S. 3893 — SAFE Act

This section requires the Department of Justice to audit each covered query (i.e., FBI query using one or more terms associated with a covered person) under Section 702(f) of the Foreign Intelligence Surveillance Act of 1978 (FISA; 50 U.S.C. 1881a(f))—defined as a U.S. person or a person reasonably believed to be located in the United States at the time of the query or the communication—conducted during each 180-day period beginning on the date of enactment, with audits completed within 90 days after each period and unredacted results submitted to the congressional intelligence committees, Senate Judiciary Committee, and House Judiciary Committee within 30 days thereafter (120 days total after period's end); requires an in-person briefing if submission exceeds 127 days after period's end; and repeals the audit requirement under Section 2(c) of the Reforming Intelligence and Securing America Act (50 U.S.C. 1881a note). As background, FISA Section 702 authorizes warrantless acquisition of foreign communications for foreign intelligence purposes, with incidental U.S. person information subject to domestic querying under Attorney General-approved procedures. The section further amends FISA Section 702(f) to require FBI querying procedures that provide for (1) training prior to any query and annually thereafter; (2) absent exigent circumstances, prior FBI attorney approval for queries reasonably believed to identify U.S. elected officials, state governors or appointees, political candidates or prominent persons/organizations, media organizations or members, federal or state supreme court judges, religious organizations or prominent persons, or two or more batch queries; (3) for covered queries, a prior written factual justification (explaining each query of the same U.S. person) and record of terms, date, personnel, and justification; and (4) affirmative election to include unminimized Section 702-acquired data when querying mixed FBI systems.

This section amends FISA Section 707 (50 U.S.C. 1881f) to require the Attorney General, in consultation with the Director of National Intelligence, to submit annual reports to the congressional intelligence committees and Judiciary Committees on queries (disaggregated by agency) of information acquired under FISA Section 702 (i.e., warrantless electronic surveillance targeting non-U.S. persons abroad). The reports must include (1) the total number of covered queries (i.e., queries using U.S. person identifiers, as defined in Section 702(f)(8)); (2) the number of times U.S. officers or employees accessed communications content (as defined in 18 U.S.C. 2510(8)) or probable-cause-warrant-level information in query results; (3) the number of applications for and grants of orders required under Section 702(f)(2)(B)(i)(I) to access such information; (4) the number of asserted exceptions under Section 702(f)(2)(B)(i)(II)–(IV), disaggregated by type; (5) the number of batch queries involving two or more approved queries; and (6) inter-agency queries of unminimized Section 702 data, broken out by querying agency, requesting agency, and date. Public versions of the reports, subject to declassification review, must be published each April covering the prior calendar year. This section repeals subsection (f) of FISA Section 603 (50 U.S.C. 1873)—a superseded reporting requirement on orders under FISA subchapters I and II and Sections 1881b and 1881c—and redesignates subsection (g) as subsection (f).

This section adds a new section 710 to Title VII of the Foreign Intelligence Surveillance Act of 1978 (FISA), requiring the FBI Director to establish procedures holding FBI employees accountable for violations of law, guidance, or procedures governing queries of information acquired under FISA section 702 (i.e., foreign intelligence collection targeting non-U.S. persons reasonably believed to be located outside the United States). The required procedures must include (1) centralized tracking of such incidents over time, (2) escalating consequences—including, for initial incidents, suspension of access to such information pending remedial action and documentation in personnel files, and, for subsequent incidents, possible indefinite suspension of access, reassignment, and referral to the FBI Inspection Division—and (3) requirements to refer intentional or reckless conduct to the Inspection Division for investigation and disciplinary action by the FBI Office of Professional Responsibility. This section also (1) makes a conforming change to the FISA table of contents, (2) requires an initial FBI report to the congressional intelligence committees and the Judiciary committees of the House and Senate within 180 days of enactment detailing the new procedures, plus annual reports thereafter on disciplinary actions taken (in unclassified form, with a possible classified annex), (3) amends FISA section 702(f)(5) to require annual FBI reports to those committees on actions under FBI minimum accountability standards for section 702 compliance, and (4) amends FISA section 702(n)(2) to add the House and Senate Judiciary committees to recipients of information on probable cause FISA orders derived from section 702 acquisitions.

