Court Chides F.B.I., but Re-Approves Warrantless Surveillance Program

WASHINGTON — For a second year, the nation’s surveillance court has pointed with concern to “widespread violations” by the F.B.I. of rules intended to protect Americans’ privacy when analysts search emails gathered without a warrant — but still signed off on another year of the program, a newly declassified ruling shows.

In a 67-page ruling issued in November and made public on Monday, James E. Boasberg, the presiding judge on the Foreign Intelligence Surveillance Court, recounted several episodes uncovered by an F.B.I. audit where the bureau’s analysts improperly searched for Americans’ information in emails that the National Security Agency collected without warrants.

Rather than a new problem, however, those instances appeared largely to be additional examples of an issue that was already brought to light in a December 2019 ruling by Judge Boasberg. The government made it public in September.

The F.B.I. has already sought to address the problem by rolling out new system safeguards and additional training, although the coronavirus pandemic has hindered the bureau’s ability to assess how well they are working. Still, Judge Boasberg said he was willing to issue a legally required certification for the National Security Agency’s warrantless surveillance program to operate for another year.

“While the court is concerned about the apparent widespread violations of the querying standard,” Judge Boasberg wrote, “it lacks sufficient information at this time to assess the adequacy of the F.B.I. system changes and training, post-implementation.”

Because of that, he added, the court concluded that “the F.B.I.’s querying and minimization procedures meet statutory and Fourth Amendment requirements.”

Judge Boasberg’s term as presiding judge on the special wiretapping court will end next month, after a tumultuous two years that also included the handling of its response to a damning inspector general report about errors and omissions in applications for traditional national security warrants to wiretap a Trump campaign adviser for the Justice Department’s Russia inquiry.

Chief Justice John G. Roberts Jr. has selected Judge Rudy Contreras to succeed Judge Boasberg in that role, said a person familiar with the matter.

The position of presiding judge has taken on particular importance in recent years. While Congress created the court — in the Foreign Intelligence Surveillance Act of 1978, or FISA — to review evidence in individual wiretap applications for national security investigations, the presiding judge also handles oversight of the National Security Agency’s warrantless surveillance program.

The program grew out of the once-secret Stellarwind project, which President George W. Bush started after the Sept. 11, 2001, attacks, based on a claim that his executive powers could override the FISA warrant requirement. In 2008, Congress legalized the practice, enacting a law known as Section 702 of the FISA Amendments Act.

That law authorizes the government to gather, without warrants, the phone calls and internet messages of noncitizens abroad with assistance from American companies, like Google and AT&T — even when the foreign target is communicating with an American, raising the question of what the rules should be for Americans’ messages that get swept in.

The surveillance is carried out by the National Security Agency, but three other entities — the C.I.A., the National Counterterrorism Center and the F.B.I. — also receive access to streams of “raw” messages intercepted without a warrant for their analysts to use. Of those, the F.B.I. is the only one that also has a law enforcement mission, heightening the stakes.

The F.B.I. receives only a small portion of the messages that the National Security Agency vacuums up: The bureau gets copies of intercepts to and from targets who are deemed relevant to a full and active F.B.I. national security investigation. Presently, that amounts to about 3.6 percent of the National Security Agency’s targets, a senior F.B.I. official told reporters in a news briefing on Monday.

(That could still be a sizable amount of information. In 2019, the most recent year for which data is public, the program had more than 200,000 targets.)

In early 2018, when Congress extended Section 702, it amended the law in part to require approval every year by the Foreign Intelligence Surveillance Court of procedures limiting how and when analysts may query the repository for information about Americans.

Later in 2018, Judge Boasberg ruled that the bureau’s procedures were inadequate to meet Fourth Amendment privacy standards. He required the F.B.I. to write down a specific reason for why each search for an American’s information was likely to return foreign intelligence information or evidence of a crime. The Trump administration appealed that ruling but lost.

In late 2019, Judge Boasberg went on to scold the F.B.I. over episodes it reported to the court in which auditors found that analysts had improperly searched the repository. For example, an F.B.I. analyst in August 2019 had made a query for information using the identifiers of about 16,000 people, even though only seven of them had connections to an investigation.

His new ruling said an audit had uncovered several more episodes from around the same time.

For example, from April to July 2019, an employee in an F.B.I. field office conducted about 124 queries using identifiers for people who did not meet the standards, including community leaders who had applied to participate in a “Citizens Academy” to better understand the role of federal law enforcement, and people entering the F.B.I. office to perform repairs or to provide tips or report they were crime victims.

In a similar episode, from August to October 2019, a task force officer in another office conducted 69 improper queries, the ruling said.

Other reported violations involved analysts who failed to opt out of querying raw FISA information for purposes that did not meet its standards, like 110 searches an official conducted for an analytic paper. The ruling did not give a date for those improper queries.

The government on Monday also disclosed the annual set of rules for the agencies that can gain access to information from the warrantless surveillance program, including procedures for targeting foreigners, “minimizing” information gathered about Americans, and querying limits. While they were heavily redacted in places, Judge Boasberg wrote that they were “largely a status-quo replacement of certifications and procedures” that he had approved in late 2019.