A Letter to Congress on the Impact of Section 702

Most notably, as written, H.R. 6570 could end the Section 702 program entirely. Section 21(d) of the bill enumerates the exclusive provisions of law allowing electronic surveillance, but – in what presumably is a serious drafting error – it fails to include Section 702. As a result, the bill could prohibit electronic surveillance through Section 702 using the compelled assistance of an electronic communications service provider. Ambiguous or erroneously drafted legislation must not imperil America’s safety.

H.R. 6570 contains many other unworkable and dangerous provisions with no basis in the Constitution, statute, or caselaw. Below are just a few examples:

The bill grants unprecedented rights to foreigners. The proposed Section 702(f)(1) would extend to foreign spies and terrorists the same protections proposed to be afforded to Americans just because they might be (or have once been) in the United States. This goes against fundamental principles of decades of surveillance law carefully crafted by both Congress and the courts. Under the proposed provision, if a spy recruiter for the People’s Republic of China was known to be inside the United States, that person could not be the subject of a query under the proposed bill unless he (unlikely) qualified for one of the proposal’s limited exceptions. Moreover, by extending this “protection” to foreign targets communicating with one another, but not with any American at all, the bill would drastically limit the government’s ability to warn Americans that they are the targets of terrorist threats, malicious cyber activity, or espionage operations. Giving foreigners “query protection” does nothing to help Americans’ privacy but will instead endanger Americans.

The bill would seriously undermine cybersecurity efforts. As written, the warrant “exception” for cybersecurity is dangerously narrow and will make it nearly impossible to protect Americans who are victims of foreign cyberattacks every day, let alone recover ransomware payments. Proposed Section 702(f)(2)(B)(i)(IV) purports to allow queries using a “known cybersecurity threat signature.” But it isn’t clear what a “known cybersecurity threat signature” even means. In any case, it apparently wouldn’t cover using actual names, IP addresses or email addresses of targets of malicious cyberattacks. Cybersecurity professionals know that those terms are precisely what’s needed to uncover the type and scope of a foreign cyberattack. The result of adopting this provision is that the government simply won’t be able to warn American citizens, businesses, hospitals, critical infrastructure owners, schools, and others of many imminent cyber threats.

As former national security officials, we believe the House cannot responsibly adopt H.R. 6750. By contrast, H.R. 6611, as reported by the Permanent Select Committee on Intelligence, represents a thoughtful alternative approach to Section 702 reforms. Reasonable minds might disagree on the details of the various reforms that might be needed, even as included in the HPSCI bill. But it presents a rigorous approach to the challenges and attempts in a responsible way to balance privacy protections and our nation’s safety. Enacting H.R. 6750 will, by contrast, greatly hamstring our government’s efforts to protect Americans.

Sincerely,