H.R. 7816 — Protect Liberty and End Warrantless Surveillance Act of 2026

This section amends Section 702(f) of the Foreign Intelligence Surveillance Act (FISA) (50 U.S.C. 1881a(f)) to prohibit any U.S. officer or employee from conducting a "covered query" of information acquired under Section 702(FISA's warrantless foreign intelligence surveillance authority)—intended to find communications or information of or about one or more United States persons—absent an exception. (As background, Section 702 authorizes collection of communications of non-U.S. persons abroad reasonably believed to possess foreign intelligence value; such incidentally acquired data on U.S. persons previously could be searched via "queries" without a warrant.) Exceptions apply if (1) the U.S. person is the subject of a FISA Title I electronic surveillance order, Title III physical search order, or criminal warrant; (2) an emergency involving imminent threat of death or serious bodily harm exists and requires the query before obtaining authorization; (3) the U.S. person (or authorized third party) consents on a case-by-case basis; or (4) the query uses a known cybersecurity threat signature solely to identify targets of malicious software, with no review of additional communication contents. (Thus, emergency exception queries are limited to the originating threat in proceedings; cybersecurity queries require FISC notification within 90 days; all such exceptions except consent require congressional and FISC/Judiciary Committee reporting within 90 days; denied emergency queries bar use of results.) The section further redefines "query" to mean any manual or automated technique to detect or retrieve Section 702-acquired information (excluding manual review of already-retrieved data) and defines "covered query" as one using terms associated with covered persons (i.e., U.S. persons), conducted to detect/retrieve their information, or with specific reason to believe it will do so.

This section sunsets, effective December 31, 2026, prior expansions to the definition of "electronic communication service provider" in FISA sections 701(b)(4) and 801(6) (50 U.S.C. 1881(b)(4), 1885(6)). (As background, the term identifies entities subject to government directives to assist in FISA Title VII acquisitions of foreign intelligence information and Title VIII pen register and trap-and-trace surveillance.) Specifically, for each section, it (1) adds "or" at the end of subparagraph (D); (2) strikes subparagraph (E), which covered service providers with access to equipment used to transmit or store wire or electronic communications (excluding public accommodation facilities, dwellings, community facilities, and food service establishments); (3) redesignates subparagraph (F) as subparagraph (E); and (4) in new subparagraph (E), strikes "custodian," and revises the cross-reference from "(D), or (E)" to "or (D)". (Thus, the definition reverts to covering primarily telecommunications carriers, electronic communication service providers, remote computing service providers, other communication service providers with access to communications as transmitted or stored, and their officers, employees, or agents.)

This section amends Section 702(i) of the Foreign Intelligence Surveillance Act (FISA) (50 U.S.C. 1881a(i)) by adding paragraph (7) to limit directives issued to covered electronic communication service providers (i.e., certain providers, custodians, or agents under FISA §701(b)(4)(E)-(F), excluding traditional telecommunications providers under §701(b)(4)(A)-(D)). Specifically, it (1) prohibits such directives unless the provider offers the type of service at issue in specified 2022-2023 Foreign Intelligence Surveillance Court (FISC) and FISC Review (FISCR) opinions authorized for public release on August 23, 2023; (2) requires the Director of National Intelligence (DNI), in consultation with the Attorney General (AG), to complete a declassification review under Executive Order 13526 within 180 days of enactment and publicly disclose, to the greatest extent practicable, the service provider type and services in those opinions (considering public interest in transparency and prior disclosures); (3) mandates that qualifying directives to covered providers include a summary description of services in the covered opinions (unless previously provided without material change); and (4) requires the AG to notify the FISC of new or materially changed qualifying directives within 7 days (with provider and service descriptions; no duplication for unchanged directives) and provide additional information as soon as feasible before collection begins. (As background, FISA §702 authorizes the AG and DNI jointly to target non-U.S. persons abroad for foreign intelligence via directives compelling provider assistance, subject to targeting/minimization procedures and FISC oversight; thus, these limits target directives to non-traditional providers involved in recent FISC challenges.)

This section expands the Foreign Intelligence Surveillance Court's (FISC) authority to appoint amici curiae with privacy and civil liberties expertise. (1) It requires such appointments—unless deemed inappropriate—for applications or motions presenting novel or significant legal interpretations; First Amendment concerns for U.S. persons; sensitive investigative matters (newly defined to include activities of domestic public officials, political candidates or their staff, religious or political organizations or prominent U.S. persons therein, domestic news media, or other comparably sensitive matters involving U.S. persons or entities); novel programs, technologies, or uses thereof; programmatic surveillance reauthorizations; other novel civil liberties issues; or U.S. person activities. (2) It authorizes appointed amici to seek leave to raise novel privacy or civil liberties issues impacting proposed surveillance legality and to petition the FISC for certification of legal questions to the FISA Court of Review (with written denial reasons required and automatic reappointment unless inappropriate) or the Court of Review for Supreme Court review under 28 U.S.C. §1254(2), treating such petitions as declassifiable FISC/Court of Review decisions. (3) It ensures amici access to unredacted applications, supporting materials, and relevant prior decisions cited by the government. (As background, FISC approves electronic surveillance warrants under FISA (50 U.S.C. ch. 38) for foreign intelligence purposes; these changes broaden adversarial input in proceedings historically ex parte.)

This section extends the repeal date for title VII of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1881 et seq.)—which authorizes warrantless acquisition of foreign intelligence information from non-U.S. persons reasonably believed to be located outside the United States (i.e., Section 702 authorities), among others—to April 20, 2028 (from two years after the date of enactment of the Reforming Intelligence and Securing America Act). The section (1) amends the repeal provision in Section 403(b) of the FISA Amendments Act of 2008, including a conforming change to the note following 18 U.S.C. 2511; and (2) revises transition procedures in Section 404(b) of that Act to reference the new repeal date. The amendments take effect on the earlier of the date of enactment of this Act or April 20, 2026.

