TOP SECRET/SW/NOFORN NATIONAL SECURITY AGENCY/CENTRAL SECURITY SERVICE m0 rr U INSPECTOR GENERAL REPORT (U) Report on the Special Study of NSA Controls to Comply with the FISA Amendments Act §§704 and 705(b) Targeting and Minimization Procedures ST-15-0002 7 January 2016 (U) This report might not be releasable under the Freedom of Information Act or other statutes and regulations. Consult the NSA/CSS Inspector General Chief of Staff before releasing or posting all or part of this report. ‘FOP-SECRET/SWNOFORNTOP SECRETUSWNOFORN 15-0002 (U) OFFICE OF THE INSPECTOR GENERAL (U) Chartered by the NSA Director and by statute, the Office of the Inspector General conducts audits, investigations, inspections, and special studies. Its mission is to ensure the integrity, efficiency, and effectiveness of NSA operations, provide intelligence oversight, protect against fraud, waste, and mismanagement of resources by the Agency and its affiliates, and ensure that NSA activities comply with the law. The OIG also serves as an ombudsman, assisting NSA/CSS employees, civilian and military. (u) AUDITS (U) The audit function provides independent assessments of programs and organizations. Performance audits evaluate the effectiveness and efficiency of entities and programs and their intemal controls. Financial audits determine the accuracy of the Agency’s financial statements. All audits are conducted in accordance with standards established by the Comptroller General of the United States, (U) INVESTIGATIONS (U) The OIG administers a system for receiving complaints (including anonymous tips) about fraud, waste, and mismanagement. Investigations may be undertaken in response to those complaints, at the request of management, as the result of irregularities that surface during, inspections and audits, or at the initiative of the Inspector General, (U) INTELLIGENCE OVERSIGHT (U) Intelligence oversight is designed to ensure that Agency intelligence functions comply with federal law, executive orders, and DoD and NSA policies. The 10 mission is grounded in Executive Order 12333, which establishes broad principles under which IC components must accomplish their missions. (U) FIELD INSPECTIONS (U) Inspections are organizational reviews that assess the effectiveness and efficiency of Agency components. The Field Inspections Division also partners with Inspectors General of the Service Cryptologic Elements and other IC entities to jointly inspect consolidated eryptologic facilities.ST-15-0002 NATIONAL SECURITY AGENCY CENTRAL SECURITY SERVICE OFFICE OF THE INSPECTOR GENERAL, 7 January 2016 =15-0002 TO: (U) DISTRIBUTION SUBJECT: (U) Report on the Special Study of NSA Controls to Comply with the FISA. ‘Amendments Act §§704 and 705(b) Targeting and Minimization Procedures (ST-15-0002)— ACTION MEMORANDUM. 1, (U) This report summarizes our special study of NSA Controls to Comply with the FISA Amendments Act §§704 and 705(b) Targeting and Minimization Procedures and incorporates ‘management's response to the draft report. 2. (U/EQLO) In accordance with NSA/CSS Policy 1-60, NSA/CSS Office of the Inspector General, and IG-11731-14, Follow-up Procedures for OIG Report Recommendations, actions on OIG recommendations are subject to monitoring and follow-up until completion. ‘Therefore, we ask that you provide a written status report concerning each planned corrective action categorized as “OPEN.” If you propose that a recommendation be considered closed, please provide sufficient information to show that actions have been taken to correct the deficieney. If a planned action will not be completed by the original target completion date, please state the reason for the delay and forward a revised target completion date (0 i, Follow- up Program Manager, at DL D1_Followup (ALIAS) D1. 