This section revises the prohibition on reverse targeting under Section 702 of the Foreign Intelligence Surveillance Act of 1978 (FISA) (i.e., warrantless acquisition of foreign intelligence by targeting non-U.S. persons reasonably believed to be located outside the U.S.) to bar targeting such a person if a purpose of the acquisition is to target one or more U.S. persons or persons reasonably believed to be located in the U.S. at the time of acquisition or communication (from if the purpose is to target a particular, known person reasonably believed to be in the U.S.). It makes conforming changes to (1) targeting procedures in subsection (d)(1)(A), (2) certification requirements in subsection (h)(2)(A)(i), and (3) Foreign Intelligence Surveillance Court order criteria in subsection (j)(2)(B). (Thus, these revisions broaden the reverse targeting ban to cover multiple targets, lower the intent threshold from "the purpose" to "a purpose," and extend protections to non-U.S. persons in the U.S.)

This section amends reporting and court review requirements under Section 702 of the Foreign Intelligence Surveillance Act of 1978 (FISA). It requires the inclusion in semiannual reports to Congress under subsection (h)(2) of a random sample of targeting decisions and supporting written justifications from the prior year, using a sample size and methodology approved by the Foreign Intelligence Surveillance Court (FISC); and it directs the FISC, as part of its compliance reviews under subsection (j)(1), to review such samples. (Section 702 authorizes targeting of non-U.S. persons reasonably believed to be located outside the United States to acquire foreign intelligence information, subject to FISC-approved targeting and minimization procedures.)

This section sunsets prior expansions of the definition of "electronic communication service provider" in FISA section 701(b)(4) (50 U.S.C. 1881(b)(4)) and section 801(6) (50 U.S.C. 1885(6)), effective December 31, 2026. Specifically, it (1) strikes subparagraph (E), which includes service providers with access to equipment used to transmit or store wire or electronic communications (excluding those primarily serving as public accommodation facilities, dwellings, community facilities, or food service establishments); (2) redesignates subparagraph (F) as subparagraph (E); (3) strikes "custodian," from the redesignated subparagraph (E); and (4) revises its cross-reference from "(D), or (E)" to "or (D)." (The term identifies entities subject to FISA orders for assistance in pen register/trap-and-trace surveillance under Title VII and production of business records under Title VIII.)

This section amends Section 702(i) of the Foreign Intelligence Surveillance Act of 1978 (FISA) (50 U.S.C. 1881a(i)) to add limitations on directives issued to electronic communication service providers to assist in foreign intelligence acquisitions targeting non-U.S. persons reasonably believed to be located outside the United States. (As background, such directives compel providers to furnish facilities, data, or assistance for upstream and downstream collection under FISA Section 702.) The amendment adds paragraph (7), which: (1) defines covered electronic communication service providers (generally, providers, their custodians, or agents under FISA Section 701(b)(4)(E) or (F), excluding providers under Section 701(b)(4)(A)-(D) or their agents when assisting the government under those provisions) and covered opinions (specified 2022 FISA Court and 2023 FISA Court of Review opinions authorized for public release on August 23, 2023); (2) prohibits directives to covered providers unless the provider offers the type of service at issue in the covered opinions; (3) requires the Director of National Intelligence (DNI), in consultation with the Attorney General (AG), to complete within 180 days of enactment a declassification review under Executive Order 13526 of the service provider type and services in the covered opinions, prioritizing public transparency given prior disclosures; (4) requires any permitted directive to a covered provider to include a summary description of the services at issue in the covered opinions (unless previously provided and unchanged); and (5) requires the AG to notify the Foreign Intelligence Surveillance Court (FISC) within 7 days of issuing or materially changing such a directive, providing the directive and a description of the provider and services (unless previously provided and unchanged), with additional information submitted as soon as feasible but no later than collection initiation.

This section extends the sunset date for Title VII of the FISA Amendments Act of 2008 (i.e., authorities under FISA §702 for warrantless acquisition of foreign intelligence information targeting non-U.S. persons reasonably believed to be located abroad)—and for related amendments excluding such acquisitions from prohibitions on unauthorized interceptions (18 U.S.C. 2511)—to April 20, 2028 (from two years after the date of enactment of the Reforming Intelligence and Securing America Act). It makes conforming amendments to §404(b) of such Act (i.e., FISA exclusivity provisions) to reflect the new date and remove references to prior reauthorizations.

This section establishes Title IX of the Foreign Intelligence Surveillance Act of 1978 (FISA) to require (1) the Attorney General or other applicants to disclose all material government information—including exculpatory information—in FISA court order applications (new Sec. 901); and (2) certifications attesting to "accuracy procedures" meeting minimum standards (e.g., reflecting doubting information, documenting factual assertions, reviewing confidential human source reliability, disclosing prior government relationships with targets, and annual auditing), which courts must find adequate before issuing orders (new Sec. 902). The section further (1) amends FISA Section 702 certifications to require attestations that the Attorney General and Director of National Intelligence have been apprised of information potentially questioning certification accuracy or required findings; (2) reorganizes Section 104(a) application contents by striking paragraphs (7) and (13) and redesignating paragraphs (8) through (12) as (7) through (11); and (3) prohibits probable cause statements under Section 104(a)(3) from including information beyond that obtained from media source content or gathered by a political campaign.

