Documents

TOPSECRETaSV/NOFORN NATIONAL SECURITY AGENCY CENTRAL SECURITY SERVICE (UIIFOUO) CLASSIFICATION GUIDE FOR FOREIGN INTELLIGENCE SURVEILLANCE ACT (FISA)/PROTECT AMERICA ACT (PAA)/FISA AMENDMENTS ACT (FAA) ACTIVITIES (2-48) Effective Date: SIGINT Director Reason(s) for Classification: E.O. 12958 1.4(,) Declassify on: 25 years* Associate Director for Community Integration, Policy & Records TOP SECRETIISI//NOFORN

TOP SECRET//SI//NOFORN (U) NSAlCSS CLASSIFICATION GUIDE NUMBER: 2-48 (U) PUBLICATION DATE: (U!/FOUO) PROJECT ACTIVITY NAME: Foreign Intelligence Surveillance Act/Protect America ActiFISA Amendments Act (FISAlPAAlFAA) Activities (U) OFFICE OF ORIGIN: SID Oversight & Compliance, SV (U//FOUO) POC Chief Oversight & Compliance (U) PHONE: (U//FOUO) CLASSIFIED BY: S, SIGINT Director, (U) DECLASSIFICATION DATE: 25 Years· (U//FOUO) This guide provides classification guidaoce for FISAlPAAlFAA. FISA governs the conduct of certain electronic surveillance activities within the United States and against U.S. persons, regardless of location, and requires surveillances he authorized by the United States Foreign Intelligence Surveillance Court (USFISC), or in certain limited circumstances, by the Attorney General. PAA was an interim version of the FISA modernization legislation and allowed the DNI and the Attorney General to jointly authorize the acquisition of foreign intelligence infonnation concerning persons reasonably believed to be outside the United States. FAA is the pennanent FISA modernization legislation and is authorized by the USFISC. (TS/INF) FISA includes all NSA FISA (to include Business Records, Large Content & FAA) aod FBI FISA (to include Pen Register Trap Trace). (U//FOUO) The phrases, "seeks or obtains FISA authority" aod "seeks or obtains PAA authority" used throughout this document include the fact that NSA collects! processes/ analyzes! retains/ produces and then disseminates foreign intelligence information and data. (U//FODO) Unless otherwise specified, classification guidance which concern NSA FISA activities apply to all fonus ofNSA FISA, including FAA. (U//FOUO) Consult with the Office of General Counselor the SID Office of Oversight and Compliance for guidance on when FISA or other special authorities are needed to conduct SIGINT activities. (U//FOUO) Note: Timetable for FISAlPAAlFAA: FISA, 1978 -present; PAA aod Continuation, August 2007 - July 2008; FAA, July 2008 - present. TOP SECRET//Sl//NOFORN

TOP SECRETIISlI!NOFORN (U) FISAJPAA/FAA Activities·• Description of Information 1. GENERAL FACTS L L (U) The fact that NSA conducts activities under Foreign Intelligence Surveillance Act (FISA) or . Protect America Act (PAA). 1.2. (0) The fact that NSA Classification! Markin2s Reason Declassification Date UNCLASSIFIED N/A N/A UNCLASSIFIED N/A N/A (U) Section 2 provides classification guidance when communications entities are specified. UNCLASSIFIED N/A N/A (U) See Section 2.18 for classification guidance when selectors are UNCLASSIFIED N/A N/A UNCLASSIFIED NlA N/A SECRET!! REL TO USA, FVEY 1.4(c)* 25 Years* SECRET// REL TO USA, FVEY IA(c)* 25Years* targets/ collects! processes the communications of unspecified foreign governments/ organizations! terrorist groups! individuals under FISA/PAA 1.3. (U) The fact that Remarks unspecified selectors are targeted and collected under FISAJPAA. specified. 1.4. (U) The factthat the PAA allows electronic surveillance of communications of persons reasonably believed to be foreign and outside the U.S. 1.5. (U) The fact that NSA acquires foreign intelligence infonnation from or with the assistance of an unspecified communications provider to collect PAA-authorized data. 1.6. (S/IREL TO USA, FVEY) The fact that PAAauthorized activities were or may be conducted at an unspecified communications facility in the U.S. 1.7. (S/IREL TO USA, FVEY) The fact that the Foreign Intelligence Surveillance Court (FISC) approved, on 22 July 2002, a motion to allow NSA to TOP SECRETIISII/NOFORN (U) Identifying a specific communications provider would make this fact classified. (S/IREL TO USA, FVEy) The CIA also receives this raw data. (U/IPOUO) Classified based on