3. (U/BOLO) We appreciate the courtesy and cooperation extended to the evaluators throughout the review. For additional information, please contact NEE on 963-0922(s) or via e mail at Inspector General (U) This report might not be releasable under the Freedom of Information Act or other statutes and regulations. Consult the NSA/CSS Inspector General Chief of Staff before releasing or posting all or part of this report.TOR-SECRETYSV/NOFORN 5-002 (U/FOUO) DISTRIBUTION: DIRNSA D/DIR EXDIR CoS sv: ae | == 802; (U//FOUO) ce: SIGINT Director: MG G. Potter (Im) TD Director: G. Smithberger (am) \ ES RTE CLPO: R. Richards aa) 10 Sn a RCS NE eS ES CC? i TTT | 2M: a) \ aa SV‘ a CLPO (DL DS_ALL) ODOC (DL D4_tasker) OGC Registry (DL d_ge_ registry) RMO (DL Risk) SID IG POC (DL SIDIGLIAISON) S02 (DL s02_frontoffice) TD Registry (DL TD REGISTRY) ‘TD Strategic Operations Group (DL TD_Strat_Ops_Grp) IG DIAG DI/Follow-up Program Manager (gaaNmIM/DL D1_Followup) Dil DI2 DI3 Dis ‘TOP SECRET/SWNOFORN‘TOP SECRETUSU/NOFORN ST-15-0002 (U) TABLE OF CONTENTS (U) EXECUTIVE SUMMARY I. (U) INTRODUCTION. I (U) FINDINGS AND RECOMMENDATIONS. (UNFOUO) FINDING ONE: Agency Controls for Monitoring Query Compliance Have Not Been Completely Developed (U/EOUO) FINDING 1 \O- |S BSR aa tsa ee 4 (UNFQUO) FINDING THREE: EA a vere I, (U) ABBREVIATIONS AND ORGANIZATIONS . (U) APPENDIX A: ABOUT THE SPECIAL STUDY (U) APPENDIX B: ADDITIONAL INFORMATION . (U) APPENDIX C: FULL TEXT OF MANAGEMENT RESPONSE. TOP SECREWSW/NOFORN,TOP SECRET/SV/NOFORN. ST-15-0002 © er eee (U) EXECUTIVE SUMMARY (U) Overview (U/FQUO) We conducted this study to determine whether National Security Ageney/Central Security Service (NSA) controls are adequate to ensure compliance with the Foreign Intelligence Surveillance Act (FISA) Amendments Act of 2008 (FAA) §§704 and 705(b) targeting and minimization procedures. We found that Agency controls for monitoring query compliance have not been completely developed gy (U) Highlights (U) Our study of NSA’s FAA §§704 and 705(b) controls revealed: * (UFOUO) Agency controls for monitoring query compliance have not been completely developed (U/#OUO) The Agency has no process to reliably identify queries performed using selectors associated with FAA §§704 and 705(b) targets. mmm SS I ee Pi SEIS (U) Management action sence Directorate agreed with the OIG's meet the intent of the recommendations. (U) Officials from the Signals Intel recommendations, The planned actios TOP SECRETUSWNOFORN itTOP SECRETUSUNOFORN ST-15-0002 1, (U) INTRODUCTION (U) Background (U/POUO) In July 2008, the President of the United States signed into law the Foreign Intelligence Surveillance Act (FISA) Amendments Act of 2008 (FAA). FAA §§703 through 705 set forth requirements that must be satisfied to target U.S. persons (USPs) outside the United States for foreign intelligence purposes. The National Security Ageney/Central Security Service (NSA) has implemented the FAA §§ and 705(b) authorities, but not the FAA §703 authority. (S/SWNE) In July 2008, the Attorney General (AG) approved National Security Agency's Standard Minimization Procedures for Acquisitions Targeting United States Persons Reasonably Believed to be Located Outside the United States Pursuant to Section 704 of the Foreign Intelligence Surveillance Act. These procedures also apply to FAA §705(b). In August 2008, the AG issued a memorandum to the NSA Director (known as the “Mukasey Letter”) that required NSA to proceed under §§704 and 705(b) of FISA to conduct foreign intelligence that previously had been authorized by the AG pursuant to §2.5 of Executive Order 12333. ‘The two documents comprise NSA’s FAA §§704 and 705(b) targeting and minimization procedures, (U/FOLO) FAA §704 grants the Foreign Intelligence Surveillance Court (FISC) jurisdiction over certain aspects of targeting USPs reasonably believed to be outside the United States when they have reasonable expectations of privacy and a warrant would be required if the collection were conducted inside the United States for law enforcement purposes. NSA’s application for an order under FAA §704 must include a statement of facts and circumstances sufficient to allow the FISC to find that the USP who is