has been conveyed to the operators on the 702 Team, each of whom expressed b3, similar notions of the standard during interviews with the OIG. For example, b7E the Lead Program Coordinator described the Team?s standard of diligence as ?thorough but reasonable.? 2- (S) b1,b3,b7E blFORN FISA DOJ-016-01044 4m .vh m3 nmh? th?. m5 .Mn? .HL mun .Mn? m2 an i av 93 AMD .HD mun nm? QOB cch?S?OQ dank mum 3) b1, b3, b7E Wne reviewer we interviewed said that the memorandum assists in the approval process and helps streamline future audits, providing a written record documenting the 76 DOJ-016-01047 bkTOP (FOUO) After the OIG presented the above information to General Counsel Caproni, she stated that she was unaware of the gap in the procedures, called it a ?mistake,? and said that the Operations Attorney should itb7E (TS) I b1 (S) b3 . b7E DOJ-016-01049 ISA bl, b3, WThe 702 Team ultimately approved all.selectors.69 The OIG (S) emphasizes that, b3 the steps the 702 Team took were entirely consistent with th (SP7E Nonetheless, for each of these selectors and for any other selectors processed by the 702 Team during the OIG review period that bore similar characteristics, the potential exists that the 702 Team, despite a proper application of the The OIG recommends, consistent with the obli ation DOJ-016-01050 (S) b1, b3, b7E (S) (S) b1,b3,b5 b7E (TS) b1,b3, b7E bl,b3,b7E I (S) b1,b3, b7E b1,b3, b7E 70 (U FOUO) The version of this report that has been distributed outside the Department of Justice contains redactions in this sentence based on the Department?s assertion of the attorney?client privilege. 80 DOJ-016-01051 nxmm.mnyb Hm mug AME. mun .MQ av mn? ,mn.H? mn?.mn.?a mun.mn.?n m: 3E6 REE 93 ?Mn? a mum, "Mn? .HL. av 35533. Sago?om 6:915musing .3 mun b1IFOU0) Subjects of Field Of?ce Investigations b1judgments must be understood in the context of the full approval b1 b3 b7E process at the FBI: they are not made unilaterally by- but rather represent judgments of the 702 Team that in most cases have been assessed by both (5) and approved by an SSA. These review and approval processes are escn 1n greater etail below. (S) b1, b3, b7E WISIWW DOJ-016-01054 FISA b1(3) b1, b3,b7E b1, b3, b7E U) 84 TOP ISA DOJ-016-01055 E\?munhoz\\ (SL1Mil) As noted above, the FISA Court-approved targeting rocedures re uire the FBI TOP FISA DOJ-016-01057 ?aura m063ADE b1described above, the FISA Court?a roved FBI targeting rocedures 0in ate the FBI to for (S) b1, b3, b7E (S) bl, b3, b7E DOJ-016-01059 SA I b1,b3,b7E (WChange to the Second - Procedures (33131)?? (5) b1, b3, b7E (TS) b1, b3, b7E DOJ-016-01060 3:21.272MBA .27 mun? .ma .3 (TS) b1,b3,b7E (TS) b1,b3,b7E (TS) b1, b3, b7E (TS) b1,b3,b7E b1,b3,b7E b1,b3,b7E DOJ-016-01062 (TS) b1, b3, b7E Lastly, in an October 3, 201 1, Memorandum Opinion and b1, b3, b7E Order, the FISA Court approved an amendment to the targeting procedures to (TSDOJ-016-01063 43mm hr mo mna.ms.?n mug nm? .HD. Munams.?a mus .MQ 5H3 mccg?g?cm? mnr? v0 mun .2 .E mun amn (3) b1, b3, b7E b1, b3, b7E b1, b3, b7E (3)131(5)1?1?b3?b7E In deciding whether to approve a (S) the 702 Team SSAs have three possible dispositions from which to b1, b3, choose. One 0 tion is to a rove the (S) b7E b1, b3, b7E DOJ-016-01066 FISA located in the United States and thus not eligible for targeting under Section b1, b3, 702. To approve a-the SSA must memorialize the date and the decisions) b7E and then se arately select ?a rove? in? to send an electronic noti?cation to that the Howeve r, ursuant to the targeting rocedures, when (E136 blFISA DOJ-016-01067 mh.EGV gag mm 1' munmum? 0H3 mun? TH D. av mun amn ?Hg ?wH Oh. cch?S?OQ mos mo Mun nmnmha HHL mun "mn? .2 .3 b1,b3,b7E (S) (S) bLbi ME (TS) bL bl WE WE WE (TS) WE 100 TOPSE DOJ-016-01071 F6) W. One reason offered was that the targeting procedures are designed to identify ineligible targets before the selector is nominated to the FBI b1, 133, for? so that ineligible targets are rarely (S) b7E nominated in the ?rst place. Indeed, the Lead Program Coordinator stated that the has done an excellent job, in my opinion, of targeting people [who] are overseas.? (5) bl, b3, b7E b1, b3, b7E (3) b1, b3, b6, b7C b7E Another factor that 702 Team members said may contribute to the fact that eci?cally, at least two members of the 702 Team ointed out that i - The Lead Pro am Coordinator attributed this to the likelihood that the NSA (3) b1, b3, b7E 101 (S) DOJ-016-01072 NOH mun63.2 mnn?mv .3 4n OH. moH mih .mnr .Hn?mv m3 .ML JUL. m3 .3 .3 mun nm? .HL. m3 AWL .HnTOP FISA (8) b1, b3, b7E b1, b3, b7E (S) b1, b3, b7E Section 702 allows'the government to acquire the communications of non?U.S. persons reasonably believed to be located outside the United States at the time of acquisition. b1, b3, b7E I (s b1, b3, b7E b1, (S) b3, b7E (Cont?gl? 133? b7E 104 DOJ-016-01075 cch?S??Mnmum, 02 3.2 .3 at . bbc?c?SAOQ NOB :02 63913Amv .Hn? m2 ,2 at mun Oun? 6n? ?Mn?Maw .3 av a .27 42 a- Information Considered in- (S) bl?b3?b7E Determination (S) b1, b3, b7E b7E b1, b3, b7E 108 DOJ-016-01079 v: H. 9: m3 ?Mn? .HL at Mun46H Sac?g?oa OHH AMQ 3 PE 5 nm? Mun .Hnw A nmn.on v?rm .-D.-D A I mun? ?wac?g?cm? m2 ?m3 TML. at mun amu? .HQ a l?vg. .H Mun ma?a? .m5 8:5 6:915TOP b1, b3, b7E (TS) bl, b3, b7E b1, b3, b7E (TS) b1, b3, b7E (TS) b1, b3, b7E 112 ISA DOJ-016-01083 Mun m?b Am? ?Hm