2018 FISC Ruling Shows How FBI Abused NSA Mass Surveillance Powers

Document regarding the Section 702 2018 Certification - ODNI A4.ttJorized fo� Release united Stitt• Foreton lntoltlg•nc• - Surv•U11noe Ccmrt T8F f:JllOROT;i;i81:\101t08JVflOFORfl OCT 1 8 2018 UNITED STATES LeeAnn Flynn Hall, Clerk of Court FOREIGN INTELLIGENCE SURVEILLANCE COURT WASHINGTON, D.C. MEMORANDlJM OPINION AND ORDER The Foreign Intelligence Surveillance Court today addresses the "Government's Ex Pru1e Submission of Reauthorization Certifications and Related Procedures, Ex Parte Submission of Amended Certifications, and Request for an Order Approving Such Ce11ifications and Amended Certifications," filed on March 27, 2018 ("March 27, 2018, Submission"), and the "Government's Ex Parle Submission of Amendments to DNI/AG 702(h) Certifications and Related Procedures, Ex Parte Submission of Amendments to DNJ/AG 702(g) Ce1iifications, and Request for an Order Approving Such Amended Certifications," filed on September 18, 2018 - - IGI•SECl<l!JIh01,;Oltl.6!UJf0P6Rff DATE: Oct 8, 2019 - Authorized Public Release Page 1 of 138 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - lf8P SF:@ftElf//8108RC8PVNereRN ("September 18, 2018, Submission"). The March 27, 2018, Submission, as amended by the September 18,2018, Submission, is subject to review by the Court under Section 702 of the Foreign Intelligence Surveillance Act (FISA) as amended, codified at 50 U.S.C. § 1881 a. The government's request for approval of the amended certifications and related procedures is granted in part and denied in part for the reasons stated in this Memorandum Opinion and Order. Part I of this Opinion summa1izes the government's submissions and the procedural history of these matters. In Part II, the, Com1 finds that the certifications before it contain the elements required by Section 702(h). Part III of the Opinion addresses the targeting procedures and issues relating to the scope of acquisition, including the "abouts limitation" at Section 702(b)(5). The Court finds that the targeting procedures satisfy the requirements of the statute and are consistent with the requirements of the Fourth Amendment and approves the proposed scope of acquisition. The Court examines the querying procedures and minimization procedures in Part IV. After reviewing the applicable statutory provisions,� Part IV.A, the Court finds that the FBI's querying procedures do not comply with the requirement at Section 702(t)(l )(B) to keep records of U .S.-person query tenns used to conduct queries of information acquired under Section 702. See Part IV.B. The Court next examines the prevalence of non-compliant queries conducted by FBI personnel to return infonnation about U.S. persons from Section 702-acquired data. It ultimately finds the FBI's querying and minimization procedures, as implemented, to be foconsistent with statutory minimization requirements and the requirements of the Fourth - - •If .Ill lftlS.liil1:111ilifl1fi11Fil.fi DATE: Oct 8, 2019 - Authorized Public Release Page 2 of 138 Page2 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - _I,OF 81UHll1•::8J::OACHUUIOFOlff Amendment. See Part 1V.C. The Court then examines and approves certain exemptions that appear in each agency's set of querying and minimization procedures, see Part IV.D ) as well as certain changes to the FBI's minimization procedures. See Part IV.E. Part V addresses ce11ain other instances of non-compliance and the govermnent's responses thereto. Those instances do not require any further findings of deficiency. In Part VI, the Court summarizes its disposition and imposes certain repo1ting and other requirements on the government. I. PROCEDURAL HISTORY The Court begins with a description of the 2018 certifications and their amendments ande then describes their subject matter. A. The 2018 Certifications and Amendments The March 27, 2018, Submission includes ertifications executed by the Attorney General and the Director of National Intelligence pursuant to Section 702: Each of those certifications (collectively referred to as "the March 27, 2018, Certifications") is accompanied by: (1) Supporting affidavits of the Director of the National Security Agency, the Director ofe the Federal Bureau of Investigation, the Director of the Central Intelligence Agency, ande the acting Director of the National Counterterrorism Center;e (2)eTwo sets of targeting procedures, which govern NSA and the FBI respectively. Thee targeting procedures for NSA appear as Exhibit A to each certification and those for thee FBI appear as Exhibit C. The targeting procedures for each ce1tification are identical;e - - '.JOPiii i'Rlii'.J'16.1:IQRGOitl 110f«CPN DATE: Oct 8, 2019 - Authorized Public Release Page 3 of 138 Page3 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release (3) Four sets of minimiz.ation procedures, which govern NSA, the FBI, the CIA, and NCTC respectively. The minimization procedures for NSA appear as Exhibit B to each certification, those for the FBI appear as Exhibit D, those for the CIA appear as Exhibit E, and those for NCTC appear as it F identifies The (4) One set of querying procedures ("March 27, 2018, Querying Procedures") for NSA, the FBI, the CIA, and NCTC, which appears as Exhibit H to each certification. The March 27, 2018, Submission also includes an explanatory memorandum prepared by the Department of Justice ("March 27, 20 I 8, Memorandum"). The Court was initially required to review and rule on the certifications and procedures within 30 days of their submission - i.e., by April 26, 2018. See§ 702(j)(I)(B). In order to allow for pa1ticipation of amici curiae, however, the Court extended this period by 90 days, until July 25, 2018, under Section 702(k)(2). See Order, April 5, 2018. The Court appointed Jonathan G. Cedarbaum, Esq., and Amy Jeffress, Esq., to serve as amici curiae. � Order Appointing Amici Cuiiae, Apr. 23, 2018. At the request of Ms. Jeffress, the Court later appointed John Cella, Esq., as amicus curiae to assist in amici's work. See Order Appointing Additional Amicus Cuiiae, May 7, 2018. The Court appreciates the diligent and learned assistance provided by amici, both in their written submissions and in their oral advocacy at hearings. Their efforts have greatly benefited the Court's review of these matters. Following briefing by amici and the government, the Court heard oral arguments by amici and representatives from the government on July 13, 2018. At the Court's direction, staff orally - - ifOP fJf!ORl!TJIIQl:\IOROOPJ:IPJOFOllPJ DATE: Oct 8, 2019 - Authorized Public Release Page4 of 138 Page4 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'fOP 8ECR@ijWBls90RCO�i!NOFOftN infonned the government three days later of the Court's concerns regarding the procedures submitted by the government on March 27, 2018. In particular, the Court raised the following significant concems with the Government: (I)eThe querying and minimization procedures included exemptions frome otherwise applicable requirements for ]awful training functions and lawfule oversight of an agency's personnel or systems. Those exemptions seemede unreasonably broad under the standards of the Fourth Amendment and FlSA'se definition of "minimization procedures." See 50 U.S.C. §§ 1801(h), 1821 (4);e (2)eUnder the querying procedures, the FBI would keep records of an queiies rune against Section 702 data, but those records would not indicate whether the querye term used was associated with a United States person. This recordkeepinge practice appeared to be inconsistent with the statutory requirement that thee querying procedures "include a technical procedure whereby a record is kept ofe each United States person query term used for a query." § 702(t)(l)(B); ande (3)eThe querying procedures did not require FBI personnel to document the basise for finding that each United States-person query term satisfied the relevante standard - i.e., that queries be reasonably designed to retum foreign-inte1ligencee information or evidence of c.,Time. Without such documentation and in view ofe reported instances of non-compliance with that standard, the procedures seemede unreasonable under FISA's definition of"minimization procedures" and possiblye the Fourth Amendment. The Court noted it was favorably inclined toward amici'se suggestions that the Court require that, if FBI personnel want to examine thee contents of Section 702 infonnation retumed by a United States-person query,e they would first be required to document why that query met the applicablee standard.e On July 20, 2018, the government filed a motion seeking a further extension until October 18, 20 I 8, in order for it to amend its procedures in an effort to address at least some of the Court's concems. See Mot. for Order Extending Time Limit Pursuant to 50 U.S.C. §e1881 a(k)(2). That motion stated, "In particular, the government believes it would be consistente with national security for the extension to provide sufficient time both for the government to -ran SFGDFTl'SJ/(ODCOIJ0]OFOPJS-- DATE: Oct 8, 2019 - Authorized Public Release Page 5 of 138 Pages FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - I"f•:,t,('.lll!Tn-'In· 1OltCOf�lf40PORf� fomrnlate and execute amendments and for the Court to review the amended 2018 Certifications." Id. at 9. On that same day, the Court granted the motion. The government timely filed its September 18, 2018, Submission, which includes arch 27, 2018, Certifications: Amendment to he Court will collectively refer to them as "the September 18, 2018, Amendments" and to the ce1tifications, as thereby amended, as "the 2018 Certifications." The September 18, 2018, Amendments are accompanied by: supporting affidavits of the Director ofNSA, the Director of the FBI, thee (1)e Director of the CIA, and the acting Director ofNCTC;e (2} Amended minimization procedures for the four agencies, which are identical for each amended certification. The amended minimization procedures for NSA appear as Exhibit B to each of the September 18, 2018, Amendments; those for the FBl appear as Exhibit D; those for the CIA appear as Exhibit E; and those for NCTC appear as Exhibit G; and (3)eAmended querying procedures, which are identical for each amended ce1tification ande are broken out by agency: NSA Querying Procedures, which appear as Exhibit H to thee September 18, 2018, Amendments; FBI Querying Procedures, which appear as Exhibit I;e CIA Querying Procedures, which appear as Exhibit J; and NCTC Querying Procedures,e which appear as Exhibit K.e The September 18, 2018, Submission also includes an explanatory memorandum prepared by DOJ (''September 18, 2018, Memorandum") and a supplemental declaration of the Director of the FBI ("Supplemental FBl Declaration"). The September 18, 2018, Submission included a number of changes intended to address the Court's concems. With regard to the concerns noted above, the government: - - Pel•Ol!@ltl!T,1111'.Jll'fOltOOf lfPIOPORfl DATE: Oct 8, 2019 - Authorized Public Release Page 6 of 138 Page6 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification -· . ODNI Authorized for Public Release 1. 01 51!JCI\E•I;;51,,otteei ,,i,e1•01u, I ( l) significantly na1TOwed the scope of the exemptions for lawful traininga functions and lawful oversight of agency personnel or systems in the querying anda minimization procedures;a (2)adid not alter the FBl's recordkeeping requirements, but in the Supplementala FBI Declaration described the operational consequences the FBI anticipates if it isa required to maintain records that distinguish U.S.-person query te1ms from othera query te1ms and to document why U.S.-person queries met the applicable standarda before viewing any Section 702 content retrieved by the query; anda (3)aincluded in the FBI Querying Procedures supplemental procedures fora "categorical batch queries" (as opposed to queries conducted on the basis ofa individualized assessments). Subject to certain exceptions, FBI personnel woulda be required to obtain the written approval of an FBI attorney before reviewinga Section 702 infonnation retrieved using a categorical batch query.a The September 18, 2018, Submission was provided to amici, and on September 28, the Court heard oral arguments from amici and the government on the amended certifications and procedures. B. Subject Matter of the Certifications Each certification involves "the targeting of non-United States persons reasonably - - 1. 162I 2262& I;;SCI GfilJO] I!1f81omf DATE: Oct 8, 2019 - Authorized Public Release Page 7 of 138 Page 7 FISC Opinion, Oct 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release The 2018 Certifications generally propose to continue acquisitions of foreign-intelligence infonnation now being conducted w1der prior certifications that were initially submitted in 2016 ("the 2016 Certifications"). See March 27, 2018, Memorandum at 2. The 2016 Certifications, amended by the government in March 2017 and approved by the FISC on April 26, 2017. See Docket Nos em. Op. and Order, Apr. 26, 2017 ("April 26, 2017, Opinion"), at 5-6, 95. The 2016 Certifications, in tum, generally renewed authorizations to acquire foreign-intelligence information under a series of certifications made by the AG and DNI ,ursuant to Section 702 that da,tes back to 2008. See Docket Nos Those dockets, together with Docket Numbers re collectively referred to as "the Prior 702 Dockets." - Ibl■SECR£1))31))0RCOfoJCUflblG4 DATE: Oct 8, 2019 - Authorized Public Release Page 8 of 138 - Page 8 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - '.FOP iliQOliaffitl'IOftdiOaHtlOfOPtI The government also seeks approval of amendments to the certifications in the Prior 702 Dockets, such that NSA, the CIA, the FBI, and NCTC hencefmward would apply the same minimization and querying procedures to information obtained under prior certifications as they would to infonnation to be obtained under the 2018 Ce1tifications, as amended. See September 18, 2018, Memorandum 11. REVIEW OF THE 2018 CERTIFICATIONS AND PRIOR CERTIFICATIONS, AS AMENDED The Court must review a Section 702 certification "to detennine whether [it] contains alle the required elements." § 702(j)(2)(A). The Court's examination of the 2018 Certifications confirms that: (1)ethe certifications, including their amendments, have been made under oath bye the AG and the DNI, as required by§ 702(h)(l)(A), seee (3)eas required by§ 702(h)(2)(B), each certification is accompani y targetmge procedures and minimization procedures adopted in accordance with§ 702(d) ande (e), respectively;e (4) each certification is supported by affidavits of appropriate national-security officials,e as described in§ 702(h)(2)(C); ande (5)eeach certification includes an effective date, which was changed by the September 18 > 2018, Amendments as described in§ 702(h)(3)- specifically, the certifications becomee effective on October 18, 2018, or the date upon which the Court issues an ordere - - IOf•31!:Cltl!,J))!Jf))OftCOfUU!>l'ORH DATE: Oct 8, 2019 - Authorized Public Release Page 9 of 138 Page9 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I Seee The statement described in§ 702(h)(2)(E) is not required because there was no "exigent circumstances" determination under§ 702(c)(2).) • _J " I' • •- I • • ti • ~ ~ ' I . • ~•••. I o,f The Comi therefore finds that the 2018 Certifications contain all the required statutory elements. Similarly, the Court has reviewed the certifications in the Prior 702 Dockets, as amended by the 2018 Certifications, and finds they also contain all the elements required by the statute . Those amendments have the same effective dates as the 2018 Ce11ifications. See Ill. TARGETING PROCEDURES AND SCOPE OF ACQUISITION Section 702(d)( I) requires targeting procedures to be "reasonably designed" to "ensure that any acquisition authorized under[§ 702(a)] is limited to targeting persons reasonably believed to he located outside the United States" and to "prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States." Additiona1Ly, the government uses the targeting procedures to ensure acquisitions do "not intentionally target a United States person reasonably believed to be located outside the United States." § 702(b)(3). Pursuant to §e702(i)(2)(B), the Court assesses whether the targeting procedures satisfy those criteria. Thee Comt must aJso assess whether the targeting procedures, along with the querying and minimization procedures, are consistent with the requirements of the Fourth Amendment. See §e702(i)(3)(A)-(B).e ln January 2018, Congress enacted the FISA Amendments Reauthorization Act of 2017 ("Reauthorization Act"), Pub. L. No. 1 I 5-118, 132 Stat. 3 (2018). The Reauthotization Act - - ·1 TOI•:Jl!@MT118fXOBOOUfUOF8Rff DATE: Oct 8, 2019 - Authorized Public Release Page 10 of 138 Page 10 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'P6f SEettE'fMS1,1,0ftCON;INOPORN enacted Section 702(b)(5), which contains a limitation on the acquisition of"communications that contain a reference to, but are not to or from, a target of an acquisition authorized" under Section 702(a), which acquisition is colloquially refen-ed to as "abouts" collection. Reauthorization Act § 103(a){3). It specifically imposed, with na1Tow exceptions for exigent circumstances, a requirement of congressional notification and a 30-day congressional-review pe1iod before the government can resume abouts collection u11der Section 702. See id. §eI 03(b )(1 )-{4 ). This Opinion refers to that requirement as the "abouts limitation." In addition,e the government must "fully and currently inform" the Judiciary and Intelligence Committees of the House and Senate of "significant noncompliance ... conceming any acquisition of abouts communications." § 702(m){4) (enacted by Reauthorization Act§ J 03(b)(5)). A. Backi:round on Section 702 Acquisition The govemment targets a person under Section 702 by tasking for acquisition one or more selectors (e.g., identifiers for email or other electronic-commu11ication accounts) associated with that person. Section 702 encompasses different fonns of acquisition. The government may acquire information "upstream," as it transits the facilities of an Internet backbone carrier, as well as "downstream," from systems operated by providers of service April 26, 2017, Opinion at 15. Traditional telephone communications may also be acquired upstream, but those acquisitions have not presented issues regarding scope of acquisition in the way that upstream Intemet acquisitions have. In the following discussion, "upstream" collection refers to upstream acquisition of Internet communications under Section 702. 'f'OP SECRE'fWSl,'fORCONf:P�OFORN DATE: Oct 8, 2019 - Authorized Public Release Page 11 of 138 Page 11 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - I01•tJl!Clll!lI;;JI;;OltCOfUf8ifPOftff• NSA is the only agency to conduct upstream collection under Section 702, while both the NSA and FBI have roles in downstream. Under the procedures, NSA is the lead agency in making targeting decisions under Section 702. The FBI Targeting Procedures Targeting Procedures § I. l at 1. "Thus, the FBI Targeting Procedures apply in addition to the See Docket No NSA Targeting Procedures," em. Op., Sept. 4, 2008 ("September 4, 2008, Opinion") at 20 (emphasis in original). It is worth highlighting two salient features of upstream collection as conducted prior to March 17, 2017, that bear on the issues raised by the abouts limitation: (I)eNSA sometimes acquired "multiple communication transactions," or "MCTs,"e through upstream collection. An MCT is a bundle of communications transiting part of the See April 26, 2017, Opinion at 15-16. ("Active user" refers to the user of a communication service to or from whom an MCT is in transit when it is acquired. See id. at 16.) (2)eIn addition to infonnation in transit to or from a tasked selector, NSA acquirede communications, including MCTs, about - i.e., containing a reference to - a tasked selector. For example, if a single email message within an MCT contained a reference to a tasked email account, the entire MCT could be acquired, including numerous additional email messages that Page 12 DATE: Oct 8, 2019 - Authorized Public Release Page 12 of 138 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - I OfI SECREI))31))0REUMI40FURI◄ -I did not contain a reference to a tasked selector. See id. For that reason, and because such MCTs could be acquired regardless of whether the active user was a Section 702 target, those additional email messages could be wholly unrelated to any target. See id. at 16-17. As a result, upstream collection as conducted prior to March 17, 2017, was "more likely than other fonns of Section 702 collection to contain information of or conceming United States persons with no foreign intelligence value." Id. at 17 (internal quotation marks and citation omitted). Heightened restrictions were accordingly placed on NSA's retention, use, and dissemination of infonnation acquired through upstream collection, including a prohibition on queries that used U .S.-person identifiers as query terms. See id. at 17-18. Beginning in October 2016, while the 2016 Ce11ifications were pending before the FISC, the government reported that NSA had violated that querying prohibition much more frequently than had been previously disclosed. The FISC discussed this issue at length in its opinion ultimately approving the 2016 Certifications, which were amended by the government to address that non-compliance. See id. at 14-30. Specifically, the government chose to stop acquiring abouts communications under Section 702 and memorialized that change in amended procedures for the 2016 Certifications. For example, the NSA Targeting Procedures were amended to state that "[a]cquisitions conducted under these procedures wi11 be limited to communications to or from persons targeted in accordance with these procedures." 20 l 6 NSA Targeting Procedures, as Amended, Mar. 30, 2017, § I at 2 (emphasis added). Consistent with that provision, NSA limited acquisition of MCTs to situations where a Section 702 target was the active user or, put another way, a sender or recipient of the entirety of each MCT acquired. NSA's cunent minimization - iflOft 8E@RE'tWSl:'/ORCON:'l'JOF01lN DATE: Oct 8, 2019 - Authorized Public Release Page 13 of 138 Page 13 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 5P8P 81!l@ltl95P11:'8t#8ftOOPVNOFOllff procedures {"2016 NSA Minimization Procedures") were amended to state that Internet transactions acquired after March 17, 2017, "that are not to or from a person targeted in accordance wit11 NSA's section 702 targeting procedures are unauthorized acquisitions and therefore will he destroyed upon recognition." 2016 NSA Minimization Procedures, as Amended Mar. 30, 2017, § 3(b)(4)b at 4. Relying on those changes, the Court approved the amended 20I 6 Certifications and procedures. See April 26, 2017, Opinion at 23-30, 95. The 2016 NSA Minimization Procedures (as amended in March 2017 and approved in April 2017) required the sequestration and destruction of all upstream Internet collection during the timeframe affected by the compliance incident. Aside from infmmation retained subject to restticted access for litigation-hold purposes (see, e.g., Gov't Fifth Update Regarding Info. Acquired On or Before Mar. 17, 2017, Pursuant to NSA's Section 702 Upstream Internet Collection, July 18, 2018, at 5-8) NSA has completed the necessary destruction. The government is not seeking Court approval to resume what it regards as the acquisition of abouts communications under the 2018 Certifications and accompanying procedures. The Court nonetheless identified issues concerning the potential applicability of the abouts limitation to some information within the proposed scope of acquisition under the 2018 Certifications and appointed amici to address the following: (a)eDo the preconditions on acquiring "abouts communications" imposed by Sectione I 03(b) of the [Reauthorization Act] apply only to forms of acquisition that thee government discontinued under Section 702 in March 2017?e (b)eIf the answer to (a) is "no," do any fonns of acquisition to be conducted under thee 2018 Certifications involve a uisition of abouts communications, with particulare consideration ofe - ifOP 8ti8M�%'011%'8ROOfl:fffOFONl DATE: Oct 8, 2019 - Authorized Public Release Page 14 of 138 Page 14 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - T8f 81)O!l!IJT:Vf!ll:1:10noor l:tfJOFOIWJ Order Appointing Amici Curiae, Apr. 23, 2018, at 4. The Court appreciates the he]pfuJ briefing it received from amici and the government on these issues. B. Analysis The Court's examination will begin wit! agreement between the government and amici that such collection comports with the abouts limitation. escribed in element (b)(i) above. It The Court next addresses examines that infonnation as acquired upstream (in-transit) and then as acquired dmvnstream With respect to the Court concludes, again based on substantial upstream collectio agreement between amici and the government, that � lllection wi11 be conducted in a manner that complies with the limitation. The govenunent and amici disagree as to whether the abouts limitation has any application to downstream collection. The Court, for reasons stated below, concludes that it does and addresses the application of the limitation to various types of downstream collection. The Court concludes that I• • • I •' ...• I • comports with the abouts limitation becaus - - ?@I1111ff@@ft@lf;':1811':tOft@ON:tPH:)fOftfl DATE: Oct 8, 2019 - Authorized Public Release Page 15 of 138 Page 15 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - I01' SECRE I11SfoORLOMNOFORN consistent with the limitation. '.J;QP 8ii6Ril1Ui61MQAGON 'JlOFQBiPtl DATE: Oct 8, 2019 - Authorized Public Release Page 16 of 138 Page 16 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release IOI SE@lllillSZ:GIE@GihllGl 8Nf - - IOI■SECJCEI//SillbRLOIUJQOJ•b]CJ4 I DATE: Oct 8, 2019 - Authorized Public Release Page 17 of 138 Page 17 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release Amici agreed with the government, and the Court accepts, that the NSA's is consistent with the abouts limitation. See, e.g., Br. of Amici Curiae ("Amici Brief'), May 31, 2018, at 40 ("[TJhe Government offers what to us are persuasive arguments that Amici conclude that the safeguards - - I I lbi I SELKEI))Jl))OICCUMl◄Ul GIG< DATE: Oct 8, 2019 - Authorized Public Release Page 18 of 138 Page 18 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release ill avoid intentional acquisition of abouts "ensure tha cmmmmications." Amici Brief at 41-42; see also§ 702(b)(5) (authorized acquisition may not intentionally acquire abouts communications). The Cou1i is equally satisfied on the record before it that · s reasonably designed to avoid the acquisition ofo abouts communications (or any other non-target communications) and to require the destruction of any no1Harget communications unintentionally obtained through such collection. Amici make two sets of recommendations First. they recommend that the Comi require the will only acquire government to explain to the Cout1 why communications to or from a Section 702 target, and to repo11 on the methods it uses to audit to detennine what percentage, if any, of information communications acquired are neither to nor from a Section 702 target, and the results of that auditing. See Amici Brief at 43. The Court adopts these recommendations, in part ) as reflected in the repo1ting requirements set out at the end of this opinion. ... &£&2!2 - ..