Vous êtes sur la page 1sur 148
Ad vitheld information exempt under (b(t) and (b}) uness chenise noted Approved for Pubic Release FOP SECRETE SH/ORCON/NOFORN: QUARTERLY REPORT TO THE FOREIGN INTELLIGENCE SURVEILLANCE COURT CONCERNING COMPLIANCE MATTERS UNDER SECTION 702 OF THE FOREIGN INTELLIGENCE SURVEILLANCE ACT. March 2015 ACLU 16.CV.8936 (RIB) 000580, ‘Ail withthe information exempt under (OK) an (0)(8) unless oervise noted. ‘Approved for Public Release [SLIOREONNOFORN: QUARTERLY REPORT TO THE FOREIGN INTELLIGENCE SURVEILLANCE COURT. CONCERNING COMPLIANCE MATTERS UNDER SECTION 702 OF THE FOREIGN INTELLIGENCE SURVEILLANCE ACT March 2015 TABLE OF CONTENTS (U) INTRODUCTION .. (U) NEW INCIDENTS OF NONCOMPLIANCE. 1. (S) Incidents of Noncompliance with the NSA. Targeting and Minimization Procedures i IL (S//NF) Incidents of Noncompliance with the CIA Minimization Procedures IIL (S) Incidents of Noncompliance with the FBI Targeting ‘and Minimization Procedures 68 IV. (U) Incidents of Noncompliance by an Electronic Communi Service Provider .... B (U) UPDATES ON INCIDENTS OF NONCOMPLIANCE REPORTED IN PREVIOUS REPORTS ‘ACLU 16-CV-896 (vB) coO581 ‘All itheld information exernpt under (1) and (b\(3) uta cries note. ‘Approved for Public Release TOU SECRET SUIORCONNOFORN (U) INTRODUCTION (S) This report is submitted pursuant to Rule 13(b) of the Rules of Procedure for the Foreign Intelligence Surveillance Court (hereinafter, “the Court”) and in compliance with the Court's August 25, 2009, instructions regarding providing timely and effective notification to the Court of compliance issues involving the Government’s implementation of its authorities under Section 702 of the Foreign Intelligence Surveillance Act of 1978, as amended (FISA). As described in a February 4, 2010, letter to the Court, the Department of Justice’s National Security Division (NSD) files prompt notices to the Court regarding compliance matters in several categories of particular concem, This report provides the Court with further information regarding, those incidents and notifies the Court of other compliance incidents that did not fall within the specified categories. (FSHSWOGEANF) This quarterly report covers incidents reported to NSD and the Office of the Director of National Intelligence (ODNI) from December |, 2014, through February 28, 2015. To provide some context to the scope of the Government's collection during this period, the ‘National Security Agency (NSA) reports that, on average, approximately individual facilities! were under task at any given time between December |, 2014, and February 28, 2015. These facilities include those initially tasked under the NSA’s Section 702 targeting procedures during this reporting period, as well as facilities that had been tasked prior to this reporting period, either pursuant to the NSA Section 702 targeting procedures or under the authority of several certifications made by the Attorney General and Director of National Intelligence (DNI) pursuant to the Protect America Act of 2007, Pub. L. No. 110-55, 121 Stat. 552 (Aug. 5, 2007) (hereinafter, “Protect America Act” or “the PAA”). Additionally. between) ¢SHNB) NSD and ODNI conduct oversight of NSA’s, the Central Intelligence Agency's (CIA), and FBI’s use of Section 702 authorities. This oversight occurs in two principal manners. First, the vast majority of the incidents discussed below were initially reported by the reviewed agencies themselves. NSD and ODNI inquired about and, where appropriate, investigated the compliance matters discussed herein. Second, NSD and ODNI conducted targeting and minimization reviews at each of these agencies to ensure compliance with the procedures.* Sooners * (S) Minimization procedures also govern the National Counterterrorism Center's (NCTC) review of previously sd Section 702-acquired information in limited situations. Specifically, NCTC is not currently authorized to ‘unminimized Section 702 data. However, NCTC ingests data from FBI systems which contain minimized Section 702 information. Because NCTC is not a law-enforcement agency, it may not receive disseminations of. n 702 information that is evidence of a crime, but which has no foreign intelligence value. NCTC’s imization procedures are very limited in scope, and are primarily designed to require purging in situations in which NCTC personnel discover purely law enforcement information in the course of reviewing Section 702-acquired ACLU 16-CV-8936 (RMB) 000582 All ihineld information exempt under (0X1) and (bY) unless athenvise noted ‘Approved for Public Release 2 /SWORCONANOFORN ‘Targeting reviews included an offsite review by NSD of facilities tasked by NSA, with a subsequent onsite review by NSD and ODNI at NSA and (when appropriate) CIA or FBIto uestions raised during the initial offsite review. For IDNI also conducted onsite minimization reviews at NSA, CIA, and FBI, with ‘a particular focus on these agencies’ dissemination of United States person information. Compliance incidents discovered during any of these targeting and minimization reviews are described in more detail below. (U) For ease of reference to the Court, this report contains the text, modified only for internal consistency, of the latest Rule 13(b) notice regarding each compliance matter previously reported. Any additional information obtained since the filing of the latest Rule 13(b) notice is clearly delineated. Ni (U) NEW INCIDENTS OF NONCOMP! I.) Incidents of Noncompliance with the NSA Targeting and Minimization Procedures ¢S) Below are descriptions of incidents involving noncompliance with the NSA targeting and minimization procedures. There have been four primary categories of incidents of noncompliance with the NSA targeting procedures during this reporting period. The first category involves incidents where noncompliance with the targeting procedures resulted in an error in the initial tasking of the facility. ‘The second category involves incidents in which the facility was properly tasked in accordance with the targeting procedures, but errors in the detasking of the facility caused noncompliance with the targeting procedures. The third category involves incidents in which a facility was properly tasked and (when necessary) detasked in accordance with the targeting procedures, but a notification requirement contained in the targeting procedures was not satisfied. The fourth category involves incidents where the determination to target a facility was not properly documented as required by the targeting procedures. In addition, fj incidents involving NSA’s minimization procedures nll other incidents are reported below. In some instances, an incident involved more than one type of noncompliance. Such incidents are discussed below only once, although each type of noncompliance has been noted where appropriate. AESUSHINE) Regarding Purges Discussed in this Report, Many of the compliance incidents in this report required NSA to purge Section 702-acquired data from appropriate systems. As the Court is aware, NSA revised its purging process in 2010 in response to prior deficiencies in its purging practices. NSA has identified and applied a certification process to systems that handle Section 702-acquired data. To the extent that NSA has officially certified a system, the Government believes that the system is compliant with the purge requirements of the NSA Section 702 targeting and minimization procedures, and information cither in FBI systems or in NCTC systems which have directly ingested the information, No incidents of noncompliance with the NCTC minimization procedures were identified during this reporting period. ACLU 16-0¥-8095 (RIB) 000583, All itheld information exempt under (1) and (b(9) unless trervise noted ‘Approved for Public Release ‘FOP SECRET /SW/ORCONNOFORN thus will be able to properly execute purging actions. NSA has also developed a Master Purge List (MPL)* to be used to document and assist in the application of its purge practices, (ESHSHANE) The relevant purge dates in this report for NSA reflect not the date on which NSA removed the data from its systems, but rather the date on which the unique identifiers of the objects® to be purged were added to the MPL.” once an Object is on the MPL it may not be used to source FISA a reporting absent a waiver or other legal ‘occur as part of a separate action, but in all cases adding the communications to the MPL prevents their use in NSA. reporting and FISA appli *eHBWANE) As stdin the Dict of SA's fiat ed oI 200 ok (hereinafter “DIRNSA affidavit"), “NSA has used its existing records of past purge actions across all authorities to create [the MPL]. This list includes the identifiers oFunique items purged from select NSA systems. DIRNSA affidavit at 4 we ee mses ES REESE Hee] SPORES NOEGRS, ACLU 16-CV-2036 (RMB) 009584 hed information exempt under (b).) and (bY) unless otherwise noted. ‘Approved for Public Release ORSke SHORCONNOFORN ESHSHNE) For each incident requiring a purge, NSA also has a process to identify and, as appropriate, revise or recall reporting based on the purged collection. quarterly report indicates (for every incident requiring a purge) whether NSA's above- described process has identified any disseminated reports based upon the purged objects at issue and, if so, the disposition of those reports. «S#NB) CIA and FBI receive unminimized data from many Section 702-tasked facilities, and at times are thus required to conduct similar purges.” For each incident requiring the purging of data, NSD has confirmed with CIA and FBI that either: (1) CIA and FBI received no data from NSA that required purging; or (2) CIA and/or FBI have completed the required purge. When a CIA or FBI purge was required, its oceurrence is noted in this report. When a required purge for any of the agencies has not been completed, this is also noted. a ae ‘FOP SECRETE SHORCONNOFORN . 4 ACLU 16.0V.8936 (RIB) 000585, [All witheld information exempt under (b1) and (0)(3) unless inenvise note ‘Approved for Public Release purge of this system. If any FBI personnel had accessed the now-sequestered| records, FBI contacts these individuals to determine whether the data has been {S#NP) Like the other agencies, FBI similarly reports that its purge process generally does not extend to temporary archives utilized for backup purposes.'