This section amends Section 109(a) of the Foreign Intelligence Surveillance Act of 1978 (FISA)—which imposes criminal penalties of fine or imprisonment not more than five years, or both, for certain surveillance violations—to add two new offenses: (1) knowingly submitting a document or making a statement to the Foreign Intelligence Surveillance Court (FISC, under FISA §103(a)) or FISC Court of Review (under FISA §103(b)) containing a false material declaration or material omission; and (2) knowingly disclosing the existence of or information in a FISA Title I surveillance application to an unauthorized person, except as authorized by statute or executive order for whistleblowers. Subsection (b) clarifies that these amendments do not interfere with enforcement of 18 U.S.C. 798 (prohibiting unauthorized disclosure of classified communications or cryptographic intelligence information) or other laws on classified information disclosure.

This section requires the head of each federal department or agency authorized to acquire foreign intelligence information under the Foreign Intelligence Surveillance Act of 1978 (FISA) to establish procedures (1) defining what constitutes a violation of FISA by an agency officer or employee and (2) for imposing appropriate adverse personnel actions against violators, including more severe actions for subsequent violations. It further requires each such agency head to report to Congress on implementation of these procedures not later than 90 days after enactment.

This section limits civil immunity for communications providers furnishing information, facilities, or technical assistance to the government without a court order under 18 U.S.C. § 2511(2)(a)(ii) by (1) requiring a written certification from an official authorized under 18 U.S.C. § 2518(7) (i.e., for emergency wiretap authorizations) or the Attorney General affirming that emergency interception requirements are met and the assistance is required; and (2) restricting such immunity to assistance that ceases at the earliest of a court order denial, obtaining the sought communication, or 48 hours after interception begins. (Thus, providers lose immunity for assistance beyond the standard 48-hour emergency window absent a court order.)

This section defines “derived from” in new FISA §101(q) (50 U.S.C. 1801(q)) as information or evidence the government would not have originally possessed but for electronic surveillance, physical search, pen register or trap and trace use, production of tangible things, or acquisition under FISA or executive authority—disregarding claims of attenuation, inevitable discovery, or subsequent reobtainment through other means. It inserts cross-references to this definition in the definitional provisions of FISA titles III (physical search, 50 U.S.C. 1821(1)), IV (pen registers and trap and trace devices, 50 U.S.C. 1841(1)), V (business records and tangible things, 50 U.S.C. 1861(1)), and VII (targeting non-U.S. persons abroad, 50 U.S.C. 1881a). (Thus, the definition applies government-wide across FISA authorities to identify information subject to statutory use and disclosure restrictions, including prohibitions on parallel construction to conceal FISA origins.) This section further requires the Attorney General and Director of National Intelligence, not later than 90 days after enactment, to publish policies and guidance on §101(q) for the intelligence community and federal law enforcement agencies, with any modifications also published. This section amends FISA §706 (50 U.S.C. 1881e) by (1) removing from subsection (a)(1) the prior exception from use restrictions “for the purposes of subsection (j) of such section”; and (2) revising subsection (b) to deem information acquired under §§703, 704, or 705 (targeting non-U.S. persons abroad) as acquired from title I electronic surveillance for purposes of §106 (i.e., court notification and disclosure to aggrieved persons when used or disclosed in proceedings). (Thus, title VII acquisitions are fully subject to title I use and notice requirements.)

This section sunsets the grandfather clause in section 102(b)(2) of the USA PATRIOT Improvement and Reauthorization Act of 2005 (P.L. 109-177) allowing use of title V of the Foreign Intelligence Surveillance Act of 1978 (i.e., business records provision for foreign intelligence and terrorism investigations), as in effect on March 14, 2020, with respect to certain investigations, offenses, or potential offenses 180 days after enactment of the SAFE Act. (Thus, the government must transition such matters to the current version of FISA title V thereafter.)