- il!Z211 - SUI - --111111 IFIM - l 52 I DATE: Oct 8, 2019 - Authorized Public Release Page 19 of 138 Page 19 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release . IOf SELKE III"tJJOftCOnn•ePORH Second, amici recommend that the Cow1 require the government to brief Congress Id. at 43-44. Amici do not identify any paiiicular reason to think ordinary oversight processes are inadequate for this subject, and the Court sees no need to dictate the tenns of executive-branch disclosures to Congress. The Court anticipates that congressional committees ofjurisdiction will receive copies of this opinion. See 50 U.S.C. § 1871(c)(I) (requiring Attomey General to submit to specified Congressional committees any decision, order, or opinion of this Court that includes a "significant construction or interpretation of any provision of law"). Congress will then have an infonned opportunity to decide for itself what further infonnation it may desire pertinent changes to the targeting procedures an under Section 702. It will then examine the acquisition of such infonnation through both upstream collection and downstream collection, The Court concludes that, while the abouts limitation potentially applies to both upstream and downstream collection, the government may use both of those means to ·thout acquiling abouts commw1ications. - IJOPfilB iRBIJJililJl;fQftOOtl11:QFQl\tl DATE: Oct 8, 2019 - Authorized Public Release Page 20 of 138 Page20 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - a. ODNI Authorized for Public Release - 1et 9E@ltt'.lffJ'il8100ft00fl:1iOFOHfI • Background The government's submission refers to pursuant to Section 702 The government made what it regards as clarifying edits to its Section 702 _ I,bl SLCKEIJlSiJlbk@OHIHOPOll!U ■ DATE: Oct 8, 2019 - Authorized Public Release Page 21 of 138 Page 21 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release The Brief of Amici Curiae was pa11icularly helpful in this regard. See Amici Brief at 30-33. ffl[B)P ilfi!PH fi!.Sfi;l;ffH;l;fAH fJAftJ:IJIJAFAlilir. DATE: Oct 8, 2019 - Authorized Public Release Page 22 of 138 Page 22 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f'OP Sl!!CRl!YtWSl#ORCON,':PfOFORN DATE: Oct 8, 2019 - Authorized Public Release Page 23 of 138 Page 23 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - TOP Sfi€1HS•om VOACON/JlQF-'Rt'J DATE: Oct 8, 2019 - Authorized Public Release Page 24 of 138 Page 24 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release The Court must now consider whether acquisitio ·s consistent with the abouts limitation. It is necessary to analyze that issue separately for each pertinent fonn of acquisition. Amici contend, and the government does not contest, that such cases involve acquisition of "communications." In support of that conclusion, amici point to the broad definition of "electronic communication" in the Electronic Communications Privacy Act (ECPA), l 8 U.S.C. § 2510( 12) (1986), as '"any transfer of signs, signals, writing, images, sounds, data or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, lflfil:P &illiilJ!i'lt liillfl DATE: Oct 8, 2019 - Authorized Public Release '·,n I IAlt A fil11,T 'PJAliilAlt ,r Page 25 of 138 Page 25 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - Ff8P 0B OllBiiJiW811%181lOOti:'JfOFORll photoelectronic or photooptical system that affects interstate or foreign commerce; subject to ce11ai11 exce tions." Amici Brief at 26. This Court has reviously w1derstood that definition to For purposes of the abouts limitation, it is impo11ant that all of the above-described communications would be in transit to or from a person who is accessing or using the account in question - i.e., the active user- at the time they could be acquired by upstream collection. So long as the active user is properly targeted under Section 702, the acquired communications would be to or from that target and therefore would fall outside the abouts limitation. And generally speaking, the active user of the account in question will be an authorized Section 702 target if the account is properly tasked for acquisition under Section 702. That is because, with a all users of a facility tasked for acquisition under natTow exception for Section 702 are considered targets. See April 26, 20 I 7, Opinion at 16 n.18; 2016 NSA Minimization Procedures, as Amended Mar. 30, 2017 § 4(c)(3) at 6 n. l ("any user of a tasked selector is regarded as a person targeted for acquisition"). (If a tasking of a facility is found to be - - EliOP SFGPFTt'.Sl'.'APCON'NOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 26 of 138 Page 26 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I T8P Oli OlllJT:ttQI1101l@ONI110FQRi'il improper for some other reason - e.g., because one of its users is a U.S. person - further a uisition would be unauthorized, but not due to the abouts limitation.) its procedures, as described above, now require it to limit acquisition to communications to or from a person targeted under Section 702. For example, Amici agree that, so limited, acquisition consistent with the abouts limitation. See Reply Br. of Amici Curiae ("Amici Reply"), June 29, 2018, at 4 (acknowledging that account infonnation "acquired as a resuJt of colJecting communications to or from a targeted account would "plainly fall outside" the abouts Jimitation). - 'JiQP SlsQA.l!i'J11.'6,l!:'OA.60J)f'A.JCFCPN DATE: Oct 8, 2019 - Authorized Public Release Page 27 of 138 Page 27 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release the Court holds that u stream collection under Section 702 may the abouts limitation. Amici make two recommendations with respect to upstream collection generally: (i) the government should be required to report on how it will comply with the abouts limitation when it tasks any new type of selector to upstream collection; and (ii) the Court should ensure that the government is systematically auditing compliance with the abouts limitation in such collection. See Amici Brief at 34-35. The Court agrees with amici's first recommendation, and it is reflected in the reporting requirements included at the end of this opinion. As to the second, the government is directed to include infonnation in any such report describing steps that will be taken to ensure that tasking the new type of selector will acquire only communications to or from a target. To the extent compliance problems arise in such collection, the government will apprise the Court in response to its compliance-reporting obligations, and the Court will have the opportunity to respond to the situation. c. Downstream Collection The government raises a threshold issue about whether the abouts limitation has any application to downstream collection at alt. After answering that general question affirmatively, falls within the Court then assesses whether the downstream acquisition the abouts limitation. - - I fOl!l 8R@8Hl9'8Ji8RfI I8f•Olfl@llt!!t!l DATE: Oct 8, 2019 - Authorized Public Release Page 28 of 138 Page 28 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IOP SECRE IhSl)}dRCONJNOFUM◄ (i) Applicability of Abouts Limitation to Downstream Collection Relying on legislative history, the government posits that Congress intended that limitation to apply only to reinstatement of upstream abouts collection, as previously conducted by NSA and discontinued in March 2017, and not to affect downstream collection. See Gov't Response at 1-2. For example, a report of the Senate Select Committee on Intelligence (SSCI) described Section 103 of the Reauthorization Act as "codif{ying] the Intelligence Communitis (JC's) current prohibition on a subset ofFISA collection under [Section 702] known as 'Abouts' Upstream collection." S. Rep. No. 11 S-182 at 1 (2017). A report ofthe House Permanent Select Committee on Intelligence (HPSCl) stated: The Committee understands that the targeting procedures currently used by the NSA to conduct acquisitions pursuant to FISA Section 702 prohibit the acquisition of communications that are not "to" or "from" a FISA Section 702 target. The new limitation established by Section [103) is intended to codffy only current procedures and is not. intended to affect acquisitions currently being conducted under FJSA Section 702. H.R. Rep. No. 115-475, pt. I, at 20 (2017} (emphasis added). Amici point out that the same general expectation was reflected in statements made by multiple members during floor debate on the Reauthorization Act. See Amici Brief at 22-23 & nn.24-25. The government would have us take those statements to the bank. Amici largely concede the point of congressional intent, but argue that Congress might not have understood what particular kinds of info1mation are acquired under Section 702. See id. at 28. They note that the legislative his�o1y of the Reauthorization Act does not discuss hey assert that silence with respect to a form of acquisition of which Congress - - 181•8J!@tt.E'f;'f81f/@ilt@ON:1U.•)F01Uf DATE: Oct 8, 2019 - Authorized Public Release Page 29 of138 Page 29 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IOP SELKEI)}S])}ORCOMNOFURN might not have been aware should not be taken to suggest that the abouts limitation does not apply. See id. at 17. The government, in response, points to, among other things, legislative history of the FJSA Amendments Act of 2008 and litigation involving challenges to directives I .'J t t nee that Congress is fully on notice that the government acquires I nder Section 702. See Gov't Response at 2-4, 7. The Court is not well positioned to assess congressional understanding on this point. In any event, it must be mindful that "(t]he starting point in disceming congressional intent is the existing statutory text." Laime v. U.S. Trustee, 540 U.S. 526, 534 (2004); accord. e.g.. Sebelius v.eCloer, 133 S. Ct. 1886, 1893 (2013) ("As in any statutory construction case, '[w]e start, ofe course, with the statutory text .... "') (quoting BP America Production Co. v. Burton, 549 U.S. 84, 91 (2006)). The plain meaning of that text must be given effect if "the disposition required by the text is not absurd." Laime, 540 U.S. at 534. Here, the text of Section 702(b)(5) does not distinguish between upstream and downstream collection or otherwise refer to how acquisition is conducted. The provision merely describes communications that are not to or frome a target, but contain a reference to a target, and subjects the intentional acquisition of such communications to the notification and delay requirements of Section l 03(b) of the Reauthorization Act. The Court discerns no absurdity in applying the abouts limitation, by its terms, to downstream collection and will adve1i to legislative history below only insofar as ambiguities are confronted in doing so. See Barnhill v. Johnson, 503 U.S. 393, 401 (1992)e ("appeals to statutory history are well taken only to resolve statutory ambiguity") (internal quotation marks omitted); see also Mohamad v. Palestinian Authority, 132 S. Ct. 1702, 1709 - - TOP 8t!@M'f;"'91;1:18tHJON:'N8FOftff DATE: Oct 8, 2019 - Authorized Public Release Page 30 of 138 Page 30 FISC Opinion, Oc t 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 161■SEEi&I;; SlhGit@UM14GI 6164 (2012) ("[R]eliance on legislative history is unnecessary in light of the statute's unambiguous language.") (internal quotation marks omitted); United States v. Gonzales, 520 U.S. 1, 6 (1997) ("Given the straightforward statutory command, there is no reason to resort to legislative history."). (ii) he above analysis of how upstream acquisition of such communications comports with the abouts limitation applies equally to effected downstream. The Court concludes that the downstream acquisition of such communications does not implicate the abouts limitation. amici and the govemment disagree as to whether the abouts limitation applies to this information. The govemment asserts that, consistent with longstanding practice, acquisitions 'f6f SECM'fh'Slf,'6RCOPffNOfiilOIU� DATE: Oct 8, 2019 - Authorized Public Release Page 31 of 138 Page 31 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release under Section 702 can and do include lt is worth noting that "communications" for pur oses of the abouts limitation. The Court does not understand the govemment to assert that 'fOP tn,e1t@'f;'ifJL\181t@ON,'NOFOIUJ DATE: Oct 8, 2019 - Authorized Public Release Page 32 of 138 Page 32 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release he Court finds in re clearly communications for purposes of the abouts limitation. For their acquisition to be autho1ized under the 2018 Certifications, such communications must be to or from a target. The statutory provisions describing the abouts limitation do not speak to this question, so the Court looks next to the broader statutory text and framework of Section 702. Upon a detennination of exigent circumstances under Section 702(c)(2) or the issuance of a FISC order w1der Section 702(j)(3), "the (AG] and [DNI] may authorize jointly, for a period of up to 1 year from the effective date of the autho1ization, the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence infonnation." §o702(a). FISA does not define "foreign intelligence information" in tenns of the nature of theo information itself, but rather the national-security purposes it may serve: for example, the definition includes "infonnation that relates to, and if concerning a United States person is - IOfI Jl!ettftf:HJI/J Oll:00fl:1i8F8ftff DATE: Oct 8, 2019 - Authorized Public Release Page 33 of 138 Page 33 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 98P 0HON•;l;IQl,V8ftO0fl/H0f0Rrt necessary to, the ability of the United States to protect against ... international terrorism, ... the international proliferation of weapons of mass destruction, [and] ... clandestine intelligence activities" by foreign powers and their agents, as well as "infonnation with respect to a foreign power or foreign territory that relates to, and if concerning a United States person is necessary to ... the national defense or the security of the United States." 50 U.S.C. § 1801 (e)(1 )(B)-(C), (2)(A). Notwithstanding this broad charge to acquire "foreign intelligence infonnation" in furtherance of national-security objectives, there are limitations on how acquisitions authorized under Section 702(a) may be conducted and against whom they may be directed. The abouts limitation is now one of them. It appears in Section 702{b) along with five other limitations on acquisitions authorized under Section 702(a). One of those other limitations, like the abouts limitation, applies to a certain type of communication and provides that an acquisition "may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States." § 702(b)(4). The other limitations do not refer to communications. Three of them prohibit the intentional targeting of persons under certain circumstances- e.g., a U.S. person reasonably believed to be outside the United States or anyone known to be in the United States, § 702(b )( 1 )·(3) - while the remaining one states that acquisitions shall be conducted in a manner consistent with the Fourth Amendment. � § 702(b)(6). The statute also provides the means of accomplishing acquisitions authorized under Section 702(a): the AG and DNI "may direct, in writing, an electronic communication service - - IOf•SECREI;;:,u,01tcon,ne1•01tu DATE: Oct 8, 2019 - Authorized Public Release Page 34 of 138 Page 34 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release provider to ...immediateJy provide the Govemment with all infonnation, facilities, or assistance necessary to accomplish the acquisition in a manner that will protect the secrecy of the acquisition and produce a minimum of interference with the services" provided to the target of acquisition. See§ 702(i)(1 )(A). Section 701 of FISA (codified at SO U.S.C. § 1881) defines "electronic communication service provider" to include among other entities: (1) "a telecommunications canier," as that term is defined at 47 U.S.C. § 153.e See§ 70I(b)(4)(A);e (2)e"a provider of electronic communication service, as that tem1 is defined at [18e U.S.C. § 2510(15)]." § 701(b)(4)(B). Section 2510 defines "electronice communication service" as "any service which provides to users thereof thee ability to send or receive wire or electronic communications." J 8 U.S.C.e §e2510(15). It defines "electronic communication," in turn, as "any transfer ofe signs, signals, writing, images, sounds, data, or inteHigence of any naturee transmitted in who]e or in part by a wire, radio, electromagnetic, photoelectronice or photooptical system that affects interstate or foreign commerce," but excJudinge "any wire or oral communication" and certain other types of communications note pertinent here. See § 2510(12); ore (3) "any other communication service provider who has access to wire ore electronic communications either as such communications are transmitted or ase such communications are stored." § 701 (b)(4)(D).e The govemment clearly may acquire communications under Section 702 subject to the I I ii .<ii.I A I\. I Ji .litllli 1111 I iUllfi IPt 11th DATE: Oct 8, 2019 - Authorized Public Release Page 35 of 138 Page 35 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release As the government suggests, see Gov't Response at 6-7, that conclusion draws further support from language in Section 703 of PISA (codified at 50 U.S.C. § 1881b). Section 703, the original version of Section 702, and the definition of "electronic communication service provider" at Section 701(b)(4) were all enacted by the same provision of the PISA Amendments Act of 2008. See Pub. L. No. 110-261, § 101(a)(2), 122 Stat. 2436, 2437-53 (2008). Although Sections 702 and 703 differ in a number of ways - e.g., whether the targets are U.S. persons or non-U.S. persons - there are also similmities. Both sections involve "the targeting" of persons "reasonably believed to be located outside the United States to acquire foreign intelligence infonnation," §§ 702(a), 703(a)(l ), and both provide for directing "an electronic communication service provider" to give the government "all infonnation, facilities, or assistance necessary to accomplish [such] acquisition,"§§ 702(i)(l)(A), 703(c)(S)(B). I I ii .Uh II W:... ,: ,:2,t;1JilN (iF{i1'1ii,lfi';(iffi(i)ff P~ DATE: Oct 8, 2019 - Authorized Public Release Page 36 of 138 Page 36 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release ■■,,.._,,,. • "'" ,• .-n.., 11, ■ •••• ■ ,,.,....,, ■," ■, ,n, 110f 9ECftB'FN9th'8R€0PNN8F8RPi DATE: Oct 8, 2019 - Authorized Public Release Page 37 of 138 Page 37 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - TOPI l'.Jl!!@Rl!!::P;;Ql;:'Olt@ON1'HOFONJ DATE: Oct 8, 2019 - Authorized Public Release Page 38 of 138 Page 38 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release IOP SECREIJJSl})OkLOMi◄OPOl'd� DATE: Oct 8, 2019 - Authorized Public Release Page 39 of 138 Page 39 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - I I •er Oft@llJBf)f,01n 8R08rt:HOFOR4!( The government, in contrast, argues that Congress was probably silent on this point because it did not contemplate or intend that the abouts limitation would apply to downstream acquisitions at all. See Gov't Response at 2. Amici concede that there is substantial suppo11 in the legislative history of the Reauthorization Act for that proposition. See, e.g.. Amici Brief at 28 ("[T]here is considerable legislative history evidence to suggest that Congress understood the statutory restrictions it was putting in place as covering the same universe of communications that the Government had discontinued acquiring in March 2017, and even some evidence that some legislators understood that universe as related to upstream Intemet communications."). As noted above, the record evinces congressional concems about a fonn of abouts collection that nd that had been was unique to NSA upstream collection discontinued by NSA at the time the Reautho1ization Act was passed. See. e.g.. S. Rep. No. 115-182, at 1 (noting that abouts limitation was intended to codify cunent prohibition of subseto of Section 702 collection known as "'Abouts' Upstream collection"). The accompanying House Report expressly disavowed any intention "to affect acquisitions currently being conducted under FISA Section 702." See H.R. Rep. No. 115-475, pt. 1, at 20. There is little doubt that Congress had NSA's intentional upstream collection of"abouts" communications and MCTs in its The govemment also points to the legislative history of the FJSA Amendments Act of 2008 to the effect that its various provisions were meant to enable - - TOP OIJOftlilf)i;%1Ql;l;IQROfiJN:1:IIUHiOWf DATE: Oct 8, 2019 - Authorized Public Release Page 40 of 138 Page40 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release n addition to their general oversight of Section 702 implementation, the government notes that congressional committees of jurisdiction have been specifically apprised of adversary proceedings brought by providers challenging directives. The government represents that those directives, and the judicial opinions addressing the provider challenges, have been produced to relevant committees and explicitJy refer to See id. at 3 nn.1-3. To be abundantly clear, the Court does not rely on this history to support a conclusion that the abouts limitation does not apply to contrary, as noted above, it holds the rever DATE: Oct 8, 2019 - Authorized Public Release Page 41 of 138 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - 'POP Sl!!CltMh'Slf/OltCOf4fPi8F8MPl That conclusion does not leave the government at libe1iy to acquire nerely because it contains a reference to an account tasked for acquisition under Section 702. The FBI Targeting Procedures only penni hat is "contained in or pertains to" a tasked account. See FBI Targeting Procedures § 1.5 at 3. This accords with longstanding practice under Title Ill of FISA. See Gov't Response at 4-5, 7 n.6. So understood, the FBI Targeting Procedures do much if not all of the work that could be done by the abouts limitation if it were to appl - 'ft)P JJ!!Cft@'Ph'OIJ'1181tCON1'N8F81tN• DATE: Oct 8, 2019 - Authorized Public Release Page 42 of 138 Page42 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 'l'Of Ol!@l\l!�)OIXOftOOPJ:'JfOP8Nf limited infonnation contrasts with the scope ofNSA's pre-March 2017 upstream collection of abouts communications, including MCTs, which could acquire the contents of a large number of U.S.-person communications that were neither to nor from a target. See Pait Ill.A above. In the present case, moreover, Section 702 target outside the United States, or even the target herself, which would further reduce the likely intrusion on U.S. persons' privacy. The Comt is therefore satisfied · s consistento with both the spitit and the letter of the abouts limitation. mici point to no plausible acquisition of Based on a strained reading of language appearing in - - IJQPODQRliJIJIIOlff£A$i£fllti@EOR&f DATE: Oct 8, 2019 - Authorized Public Release Page 43 of 138 Page 43 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release "abouts" communication.) The Court views these examples as hypothetical and. so far as the Court is aware, counterfactual. In short. based on the cun-ent record. amici raise no serious concerns that any w1dcr the FBI Targeting Procedures would run afoul of the abouts limitation, even i mici suggest that the government should be required to provide more m onnatton btained under Section 702. See, e.g., with regard t Amici Brief at 37; Amici Reply at 2-3. The Court agrees with amici that a fuller accounting of cquired pursuant to Section 702 will infonn future assessments of whether particular acquisitions may be subject to the abouts limitation and are otherwise properly authorized. The government has stated it would "endeavor to accommodate" a request for such an accounting. See July 13, 2018, Proposed Tr. at 23. The Court consequently is ordering the government to provide additional infonnation in this regard, as stated at the end of this opinion. TOP S�CIU!1'f,'Sl,Y6ft€6Ni'N6P6RN DATE: Oct 8, 2019 - Authorized Public Release Page 44 of 138 Page44 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release Ff8P SHCRIMWSl,¥8ROON:'PtOPOllN C. Conclusion The Court accordingly finds tha ot involve the acquisition of abouts communications. Otherwise, the changes to the government's targeting procedures, see March 27, 2018, Memorandum at 37-43, present no impediment to the Cou11's finding that the targeting procedures compo11 with the requirements of§ 702(d)(l) and the Fourth Amendment. IV. THE QUERYING AND MINIMIZATION PROCEDURES A. Statutory Provisions Pursuant to § 702U)(2)(C)-(D), the Court must assess whether the querying procedures and minimization procedures comply with specified statutory requirements. Those statutory requirements are summarized separately below. 1. Requirements for Querying Procedures The Reauthorization Act required the government to adopt querying procedures and provided for FISC review of them. See Reauthorization Act§ 1 Ol(a)(l )(B), (b)(l)(F), 132 Stat. 3. The 2018 Certifications are the first ones subject to that requirement. Id.§ 101 (a)(2). Specifically, the AG, in consultation with the DNI, must "adopt querying procedures consistent with the requirements of the fourth amendment ... for infonnation collected" pursuant to a Section 702 certification, see§ 702(f)(l )(A), and must "ensure" those procedures "include a technical procedure whereby a record is kept of each United States person query tenn used for a query." § 702(f)(1 )(B). "Query" is defined as "the use of one or more tenns to retrieve the unminimized contents or noncontents located in electronic and data storage systems of - IOI ■SECREJ))§l))bkCOl◄ll4010164 DATE: Oct 8, 2019 - Authorized Public Release Page 45 of 138 Page 45 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I01 tJl!!CM!.-ll81Ul8ft@OfMf@IFOftff communications of or concerning United States persons obtained through acquisitions authorized" under a Section 702 certification. See§ 702(f)(3)(B). The FISC must detennine whether querying procedures satisfy the requirements of§ 702(f)(1 ). See§ 702(j)(3)(A)-(B). The Reauthorization Act further amended Section 702 to require the govenunent in specified circumstances to obtain a FISC order before accessing Section 702-acquircd infonnation. See Reauthorization Act§ 101 (a)(] )(B). Those amendments are codified at Section 702(f)(2). Specifically, that new statutory requirement applies: (1)eonly to the FBI, not the CIA, NSA or NCTC. See§ 702(f)(2)(A);e (2)eonly to accessing "the contents of communications ... that were retrieved pursuant toe a query made using a United States person query te1m." Id. For purposes of Sectione 702(f), the term "contents," "when used with respect to any wire, oral, or electronice communication, includes any infonnation concerning the substance, purport, or meaninge of that communication." 18 U .S.C. § 2510(8) (incorporated by § 702(f)(3)(A)). The newe requirement does not limit the authority of the FBI to conduct a lawful query, by whiche the contents of communications may be retrieved. See § 702(f)(2)(F)(i);e (3)eonly with regard to "a query made using a United States person query tenn that wase not designed to find and extract foreign intelligence information." § 702(f)(2)(A). Thee new requirement does not limit the FBl's authority "to review, without a court order, thee results of any query ... that was reasonably designed to find and extract foreigne inte1ligence infon11ation, regardless of whether such foreign intelligence infonnatione could also be considered evidence of a crime." § 702(f)(2)(F)(ii); ande (4)eonly "in connection with a predicated criminal investigation opened by the [FBI] thate does not relate to the national security of the United States." § 702(t)(2)(A). The newe requirement does not Jimit the FBl's ability "to access the results of queries conductede when evaluating whether to open an assessment or predicated investigation relating to thee national security of the United States." § 702(f)(2)(F)(iii).e In addition, the FBI need not obtain a Coul1 order if it "detennines there is a reasonable belief' that the contents sought "could assist in mitigating or eliminating a threat to life or serious bodily hann." § 702(f)(2)(E). - '.],OPiliCi:ilJi'.], H6111CRCAN0JOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 46 of 138 Page 46 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 'f'8P8f!Cftl3ifh1Sil\'8D@8i'VN8fl8ftN When the triggering conditions are satisfied, FBI perso1mel must apply for and receive a FISC order before accessing contents rettieved by such a query. See§ 702(f)(2)(A). The application must be made upon oath or affimiation and approved by the AG based upon a finding that the application satisfies the statutory requirements. See§ 702(f)(2)(C). It must include "a statement of the facts and circumstances relied upon ... to justify the belief ... that the contents" sought "would provide evidence of: (I) criminal activity; (II) contraband, fruits of a crime, or other items illegally possessed by a third party; or (III) property designed for use, intended for use, or used in committing a crime." § 702(1)(2)(C)(ii). Upon such an application, "the Court shall enter an order approving the accessing of the contents of communications" if it "finds probable cause to believe that such contents would provide any of the evidence" described above. See§ 702(f)(2)e(D). If such an 6rdei· is not obtained when required, infonnation concerning a U.S. person obtained through the pertinent query may not be used in a criminal proceeding against that person unless the AG detennines the criminal proceeding relates to the national security or one of several specified serious crimes. See 50 U.S.C. § 188le(a)(2)(A). 