? These archives are only accessible to FBI technical personn ‘BI reports that these archives have limited capacity, ¢S) (A) Tasking Errors, The following incidents involved noneompliance with the NSA targeting procedures that resulted in an error in the initial tasking of the facility." "\{S4NF} In notices filed in May and July 2014 and March 2015, the Government advised the FISC of gaps inthe FBI's purge process and the FBI's resolution ofthe matter. " (ups6) In a notice filed on October 1, 2013, the Government advised the FISC that there were multiple instances in ‘On November 14, 2013, he Attorney General and Director ‘Of Natfonal Intelligence approved amended cerlificaions which include amended minimization procedutes for FB that permit FBI to process and retain raw Section 702-aequired information, subject to certain conditions and restrictions, in ad hoe FBI databases in order to conduct additional analysis of the Section 702-acquired information. The FISC approved these minimization procedures on December 13, 2013. a ‘2 (S4NE)_FBI advises that as an added precaution, FBI conducts purges of one temporary backup archive} ACLU 18:CV-8998 (RMB) 000586, Approved for Public Release This page intentionally left blank. ACLU 16-CV-8936 (RMB) 000587-000636 ‘Allield information exempt under (1) and (D1) unless terse note. ‘Approved for Public Release ¢S) (C) Noncompliance with a Notification Requirement. ¢SHNSA’s targeting procedures require NSA to report certain incidents to NSD and ODNI even if these incidents do not involve noncompliance with the targeting procedures. Specifically, NSA is required to terminate acquisition and notify NSD and ODNI if “NSA concludes that a person is reasonably believed to be located outside the United States and after targeting this person learns that the person is inside the United States, or NSA concludes that a person who at the time of targeting was believed to be a non-United States person was in fact a United States person.” NSA Targeting Procedures at 8-9. This not ation must occur within five business days. {S} In addition to other notification issues noted in incident descriptions above, during the period covered by this report, there have beerf§jj incidents involving circumstances in which NSA did not notify NSD and ODNI within the required five business days. In the remaining incidents, a facility NSA reasonably believed to be used by a non-United States person was found to be used by a United States person. Reporting delays ranged from one to 131 business days, with an average delay of approximately 19 business days. NSA advised that it acquired no relevant data from the taskiny facilities, NSA advised that - With respect to the remaining facility, NSD is still confirming the necessary purges at NSA. ¢S) CIA advised that it was [EE Section 702 data for MJ of the ff incidents. CIA Be ae pate aS ner ama = MineweES eeer 8) (D) Noncom ince with Documentation Requirements. 48) The fourth category of incidents involved noncompliance with the documentation requirements of the NSA targeting procedures. The NSA targeting procedures approved for use in each certification require that NSA’s documentation concerning each tasked facility contain a citation to the source of information upon which the determination was made that the user of that - — aS a RE] 48} There were instances in which the respective delays were 131 and 53 business days. due to incident reports beng inadvertently lost by an agency. Otherwise, the longest delay was 13 business days. Without tose insancos, the average delay was approximately four days. 56 ACLU 16-CV-8835 (RMB) 000837 [Al withheld information exempt under (1) and (9) urigss others note, Approved for Public Release facility was reasonably believed to be located outside the United States (the “foreignness determination”) and identify the foreign power or foreign territory about which NSA expects to obtain foreign intelligence information pursuant to the tasking. According to the procedures, the purpose of the citation is to “enable those responsible for conducting oversight to locate and review the information that led NSA analysts to conclude that a target is reasonably believed to be outside the United States. ¢) According to requirements set forth in the NSA targeting procedures, NSD and ODNI conducted regular Section 702 oversight reviews in order to evaluate NSA’s implementation of its targeting procedures. Two such reviews occurred during this reporting period. During the review, NSD and ODNI identified isolated instances in which NSA may not have complied with the documentation requirements in the targeting procedures. Of the approximately [IM taskings assessed during the reporting period of reviews, NSD and ODNI have, to date, identified approximately ff] instances in which NSA may have failed to cite sources that NSD and ODNI assessed were adequate to demonstrate a reasonable basis for believing that the user of the account ‘was located outside the United States. Additionally, NSD and ODNI have identified approximately fj instances in the course of these bimonthly reviews in which NSD and ODNI are still attempting to determine whether NSA cited sources that NSD and ODNI assess are adequate to demonstrate a reasonable basis for believing the user of the account was located outside the United States. During the reporting period, NSA reported no instances in which it identified taskings based upon similarly insufficient documentation, ¢S) (E) Minimization Incidents {5} @) Incomplete Purge This nt was initially reported fo the Court in a Rule 13(b) notice filed on 2014. As detailed in that incident rezarding NSA retention of information| a= re FISA that NSA analysts marked for purge with the disposition code IM] were incorrectly posted to the MPL| ying the purge process for those objects. ler objects marke MPL, they are processed for purge completion, Es Ay objects a ee to FISA and oe 2% ($} The Government is investigating adcltional incidents FOP SECRET SH/ORCONOFORN 37 ‘ACLU 16-¢V-8896 (RMB) 000638 [All wthheld information exert under (1) and (08) unless ctPeruse note, ‘Approved fr Public Release /SHORCONNOFORN 2014, NSA personnel recognized and attempted to = correct the errors| ae — letion of the} CESHSHENE) On| 201 cd the error and began the process of purging the| ‘objects. As of 2014, all of the misidentified objects were placed on the MPL in purge state. The Government will further update the Court on the disposition of affected communications related to this ineident. “Objects was delayed when they were placed on the MPL fj] (U) NSA informed NSD and ODNI of this incident on NN 2014. €S) (2) Query Using United States Person Identifier €FSHSHANF) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA ‘that all results had expired from NSA systems by 2014. NSA further advises that the relevant personnel have been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on [EE 2014. {5} 3) Overly-Broad Query FSHSHANE) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that on [omar 2014, an analyst conducted an overly broad search against data acquired from multiple authorities, including Section 702. NSA advises that the analyst realized his error imediately, canceled the query, and deleted the corresponding results. NSA further advises that the analyst has been reminded of the Section 702 query requirements. eee apcagueipe ose EET pe HORSE CCL ES ORCONAOLORY, 38 ACLU 16-CV-8036 (RMB) 000630 Ad witheld information exempt under (01) and (D1) unless otherwise note. ‘Approved for Public Release /SWORCON/NOFORN (U) NSA informed NSD and ODNI of this incident on 2014. «S} (4) Overly-Broad Query -CESHSHANE)-According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key ‘words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that on 2014, an analyst conducted an overly broad search against data acquired from ‘multiple authorities, including Section 702. NSA advises that the analyst recognized the error upon viewing the results, and immediately deleted the results. (U) NSA informed NSD and ODNI of this incident on A. 2014. ¢S} (5) Query Using a United States Person Identifier EESHSHINE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA reported that al 2014, an NSA analyst used the identifier of a United States person, subject fo acquisition pursuant to Title I and 705(b), as part of a query against data acquired from multiple authorities, including Section 702 upstream data. ‘The Uni person identifier had not been approved as a query term in accordance with NSA internal procedures, and querying United States person information against Section 702-acquired "upstream collection is barred by the minimization procedures. On| 2014, an ‘NSA auditor discovered the error, and NSA advises that the query and its results were deleted the same day. NSA further advises that the analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on JM. 2014. ¢S) (6) Overly-Broad Query FSHSHANE) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[eJomputer selection terms used for scanning, such as telephone numbers, key ‘words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that on 2014, an NSA analyst, due to a typographical error, inadvertently conducted an overly broad query against data acquired from several authorities, including Section 702 data. NSA advises that the query returned no results, and that the analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of th s incident on AM, 2014 ORS ECR ORCONNOFORN: 39 ACLU 16.Cv.8936 (RIB) 000640, All ined information exempt under (61) and (ONS) unless tense rote, ‘Approved for Public Release SHORCOSSOFORS €8) (2) Overly Broad Queries EESHSHANE) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other dise ‘will be limited to those selection terms reasonably likely to return forei n” NSA reported that on |, 2014, an NSA analyst conducted, due to incorrectly formule searches, overly broad queries against data acquired from several authorities, including Section 702. Upon seeing the results, the NSA analyst realized the error and deleted the results. NSA advises that the analyst has been reminded of the Section 702 query requirements (U) NSA informed NSD and ODNI of this incident on AM. 2014. ¢S) (8) Overly Broad Queries EESUSHANE) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms te likely to return foreign intelligence information.” NSA reported that in 2014 an NSA analyst conducted, due to incorrectly formulated searches, overly broad queries against data acquired from several authorities, including Section 702. NSA advises that the relevant personnel have been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on I) 2015. €S) (9) Overly-Broad Query FSHSWANE) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that on 2014 an NSA linguist conducted an overly broad query against data acquired from several authorities, including Section 702. : ai 2014, an NSA auditor discovered the inappropriate query. NSA advises that query results have aged off NSA. systems. NSA further advises thatthe linguist has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on [EE 2015. ¢S} (10) Overly-Broad Query ESHSHANE) According to section 3(b(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key 60 ACLU 16.6V.895 (RIB) 000841 [Allithbeld information exempt under (1) and (9) unless otPerwise note, ‘Approved for Public Release [SHORES SHOR words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that of |, 2015, an NSA analyst conducted, due to an incorrectly formulated| search, an overly broad query against data acquired from several authorities, including Section 702. The NSA analyst immediately realized the error, and deleted the results. NSA advises that the analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on [I 2015. €S} (11) Query Using a United States Person Identifier ESHSHINE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream-collection techniques. NSA reported that on EM) 2015, an NSA analyst used a| wrt of a query against multiple authorities, including Section 702 upstream data. The| ear had not been approved as a query term in accordance with NSA internal procedures, and querying United States person information against Section 702-acquired upstream collection is barred by the minimization procedures, NSA advises that all results were deleted - a 2015. NSA further advises that this analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of th incident on |. 2015. {5} (12) Query Using a United States Person Identifier ESHSUINE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. NSA reported that o 2015, an NSA analyst used a presumed United States person’s facility® as part of a. query against multiple authorities, including Section 702. The facility had not been approved as a query term in accordance with NSA internal procedures. On 2015 ai NSA auditor discovered the error, and the results were deleted. NSA further advises that this analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on EE 2015. 