FISA stands for the Foreign Intelligence Surveillance Act, enacted 1978 in response to revelations about US intelligence-service abuses (Church Committee hearings, COINTELPRO). Establishes the Foreign Intelligence Surveillance Court (FISC), a secret federal court that authorizes electronic surveillance for foreign intelligence purposes. Section 702, added in 2008, authorizes mass collection of non-US persons’ communications passing through US infrastructure. Reauthorized through April 2026, with another reauthorization fight scheduled.
What it means in practice
The mechanics matter. Traditional FISA (Title I) targets specific individuals with court-issued surveillance orders, similar to a wiretap but with lower disclosure requirements. Section 702 is bulk: the government tasks selectors (email addresses, phone numbers) believed to be foreign-targeted, US providers turn over matching communications, and the FBI can later query the resulting database for incidental US-person communications without a warrant. The “incidental” collection is structural, not accidental: any time a US person communicates with a 702-targeted foreign person, both sides of the conversation enter the collection. Privacy and Civil Liberties Oversight Board reports have documented millions of US-person query terms run annually. Reform proposals to require warrants for US-person queries have repeatedly stalled.
Who it affects, and how
Officially, FISA targets foreign persons abroad. Operationally, US persons who communicate with foreign-targeted selectors get pulled into 702 collection. That includes: journalists with foreign sources, lawyers representing foreign clients, NGO staff coordinating with overseas partners, academics with international research collaborators, families with relatives abroad. The volume is opaque (the 2024 ODNI annual report disclosed 57 million 702-collected communications retained at year-end), the query rate by FBI is opaque (PCLOB reports indicate it runs in the hundreds of thousands per year), and the practical recourse is nearly nil because standing to sue requires proof of being targeted, which is classified.
What you can change today
Two structural moves and one tactical. Structural: route sensitive communications through end-to-end encryption that operates outside US provider infrastructure (Signal, Proton Mail, Tutanota, Olvid for the EU-jurisdiction option) so that even if the metadata enters 702 collection, the content does not. Structural: minimize routine cross-border communication that mixes sensitive and non-sensitive content, because aggregated metadata is what produces the “incidental” sweep. Tactical: assume any communication on a Gmail/Outlook/Apple iCloud account with a foreign person known to be of intelligence interest is in the collection, and plan accordingly.