TOP SECRETIISIIINOFORN receive raw data from Court-authorized electronic surveillance and physical search acquired by the FBI of international terrorist groups, their agents, and related targets. 1.8. (S/IREL TO USA, FVEY) The fact that FBI obtains FlSA counterterrorism court orders on behalf ofNSA. 1.9. (S/IREL TO USA, FVEY) The fact that FBI enables FISA-authorized surveillances, without identification of targets, on Docket number 02431,22 July 2002. SECRETI/ REL TO USA, FVEY 1.4(c)* SECRET// l.4(c)* 25 Years* 25 Years* REL TO USA, FVEY (TSJ/SI/INF) For FBI Pen Register Trap Trace (PRITT), classification is TOP SECRETIISIII NOFORN. (S/IREL TO USA, FVEY) This will apply to either NSAor FBI-secured court orders. behalf ofNSA. 1.10. (S//SIfIREL TO USA, FVEy) The fact that NSA acquired or acquires signaling, dialing, routing and addressing infonnation of electronic communications targeted under PAA from communications service I nroviders. 1.11. (UIIFOUO) The association of any RAGTIME data labels, e.g., RAGTIJv1E-C, etc., with NSA FISA or PAA activities. SECRETIISIII REL TO USA, FVEY 1.4(c)* 25 Years* UNCLASSIFIED!! FOUO Ex. 3* N/A 1.12. (CIIREL TO USA, FVEY) The fact that NSA FISA surveillances are subject to an Interagency Review Panel (IRP) policy approval process, with or without mention of the specific participants in that I n-rocess or their roles. CONFIDENTIAUI REL TO USA, FVEY 1.4(c)* 25 Years* (U!IFOUO) These data labels will be applied to FISA raw traffic to ensure that only those who are properly trained to handle, retain, and disseminate FISA or PAA-authorized collection may do so. 2. (U) TARGETING/COLLECTION/PROCESSING 2.1. (U) The fact that NSA seeks or obtains FISA SECRETIISIII REL TO USA, FVEY 1.4(c)* 2S Years* TOP SECRETi/SII/NOFORN

TOP SECRETilSlIINOFORN authority against a specified country, with identification of specific foreign target facilities or their locations outside of the U.S. 2.2. (U) The fact that NSA seeks or obtains FISA authority against a specified country, with identification of specific foreign target facilities or their locations inside the U.S. 2.3. CD) The fact that NSA seeks or obtains FISA authority against a specified country, without identification of specific foreign target facilities or their locations. at a minimum TOP SECRET/ISI!/ NOFORN l.4(c)* 25 Years* TOP SECRETiiSVi NOFORN L4(c)* 25 Years* 2.4. (TSIISI/INF) The fact that NSA seeks or obtains FISA authority against an international organization inside the U.S., with or without identification of specific communications entities. TOP SECRETiiSVi NOFORN L4(c)* 25 Years* 2.5. (TS/ISVINF) The fact that NSA seeks or obtains FISA authority against an international organization that includes 2nd Party governments, with or without identification of specific foreign target entities or locations. TOP SECRET!!SV! NOFORN L4(c)* 25 Years* 2.6. (TSiiSliiREL TO USA, FVEY) The fact that NSA seeks or obtains FISA authority, if necessarv, TOP SECRETiiSVi REL TO USA, FVEY L4(c)* 25 Years* TOP SECRETiiSIllNOFORN (UiiPOUO) When the foreign target entity or location is not specified, the default is that the activity could be taking place in the U.S., and therefore such information is classified at the TOP SECRET/lSI!! NOFORN level in accordance with 2.2 above. (TSiiSIiiNF) The classification level is TOP SECRETIISI!! NOFORN regardless of whether the international organization is specified for which NSA is seeking or obtaining FISA authority. (TSiiSliiREL TO USA, FVEY) The classification level is TOP SECRETiiSIii

