Many news reports have focused on Section 215 of the Patriot Act (used to collect all Americans' calling records) and Section 702 of the Foreign Intelligence Surveillance Act Amendments Act (FAA) (used to collect phone calls, emails and other Internet content) as the legal authorities supporting much of the NSA's spying regime. Both laws were passed by Congress and are overseen by the Foreign Intelligence Surveillance Court (FISA court). However, it's likely that the NSA conducts much more of its spying under the President's claimed inherent powers and only governed by a document originally approved by President Reagan titled Executive Order 12333. The Senate Select Committee on Intelligence is currently conducting a secret investigation into the order, but Congress as a whole—including the Judiciary committee—must release more information about the order to the public.
EO 12333 was first written in 1981 in the wake of Watergate and the Foreign Intelligence Surveillance Act, an act passed by Congress that regulates spying conducted on people located within the United States. Since FISA only covers specific types of spying, the President maintains that the executive branch remains free to spy abroad on foreigners with little to no regulation by Congress.
Executive Order 12333
The Executive Order does three things: it outlines what it governs, when the agencies can spy, and how they can spy. In broad strokes, the Executive Order mandates rules for spying on United States persons (a term that includes citizens and lawful permanent residents wherever they may be) and on anyone within the United States. It also directs the Attorney General and others to create further policies and procedures for what information can be collected, retained, and shared.
The first section of the order covers the role of every agency conducting intelligence in the Intelligence Community, which includes seventeen different agencies, including well-known entities like the Central Intelligence Agency (CIA) and the NSA, and lesser-known entities like the Office of Terrorism and Financial Intelligence in the Department of Treasury. The roles vary by agency. For instance, the NSA is, among other things, responsible for "collection, processing and dissemination of signals intelligence," while the CIA is responsible for "national foreign intelligence.
The Information Collected
The Executive Order purports to cover all types of spying conducted with the President's constitutional powers—including mass spying. That’s important to note because some of the spying conducted under EO 12333 is reportedly similar to the mass spying conducted under Section 702 of the FAA. Under this type of spying, millions of innocent foreigners’ communications are collected abroad, inevitably containing Americans' communications. In the Section 702 context, this includes techniques like Prism and Upstream. While we don’t know for sure, the Executive Order probably uses similar techniques or piggybacks off of programs used for Section 702 spying.
The second section of the EO partly covers mass spying by establishing what information intelligence agencies can collect, retain, and share about US persons. The current guidelines, the United States Signals Intelligence Directive SP0018, also known as "USSID 18," are (just like the "minimization procedures" based off of them) littered with loopholes to over-collect, over-retain, and over-share Americans' communications—all without a probable cause warrant or any judicial oversight.
Defenders (.pdf) of the mass spying conducted under the Executive Order point out the order "protects" such US person information with guidelines like USSID 18, but such protections are window-dressing, at best. Policies like USSID 18 and other accompanying Executive Order guidelines such as the "Special Procedures Governing Communications Metadata Analysis" allow for extensive use of US person information and data without a probable cause warrant. Indeed, news reports and Congressional testimony confirm the "Special Procedures" are used to map Americans' social networks. The procedures are clear evidence the government believes that Fourth Amendment’s protections stop at the border.
Uses of Executive Order 12333
We do know a little about the spying conducted using EO 12333, but more must be revealed to the public. One early news report revealed it was the NSA's claimed authority for the collection of Americans' address books and buddy lists. It's also involved in the NSA's elite hacking unit, the Tailored Access Operations unit, which targets system administrators and installs malware while masquerading as Facebook servers. And in March, the Washington Post revealed the order alone—without any court oversight—is used to justify the recording of "100 percent of a foreign country's telephone calls." The NSA's reliance on the order for foreign spying includes few, if any, Congressional limits or oversight. Some of the only known limits on Executive spying are found in Executive procedures like USSID 18, the metadata procedures discussed above, and probably other still-classified National Security Policy Directives, none of which have been publicly debated much less approved by Congress or the courts.
The extent of the NSA's reliance on Executive Order 12333 demands that the government release more information about how the order is used, or misused. And Congress—specifically the Judiciary and Intelligence committees—must reassert the same aggressive and diligent oversight they performed in the 1970s and 1980s.