2. Requirements for Minimization Procedm·es Section 702(e)(]) requires minimization procedures that "meet the definition of minimization procedures under ( 50 U.S.C. § 1801(h) or I 821 (4)]." That definition requires (1)especific procedures ... that are reasonably designed in light of the purpose ande technique of the particular surveillance ( or physical search], to minimize thee acquisition and retention, and prohibit the dissemination, of nonpublicly availablee infonnation concerning unconsenting United States persons consistent with thee need of the United States to obtain, produce, and disseminate foreign intelligencee infonnation;e - 'JaOP 61iwRlii1:'::0U'OiA'1JQN 1aiQFQAP:I DATE: Oct 8, 2019 - Authorized Public Release Page 47 of 138 Page47 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release 101•31!.CllETh31;;· 1eftCONJue,ettu - (2)eprocedures that require that nonpublicly available information, which is note foreign intelligence infotmation, as defined in [50 U.S.C. § 180l{e)(1)], shall note be disseminated in a manner that identifies any United States person, without suche person's consent, unless such person's identity is necessary to understand foreigne intelligence infonnation or assess its importance; [and]e (3)enotwithstanding paragraphs ( l) and (2), procedures that allow for the retentione and dissemination of infonnation that is evidence of a c1ime which has been, ise being, or is about to be committed and that is to be retained or disseminated fore law enforcement purposes[.]e §e180 l( h). The definition of "minimization procedures" at § 1821 (4) is substantively identical toe the definition at§ 1801 (h) (although § J 821(4)(A) refers to "the purposes ... of the particular physical search"). For simplicity, subsequent citations refer only to§ 180l{h). Each agency having access to "raw," or unminimized, infonnation obtained under Section 702 is governed by its own set of minimization procedures in handling that infonnation. (This opinion uses the terms "raw" and "unminimized" interchangeably. The NCTC Minimization Procedures define "raw" infonnation as "section 702-acquired infonnation that (i) is in the same or substantially the same fonnat as when NSA or FBI acquired it, or (ii) has been processed only as necessary to render it into a fonn in which it can be eva]uated to determine whether it reasonably appears to be foreign intelligence information or to be necessary to understand foreign intelligence information or assess its importance." NCTC Minimization Procedures§ A.3.d at 2). The minimization procedures submitted in the Prior Dockets contained rules for querying raw Section 702 infonnation. See, e.g., 2016 FBI Minimization Procedures§ Ill.D at 11-12. In response to the enactment of§ 702(f), the AG and DNI have adopted querying procedures for each agency that appear in a document separate from the relevant set of minimization procedures. - . 120P ifiGAliiJzU6f;!:'OIUi10tl '1llOFOA>I DATE: Oct 8, 2019 - Authorized Public Release Page 48 of 138 - Page48 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 1f8P S@CR@111f,1EIIXOM!CON/fiOFORf l See page 6 above. Each agency's procedures nonetheless make clear that the querying and minimization procedures are to be read and applied together. See, e.g.• NSA Querying Procedures§ I at 1 ("These querying procedures should be read and applied in conjunction with [the separate] minimization procedures, and nothing in these procedures penuits any actions that would otherwise be prohibited by those minimization procedures."); FBI Querying Procedures §e1 at 1 (same); NSA Minimization Procedures§ I at 1 (''These minimization procedures apply ine addition to separate querying procedures.... [They] should be read and applied in conjunction with those querying procedures, and nothing in these procedures pennits any actions that would otherwise be prohibited by those querying procedures."); FBI Minimization Procedures§ I.A at 1 (same). The Court therefore will assess whether each agency's minimization procedures, in conjunction with the corresponding querying procedures, satisfy§ 180l(h). B. Recordkeeping Reguirement for U.S.-Person Query Terms The statute's text plainly requires the relevant agencies, including the FBI, to keep records of U.S.-person query terms used to query Section 702 infonnation. The FBI's practice of keeping records of all query tenns in a manner that does not differentiate U.S.-person terms from other tenns is inconsistent with that requirement. The Court begins with the statute and a textual analysis and then separately explains why the government's arguments regarding text, legislative history, and policy considerations do not alter the outcome. I.e Backeround As noted above, the querying procedures must "include a technical procedure whereby a record is kept of each United States person query tem1 used for a query." § 702(f)(l)(B). The - - iJ0P Q!QQllliifll:'1'01?QRQOJJ1tiOFQIHf DATE: Oct 8, 2019 - Authorized Public Release Page 49 of 138 Page49 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 101•Sl!:Cftl!:1"""'etteen,,u,,ettN querying procedures for each agency define "United States person que1y tenn" as "a term that is reasonably likely to identify one or more specific United States persons," which "may be either a single item of infonnation or inforn1ation that, when combined with other infonnation, is reasonably likely to identify one or more specific United States persons." CIA Querying Procedures§ III.A at 1; NCTC Querying Procedures§ Ill.A at 1; FBI Querying Procedures §eIII.A at 1; NSA Querying Procedures§ III.A at l. Depending on context, "names or uniquee titles," "government-associated personal or corporate identification numbers," 1d "street address, telephone, an ould all constitute United States-person query tenns. See CIA Querying Procedures§ ULA at 2; NCTC Querying Procedures§ III.A at 2; FBI Querying Procedures §eIll.A at 2; NSA Querying Procedures§ IlJ.A at 2.e Each agency's querying procedures require the agency to "generate and maintain an electronic rec-0rd of each United States person query tenn used for a query of unminimized infonnation acquired pursuant to section 702." CIA Querying Procedures§ IV.B.1 at 3; NCTC Querying Procedures§ IV.B.l at 3; FBI Querying Procedures§ IV.B.1 at 4; NSA Querying Procedures§ IV.B.1 at 4. If, however, "it is impracticable" for a particular system "to generate an electronic record," or if "an unanticipated circumstance ... prevents the generation" of an electronic record, the agency "must generate and maintain a written record of each United States person query tenn that contains the same information required for electronic records." CIA Querying Procedures§ JV.B.3 at 4; NCTC Querying Procedures§ IV.B.3 at 4; FBI Querying Procedures§ IV.B.2 at 4; NSA Querying Procedures§ IV.B.2 at 4. Agencies may run queries on TAP SFCPET/JSI//OPCOtJ IIJOEOP):- DATE: Oct 8, 2019 - Authorized Public Release Page 50 of 138 Page 50 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release ,_ JOI SECRElllbliiGJl@Cll!!IOL Ski systems that do not generate electronic records only when necessary for "technical, analytical, operational, or security reasons." CIA Querying Procedures§ IV.BJ at 4; NCTC Querying Procedures§ N.B.3 at 4; FBI Querying Procedures§ IV.B.2 at 4; NSA Querying Procedures §eIV.B.2 at 4. The agencies must maintain their electronic and written records for at least fivee years from the date of the query (or in the case of NSA for at least five years from the date of approval to use a United States-person query teim to query content infonnation). See CIA Querying Procedures§ IV.B.4 at 4; NCTC Querying Procedures§ IV.B.4 at 4; FBI Querying Procedures§ IV.B.3 at 4-5; NSA Querying Procedures§ IV.B.3 at 4. For the CIA, NCTC, and the FBI, the electronic record must include "the query term(s) used," "the date of the query," and "the identifier of the user who conducted the query." CIA Querying Procedures§ IV.B.l at 3; NCTC Querying Procedures§ IV.B.1 at 3; FBI Querying Procedures§ IV.B.1 at 4. NSA 's use of United States-person query terms "to identify and select unminimized section 702-acquired content,, infonnation requires prior approval by its Office of General Counsel. See NSA Querying Procedures§ N.A at 3. The duration of such approvals may not exceed one year, but may be extended in increments of one year. Id. The electronic record for NSA' s use of a United States-person query term accordingly must include "the query term(s) used or approved"; "the date of the query or approval of the query terms(s)"; "the identifier of the user who conducted the query or sought approval of the query term(s)"; and "in the case of content queries, the approving official in NSA 's Office of General Counsel and duration of the approval." § IV.B.l at 4. - - T8F QIIOMIT#QIOOftQO)UflOliOIUI DATE: Oct 8, 2019 - Authorized Public Release Page 51 of 138 Page 51 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release . IOI SECREl)JSIJJORCOICJJCOI Ofo◄ Unlike the other agencies, the FBI "intends to satisfy the record-keeping requirement by keeping a record of all queries" of un-minimized Section 702 infonnation. See FBI Querying Procedures § JV .B.3 at 4 n.4 (emphasis added). The re..c;ulting FBI records, in other words, will not distinguish between United States-person query tenns and other query tenns. See March 27, 2018, Memorandum at 27. In fact, the government represents that the FBI already keeps records of all Section 702 query tenns without distinguishing between U.S.-person query tenns and non­ U.S.-person query tenns and contends that Section 702(f)(I)(B) requires no change. See id. at 26. 2. Application of Section 702({)(1)(8) to FBI Recordkeeping Practices The issue presented by the FBl's current recordkeeping is straightforward: Is the requirement for "a technical procedure whereby a record is kept of each United States person query tenn used for a query" satisfied by a procedure that results in records that do not indicate whether tenns are United States-person query tenns? The plain meaning of the statutory text suggests that the answer is "no." a. Textual Analysis A "record" serves to memorialize information. See, e.g., Black's Law Dictionary (I0th ed. 2014) (defining "record" as, among other things, "1. A documentary account of past events, usu. designed to memorialize those events"); Webster's II New College Dictionary 927 (2001) (defining "record" as "l. a. An account, as of infonnation, set down esp. in writing as a way of preserving knowledge. b. Something on which such an account is made... 2. Jnfonnation or data on a specific subject collected and preserved"). Section 702{f)( 1 )(B) identifies "each United marSFCRET((SJ(PRCON'NOFARN DATE: Oct 8, 2019 - Authorized Public Release Page 52 of 138 Page 52 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - fJiOPfiiillliTf!61'.'0RCOt:'.DJOFOPN States person query tem1 used for a que1y" as the infonnation that must be memorialized. The government argues that records that document all terms used to query Section 702 information, regardless of whether the te1m is a United States-person query tenn or not, satisfies Section 702(t)(l)(B) because that provision "does not include any other tenn, such as 'separately' or 'segregated,' specifying that United States person query tenns must be retained apart from other queries." March 27, 2018, Memorandum at 27; see also Gov't Response at 28-29 (statute "does not include any additional language specifying that U.S. person query tenns must be retained separate and apart from other queries"). The government's argument, however, misses the essential aim of the recordkeeping requirement, which is to memorialize when a United States-person query tem1 is used to query Section 702 infonnation. Just as records of all applicants admitted to a university are not records of out-of-state applicants admitted if they do not differentiate out-of-state from in�state, records that do not memorialize whether a query tenn used to query Section 702 data meets the definition of a United States­ person query tenn do not preserve the infom1ation specifically required by Section 702(f)( l)(B). Section 702(f)(J)(B), moreover, imposes a recordkeeping requirement only for queries that use United States-person que1y terms, not for all que1ies. It is not reasonable to expect Congress to have focused on the circumstance of an agency's generating records for all its Section 702 query tenus and to have explicitly reiterated that, in such a case, the records must document which of those query tenns are United States-person query tenns. The language Congress chose to enact clearly conveys that the records are meant to memorialize when United Sflfilt? .'itilPH P.lifl/JI.GH:'JIAH PAfJ:'l'J Af>Afth DATE: Oct 8, 2019 - Authorized Public Release Page 53 of 138 Page 53 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - 5f8P 8E@RE5fh181:1;10R@ON:'�fOFOWI States�person query terms are used, and the FBI is obligated to keep records that do so, regardless of whether it also keeps records for other query terms. The government also argues that, in light of an exemption from certain aspects of public reporting required by Section 603 ofFISA (codified at 50 U.S.C. § 1873), Section 702(f)(l)(B) should not be read as requiring the FBI to alter its current rec-0rdkeeping practices. Section 603 requires the DNI to repo1t publicly on, among other things, "the number of search tenns conceming a known United States person used to retrieve the unminimized contents of electronic communications or wire communications obtained" under Section 702 and "the number of queries concerning a known United States person of unminimized noncontents infonnation relating to electronic communications or wire communications obtained" under Section 702, §e603(b)(2)(B)-(C); however, "information or records held by, or queries conducted by," the FBIe are explicitly exempted from that reporting, except insofar they relate to FISC orders issued under Section 702(f)(2). See§ 603(d)(2)(A). The government attributes this exemption of FBI queries to congressional recognition that the FBI lacked the capacity to provide the relevant information. See March 27, 2018, Memorandum at 29 (quoting H.R. Rep. No. 114-109, pt. 1, at 26 (2015) ("the FBI is exempted from repo1ting requirements that the agency has indicated it lacks the capacity to provide")). The government suggests that because Congress generally exempted FBI queries from the DNI's annual reporting (only requiring reporting for FBI queries that relate to Section 702(f)(2) orders), the recordkeeping requirement of Section 702(f)(l)(B) should be read to make similar allowances for the FBI's limited capabilities. See March 27,2018, Memorandum at 30 'f'OP 9ECRf;'fh'Slh'ORCONi'NOFORN DATE: Oct 8, 2019 - Authorized Public Release Page 54 of 138 Page 54 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IIGI■SECMf;;91;;61tl!8JM(8fi8Rff (Congress ·•presumably would have included such queries in the statistics required to be reported in the annual DNI report" if it had "intended for FBI to distinguish and separately track United States person queries."). The premise of the government's argument is that the only purpose for keeping records that identify United States-person query tenns is to satisfy the DNI's reporting obligations. That premise is belied by the government's own briefing, which acknowledges oversight of the agencies' querying practices as another purpose of Section 702(f)(l )(B)'s recordkeeping requirement. See March 27, 2018, Memorandum at 27. Because the recordkeeping requirement serves a purpose separate from the reporting obligations, there is no inconsistency between exempting from public repo1ting the number of U.S.-person queries conducted by the FBI and requiring the FBI to keep records that identify which Section 702 query ten11s are United States-person query terms. The explicit exemption set forth in Section 603(d)(2)(A) demonstrates, moreover, that if Congress intended for Section 702(t)(l )(B) to make similar allowances for the FBI, it would have been easy to provide for them expressly. In support of its position, the govemment also cites Section 112 of the Reauthorization Act, which requires the Inspector General of DOJ to repo1t to Congress on the FBJ's implementation of querying procedures within one year of their approval by the FISC. See March 27, 2018, Memorandum at 31. In addition to requiring the Inspector General to assess several aspects of FBI' s implementation of the querying procedures, Section 112 requires the Inspector General to assess any impediments, including operational, technical, or policy impediments, for Lhe [FBI] to count (A)ethe total number of queries where the FBI subsequently accessed informatione acquired w1der ... section 702;e TOP SECftE'fh'SIHORCONtNOFOR:N DATE: Oct 8, 2019 - Authorized Public Release Page 55 of 138 Page 55 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f 811 S661l:IHW61:4'QACQN,~0'60;A:i>l (B)ethe total number of such queries that used known United States person ident{fiers; ande (C) the total number of queries for which the [FBI] received an order of thee Foreign Intelligence Surveillance Court pursuant to [Section 702(f)(2)].e § l 12(b)(8) (emphasis added). The government argues that Congress recognized "the limitationse of FBI systems' technical record-keeping function" when it enacted Section 112, and that this provision makes clear it "did not intend to impose any new obligation on the FBI to differentiate queries based on United States person status." March 27, 2018, Memorandum at 31; see also Gov't Response at 30 ("lf, as amici claim, the Reauthorization Act newly mandates that FBI separately track U.S. person query terms, a new statutory directive requiring an IG report discussing 'impediments, including operational, technical or policy impediments' to do that very thing would be pointless."). The government's ar&,,ument ignores that Section l 12(b)(8)(C) of the Reauthorization Act directs the Inspector General to rep01i on impediments to the FBI's counting ofU.S.-person queries for which it receives a FISC order under Section 702(f)(2) - information the DNI is explicitly required to report under Section 603 ofFISA, as amended by the Reauthorization Act. See FISA § 603(b)(2)(B) & (d)(2)(A), as amended by Reautho1ization Act §e102(b)(2)(B)(ii).e Amici contend that Congress did not acquiesce in cuITent FBI practices, but rather imposed new recordkeeping requirements and deputized the Inspector General to scrutinize how the FBI implements them . See Amici Brief at 80-81. Amici have the better of the exchange. Congress can sensibly be understood to have directed the Inspector Genera] to assess impediments toward the FBl's counting queries that employ U.S.-person identifiers as query - - TOP t!tlH!!R@'.f1,IJIOt%'0ROOfll'JIQFQftll DATE: Oct 8, 2019 - Authorized Public Release Page 56 of 138 Page 56 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 'ifl8P S@CJRElfh'SIOORCJON,'J>JO�RN tenns (Reauthorization Act§ 112(b)(8)(B)), while simultaneously requiring the FBI and other agencies to maintain records necessary to perfom1 that count. b. Le�islative History The government further argues that the legislative history of the Reauthorization Act supports its conclusion that the FBI's recordkeeping is consistent with Section 702(f)(l)(B). Even if one assumes arguendo that the statute is reasonably susceptible to the government's interpretation, such that ambiguity justifies recourse to legislative history,� Part JII.B.2.c(i) above, the government's arguments are unavailing. The government points to the following statement in a HPSCI report: [Section 702(f)(] )(B)] does not impose a requirement that an Intel1igence Community element maintain records of United States person que,y terms in any particular manner, so long as appropriate records are retained and thus available for subsequent oversight. This section ensures that the manner in which [an agency] retains records of United States person query terms is within the discretion of the Attorney General, in consultation with the Director of National Intelligence and subject to the approval of the FISC. H.eRep. No.115-475, pt. 1, at 18 (emphasis added) (quoted in March 27, 2018, Memorandum ate 27). The government suggests that the FBl's recordkeeping practices reflect a pennissible exercise of the discretion of the AG and the DNI «to detennine how an agency would keep records of queries in a manner that allows for meaningful oversight." March 27, 2018, Memorandum at 27 (emphasis added). But the issue presented is whether the FBI's records will memorialize the infom1ation required by the statute. The passage from the HPSCI report cJearly indicates that, however records are kept, they must be ''records of United States query tenns." It provides no reason to think that (I) HPSCJ understood "records of United States person query - - I Ibi•.9ECRfJIJHUlibl\COftftePeftU DATE: Oct 8, 2019 - Authorized Public Release ~ Page 57 of 138 Page57 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release tenns" to include records that do not indicate whether query tenns are United States-person query te1ms, or (2) HPSCI intended to leave that detennination to executive-branch discretion. In addition, the first sentence of the paragraph from which the above quotation is taken describes the required records in language that closely tracks the statutory text: "Section 201 [ of the Reauthorization Act] further mandates that all querying procedures include a provision requiring that a record is kept for each Ui1ited States person que1y term usedfor a query of FISA Section 702 data." H. Rep. No. 115-475, pt. 1, at 18 (emphasis added). HPSCI's reiteration of the "U.S. person" nature of query terms that must be recorded makes clear that the discretionary manner in which an agency keeps the required records does not include the freedom to decide not to record the fact that a query tennis a United States-person query tem1. The report's reference to "subsequent oversight," moreover, is consistent with an intent that the records document use of United States-person query tenns, as such, particularly in view of HPSCI's acknowledgment "that certain lawmakers and p1ivacy advocates wo1ry about the ability of the Intelligence Community to query lawfully acquired data using query tenns belonging to United States persons." Id. at 17. Such oversight would be best served if the records indicate whether a particular query tennis a United States-person query tenn - i.e., a term reasonably likely to identify one or more specific U.S. persons. The govemment also relies on a statement in the same report that "the Committee believes that the Intelligence Community should have separate procedures documenting their current policies and practices related to the querying oflawfully acquired FISA Section 702 data." Id. at 17-18 (emphasis added) (quoted in March 27, 2018, Memorandum at 28). The -TOD £FCDFT//£1//0DCOJ>J/J>:J OFOJlJ\1- DATE: Oct 8, 2019 - Authorized Public Release Page 58 of 138 Page 58 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release rpe,r z,:eettE'f//SJfJ'0ft€0U,1',0fil0RU government argues that, because "Congress understood the FBI's existing practice ... and the limitations of FBI systems' technical record-keeping," the reference to query procedures that document current policies and practices demonstrates HPSCI's intent that the FBI need not alter its recordkeeping in response to Section 702(t)(1 )(B). See March 27, 2018, Memorandum at 26, 28. But the report's generic reference to current po]icies and practices of the Intelligence Community appears in a discussion of the general requirement to adopt querying procedures, not the specific recordk:eeping requirements of Section 702(f)(1 )(B). The report, furthermore, does not mention any technical limitations of FBI systems or desc1ibe, let alone endorse, the FBI­ specific practice of keeping records that do not identify which query terms are United States­ person query tenns. Neither the plain language of the statute nor the plain language of the report cited by the government supports its contention that Congress intended no changes to FBI's existing querying practices in response to the Reauthorization Act. c. Policy Considerations Finally, the government contends that requiring the FBI to maintain records that differentiate United States-person query tenns from other Section 702 query tenns will have adverse consequences. See Supplemental FBI Declaration at 8-15. In his declaration, the Director of the FBI does not desctibe as a source of difficulty any "limitations of FBI systems' technical record-keeping functions." March 27, 2018, Memorandum at 26, 28. Instead, he posits that such a requirement would leave the FBI with two possible means of implementation, neither of which is desirable. Under one option, FBI personnel would conduct research in FBI holdings to infom1 their assessments of which proposed query tenns are United States-person query tenns 'i>0P Sli!CM'¥J¥S1,¥8R0OM,'l'i8F91L'I DATE: Oct 8, 2019 - Authorized Public Release Page 59 of 138 Page 59 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f 8P 813 CJH:il35FOS l:':'9RCOl'Ul>J Oi>OR'\l for pu1poses of Section 702(t)(l)(B). See Supplemental FBI Declaration at 8-9. The Director anticipates that approach would divert resources from investigative work, delay assessment of threat infonnation, and discourage its personnel from querying W11ninimized FISA infonnation, to the dettiment of public safety. Id. at 9-12. He also describes an alternative approach whereby persom1el would be allowed to forgo such research and rely solely on their "personal knowledge" in making those assessments. Id. at 12. The Director expects that practice would "result in inconsistent and unreliable infonnation in FBl systems," id., thereby complicating other aspects of the FBl's work - e.g., implementing its Section 702 targeting procedures. Id. at 13-14. The Director also expresses concern that such an approach would be inconsistent with the FBJ's "strong culture that places great emphasis on personnel consistently conveying true and accurate infonnation." Id. at 14. All of those points raise policy considerations regarding the advisability ofrequiring the FBI to keep records that identify United States-person query terms it has used to query Section 702 infonnation. The Court, it should be emphasized, makes no detennination as to the advisability of a particular policy on this subject. Regardless of how persuasive the FBI 's considerations may be, the Court is not free to substitute its understanding of sound policy- or, for that matter, the understanding of the Director of the FBI - for the clear command of the statute. See 14 Penn Plaza LLC v. Pyett, 556 U.S. 247,270 (2009) ("Absent a constitutional banier, 'it is not for us to substitute our view of ... policy for the legislation which has been passed by Congress."') (quoting Florida Dept. of Revenue v. Picadilly Cafeterias, Inc., 554 U.S. 33, 52 (2008)); Bamhart v. Sigmon Coal Co, 534 U.S. 438, 462 (2002) ("We will not alter - - •or 01]@ftl)1WOU1Qllfil0)J!)IQFOIUI DATE: Oct 8, 2019 - Authorized Public Release Page 60 of 138 Page60 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f6P Sl!:CftE'tWSIJ'f6ftCON{NOFOfttJ the (statutoryJ text in order to satisfy the policy preferences of the Commissioner [ of Social Security]."); Herb's Welding, Inc.v. Gray, 470 U.S. 414,427 (1985) ("[l]fCongress' ... decisions are mistaken as a matter of policy, it is for Congress to change them. We should not legislate for them."). In sum, the Coutt is it is merely enforcing what Section 702(t)(l )(B) plainly imposes. d. Conclusion In sho1t, the Court should follow the "'first canon "' of statutory construction: to presume that Congress says in a statute what it means and means in a statute what it says. Barnhart, 534 U.S. at 461-62 (quoting Connecticut Nat'! Bank v. Germain, 503 U.S. 249, 253-54 (1992)). Section 702(f)(l )(B) plainly states that the querying procedures must include "a technical procedure whereby a record is kept of each United States person query te1m used for a query." That requirement is not satisfied by procedures under which the FBI does not keep such records in a readily identifiable manner. The Court accordingly finds that the FBI Querying Procedures do not comport with Section 702(f)(l )(B). The Supplemental FBI Declaration touches on another point that the Court will address because it may bear on curing this deficiency. Section III.B of the FBI Querying Procedures provides for certain presumptions regarding U.S.-person status. FBI Querying Procedures§ III.B at 3. The Declaration, however, discounts their potential utility in alleviating the problems anticipated by the FBI because "they would genera11y require FBJ personnel to evaluate information in FBI holdings before applying a presumption." Supplemental FBI Declaration at 13 n. 7. But the government can revise those procedures to address specifically what, if any, - - IOP SECREI}}$))}0kCO!tJ!U)Pt!Jffl4 DATE: Oct 8, 2019 - Authorized Public Release Page 61 of 138 Page 61 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification • ODNI Authorized for Public Release - •or Ol!@ftl!