This section expands the circumstances requiring the Foreign Intelligence Surveillance Court (FISC)—a panel of 11 district judges designated by the Chief Justice to authorize foreign intelligence surveillance—to appoint one or more amicus curiae with privacy and civil liberties expertise, unless the court finds appointment inappropriate, for any application or motion presenting (1) a novel or significant legal interpretation; (2) significant First Amendment concerns for U.S. persons; (3) a sensitive investigative matter (newly defined to include surveillance of domestic public officials or candidates and their staff, religious or political organizations or prominent U.S. persons therein, domestic news media, or comparably sensitive matters involving U.S. persons or entities); (4) approval of a new program, technology, or use thereof; (5) reauthorization of programmatic surveillance; or (6) other novel or significant civil liberties issues. It further (1) eliminates the prior exception allowing non-appointment due to potential undue delay; (2) requires amici to address privacy and civil liberties impacts on U.S. persons and authorizes them to raise novel such issues; (3) grants amici authority to petition the FISC to certify questions of law to the FISA Court of Review (with written reasons required for denial and automatic reappointment there unless inappropriate), to petition the Court of Review to certify questions to the Supreme Court, and deems such petitions eligible for declassification review; and (4) ensures amici access to government applications, certifications, and supporting materials (including classified information under seal) to the extent available to the government.

This section revises the declassification review requirement for significant decisions, orders, or opinions of the Foreign Intelligence Surveillance Court (FISC) or Foreign Intelligence Surveillance Court of Review (FISCR)—which interpret provisions of law, including the term "specific selection term" used in FISA business records orders—by changing the 180-day deadline to run from the issuance of such documents (from the commencement of the review). (Thus, this accelerates public availability of declassified or redacted FISC/FISCR opinions or waiver summaries.)

This section amends 18 U.S.C. Chapter 21 (contempt) to explicitly include the Foreign Intelligence Surveillance Court (FISC) and Foreign Intelligence Surveillance Court of Review (FISC-R)—which hear applications for and review denials of electronic surveillance orders under the Foreign Intelligence Surveillance Act (FISA, 50 U.S.C. 1803)—as "courts of the United States" subject to its provisions. Specifically, it (1) revises the parenthetical reference to FISC and FISC-R in section 402; and (2) adds section 404 defining those courts by cross-reference to FISA (50 U.S.C. 1871(e)). It also makes a conforming amendment to the chapter's table of sections.

This section directs the Inspector General of the Department of Justice to conduct an audit of alleged or potential violations of, and failures to comply with, the Foreign Intelligence Surveillance Act of 1978 (FISA) and related procedures—including analysis of the accuracy and completeness of applications and certifications for orders under FISA sections 105, 303, 402, 502, 702, 703, and 704—not later than June 30 of the first calendar year after enactment and every three years thereafter, and to submit a report on each audit to the Senate Select Committee on Intelligence, Senate Committee on the Judiciary, House Permanent Select Committee on Intelligence, and House Committee on the Judiciary. (As background, these FISA sections authorize various court orders for electronic surveillance, physical searches, and pen register/trap-and-trace devices in national security investigations.)

This section prohibits elements of the intelligence community from acquiring covered data—defined as data or derived data linked to a covered person (i.e., a U.S. person or an individual reasonably believed to be located in the United States)—directly or indirectly, excluding publicly available data, voluntarily public data by the covered person, specific communications with non-covered persons, or non-data human intelligence. Exceptions permit acquisition (1) pursuant to a court order under the Foreign Intelligence Surveillance Act or Title 18, U.S. Code; (2) for employment-related purposes limited to employees or applicants, with destruction when no longer needed; (3) for compliance with statutory or constitutional limits, similarly restricted; (4) to address an imminent threat of death or serious harm; (5) with case-by-case consent from the covered person (or authorized third party); or (6) for nonsegregable data in datasets, subject to minimization procedures. The section further requires the Attorney General to adopt minimization procedures reasonably designed to exclude, remove, delete, and restrict querying of non-excepted covered data, including prompt destruction upon identification and limits on operational use or database inclusion.

This section amends Section 2702 of title 18, United States Code—part of the Stored Communications Act prohibiting electronic communication service providers and remote computing service providers from disclosing communication contents and certain subscriber records to governmental entities without legal process or exceptions—by adding subsection (e) to prohibit law enforcement agencies (covered governmental entities) from obtaining covered personal data on covered persons (U.S. persons or those reasonably believed to be located in the United States) from nongovernmental entities other than individuals (covered organizations, i.e., data brokers) in exchange for anything of value, including purchases, fees, or services. Covered personal data includes any data, derived data, or unique identifiers linked or reasonably linkable to such persons or their electronic devices (excluding certain lawfully available government records or media and targeted non-covered communications). Exceptions apply to (1) compilations including non-covered data where covered data cannot reasonably be excluded, with required minimization; (2) whistleblower disclosures under programs such as IRC §7623; (3) cost reimbursements under compulsory legal process such as 18 USC §2706; (4) employment-related data on employees or applicants, if used and destroyed solely for such purposes; (5) background checks with subject consent, if used and destroyed solely for such purposes; (6) lawfully obtained public data; and (7) emergencies involving reasonable beliefs of threats to life or safety.