the target of the collection is reasonably believed to be outside the United States and is a foreign power, an agent of a foreign power, or an officer or employee of a foreign power and targeting is for a valid foreign intelligence purpose. The FISC issues orders for 90 days when it finds that the facts support targeting. (U/POLO) FAA §705(b) streamlines the approval process for collection against USPs who are outside the United States and are currently subject to a FISC order authorizing electronic surveillance or physical search under FISA §105 or §304, respectively. In such cases, the FISC has already made a probable cause determination with respect to the target. Accordingly, FAA §705(b) permits the AG to authorize collection against the USP for the effective period of the Order, while the person is reasonably believed to be outside the United States. (U) Table | summarizes the requitements for targeting USPs under FAA §§704 and 705(b). TOP-SECRETU/SW/NOFORNTOP SECRET/SWNOFORN ST-15-0002 (U) Table 1. FAA §§704 and 705(b) Targeting Requirements cesusuinc) Targeting (UEQUO) Must satisfy four cntena (UIFOUO) Same as FAA §704 requirements 41, Proof that target is a USP 2. USP is reasonably believed to be outside the United States 3. USP is a foreign power, an agent ofa foreign power, or an officer ‘or employee ofa foreign power 4. Targeting is fr a valid foreign inteligence purpose | Approval (U) FISC Order EFSUSWINE) AG authorization; however, | ee | LAE | BEN Must nave an existing FISC Order ‘against the target Duration (UIFOUO) 90 days (FSSUINE) For the period of the existing FISC ord, a = Targeting and | (SUSURELTOUSA-FVEY) Mukasey | (U) Same as FAA §704 minimization | Letterand National Secunty Agency's procedures | Standarel Minimization Procedures for ‘Acquisitions Targeting United States Persons Reasonably Believed to be Located Outside the United States | | Pursuant to Section 704 of the Foreign | | Intetigence Surveitance Act STS (U) Study Scope and Methodology (SHSUREL TO-USA,EVEY) Our study focused on NSA system controls and manual processes designed to ensure that data is collected (tasked and detasked) and queried in compliance with the FAA §§704 and 705(b) targeting and minimization procedures. We reviewed records of taskings and detaskings and queries associated with FAA §§704 and 705(b) targets to determine compliance for January through | eT TS TE TE RW als reviewed whether selectors had been tasked in the cor TT 2 tered in TTT 2s the Signals Intelligence Directorate (SID) requires.’ Last, we determined whether the Agency has implemented controls to " (SUSWRELTO.USA,EVEY) The term “selector” includes but isnot limited to dialed number recognition (DNR) data (eg, telephone numbers) and gence (DN1) data (e.g. e-mail addresses). mis NSA’S corporate system for managing selector taskings and detas‘TOP SECRETUSUNOFORN ST-15-0002 (U/FQUO) Table 2 shows the four areas reviewed and the corresponding study results within the report, (U) Table 2. Study Scope and Results cust TTasking and detasking See Appendix 8 compliance ‘Selectors entered in ‘See Appendix 8 oe cen) _ Query compliance Finding One: Agency Controls for Monitering Query Compliance Have Not Been ca a ee Developed Finding Two! a EATS LENORE Controls implement response (mm | ‘See Appendix B iS | | EDITOP SECRET/SW/NOFORN ST-15-0002 (U) FINDINGS AND RECOMMENDATIONS (U/IFOUO) FINDING ONE: Agency Controls for Monitoring Query Compliance Have Not Been Completely Developed (U/FOUO) The Agency has no process to reliably identify queries performed using selectors associated with FAA §§704 and 705(b) targets. Sr As a result, the Agency cannot monitor completely query compliance for these authorities. (U) Criteria (U) FAA §§704 and 705(b) (SHSWRELTOUSA,FYEY) National Security Agency's Standard Minimization Procedures for Acquisitions Targeting United States Persons Reasonably Believed to be Located Outside the United States Pursuant to Section 704 of the Foreign Intelligence Surveillance