4S) (13) Query Using a United States Person Identifier ESHSHANE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, ACLU 16-Cv-8996 (RIB) 000642. ‘All ined information exempt under (b\) and (2)() unless athervise noted. ‘Approved fr Public Release [:SHORECONNOFORN such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA reported that aa 2015, an NSA analyst used a United States person’s e-mail account as part ofa query against multiple authorities, including Section 702 upstream data.%° The United States person identifier had not been approved as a query term i accordance with NSA internal procedures, and querying United States person information against Section 702-acquired upstream collection is barred by the minimization procedures. Upon reviewing the results, the analyst recognized the error and reported the matter. NSA further advises that this analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident ¢S) (14) Query Using a United States Person Identifier FSUSHANE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA reported that on IEEE 2015, an NSA analyst used a United States person identifier as, part of a query against multiple authorities, including Section 702 upstream data. The United States person identifier had not been approved as a query term in accordance with NSA internal procedures, and querying United States person information against Section 702-acquired upstream collection is barred by the minimization procedures. NSA advises that all results were deleted orf. 2015. NSA further advises that this analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on AM, 2015. {S) (15-16) Queries Using United States Person Identifiers FSHSHASE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures Additionally, section 3(b(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. In it was analyst that some of the selectors were used by United States Consequently, the NSA analyst used the United States person identifiers as part of| queries against data acquired from multiple sources, possibly including Section 702- acquired upstream data. The United States person identifiers had not been approved as FOP SECRETARY SH/ORCON/NOFORN a ACLU 18-Cv-8936 (RIB) 000643 ‘ll wield information exempt under (b\1) and (bX9) unless atherwise noted Approved for Public Release es /SWORCONNOFORN query terms in accordance with NSA internal procedures, and querying United States person information against Section 702-acquired upstream collection is barred by the minimization procedures. On]. 2015, the NSA analyst discovered the error, and. attempted to discontinue the queries. However, due to an unknown error, additional queries were conducted using some of the United States person selectors on one additional occasion. NSA advises that all results from all queries were deleted. NSA further advises that the relevant personne! have been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on I. 2015 ¢S) (1) Overly-Broad Query ESHSHINE) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[c]omputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that on [S BB. 2015, an NSA analyst conducted an overly broad query -_ data acquired from several authorities, including Section 702-acquired data. On| |, 2015, an NSA auditor discovered the inappropriate query, and the results of the query were deleted that same day. NSA advises that the analyst has been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on [EM 2015. 18) Impro) munications EFSHSHANE) According to Section 5 of NSA’s Section 702 minimization procedures, domestic communications must “be promptly destroyed upon recognition unless the Director (or Acting Director) of NSA specifically determines, in writing, and on a communieation-by-communication basis, that the sender or intended recipient of the domestic communication had been properly targeted under section 702 of the Act, and the domestic communication satisfies one or more of” several enumerated conditions. NSA advises that on| 2015, an NSA analyst improperly disseminated a domestic communication. On 2015, the analyst recognized the error, recalled the dissemination, marked the communication for deletion, and reported the matter. incident on IY 201 5. (U) NSA informed NSD and ODNI of thi 0 2) ESHSHANE) This incident involves the hr NSA’s minimization procedures permit NSA to provide unminimized Section 702-acquired communications to FBI and CIA. ACLU 16.c¥-89964RMB) 990544 ‘All itield information exempt under (01) and (19) unless otherwise noted Approved fr Public Release NSA emergency detasked the facility on (U) NSA informed NSD and ODNI of this incident on [EE 2015. €ESYSHENE) This incident involves the improper NSA°s minimization procedures permit NSA to provide unminimized Section 702-acquired communications to FBI and CIA,| Ea ee | (U) NSA informed NSD and ODNI of this incident on 2015. {8} (21) Improper Dissemination of Information Concerning a United States Person (SNE) This incident involves the dissemination of United States person information in a manner contrary to the requirements of Section 6(b) of NSA’s Section 702 Minimization Procedures. Specifically, on AM 2015, an NSA analyst discovered that NSA issued a report which included 1 2 United States person whose identity was not foreign intelligence information. On [REE 2015, NSA recalled the report and reissued it without the United States person information. (U) NSA informed NSD and ODNI of this incident on EE 2015. ¢S} (22) Improper Dissemination of Information Concerning a United States Person (S4NF) This incident involves the dissemination of United States person information in a manner contrary to the requirements of Section 6(b) of NSA’s Section 702 Minimization Procedures. Specifically, on MEE 2015, NSA issued a report which contained names of United States persons whose identities were not foreign intelligence information. * CREE analyst discovered the error and notified NSA. On RR 2015. NSA recalled the report and reissued it without the United States person eae information. ot ACLU 16-cV-8036 (RMB) cOO845 Al wtield information exempt under (01) and (b}@) unless cherie noted, ‘Approved for Public Release /SHORCONNOFORS (U) NSA informed NSD and ODNI of this incident on [RM 2015. ¢S) (23) Query Using a United States Person Identifier SHSHANE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA. reported that on [IEE 2015, an NSA analyst used a United States person identifier as part of query against multiple authorities, including Section 702 upstream data. The United States person identifier had not been approved as a query term in accordance with NSA internal procedures, and querying United States person information against Section 702-acquired upstream collection is barred by the minimization procedures. NSA advises that all results were deleted on [E, 2015. NSA further advises that the relevant personnel have been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on EE. 2015. ¢S) (24) Query Using a United States Person Identifier GSHSYANE) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA intemal procedures. NSA reported that on [EE 2015, an NSA analyst mistakenly used United States person identifier as part of a query against multiple authorities, including Section 702 data. Although the query did not run against upstream-acquired data, the United States person identifier had not been approved as @ query term in accordance with NSA internal procedures. An NSA auditor discovered the error — 2015, and all results were deleted a 2015. NSA further advises that the relevant personnel have been reminded of the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on I 2015. ¢8) (25) Overlv-Broad Query This incident was ially reported to the Court in a Rule 13(b) notice filed on 2015. As detailed in that notice, NSA reported that an NSA analyst conducted overly broad queries the previous day. The queries at issue were of NSA repositories containing information collected under multiple authorities, including NSA Section 702 upstream collection. While cunning fi] queries, the analyst used terms and phrases, which if connected together properly, would have limited the selection terms to those reasonably designed to retum foreig The analyst, however, inadvertently constructed the queries using| Jesulting in.an extremely large number of search results. Due to the error, the resulting queries were not FOP SECRETE SHORCONNOFORN 65 ACLU 16-C¥-8936 (FMB) 000646, _Alwitbeldinormation exempt uner (1) ae (0G) unless athernse noted Aeproved fo Public Release HORSE CRE IH OR CONS OLORS limited to those terms reasonably designed to return foreign intelligence information. On = 2015, NSA deleted all results from these queries. NSA has not identified any reporting that resulted from foreign intelligence information returned by these queries, and advised that the analyst has been reminded of applicable query requirements in the SMPs. lent on I 2015.57 (U) NSA informed NSD and ODNI of this in (U) (F) Other Issues (1) Unauthorized Access to Section 702 Data PSHSHANE}-According to section IV of NSA’s Section 702 targeting procedures, raw Section 702 data must be stored in authorized repositories and accessed only by authorized personnel. NSA advises that o 2014, an analyst e-mailed a “tip” containing unminimized Section 702 collection to NSA employees who were not authorized to receive the data, NSA advises that the unauthorized recipients did not further disseminate the information and that the e-mails were deleted. NSA also advises that the information was subsequently assessed to be foreign intelligence information and properly disseminated. NSA further advises that the relevant personnel have been reminded of the Section 702 data access requirements. (U) NSA informed NSD and ODNI of this incident on J 2014. 2) Unauthorized Access to Section 702 Data EFSHSHANF) According to section IV of NSA’s Section 702 targeting procedures, raw Section 702 data must be stored in authorized repositories and accessed only by authorized personnel. NSA advises that a, 2015, an analyst stored unminimized Section 702 collection in a particular database from whicl{{j NSA employees, who are not authorized to do so, reviewed the Section 702 data. NSA advises that the unauthorized recipients did not further disseminate the information and that the information was deleted from the database. NSA also advises that the relevant personnel have been reminded of the Section 702 data access requirements. (U) NSA informed NSD and ODNI of this incident on EE. 2015. 