Every Search of an American Should Carry a Name and a Reason

On September 11, 2013, the 12th anniversary of the attacks, the National Security Agency’s inspector general answered a letter from Sen. Charles Grassley^[1] by listing “12 substantiated instances of intentional misuse” of the agency’s signals intelligence authorities since January 1, 2003. Eight involved a spouse or a current or former partner, most of them foreign nationals. In one, a service member used his first day of access to the collection system to query six email addresses belonging to a former girlfriend, a U.S. person, without authorization. An audit review caught them four days later. He testified that he “wanted to practice on the system” and got no information from the queries. He was demoted. The letter records six referrals to the Justice Department and no charges; seven of the 12 retired or resigned before discipline was imposed.

The letter shows the limits of internal controls: access policed after the fact, discipline that often never arrived and a public that heard the details only because a senator asked.^[2] The system built after September 11 came from good intentions and has not delivered in proportion to its reach. The trouble needs no villain. When you give people powerful tools and vague mandates, they use the tools, and the scope expands. I would keep the tools. Section 702, which lets the government target foreigners reasonably believed to be abroad^[3] and then search what it collects, including information about Americans, should be renewed before it expires in April 2026.^[4] But every search of that collection for an American should carry a written reason, the name of the person who approved it and an audit by someone outside the office that ran it. The rules for who gets searched should be bright lines, published in advance.

Some of the broadest programs returned little. The NSA’s phone-records program under the USA Freedom Act cost the government approximately $100 million and produced 15 intelligence reports,^[5] the Privacy and Civil Liberties Oversight Board reported in 2020, and the FBI received unique information from two of those reports. The NSA did draw on it in analyzing the 2016 Pulse nightclub shooting, so its value was thin rather than zero. In New York, the police department’s Demographics Unit spent more than six years eavesdropping in Muslim neighborhoods and cataloging mosques without producing a lead, the Associated Press reported in August 2012.^[6] “I never made a lead from rhetoric that came from a Demographics report, and I’m here since 2006,” testified Assistant Chief Thomas Galati, who commanded the NYPD Intelligence Division. Still, no one can count the plots that never formed. That uncertainty is the reason to pay for the tools in accountability.

The FBI’s record shows what a vague standard does at scale. A query must be “reasonably likely to retrieve foreign intelligence information,” the Office of the Director of National Intelligence^[3] says, and the FBI could also search solely for evidence of a crime, an authority that a 2024 law largely ended. In an opinion dated April 21, 2022,^[7] the Foreign Intelligence Surveillance Court pointed to “an apparent continued lack of a common understanding of how to apply the querying standard.” In June 2020, FBI personnel ran a batch query of FISA data using identifiers of 133 people arrested “in connection with civil unrest and protests.” The Justice Department concluded that the queries failed the standard; the FBI argued that the arrests themselves made evidence of a crime reasonably likely. Another batch query covered “over 19,000 donors to a congressional campaign.” The analyst said the campaign was a target of foreign influence, but the department found that only eight of the identifiers had “sufficient ties to foreign influence activities.” Many of these examples involved FISA collection other than 702, but an FBI audit found more queries of people tied to protests or the January 6, 2021, Capitol breach, and several, the court wrote, “ran against Section 702-acquired information.” The government reported “in excess of 278,000 non-compliant FBI queries of raw FISA-acquired information.” The court called the FBI’s 702 compliance problems “persistent and widespread.” In a gray area, anyone can justify anything.

Then the FBI and Congress changed the process. In June and August 2021, the FBI began requiring attorney approval for batch jobs of 100 or more queries^[8] and made users “opt in” before a query touched 702 data. The Reforming Intelligence and Securing America Act,^[4] signed April 20, 2024, requires an FBI supervisor or attorney to approve any query using a U.S. person query term, except to address a threat to life or serious bodily harm, and a prior written statement of “the specific factual basis.” By the ODNI’s count, the FBI’s unique U.S.-person query terms fell from about 2.96 million in the 12 months ending November 2021^[8] to 5,518 three years later.^[3] Each year’s FBI figure counts unique terms, a method adopted for the 2022 report and applied back to 2020, though batch jobs almost certainly inflate it.^[9] One 2021 investigation of foreign hackers, with about 1.9 million queries for potential victims, drove most of that year’s jump, so measure from 2020: the fall from about 853,000 to 5,518 is still more than 99%. The ODNI credited the latest decline “in large part” to “the increased focus on technical and policy controls” and to “individual caution” in applying the reforms. The tools did not go dark. In 2024 the NSA, the CIA and the National Counterterrorism Center together approved or used 7,845 U.S.-person query terms in searches that included content, and NSA attorneys had to approve each NSA term before a content search.^[3]