TOP SECRETIISIIINOFORN against an international organization outside of the U.S. that does not include 2nd Party governments, with or without identification of specific foreign target entities. REL TO USA, FVEY regardless of whether the international organization is 2.7. (TSI/SII/NF) The fact that NSA seeks or obtains FISA authority against financial or commercial organizations, with or without identification of specific target entities or locations. TOP SECRET/ISIII 2.8. (TS//SI/INF) The fact that NSA seeks or obtains FISA authority against an agent of a foreign power in the V.S., with or without specific foreign target entity locations. 2.9. (TSIISIIINF) The fact that NSA seeks or obtains FISA authority against V.S. persons. 1.4(c)* 25 Years* TOP SECRETIISIII NOFORN 1.4(c)* 25 Years* TOP SECRETIISIII NOFORN 1.4(c)* 25 Years* NOFORN specified for which NSA is seeking or obtaining FISA authority. (TSIISVINF) The classification level is TOP SECRET//SVI NOFORN regardless of whether the financial or commercial organization is specified for which NSA is seeking or obtaining FISA authori~. 2.10. (U) The fact that NSA seeks or obtains FISA authority or sought PAA authority against unspecified terrorists or terrorist groups. 2.11. (U) The fact that NSA seeks or obtains FISA authority or sought P AA authority against specified terrorists or terrorist I orouns, outside the U.S. 2.12. (U) The fact that NSA seeks or obtains FISA authority against specified terrorists or terrorist UNCLASSIFIED N/A N/A SECRETIISI!! 1.4(c)' 25 Years* 1.4(c)* 25 Years* REL TO VSA, FVEY ata minimum TOP SECRETIISIII NOFORN TOP SECRETIISI!!NOFORN (UIIFOVO) Refer to the FAA web site located at for additional information concerning FAA authority. (V) See Sections 2.11,2.12, and 2.15 for classification guidance when terrorists or terrorist groups are specified. (TSIISIIINF) Fo, FBI Pen Register Trap Trace (PRITT), classification is TOP SECRETIISVI NOFORN.

TOP SECRETllSlIlNOFORN --grOUPS, inside the U.S. 2.13. (TS/ISI/INF) The fact that NSA seeks or obtains FISA authority against communications from foreign governmental and diplomatic facilities in the U.S. TOP SECRETIISI/J NOFORN 1.4(c)'" 25 Years* 2.14. (SIISIIIREL TO USA, FVEY) The fact that NSA seeks or obtains FISA authority against communications from foreign governmental or diplomatic facilities outside the U.S. SECRETIISIII REL TO USA, FVEY 1.4(c)* 25 Years* 2.15. (U) The fact that NSA seeks or obtains PAA authority against the communications of a specified foreign government, terrorist group, organization, or individual. 2.16. (TSiISIIINF) The fact that NSA seeks FISA authority to obtain business records (BR) for terrorist groups. SECRETIISIII REL TO USA, FVEY 2.17. (TSIISI/INF) The fact that NSA receives or requests from FBI Pen Register Trap Trace (PRfIT) FISA warrants in order to get data about terrorist groups. ala minimum (TSIISIIINF) The classification level is TOP SECRET//SII/ NQFORN regardless of whether the foreign governmental or diplomatic facility in the U.S. is specified for which NSA is seeking or obtaining FISA autharitv, (SIISIIIREL TO USA, FVEY) The classification level is SECRET/ISI// RELTOUSA, 1.4(c)* 25 Years* TOP SECRETIISIII NOFORN 1.4(c)* 25 Years* TOP SECRETIISIII NOFORN 1.4(c)* 25 Years* ala minimum TOP SECRETIISII/NOFORN FVEY regardless of whether the foreign government or diplomatic facility outside the U.S. is specified for which NSA is seeking or obtaining FISA authority. (U) Sensitivity of the target entity may also result in the application of NOFORN. (TSIISIIINF) The classification level is TOP SECRETIISIII NOFORN regardless of whether the terrorist group is specified for which NSA is seeking or obtaining FISA BR authority. (TSIISIIINF) The classification level is TOP SECRETIISVI NOFORN regardless of whether the terrorist group is specified for which NSA is seekinp" or

