S. 4280 — SAFE Act

This section establishes mandatory audits by the Department of Justice of each covered query of United States persons conducted by the Federal Bureau of Investigation during the 180-day period beginning on the date of enactment and each 180-day period thereafter, requiring completion within 90 days and submission of complete unredacted results to the congressional intelligence committees and the Judiciary Committees of the Senate and House within 30 days after completion, with an in-person briefing required if results are not submitted within 120 days. It also revises the querying procedures applicable to the Federal Bureau of Investigation under section 702(f) of the Foreign Intelligence Surveillance Act of 1978 by requiring annual training for personnel, prior attorney approval absent exigent circumstances for queries using terms identifying United States elected officials, governors, presidential or gubernatorial appointees, political candidates or organizations, media organizations, federal or state judges, or religious organizations, prior attorney approval for batch queries of two or more terms, prior written factual justifications retained with query records for each covered query, and affirmative election to include unminimized section 702-acquired contents or noncontents when querying systems that combine such information with other lawfully obtained data. This section repeals the superseded audit requirement in section 2(c) of the Reforming Intelligence and Securing America Act and expands the definitions of covered person and covered query.

This section establishes new annual reporting requirements under the Foreign Intelligence Surveillance Act of 1978 regarding queries of information acquired under section 702. The Attorney General, in consultation with the Director of National Intelligence, must submit to the congressional intelligence committees and the Judiciary Committees of the Senate and House of Representatives a report that includes, disaggregated by each agency conducting such queries, the total number of covered queries; the number of times an officer or employee accessed communications contents or information whose compelled disclosure would require a probable cause warrant; the number of applications for orders and the number granted; the number of times exceptions were asserted under specified subclauses; the number of batch queries conducted using batch job technology or similar methods; and the number of queries run by one agency at the request of another agency without access to unminimized section 702 information, broken down by agency and date. Each report must be made publicly available in April, subject to declassification review by the Attorney General and the Director of National Intelligence. This section also repeals the superseded reporting requirement in section 603(f) of that Act and redesignates subsection (g) as subsection (f).

This section establishes accountability procedures for Federal Bureau of Investigation (FBI) employees who violate laws, guidance, or procedures governing queries of information acquired under section 702 of the Foreign Intelligence Surveillance Act of 1978. The procedures must include centralized tracking of individual employee violations over time; escalating consequences such as suspension of access to section 702 information and documentation in personnel files for initial incidents, and possible indefinite suspension of access, reassignment, and referral to the FBI Inspection Division for subsequent incidents; and clarification of requirements for referring intentional or reckless misconduct to the Inspection Division for investigation and disciplinary action by the Office of Professional Responsibility. This section also requires the FBI Director to submit an initial report to the House and Senate Judiciary Committees and congressional intelligence committees within 180 days of enactment detailing the procedures, followed by annual reports on disciplinary actions taken, including circumstances and results of each action. It further requires the Director to submit annual reports on actions taken under minimum accountability standards for section 702 query compliance and expands access to certain section 702 information to include the House and Senate Judiciary Committees.

This section strengthens the prohibition on reverse targeting under Section 702 of the Foreign Intelligence Surveillance Act of 1978 by barring acquisitions where a purpose (rather than the purpose) is to target one or more United States persons or persons reasonably believed to be located in the United States at the time of acquisition or communication. It updates the corresponding limitations, Attorney General and Director of National Intelligence certifications, and court review requirements to reflect the revised standard.

This section requires the submission to the Foreign Intelligence Surveillance Court of a random sample of targeting decisions and supporting written justifications from the prior year under Section 702 of the Foreign Intelligence Surveillance Act of 1978, using a sample size and methodology approved by the Court, and directs the Court to review the sample as part of its review of certifications.

This section sunsets, effective December 31, 2026, expansions to the definition of electronic communication service provider in sections 701(b)(4) and 801(6) of the Foreign Intelligence Surveillance Act of 1978. It strikes subparagraph (E) (and related references to custodians of data), redesignates subsequent subparagraphs, and removes the term “custodian,” thereby reverting the definition to its prior scope.

This section limits the issuance of directives under section 702(i) of the Foreign Intelligence Surveillance Act of 1978 to covered electronic communication service providers, defined to include service providers described in section 701(b)(4)(E), their custodians, and their officers, employees, or agents, but excluding providers described in subparagraphs (A) through (D) of that section. A directive may be issued to such a provider only if the provider offers the type of service at issue in the Foreign Intelligence Surveillance Court and Court of Review opinions authorized for public release on August 23, 2023. This section requires the Director of National Intelligence, in consultation with the Attorney General, to complete a declassification review under Executive Order 13526 not later than 180 days after enactment of the SAFE Act and to make publicly available to the greatest extent practicable the type of service provider and services at issue in those opinions. Directives issued on or after enactment to covered providers must include a summary description of the services at issue, unless a prior directive to the same provider already contained such a description that has not materially changed. The Attorney General must notify the Foreign Intelligence Surveillance Court within 7 days of serving or materially changing any such directive, providing a description of the provider and services at issue, unless a prior notification has not materially changed.