U.S.-person query terms in Section 702 data, by agency, 2017 to 2024

A gray area costs more than the privacy of the people searched. People who feel watched may grow cautious about voicing opinions or joining causes, and self-government needs people who feel free to debate, organize and peacefully protest. The evidence is suggestive. In a 2016 study in the Berkeley Technology Law Journal,^[10] Jonathon Penney tracked monthly views of 48 terrorism-related Wikipedia articles from January 2012 to August 2014. After the June 2013 NSA disclosures, average monthly views ran about 527,000, or 19%, below the earlier average, while comparison groups showed no similar drop. Penney notes that “a true control group was not possible,” so the decline is associated with the disclosures, not proven to follow from them. I doubt most self-censorship is permanent, but it can return, and a public that learns about surveillance mainly from leaks and court filings gives it reasons to.

Public unease has grown, too. In a Pew Research Center survey of 5,101 U.S. adults in May 2023,^[11] 71% said they were very or somewhat concerned about how the government uses the data it collects about them, up from 64% in 2019. Pew traced the rise to Republicans and Republican-leaning independents, whose concern climbed from 63% to 77%, a 14-percentage-point rise; the 2023 margin of error for each party group was 2.4 points.^{[11, p. 55]} Democrats and Democratic leaners held steady, at 66% and then 65%. And 77% said they understand very little or nothing about what the government does with that data. Oversight by a backroom court or panel that no one knows about breeds uncertainty, and uncertainty erodes trust.

Concern about government use of personal data, by party, 2019 and 2023

The case against more friction is strong. In September 2023, the oversight board agreed unanimously that “Section 702 is highly valuable,”^[12] and the two members who dissented from the majority’s report said “not one Member of this Board believes Congress should allow it to lapse.” Many queries protect Americans, like the 2021 searches for hacking victims. Some plots these tools helped stop may still be classified, and the absence of another September 11 may owe something to them. People who say they have nothing to hide are expressing trust in institutions and a desire for safety, and both are reasonable. The FBI’s count fell by more than 99% without a warrant requirement, which the House rejected on a 212-212 tie in April 2024.^[13] Every added approval costs time in cases where hours can matter.

I accept most of that, and it still points to my rules. They require no warrant and no judge: a named approver and a written reason cost less, and the emergency exception stays. That puts me short of the board’s majority, which urged Congress to require the surveillance court’s approval of U.S.-person queries.^[12] The FBI’s falling count suggests up-front controls work. The remaining risk is an approver who accepts a weak reason; the written record and an outside audit exist to catch it. But today’s safeguards are fragile. The Justice Department’s audit of every FBI U.S.-person query within 180 days ends in April 2026,^[4] or sooner if the attorney general certifies an internal FBI audit process. The surveillance court may waive four of the FBI requirements in the 2024 law, the written statement among them, if other measures are “reasonably expected to result in similar compliance outcomes.” The oversight board needs a quorum of three^[14] for much of its statutory work, and on September 9, 2025, its website listed one current member;^[15] an appeals court has stayed a ruling^[16] in favor of two members the president removed. Limits on power protect people with nothing to hide: the service member’s former girlfriend needed no secret to become a search term.

The 2024 law already concedes the principle with supervisor approval, written reasons and a demand for “zero tolerance for willful misconduct.”^[4] The April 2026 renewal should finish the job. Keep the approver and the written reason for every U.S.-person query, and remove the court’s power to waive the statement. Make the 180-day audit permanent. Replace the “reasonably likely” test with published criteria strict enough to work like a checklist: if a query meets seven listed conditions it runs, and if it meets six it does not. Review every year who still needs access; in 2022 the court floated “substantially limiting the number of FBI personnel with access.”^[7] Publish the FBI’s annual report on discipline for noncompliant queries, which the 2024 law sends only to four congressional committees.^[4] And restore the board the 9/11 Commission recommended^[17] to a working quorum. In 2013, the public learned about the service member and his former girlfriend because a senator asked. By the 25th anniversary, no one should have to ask.