�1:'01JIJIOR@OfHf8F8Nf I steps its personnel need to take before relying on presumptions in deciding what tenns to treat as United States-person query tenns for purposes of Section 702(f)( 1 )(B). Such revised procedures, of course, wou]d be subject to FISC review pursuant to Section 702(i). In any event, there are clearly some queries for which FBI personnel know they are using United States-person query tenns, and the obligation to keep adequate records of those te1ms pursuant to Section 702(f)( 1 )(B) will be readily apparent. Finally, the Court does not ho]d that the FBI must immediately deploy a comprehensive technical means of generating appropriate records. So long as it is taking serious steps toward implementing such teclmical means, it may rely on "written" records, as desciibed at FBI Querying Procedures § IV.B.2 at 4. C. FBI Querying Practices and Statutory and Constitutional Requirements The Court next independently finds that tl1e FBI's repeated non-compJiant queries of Section 702 infonnation preclude (1) a determination that its minimization and querying procedures are reasonably designed to minimize the retention, and prohibit the dissemination, of private information concerning U.S. persons, consistent with the government's foreign­ intelligence needs, and (2) a finding that such procedures are consistent with the requirements of the Fourth Amendment. This section begins by describing the role of querying rules within minimization procedures and discussing the reasonableness of the FBl's querying standard, as written. The Court then reviews numerous instances of non-compliance with that standard and three factors that contribute to the Court's concerns about the FBI's querying practices. The Court then - I or 8R@A!i@IJj'.JIQtt'OABUfliJJOPOIUl DATE: Oct 8, 2019 - Authorized Public Release Page 62 of 138 Page62 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 'f6P Sl!J@ftl5'fh:SIOOR!CON:1N8F8Rf4 considers steps the government has taken to respond to non-compliant queries, including requiring FBI personnel to obtain attorney approval before examining content infonnation returned by certain categorically justified queries, and concludes they are insufficient to suppmt the required findings. Finally, the Court examines amici's proposal regarding FBI documentation of query justifications, adoption of which the Court believes would remedy the deficiency. 1. Querying and Effective Minimization The Foreign Intelligence Surveillance Court of Review (FISCR) has instructed: By minimizing retention, Congress intended that "infonnation acquired, which is not necessary for obtaining[,] producing, or disseminating foreign intelligence infom1ation, be destroyed where feasible." Furthenuore, u[e]ven with respect to information needed for an approved purpose, dissemination should be restricted to those officials with a need for such infom1ation." In Re Sealed Case, 3 JO F.3d 717, 731 (FISCR 2002) (per curiam) (quoting H.R. Rep. No. 951283, pt. 1 at 56 (1978) and adding emphasis; internal citations omitted). Notwithstanding that preference for destruction of non-pertinent information when feasible, the F[SC has approved minimization procedures that pe1mit retention for considerable pe1iods of time, even after infonnation has been reviewed and not found to relate to foreign intelligence or evidence of crime. See, e.g.. 2016 FBI Minimization Procedures§ Ill.G.l .bat 23 (such information may be retained for up to 15 years, with enhanced access controls in place after ten years). The FBI minimization procedures now before the Cou1t propose the same approach. See September 18, 2018, FBI Minimization Procedures§ III.D.4.c at 17 (same). The reasonableness of such a retention period rests in part on the "complex and time-intensive nature - - 'il?OP 06ilillii' ':11>I11QRCON C>IQEQP)I DATE: Oct 8, 2019 - Authorized Public Release Page 63 of 138 Page 63 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOf•SELKEI})sm ORCOl◄JICOJI6ftU of piecing together, and making sense of, the myriad pieces of information gathered during a lengthy surveillance." United States v. Mubayyid, 521 F. Supp. 2d 125, 134 (D. Mass. 2007) (finding retention of FISA intercepts for ten years reasonable in circumstances of case). But it also importantly depends on querying rules and other access restrictions that guard against the p.and indiscriminate review and use ofU.S.-person information. See Order, May 17, 2016 ("May 17, 2016, Opinion") at 25 ("because raw FISA-acquired infonnation nay be accessible by large numbers of persons in the FBI for a wide variety of investigative and analytical purposes, it is especially impmtant for U.S. person infonnation on those systems to be subject to appropriate access restrictions," including querying rules); id. at 43 ("substantive standards for s.querying data" "guard against indiscriminate or improper accessing or use of U.S. person information"); em. Op. and Order, Nov. 6, 2015 ("November 6, 2015, Opinion") at 24 (relying on "several important restrictions" of CIA and NSA minimization procedures for §a702, "[m]ost notably" that all tenns used to query the contents of communications must bea "reasonably likely to return foreign intelligence infom1ation") (internal quotation marks omitted). The govemment notes that agency personnel do not need to run queries to find and examine Section 702 infonnation concerning United States persons. They can, for example, review Section 702 data on a communication-by-communication basis and thereby encounter U .S.-person infom1ation. See Gov't Response at 14-15. Despite the availability of that alternative, the rules for U.S.-person queries - i.e., queries that use a "United States person query term" as defined at FBI Querying Procedures §Ill.A-are important to proper minimization of - - TOP 8@eR:E1'¢110tJ;f8'.R@ONfN8FORN DATE: Oct 8, 2019 - Authorized Public Release Page 64 of 138 Page64 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - IIbl•SECltZ lll31l:c5R@c5ff;lf8fi!8ftff - Section 702 infonnation. The government's own submissions emphasize the operationa1 importance of the FBI being able to query infonnation and the large number of que1ies of FISA infonnation conducted by the FBI. See, e.g., Supplemental FBI Declaration at 6 ("[ d]atabase queries are a critical tool," and in one system during fiscal year 2017, FBI ran approximately 3.1 million queries "against raw FISA-acquired infonnation ..., including section 702-acquired information"). Given the importance and prevalence of querying, it is a logical focus for efforts to balance protection of U.S. persons' privacy interests against foreign-intelligence needs. The enactment of Section 702(f) indicates Congress drew a similar conclusion. Indeed, the rules for U.S.-person queries are especially important for minimization of Section 702 information. Section 702 provides a means for the government to target individuals who are reasonably believed to be non-U.S. persons located outside the United States. See §e702(b)(1), (3) (prohibiting intentional targeting of U.S. persons and any persons located insidee United States); (d)(l)(A) (requiring targeting procedures reasonably designed to ensure only persons reasonably believed to be located outside United States are targeted). The government may acquire the full contents of communications under Section 702 without a finding of probable cause, as is needed for electronic surveillance and physical search w1der FISA. See 50 U.S.C. §§ l 805(a)(2), I 824(a)(2). When the government queries Section 702 data to identify ande examine infonnation about a particular U.S. person, moreover, it typically has an investigative or analytical interest regarding that person, who necessarily was not a target of the acquisition. As suggested by amici, it can also result in a further intrusion into the privacy of such U.S. persons, who may have enjoyed "the protection of anonymity" until inforn1ation concerning them was - - IJOP iii ill.iii flil'.'.92GOll '.tIOEOPN DATE: Oct 8, 2019 - Authorized Public Release Page 65 of 138 Page 65 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release retrieved by use of an individualized U.S.-person query directed at them. See Amici Reply at 9. And FBI queries intended to retrieve evidence of crime may be conducted in the course of law­ enforcement investigations that are unrelated to national-security threats. The FBI's querying practices under Section 702 are especially important because the FBI conducts many more U.S.-person queries than the other agencies. In 2017, NCTC, the CIA, and NSA collectively used approximately 7500 terms associated with U.S. persons to query content information acquired under Section 702, see Amici Brief at 51 n.47; Gov't Response at 32, while during the same year FBI personnel on a single system ran approximately 3.1 million queries against raw FISA-acquired information, including section 702-acquired information. See Supplemental FBI DecJaration at 6. (As explained above in Part IV .B. l, FBI records do not differentiate between U.S.-person query tem1s and other query tenns, but given the FBI's domestic focus it seems likely that a significant percentage of its queries involve U.S.-person query tenns.) The large number of U.S.-person queries run by the FBI makes its querying practices significant, despite its receiving only a small percentage of the total information acquired under Section 702. See Gov't Response at 26-27 (it was reported in October 2017 that FBI received infonnation for approximately 4.3% of persons targeted under Section 702). 2. The FBl's Querying Standard The FBI Querying Procedures require: "Each query of FBI systems containing unminimized content or noncontent 1nfonnation acquired pursuant to section 702 of [PISA] must be reasonably like(}' to retrieve.foreign intelligence i�formation, as defined by FISA, or evidence ofa crime, unless otherwise specifically excepted in these procedures." FBI Querying ICCSFGPET((SJ 119969N019FOPN DATE: Oct 8, 2019 - Authorized Public Release Page 66 of 138 Page66 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - II01IIQIU!IRBT!i81:;i8ROOHJIOliiftfl - Procedures§ IV.A. 1 at 3 (emphasis added). (Certain of those exceptions are discussed below in Part IV.D.) As written and in the context of restrictions on the use and disclosure ofU.S.-person information within the FBI Minimization Procedures, that querying standard is consistent with the statutoiy definition of minimization procedures; however, as implemented by the FBI, it is not. The minimization procedures now in effect a1ticulate the standard for FBI queries of Section 702 infonnation differently: "To the extent reasonably feasible," FBI personnel "must design" queries of unminimized Section 702 information "to find and extract foreign intelligence information or evidence of a crime." 2016 FBl Minimization Procedures § IIJ.D at 11. The government represents that "[i]n practice, the applicable standard remains the same .... " March 27, 2018, Memorandum at 24. Counsel for the government has characterized the FBI querying standard as a high one, having three elements: (1) a query cannot be "overly broad," but rather must be designed to extract foreign-intelligence infonnation or evidence of crime; (2) it must "have an authorized purpose" and not be run for personal or improper reasons; and (3) there must be "a reasonable basis to expect [it] will return foreign intelligence infonnation or evidence of crime." July 13, 2018, Proposed Tr. at 9; see also March 27, 2018, Memorandum at 25 (there must be "a reasonable basis to believe the query is likely to return foreigri intelligence information or, in the case of the FBI only, evidence of a crime."). The FBI querying standard - as written and as explicated in the manner summarized above - presents no impediment to finding that the FBI Querying Procedures and FBI Minimization Procedures satisfy the definition at § 180 I (h). Queries that are reasonably likely to - - JjQRiitieGPST11ti:111APGAN'NOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 67 of 138 Page67 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - I·OP SECREI11SiJJORCOMNOllORI•- return foreign-intelligence infom1ation, are conducted for that purpose, and avoid overbreadth should contribute to the minimization of private lJ.S.-person infonnation, consistent with foreign-intelligence needs, as contemplated by§ 180l(h)(l). (The same conclusion holds for the querying standards applied by the other agencies, which require queries to "be reasonably likely to retrieve foreign intelligence information," unless specifically excepted. See NCTC Querying Procedures§ IV.A at 3; CIA Querying Procedures§ IV.A at 3; NSA Querying Procedures§ IV.A at 3.) FBI queries that are reasonably likely to retum evidence of c1ime comport with § 180 I (h) for reasons explained at pages 30-36 of the November 6, 2015, Opinion and adopted herein. 3.e Non-Compliance with the Ouervin2 Standard FISC review of minimization procedures under Section 702 is not confined to the procedures as written; rather, the Court also examines how the procedures have been and will be Mem. Op., Apr. 7, 2009, at 22•24; Docket Nos. em. Op., Aug. 30, 2013, at 6-11. In this case, the government contends that the FBl's implementation of the querying standard has provided appropdate protection for U.S. persons' privacy. See Gov't Response at 32-33. For reasons explained below, the Court does not agree. Since April 2017, the government has reported a large number of FBI queries that were not reasonably likely to return foreign-intelligence infonnation or evidence of crime. In a number of cases, a single improper decision or assessment resulted in the use of query terms corresponding to a large number of individuals, including U.S. persons. In brief: • During March 24-27, 2017, the FBI' nducted queries using identifiers for over 70,000 communication facilities "associated with" -•or - Ol!@ltl!if,�'01;iJIOROOUIJt0JiOBPf DATE: Oct 8, 2019 - Authorized Public Release Page 68 of 138 Page 68 FISC Opinion, Oct. 2018

I Of SELKE I ))31))0RCOIUl ◄ Uit01Cf4 )ersons with access to FBI facilities and systems. See Nov. 22, 2017, Notice at 2. roceeded with those queries notwithstanding advice om 1e ice o eneral Counsel (OGC) that they should not be conducted without approval by OGC and the National Security Division (NSD) of the Department of Justice. Id. at 3. The FBI did not examine the results of those queries. Id. [Most of the notices of non-compliant queries cited herein have a title including the language: "Notice of Compliance Incident[ s] Regarding FBI' s Querying of Raw FISA-Acquired Jnfonnation Including Infonnation Acquired Pursuant to Section 702 of FISA, and Storage of those Query Results.'' Those notices are dted in the fonn of "[Filing Date] Notice." If multiple notices were filed on the same date, their citations are distinguished by reference to the relevant FBI office.] Apr. 12, 2018, Notice at 2. The 1 10 con uc e 1ose quenes advised he did not intend to run them against raw FISA information, but nonetheless reviewed raw FISA infonnation returned by them. Id. • On February 5 and 23, 2018, the FBl's approximately 30 queries regarding potential persons who here the subject of a investigation was See June 7, 2018, Notice at 2-3. • On February 21, 2018, the FBI's queries to retrieve info1111ation on persons - n d e r consideration as potential sources o May 21, 2018, Notice at 2-3. The government acknowledges that such queries generally resulted fi:om "fundamental misunderstandings by some FBI personnel [about] what the standard 'reasonably likely to return foreign intelligence information' means." July 13; 2018, Proposed Tr. at 49. I 61 BIS@llf51!191:i 0Ri!SOH:¥f0ifl8Aff DATE: Oct 8, 2019 - Authorized Public Release Page 69

I 31 i!IE@UISl!iSl!i OR@Off:HOFORff In addition, the government has reported queries of infonnation believed to have been obtained under Title I or V of FISA (not Section 702) that it characterizes as potentially non­ compliant. See Prelim. Notice of Possible Compliance Incident Regarding FBI's Querying of pr. 27, 2018, Notice"). Those Raw FISA-Acquired Infonnation, Apr. 27, 2018 queries were govemeq by a querying standard that requires FBI personnel, "'[t]o the extent reasonably feasible,"' to "'design ... queries to find and extract foreign intelligence information or evidence of a crime."' Id. at l (quoting Standard Minimization Procedures for FBI Electronic Surveillance and Physical Search Conducted Under PISA, May 17, 2016, § lll.D.3.b at 18). The government understands that standard "to mean that the query te1111s must be reasonably likely to return foreign intelligence information,' pril 27, 2018, Notice at 2, which is equivalent to the Section 702 standard for foreign-intelligence queries. Specifically, the government reported that an unspecified FBI unit "conducted what may be considered queries against raw FISA-acquired [metadata] ... using what appear to be identifiers of approximately 57,000 individuals who work (The notice also refers to "queries of the 57,000 identifiers," vice ''individuals." Id.) The date of the queries is not provided, though it is reported that the FBI infon11ed NSD of them on April 13, 2018. Id. As of April 27, the government was examining whether the queries were reasonably likely to return foreign-intelligence infonnation. Id. At the argument on September 28, 2018, cow1sel for the government advised that internal discussions of the adequacy of the justification for those queries were continuing and agreed to update the Court within 60 days. Sept. 28, 2018, Proposed Tr. at 30-31. TQP SFGPET 11SJ 110PCON'NOEAPN DATE: Oct 8, 2019 - Authorized Public Release Page 70

TOP fJECIHJH'/i'fJlh'ORCON,'NOf:ORN The government has also disclosed misapplications of the FBI querying standard that are similar to those described above, except that they involved queries of Section 702 data to return infonnation for just one person: conducted a guery See May 1, 2018, Notice at 2-3. onducted a query on before servmg a classified order on onducted a query on a • On November 11, 2017, the FBI' potential recipient of a FISA order. Apr. 24, 2018, Notice at 2. The government has reported a number of other non-compliant queries of Section 702 infonnation by the FBI, which do not appear to result from comparable misunderstandings of the querying standard. Those include: • A small number of cases in which FBI personnel apparently conducted queries for improper personal reasons - for example, a contract linguist who ran queries on himself: other FBI employees, and relatives. See Jan. 30, 2018, Notice at 1-2. • A number of instances in which FBI personnel inadve1tently ran queries against Section 702 infonnation. See, e.g.• May 8, 2018, Notice ov. 27 2017 Notice • A set of queries (overlapping to some extent with the set of inadve1tent queries nts or material. of Section 702 data) apparently inte1 May 4, See, e.g., May 17, 2018, Notice at 2 2018, Notice at 2 1iQR liiiliiiCIHilif((tiJJ((QPGONNOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 71

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - •or 1!113@!1tlfJ;'.:IQl;l;l8ROQff11QJiQRiltl Those instances of non-compliant queries, in the Comt's view, do not present the same level of concern as those that evidence misw1derstanding of the querying standard. It would be difficult to completely prevent personnel from querying data for personal reasons. As a general rnle, inadvertent queries of Section 702 infonnation and queries intended to retrieve finished intelligence reports or other FBI work product do not seem likely to return raw 702 infonnation or, if they happen to do so, to result in personnel examining U.S.-person infonnation contained therein, the above-described queries regarding notwithstanding. 4. Factors Contributine to the Court's Concerns Of serious concem, however, is the large number of queries evidencin a misunderstanding of the querying standard -- or indifference toward it: queries were conducted against the advice of FBI OGC. That concern is heightened by three factors: (I) limitations on the govemment's oversight mechanisms; (2) the FBI's policy to encourage routine and maximal querying of Section 702 infom1ation; and (3) apparent complications in applying the querying standard. The Court discusses each. a. Limitations on Oversieht As noted above, in 2017 the FBI conducted over three million queries of PISA-acquired See Supplemental FBI Declaration at 6. In infonnation on just one system contrast, during 2017 NSD conducted oversight of approximately 63,000 queries ii 274,000 queries in an FBI system - See Gov't Response at 36. - . I01 Jl!Cltl!:Pn9t;elt@t)N:fff8P8Mi DATE: Oct 8, 2019 - Authorized Public Release nd Page 72 of 138 Page 72 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release _ , IOP SECREI})Si,JURCOl◄JNUl1 - 01<N Personnel from the Office of Intelligence (OJ) within the Depa1tment of Justice's National Security Divsion (NSD) visit about half of the FBI's field offices for oversight purposes in a given year. Id. at 35 & n.42. Moreover, 01 understandably devotes more resources to offices that use FISA authorities more frequently, so those offices are visited annually, id. at 35 n.42, which necessitates that some other offices go for periods of two years or more between oversight visits. The intervals of time between oversight visits at a given location may contribute to lengthy delays in detecting querying violations and reporting them to the FISC. See, e.g., Jan. 18, 2018, Notice ad been conducting improper queries in a training context since 2011, but the practice was not discovered until 2017). When 01 does visit a field office, it reviews queries conducted during a specific interval (�, 90 days) by a subset of the persons with access to FJSA infonnation. See Gov't Response at 35. 01 receives from the FBI a list of queries conducted by the designated persons during the relevant time, which includes the "query tenns, the user who conducted the query, the date and time of the query, the system queried," and in certain cases "infonnation indicating which datasets [were] excluded from the query if the user chose to limit or opt out of certain datasets.» Id. As discussed above, FBI does not keep records of which tenns are U.S.-person query tenns. Neither do FBI personnel cunently memorialize their reasons for believing query terms are reasonably likely to return foreign-intelligence information or evidence of crime. In contrast, the CIA, NSA, and NCTC are all required to provide written statements of why queries using U.S.­ person query tenns are reasonably likely to return foreign�intelligence infonnation. See NCTC - - 'fOf S�@Jt8'f;IJ'81:':'8HOON:'PlOF0R'l DATE: Oct 8, 2019 - Authorized Public Release Page 73 of 138 Page 73 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 'F8P 880RSIJWSl,'f8R60N,')JOFOAl\l Querying Procedures§ IV.B.2 at 4; CIA Querying Procedures§ IV.B.2 at 4; NSA Querying Procedures§ IV.B. l .d at 4. The FBI does not even record whether a query is intended to return foreign-intelligence information or evidence of crime. See July 13, 2018, Proposed Tr. at 14 (DOJ personnel "try to figure out" from FBI query records which queries were run for evidence­ of-crime purposes). DOJ personnel ask the relevant FBI personnel to recall and atiiculate the bases for selected queries. Sometimes the FBI personnel report they cannot remember. See July 9, 2018, Notice. The government contends that "oversight of FBI's queries is substantial and effective," Gov't Response at 35, but 01 personnel review only a small portion of the queries conducted and the documentation available to them lacks basic infonnation that would assist in identifying problematk queries. ln particular, it is apparent that contemporaneous documentation of the bases for queries would facilitate oversight efforts. By way of comparison, the Court understands that the oversight conducted by NSD and the Office of the Director of National Inte))jgence (ODNI) ofNSA's queries makes use of such documentation. See April 26, 2017,. Opinion at 28 n.32 ("DOJ and ODNI review all U.S.-person identifiers approved for [NSA's] use in querying contents of Section 702-acquired communications as wel1 as the written documentation of the foreign intelligence justifications for each such query during bi-monthly compliance reviews."). Given the limitations on the oversight of FBI querying practices, it appears entirely possible that further querying violations involving large numbers of U .S.-person query tenns have escaped the attention of overseers and have not been rep01ied to the Court. - - IGI•:Jb€1'1!JTHJIBeft:CON:1(8ff81Uf DATE: Oct 8, 2019 - Authorized Public Release Page 74 of 138 Page 74 FISC Opinion, Oct; 2018