TOP SECRETIISIIINOFORN obtainingFISA 2.18. (SIISVIREL TO USA, FVEY) The identification of specific sele<:tors (e.g., specific phone numbers; specific e-mail addresses) targeted in FISA warrants or PAA certifications. PRITT authority. SECRETI/SIII 1.4(c)* 25 Years* REL TO USA, FVEY (U) Classify at the same level as the classification assigned to the target (e.g., selectors for a target classified as TS/ISI/INF per section 2.2, would at a minimum also be classified 2.19. (D) The identification of, or relationships with, providers. TOP SECRETI/SVI 1.4(c)* 25 Years* 1.4(c)* 25 Years* NOFORN at a minimum 2.20. (U) The identification of specific communications methods! technologies targeted! collected! processed under FISA or PAA. SECRET/! REL TO USA, FVEY at a minimum TSIISIIINF). (U) Refer to appropriate Eel classification guides for additional instructioQs. (D) Handle at the same classification level as required for the specific communications methods or teclmologies targeted/collected! processed. Certain facts about teclmologies collected under FISA or P AA may be determined to be UNCLASSIFIED, while other facts may be higher than SECRET// REL TO USA, FVEY. (UI/FOUO) If the FISA or P AA target entity is specified, refer to the classification guidance throughout Section 2. 2.21. (S/ISIIIREL TO USA, FVEY) Statistics or statistical trends relating to NSA FISA targets, including numbers of court orders, IRP policy approvals, targets, facilities, or selectors, or TOP SECRET/lSI/! NOFORN 1.4(c)* 25 Years* TOP SECRETIISIIINOFORN

TOP SECRET//SI/INOFORN combinations or subcategories thereof, without mention of techniques involved. 2.22. (S/IREL TO USA, FVEY) Statistics or statistical trends relating to FBI FISA targets, including numbers of court orders, targets, facilities, or selectors, or combinations or subcategories thereof, without mention of techniques involved. 2.23. (S/IREL TO USA, FVEY) Statistics or statistical trends relating to PAA targets, including number of certifications, targets, facilities, selectors, or combinations of subcategories thereof, without mention of teclmiques involved. 3. (lJ) SECRETI! REL TO USA, FVEY 1.4(c)* 25 Years* (TSI/SIIINF) For FBI Pen Register Trap Trace (PRrIT), the classification is TOP SECRETI/SIII NOFORN. SECRET/ISIII REL TO USA, FVEY 1.4(c)* 25 Years* 1.4(c)* 25 Years'" at a minimum DATA HANDLING 3.1. (TSIISIIINF) Unminimized unevaluated NSA FISA data (e.g., BR, large content, FAA) encrypted or unencrypted. TOP SECRET//SV! NOFORN (U) See Remarks (UI/FOUO) Within NSAlCSS, the data must be labeled with appropriate RAGTIME-series markings. (UlIFODO) Traffic remains subject to FISA minimization procedures described in USSID SP0018, Annex A, plus supplemental minimization procedures as required. (U/IFODO) Data may only be released to foreign partners when specifically approved by an appropriate authority on a case-by-case basis. TOP SECRET//SI/INOFORN

TOP SECRETIISIIINOFORN 3.2. (U/iFOUO) Unminimized "Devaluated PAA data, encrypted or unencrypted. TOP SECRETIISI!J NOFORN 1.4(c)* 25 Years'" (U) See Remarks (UI/FOUO) Within NSA/CSS, the data must be labeled with appropriate RAGTIME~series markings. (U//FOUO) Traffic remains subject to minimization procedures described in USSID SPOOlS, Annex A, and those prescribed under the respective PAA certifications. (U/iFOUO) Data may only be 3.3. (U/iFOUO) Unminimized unevaluated FBI FISA data, encrypted or unencrypted. SECRET/ISII/ IA(e)* 25 Years* NOFORN released to foreign partners when specifically approved by an appropriate authority on a case-by-case basis. (UI/FOUO) Within NSA/CSS, the data must be labeled at a minimum with appropriate (U) See Remarks markings. RA.GTJJ\.iE~series (UIIFOUO) Traffic remains subject to FISA minimization procedures, described in USSID SPOOI8, Annex A, plus supplemental minimization procedures as required. (UlIFOUO) Target offices will also add the additional caveat statement required for FISC reporting. (UI/FOUO) Data may only be released to foreign TOP SECRETIISIIINOFORN