4S) G) Unauthorized Access to Section 702 Data ¢FSHSUANE) According to section IV of NSA’s Section 702 targeting procedures, raw Section 702 data must be stored in authorized repositories and accessed only by authorized personnel. NSA advises that a, 2015, an analyst attempted to (U) In the IY 2015, ener, the government incorrectly advised that NSA reported the matter on 20s. * ($} The government is still investigating one possible incident. ACLU 16-CV-3896 (RMB) 000647 thea information exempt under (b\1) and (bY) uniess otherwise note. Approved for Pubic Release J HHEOR COD A.OFORN coordinate, via e-mail, a report containing Section 702-acquired information with ij language analysts. When sending the e-mail, the analyst mistyped one of the language analyst's names, and the e-mail was inadvertently sent to an employee detailed to NSA BRIE «30:05 00% cutrorized to review uninimized Section 702 data. Upon scanning the e-mail on [IM 2015, the detailee recognized the error and reported the matter. NSA advises that the detailee did not further disseminate the information and that the e-mail was deleted. NSA advises that the relevant personnel have been reminded of the need to carefully review e-mails prior to sending. (U) NSA informed NSD and ODNI of this incident on [EN 2015. ¢$) (4) Unauthorized Access to Section 702 Data FSHSHNF)-According to section IV of NSA’s Section 702 targeting procedures, raw Section 702 data must be stored in authorized repositories and accessed only by tutorized personnel, NSA advices het, AT 2 used by NSA instructors and students contained raw Section 702 data. On| 2015, an NSA instructor who was not authorized to access raw Section 702 data reviewed a student's Section 702 work product [EEE -” The instructor recognized the error and om the matter. NSA advises that all Section 702 data was purged| 2015. (U) NSA informed NSD and ODNI of this incident on [A 20115. (5) Unauthorized Access to Section 702 Data EESHSHANE) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[eJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” According to section IV of NSA’s Section 702 targeting procedures, raw Section 702 data must be stored in authorized repositories and accessed only by authorized personnel. While an analyst was assigned to a particular group, the analyst received the daily results of queries run against Section 702 data, When the analyst was reassigned i access to the results of those daily queries should have been removed. OF 2015, an NSA auditor discovered that the analyst still had access to the query results. NSA advises that the analyst’s access ‘was removed on| 2015, and that the analyst did not view of any the query results after being transferred in (U) NSA informed NSD and ODNI of this incident on JM, 2015. ° (83 ‘The instructor had a pending request for authorization to access raw Section 702 data FOP SECRETE SHORCONNOFORN or ACLU 16.CV-806 (RMB) c00648, {All wtheld information exempt under (1) and ((@) unless otherwise noted, Approved fr Public Release SHORCON ORO t this ¢S) (@ Reported Incidents that Appe eto Not Be Compliance Incidents. (SHANE) NSA is required to report to NSD and ODNI incidents other than those it assesses to be compliance matters. The NSA’s targeting procedures require that whenever NSA “concludes that a person is reasonably believed to be located outside the United States and after targeting this person learns that the person is inside the United States, or if NSA concludes that a person who at the time of targeting was believed to be @ non-United States person was in fact a United States person,” NSA must terminate the acquisition without delay and report the incident to NSD and ODNI. NSD reviews each of these incidents and, as necessary, asks questions of NSA or other relevant agencies regarding the initial tasking and the subsequent detasking of facilities used by these targeted individuals to ensure that no compliance incident has in fact occurred. It is also NSD's practice to confirm with each ageney that may have received the unminimized acquisitions from a facility involved in one of these incidents that the agency has completed any purges required by the procedures. NSD does not consider a reported incident to be closed until all outstanding questions have been answered and all purges have been confirmed. ¢S) This quarterly report includes all incidents reported to NSD and ODNI between December 1, 2014, and February 28, 2015, determined to be compliance matters. There are, however, approximately J incidents for which NSD is awaiting additional information before deciding that these incidents can be closed. II. (U) Incidents of Noncompliance with the CIA Minimization Procedures {SHNE) CIA does not task facilities under the Section 702() certifications, though it can nominate facilities to be tasked by NSA. CIA does, however, receive raw, unminimized data as a result of NSA’s and FBI's acquisition of foreign intelligence information under the certifications. CIA must minimize such information in accordance with CIA’s minimization procedures. Di the reporting period, NSD and ODNI have conducted one review of CIA's application of its minimization procedures. (U) During the reporting period, the government reported no instances of noncompliance with CIA’s procedures, m1. nce with the FBI Targeting or Minimization Procedures ‘ACLU 16-v-8906 (RIB) 000649, ‘Ail the information exempt under Xt) and (bX) unis ahense note. Approved fr Public Release FOP-SECRET ABB /SH/ORCON/NOFORN ee a as Joint targeting reviews during the reporting period in order to monitor FBI's targeting practices. ‘) NSD. ‘and ODNI conducted one joint minimization review during the reporting period in order to monitor FBI’s minimization practices. ¢S) During the reporting period, the following compliance incidents were identified." (U) This incident was discovered during a January 2015 joint NSD and ODNI review at FBI. ©! (S#NB) The government is sill investigating one possible incident of non-compliance with the FBI’s procedures. = ean FOR SECRET SVIORCONNOKORN 9 ACLU 16-¥-8998 (FM) 000850, ‘All itield information exempt under (1) and (DK) unless otrervise noted Approves fer Public Release TOP SECRET SI/ORCONNOFORN ¢S) (2) Improper Dissemination of United States Person Identifiers (SHNE) (U) This incident was discovered during a November 2014 joint NSD and ODNI review at FBI 68) © tom i ¢SHME) This incident was initially reported to the Court in a Rule 13(b) notice filed on March 12, 2015. As detailed in that notice, FBI reported an error] SOS OT] FOPSECRET BB SH/ORCONNOFORN, 0 ‘ACLU 16.V-8996 (RMB) 000851 ‘Al withheld information exempt under (bX) and (8) unless athervise noted ‘Approved for Public Release TOP SECRE T/A SUORCON/NOFORN Woh (U) FBI informed NSD and ODNI of this incident on December 23, 2014. (4) E-mail accounts| == SHSWANE) This incident was initially reported to the Court ina Rule 13(b) notice filed on March 4, 2015. As detailed in that notice, during 2AM review ac FORSECREL IR SORCON-NOKORN, 1 ACLU 16-0V-0996 (RMB) 000852 ‘Approved for Public Release ACLU 16.0V-8936 (ROB) 000853, ‘All itheld information. emp under (01) and (1) unless obese ned ‘Approved for Public Release FOP SECREF IRB SWORCONNOFORN (U) This incident was discovered during an NSD review iii IV. _ (U) Incidents of Noncompliance by an Electronic Communication Service Provider ESHSHANE) This incident was initially reported to the Court in a Rule 13(b) notic filed on [IN 2014. As detailed in that not communications from accounts not tasked pursuant as a result of a provider error. (U) NSA informed NSD and ODNI of this incident on NN 2014. ¢8} (2) Overproduction SWINE) This incident was initially reported to the Court in a Rule 13(b) notice filed on] , 2015. As detailed in that notice, NSA reported an error SUISHINE) ACLU 16-0V-8936 (ROME) 000654 [At wthhel information exempt under 1) and (9) unless otPervise noted, ‘Approved for Pubic Release SEYORCON-NOFORN: terminated all Section 702 collection from] with respect to the} accounts. 48} The Government is still confirming the necessary purges. (U) NSA informed NSD and ODNI of this incident on J 2014. (U) UPDATES ON INCIDENTS OF NONCOMPLIANCE REPORTED IN PREVIOUS REPORTS ¢S) There were a number of matters discussed in previous quarterly reports for which NSD stated that it was continuing to gather information. The following provides relevant updates to the ‘matters that remained outstanding in the previous reports. A substantial majority of these matters were first discussed in the previous quarterly report, covering the period from September | through November 30, 2014. For ease of reference, the letters and numbers referencing the incidents below have been retained from that previous report. Gaps in the letter or numbering sequence indicate that no updates from the previous report were necessary. Several incidents first reported in prior quarterly reports for which new information has been gathered are reported at the conclusion of this section. ¢S}-Updates On Incidents First Reported in the Previous Quarterly Report I. S} Incidents of Noncompliance with the NSA Targeting and Minimization Procedures ¢S) (A) Tas! ¢S} G1) Retasking of Facilities due to a System Error ¢S#NB), In the previous quarterly report, the Court was updated regarding a tasking error involvin; facilities that NSA had previously detasked. As of previous quarterly report, NSD was awaiting final purge confirmation from NSA. NSA 1g Errors FORSECREL SBP SWORCONAOFORN, ” ACLU 16-CV-8836 (RIB) 000655 ‘A withheld information exempt under 1) and roved for Public Release {S} (B) Detasking Errors. ‘Al the infomation exempt under (1) and (0) unis obervise noted ‘Aproved fr Public Release FOPSECRET BB SHORCONNOFORN 6S) (C) Noncompliance with a Notification Requirement. (8) In the previous quarterly report, NSD advised the FISC that there were fj incidents involving circumstances in which NSA did not notify NSD and ODNI within the required five business days. At the time of the previous quarterly report, NSD was ing final confirmation from NSA regarding the purge of MMI facilities. NSA now advises that the unique identifiers of the relevant objects fom the facilities were placed on the MPL in purge state as of NNN, 2015. NSA further advises that it identified no reporting based on this collection. With respect to the remaining facility, NSD is still confirming the necessary purges. «S) () Overcollection Incidents © C) NSAI toot FSHSHANE) In the previous quarterly report, the Court was updated regarding a covercollection in NS ion 702 upstream collection. Specifically. NSA reported that on Ee is eae FOP SECRET/ BP S1I/ORCON/NOFORN 16 a aa ACLU 16-6V-6996 (RIB) 000857 ‘All withheld information exempt under (b(t) and (8) unless ethrwise noted. ‘Approved for Public Reb PSHORCOXNOLORN (U) G) Other Issues Al withheld information exempt undec (1) ane (0,8) unless there noted. Approved for Public Release e [:SBIORCONNOFORN -2996 (RMB) CoN6s ‘All wield information exernpt under ((1) and (b1@) unless otherwise noted. ‘Approved for Pubic Release FOR SECREFBB/SIHORCONAGEORN, ¢) (G) Reported Incidents that Appear at this Time to Not Be Compliance Incidents. {8} The previous quarterly report included all incidents reported to NSD and ODNI determined to be compliance matters. ‘There were, however, ff incidents for which NSD was awaiting confirmation that all required purges have been completed jj from NSA and| from FBD). For incidents, NSA now advises that it acquired no relevant data from the facilities. For dents, NSA now advises that the unique identifiers of the relevant objects from the facilities were placed on the MPL in purge state as of II 2015. NSA further advises that it identified no reporting based on this collection. For the remaining fj) facilities, NSD is still confirming the necessary purges. Sy fa BI advises that it purge the relevant data from FBI systems as of| 'BI further advises that it recalled ffi|disseminations based on this collection. For NSD is still confirming the necessary purges. «S) UPDATES ON INCIDENTS OF NONCOMPLIANCE REPORTED IN PRIOR QUARTERLY REPORTS. I. _¢S) Incidents of Noncomplianee with the NSA Targeting and Minimization Procedures ¢S}{E) Minimization Incidents. ¢S-(EEE Database {SHSHREL-TO-USA_FVEY}-In the previous quarterly reports, the Court was updated regarding NSA’s efforts to evaluate transcripts stored in a database known as that may have been retained longer than permitted. 