This section extends the expiration date of Title VII of the Foreign Intelligence Surveillance Act (FISA) and related authorities to April 20, 2028 (from two years after the date of enactment of the Reforming Intelligence and Securing America Act). It also makes conforming amendments to update statutory references to prior amendments of those authorities.

This section amends the Foreign Intelligence Surveillance Act of 1978 to require that any federal officer applying for a court order under the Act disclose to the court all information in the government's possession that is material to the application's requirements, including exculpatory information. It further amends section 702(h)(2) to mandate that certifications attest the Attorney General and Director of National Intelligence have been apprised of information that might reasonably question the certification's accuracy or raise doubts about required findings, adds new section 902 establishing detailed accuracy procedures (including documentation of factual assertions, review of confidential human source information, and annual compliance audits) that must be certified and judicially found adequate before any order may issue, and limits the use of information from media sources or political campaigns in applications under section 104.

This section adds criminal penalties under the Foreign Intelligence Surveillance Act of 1978 for knowingly submitting a false material declaration or material omission to the Foreign Intelligence Surveillance Court established under section 103(a) or 103(b), and for knowingly disclosing the existence of a FISA application or information contained therein to an unauthorized person, except for disclosures authorized by statute or executive order for whistleblowers. It includes a rule of construction clarifying that these amendments do not interfere with enforcement of 18 U.S.C. 798 or other laws prohibiting unlawful disclosure of classified information.

This section establishes procedures requiring the head of each Federal department or agency authorized to acquire foreign intelligence information under the Foreign Intelligence Surveillance Act of 1978 to set clear rules defining violations of the Act by its officers or employees and to impose appropriate adverse personnel actions for such violations, including more severe actions for repeat offenses. It also directs each such agency head to report to Congress on implementation of the procedures not later than 90 days after the date of enactment.

This section limits civil immunity from civil liability for providers of wire or electronic communication services that furnish information, facilities, or technical assistance to the government to intercept communications absent a court order. It replaces the prior certification process with a requirement for a written certification by the Attorney General or other specified official that the requirements for an emergency authorization under 18 U.S.C. § 2518(7) have been met and that the assistance is required. It further provides that such immunity applies only to the extent assistance ceases at the earliest of the denial of a court order application, the time the communication is obtained, or 48 hours after interception begins.

This section establishes a statutory definition of “derived from” for information obtained through electronic surveillance, physical searches, pen registers, trap and trace devices, tangible things production, or acquisitions under the Foreign Intelligence Surveillance Act of 1978 or executive authority. The definition treats information as derived if the government would not have originally possessed it but for the surveillance or acquisition activity, without regard to claims of attenuation, inevitable discovery, or subsequent reobtainment through other means. It makes conforming amendments to titles III, IV, V, and VII of FISA; requires the Attorney General and Director of National Intelligence to publish implementing policies and guidance for the intelligence community and federal law enforcement agencies within 90 days (and to publish any subsequent modifications); and amends section 706 to treat information acquired under sections 703, 704, or 705 as information acquired from electronic surveillance under title I for purposes of section 106.

This section sunsets the grandfather clause for ongoing investigations under title V of the Foreign Intelligence Surveillance Act of 1978 (FISA) (i.e., the business records provision). Investigations, offenses, or potential offenses begun before the provision’s prior expiration date of March 14, 2020, must now cease on the date that is 180 days after the date of enactment of the SAFE Act (from continuing indefinitely).

This section expands the circumstances in which the Foreign Intelligence Surveillance Court (FISC) and FISC Court of Review must appoint one or more amicus curiae, including when an application or motion presents a novel or significant interpretation of law, significant First Amendment concerns involving U.S. persons, a sensitive investigative matter, a request for approval of a new program or technology, or a request for reauthorization of programmatic surveillance. It defines a sensitive investigative matter to include investigations involving domestic public officials, political candidates, religious or political organizations, the domestic news media, or other comparably sensitive domestic matters. The section eliminates prior language allowing the court to decline appointments to avoid undue delay, authorizes appointed amici to seek leave to raise novel privacy or civil liberties issues and to petition for certification of legal questions to the FISC Court of Review or the Supreme Court, and grants amici access to the underlying application, certification, petition, motion, and related materials submitted to the court.

This section revises the timeline for the Director of National Intelligence’s review of certain Foreign Intelligence Surveillance Court or Foreign Intelligence Surveillance Court of Review decisions, orders, or opinions for declassification and public disclosure under FISA. The review must now be concluded as soon as practicable but not later than 180 days after issuance of the decision, order, or opinion (from 180 days after commencement of the review).