This section defines "online service provider" in 18 U.S.C. §2711(5) to include providers of electronic communication service (ECS), remote computing service (RCS), and any information service, system, or access software provider enabling multiple users' computer server access (including Internet access services operated by libraries or educational institutions). It applies this term throughout 18 U.S.C. §§2702(a), 2703(a), (c), and (g) by replacing prior references to specific ECS or RCS providers, thereby subjecting online service providers to (1) warrant requirements for disclosing contents of communications in electronic storage for 180 days or less; (2) existing disclosure rules for contents held over 180 days or by RCS providers; (3) court orders, subpoenas, or warrants for subscriber records; and (4) prohibitions on voluntary disclosures of contents or records. (Thus, the Stored Communications Act's protections against government access to stored electronic communications and data extend to a broader range of internet-related entities.)

This section establishes privacy protections for covered personal data held by covered organizations that are not online service providers (as defined in 18 U.S.C. §2702(e)) by prohibiting governmental entities from requiring disclosure unless they obtain a court order issued on the same basis, subject to the same limitations, and applying the most stringent standard under federal statute or the Constitution applicable to comparable disclosures of customer or subscriber records by online service providers. (Thus, such organizations—typically data brokers—receive equivalent procedural safeguards under the Stored Communications Act as electronic communication service providers.)

This section (1) defines "intermediary or ancillary service provider" in the Stored Communications Act (18 U.S.C. §2711) as an entity or facilities owner or operator that directly or indirectly delivers, transmits, stores, or processes communications or covered personal data for an online service provider; and (2) prohibits such providers from knowingly disclosing to any person or entity the contents of a communication while in electronic storage or to any governmental entity records or other information pertaining to subscribers or customers of, recipients of communications from, or senders of communications to, the online service provider. (As background, the Stored Communications Act generally bars electronic communication service providers and remote computing service providers from disclosing communication contents or certain customer records absent legal authorization.)

This section revises the semiannual reporting requirements for the Director of National Intelligence under Section 603(b) of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1873(b))—which cover activities under Section 702 (i.e., targeting non-U.S. persons reasonably believed to be outside the United States to acquire foreign intelligence information)—by (1) requiring a description of the subject matter of each certification provided under Section 702(h); (2) requiring statistics on the number of persons targeted and selectors used under Section 702(a), disaggregated by certification; (3) requiring the total number of directives issued to electronic communication service providers under Section 702(i)(1), disaggregated by provider type; (4) requiring counts of disseminated intelligence reports derived from Section 702 collection or other Attorney General-approved procedures that contain U.S. person identities (disaggregated by whether identities are masked or openly included); (5) requiring the number of queries of data obtained under Attorney General-approved procedures (without court order or similar process) to find communications or information of or about U.S. persons or persons reasonably believed to be located in the United States; (6) requiring the number of criminal proceedings in which information obtained under such procedures was entered into evidence, used, or disclosed; and (7) requiring a good faith estimate of the percentage of "covered communications" (i.e., incidentally acquired nonpublic telephone or electronic communications to or from U.S. persons under non-court-authorized intelligence activities, per 50 U.S.C. 1813) retained for more than five years overall and due to encryption. This section also repeals the exemption for the Federal Bureau of Investigation from certain of these reporting requirements (previously in Section 603(d)(2)) and makes conforming amendments to cross-references in Section 603(d)(1).

This section revises the notification requirement under Section 18(a) of the Reforming Intelligence and Securing America Act by directing notifications to Congress of certain unauthorized disclosures to the appropriate congressional committees (from the congressional intelligence committees).

This section authorizes the Attorney General, in coordination with the Director of National Intelligence as appropriate, to delay implementation of a provision of this Act or an amendment made by this Act for up to 180 days upon a showing to the appropriate committees of Congress that the delay is necessary (1) to develop and implement technical systems needed for compliance or (2) to hire or train personnel needed for compliance. For this purpose, the appropriate committees of Congress are the congressional intelligence committees (as defined in 50 U.S.C. 3003), the Senate Committee on the Judiciary, and the House Committee on the Judiciary.