2OP SECRET/MISHORCONSOFORS p ACLU 16.C¥-898 (FONE) 000560 ‘All itield information exempt under (01) and (bY) unless tense note. Approved for Pubic Release FOR SEGRE BRS OREO. CLORS, }) (F) Overcollection Incidents. ($}-(1) Overcollection Incident Related to GESHSHANF) In the previous quarterly report, the Court was updated regarding an overcollection incident involving the acquisition of] (S) (C) Noncompliance with a Notification Requirement. £8} At the time of the previous quarterly report, NSD was awaiting final confirmation from NSA regarding one incident for which there was a notification delay. With the exception of one communication, NSA now advises that the unique identifiers of the relevant objects were placed on the MPL in purge state as of| 2014, NSA further advised that it identified no reporting based on this collection. With respect to the remaining communication, NSA executed the necessary waiver on I. 2014. €S) (H) Reported In dents that Appear at this Time to Not Be Compliance Incidents 8) The previous quarterly reports included all incidents reported to NSD and ODNI that were determined to be compliance matters. ‘There were, however, = incidents for which NSD was awaiting confirmation from NSA that all required purges have been completed. For] incidents, NSA now advises that it acquired no relevant data from the facility. For incidents, NSA now advises that the unique identifiers of the relevant objects from the facilities were placed on the MPL in purge state as of| 2014. NSA further advises that it recalled one report based on this collection. For incidents, NSA executed destruction waivers and advises that the unique identifiers of the relevant remaining objects from 80 ACLU 16-CV-8936 IB) CO08St ‘All watnels infomation exempt under (1) and (0) unless other note. ‘Approved fr Public Release the facilities were placed on the MPL in purge state. For the remaining facility, NSD is still confirming the necessary purges. ACLU 16-¥-8965 (RMB) 990862 ‘All withheld information exempt under (bX) and (bY) unless otherwise noted, ‘Approved for Pubic Release US. Department of Justice ‘National Security Division SEERETNOFORN 2 Washington, DIC 20550 ‘March 20, 2015 ‘The Honorable Thomas F. Hogan United States Foreign Intelligence Surveillance Court 333 Constitution Avenue, N.W. Washington, D.C. 20001 (U)Re: Quarterly Report Conceming Compliance Matters Under Section 702 of FISA Dear Judge Hogen: (SHB) The attached report is submitted pursuant to Rule 13(b) of the Rules of Procedure for the Foreign Intelligence Surveillance Court (hereinafter, “the Court”) and in compliance with ‘Your Honor’s August 25, 2009, instructions regarding providing timely and effective notification to the Court of compliance issues involving the Government's implementation of its authorities under Section 702 of the Foreign Intelligence Surveillance Act of 1978, as amended (FISA), As described in a February 4, 2010, letter to the Court, the Department of Justice’s National Security Division has filed prompt notices to the Court regarding compliance matters in several categories of particular concern, This report provides the Court with further information regarding those incidents, and notifies the Court of other compliance incidents that did not fall within the specified categories. For ease of reference to the Cour, this report contains the text, modified for internal consistency, of the latest Rule 13(b) notice regarding each compliance matter previously reported. Where additional information has heen obtained since the filing of the latest Rule 13(b) notice, this information is delineated. In addition, the attached report updates the Court on incidents included in prior Quarterly Reports that were not fully resolved. Please contact me if you have any questions regarding the compliance matters discussed in the attached report. Respectfully submitted, re g Kevin J. O'Connor Chief, Oversight Section Office of Intelligence, NSD US. Department of Justice F Classified by: Chief, Oversight Section, OL, NSD, DOT Derived from: NSA/CSSM 1-52; FBINSICG INV; CIA NSCG — = = Declassify on: 20400320 —— a= = 55-555 ACLU 18-CV-8995 (RMB) 000863, ‘All ithheld information exempt under (01) and 0)8) ures otherwise noted ‘Approved for Public Release SECRETHOREON NOFORN UNITED STATES ‘ FOREIGN INTELLIGENCE SURVEILLANCE ot, 5: 22 WASHINGTON, D.C. LEE A GOVERNMENT'S SUPPLEMENTAL REPORT REGARDING NSA'S POST-TARGETING ANALYSIS (S} ‘THE UNITED STATES OF AMERICA, through the undersigned Department of Justice attorney, respectfully submits the attached supplemental report regarding the processes that the National Security Agency (NSA) has implemented to comply with its targeting procedures under section 702 of the Foreign Intelligence Surveillance Act of 1978, as amended. These processes were discussed in part during a hearing before the Court on po10. s700NF)- inal Security Division United States Department of Justice ACLU 16-CV-8996 (RMB) 000664 Attn insane 2 3 1c Rovse Supplemental Report Regarding NSA's Post-Targeting Analysis (S)- Daring the) 2010, hearing held by the Court with respect to DNUAG 702(g) I cine: “tbe [MMPbcaring’), the Government provided additional information about the National Security Agency's (NSA) efforts to identify use of targeted electronic communications accounts/addresses/identifiers (hereinafter, "targeted accounts") by users located in the United States. In particular, the Government described NSA's use of I 22> I ene spires I 22 67-2222 210 povised intron tothe Court regarding NSA\s efforts to reduce the backlog of alerts generated of. receive ——— ‘Atthe time of the {iMhearing, NSA reported to the Court that approximately al alerts remained .waiting final resolution by NSA analysts, with the oldest alert dating to ‘As of (IIBJ2010, NSA had further reduced its backlog to approximate och alerts.’ Of those EE. approximately 21% were less than one week old, approximately 32% were between one week and one month old, and approximately 47% were between one month and four months old, the oldest of which dated back tof 1t:ough the esotution snot yet complete, NSA’s initial assessment is that likely did not occur from within the United States. * Confirming its initial assessment, NSA ultimately determined that this alert was not indicative ofthe user's location. €8) a : * ey ‘queue, but rather on ensuring that alerts are processed accurately and efficiently. (S4SH/ ae i ne eae SoS i ACLU 16-CV-8036 (RON) 000565 ‘All withheld information exempt under (61) and (DY) unless othenvie note ‘Approved for Public Release Pop secRET/coM\ NSA is taking active steps to continue to reduce this backlog. As discussed in part during the [EBB bcaring, since inception of : ee process, each business day NSA conducts an initial tage on alerts generated the prior day (or days, for alerts generated over a weekend or holiday), This initial triage is done | NSA analysts NSA to more quickly identify those alerts that have a higher probability of being indicative of a Ea] ‘Asa result of this triage, alerts with a low probability of being indicative of location -- and thus more likely to be false positives - will be reviewed after other alerts that are more likely to indicate that a targeted account has been active from the United States. Therefore, alerts assessed as likely false positives — ‘Subsequent to the fearing, NSA established guidelines to ensure that the (BBB 0s-tasking checks required by the NSA targeting procedures are completed in a timely and effective manner. First, the initial triage of all new prioritized alerts (described above) will continue to occur the same business day thatthe alerts are received. Second, NSA will begin a further assessment of each prioritized alert no later than five business days after receipt. This further assessment may include: ‘Attell infomaion grape ade) ad Although this further research must begin within five business days, depending on the complexity and volume of alerts, in some cases, it may take NSA longer than five business days to filly solve an alert oo In order to meet the above-described guidelines, NSA has increased personnel resources devoted to conducting [EEE post-tasking checks; NSA will continue to monitor these resources and adjust them as needed. Additionally, NSA has implemented improved ‘management of the initial triage process, to includs reprioritization of alerts most likely to be indicative of U.S. ‘th respect to By doing this, NSA believes its analysts will be able to resolve numerous related alerts at the same time, making the process more efficient. NSA also is in the process of implementing several other improvements: ACLU 16-CV-8996 (RMB) 000867 ‘Al withheld information exempt under (b\1) and (6,9) unless otherwise noted ‘Approved for Pubic Release wo is RE a] modification will help prevent future alerts lets in this manner, and continued ‘The Department of Justice and the Office of the Director of National Intelligence will continue to closely monitor both the alerts in process and NSA implementation of the improvements it has made or is inthe process of making in order to comply with its newly- ‘slablished intomnal guidelines, Moreover, as NSA continues to improve its capabilities to ensure the alerts are processed accurately and efficiently, these guidelines and processes may be further refinod overtime > Respectfully submitted, Signals Intelligence Directorate National Security Agency ACLU 16-CV-2035 (RIB) 000663 FOP-SECREFCOMINF/NOEORN [withheld information exemot under (1) and (08) uniess oewise noted. ‘Approved for Public Release ; USS. Department of Justice National Security Division Tashngion, DC O53 HE 2010 The Honorable Mary A. MeLat Judge United States Foreign Intelligence Surveillance Court Washington, D.C. Dear Judge McLaughlin: I am pleased to provide certain additional information related to certain issues raised and discussed during our meeting on| 2010, concerning the matters currently pending before the Court in In re: tion of In mation, and from supplemental information provided to the Court on ISA) stores unminimized and unevaluated signal As the Court is aware from the testimony provided by the iano on i. For the reasons more fully explained in our} has proposed separate and distinct purge requirements for each class of information. ESHSHANE) According to NSA, certain of its systems contain multiple classes of information, For example, a certain system could include both information, According to NSA, every system that obtains/retains| information from a has, along with other purge-specific requirements, explicit requirements to maintain traceability. in their system -- including the ability to distinguish| information from other categories of i ways. such as Attorney-General NSD-DOF- Reason = Deelassifpon: = = ACLU 16-Cv.8906 (RIB) 000869 [A wthhel information exempt under (b(t) ar (b),8) uness otherwise noted. ‘Approved for Public Release ‘The Resolution of Alerts (S) On Friday, [BJ 2010, the government submitted to the Court its Supplemental Report Regarding NSA's Post-Targeting Analysis. Following its review of the report, the Court expressed concer that allowing an alert to go unresolved for an extended period of time may not by consistent with NSA’s targeting procedures, which specifically provide that As noted in the government's J 2010 Supplemental Report, each business day NSA conducts an initial triage of the alerts generated the previous day by the! ae] process. This initial triage, performed by analysts, allows NSA to quickly identify those alerts that have a higher probability of being indicative of a target’s presence in the U.S. Those alerts