Document regarding the Section 702 2018 Certification b. ODNI Authorized for Public Release FBI Policy on Queries In addition to articulating the above-described querying standard, the 2016 FBJ Minimization Procedures require FBI personnel, to the extent reasonably feasible, to design queries of Section 702 data to find and extract foreign►intelligence infonnation or evidence of crime. See 2016 FBI Minimization Procedures § III.D at 1 1. They also state it is "a routine and encouraged practice for the FBI to query" 702 infonnation in fm1herance of authorized intelligence and Jaw-enforcement activities, including when "making an initial decision to open an assessment." Id. at 11 n.3. The FISC previously approved FBI minimization procedures containing that statement prior to the disclosure of the above-described querying violations. See November 6, 2015, Opinion at 29 n.27. The FBI Querying Procedures do not contain the quoted language, but the FBl's policy has not changed. See Supplemental FBI Declaration at 6 (FBI uses queries, among other reasons, "to quickly detennine whether a new tip or lead ... warrants opening an investigation, is related to an existing investigation," or requires no further action); id. at 7 ("FBI encourages its perso1mel to make maximal use of queries - provided they are compliant with the FBI's minimization procedures and other applicable law - in order to perfonn their work."). On the one hand, the FBI is obligated to query Section 702 and other FJSA infonnation only in circumstances satisfying a querying standard that does not apply to FBI information generally. On the other hand, it has set up its systems to facilitate running the same query simultaneously across FISA and non-FISA datasets, id. at 5, and encourages personnel to make maximal use of such queries, even at the earliest investigative stages. Those policy decisions - . fOf SELREf})31J}bkCONH◄Ol'0RH DATE: Oct 8, 2019 - Authorized Public Release Page 75 of 138 Page 75 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I OP ~1'.LRP,Tn~moRLOf~?NOPO'.IU~ may well help FBI personnel work efficiently and "'connect dots"' to protect national security, id. at 7, but they also create an environment in which unduly lax applications of the Section 702 querying standard are more likely to occur. Complications in Applyin(: the Queryine Standard c. Delays in reporting some of the querying violations discussed in Part IV.C.3 above suggest that FBJ and NSD personnel charged with applying the querying standard may lack a On May I, 2018, the government first reported to the FISC non­ common understandin that had been examined during compliant queries at t oversight reviews that took place in March 2015 and May 2016, respectively. See May I, 2018, Notice at 2 n.2. The government did not identify them as non-compliant during those reviews; it and did so only upon re-examination in the wake of incident "the government's interpretation of the query provision as reflected in recent compliance notices." May l, 2018, Notice at 2-3. Another instance of delayed notice concerned the non-compliant queries conducted by the uring March 24-27, 2017. FBI OGC and NSD were aware of the proposal to conduct those queries before they were run, and FBI OGC learned they had been conducted on March 29, 2017. See Nov. 22, 2017, Notice at 2-3. The government did not notify the FTSC, however, unti] November 22, 2017. The government attributed that delay of nearly eight months "to the time needed by FBI to gather facts regarding the matter and for the government to detennine whether the queries were consistent with the FBI minimization procedures." Id. at 3 n.6. That sequence of events is similar to the govemment's ongoing assessment of the queriese - - I62I 3£6222211Si!i 52263!!ii!Si Sidi DATE: Oct 8, 2019 - Authorized Public Release Page 76 of 138 Page 76 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release that used approximately 57,000 identifiers for persons In April 2018, the government was examining whether that standard was met Apr. 27, 2018, Notice at 2, and counsel for the government represented at the September 18, 2018, oral argument that discussions of the FBl's justifications for those queries were still ongoing. Sept. 28, 2018, Proposed Tr. at 30. It is reasonable to suspect from the facts available to the Court, including the broad and apparently suspicionless nature of those queries, that the govemment's prolonged deliberations in those matters resulted in part from the lack of a common understanding within FBI and NSD of what it means for a query to be reasonably likely to retum foreign-intelligence infonnation or evidence of crime. The government addressed another set of potentially non-compliant queries at the September 28, 2018, oral argument. Id. at 28-30. compliance problems and filed on February 15, 2018. See Feb. 15, 2018, Notice at 2 n.l. As of that time, the government was "continuing to review whether [certain] queries ofraw-FlSA ... complied with the query standard." Id. Counsel for the datasets government reported at the September 28, 2018, oral argument that such examination had not been completed and agreed to update the Court within 60 days. Sept. 28, 2018, Proposed Tr. at 29-30. - - 'FOP Ei13@1ll!l1WOL':101l@OtUNOf101lPi DATE: Oct 8, 2019 - Authorized Public Release Page 77 of 138 Page77 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification . - - - . - ODNI Authorized for Public Release . - - . - - - - - - - Finally, it appears that the government may interpret the FBI querying standard more leniently than its language fairly conveys. The FBI Querying Procedures state: "Each que1J' ... must be reasonably likely to retrieve foreign intel1igence information ... or evidence of a crime.. . . ," FBI Querying Procedures§ IV.A.1 at 3 (emphasis added), which seems to indicate that each individual query must have an adequate justification. The government nonetheless expresses the view that an aggregation of individual que1ies can satisfy the querying standard, even if each individual que1y in isolation would not be reasonably likely to return foreign-intelligence infonnation or evidence of c1ime. Specifically, the government describes a situation in which "threat infonnation" indicates "that there is an employee at a cleared defense contractor who has access to certain technology" and plans to sell i See September 18, 20e18, Memorandum at 22 n.20. If 100 employees of the contractor are known to have access to that technology, the "government assesses that the FBI could run a categorical query of the identifiers associated with these 100 employees as there is a reasonable basis to assess that the queries would return foreign intelligence informatiort of evidence of a crime." Id. By no stretch oflanguage could one say that an individual query for a randomly selected one of those 100 employees would be reasonably likely to return foreign-intelligence infonnation or evidence of crime. The government's assessment that it nonetheless would be pennissible to que1y using the identifiers of all 100 employees must rest on the idea that, if those identifiers are aggregated and run together in ostensibly a single query, there would be a reasonable likelihood that foreign-intelligence infonnation or evidence of crime would be returned. Perhaps in the abstract it would be reasonable for the FBJ to run such an aggregated query, but it is by no means ,.or 9ECfte'f1'ffll,'fORCOf�{NOFORM DATE: Oct 8, 2019 - Authorized Public Release Page 78 of 138 Page 78 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - Tel t,f:Cllf:TMHnOltCONINOfi'Oft'N obvious how such justification-by-aggregation would be consistent with the requirement that "[e]ach query" must be reasonably likely to retum foreign-intelligence infonnation or evidence of cnme. See FBI Querying Procedures § IV.A.1 at 3. 5. The Government's Response to the Non-Compliant Queries The govemment has taken steps in response to the FBT's non-compliance with the querying standard. It reports that it now emphasizes issues related to categorical query justifications in training, see Gov't Response at 38, and has promulgated within the FBI detailed guidance on querying requirements, which also focused on categorical justifications for queries. See id.; July 13, 2018, Proposed Tr. at 50. That guidance recommended consultation with FBI lawyers regarding queries based on a "categoiical reason," rather than an "individual reason for each identifier." Ju]y 13, 20 I 8, Proposed Tr. at 50. As part of the amended procedures submitted on September 18, 2018, the government has added to the FBI Querying Procedures a requirement in certain circumstances to consult with an FBI attorney regarding queries supported by categorical justifications. That provision, which apparently fonnalizes a version of the above-noted recommendation, states: Prior to reviewing the unminimzed content of section 702-acquired infonnation retrieved using a categorical batch que,y (as opposed to queries conducted 011 the basis ofindividualized assessments), FBI personnel will obtain approva] from an attorney from either their Chief Division Counsel's Office or the National Security and Cyber Law Branch. This requirement does not apply if the persons whose identifiers are queried are (l) targets of lawful coJlection, (2) subjects of predicated investigations, or (3) in contact with targets oflawful collection or subjects of predicated investigation. Approvals to review the content returned by such queries will include a justification for the queries, the approving official, and the duration of such approval. FBI Querying Procedures § IV.A.3 at 4 (emphasis added). - r r o o f:'PCDRT/(£1/IODCO'Dt,J0\I OPOPJ\._ DATE: Oct 8, 2019 - Authorized Public Release Page 79 of 138 Page 79 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release "Per 81!9t.!ft:@'P;';'.�l,rOftCON,'f(OFORN The govemment apparently promulgated the enhanced guidance in June 2018. See Gov't Response at 38 (guidance "expected to be provided to appropriate FBI personnel in June 2018"). There accordingly has been insufficient time to assess its effect. As to Section IV.A.3, the requirement to consult with an attorney applies in narrow circumstances: after a categorical batch query has been conducted and prior to FBI personnel's reviewing content infonnation returned by the query, unless one of three exceptions applies. The government explains that the provision is "tailored to focus on a particular type of query that potentially presents greater compliance risk and piivacy impact" - those "based on a categorical, rather than individualized, justification." See September 18, 2018, Memorandum at 21. At the oral argument on September 18, 2018, counsel for the government stated that querying to retrieve information regarding as few as two persons, based on a common justification, would be regarded as a categorical batch query for purposes of§ IV.A.3. Sept. 28, 2018, Proposed Tr. at 24, 26. 6. Analysis The Court finds that the FBI's Section 702 minimization procedures, as they have been implemented, are not consistent with the requirements of Section 1801 (h)(]) and (h)(3), or the Fourth Amendment. a. Statutoi·y Deficiency As noted above, minimization procedures must be reasonably designed in light of the purpose and technique of the particular surveillance, to minimize ... the retention, and prohibit the dissemination, of nonpublicly available infonnation concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information. - x o n PFCDJ?T//C:1//0P COJ\1/NOPOP?!t" DATE: Oct 8, 2019 - Authorized Public Release Page 80 of 138 Page 80 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'fOf 9ElCltEl'fh'91//8ltCOP~'f,OFOftN § 180 I (h)( I). In this case, the "purpose and technique" of Section 702 collection involvese targeting non-U.S. persons reasonably believed to be located outside the United States to obtain foreign-intelligence information with the assistance of communications service providers. See § 702(a), (b)(3), (i)(l ). Those acquisitions include the contents of communications to or from non-target U.S. persons. Queries that are in fact reasonably likely to return foreign-intelligence infonnation are responsive the government's need to obtain and produce foreign-intelligence information, and ultimately to disseminate such information when warranted. For that reason, queries that comply with the que1ying standard comport with § 1801 (h), even insofar as they result in the examination of the contents of private commw1ications to or from U.S. persons. On the other hand, queries that lack a sufficient basis are not reasonably related to foreign­ intelligence needs and any resulting intrusion on U.S. persons' privacy lacks any justification recognized by§ 1801 (h)(l). Because the FBI procedures, as implemented, have involved a large number of unjustified queries conducted to retrieve infonnation about U.S. persons, they are not reasonably designed, in light of the pu1pose and technique of Section 702 acquisitions, to minimize the retention and prohibit the dissemination of private U.S. person infonnation. With regard to evidence-of-crime queries, the FISC has previously found that by providing for minimization procedures that pennit the retention and dissemination of evidence of crime for law-enforcement purposes, Section 180 I (h)(3) fairly contemplates queries reasonably designed to retum evidence of crime. See November 6, 2015, Opinion at 32-33. The issue in this case, however, is the prevalence of FBI queries that were unlikely to return evidence of crime (even though they may have been subjectively intended to do so). The govenunent has not TOP SGCRKT/+Sl.lstQRCON.CNOf0RN DATE: Oct 8, 2019 - Authorized Public Release Page 81 of 138 Page 81 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release argued that Section 180l(h)(3) pennits such queries, and the Court declines to adopt such a conclusion. The Court also has considered carefully whether the recently improved guidance and training referenced by the government adequately addresses the problems with the FBl's querying practices such that the Court should find that the FBl's querying and minimization procedures, as amended, comport with § 180 l (h). It has concluded that, while the government has taken constructive steps, they do not adequately justify such a finding. First, as discussed above in Part IV.C.2, many, though not all, recent misapplications of the querying standard by the FBJ involved categorical batch queries. More significantly, the Court is doubtful that in practice FBI personnel will consistently channel categorical batch queries into § JV.A.3's approval process before they examine content info1111ation retrieved by those queries. As stated in § IV .A.3, a query conducted on the basis of an individualized assessment is not a categorical batch query. hnplementation of§ JV.A.3 will depend on the ability of the FBI's front�Jine personnel to detem1ine which queties are supported by individua1ized assessments, and therefore not subject to the approval requirement of§ IV.A.3, and which rely on categorical justifications and are subject to the approval requirement. Given the documented misunderstandings of the querying standard among FBI personnel, the government's reliance on them to make those distinctions seems misplaced. Indeed, the personnel most in need of guidance from an attorney may not receive it because they have difficulty in dete1111ining when they are supposed to consult with one. - - FfOP 8J.§@llJ.§GF;%101;1;'.OM!OOftl:'fl0Fi!lWl DATE: Oct 8, 2019 - Authorized Public Release Page 82 of 138 Page 82 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release T(JI "~cn,wsti'/6RC ONiNOPORN Finally, the broad exceptions to Section IV.A.3's approval requirement are also of concem. Most notably, one of those exceptions applies if the persons whose identifiers are queried are "in contact with targets of lawful collection or subjects of predicated investigations." §aIV.A.3. There are two levels of FBI predicated investigations: full and preliminary. See Att'ya General Guidelines for Domestic FBI Operations§ II.B.4 at 21, Sept. 29, 2008. The FBI may initiate a full investigation "if there is an articulable factual basis for the investigation that reasonably indicates" that, for example: a.aAn activity constituting a federal crime or a threat to the national security has or may have occurred, is or may be occurring, or will or may occur and thea investigation may obtain infonnation relating to the activity or the involvement ora role of an individual, group, or organization in such activity[; or]a b.aAn individual, group, organization, entity, information, property, or activity is or may be a target of attack, victimization, acquisition, infiltration, or recruitmenta in connection with criminal activity in violation of federal law or a threat to thea national security and the investigation may obtain information that would help toa protect against such activity or threat.a Id. at§§ 11.B.3, ll.B.4.b.i at 21-22 (emphasis added). The FBI may open a preliminary investigation with even less of a factual predicate: "on the basis of h�formation or an allegation indicating the existence of a circumstance" described in paragraph a. orb. above. Id.§ II.B.4.a.i at 21 (emphasis added). A query using identifiers for persons known to have had contact with any subject of a full or preliminary investigation would not require attomey approval under § IV.A.3, regardless of the factual basis for opening the investigation or how it has progresseda since then. liili'fiU? Al?Ailll?'lil 'fAI 'fADCAllUUDFOQ l> DATE: Oct 8, 2019 - Authorized Public Release Page 83 of 138 Page 83 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release T 0 f .@Jl3 01lllT,';l(JIN0 no OHJ JO 13 0 Rf l b. Fourth Amendment Deficiency Applying the totality-of-circumstances analysis the FlSC employed in previous Section 702 proceedings, the Court finds that the FBI Minimization Procedures and Querying Procedures are similarly unreasonable under the Fourth Amendment. (i) Applicable Fourth Amendment Framework The Fourth Amendment states: The light of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, sha11 not be violated, and no Wan-ants shall issue, but upon probable cause, supported by Oatl1 or affinnation, and particularly describing the place to be searched, and the persons or things to be seized. U.S. Const. amend. IV. "The touchstone ofthe Fourth Amendment is reasonableness." In re Certified Question of Law, 858 F.3d 591,604 (PISA Ct. Rev. 2016) (per curiam) ("In re Certified Question"). Although "[t]he wa1rnnt requirement is genera11y a tolerable proxy for 'reasonableness' when the govemment is seeking to unearth evidence of criminal wrongdoing> ... it fails properly to balance the interests at stake when the government is instead seeking to preserve and protect the nation's security from foreign threat." Id. at 593. Accordingly, a warrant is not required to conduct surveillance "to obtain foreign intelligence for national security purposes ... directed against foreign powers or agents of foreign powers reasonably believed to be located outside the United States." See In re Directives Pursuant to Section 105B ofFISA, 551 F.3d 1004, 1012 (FISA Ct. Rev. 2008) ("In re Directives"). The FISC has repeatedly reached the same conclusion - I IStt@Cllli:SL 5121 161 SE@flbi!lblll DATE: Oct 8, 2019 - Authorized Public Release Page 84 of 138 Page 84 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'f8P SECftE1ifY/St,1#8RCONs'l'4OFOftN regarding Section 702 acquisitions. See, e.g., November 6, 2015, Opinion at 36�37; September 4, 2008 Opinion at 34-36. In assessing the reasonableness of a governmental intrusion under the Fomth Amendment, a court must "balance the interests at stake" under the "totality of the circumstances." In re Directives, 551 F.3d at 1 OJ 2. In prior reviews of Section 702 procedures, the FISC has assessed the reasonableness of the government's procedures as a whole, rather than separately analyzing the reasonableness of discrete fmms of action taken thereunder, such as querying. See, e.�.. November 6, 2015, Opinion at 39 (assessing ''the combined effect" of the targeting and minimization procedures ). Amici, however, argue that the Court should regard querying as a separate Fourth Amendment event subject to its own reasonableness analysis. See Amici Brief at 57-59. First, they contend that the Reauthorization Act mandates that the querying procedures be constitutional in their own right. Id. at 48 ("Section I 01 requires the Attorney General, in consultation with the DNI, to establish Querying Procedures relating to 702-acquired infonnation that comport with the Fourth Amendment" and citing § 702(f)). Amici also point to Section 702(f)(2), which requires the FBI, in specified narrow circumstances, to obtain a FISC order before examining content information retrieved by querying Section 702 data, as mandating a change to the Court's analysis. � id. Amici argue that by enacting that requirement "Congress has acknowledged the reality that FBI agents querying databases containing raw 702 infonnation for a variety of purposes are, in effect, undertaking new 'searches,' some of which now require a court order." Amici Brief at 56-57. �OP 0@CIU,�'{0lh'ORCJON{l\l8F8ftfJ DATE: Oct 8, 2019 - Authorized Public Release Page 85 of 138 Page 85 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - •ifOP QIU.iRBif;f:161#QftOOfl '.JfQfCDll Amici also argue that reviewing querying as an independent Fourth Amendment event would be in line with evolving case law. See id. at 57 (citing Riley v. California, 134 S.Ct. 2473, 2493 (2014), as "requiring law enforcement to obtain a warrant before searching a cell phone lawful1y seized incident to arrest"); see also id. at 58 (citing Walter v. United States, 447 U.S. 649, 654 (1980), United States v. Mulder, 808 F.2d 1346 (9th Cir. 1987), United States v. Bowman, 215 F.3d 951 (9th Cir. 2001) and United States v. Runyan, 275 F.3d 449,461 (5th Cir. 2001 ), for the proposition that "even if law enforcement comes into possession of an object lawfully because it has been seized or searched by a private party, subsequent actions taken by law enforcement to inspect or review the object's contents constitute separate events for purposes of the Fourth Amendment"). Amici also point to the recent holding in Carpenter v. United States. 138 S.Ct. 2206 (2018), for further support. See July 13, 2018, Proposed Tr. at 37. They analogize (1) a cellular-phone provider's collection of cell-site location infom1ation (CSU) to the govemment's acquisition of Section 702 infonnation, and (2) the provider's subsequent compiling and production to the govemment of CSU revealing the location of a particular suspect over time to the FBI' s subsequent querying of Section 702 information for a particular U.S. person. Based on those analogies, they contend that the Supreme Court's holding in Ca1:penter that the governmenfs obtaining and accessing CSU info1mation involved a search under the Fourth Amendment has implications for whether querying Section 702 data might also be a Fourth Amendment search. See id. The Court has considered these authorities and declines to find that they require that querying of infonnation lawfully acquired under Section 702 be considered a distinct Fourth -wniR '11i'AIUl:i1? 116iilJ IIAAC(iUJ'])IQli'QAll DATE: Oct 8, 2019 - Authorized Public Release Page 86 of 138 Page 86 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release [)ijtp iii liMl'fI'ii'fQftOOtl'lUQifQPN Amendment event requiring a reasonableness detennination independent of the other circumstances of acquisition. With regard to the Reauthorization Act, the provisions cited by amici reflect congressional views on the reasonableness of ce1tai11 querying practices and strongly suggest congressional recognition that Fourth Amendment concerns are implicated by the querying of Section 702 info1mation. Their effect, however, is to expand statutory protections, not the scope of what constitutes an independent search under the Fourth Amendment. The Court also declines to find that the case law cited by amici mandate that queries of Section 702 infmmation be considered distinct Fourth Amendment events. Three of the cases involved prope1ty voluntarily provided to law enforcement by a third party and subsequent law­ enforcement searches that exceeded the scope of the p1ior examination by that third party. See Walter, 447 U.S. at 654-57 (finding that FBI's screening of fihns that had been contained in shipment mistakenly sent to and opened by third party violated Fourth Amendment); Runyan, 275 F.3d at 464 (finding that police examination of compact disks that had not been viewed by third patty who turned them over violated Fourth Amendment); Bowman, 215 U.S. at 963 (government conceded that viewing of film contained in footlocker provided by third party exceeded third party's prior examination). In Mulder, the court found that toxicology lab tests of tablets, which a hotel employee had turned over to law enforcement, exceeded the scope of the "field test" exception to the warrant requirement. Mulder, 808 F.2d at 1348-49 (citing United States v. Jacobsen, 466 U.S. 109, 123 (1984)). None of these cases is instructive regarding circumstances like those present in this case, which involve the government's examination of - - IOII SE@llbliteJIIOROOfUIOPONf DATE: Oct 8, 2019 - Authorized Public Release Page 87 of 138 Page 87 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 5Ji8P 0OOllfi1WOl,~'8ftCJ8M'N8FOlliii information lawfully acquired under a statutory framework that requires a judicial detennination that the totality of attendant circumstances, including the govemment's acquisition, retention, use, and dissemination of such information, is reasonable under the Fourth Amendment. In any event, the Court arrives at the same conclusions as amici, albeit under a totality-of­ circumstances analysis: the FBI's procedures are unreasonable under the Fourth Amendment and the amici's proposal to require the FBI to document the basis for its queries in certain additional circumstances,� Part IV.C.7 below, would cure that deficiency. (ii) Reasonableness Under the Totality of Circumstances Under the totality-of-circumstances approach, a court must balance "'the degree to which [governmental action] intrudes upon an individual's privacy'" against "'the degree to which it is needed for the promotion of legitimate governmental interests.'" In re Certified Question, 858 F.3d at 604-05 (quoting Wyoming v. Houghton, 526 U.S. 295,300 (1999)). "The moree important the government's interest, the greater the intrusion that may be constitutionally tolerated." In re Directives, 551 F.3d at 1012. If the protections that are in place for individual privacy interests are sufficient in light of the governmental interest at stake, the constitutional scales wi11 tilt in favor of upholding the government's actions. If, however, those protections are insujficienJ. to alleviate the risks o.fgovernment error and abuse, the scales will tip toward a finding of unconstitutionality. Id. (emphasis added). The Cout1 regards the privacy interests at stake as substantial. As described above in Part IV.C.3, the FBI has conducted tens of thousands of unjustified queries of Section 702 data. Based on the infonnation available - e.g., queries for TAP SFCPPZ?ff?J ffARGOIJ llJAFOPI DATE: Oct 8, 2019 - Authorized Public Release Page 88 of 138 and for Page 88 FISC Opinion, Oct. 2018

- - I '.JJQP .,1Hs\1Us1W�l,'£QRG0��0:60.IUI I l ■ I I I I I I I I persons with access to FBI facilities - it appears that many subjects of those queries were U.S. persons. Beyond that, it is difficult on the record before the Court to assess to what extent U.S.­ person infonnation was returned ru1d examined as a result of those queries. At a minimum, however, the reported querying practices present a serious risk of unwarranted intrusion into the private communications of a large number of U.S. persons. The Court believes that serious risk weighs substantially in the assessment of reasonableness. The goal of the Fourth Amendment is to protect individuals from arbitrary governmental intrnsions on their privacy. See Camenter, 138 S. Ct. at 2213 ( "' basic purpose"' of the Fourth Amendment "'is to safeguard the privacy and security of individuals against arbitrary invasions by governmental officials'") (quoting Camara v. Municipal Court of City and County of San Francisco, 387 U.S. 523,528 (1967)). The FBI's use of unjustified queries squarely implicates that purpose: the FBI searched for, ru1d presumably examined when found, private communications of particular U.S. persons on arbitrary grounds Part IV.C.3 above. The government is not at liberty to do whatever it wishes with those U.S.-person communications, notwithstanding that they are "incidental collections occurring as a result of' authorized acquisitions. In re Directives, 551 F.3d at 1015. The FISCR in In re Directives relied on the governmenfs assurance "that it does not maintain a database of incidentally collected infonnation from non-targeted United States persons" when it held on the facts of that case that "incidentally collected communications of non-targeted United States persons do not violate the 5Jil8P BE ODOFJill%'81XODOON:'JJOf301lJJ DATE: Oct 8, 2019 - Authorized Public Release Page 89