Act, 29 July 2008 (U/FOUO) Mukasey Letter, 18 August 2008 (U) FAA §702 (U) Minimization Procedures Used by NSA in Connection with Acquisitions of Foreign Intelligence Information Pursuant to Section 702 of the Foreign Intelligence Surveillance Act of 1978, as Amended in 2008, 24 Suly 2014 (U) E.0, 12333 (U) Executive Order 12333, United States Intelligence Activities, as amended (2008) (U/FOUO) SID Oversight and Compliance (SV) Controls for Monitoring Query Compliance Are Not Complete (U//EQUO) The SV internal oversight program for the FAA §§704 and 705(b) authorities is still being developed. ‘The following two activities, although important, do not allow SV to monitor completely query compliance with the FAA §§704 and 705(b) targeting and minimization procedures. FOP SECRET/SUNOFORN‘TOP. SECRETISUNOFORN ST-15-0002 (UMFOUO) SV's support to external reviews is limited (CHRELTO.USA,FYEY) In October 2014, SV began supporting the De Justice National Security Division’s (DoJ NSD) semi-annual reviews of §§704 and 705(b) operations. SV provides to Dol NSD records of queries that NSA analysts performed during the previous six months. These records include only queries of FAA §§704 and 705(b) data in gg and in certain partitions of (U//FOUO} The methodology that DoJ NSD and NSA have agreed on doe: include providing all records of queries performed using selectors associated with EAA §0704 and 705() 212. limitations, Dod and NSA agreed that NSD's semi-annual reviews woutd focus on queries of content performed in ggg and in certain partitions of amma (UIFOUO) SV's post-query auditing controls are not designed to verify query ‘compliance with the FAA §§704 and 705(b) authorities (U/FQUO) SV oversees the Agency's post-query auditing controls, SV performs “supet audits” that randomly sample query records across all NSA missions and authorities, SID mission auditors review query records (marked for auditor review) for their assigned missions. SV requires that auditors have target knowledge and be familiar wit Ue types of guetes within ther production chin to a the gnness of queries and to protect USP privacy (UFOS) a 2 IMI are mission data repositories approved to retain communications content. Content, as defined in 18 U.S.C, $2510, isthe substance, purport, or meaning of a communication | Ee aE SR TOPSECRET/SI/NOFORN: 5‘TOP SECRET/SU/NOFORN ST-15-0002 (U/FOUQ) NSA System Limitations for Identifying FAA §§704 and 705(b) Queries (U#EOUO) At the time of our review, the Agency could not reliably identify queries performed using selectors associated with FAA §§704 and 705(b) targets because SIGINT databases did not uniformly send records in the correct format to NE (NSA’s SIGINT auiditing and logging system), |As a result, the Technology Directorate (TD) could not search these records to identify queries performed using selectors associated with FAA §§704 and 705(b) targets. (U/EQUO) We worked with TD to identify records of queries using selectors associated with FAA §§704 and 705(b) targets. The TD extraction tool and the system script allowed TD, in coordination with the OIG, to identify all query records from January through March 2015 related to our review. We then developed our own process that automated the analysis of the query records and flagged potential incidents for further review. [aaa (uiFoug) (CESUSMNE) We analyzed all gM query records available for review from January through March 2015. Queries were performed using selectors associated with jg FAA §§704 and 705(b) targets. We identified ggg queries that were not compliant with the FAA §§704 and 705(b) targeting and minimization procedures. agama Se ea ea a a SL LNT EIT RE RES, NNER We fed another ques that were performed outside the targeting authorization periods in E.O. 12333 data, which is prohibited by the E.0, 12333 minimization procedures. We also identified gy * (U/FOUO) RIMM is « mission data repoSt0ry. A |‘FOP SECRETUSUNOFORN 0002 queries performed using USP selectors in FAA §702 upstream data, which is prohibited by the FAA §702 minimization procedures.’ Table 3 summarizes our test results. ORS BE A AMEE EI ET | cg * CESHSWNE) We reviewed gg query records for the ggg targets that had| by (UEOUO) SV confirmed that I of the I non-compliant queries that we identified were newly discovered instances of non-compliance. SV had already discovered two instances of non-compliance and filed incident reports before our review. For the newly discovered incidents, SV ensured that the appropriate TOPIs, filed incident reports and counseled analysts to prevent future non-compliance. 's Office of General Counsel (OGC) notified DoJ NSD of the FISA incidents.” (UIFOUO) Factors that caused non-compliant queries (U/FQUO) SV explained that NSA query compliance is maintained largely through a series of manual checks that analysts perform before querying data. Analysts are relied on to maintain target awareness, track targets’ U.S. travel, and perform compliant queries. For queries performed outside the targeting authorization periods and queries performed usin ET, SV concluded that analysts had not performed the required checks before querying data. SV also explained that EN 811 stems automatically * (UJ/EOUO} Upstream Internet collection includes acquisition of two types of communications not present in provider-enabled collection: “abouts” communications and “multiple communications transactions" (MCT). “Abouts” communications are those that are nat to or from the target selector but whose contents include the selector. An MCT isan Internet “transaction” that contains more than one discrete communication. If one of those communications is to, from, or about a tasked selector and if the active end of the transaction is foreign, the entire MCT transaction will be acquired through upstream Internet collection. This can include other diserete ‘communications that do not contain the tasked selector. Ifthe targeted selector is not the active user inthe ‘tansaction, the MCT can include other discrete communications that do not contain the tasked selector. © (Ui/PQUO) The instances of non-compliance with the E.O, 12333 minimization procedures will be reported in NSA’s first quarter 2016 calendar year Intelligence Oversight Quarterly report. The reports are provided quarterly to the Office of the Department of Defense Senior Intelligence Oversight Official and the Presidents Intelligenct Oversight Board. TOP SECRETUSWNOFORN 7TOP SECRET/SINOFORN ST-15-0002 include all authorities to which analysts are entitled access on the basis of their credentials. For the queries into FAA §702 upstream data, SV concluded that analysts had not removed the FAA. §702 upstream authority from their search criteria (that automatically defaulted on the basis of their credentials) or had not included the appropriate limiters to prevent FAA §702 upstream data from being queried. (U) New controls to improve future query compliance (U/FOLO) NSA is in the early stages of implementing a new system control, Until IM fas been implemented jg (he 4 gency’s compliance monitoring activities and compliance awareness programs will remain important tools for detecting query compliance problems and preventing future recurrences (U//EQUO) SV has already agreed to perform compliance verification reviews periodically using the process we developed for this study. ‘This will significantly strengthen the Ageney’s ability to monitor future compliance with the FAA §§704 and 705(b) and FAA §702 targeting and minimization procedures and implement corrective action as needed. (U//FOUO) Implement a process to periodically monitor for compliance all queries performed using selectors associated with FAA §§704 and 705(b) targets. These reviews must determine whether queries had been performed [NNN 2s the FAA §§704 and 705(b) targeting and minimization procedures require, and whether queries of FAA §702 data excluded upstream data, as the FAA §702 mi tion procedures require. (ACTION: Chief, Compliance