that have a low probability of being indicative of location — and therefore are more likely to be false positives — are reviewed after other alerts of higher interest, consistency in the management of this process given the diversity of targets and reasons for alerts. To ensure that alerts do not 2o unresolved for an unreasonable period of time, NSA has NSA reports that on average it receives ij prioritized alerts (e.g. Urgent, High, Medium, Low) per day through the process. Within a given week, however, a single selector could, and often does, receive multiple alerts. For example, during the first week of May 2010, selectors generated a total oa alerts resulting ink incident (roaming) reports being forwarded to the Department of Justice and the Office of the Director of National Intelligence. BB alerts continue to be researched. Given the procedures in place as outlined in the government's [MJ 2010 Supplemental Report which are designed to identify, prioritize and resolve those alerts having a higher probability of being indicative of a target’s presence in the United States, the government believes ec resolve alerts is reasonable. CESHSHENE) NSA intends to provide the Court with further updates regarding its certification of systems to receive and properly handle FAA 702 data going forward as well as its efforts to remediate the purge compliance issue on or before Wednesday, J 2010. a Ua ‘ACLU 16-C¥-3996 (RMB) 000670 All withheld information exempt under (b\1) and 6), unless ofyenise noted ‘Approved for Public Release ‘The government would like to thank both you and your staff for your consideration of iil. Should the Court have any additional questions, comments or concems, please do not hesitate to contact me. (U) Sincerely, Deputy Section Chief, Operations Office of Intelligence ‘ACLU 16.Cv-806 (FONE) 000871 ‘All wthined information exert under (bX1) and (bY) unless otherwise role, ‘Approved for Pubic Release -FOP- SECRETE SH/ORCON/NOFORN- QUARTERLY REPORT TO THE FOREIGN INTELLIGENCE SURVEILLANCE COURT CONCERNING COMPLIANCE MATTERS UNDER SECTION 702 OF THE FOREIGN INTELLIGENCE SURVEILLANCE ACT March 2014 ACLU 16.0¥-8966 (R08) 000672 Alvitheld information exempt under (0) and (DKS) unless otherwise noted. ‘Approved for Pubic lease QUARTERLY REPORT TO THE FOREIGN INTELLIGENCE SURVEILLANCE COURT CONCERNING COMPLIANCE MATTERS UNDER SECTION 702 OF THE FOREIGN INTELLIGENCE SURVEILLANCE ACT March 2014 TABLE OF CONTENTS (U) INTRODUCTION (U) NEW INCIDENTS OF NONCOMPLIANCE... I (S) Inc and Mi fents of Noncompliance with the NSA Targeting jization Procedures ..... Il. (S/NF) Incidents of Noncompliance with the CIA Minimization Procedures .. IIL () Incidents of Noncompliance with the FBI Targeting IV. (U) Incidents of Noncompliance by an Electronic Communication Service Provider... (U) UPDATES ON INCIDENTS OF NONCOMPLIANCE REPORTED IN PREVIOUS REPORTS... ACLU 16-Cv-8996 (RMB) 000673 Aveo enn eit 4 a i ‘Approved for Public Release (U) INTRODUCTION —48)-This report! is submitted pursuant to Rule 13(b) of the Rules of Procedure for the Foreign Intelligence Surveillance Court (hereinafter, “the Court”) and in compliance with the Court’s August 25, 2009, instructions regarding providing timely and effective notification to the Court of compliance issues involving the Government's implementation of its authorities under Section 702 of the Foreign Intelligence Surveillance Act of 1978, as amended (FISA). As described in a February 4, 2010, letter to the Court, the Department of Justice’s National Security Division (NSD) files prompt notices to the Court regarding compliance matters in several categories of particular concem. This report provides the Court with further information regarding those incidents and notifies the Court of other compliance incidents that did not fall within the specified categories. (ESHSHHOGANE) This quarterly report covers incidents reported to NSD and the Office of the Director of National Intelligence (ODNI) from December 1, 2013, through February 28, 2014. To provide some context to the scope of the Government’s collection during this period, the ‘National Security Agency (NSA) reports that, on average, approximately individual facilities” were under task at any given time between December 1, 2013, and February 28, 2014. These facilities include those initially tasked under the NSA’s Section 702 targeting procedures during this reporting period, as well as facilities that had been tasked prior to this reporting period, either pursuant to the NSA Section 702 targeting procedures or under the authority of several certifications made by the Attorney General and Director of National Intelligence (DND) pursuant to the Protect America Act of 2007, Pub. L. No. 110-55, 121 Stat. 552 (Aug. 5, 2007) (hereinafter “Protect America Act” or “the PAA”). “(S#NF) NSD and ODNI conduct oversight of NSA’s, the Central Intelligence Agency’s (CIA), and FBI’s use of Section 702 authorities. This oversight occurs in two principal manners. First, the vast majority of the incidents discussed below were initially reported by the reviewed agencies themselves. NSD and ODNI inquired about and, where appropriate, investigated the compliance matters discussed herein. Second, NSD and ODNI conducted targeting and minimization reviews at each of these agencies to ensure compliance with the procedures.* " (U) Given recent events concerning the public diselosure of information concerning the Government's ‘implementation of Section 702 authorities, NSD and ODNI are reviewing the classifications associated with certain parts of this report. While the overall classification of the report will remain the same, itis possible that certain portion markings within individual paragraphs will be re-clasified. iii “{S}-Minimization procedures also gover the National Counterterrorism Center's (NCTC) review of previously minimized Section 702-acquired information in limited situations. Specifically, NCTC is not curently authorized to receive unminimized Section 702 data. However, NCTC does have access to FBI systems which contain minimized ‘FOP SECRET SW/ORCONNOFORN- ACLU 18-0v-8836 (®MB) 00067 ‘Alt witht information exempt under (0\.) and (0,3) unless terse note. ‘Approved for Public Release ‘Targeting reviews included an offsite review by NSD of facilities tasked by NSA, with a subsequent onsite review by NSD and ODNI at NSA and (when appropriate) CIA or FBI to answer any questions raised during the initial offsite review. For FBI, "NSD and ODNI also conducted onsite minimization reviews at a particular focus on these agencies’ dissemination of United States person information. Compliance incidents discovered during any of these targeting and minimization reviews are described in more detail below. (U) For ease of reference to the Court, this report contains the text, modified only for internal consistency, of the latest Rule 13(b) notice regarding each compliance matter previously reported, Any additional information obiained since the filing of the latest Rule 13(b) notice is clearly delineated. (U) NEW INCIDENTS OF NONCOMPLIANCE I. 4S} Incidents of Noncompliance with the NSA Targeting and Minimization Procedures £8} Below are descriptions of incidents involving noncompliance with the NSA targeting and minimization procedures. ‘There have been four primary categories of incidents of noncompliance with the NSA targeting procedures during this reporting period. The first category involves incidents where noncompliance with the targeting procedures resulted in an error in the initial tasking of the facility. The second category involves incidents in which the facility was rly tasked in accordance with the targeting procedures, but errors in the detasking of the ty caused noncompliance with the targeting procedures. The third category involves incidents in which a facility was properly tasked and (when necessary) detasked in accordance with the targeting procedures, but a notification requirement contained in the targeting procedures was not satisfied. The fourth category involves incidents where the determination to a a facility was not properly documented as required by the targeting procedures. In addition, jj incidents involving NSA’s minimization procedures andfjj other incidents are reported below. In some instances, an incident involved more than one type of noncompliance. Such incidents are discussed below only once, although each type of noncompliance has been noted where appropriate, CESUSHINF} Regarding Purges Discussed in this Report. Many of the compliance incidents in this report required NSA to purge Section 702-acquired data from appropriate systems. As the Court is aware, NSA revised its purging process in 2010 in response to Section 702 information. Because NCTC is not a law enforcement agency, it may not receive disseminations of Section 702 information that is evidence of crime, but which has no foreign intelligence value. NCTC’s minimization procedures are very limited in scope, and are primarily designed to require purging in situations in which [NCTC personnel discover purely law enforcement information in the course of reviewing Section 702-acquired information either in FBI systems or in NCTC systems which have directly ingested the information. No incidents of noncompliance with the NCTC minimization procedures were identified during this reporting period, FOP SECRETARY SH/ORCON/NOFORN- 2 ACLU 16-CV-8996 (RMB) 000875 ‘Al withheld information exempt under (1) end (3) i i noted. ‘Approved for Public Release prior deficiencies in its purging practices. NSA has identified and applied a certification process to systems that handle Section 702-acquired data. To the extent that NSA has officially certified a system, the Government believes that the system is compliant with the purge requirements of the NSA Section 702 targeting and minimization procedures, and thus will be able to properly execute purging actions. NSA has also developed a Master Purge List (MPL) to be used to document and assist in the application of its purge practices.* -€FSHSH/NF)-The relevant purge dates in this report for NSA reflect not the date on “object is on the reporting absent a waiver or other legal process. OCcUT as part of a separate *ESHOHAREY As ated nthe Diet of NSA eit ld oI 210, docket (hereinafter “DIRNSA affidavit"), “NSA has used its existing records of past purge actions across all SIGINT authorities to create [the MPL]. This ist includes the identifiers of unique tems purged fram select NSA systems." DIRNSA affidavit 4. iL ‘ACLU 16-Cv-8996 (RMB) 000678 All wield infomation exempt under (bt) and (3) i si noted. ‘Agoroved for Public Release action, but in all cases adding the communications to the MPL prevents their use in NSA reporting and FISA applications. -€PSHSHNF} For each incident requiring a purge, NSA also has a process to identify and, as a iate, revise or recall reporting based on the purged collection. ‘quarterly report indicates (for every incident requiring a purge) whether NSA’s above- described process has identified any disseminated reports based upon the purged objects at issue and, if so, the disposition of those reports. -(S#NE}-CIA and FBI receive unminimized data from many Section 702-tasked facilities, and at times are thus required to conduct similar purges.'