This section modifies contempt provisions in chapter 21 of title 18, United States Code, to include the Foreign Intelligence Surveillance Court and the Foreign Intelligence Surveillance Court of Review within the definition of a court of the United States for purposes of criminal contempt proceedings under section 402. It also adds a new section 404 that defines those courts by reference to section 601(e) of the Foreign Intelligence Surveillance Act of 1978.

This section establishes a new requirement for periodic audits of compliance with the Foreign Intelligence Surveillance Act of 1978 (FISA). Not later than June 30 of the first calendar year beginning after the date of enactment, and every three years thereafter, the Inspector General of the Department of Justice must audit alleged or potential violations of FISA requirements and procedures, including an analysis of the accuracy and completeness of applications and certifications for orders submitted under sections 105, 303, 402, 502, 702, 703, and 704, and submit a report on the audit to the Senate and House intelligence and judiciary committees.

This section limits the acquisition of covered data by elements of the intelligence community. Covered data includes data or unique identifiers linked or reasonably linkable to a covered person (i.e., a United States person or an individual reasonably believed to be located in the United States), excluding publicly available data, voluntarily disclosed data, specific communications with non-covered persons, or human intelligence other than data transfers. The prohibition applies to direct or indirect acquisition and is subject to six exceptions: (1) collection authorized by court order under the Foreign Intelligence Surveillance Act or title 18, United States Code; (2) employment-related acquisition for intelligence community employees or applicants, with access limited to such purposes and data destroyed when no longer needed; (3) compliance with statutory or constitutional collection limitations; (4) emergencies involving imminent threats of death or serious bodily harm; (5) case-by-case consent; and (6) acquisition of nonsegregable datasets, subject to minimization. The section directs the Attorney General to adopt minimization procedures requiring exhaustion of reasonable means to exclude or delete covered data prior to acquisition or operational use, prompt destruction of non-excepted data, and restrictions on querying.

This section prohibits a covered governmental entity from obtaining in exchange for anything of value covered personal data directly or indirectly from a covered organization or derived from such data. It defines covered personal data to include data linked or linkable to a covered person (i.e., an individual reasonably believed to be in the United States or a U.S. person) and an electronic device, with specified exceptions for compilations of data that cannot reasonably exclude covered persons, whistleblower programs, cost-reimbursed compulsory process, employment-related uses, background checks with consent, lawfully obtained public data, and emergencies involving life or safety.

This section revises the definitions and procedures governing government access to data held by online entities under title 18 of the United States Code. It adds a definition of “online service provider” in section 2711 that encompasses providers of electronic communication service, remote computing service, and any information service, system, or access software provider that enables multiple users to access a computer server, including services operated by libraries or educational institutions. The section then replaces narrower references to providers of electronic communication service or remote computing service with “online service provider” in the required disclosure rules of section 2703 and the voluntary disclosure limitations of section 2702.

This section limits governmental entities from requiring covered organizations that are not online service providers to disclose covered personal data unless the entity obtains a court order. The order must be issued on the same basis and subject to the same limitations that would apply to a comparable request for disclosure by an online service provider, with courts required to apply the most stringent standard under federal statute or the Constitution.

This section defines “intermediary or ancillary service provider” as an entity that directly or indirectly delivers, transmits, stores, or processes communications or covered personal data for or on behalf of an online service provider. It further prohibits such providers from knowingly disclosing the contents of a communication in electronic storage to any person or entity or from disclosing to any governmental entity records or other information pertaining to a subscriber, customer, recipient, or sender of a communication to or from an online service provider.

This section expands the annual statistical reports that the Director of National Intelligence must submit under section 603(b) of the Foreign Intelligence Surveillance Act of 1978 by adding requirements to describe the subject matter of each section 702(h) certification; report the number of persons targeted and selectors used under section 702(a), disaggregated by certification; report the total number of directives issued under section 702(i)(1), disaggregated by provider type; provide detailed counts of disseminated intelligence reports containing United States persons’ identities (masked or openly included) derived from both section 702 collection and other Attorney General-approved collection; report the number of queries seeking communications or information of or about United States persons or persons in the United States; report the number of criminal proceedings in which such information is used or disclosed; and provide a good faith estimate of the percentage of communications subject to section 309(b)(3) procedures that are retained for more than five years, including those retained because they are encrypted. The section also repeals the exemption that previously relieved the Federal Bureau of Investigation from certain of these reporting obligations and makes conforming changes to cross-references.

This section expands the recipients of required notifications to Congress regarding certain unauthorized disclosures from the congressional intelligence committees to the appropriate congressional committees.

This section authorizes the Attorney General, in coordination with the Director of National Intelligence as appropriate, to delay implementation of a provision of this Act or an amendment made by this Act for a period of not more than 180 days upon a showing to the appropriate committees of Congress that the delay is necessary to develop and implement technical systems or to hire or train personnel needed for compliance. The term "appropriate committees of Congress" means the congressional intelligence committees, the Senate Committee on the Judiciary, and the House Committee on the Judiciary.