TOP SECRETIISII/NOFORN 3.4 (TS/ISIIINF) Unminimized unevaluated FBI PRITT FISA data, encrypted or unencrypted. TOP SECRETllSl/I NOFORN 1.4(c)* 25 Years* (ll) See Remarks partners when specifically approved by an appropriate authority on a case-by-case basis. (U/IFOUO) \Vitbill NSA/CSS. the data must be labeled with appmpl'iate RAGTIl\'lE-series markings. (UlIFODO) Traffic remains subject to FISA minimization procedures, described in USSID SPOOlS, Annex A, plus supplemental minimization procedures as required. 3.5. (TSI/SIIINF) TOP SECRETIISII/ Unminimized evaluated NSA FISA data (e.g., BR, large content, FAA) such as a verbatim transcript or gisted traffic, that does not disclose specific methods or techniques. NOFORN lACe)'" 25 Years* (U) See Remarks (U/IFOUO) Data may only be released to foreign partners when specifically approved by an appropriate authority on a case-by-case basis. (UliFOUO) Within NSAfCSS, the data must be labeled witb appropriate :RAGTIM:l!>series markings. (U/IFQUQ) Traffic remains subject to FISA minimization procedures, described in USSID SPOOI8, Annex A, plus supplemental minimization procedures as required. (U) Methods are governed by the TOP SECRETIISIIINOFORN

TOP SECRETIIS[//NOFORN classification guides applicable to the specific methods involved. (U//FODQ) Data may only be released to foreign partners when specifically 3.6. (SIISIIIREL TO USA, SECRETIISIII FVEY) Unminimized evaluated PAA data, such as a verbatim transcript or gisted traffic, that does not disclose specific methods or techniques. NOFORN 1.4(c)* 25 Years* ata minimum (U) See Remarks approved by an appropriate authority on a case-by-case basis. (Ui!I<'OUO) Within NSAfCSS, the data must be labeled with appropriate RAGTIME-series markings. (U/IFOUO) Traffic remains subject to minimization procedures described in USSID SPOOI8, Annex A, plus supplemental minimization procedures as required, and those prescribed under the respective PAA certifications. (U) Methods are governed by the classification guides applicable to the specific methods involved. 3.7. (SIIREL TO USA, FVEY) Unminimized SECRET//SI// NOFORN 1.4(c)* 25 Years* TOP SECRETIIS]//NOFORN (U/IPOVO) Data may only be released to foreign partners when specifically approved by an appropriate authority on a case-by-case basis. (U/IFOUO) Within NSAlCSS, the data

TOP SECRETi/SI/iNOFORN evaluated FBI FISA data, such as a verbatim transcript or gisted traffic, ala minimum that does not disclose (V) See Remarks must be labeled with appropriate RAGTI.ME~series markings. specific methods or techniques. CUI/FOUD) Traffic remains subject to FISA minimization procedures, described in USSID SPOOI8, Annex A, plus supplemental minimization procedures as required. (V/iPOVQ) Target offices will also add the additional caveat statement required for FISC reporting. (V) Methods are governed by the classification guides applicable to the specific methods involved. (UiiFOUO) Data may only be released to foreign partners when specifically approved by an 3.8. (TSiiSIIINF) Unminimized evaluated TOP SECRETliSVI NOFORN l.4(c)* 25 Years* TOP SECRETilSW REL TO USA, FVEY 1.4(c)* 25 Years* FBI PRIIT data that does not disclose specific methods or techniques. 3.9. (UliFOUO) Minimized evaluated NSA FISA data, such as verbatim transcript or gisted traffic, that does not disclose specific methods (U) See Remarks TOP SECRETI/SIIINOFORN appropriate authority on a case-by-case basis. (UliFOUO) Data may only be released to foreign partners when specifically approved by an appropriate authority on a case-by-case basis. (U/IFOUO) Target offices may add caveats (e.g., NOFORN,ORCON, etc.) if the intelligence nroduct