° For each incident requiring the purging of data, NSD has confirmed with CIA and FBI that either: (1) CLA and FBI received no data from NSA that required punging; or (2) CIA and/or FBI have completed the required purge. When’a CIA or FBI purge was required, its occurrence is noted in this report. When a required purge for any of the agencies has not been completed, this is also noted. a FOP SECRETHBBSIWORCONNOFORN- ACLU 16-6¥-8996 (RMB) 000677 ‘All withheld information exert under (01) and (03) unless otherwise note, ‘Approved for Pubic Release purge of this system. If any FBI personnel had accessed the now-purged| records, FBI contacts these individuals to determine whether the data has been disseminated or otherwise migrated to any other FBI systems. If so, the migrated data is d and the disseminated data is recalled. ection 702-acquired data in that occur in ~(S/NF)-Like the other agencies, FBI similarly reports that its purge process generally does not extend to temporary archives utilized for backup purposes.'? These archives are only accessible to FBI technical personnel. FBI reports that these archives have Hint a7 4S)-(A) Tasking Errors. The following[J incidents involved noncompliance with the NSA. targeting procedures that resulted in an error in the initial tasking of the facility: Intelligence approved amended ceriffcations which include amended minimization procedutes for FBI it FBI to process end reizin raw Section 702-aequired information, subject (o certain conditions and ad hioc FBI databases (such asthe stand-alone or other limited systems discussed above) in order to conduct additional analysis of the Section 702-acquired information. The Court approved these minimization procedures on December 13, 2013. 5 es — 7 BI advises that as an added precaution, FBI conducts purges of one temporary backup archive} “FOP SECRET JI SH#ORCONNOFORN— ‘ACLU 16-CV-8996 (RMB) 000878 Alwitbeld information exempt under (b\1) and (DY) unless, sii noted. Approved for Public Release ACLU 16-CV-8936 (RM) 000878, ‘All ined information exert under (61) and (DY) unless oenwise rote, ‘Approved for Publi Release ‘ACLU 16.CV-8996 (RMB) 000680, ‘Abvithheldinformaton exempt under (1 ‘Approved for Pubic Reless2 ‘ACLU 16-0¥-8996 (RMB) 00088 ‘All wtnheld formation exempt unde (]() and (bX3) unless otherwise noted, ‘Approved for Public Release ACLU 16.Cv.8006 (ROB) 000682 ‘Approved for Pubic Release LU 16-cV-8995 (RIMB) 000883 ‘i withield information exempt under (1) and (b)) unis cerwise noted ‘Approved for Public Release FOPSECRETASHORCONNOFORN ACLU 16-Cv-8086 (FB C0064 All ithe information exempt undor (1) and (D3) unless there noted, ‘Approved fr Pubic Release ACLU 16-CV-2996 (RIB) 000685 Awe infomation exempt under (1 Approved fr Public Release ACLU 16-CV-2996 (RMB} 000608 ‘Al withnald infomation exempt under (1) and (0),8) unas otherwise noted. ‘Approved for Pubic Release ‘FOP SECRETE SH/ORCON/NOFORN- ‘AOLU 16-0V-8936 (RIB) 000887 Aawahneld information exempt unde ‘Approved for Publ Releaeo ACLU 16-CV-8996 (RMB) 000688 ae eee ad conor one erica noted. Approved fr Pubic Release Sy (B) Detasking Errors. The following il incidents involved facilities that were tasked by NSA in accordance with the NSA targeting procedures." In each case, however, errors in the detasking of these facilities resulted in noncompliance with the NSA targeting procedures: "9 (U) The Government is continuing to investigate a possible additional incident. ‘FOP SECRET SW/ORCONNOFORN- 16 ACLU 16-CV-8998 (RMB) 000689 ‘All witineld information exert under (0X1) and (D9) unless herve rote. ‘Approved for Public Release TOP SECRET/ MBB SH/ORCONNOFORN- ACLU 16-Cv.8996 (RMB) 000600 [Nt vthet information exempt under (01) ae (b)) unless oberwise noted ‘Approved fr Public Release ACLU 16-CV-2996 (RMB) ooDaet Al ital information exernpt under (0K) and (0) /Approved for Public Release FOP SECRET IPSH/ORCONNOFORN- ACLU 16-Cv-8596 (ROE) 00602 Alwitheld information exempt under (61) and (OK) unless atrerwise noted, Approved for Pubic Release ~FOP SECRET SHORCONNOFORN- ACLU 16-Cv-8996 (RIE) 000693, Ad withhldiformaton exempt under (61) and (bX) unless thorn noted, ‘Approved fr Publi Release ~FOPR SECRET SHORCONNOFORN- ACLU 16-CV-8996 (RMB) 000894 ‘All ithneld information exernpt under (1) and (3) aK ‘Approved for Pubic Release ACLU 16-Cv-8936 (RIES) 000688, ‘All wthheld information exempt under @\1) and (3) unos otheruse notes. ‘Approved for Publc Release TOP SECRET SWORCONNOFORN- ACLU 16-CV-8996 (RMB) 000586 A withheld information exe u ‘Approved for Pubic Release ‘ACLU 16-Cv-8996 (RMB) 000697 ‘All wtheld information exempt under (6) and (03) unless cere note, ‘Approved for Pubic Release ACLU 16.CV-8906 (RMB) 000898, ‘Al witield information exempt under (01) and 0)(2) ures otherwise not Aoproved for Publi Release ACLU 16-CV-3896 (RMB) 000698 Alwitheld information exert under (DK) and (bY) unless thers noted. Approved for Publi Release ACLU 16-Cv-8895 (RMB) 000700 Al withbeld information exempt under (OK) and (bY) unl sists ‘Approved for Public Release FOP SECRET SH/ORCON/NOFORN- ACLU 16-6V-8936 (RMB) 000704 Al witibld information exempt under (0K) and (0X3) unass otherwise noted. Approved fr Public Release ACLU 16-CV-2996 (Rl) 000702 Al vithld information exempt under (61) and (3) unless ernise noted. ‘Approved for Public le —TOP SECRET BP SH/ORCON/NOFORN- ACLU 16-cV-8995 (RMB) 00072 Al wield information exempt under (b1) and (b1@) unless there noted. Approved for Public Releaso FOP SECRET SHWORCON/NOFORN- TOP-SECRET SW/ORCONNOFORN 31 ACLU 16-CV-8936 (RMB) 000704 ‘Al watheld information exempt under (4) and (O12) i oterwise noted, Approved for Public Release ee KK—_—————EEEEEeeeeee FOP SECRET SH/ORCONNOFORN- ACLU 16.CV-0038 (RMB) 000705 ‘Al witheld information exempt under (1) and (3) unless otherwise note, ‘Approved or Pubic Relaase ACLU 160.8996 (RMB) 000708 ‘al wie information exempt under (OX) and (8) uress ahensise note. ‘Approved for Public Release ACLU 16-CV-8936 (RIB) 000707 All whet inforaton exempt under (b)(1) and (9X3) unless ators noted. Approved for Puli Release FOPSECRET EB SHORCONNOFORN- 35 ACLU 16-CV-8935 (RMB) 600708 [Ad witheld information exempt under (1) and (01) unis oberwise noted ‘Approved fr Public Release -FOP SECRET SHORCONNOFORN- ACLU 18-CV-8935 (RMB) 00076 ‘All withield ifermation exempt under ()(1) and (019) unless cthernise noted, ~FOP-SECRET A SHU/ORCONNOFORN- ACLU 16-CV-8996 (RMB) c00710 Alwiteld information exempt under (0X1) and Se at on wokoRN. unless etberwise notes. Approved fer Pubic Release ACLU 16-CV-8938 (RMB) 000711 ‘a withetd information exempt under (OK) and (0,8) uness aterwiee note. ‘Appcoved for Public Release “FOP SECRET SHORCON/NOFORN- ACLU 16-0¥-8906 (FMB) 000712 All withbeld information exert under (61) and (ON3) unless athenwise noted ‘Approved fr Public Release “POP SECRET SH/ORCONNOFORN— ACLU 16-CV-6098 (RMB) 000713 All wihneldinfermation exempt under (9X1) and (03) unless tterwise note, Approved for Pubic Release ‘ACLU 16.CV-8996 (RMB) 000714 ‘Alliheld information exempt under (01) and (619) unless ctperwise note, ‘Approved for Pubic Release 48} (C) Noncompliance with a Notification Requirement. 8} NSA’s targeting procedures require NSA to report certain incidents to NSD and ODNI even if these incidents do not involve noncompliance with the targeting procedures. Specifically, NSA is required to terminate acquisition and notify NSD and ODNI if “NSA concludes that a person is reasonably believed to be located outside the United States and after targeting this person learns that the person is inside the United States, or if NSA concludes that a person who at the time of targeting was believed to be a non-United States person was in fact a United States person.” NSA Targeting Procedures at 8-9. This notification must occur within five business days. -{8}- In addition to other notification issues noted in incident descriptions above, during the period covered by this report, there have been [| incidents involving circumstances in which NSA did not notify NSD and ODNI within the required five business days. ACLU 16-CV-8896 (RMB) 000715 Al wild information exert under (0X1) and (3). ai ote. ‘Approved for Pubic Release States person was found to be used by a United States person. Reporting delays ranged from one to 409 business days, with a median delay of two business days and an average delay of approximately 11 business days. °° 4S} For[flf of thelff incidents, NSA advised that — by a United States person or to a user within the United States have related to the use of the fac separately, for the remaini States. CIA advised that it was| Section 702 data for . For| incidents, CIA advised that ithad completed all necessary purgi nt, CIA is considering obtai «to retain communications pursuant to its remaining inci awai minimization procedures 48} (D) Noncompliance with Documentation Requirements. 4S} The fourth category of incidents involved noncompliance with the documentation requirements of the NSA targeting procedures. The NSA targeting procedures approved for use in each certification require that NSA’s documentation concerning each tasked facility contain a citation to the source of information upon which the determination was made that the user of that facility was reasonably believed to be located outside the United States (the “foreignness determination”) and identify the foreign power or foreign territory about which NSA expects to obtain foreign intelligence information pursuant to the tasking. According to the procedures, the purpose of the citation is to “enable those responsible for conducting oversight to locate and review the information that led NSA analysts to conclude that a target is reasonably believed to be outside the United States.” ~48}- According to requirements set forth in the NSA targeting procedures, NSD and ODNI conducted regular Section 702 oversight reviews in order to evaluate NSA’s implementation of its targeting procedures. Two such reviews occurred during this reporting period. During these reviews, NSD and ODNI identified isolated instances in which NSA may not have complied with the documentation requirements in the targeting procedures. Of the taskings assessed during the reporting period of reviews, NSD and ODNI have, to date, identified| stances in which NSA may have failed to cite sources that NSD and ODNI assessed were adequate to demonstrate a reasonable basis for believing that the user of the account was located outside the United States. NSA also reported an additional lJ documentation issues. Additionally, NSD and ODNI have identified fff instances in the course of these bimonthly reviews regarding which NSD and ODNI are still attempting to determine whether NSA cited sources that NSD and ODNI assess 48} There was one instance in which the respective delay was 409 business days, This was due o an internal ‘racking mistake at NSA. There were only instances in which the delay was more than two business days, -FOP SECRET SH/ORCON/NOFORN— “a ACLU 16.CV-8996 (RMB) 000716 ‘All withheld information exemet under (1) and (9) unless othervise nod. ‘Approved for Public Release are adequate to demonstrate a reasonable basis for believing the user of the account was located outside the United States. +5)-Finally, NSA reported| \cidents in which the documentation indicated that NSA. intended to task a facility to a different DNU/AG Section 702(g) certification than the certification under which the facility was actually tasked. NSA has reported that it either detasked the facilities in question or promptly corrected the documentation to ensure that the facilities were tasked to the appropriate certification. {5} ) Minimization Incidents >" (U) Seotion 1806(b) provides tet “[ao information acquired pursuant to this tte shall be disclosed for Taw enforcement purposes unless such disclosure is accompanied by a statement that such information, oF any information derived therefzom, may only be used ina criminal proceeding withthe advance authorization ofthe Attorney General.” ‘FOP-SECRET/ MB SH/ORCONNOFORN- 44 ACLU 16-0V-8996 (RMB) 000717 Q). ie noted, proved for Puble Release SREB SHORCONNOFORN- ACLU 16-CV.8996 (RMB) 0 ‘Allied information exempt under (0X1) and (OK9) unis, 7. Approved for Pubic Release CY 46 ACLU 16-C-2008 (RMB) 000718 Al wthineld information exernpt under (1) and (3) unless cthernse noted, -Roproves fr Publi Release jeries Using United Si \n Identifiers -CESHSHANF) Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA intemal procedures. NSA * reported that on| 2013, an NSA analyst conducted queries, against non- upstream data, using a United States person’s facilities. Although the United States person ‘was a target pursuant to Section 704 of FISA, NSA had not approved the facilities to be queried against Section 702-acquired data. The error occurred because the analyst inadvertently included Section 702-acquired data as part of the searches. On| 2013, an NSA auditor discovered the error and the results were deleted that same day. NSA advises that the analyst has been reminded of the requirements when using United States person identifiers as query terms. 