Verification (SV3) with Analysis and Compliance ($2) Compliance Lead and Office of the Director of Compliance) ATP TT TELA Dr =o) TT A is sie A ST 2 2S TE PT PR TOP SECRET ASL NOUORS 8TOP SECRET/SWNOFORN, ST-15-0002 {U) Management Response (U/EQUO) AGREE SV will develop a standard operating procedure (SOP) to document SV's procedures and processes to periodically monitor for compliance all queries performed using selectors associated with FAA §§704 and 705(b) targets. Itis estimated the SOP will be developed bY J. This SOP will include the procedures for determining whether queries were performed I jand whether queries of FAA §702 data excluded upstream data, It is estimated that the periodic compliance verification reviews will be implemented by | (U) O1G Comment (U) The planned action meets the intent of the recommendation, (UIFOUO) For the periodic reviews of queries performed using selectors associated with FAA §§704 and 705(b) targets, work with TD to obtain records that also include INN query records. (ACTION: Chief, SV3, with uu Lead, 71412) (U) Management Response (U/EQUO) AGREE SV will develop an SOP to document $V’s procedures and processes to periodically monitor for compliance all queries performed using selectors associated with FAA §§704 and 705(b) targets. The SOP will also include the procedures and processes to assess NNN query records. Target completion date is amma. (U) O1G Comment tion meets the intent of the recommendation. (U) The planned15-0002 (UI/EQUO) Develop a process to send periodic reminders to the SID workforce to specify that queries performed using selectors associated with FAA §§704 and 705(b) targets must be performed} ‘Analysts must also be reminded periodically that queries of FAA §702 data using USP selectors must exclude upstream data by removing the FAA §702 upstream authority from the search criteria| EEE prevent that data from being queried. (ACTION: Chief, SV, and $2 Compliance Lead) (U) Management Response (U/POLO) AGREE SV will develop and post two compliance advisories ~ one for the FAA §§704 and 705(b) queries and one for FAA §702 queries. Based on trend analysis of any non-compliant queries discovered during the planned periodic compliance verification reviews (as agreed in Recommendation 1), SV will issue | periodic reminders, as needed, to the SID workforce that references the two compliance advisories to improve awareness. Target completion date is (U) O1G Comment (U) The planned action meets the intent of the recommendation. 10TOP-SECRET/SUW/NOFORN ‘ST-15-0002 (U//FOUQ) FINDING TWO: The Agency Has Not Provided Guidance for Documenting (S/S1/\F) rE by FAA §§704 and 705(b) targets are not documented consistently and completely and in a manner accessible to all SID analysts who cover the targets. As a result, the Agency has. an increased risk of non-compliance. (U/FOUQ) Information Is Not Documented Consistently and Completely (U/FOUO) FAA $8704 and 705(b) targeting and minimization procedures prohibit targeting USPs while they are in the United States. Although the Agency is not required to document |, maintaining these records is important for securing compliance with the targeting and minimization procedures. (SUSUANF) We reviewed the processes that ggg TOPIs use to document I FAA. 85704 and 705(b) targets. Although the Agency uses the processes to maintain compliance with all NSA authorities, we focused our review on how they are used for the FAA §§704 and 705(b) authorities. We determined that are not documented consistently and completely and in a manner accessible to all SID analysts who cover FAA §§704 and 705(b) targets. (UFOUO) Processes to document EEE are not adequate (S/SUANE) Each TOPI has developed its own method for aR HBBPAA §§704 and 705(b) targets. Information is often saved in systems inaccessible by analysts in other TOPIs who might cover the same ‘argc. Emma However, this information is not consistently documented in gag (CSUSUNE) The IIE Staff branch also documents am