This section amends the Stored Communications Act (18 U.S.C. § 2702), which prohibits providers of electronic communication services or remote computing services from disclosing the contents of communications or certain subscriber records to governmental entities absent exceptions, by adding subsection (e) to prohibit law enforcement agencies and intelligence community elements from obtaining covered customer or subscriber records—pertaining to U.S. persons (i.e., covered records including non-content records, communication contents, or location information)—or illegitimately obtained information (i.e., obtained in violation of service agreements, privacy policies, by deception, unauthorized access, or certain contracts) from third parties (i.e., non-governmental entities not acting as service providers) in exchange for anything of value (i.e., purchases, fees, or other consideration). The prohibition applies regardless of whether indirectly acquired and bars non-law enforcement or non-intelligence agencies from sharing such records obtained for value with those entities. (Thus, covered records or illegitimately obtained information acquired in violation, and any derivative evidence, are inadmissible in federal, state, or local proceedings.) The Attorney General must adopt minimization procedures to limit acquisition, retention, and dissemination of such information pertaining to U.S. persons, which agencies must implement.

This section establishes disclosure limitations under the Stored Communications Act by adding a new subsection (i) to 18 U.S.C. § 2703, prohibiting a governmental entity from requiring a third party to disclose covered customer or subscriber records or illegitimately obtained information (as defined in 18 U.S.C. § 2702(e)) unless pursuant to a court order. Such an order must be issued on the same basis and subject to the same limitations as would apply to comparable disclosures from a provider of electronic communication service or remote computing service, applying the most stringent standard under federal statute or the Constitution. (Thus, the provision prevents governmental entities from circumventing Stored Communications Act requirements—such as warrants for certain communications content—by seeking the specified records or information from third parties instead of service providers.)

This section amends the Stored Communications Act (SCA), which generally prohibits providers of electronic communication services to the public (ECS) or remote computing services (RCS) from disclosing communication contents or certain customer records without consent or legal process, by (1) defining an "intermediary service provider" as an entity or facilities owner or operator that directly or indirectly delivers, stores, or processes communications for or on behalf of an ECS or RCS provider; and (2) prohibiting such providers from knowingly divulging (A) to any person or entity the contents of a communication while in electronic storage by that provider or (B) to any governmental entity a record or other information pertaining to a subscriber or customer of, a recipient of a communication from a subscriber or customer of, or the sender of a communication to a subscriber or customer of, the ECS or RCS provider for or on behalf of which the intermediary acts. (Thus, this extends SCA nondisclosure requirements to upstream entities such as network transit providers or data center operators.)

This section defines "online service provider" in 18 U.S.C. §2711(6) to include providers of electronic communication service or remote computing service, any information service, system, or access software provider enabling multiple users' computer access to a server (including internet access providers), and such systems or services operated by libraries or educational institutions. (As background, §§2702 and 2703 of title 18, U.S. Code—part of the Stored Communications Act—generally prohibit those providers from voluntarily disclosing user communications or data and require warrants or other specified processes for governmental entities to compel disclosure of contents in electronic storage for 180 days or less, contents held by remote computing services, and certain customer records.) The section replaces references to electronic communication service providers and remote computing service providers with "online service provider" throughout 18 U.S.C. §§2702(a) (limitations on voluntary disclosures) and 2703(a), (c), and (g) (required disclosures of contents and records). (Thus, these warrant and process requirements, along with voluntary disclosure limits, extend to the newly defined broader class of online service providers.)

This section revises 18 U.S.C. 2511(2)(f) to except from certain statutes (chs. 119, 121, 206 of title 18 and section 705 of the Communications Act) specified foreign intelligence acquisitions conducted without electronic surveillance—namely, (1) acquisitions of foreign intelligence from international or foreign communications pursuant to express statutory authority or solely involving non-U.S. persons outside the United States, or (2) foreign intelligence activities involving foreign electronic communications systems pursuant to express statutory authority or solely involving non-U.S. persons outside the United States—and to designate procedures under those statutes and FISA as the exclusive means for electronic surveillance (as defined in FISA) and interception of domestic wire, oral, and electronic communications. The section further designates FISA as the exclusive means for the U.S. government to acquire, for foreign intelligence purposes inside the United States or from a U.S.-located person or entity providing telecommunications, electronic communication, or remote computing services: (1) electronic communications transaction records, call detail records, or other communications information of U.S. persons or persons inside the United States; (2) location information (as defined in new 18 U.S.C. 2702(e)), web browsing history, or internet search history of such persons; and (3) any information, records, data, or tangible things whose compelled production would require a warrant for law enforcement purposes. (As background, the Foreign Intelligence Surveillance Act of 1978 authorizes foreign intelligence surveillance subject to court-approved orders and other specified procedures.)

This section limits civil immunity under 18 U.S.C. § 2511(2)(a) for communications providers furnishing assistance to the government for wire, oral, or electronic surveillance absent a court order by (1) requiring, for emergency assistance, a written certification by an official specified in 18 U.S.C. § 2518(7) (i.e., those authorized for emergency intercepts) or the Attorney General confirming that emergency requirements are met and the assistance is required; and (2) limiting such immunity to assistance that ceases at the earliest of a court order denial, obtaining the sought communication, or 48 hours after interception begins. (As background, § 2518(7) authorizes emergency intercepts without prior court approval when delay would risk death or serious injury, subject to prompt court application; thus, this change curtails potential provider liability exposure beyond 48 hours in unsuccessful or unapproved emergencies.)