48} NSA informed NSD and ODNI of incident on EN 2013. 48} (3) Queries Using United States Person Identifiers ~€PS#SHANE}. Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. FOP SECRET SH/ORCON/NOFORN- a ‘ACLU 16-CV-0696 (RMB) 000720 ‘Allied information exempt under (0X1) and (bY) unless oer noted, Approved for Pubic Release Additionally, section 3(6)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA e error occurred because the analyst inadvertently forgot to delete the] query after NSA detasked fl} |. The analyst discovered the error a 2013, and deleted the single result. ent on I 2013. {8} NSA informed NSD and ODNI of this inci 48} (4) Overty-Broad Queries -CESHSHINPY According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key ‘words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that on —. 2013, an analyst executed| separate queries in rapid succession as part of a single analytic investigation without employing appropriate limits on the query to exclude extraneous potentially United States person information. On the a the query results and halted J of the queries when the number of records returned exceeded a reasonable threshold. The remaining overly-broad queries executed by this analyst were not discovered until a routine query audit was conducted on 20: NSA advises that the query results were deleted. (U) NSA informed NSD and ODNI of this incident on [A 2013. Sy (5) United States Person Query This incident was initially reported to the Court in a Rule 13(b) notice filed on| 2013.°° Section 3(b\(5) of NSA’s Section 702 minimization procedures state that, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those setection terms reasonably likely to retum foreign intelligence information. Identifiers of an identifiable U.S. person may not be used as terms to identify and select for analysis any Internet communication acquired through NSA’s upstream collection techniques. Any use of United States person identifiers as terms to identify and select communications must first be approved in accordance with NSA procedures.” As detailed in the JN notice, % sie) The note aod Tile an sein 78 of FIA spect of is compet incident. In keeping with the subject matter of this quarterly report, this incident report only describes the Section 702 aspects ofthis nedent. “FOP SECRET SHORCONNOFORN- 48 ACLU 16-CV-8996 (F048) 000721, A wine information exer undor (1 et aig ‘Approved fr Pubic Release NSA reported that on or about 2013, an NSA analyst improperly queried information acquired pursuant to Section 702. The query had not been approved in accordance with NSA’s Section 702 minimization procedures*’. Specifically, an NSA analyst used [IMJ identifiers associated with a United States person who was formerly the target of surveillance pursuant to Section 704 of FISA. to query this collection. [The analyst, however, forgot that the authority had expired prior to conducting this Jpon recos g the error. on EE 2013, the analyst deleted the query BB ecsts it returned, and notified NSA's O&C section. (U) NSA informed NSD and ODNI of this incident on EN 2013. 8) (©) Ove -CESUSHINE}-A cording to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms ammns likely to return foreign intelligence information.” NSA reported that on |, 2013, a newly-assigned NSA analyst conducted an overly broad query against data acquired from several authorities, including Section 702-acquired data. Specifically, the analyst conducted the overly-broad query while trying to familiarize herself with the query programs she had seen as part of NSA’s training program. On , 2013, an NSA auditor discovered the inappropriate queries. NSA advises that the queries and the corresponding results were deleted. NSA further advises that the analyst and other team members have received additional training regarding the Section 702 query requirements. (U) NSA informed NSD and ODNI of this incident on NN. 2013. 48), ir umn identifier, SANE} Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b\(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA reported that an NSA. analyst conducted ir juired pursuant to Executive Order 12333 and Section “The error occurred because the analyst © QESHSMENEY The analyst did not, however, use the United States person identifiers to query NSA’s upstream acquisition of Internet transactions, which is also prohibited by the Section 702 minimization procedures. FOP SECRETE SHWORCONNOFORN- 49 ACLU 16-0V-8996 (RMB) 000722 ‘Al withheld information exempt under (1) snd (23) unless otbervive noted, ‘Approved for Public Release inadvertently forgot to delete the| ery after NSA detasked the e-mail account. _ | queries were terminated on| 2013, and NSA advises that no results were retumed, The analyst has been reminded of the relevant Section 702 query requirements. (WD) NSA informed NSD and ODNI of this incident on J 2014. £5) (8) United States Person Query. -¢PSHSHANPY Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA reported that ee rT 2014, an NSA analyst unintentionally conducted an| query against multiple authorities, including Section 702 upstream data, using United States person telephony numbers of a United States person subject to Court authorized targeting pursuant to Section 704. Although this target was the subject of Section 704 collection, his telephone numbers had not been authorized for queries of Section 702-acquired data pursuant to NSA’s internal procedures. In addition, querying of Section 702-acquired upstream collection is barred by the minimization procedures in any case. The error occutred because the analyst mistakenly chose the wrong data sets, including Section in data, when designing the query. This error was identified by an NSA auditor on| 2014. ‘The query was terminated on 2014, and the query results were deleted that same day. The analyst has been reminded to take greater care in selecting data sets to query. 48} NSA informed NSD and ODNI of this incident on I, 2014. 4S} (9) United States Person Query -CISUSUASE} Although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of storage media using United States person identifiers, such queries are to first be approved in accordance with NSA internal procedures. Additionally, section 3(b)(5) prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. On 2014, an NSA analyst ran a query using a foreign phone number against mn 702-acquired data, to include upstream collection, in order to} NSA advises that the uery results were not saved in the system that was queried. -TOP SECRET SW/ORCONNOFORN- 50 ACLU 16.0v-8906 (RIB) 000723, Alvwitneld information exempt under (bX?) an (2)() unless onerwise noted. Approved for Public Release 48} NSA informed NSD and ODNI of this incident on [RI 2014. ~&)-(10)_Overly Broad Query ~€FSHSHNB)- According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key ‘words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that or 2014, an NSA analyst unintentionally conducted an overly broad que: ainst Section ‘The analyst realized their error upon receiving the results of their query. at the query and the corresponding results were deleted. NSA further advises that the analyst has been instructed and tested on how to properly query in this tool. (U) NSA informed NSD and ODNI of this incident on I 2014. 48} (11) Overly Broad Query. -€ESHSWNF) According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that or [HB 2014, an NSA analyst unintentionally conducted an overly broad query against Section 702-acquired data. Specifical The analyst realized the error upon receiving the results of the query. NSA advises that the query and the corresponding results were deleted. NSA further advises that the analyst has been instructed —_ prior to conducting such queries of acquired data. (U) NSA informed NSD and ODNI of this incident on J, 2014. 48} (12) Overly Broad Query -EESHSHINF} According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[clomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other dis ators, will be ited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that: or 2014, an NSA analyst unintentionally conducted an overly broad query against Section y limiting term e analyst realized the error upon receiving the results of the FOP SECRETE SH/ORCONNOFORN- 31 im conducting this query. ‘ACLU 16-CV-8996 (RM) 000724 wine infomation exempt under (DN) and (DX) unless atnerwise noted. Approved for Pubic Release query. NSA advises that the query and the corresponding results were deleted. NSA further advises that the analyst has been reminded to ensure that his/her queries are properly constructed to meet the Section 3(b)(5) requirements. incident on J 2014. (U) NSA informed NSD and ODNI of this 48} (13) Overly Broad Queries -CESHSHINF} According to section 3(b)(5) of NSA’s Section 702 minimization procedures, “[cJomputer selection terms used for scanning, such as telephone numbers, key words or phrases, or other discriminators, will be limited to those selection terms reasonably likely to return foreign intelligence information.” NSA reported that on| 2014, an NSA analyst unintentionally conducted J overly broad queries against ‘ection 702-acquired data. Specifically, the analyst forgot a that would have limited their queries in such a way to have been reasonably designed to return foreign intelligence information. This error was identified as a result of NSA’s auditing of query terms, NSA advises that the query and the corresponding results were deleted. NSA further reports that the analyst has been reminded to ensure that his/her queries are properly constructed to meet the Section 3(6)(5) requirements. (U) NSA informed NSD and ODNI of this incident on [AE 2014. 4S} (14) Improper Dissemination of Information Concerning United States Persons -€ESHSH} This incident involves the dissemination of United States person information in a manner that was contrary to the requirements of Section 6(b) of NSA’s Section 702. Minimization Procedures. a se on BBE, 2014, NSA issued a report which included the identities offi United States persons located outside the United States that were not foreign intelligence information. On J 2014, an NSA analyst recognized the error and recalled the report. The report was not reissued. (U) NSA informed NSD and ODNI of this incident on J 2014. {8} (15) Access to Test Database -