TOP SECRETIISIIINOFORN or techniques. 3.10. (fSI/SIIINF) Minimized evaluated NSA BR and large content FISA data that does not disclose specific methods or techniques. 3.11. (UIIFOUO) Minimized evaluated PAA data, such as a verbatim transcript or gisted traffic, that does not disclose specific methods or techniques. 3.12. (SIISIIIREL TO USA, FVEY) Minimized evaluated FBI FISA data, such as a verbatim transcript or gisted traffic, that does not disclose specific methods or techniques. itself warrants such protection. TOP SECRET//SVI NOFORN 1.4(c)* 25 Years* SECRETIISV! REL TO USA, FVEY I ACe)* 25 Years* at a minimum SECRETIISVI REL TO USA, FVEYI FISA lA(e)'" 25 Years'" at a minimum (U) Methods are governed by the classification guides applicable to the specific methods involved. (D) Methods are governed by the classification guides applicable to the specific methods involved. (U/IFODO) Target offices may add caveats (e.g., NOFORN, GReON, etc.) if the intelligence product itself warrants such protection. (U) Methods are governed by the classification guides applicable to the specific methods involved. (U//FOUO) Target offices may add caveats (e.g., NOFORN,ORCON, etc.) if the intelligence product itself warrants such protection. (U1/FODO) Target offices will also add the additional caveat statement required for FISC reporting. 3.13. (fSI/SIIINF) Minimized evaluated FBI TOP SECRETIISVI NOFORN 1.4(c)'" 25 Years'" TOP SECRETIIS]//NOFORN (U) Methods are governed by the classification guides applicable to the specific methods involved. (U) Methods are governed by the

TOP SECRETIISII!NOFORN PRITT FISA data that does classification guides applicable to the specific methods involved. not disclose specific methods or techniques. 4. (U) DISSEMINATION 4.1. (TSf/SliIREL TO TOP SECRETIISII! USA, FVEY) SIGINT REL TO USA, FVEY 1.4(c)* 25 Years* offices may add caveats (e.g., NOFORN,OReON, product derived from encrypted or unencrypted NSA FISA collection. 4.2. (TSIISIIINF) SIGINT product derived from encrypted or unencrypted NSA FISA~warrantedBR or large content FISA collection. (U//FOUO) Target (D) See Remarks TOP SECRETJ/SIII NOFORN 1.4(c)* 25 Years* SECRET/ISVI I.4(c)* 25 Years* 1.4(c)* 25 Years* etc.) if the intelligence product itself warrants such protection. (UIIFOUO) Target offices may add caveats (e.g., OReON) if the intelligence product itself warrants such protection. 4.3. (U/IFOUO) SIGINT product derived from encrypted or unencrypted PAA-authorized collection. REL TO USA, FVEY ala minimum 4.4. (SIISIIIREL TO USA, SECRETIISIII FVEY) SIGINT product derived from encrypted or unencrypted FBI FISAwarranted collection when associated with NSA or REL TO USA, FVEY (U/IFODO) Target offices may add caveats (e.g., NOFORN,ORCON) if the intelligence product itself warrants such I nrotection. (UlIFODO) Target offices may add caveats (e.g., NOFORN, ORCON) ala minimum if the intelligence product itself warrants such protection. SIGINT. (SIIREL TO USA, 4.5. (TSIISIIINF) SIGINT TOP SECRETIISIII product derived from encrypted or unencrypted NOFORN 1.4(c)' 25 Years* FBI PRITT FISAwarranted collection. TOP SECRETIISIIINOFORN FVEY) Target offices will also add the additional caveat statement required for FBI FISA reporting. (UI/FODO) Target offices may add caveats (e.g., ORCON) if the intelligence product itself warrants such protection.

TOP SECRETliSlIiNOFORN *25 years: Declassification in 25 years indicates that the information is classified for 25 years from the date a document is created or 25 years from the date 0£thi8 original classification decision, whichever is later. *1.4(c): Section 1.4(c) ofE.O. 12958, as amended *Ex 3: Exemption 3 of the Freedom oflnformation Act (UiiFODO) Additional Remarks: The denial of any facts in this guide concerning NSA's collection/processinglanalyzinglretaininglproducing and then disseminating of entities under FISAIPAA/FAA authority carries the same level of classification as the fact of NSA's performing such functions. (D) Acronyms (U) BR - Business Records (D) ECI- Exceptionally Controlled Information (D) FAA - FISA Amendments Act (U) FISA - Foreign Intelligence Surveillance Act (D) FISC - Foreign Intelligence Surveillance Court (U) IRP - Interagency Review Panel (U) PAA ~ Protect America Act (U) PRITT - Pen Register Trap Trace (U) US SID - United States Signals Intelligence Directive TOP SECRETl/SliiNOFORN