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - •or 81!@1\l!T;:'OlhOR@Ofl:1i8F8RP1 Fou11h Amendment." Id. ln this matter, while the FBI may not maintain a separate database of U.S.-person communications acquired under Section 702, it routinely queries raw Section 702e data in order to identify and examine communications of pa1ticular U.S. persons. Whether those querying practices adequately protect the privacy of those U.S. persons, or instead unjustifiably invade U.S. persons' privacy, bears on the analysis of reasonableness under the Fomth Amendment. See In re Certified Question, 858 F.3d at 609 (examining intra-FBI restrictions on access to information acquired pursuant to a FISA pen register/trap-and-trace authorization as part of assessment of Fou1th Amendment reasonableness). Under the totality-of-circumstances framework, the Court must take into account protections afforded by other provisions of the government's procedures and assess whether their combined effect is reasonable under the Fourth Amendment. Those protections include requirements in the targeting procedures that "direct the govemment's acquisitions toward communications that are likely to yield foreign intelligence information" and "substantial restrictions on the use and dissemination of infonnation derived from queries.>' November 6, 2015, Opinion at 41-42. Compliance with those provisions mitigates the intrusion on U.S. persons' privacy resulting from unjustified queries, either by limiting the scope of infom1ation acquired and therefore subject to querying or limiting the further use or disclosure of U.S.-person infonnation retumed by queries. The Court nonetheless views as substantial the intrusion on U.S. persons' privacy inherent in FBI personnel's examination of infonnation- especially content information - returned by unjustified U.S.-person queries. 'fOP 91!lCHlffh'91f>'ORCONi'fl�0FO�� DATE: Oct 8, 2019 - Authorized Public Release Page 90 of 138 Page90 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - liQR 61iC:AJi1i((fiiif110:ACON NOEOPN On the other side of the balance, it must be acknowledged that acquiring "forei!,'11 intelligence with an eye toward safeguarding the nation's security serves ... a particularly intense interest." In re Certified Question, 858 F.3d at 606 (internal quotation marks omitted). For that reason, the FISCR has observed that "the government's investigative interest in cases arising under FISA is at the highest level and weighs heavily in the constitutional balancing process." Id. at 608. The Court must also consider, however, the degree to which the governmental action in question is needed for the promotion of the relevant governmental interest. Id. at 605. Here, the relevant governmental action is the FBl's continuing to run queries without taking further measures to ensure they actually satisfy the querying standard FBl personnel are supposed to apply. Whether the balance of interests ultimately tips in favor of finding the procedures to be inconsistent with the Fourth Amendment is a close question. Reasonableness under the Fourth Amendment does not require perfection. See In Re Directives, 551 F.3d at J 015 ("the fact that there is some potential for en·or is not a sufficient reason to invalidate" surveillances as unreasonable under the Fourth Amendment). Nonetheless, if "the protections that are in place for individual privacy interests are ... insufficient to alleviate the risks of government error and abuse, the scales will tip toward a finding of unconstitutionality." kl at 1012. Here, there are demonstrated risks of serious error and abuse, and the Court has found the govenunent's procedures do not sufficiently guard against that risk, for reasons explained above in the discussion of statutory minimization requirements. - w o » QDCDPT((OJ((OD COIJ0JOPODne:- - DATE: Oct 8, 2019 - Authorized Public Release Page 91 of 138 Page 91 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release Finally, for reasons explained below, the government has not made a persuasive case that the documentation requirement proposed by amici, which would provide a fw1her check against unjustified intrusions on the privacy of U.S. persons and should also enhance oversight of FBI quelies, would impede the FBI's ability to respond to national-security threats. On the current record and subject to future oversight of the FBJ's querying practices, the Court believes that its adoption would remedy the statutory and Fourth Amendment deficiencies discussed above. TI1e Court accordingly finds that the FBJ's querying procedures and minimization procedures are not consistent with the requirements of the Fourth Amendment. 7.e Amici's Documentation Proposal as a Remedy The government offers§ IV.A.3 in part as an alternative to a proposal made by amici. See September l 8, 2018, Memorandum at 21. Amici propose that FBI personnel be required to document in writing their bases for believing that queries of Section 702 data using U.S.-person query tenns were reasonably likely to return foreign-intelligence infonnation or evidence of crime before they examine content infonnation returned by such queries. See Amici Brief at 69, 72. (Amici alternatively discussed a more far-reaching requirement to document the basis for queries before they are conducted, see July 13, 2018, Proposed Tr. at 34, but stated at the September 28, 2018, argument that the above-described option would be adequate. The FISC declined to adopt a pre-querying documentation requirement in a prior Section 702 proceeding, see November 6, 2015, Opinion at 39-41, though the record in that case did not reflect similar problems with the FBI's querying practices.) -ffOf s@eR�'fih01#8RCONs 1'�OF8Wl1 DATE: Oct 8, 2019 - Authorized Public Release Page 92 of 138 1 Page 92 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'FOP SFJCRl!l'Fh'Sln'ORCOl'Hl'J0FOAl>I Like§ IV.A.3, the documentation requirement proposed by amici would apply only when a query has returned Section 702-acquired content infonnation that FBI perso1mel wish to examine. The amici proposal is further limited to U.S.-person queries. Because of those limitations, it applies only to the subset of queries that are particularly likely to result in significant intrusion into U.S. persons' piivacy. In contrast to§ IV.A.3, the documentation requirement proposed by amici would impose a less onerous requirement on FBI personnel who wish to examine such contents (written memorialization of the basis for the query vs. attorney approval), but in a larger number of cases (U.S.-person queries vs. categorical batch queries). In the Court's assessment, the documentation requirement proposed by amici would facilitate oversight of queries likely to have intruded on U.S. persons' privacy interests by providing contemporaneous documentation of why FBI personnel believed the querying standard was satisfied. The requirement to create that documentation would also help ensure that FBI perso1mel, in fact, have thought about the querying standard and articulated why they believe it has been met. By so doing, it would prompt FBI personnel - much more frequently than the attorney-approval process under § IV .A.3 to recall and apply the guidance and training they have received on the querying standard. Over time and with review by oversight personnel, those written statements may also suggest how to improve that guidance and training, or even the fonnulation of the standard in the querying procedures. The government, however, objects that such a requirement would not be effective and would unduly burden and hinder the FBI's work. Regarding effectiveness, the government contends that such a documentation requirement would not have prevented the most serious - �OP 8:ECRBT,¥Sl,¥8ROON�J9F91ltJ DATE: Oct 8, 2019 - Authorized Public Release Page 93 of 138 Page93 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release repo1ted instan 1-compliance, such as the queries performed at for persons witl July 13, 2018, Proposed Tr. at 12. In the government's estimation, the relevant personnel in those cases mistakenly but genuinely thought they had a sufficient basis for the queries, so they would have docwnented that basis and proceeded to examine the content infonnation retrieved. See Gov't Response at 36-37; July 13, 2018, Proposed Tr. at 9-10. The Court has not heard from the personnel who conducted those non-compliant queries and is not well positioned to assess what courses of action they would have taken if they had been obligated to state in writing why they thought the queries were justified. But it accords with common sense and experience that some persons in comparable circumstances may, as amici suggest, realize their queries "could not be justified" when they are required to a1ticulate the justification. See Amici Brief at 54. The government further objects that requiring a written justification to examine the contents provided in response to U.S.-person queries of Section 702 infonnation "would substantially hinder the FBI's ability to investigate and protect against threats to national security." Supplemental FBI Declaration at 17. Different fo1ms of hindrance are claimed. First, the government identifies burdens and potential enor costs associated with identifying which tenns are U.S.-person query tenns. Jd. at 15; July 13, 2018, Proposed Tr. at 13, 15. But those are the same burdens and costs anticipated by the government with regard to the statutory obligation to keep records that differentiate U.S.-person query tem1s from other tenns. See Part IV.B.2.c above. If for some reason, moreover, FBJ personnel are in doubt about -xon SFCPJ?T//SJ((OPCO}]/:O,J OFOPJ>l DATE: Oct 8, 2019 - Authorized Public Release Page 94 of 138 Page 94 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - • I01 BEERE)))5fllUICCOl4:U8P8MI ■ whether a particular query used a U.S.-person que1y tenn, they can always choose to document the justification for the query rather than try to resolve that doubt. The government also assesses that "there is a substantial likelihood" that the impact on the FBI's "resources and operations'' of amici's documentation proposal "would be significant." Supplemental FBI Declaration at 16. The government is not, however, able to quantify that impact. Id. at 15-16. For example, given the above-described FBI recordkeeping practices, it cannot say how often the FBI conducts U.S.-person queries, nor can it state how often queries return content information acquired under Section 702, id. at 6 n.3, or how often FBI personnel review PISA infonnation returned in response to a query. Id. at 15-16. The government does acknowledge, however, that a U.S.-person query of Section 702 infonnation may not return any such inforn1ation, and even if it does, the FBI may not review it. See Gov't Response at 35 n.41. In either of those situations, the documentation requirement would not apply. The government nonetheless contends that "a requirement that FBl must include a written justification prior to reviewing any section 702-acquired results that are returned using a U.S. person query term would ... hinder the FBI's ability to perfom1 its national security and public safety missions." Supplemental FBI Declaration at 15 (emphasis added). But the burden associated with documenting the basis for any pa1ticular query should be minimal. FBI personnel must detennine that every query they conduct is reasonably likely to return foreign­ intelligence information or evidence of a crime before they run it. See Gov't Response at 33-34 ("The lack of a requirement for written documentation of the query justification does not mean that FBI personnel are not required to have a justification for each query" and they are "required - - 'JOP 66 '91Ut'J./ 'ii''QRCQN 'l>1QEQRN DATE: Oct 8, 2019 - Authorized Public Release Page 95 of 138 Page 95 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release T8P 91BCRl!~'J'91:'f8RCOPVNOfiOllN to have a justification for each query of raw PISA-acquired infonnation, as each query has to meet the substantive query standard ...."). For that reason, memorializing the basis for a query should involve no additional research or analysis. Nor should composing the written statement be time consuming. The Court contemplates a bdef statement of the query justification - in many cases it should suffice to succinctly complete a sentence that starts "This query is reasonably likely to return foreign-intelligence infonnation [or evidence of crime] because ...." At the heart of the government's objections to the documentation requirement proposed by amici is an understandable desire to ensure that FBI personnel can perform their work with the utmost efficiency and "connect dots" in an effort to protect the national security. Given the lessons learned fol1owing 9/11 and the Fort Hood shooting, as well as the FBI's significant reliance on queries to effectively and efficiently identify threat streams in its holdings, the FBI is extremely concerned about anything that would impede, delay, or create a disincentive to querying FBI databases. Supplemental FBI Declaration at 7 (emphasis added). But amici's documentation proposal would in no way affect the FBI's ability to query its databases. Only if a U.S.-person query returns Section 702 content infonnation and the FBI decides to review that infonnation is the documentation requirement triggered. Non-content metadata, which may help the FBI "connect the dots," will be immediately available without having to document the basis for a query. And FBI personnel could dispense with the otherwise-required documentation if needed to protect against an immediate threat to human life. See FBI Querying Procedures§ II at 1. The Court regards amici's documentation proposal as a measured and reasonable response to the statutory and Fourth Amendment deficiencies it has found in the FBI's implementation of its querying standard. The Court believes that adopting and implementing - Ff?OP 0O@RO'IW0f;l;l8:RO9N,'Jl9f181Ul DATE: Oct 8, 2019 - Authorized Public Release Page 96 of 138 - Page 96 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - :POP f!IIH.iltB:P;f:!il#8ft00fl/UQFQBfl that proposal, in combination with the other protections of the FBI Querying Procedures and FBI Minimization Procedures, would satisfy the definition of "minimization procedures" at § 1801 (h) and render those procedures consistent with the requirements of the Fout1h Amendment. Indeed, while other modifications to the procedures could have the same effect, it is difficult to conceive of their doing so while imposing so modest a burden on the FBI's work. D. Exemptions in the Minimization and Queryine Procedures The minimization and querying procedures proposed by the government contain several exemptions for activities relating to oversight and training, as well as activities responsive to congressional mandates. Although the Cou1t assessed that the oversight and training exemptions included in the March 27, 2018, Submission were unreasonably broad, it concludes that the revised exemptions in the September 18, 2018, Submission comport with the statutory requirements and the Fourth Amendment. 1. Exemptions for Oversight Activities One broad category of exemptions proposed by the govenunent in March 20 J 8 concerned oversight activities conducted by independent executive-branch entities or the agencies themselves. The first type of exemption, which is not new, addresses oversight conducted by independent executive-branch entities. This exemption is included in each of the four sets of minimization procedures. For example, Section I ofNSA's proposed minimization procedures provides: "Nothing in these procedures shall restrict the lawful oversight functions of [NSD, ODNI] or the applicable Offices of the blspectors General, or the provision by NSA of the - - TOP OH@R<81Ji{J10f;%'O1tOON:IJ.fOFOWf DATE: Oct 8, 2019 - Authorized Public Release Page 97 of 138 Page 97 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - Ie, "l!!elll!JIIIJJ!Hn 81tCOU:1ft'JF8Mf - assistance necessary for these entities to perform their lawful oversight functions." March 27, 2018, NSA Minimization Procedures§ 1 at I; see also March 27, 2018, FBI Minimization Procedures§ I.G at 4; March 27, 2018, CIA Minimization Procedures§ 6.f at 4; March 27, 2018, NCTCMinimization Procedures § 6.e at 4. The initially proposed querying procedures contained a similar provision, see March 27, 2018, Querying Procedures § lI eI at 1, which is canied forward in the amended que1ying procedures for each agency submitted in September 2018. See FBI Que1ying Procedures§ IV.Cat 5; NSA Querying Procedures§ IV.Cat 5; CIA Querying Procedures§ JV.Cat 4; and NCTCQuerying Procedures§ JV.Cat 4. The second type of exemption - for oversight conducted by the agencies themselves was quite broad as initially proposed by the government. For example, the exemption initially proposed for FBI provided: • . • • • [N]Shing in these p1WCNures • • I shall restrict the FI• I's :,eria • •nnan~. If lawful llversight functions llf' its per~ ne] or systems, which includes activities perfonned: in sup)91 I• f Fi• l' s investigatisi and remediatial of a Jlllll,sible • •• 11 af <anpliance incident; in sup~ • F•• I' s •' •lication of the •• estructi re uirements in these minimizati roc~. ures· in su t of • • '. • . • • . •.. . ,. • and in support of FBI Inspection 1v1s1on audits. March 27, 2018, FBI Minimization Procedures§ l.H at 4. The minimization procedures proposed for the other three agencies contained similar exemptions. See March 27, 2018, NSA Minimization Procedures§ I at 2; March 27, 2018, CIA Minimization Procedures§ 6.h at 5; March 27, 2018, NCTCMinimization Procedures§ 6.g at 4. Amici challenged the breadth of these proposed exemptions as insufficiently defined,� Amici Brief at 63-67, 82-84, and asserted the exemptions al]ow any deviation from otherwise� - IOf I SELKEI))SfobRCOl◄Ji◄Ottbkt< DATE: Oct 8, 2019 - Authorized Public Release Page 98 of 138 Page 98 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - Ibl■SJ1CREJ))§D,UICC614)f46£ Oitit applicable restrictions "no matter how disproportionate the Government's purpose may be to the deviation," Amici Reply at 13, and "do not aim for a reasonable balance between the Govemment's interest in perforn1ing ... oversight, on the one hand, and the p1ivacy interest of U.S. persons affected by deviations from the procedures on the other ...." Id. at 13-14. ln support of the lawful-oversight exemption, the government emphasized that the exemption fm1hers its interest in ensuring that the Section 702 procedures are co1Tectly implemented, which should increase protection of U.S. persons' p1ivacy. See Gov't Response at 21 (asserting "a strong government interest in supervising personnel to mitigate the risk of•· non-compliance by government employees accessing raw section 702 infonnation"); id. at 43 (the exemption "permits the government to engage in essential oversight activities that in fact promote the privacy interests of U.S. persons"). The government also contended that the proposed exemption provided greater specificity without expanding the scope of exempted conduct as previously approved by the FlSC. See Gov't Response at 42-43. The Cou11 did not accept the govemment's premise that the proposed modifications resulted in exemptions that were no broader than those previously approved. Although similar language did appear in previously approved minimization procedures, the govenunent did not disclose, nor did the Court recognize, how broadly the government understood "lawful oversight functions" until June 2017. In an attempt to mitigate the scope of the minimization violations raised by the FBI's retention of umninimized Section 702-acquired infom1ation in repositories containin lassified email and instant messages (see Part IV.E.2 below), the government articulated a view of"lawful oversight functions" that spanned a wide range of - - WOPHJUi11UiTf!lilUORCOtI0JOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 99 of 138 Page99 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 1 'Ji18P SJ3CIU3ifW81,'f8ROONfl410F81lN disparate functions, such as overseeing compliance with federal records-management requirements, identifying executive-level email messages subject to an archiving requirement imposed by the National Archives and Records Administration, and conducting See Report Regarding Retention of Raw FISA-Acquired Jnfonnation in Certain FBI Special Purpose Systems, June 16, 2017, at 4-5, 10-12. The Court, moreover, agreed with amici regarding the unjustified breadth and lack of specificity of the lawful-oversight exemption initially proposed by the government. In response to those concerns, the government significantly modified the proposed exemption. In the modified procedures submitted on September 18, 20 I 8, it described more particularly the types of activity conducted by each agency that constitute lawful-oversight functions. For example, the FBJ's modified procedures identify the following types of activity as lawful-oversight functions: (1) review of Section 702-acquired infonnation the FBI detennines is necessary to remediate a potential spill of Section 702-acquired information; (2) review, retention, and disclosure of Section 702-acquired infonnation subject to destruction, including under these minimization procedures; and (3) review and retention of umninimized Section 702acquired infonnation contained in employee electronic communications by the FBI's Inspection Division, as part of its record of what it has provided to the Office of the Inspector General. See September 18, 2018, FBI Minimization Procedures§ II.Hat 5. Notably, the amended provisions - - IOP SECREl}}S)})ORCUMNOFOIG◄ DATE: Oct 8, 2019 - Authorized Public Release Page 100 of 138 Page 100 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 161•511!(.!lll!Jf;;.n"e"eOfVUOPOMf and no longer reference investigations intc do not specify activities relating to The modified provision also limits the scope of the authorized deviation by requiring (1)ecompliance with the minimization procedures to the maximum extent practicable, seee September 18, 2018, NSA Minimization Procedures§ 2 at 3; September 18, 2018, FBI Minimization Procedures§ I.Hat 5 n.4; September 18, 2018, CIA Minimization Procedures§ 6 at 4 n.2; September 18, 2018, NCTC Minimization Procedures§ A.6 at 4 n.1; and (2) destruction of infonnation in accordance with the applicable procedures once it is no longer reasonably believed to be necessary to the lawful-oversight function. See September 18, 2018, NSA Minimization Procedures§ 2(b)(5) at 2; September 18, 2018, FBI Minimization Procedures§ I.H at 6; September 18, 2018, CIA Minimization Procedures § 6.i at 5; and September 18, 2018, NCTC Minimization Procedures§ A.6.g at 4-5. Each agency is also pe1mitted to deviate from the procedures when necessary to conduct lawful-oversight functions that are not described in the procedures, but only after consultation with NSD and ODNI, followed by prompt reporting of the deviation to the FISC. See September 18, 2018, NSA Minimization Procedures § 2(b)(5) at 2; September 18, 2018, FBI Minimization Procedures§ l.H at 5-6; September 18, 2018, CIA Minimization Procedures§ 6.i at 5; September 18, 2018, NCTC Minimization Procedures § A.6.g at 4. At the hearing on September 28, 2018, the government confinned that this provision is not intended to include activities related to investigations o See September 28, 2018, Proposed Tr. at 12-13. - - 'POP Bfi!@llfi!'f;IJ'OIXOROOPk')iOFOB.lJ DATE: Oct 8, 2019 - Authorized Public Release Page 101 of 138 Page 101 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'fOf' Sf!CltE'f7'fSb'fORCONtNOFORN The amended querying procedures contain corresponding exemptions. For example, NSA's provide: (N]othing in these procedures shall prohibit NSA from conducting queries it determines are necessary to: ... perfonn the following lawful oversight functions of NSA's personnel or systems: a.esuppo,t NSA's investigation and remediation of a possible section 702e compliance incident;e b.eremediate a potential spill of classified section 702-acquired infonnation ine NSA systems;e c.eidentify section 702-acquired infonnation subject to destrnction, includinge under NSA's section 702 minimization procedures;e d.eensure the effective application of marking or segregation requirements in NSA's section 702 minimization procedures; and e.support NSA's audit or review, for quality control purposes, of work done related to section 702 collection by NSA personnel[.] NSA Querying Procedures § C.6 at 5-6 (followed by corresponding catchall provision pe1mitting deviations from querying procedures for unspecified lawful-oversight functions after consultation with NSD and ODNI followed by prompt reporting to the FISC); see also CIA Querying Procedures§ IV.C.7 at 5 (similar); NCTC Querying Procedures§ IV.C.6 at 5 (similar); and FBI Querying Procedures§ IV.C.7 at 6 (delineating similar exemptions as well as an exemption for queries conducted to "assess compliance with federal record-keeping requirements, where such r audit and oversight systems, as defined in FBPs queries are conducted section 702 minimization procedures, that contain FBI personnel e--mails that may contain unminimized section 702-acquired infonnation"). The Cou1i is satisfied that the exemptions for lawful-oversight functions conducted by the agencies are sufficiently defined and no broader than reasonable to permit the effective exercise of those functions. To the extent the need to conduct additional but unspecified lawful-oversight - - 110P QI]OlllJ'.Jil;f110lf:1,HUilQtl!JIQf'QIUf DATE: Oct 8, 2019 - Authorized Public Release Page 102 of 138 Page 102 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release TOP Sf:ettf:'fh'Sl1�'6ftCONfNOFORN activities arises and those activities require deviation from applicab]e procedures, the Comt views the required pre-implementation consultation with NSD and ODNI and prompt notification to the FISC as reasonable means ofmonito1ing and, if necessary, checking any other deviations from applicable procedures based on the lawful-oversight exemption. 2. Exemptions for Ti·ainin& Activities Each agency's initially proposed minimization procedm·es also contained a broad exemption from otherwise-applicable rules for activities conducted during training or for system­ administration purposes. See March 27, 2018, NSA Minimization Procedures § 1 at 1 ("Nothing in these procedures shall restrict NSA 's performance of lawful training functions ofits personnel or activities unde1taken for creating, testing, or maintaining its systems."); March 27, 2018, FBI Minimization Procedures§ LG at 4 ("Nothing in these procedures shall restrict the FBI's perfonnance of lawful training functions ofits personnel or creating, testing, or maintaining the functions of its systems."); March 27, 2018, CIA Minimization Procedures§ A.6.g at 4-5 (''Nothing in these procedures shall prohibit ... CIA's performance oflawful training functions of its personnel, or activities undertaken for creating, testing, or maintaining its systems.''); March 27, 2018, NCTC Minimization Procedures § A.6.f at 4 ("Nothing in these procedures sha11 prohibit ... NCTC' s performance of lawful training functions of its personnel, or creating, testing, or maintaining its systems."). A similar provision was included in the querying provisions. See March 27, 2018, Querying Procedures§ III at I ("Nothing in these procedures shall restrict a covered agency's perfonnance oflawful training functions ofits personnel, or creating, testing, or maintaining its systems."). - - Y8f O@@ft@'f;IJIQf,i1'81lfJ8fJ:IPf8F8Nf DATE: Oct 8, 2019 - Authorized Public Release Page 103 of 138 Page 103 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOf■SECICZI;;0111OIECOH:!IOPBftff Prior minimization procedures under Section 702 did not have a comparable exemption for training, which the government proposed in March 2018 after numerous instances of queries conducted during training that did not comply with the FBI minimization procedures. See March 27, 2018, Memorandum at 8 n.9. The Couii notes that the practice of conducting queries of unminimized Section 702-acquired information that do not meet the querying standard during training was not limited to isolated mistakes, see, e.g., Jan. 5, 2018, Notice at 2; May 2, 2018, Notice at 2, but appears to have been a systemic practice that went largely undetected for years. See Jan. 18, 2018, Notice at 2-3 (reporting that since 2011, a unit in FBI's ad been routinely conducting training sessions with FBI employees on the use of databases containing PISA-acquired information, including Section 702 information, during which trainees were asked to conduct queries using tenns provided by the trainers, which generally involved the use of names of former subjects of FBI investigations as query terms). Amici objected to the provisions proposed in March 2018 insofar as they sought a wholesale exemption from otherwise-applicable querying, retention, and dissemination rules. See Amici Brief at 61-63, 82-84; Amici Reply at 13-16. Specifically, amici questioned whether effective training really required the use ofU.S.�person query tenns, see Amici Brief at 62, or departures from retention and dissemination standards. Id. at 83. Amici also noted that "the procedures do not assign any responsibility for training, provide any guidance as to what it should entail, or describe how it must be designed ...." 14.. at 61. The government responded that queries "conducted for training purposes promote both the government interest in ensuring an effective workforce while simultaneously protecting the 'fOf SECftlf'fh'Sth'ORCONfP�OF0Rfi DATE: Oct 8, 2019 - Authorized Public Release Page 104 of 138 Page 104 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - TAP SFCPETfffl((QPCODI'NOWPN interests of U.S. persons by reducing the risk of non-compliant use or disc1osure of sensitive data." Gov't Response at 19. That rationale was undercut by the breadth of the provisions, which by their tenns were not limited to training that pertains to protecting U.S.-person information. The government also disclaimed any intent to use the exemptions to retain information otherwise subject to destruction requirements or to make otherwise prohibited disseminations. Id. at 41-42. In response to concerns regarding the breadth of the proposed training exemption raised by amici and the Cou1i, the government narrowed the training exemption in the procedures in three significant ways. First, the training exemption in the minimization procedures was narrowed to only permit deviations from procedures goveming access and review of information, and limited those deviations to only those reasonably necessary for effective training. See. e.g.. September 18, 2018, NSA Minimization Procedures§ 2(b) at 2; September 18, 2018, FBI Minimization Procedures § l.G at 4; September 18, 2018, NCTC Minimization Procedures § B. l at 5. The training exemption in the CIA minimization procedures was removed after the CIA detennined that such an exemption was unnecessary. See September 18, 2018 > Memorandum at 6. In addition, the government limited the exemption for training queries to quedes the agency detennines are necessary to the training of its personnel regarding proper implementation of FISA and FISA procedures, and to pennit the use ofU.S.-person identifiers to perform such queries only when there is a particular need to do so in the conduct of such training. See FBI Querying Procedures§ IV.C.1 at 5; NSA Querying Procedures§ IV.C. l at 4; CIA Querying Procedures§ IV.CJ at 4; NCTC Querying Procedures§ JV.C.1 at 4. - - $OP iGGAsi'fHilUQUCQNNOFORN I. • I DATE: Oct 8, 2019 - Authorized Public Release I Page 105 of 138 Page 105 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - WII 1111.l■ilHlliili@llilf@FfDPI These modifications appear to meaningfully limit the types oftraining activity exempted from otherwise-applicab]c rules. In light of the long-tenn non-compliance with the querying standard during training sessions conducted by the FBI's however, it appears prudent to clarify the Court's understanding of the limited exemption from the querying procedures sought for queries conducted using U.S.-person query tenns deemed necessary for effective training. It is not apparent why U.S.-person query terms that are known to objectively meet the general querying standard (i.e., reasonably likely to retrieve foreign­ intelligence information or evidence of a crime) should not be used whenever U.S.-person query terms are necessary to effective training. Trainers should pre-select U.S.-person query tem1s known to return foreign-intelligence infom1ation to prevent any unnecessary querying ofU.S.­ person identifiers unassociated with national-security investigations. The deviation from the querying standard for training queries should be understood to permit the use of queries conducted for training rather than foreign-intelligence purposes, but which nevertheless are reasonably likely to return foreign-intelligence infonnation or evidence of a crime. 3. Exemptions for Responding to Congressional Mandates Each set of proposed minimization procedures includes new language regarding agency compliance with congressional mandates that would require the agency to deviate from otherwise-applicable rules. The new language describes the types of process that would bigger this exemption as "a subpoena or similar process consistent with congressional oversight. " See September 18, 2018, NSA Minimization Procedures§ 2(b)(3) at 2 ("Nothing in these procedures shall restrict: ... the retention, processing, analysis, or dissemination of infonnation necessary to TOD £J?CDFTf/Slf/OPCObI0TOFOPJ!::. DATE: Oct 8, 2019 - Authorized Public Release Page 106 of 138 Page 106 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 5F8P SE@llflif:':'81s1f81l08PUPI8fl8ft,r comply with an order of a court within the United States or a specific congressional mandate, such as a subpoena or other similar process consistent with congressional oversight") (emphasis added); see also September 18, 2018, FBI Minimization Procedures § J.G at 4; September 18, 2018, CIA Minimization Procedures§ 6.h at 4-5; September 18, 2018, NCTC Minimization Procedures§ A.6.d at 4. The proposed querying procedures also permit queries the agency determines are necessary to comply with "a specific congressional mandate, such as a subpoena or similar process consistent with congressional oversight[.Y' NSA Querying Procedures §eIV.C.3 at 5; FBI Querying Procedures§ JV.C.3 at 5; CIA Querying Procedures§ IV.C.3 at 4;e NCTC Querying Procedures§ IV.C.3 at 4. The Court has previously observed that procedures that pennit exemptions "based on unspecified mandates could undennine the Court's ability to find that the procedures satisfy statutory requirements." See Ap1il 26, 2017, Opinion at 53 (citing November 6, 2015, Opinion at 22)e(internal quotation marks omitted). ln approving this provision in 2015, the Courte emphasized that the language, which at that time referred to "specific constitutional, judicial or legislative mandates," must be interpreted nan-owly to include only those mandates containing language "that clearly and specifically requires action in contravention of an othenvise-applicab]e provision of the requirement of the minimization procedures," and directed the government to report any action taken in reliance on this provision. See April 26, 2017, Opinion at 53 (internal citation omitted). The government sought to modify this provision in September 2016 to describe the contemplated activity requiring a departure as "necessary to comply with a specific congressional 'fOP 91'3Eftl'31fM91h10RCONi':Pi8F8RPi DATE: Oct 8, 2019 - Authorized Public Release Page 107 of 138 Page 107 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release mandate or order of a court within the United States.» See id. at 53-54. The Court approved the revised language hut reiterated its expectation that the provision be narrowly interpreted, id., and directed the government to provide prompt written notification of any instance in which an agency acted in contravention of othe1wise-applicable minimization procedures in reliance on that provision. See id. at 96-97. To date, the government has not relied on the exemption for activities responsive to a specific congressional mandate. The government did, however, receive a congressional request to calculate the number of communications of U.S. persons that have been acquired pursuant to Section 702. That request "was not in the fom1 of a subpoena or other legal process" and therefore would not have constituted a legal mandate for purposes of the exemption. See id. at 54. The govemment asserted, however, that any action it undertook in response to the request in contravention of otherwise-applicable minimization requirements would be pe1mitted under the lawful-oversight exemption. Id. Although the Court believed both provisions could be clearer, it did not take issue with the government's interpretation. The Comi did, however, direct the government to provide prompt notification of any instance in which an agency acts in contravention of otherwise-applicable minimization requirements to respond to an oversight request from any outside entity other than the executive-branch entities specified in the procedures. See M.. at 55, 97. The government filed a notice of such actions taken in an effort to respond to the above-described congressional request. See Report on NSA Action Pursuant to Section 1 of Section 702 Minimization Procedures in Response to Oversight Request of - - TORiliiGPFT({f!ffOPGON0IOFORN DATE: Oct 8, 2019 - Authorized Public Release Page 108 of 138 Page 108 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IClI Bl!@ill§ r;;Ol!i lJIQCOrt:H8f8Rff Congress, June 19, 2017 (advising that NSA conducted quelies of Section 702 data in attempt to provide requested estimates). ln response to the government's March 2018 submission (which described the exempted activity as that "necessary to comply with a specific congressional mandate," see. e.g.. March 27, 2018, NSA Minimization Procedures § 1 at 1), amici asse11ed that the exemption concerning congressional mandates did not adequately protect privacy interests because it was not clear whether a letter from a single member of Congress could be considered a mandate for purposes of the exemption. See Amici Brief at 67. Amici also recommended that the Court's interpretation of the tenn as directives in "the fonn of a subpoena or other legal process" be added to the querying procedures. Id. at 67-68. And, given the government's historical intent to rely on the "lawful oversight function" exemption when a congressional request for infonnation does not qualify as a "mandate," amici argued that the congressional-mandate exemption appeared to be superfluous, unless it could be narrowed in a way that made it distinct from the "lawful oversight" exception. Id. at 68. In response to these concerns, the government proffered the revisions to the congressional-mandate language noted above - i.e., adding the descriptor "such as a subpoena or other similar process consistent with congressional oversight" in both the minimization procedures and querying procedures. The Court believes that the requirement that such process be "consistent with congressional oversight" sufficiently circumscribes the type of mandate subject to the exemption. - FfOPOOOROIFOBIX81l@0Pl{l'l0F9R.l1 DATE: Oct 8, 2019 - Authorized Public Release Page 109 of 138 - Page 109 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOf SECREI})$i})bkCOMl◄OIIOftl4 The Court also believes that the modifications made to the lawful-oversight functions provision (discussed above) help claiify the respective spheres of that exemption and the exemption for specific congressional mandates: responding to a congressional request is not among the specified lawful-oversight functions, and the provision pennitting deviations necessary to the conduct of unspecified lawful-oversight functions only applies to such functions of the agency over its personnel and systems. See, e.g.. September 18, 2018, FBI Minimization Procedures§ I.Hat 5. Should an agency rely on this provision to deviate from generally applicable rules to respond to a request from a member of Congress, it would be required to consult with NSD and ODNI beforehand and report promptly to the FISC the specific oversight activity involved. Id. § J.H at 5-6. Any such submission should also explain why the action taken constitutes lawful oversight of the agency's personnel or systems. The Cou11 is satisfied that the congressional-mandate provisions and lawful-oversight provisions of the procedures as now proposed adequately address the concerns raised regarding the potentia] breadth of the congressional-mandate exemption. Consistent with prior approvals, however, the Cou11 will require the government to promptly report the circumstances of any deviation from applicable minimization or querying procedures taken in reliance on the congressional-mandate provision. E. Other· Changes to the FBI Minimization Procedures The government proposes changes to the FBI's minimization procedures conceming retention of Section 702-acquired metadata and retention of unminimized Section 702 - 16fI OE@llt!lfiJl110f;%18R88fl1'Ji8P8R:ll DATE: Oct 8, 2019 - Authorized Public Release Page 110 of 138 Page 110 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release he Court assesses infonnation in copies of emails and instant messages in each proposal below. 1. Retention of Metadata In assessing the metadata proposals, it is useful to disting1.1ish between provisions relating to the use of metadata for link analysis and those relating to que1ies for other purposes. Metadata Used for Link Analysis a. Section IIJ.G.1 of the 2016 FBI Minimization Procedures currently exclude Section 702acquired metadata in systems used solely for link analysis from the retention timetables that generally apply to raw Section 702 infonnation in electronic storage. Sec 2016 FBI Minimization Procedures§ Ill.G.1 at 22. The govemment seeks to modify Section IIJ.G to pennit the FBI to indefinitely retain such metadata for purposes of link analysis on all electronic and data-storage systems and ad hoc systems. See September 18, 2018, FBI Minimization Procedures§ III.G.2 at 32. This change would hannonize the FBI's Section 702 minimization procedures with a parallel provision of the FBI's minimization procedures applicable to electronic surveillance and physical search under Titles I and 111 of FISA, which the Court approved in May 2016. See May 17, 2016, Opinion at 46-48. One incident of FBI over-retention of Section 702-acquired metadata was reported du1ing the prior authorization period and is worth noting here. In imp]ementing the change allowing indefinite retention of metadata acquired pursuant to Title l and III, the FBI mistakenly reconfigured its systems to eliminate the time Hmits on retention for all FISA-acquired metadata, including Section 702-acquired metadata that should have aged off systems not used solely for - - 'f@P Sl!@IU�'tW81,�tOft00Pf/NOPORPJ DATE: Oct 8, 2019 - Authorized Public Release Page 111 of 138 Page 11 J FISC Opinion, Oct. 2018

Document regarding the Section 7022018 Certification ODNI Authorized for Public Release - 1IOI■SECR£1))31))0REUIC140I OICl4 link analysis. See Preliminary Notice of Compliance Incident Involving Retention of Raw Section 702-Acquired Metadata by FBI, April 27, 2018, at 2-3 (reporting improper retention of unminimized Section 702-acquired metadata that should have been purged from systems not solely used for link analysis within five years of expiration of cel1ification under which it was obtained pursuant to Section lll.G. l of FBI's current Section 702 minimization procedures). The FBI remediated the violation by limiting access to the over-retained Section 702-acquired metadata to a tool used solely for link analysis. See Supplemental Notice of Compliance Incident Involving Retention of Raw Section 702-Acquired Metadata by FBI, July 2, 2018, at 2-3. That restriction would become unnecessary if the Court approves the proposed modification to Section III.G to pennit indefinite retention of Section 702-acquired metadata on systems other than thosee used so]ely for link analysis. In suppo1t of the modification to the FBI Title I and 1II minimization procedures requested in 2016, the government argued that the limitations on retention periods for FISA­ acquired metadata based on the nature of the system on which the metadata resides impaired the FBI's ability to use metadata in data-storage systems not solely used for link analysis without commensurately increasing privacy protections, and that the ability to conduct link analysis of metadata in other systems would enhance the FBI's capacity to make connections about targets and their networks. See Gov't Mot. to Amend Standard Minimization Procedures for FBI Electronic Surveillance and Physical Search Conducted Under FISA, May 17, 2016, at 35-38. The Court concluded that the FBl's compliance with the querying standard as well as other protections set fo1th in the applicable minimization procedures strikes a reasonable balance - T P .illf E 11 lllf 11.'iU ii lilll P RilTPiAIOAflf DATE: Oct 8, 2019 - Authorized Public Release Page 112of138 Page 112 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release between the government's foreign-intelligence needs and the protection of U.S. persons' privacy, and approved the modification. See May 17, 2016, Opinion at 47-48. The government presents similar arguments now. See March 27, 2018, Memorandum at 71-73. When evaluating the government's current request to add Section 702-acquired metadata to the cache of infom1ation indefinitely retained on all electronic-data storage and ad hoc systems, the Court must consider the same governmental and privacy interests in relation to the protections afforded by the applicable procedures. The FBl's procedures seek to protect privacy in a variety of ways. Most pe1iinent to the requested modification is the requirement that FBI personnel may only conduct queries of Section 702-acquired infonnation that are "reasonably likely to retrieve foreign intelligence infonnation" or "evidence of a crime." FBI Querying Procedures§ IV.A.I at 3. That standard applies to queries of Section 702-acquired metadata, not just content information. (For reasons discussed in Pa1t IV.B above, the Court has found the FBI's querying practices deficient and is contemporaneously ordering the government to correct that deficiency.) ln addition, any dissemination of metadata acquired under Section 702 that is of or concerning a U.S. person must meet the criteria of Section IV of the September 18, 2018, FBI Minimization Procedures, and disclosure for law-enforcement purposes must comply with Section III.H .2 of those procedures. Consistent with the May 2016 approval of the FBI's standard minimization procedures for electronic surveillance and physical search, the Court finds that the FBI's proposed Section 702 minimization and querying procedures provide sufficient protection for U.S.-person privacy - - TOP Ol!@ftl!Ffl/J10M18R@8f J:'Jlf8F8RJf DATE: Oct 8, 2019 - Authorized Public Release Page 113 of 138 Page 113 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - ,er Sft@ttft7Pl111s1,reR@Of4:'f4oroRH concerns related to the indefinite retention of Section 702-acquired metadata on all FBI datastorage and ad hoc systems when balanced against the important and substantial interests asserted by the government. The Court notes, however, that for purposes of evaluating Section 702 minimization procedures, the diminished privacy interest in non-content infonnation generally recognized (including by amici, see Amici Brief at 73), does not equate to no privacy interest. And, in a digital era in which U.S. persons share an expanded amount of data electronically, the type and volume of metadata associated with U.S. persons' communications acquired under Section 702 may also expand. It is not unreasonable to expect that the type of metadata available for querying across all FBI data-storage and ad hoc systems, particularly when retained indefinitely and aggregated over longer periods of time, could provide a cache of infonnation the use of which might implicate greater privacy concerns. Cf. Cawenter, 138 S.Ct. at 2215-17 ("the unique nature of cell phone location records" at issue distinguished it from other third-party records such as dialed numbers or negotiable instruments). Mindful of the need to consider the type and volume of metadata acquired under Section 702 and the manner in which the government uses such metadata when evaluating the sufficiency of the targeting, minimization, and querying procedures, the Court will require the government to describe the types of infonnation acquired by the FBI under Section 702 that the government regards as metadata and the extent to which such metadata can reveal location information about U.S. persons. b. Metadata Queried for Other Purposes As noted above, Section III.G.1 of the FBl's current minimization procedures permits the indefinite retention of Section 702-acquired meta.data only on systems used solely for link - - 1'QP OHGRID1' ':lfJl''QRGQJtl'JtlOI:t,MU•l DATE: Oct 8, 2019 - Authorized Public Release Page 114 of 138 Page114 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release TOP SECRETHSli'IORCONf:NOFO�, analysis. Section 702 metadata stored on other systems must be aged off those systems pursuant to the same retention limits applicable to the contents of the corresponding communications. Specifically, infonnation that has not been reviewed must be purged within five years of the date ofexpiration of the certification under which it was acquired, unless a specific extension is obtained. See 2016 FBI Minimization Procedures § III.G. l .a at 22. Infonnation that has been reviewed but not identified as meeting the retention standard - i.e., infonnation that reasonably appears to be foreign-intelligence infonnation, to be necessa1y to understand foreign-intelligence information or assess its impmtance, or to be evidence of a crime - must be access-restricted after ten years and purged after fifteen years, unless a specific extension is obtained. See id. §eUl.G. 1 .b at 23. Information that is subject to those access restrictions may be queried, bute personnel must obtain approval from a designated FBI official before accessing the results of the query. The government has advised that it intends to implement the ten-year access-restriction provision (under both the FBl's standard minimization procedures for electronic surveillance and physical search and its Section 702 minimization procedures) to allow immediate access to rnetadata responsive to a query, regardless of whether the query was run for purposes of link analysis or for other analytical purposes. See Letter Regarding FBI' s Implementation of Section III.D.4.c of Standard Minimization Procedures for FBI Electronic Surveillance and Physicale Search Conducted Under FISA, Feb. 5, 2018, at 2. The ten-year mark will be reached in November 2018 for data acquired under FISA Title I and Title Ill but not until September 2019 for Section 702 information. ld. at 1 n.1, 2. The government also advised that if access to a - - TOP OIJ 8RIJ'F;%101XOROON 'JIOF'il\itl DATE: Oct 8, 2019 - Authorized Public Release Page 115 of 138 Page 115 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - IOf SECREI})$b}OKCUl◄if◄U)t0ft1' restricted communication is approved, the FBI intends to make the communication, including the contents, accessible in a non-restricted state "to all users who would otherwise be authorized to access such infonnation" in the pe1tinent system for six months or until fifteen years from the expiration of the authority under which the communication was acquired, whichever is sooner. Id. at 3. In order to fully assess the reasonableness of the intended action, FISC Presiding Judge Rosemary M. Collyer directed the government to, among other things, submit a written explanation of the basis for its assessment that access to the metadata results of queries that are not conducted for purposes oflink analysis is pennitted under the applicable retention limits and describe how metadata may be queried or analyzed for purposes of link analysis and how it may Order, be queried or analyzed for other purposes. See Docket Nos. July 26, 2018, at 3. The Court anticipates that the infonnation regarding the actual implementation of these provisions provided by the government will sif,mificantly inform the Court's evaluation of the reasonableness of the government's actions in the context of Titles I and Ill and, beginning in 2. under Section 702. Retention on Email and Instant-Messa The government seeks modifications to the FBI's 702 minimization procedures that would permit the FBI to retain unminimized Section 702 infom1ation in certain repositories that do not comply with the FBI's current minimization procedures. The government seeks these modifications as part of an effort to address such noncompliance, which was first reported to the Couit in the context of infonnation acquired pursuant to Titles I and III of FISA in December 2016. - TOP 8@Clt@'tW81X8RCON,'P�8f'8Wl DATE: Oct 8, 2019 - Authorized Public Release Page 116 of 138 Page 116 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release Tor ~~Cltl!fMSIMt,ftCONtN0 ¥'6ft"N In December 2016, the government infonned the Court that FBI systems containing classified email and instant messages might be retaining unminimized FISA information in violation of FBI' s standard minimization procedures. See April 26, 2017, Opinion at 88 n.70. In March 2017, the government identified the same systems as presenting compliance issues under the FBI's 702 minimization procedures. See Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of FISA, Mar. 17, 2017 ("March 2017 Quarterly Report,,) at 78-79.e According to that report, all email messages on the FBl's secret-level email system are naintained by the FBI' etained i FBI in responding to discovery requests. Id. Tha management and FOIA processing, and by the FBI's is also storing instant messages from FBI's investigative purposes. Id. secret-level instant-messaging system in a separate system used primarily for investigative purposes. See id. at 79. The Aptil 26,2017, Opinion directed the government to report the extent to which unminimized FISA, including Section 702, info1mation was being retained on those systems and to assess whether such retention complied wit11 applicable minimization requirements; and to the extent that noncompliance was found,to describe the remediation steps the government was taking. See April 26, 2017, Opinion at 97-98. h1 subsequent months, the government provided the Com1 additional details regarding the FBl's retention of Section 702 and other FISA infom1ation on those systemse, and reported ane additional discovery - namely, that the FBI's was instant messages on the FBl's top secret enclave. See March 27, 2018, Memorandum at 80. In 'POP s"ett"'l½'91//8RCONfl',8F8RN DATE: Oct 8, 2019 - Authorized Public Release Page 117 of 138 Page 117 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release December 2017, the govemment notified the Court that the FBI intended to prohibit users from placing unminimized FISA-acquired information in classified instant messages, but because FBI personnel needed the ability to include unminimized Section 702 and other FISA information in classified emails, that practice would not be prohibited. See Supplemental Information Regarding Retention of Raw PISA-Acquired Infonnation in Certain FBI Special Purpose Systems, Dec. 14, 2017, at 2. The government further advised that the FBI was working on a solution that would require instant messages and emails (except for those subject to litigation holds) to age off within five years. See id. at 2-3. Recognizing these measures would not bring the FBI into full compliance with the minimization procedures, the govemment advised the Court it also intended to seek modifications to the applicable procedures. See id. at 3. In the March 27, 2018, Submission, tl1e government proposed changes to the FBJ's current Section 702 minimization procedures. The first change would prohibit the further placement of unminimized Section 702-acquired information in classified-email and instant­ message systems. See March 27, 2018, Memorandum at 81-82. Even though the FBI assesses there is still an operational need to place such information on classified email systems, the rovemment is prepared to take that step because of its inability to delete information from the mail system and instant-message repositories in confonnance with the generally applicable retention limits while stiU retaining infonnation subject to a litigation hold. See id. at 81-82. Because the non-compliant systems will not ingest any additional unminimized Section 702-acquired information, the volume of information "over-retained" in those systems willa effectively be capped. - - 130P 6fii!IUii7c'lil'.'.ORCCllltJOEOPtl DATE: Oct 8, 2019 - Authorized Public Release Page 118 of 138 Page 118 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release With regard to info1mation already in mail system and instant-message repositories, the govemment contends that it is not currently possible to globally search for messages containing unminimized Section 702-acquired infonnation. Id. at 82-83. The government therefore proposes two new provisions to the FBl's Section 702 minimization procedures, which would permit the indefinite retention of unminimized Section 702-acquired infonnation on these systems notwithstanding othe1wise-appiicable retention limits. See • I " . "I " ystem") and § III.F.6 at 31-32 (''FBI-Designated Systems") (exempting those systems from specified retention rules). Although no maximum retention period would apply to either system, access to the databases would be limited to "FBI personnel who require access to perform their official duties or assist in a lawful and authorized governmental function, including system administrators and other technical personnel, and who have received training on these minimization procedures and the Querying Procedures." Id. §§ III.F.5 at 30 and Hl.F.6 at 31. The proposed provisions also require that the FBI maintain records of all personnel who have been granted access to such repositories and all accesses to such repositories. Id. at 30-32. Finally, FBI personnel authorized to access these repositories may do so only "to assist in investigations, and to respond to inquiries related to records management and discovery," and may only query those systems to find and provide infonnation, which may include raw FISA- TAD £FCDFTI/SI//OPCA7'r:1!N OFOPLJ DATE: Oct 8, 2019 - Authorized Public Release Page 119 of 138 Page 119 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release acquired infonnation, in furtherance of such inquiries, functions, and investigations. Id. Any queries in those repositories must also comply with the querying standard described above. Id. Amici expressed several concerns regarding the government's proposal, including lack of specificity regarding who may have access to mail system and instant-message repositories, the purposes for which those repositories are used, and the justification for exempting them from U.S.-person masking requirements. See Amici Brief at 92-94. Amici also recommended that the FBI be required to provide a w1itten statement justifying access. Id. at 94. The Cowi shares amici's concerns to some extent but is also cognizant of the general nature and purpose of these systems, which do not include the retention ofumninimized Section 702 information in any amount approaching the quantity found in systems primarily used by the FBI for analytical and investigative work. ln that light, the proposed modifications to the FBI's minimization procedures greatly mitigate the potential impact of indefinite retention of umninimized Section 702 infonnation in those systems. The necessity of categorically exempting them from any limits on retention, however, is not apparent. The Court will t11erefore approve proposed Sections l1I.F.5 and III.F.6 subject to the following: in the event the FBI recognizes unminimized Section 702-acquired infonnation in a system defined by Section JII.F.5 or IJI.F.6, and seeks to retain such information in that system, the govemment shall report in its next quarterly report concerning compliance matters under Section 702: ( 1) whether the infonnation could be retained on an FBI classified-email or instant-messaging system as described in Section lJJ.F.4, or in connection with litigation matters as described in Section Page 120 DATE: Oct 8, 2019 - Authorized Public Release Page 120 of 138 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOI•SECICEl))SJ))Gfl@O:tll!GlGIGt IIl.1.3; and (2) if not, the reason retention of the infonnation in that system is necessary to the purposes served by the system. F. Conclusion For the reasons stated in Parts JV.Band V I .C above, the Coui1 finds that the FBJ Querying Procedures do not comply with the recordkeeping requirement at § 702(f)(l )(B) and that, in view of the FBI's querying practices, the FBI Querying Procedures and FBI Minimization Procedures do not, as implemented, satisfy the definition of "minimization procedures" at 50 U.S.C. § 1801 (h) and are unreasonable under the Fou11h Amendment. In other respects, the government's querying and minimization procedures, including those provisions examined in Parts JV.D and IV.E above, comport with applicable statutory requirements and the Fourth Amendment. In particular, the changes to the FBI Minimization Procedures that provide more detailed guidance on the storage and handling of infonnation on various types of systems and related organizational changes to those procedures, see March 27, 2018, Memorandum at 43-70, 74-75, present no impediment to making those findings. V. OTHER NON-COMPLIANCE Although the other instances of non-compliance reported by the government do 119t beare significantly on the Court's disposition of these matters, it is desirable to touch briefly on the current status of two additional matters discussed in the April 26, 2017, Opinion, as well as two more recent matters. - - li'OP OD ODlili'fflilffORQQ)lI,iIQECRtl DATE: Oct 8, 2019 - Authorized Public Release Page 121 of 138 Page 121 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification A. ODNI Authorized for Public Release Incidents Addressed in the April 26, 2017. Opinion Several significant compliance issues were addressed in the Apiil 26, 2017, Opinion, four of which were not fully resolved at the time of the Opinion: (1) issues a1ising from NSA's upstream co11ection of Internet communications, see April 26, 2017, Opinion, at 78-81 ; (2)eimproper disclosure of unminimized Section 702 infonnation by the FBI, kt at 83-87;e (3)econcerns about the frequency of NSA's post-tasking review of contents, kt at 75-78; ande (4)ethe potential over-retention of unminimized Section 702 infonnation by the FBIe Id. at 87-89. The first and fourth issues are discussed above in Part III.A and Part IV.E.2, respectively. The other two are discussed briefly below. 1. Freguency of NSA's Post-Taskin¥ Review of Contents NSA 's targeting procedures require that analysts take reasonable steps to confirm that a selector continues to be used by a non-U.S. person located outside the United States. Such steps may include content review, as weJI as ascertaining whether a tasked facility is being used inside ee NSA Targeting Procedures§ II at 6-7. NSA's targeting procedures provide that content review "will be conducted according to analytic and intelligence requirements and priorities" and do not require analysts to review the contents of communications acquired from tasking a particular selector at fixed intervals. See id. at 7. The government has advised the Court, however, that NSA fol1ows a policy whereby such content review is perfonned no later fter the first acquisition and at intervals of 'FOP 86CR6'F/,'6lh'QACQl'J,1l'IQF8R"l DATE: Oct 8, 2019 - Authorized Public Release Page 122 of 138 Page 122 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 1ereafter. See Update Regarding Post-Targeting Content no more th a Reviews, Sept. 13, 2016, at 2. As indicated in the April 26, 2017, Opinion, the Court has had concerns about the govemment's ability to monitor analysts' compliance with this policy. See April 26, 2017, Opinion at 76-77 (citing Supplement Letter Regarding Post-Targeting Content Reviews, Mar. 13, 2017 (indicating that NSA ha or monitoring compliance with the policy in only one of its Section 702 repositories and therefore does not comprehensively monitor or velify analysts' compliance with the policy)). To address the Court's concern, the government undettook to include in its quaiterly reports any instances in which a failure to conduct timely content review in accordance with this policy was discovered, whether or not such failwe resulted in a violation of the targeting procedures themselves (e.g., a delayed detasking resulting from the failure to conduct timely post-targeting content review). April 26, 2017, Opinion at 77. The infonnation submitted in the six quarterly repo11s filed since April 2017 revealed several instances in which NSA did not comply with the policy, only a small fraction of which led to violations of the targeting procedures. See, e.g., Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of PISA, Sept. 14, 2018 ("September 2018 Quarterly f failure to conduct timely post-targeting content review, ikely resulted in delayed detasking); see also Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of FISA, June 15, 2018 ("June 2018 Quarterly Report") at 101 (reporting f failure to conduct timely post-targeting content review, ssociated with delayed detaskings); Qua1terly Report to FISC Concerning -xon SFCPFT/JSI/{ODCONNOFOPI:'- DATE: Oct 8, 2019 - Authorized Public Release Page 123 of 138 Page 123 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - I I 1QllOON:'tiOfQIUl Sfi0P 81UiJllliTi!Jl8I1l1 Compliance Matters Under Section 702 of FISA, Mar. 16, 2018, at 91 (reportin failure to conduct timely post-targeting content review ssociated with delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of PISA, Dec. IS, 2017 ("December 2017 Quarterly Repo1i") at 89 (reportin failure to conduct timely post-targeting content review ssociated with delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section 702 of FISA, Sept. 15, 2017 ("September 2017 Quarterly Report") at 81 (reporting of failure to conduct timely post-targeting content review, ssociated with delayed detaskings); Quarterly Report to FISC Concerning Compliance Matters Under Section f 702 of FISA, Jw1e 16, 2017 ("June 2017 Qua1ierly Report") at 99 (reportin failure to conduct timely post-targeting content review delayed detaskings). The qua11erly reports also revealed that in several of these incidents the CIA or the FBI was responsible for conducting post-targeting content review but did not conduct timely reviews. See. e.g., June 2017 Quarterly Report at 99 n.54 (identifying incidents for which FBI had responsibility for conducting timely post-targeting content review); September 2017 Qualierly Report at 81 n.39 (same); September 2018 Quarterly Report at 64 & n.40 (identifying incident in which CIA had responsibility for conducting timely post-targeting content review). In addition, in June 2018, the government notified the Court that because ofreliability issues, NSA had disabled two features of the system used to remind analysts of their obligations 'fOP se@Rt!:Ffh191//0RCON{Pi9FOll'l DATE: Oct 8, 2019 - Authorized Public Release Page 124 of 138 Page 124 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - 'liOP 81!l@Rl!l'li;%'81XOROOM'flOF@RPl to conduct post-targeting content review. See Supplemental Letter Regarding Post Targeting Content Reviews, June 12, 2018, at I. Despite these setbacks, the Couit does not view the reported deviations from the policy as presenting significant concems, principally because ( 1) only a small fraction of the deviations from NSA's post-tasking content review policy resulted in an improper delay in detasking; and (2)ethe number ofmissed or untimely reviews repo1ted, regardless of whether a delay ine detasking resulted, is small when viewed in relation to the total number of cuffent taskings. See, M:., September 2018 Quarterly Report at 1, 97 (repo1ting ·cilities under task at any given time between June 1, 2018, and August 31,201 timely posMargeting content review during the same period). The Court notes, however, that compliance with NSA's post-targeting content-review policy remains an area susceptible to improvement. The govemment is encouraged to continue to explore additional means of prompting analysts to conduct the content reviews required by NSA's policy ai1d, to the extent the FBI or the CIA is responsible for conducting such review, to ensure compliance with the policy. The government is also expected to continue to report instances of non-compliance with the policy in its quarterly reports. 2. he FBI allowed The April 26, 2017, Opinion also discussed unauthorized personnel to access Section 702 infonnation, only one of which presented a continuing issue of concern to the Court. See April 26, 2017, Opinion at 83-87. That matter involved the provision of unminimized Section 702 infom1ation pet1aining to - IGI SELKEI;;SfoORCOl4J14bl GIG4 DATE: Oct 8, 2019 - Authorized Public Release Page 125 of 138 Page 125 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - ff8POH@lt.811;1;I81,VOll0OfI'.JIOFOIVI ontractor that was developing software intended to facilitate review of Section 702 information. See Quarterly Report to FISC Concerning Compliance Matters Under Section 702 ofFISA, Sept. 15, 2016, at 131. At the time of the Court's April 2017 decision, eturned the infonnation in question to the FBI, but the FBI still planned personnel to install the software on an FBl system. See April 26, 2017, Opinion at 86. The Court ordered the government to report (1) the results of an investigation it had undertaken to detem1ine whether there were other instances of improper access or disclosures, and (2) to report the circumstanc nticipate<l installation of the software on an FBI system, including whether its personnel received access to unminimized Section 702 infonnation in the course of their work; and if so, an assessment whether such access complied with the FBl's minimization procedures. See April 26, 2017, Opinion at 98. On June 8, 2017, the government reported that its investigation had revealed no additional instances of improperly accessed, unminimized Fl SA-acquired information on FBI systems between 2008 and March 20 I 7. See Supplemental Response Regarding Improper Disclosures by FBI of Raw FISA-Acquired lnfonnation, Including Section 702-Acquired Infomrntion, June 8, 2017, at 2. The government also reported ot installed th.e software and undertook to infonn the Court of the circumstances o at 4. The results of the FBJ's investigation reported in June 2017 eased the Court's concerns regarding the possibility of further noncompliance with access restrictions. The FBI must, of course, report any future unauthorized access of Section 702 information; however, in the event 'f'Of SECft�1'/fSl/i6RCONiNOFORN DATE: Oct 8, 2019 - Authorized Public Release Page 126 of 138 Page 126 FISC Opinion, Oc t 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I er ~~Cft'.~Th'311'1'6ttCO¥VNOFOttN oftware is installed in a manner fully consistent with the FBl's minimization procedures, such installation need not be repo1ted to the Comt. B. New Compliance Issues ln addition to the incidents of non-compliance concerning querying practices and over­ retention of Section 702-acquired information discussed above, the government has identified a number of other incidents of noncompliance with the applicable procedures. For example, there have been several instances in which NSA has tasked selectors under Section 702 without conducting the necessary foreignness checks, failing to perfonn timely foreignness checks (i.e., the results of a foreignness check had grown stale by the time the selector was tasked), or failing to consider the totality of circumstances when making a foreignness detennination. See. e.g., September 2017 Quarterly Report at 6-41. In other instances, the govemment failed to timely detask accounts because of human error, staffing issues, communications failures between agencies, or misunderstandings of the ru1es. See, e.g.• December 2017 Quarterly Report at 28-63. Notices filed over the last year also indicate that the FBI continues to encounter difficulty with the timely establishment of review teams, which its minimization procedures require when a Section 702 target has been charged with a federal crime, see, e.g., Supplemental Notice of Compliance Incident Regarding Two Section 702-Tasked Facilities, Aug. 8, 2018; Rule 13 Notice Regarding [Target and Multiple Docket Numbers] and Three Section 702-Tasked Facilities, Jan. 11, 2018, and that NSA continues to experience problems of varying magnitude with the over-retention of 702-acquired info1mation on its many systems. See, e.g., June 2018 Quarterly Report at 85-87, 93, 97. -•A~ .i H'PRW.Yh'.liilffAR PANH~i!AOOkN DATE: Oct 8, 2019 - Authorized Public Release Page 127 of 138 Page 127 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release I OJ 5:l!!Cft'I!,,,, :,,,, 01teef M140P(nu, After considering these and other incidents reported since April 2017, the Court finds reasonable and sufficient the steps taken by the government to address them and to prevent similar occurrences. It concludes that only one new incident and one potential compliance incident merit specific discussion here. In addition, when reporting incidents of non- 'fOP SECftE'f;'fSINORCONfNOFOR.� DATE: Oct 8, 2019 - Authorized Public Release Page 128 of 138 Page 128 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - IOF SECREJ11$1})bkC01◄mo11 um, compliance to the FISC, the government frequently represents that infonnation has been placed On May 25, 2018, the government reported to the FISC that, since September 20 I 7, NSA had a growing backlog of purge-discovery orders, which resulted in significant delays in placing information on the MPL. Id. at 2. The majority of the backlogged orders pertained to Section 702 collection id., which suggested that NSA was not timely complying with its purge obligations under the applicable Section 702 procedures. See, e.g., 2016 NSA Minimization Procedures, as amended Mar. 30, 2017, § 3 at 4, 6-10, § 5 at 12 > § 6 at 13- l 4. On May 29, 2018, Judge Collyer held a hearing to learn how the go�ernment proposed to address acklog. She directed the govemment to report on its progress in writing every two weeks. Page 129 DATE: Oct 8, 2019 - Authorized Public Release Page 129 of 138 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - IOI■SELICEIHJ())bltCOIOUOP<JftU As of October 1, 2018, NSA has successfully automated its processing of purge-discovery orders in some but not all of its SSRs, and is processing new purge-discovery orders at a rate similar to its pre-September 2017 rate. See Ninth Update at 2. Accordingly, the NSA considers acklog to have been eliminated. The government has not yet, however, provided to the Court a proposed standard for detennining whether a backlog in processing purge-discovery orders develops in the future. As a result, until the government is able to assure the Court that purge-discovery orders are being timely processed, NSA will continue to: (1) and (2) provide bi-weekly reports with the number of pending purge discovery orders. See id. Based on the NSA's processing of previously backlogged purge-discovery orders and its bi-weekly checks and updates, the Court finds that the backlog issue does not impede a finding that the NSA's purge procedures, as cunently implemented, are consistent with statutory and Fourth Amendment requirements. 2. Insider-Threat Monitorin2 In the March 27, 2018, Submission, the government infonned the Court that it had identified certain insider-threat-monito1ing activities, and the subsequent placement of that Memorandum at 11. The government refers to those activities as "user activity monitoring" or "UAM." See September 18, 2018, Memorandum at 24. - - $OP ili'1Ai1l:'HilUQPCON NOFOPN DATE: Oct 8, 2019 - Authorized Public Release Page 130 of 138 Page 130 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 'l'OP SECRE I11S1770RCON7NUFORN .. encounter raw section 702-acquired information" and "whether such activities implicate the section 702 minimization and querying procedures." Id. at 27. The government's submission also includes a timeline: (I) NSD has requested that the covered agencies provide infonnation concerning the user-activity-monitoring practices that may implicate raw section 702-acquired information no later than November 1, 2018; (2) the government anticipates that it will conclude any subsequent investigation by mid-January; and (3) "(b]y the end of Fcl:Jrnary 2019, the government intends to provide the Court with a written update on whether UAM activities at each agency implicate the section 702 minimization and/or querying procedures and, if so, the extent to which those procedures need to be amended in order to address those UAM activities." Id. at 28. The timeline proposed by the govenunent for its investigation of the repm1ed practices appears reasonable, except to the extent it intends to delay reporting any discovery of actual noncompliance with applicable minimization or querying procedures. At present, the government has advised the Court only that user-activity monitoring may have resulted in violations of applicable procedures. Any confirmation of that concem should be immediately reported to the Court in accordance with Rule 13(b) of the Court's Rules of Procedure, even though the Com1 anticipates that any report of such an incident may be limited in content until 'fOP SECRSTi'r61frORCON/NOF-OM DATE: Oct 8, 2019 - Authorized Public Release Page 131 of 138 Page 131 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - fliOf iii fi'Rlilfli''til''OHOOPI1iOFQDtI the completion of the investigation described by the govemment. And, to the extent noncompliance with applicable procedures is identified, the government is directed to consider and address options other than amending the procedures to remediate the violations. V. CONCLUSION For the foregoing reasons, the Court finds that:e (1)eThe 2018 Ce11ifications, as amended by the September 18, 2018, Submission, as welle as the certifications in the Prior 702 Dockets, as amended by those documents, contain all the required statutory elements; (2)eThe targeting procedures for acquisitions conducted pursuant to the 2018e Certifications, as amended, are consistent with the requirements of Section 702( d) and of the Fouith Amendment; (3)eWith respect to infonnation acquired under the 2018 Ce1tifications, as amended, thee minimization procedures and querying procedures to be implemented by NSA, the CIA, and NCTC are consistent with the requirements of Section 702(e) and Section 702(i)())(A)-(B) respectively and of the Fourth Amendment; (4)eWith respect to infom1ation acquired under the certifications in the Prior Section 702e Dockets, as amended, the minimization procedures to be implemented by NSA, the CIA, and NCTC (to include, as referenced therein, the requirements of the respective agencies' querying procedures) are consistent with the requirements of Section 702(e) and of the Fourth Amendment. (The Court makes no findings regarding whether any querying procedures, as appJied to infomrntion acquired under the certifications in the Prior Section 702 Dockets, are - - ffOP Qfifi'IUi'.iJif((JIffQA6'CtHJUQFQJUI DATE: Oct 8, 2019 - Authorized Public Release Page 132 of 138 Page 132 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - IGI■SE@llbf))b1))01CC©ICI401CICIt- consistent with the requirements of Section 702(f)(l) because Section 702(f) only applies "with respect to ce1iifications submitted under [Section 702(h)] ... after January 1, 2018." Reauthorization Act§ 101(a)(2).); (5)eWith respect to infonnation acquired under the 2018 Certifications, as amended, thee minimization procedures and querying procedures to be implemented by the FBI are consistent with the requirements of Section 702(e) and Section 702(f)(l )(A)-(B) respectively and of the Fourth Amendment, except insofar as they are inconsistent with (a) the recordkeeping requirement at Section 702(f)( J )(B) because they do not require the FBI to keep records of United States-person query tenns used to conduct queries of Section 702 infonnation in a manner that fairly identifies United States-person query tetms as such or differentiates them from other tenns used to query Section 702 infonnation and (b) the requirements of Section 702(e) and Section 702(£)(1 )(A) respectively and of the Fourth Amendment because they do not require adequate documentation of the justifications for queries that use United States-person query tem1s. In those two respects, the Court finds deficiencies in those procedures within the meaning of Section 702(j)(3)(B); and (6)eWith respect to infonnation acquired under the certifications in the Piior Section 702e Dockets, as amended, the minimization procedures to be impJemented by the FBI (to include, as referenced therein, the requirements of the FBI's querying procedures) are consistent with the requirements of Section 702(e) and of the Fourth Amendment, except insofar as they are inconsistent with those requirements because they do not require adequate documentation of the justifications for queries that use United States-person query terms. In that respect, the Court - - TQP 6liGl.iUii'.Jil:f;l61J:IQA:'1'QlbJ llbiQilQA:ll DATE: Oct 8, 2019 - Authorized Public Release Page 133 of 138 Page 133 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification - ODNI Authorized for Public Release - Jl8P Sl!l8Uiffil:!:'fill(.101l60N{Pi0FOIVI finds a deficiency in those procedures within the meaning of Section 702(j)(3)(B); and, accordingly, IT IS HEREBY ORDERED AS FOLLOWS: (1) The government's request for approval of the March 27, 20 I 8, Submission, ase amended by the September 18, 2018, Submission, is approved in part and denied in pati, as set out below: a.eThe 2018 Certifications, as amended, and the certifications in the Prior Sectione 702 Dockets, as amended, are approved; b.eThe use of the targeting procedures for acquisitions conducted pursuant to thee 2018 Certifications, as amended, is approved; c.eWith respect to information acquired under the 2018 Certifications, ase amended, the use of the minimization procedures and querying procedures to be implemented by NSA, the CIA, and NCTC is approved; d.e With respect to information acquired under the cettifications in the Priore Section 702 Dockets, as amended, the use of the minimization procedures to be implemented by NSA, the CIA, and NCTC (to include, as referenced therein, the requirements of the respective agencies' querying procedures) is approved; e.e With respect to information acquired under the 2018 Certifications, ase amended, the use of the minimization procedures and querying procedures to be implemented by the FBI is approved, except insofar as they (a) do not require the FBI to keep records of United States-person query terms used to conduct queries of Section 702 information in a manner that - - ijiQp Olii Qftlii•1%iOl:f1'QRQQJJ11tlQliQIU! DATE: Oct 8, 2019 - Authorized Public Release Page 134 of 138 Page 134 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release 't'OP SECREJi?'SI06RCONi'NOFORi'� fairly identifies United States-person query tenns as such or differentiates them from other terms used to query Section 702 infonnation and (b) do not require adequate documentation of the justifications for queries that use United States-person query tenns; and f.e With respect to infonnation acquired under the certifications in the P1iore Section 702 Dockets, as amended, the use of the minimization procedures to be implemented by the FBI (to include, as referenced therein, the requirements of the FBI's querying procedures) is approved except insofar as those procedures do not require adequate documentation of the justifications for queries that use United States-person query tenns; (2)eSeparate orders memorializing the dispositions described above are being issuede contemporaneously herewith pursuant to Section 702(j)(3)(A)-(B); (3)eThe following provisions of the April 26, 2017, Opinion shall remain in effect for thee reasons stated therein. Prospectively, the govemment need not comply with reporting requirements imposed by the April 26, 2017, Opinion, except as reiterated below: a.e Raw information obtained by NSA's upstream Internet collection undere Section 702 shall not be provided to the FBI, the CIA or NCTC unless it is done pursuant to revised minimization procedures that are adopted by the AG and DNI and submitted to the FISC for review in conformance with Section 702; b.e On or before December 31 of each calendar year, the government shall submite a written report to the FISC: (a) describing all administrative-, civil- or criminal-litigation matters necessitating preservation by the FBI, NSA, the CIA or NCTC of Section 702-acquired information that would otherwise be subject to destruction, including the docket nwnber and 'FOPSHCRIS'Fh'61h'ORCON,1NOFOR"f DATE: Oct 8, 2019 - Authorized Public Release Page 135 of 138 Page 135 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - - 101•&fl!Clll!'fJJ2Jtli etteornne,01u, court or agency in which such litigation matter is pending; (b) describing the Section 702acquired infonnation preserved for each such litigation matter; and (c) describing the status of each such litigation matter; c. The government shal1 promptly submit a written report describing each instance in which an agency invokes the provision of its minimization or querying procedures providing an exemption for responding to congressional mandates, as discussed in Part JV.D.3 above. Each such report shall desciibe the circumstances of the deviation from the procedures and identify the specific mandate on which the deviation was based; and d.e The government shall promptly submit in writing a report concerning eache instance in which FBI personnel receive and review Section 702-acquired information that the FBI identifies as conceming a United States person in response to a query that is not designed to find and extract foreign-intelligence information. The report should include a detailed description of the infonnation at issue and the manner in which it has been or will be used for analytical, investigative, or evidentiary purposes. It shall also identify the query tenns used to elicit the infonnation and provide the FBl's basis for concluding that the query was consistent with applicable minimization procedures. The govemment need not file such a repo11 for a query for which it files an application with the FISC pursuant to Section 702(f)(2); and (4) For the reasons stated herein, the government shall comply with the followinge requirements: a.e The government shall submit repo11s to the Court on a quarterly basis,e beginning not more than 90 days after the issuance of this Memorandum Opinion and Order, on I.•• .1111/ R 11.1 :1.illls:ifJlta@t ,H;1r,c iiJilOHtd DATE: Oct 8, 2019 - Authorized Public Release Page 136 of 138 Page 136 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release his repmt shall: (i) describe the communications to or from a Section 702 target describe methods the government is using to monitor compliance with the abouts limitatio and report on the results of such monitoring; No later than ten days after tasking for upstream collection under Section 702 a ill comply with the abouts ii) explain how limitation; and (iii) describe steps that will be taken during the course of the proposed acquisition ·sonly acquhing communications to or from to ensure tha authorized Section 702 targets; c.o By January 31, 20 I 9, the government shall make a written submission: (i)o t acquireswith the assistance of downstream describin providers under Section 702; and (ii) stating to what extent erives from any communication(s), and if so, whether those communication utho1ized Section 702 targets. For any communications that 1 authorized Section 702 target, the government's submission shall describe the source and nature of those communications, to include a description of the patties thereto; - - 11QPOEiBE'.iflSlt'.CR@Cll?IOFOPll I. DATE: Oct 8, 2019 - Authorized Public Release Page 137 of 138 Page 137 FISC Opinion, Oct. 2018

Document regarding the Section 702 2018 Certification ODNI Authorized for Public Release - TOP SFCRFTf'fl'fORGON'NOFORN d.e By January 31, 2019, the government shall submit a written report thate describes the types of infom1ation acquired by the FBI u11der Section 702 that the government regards as metadata and the extent to which such metadata can reveal location infonnation about U.S. persons; and e.e In the event the FBJ recognizes unminimized Section 702�acquired infonnatione in a system defined by Section III.F.5 or lll.F.6 of its September 18, 20 I 8, Minimization Procedures, and seeks to retain such information in that system, the government shall repo1t in its next quarterly report concerning compliance matters under Section 702: (i) whether the infonnation could be retained on an FBI classified-email or instant-messaging system as described in Section 111.F.4 of those procedures, or in connection with litigation matters as described in Section 1111.3 of those procedures; and (ii) if not, the reason retention of the infom1ation in that system is necessary to the purposes served by that system. ENTERED this - If_ day of October, 20 I 8.e 'fOP SElCRl!:'f'lmlHORCOPJ,'M0FOR.� DATE: Oct 8, 2019 - Authorized Public Release Page 138 of 138 Page 138 FISC Opinion, Oct. 2018