MMR AA 95704 and 705(b) targets. However, branch personnel stated that the records they maintain cannot be relied on, They also asserted that the TOPIs are responsible for maintaining the official records. Failure to have a jdocumented consistently and completely in @ system available to all SID analysts increases the risk that It also increases the risk that gy Fe ree SR 0 be peor cLaOR ECE FORN ST-15-0002 (U/FOUO) EE are not consistently documented (TSUSUANE) TOPIs do not consistently document me Asa result, the Agency has an increased risk of non-compliance. (SHSVINF) Develop a process to document consistently and completely all including FAA §§704 and 705(b) targets; 7 This process must designate systems for centrally documenting this information, and these systems must be available to all SID analysts. Notify the SID workforce of the new process once complete. (ACTION: Title Vil Authority Lead with $2 Compliance Lead)TOP SECRETW/SIWNOFORN, ST-15-0002 (U) Management Response (U/QUO} AGREE Management action plan will be implemented in three phases a, (S4NB) The Section 704/705(b) authority virtual team will develop and disseminate guidance requiring analysts to aS BR | is anticipated that the interim J procedures will be completed by am | ST Se i RATS (U) O1G Comment | (U) The planned actions meet the intent of the recommendation. (UEQUO} On NSA’s Supplemental Procedures Governing Communications Metadata Analysis (SPCMA) web page, the system link that documents the | SPCMA enabled metadata repositories does not work. This link should be restored.TOP SECRET/SW/NOFORN ST-15-0002 (U/FOUQ) FINDING THREE: (U) FAA §§704 and 705(b) (SHSUREL-FO-USA,EVBY) National Security Agency's Standard Minimization Procedures for Acquisitions Targeting United States Persons Reasonably Believed to be Located Outside the United States Pursuant to Section 704 of the Foreign Intelligence Surveillance Act, 29 July 2008 ui (U/FQUO) J(actio! : Title Vil Authority Lead) (U) Management Response GS (a TS ST EE SR Re 226% comp tion cates (U) 016 Comment (U) The planned action meets the intent of the recommendation, 15ST-15-0002 TOP SECRET/SWNOFORN ill. (U) ABBREVIATIONS AND ORGANIZATIONS. (U) DNI (U) DNR (U) Dol NSD (U) FAA (U) BO, Om (U) FISA (U) FIsc Oy] (U) MCT or] (U)NSA (u)oIG (u) 0Ge (u) SID oy (U) SIGINT (U) SPCMA (U) SOP (U) SS (U/EQUQ) SV (U//EQUO) SV3 (U/POUQ) SV4 (U/EQUO) $2 (U)TD (U) TOPI Om (U/FOLO} T131 (U//FOUO) T1412 (U) USP Oz ‘Attorney General i Counterterrorism Digital network intelligence Dialed number recognition Department of Justice, National Security Division Foreign Intelligence Surveillance Act Amendments Act Executive Order Deer See Foreign Intelligence Surveillance Act Foreign Intelligence Surveillance Court aes Multiple communi : Be a ea National Security Ageney/Central Security Service Office of the Inspector General Office of General Counsel Signals Intelligence Directorate aS Signals intelligence Supplemental Procedures Governing Communications Metadata Analysis Standard operating procedure Source system of record Signals Intelligence Directorate Oversight and Compliance Compliance Verification FISA Authorities Analysis and Production Technology Directorate Target office of primary interest Compliance Capabilities ULS. person TOP SECRETUSW/NOFORN 16‘FOP SECRET/SW/NOFORN ST-15-0002 (U) APPENDIX A: ABOUT THE SPECIAL STUDY (U) Objectives (UlFOUO) The overall objective of the study is to determine whether National Security Agency/Central Security Service (NSA) controls are adequate to ensure ‘compliance with the Foreign Intelligence Surveillance Act (FISA) Amendments Act ‘of 2008 (FAA) §§704 and 705(b) targeting and minimization procedures. (U) The focused objectives were as follows: 1. (Ui/EOLIO} Determine whether selectors associated with FAA §§704 and 705(b) targets are tasked for collection only within Foreign Intelligence Surveillance Court- or Attorney General-approved targeting authorization periods and while targets are reasonably believed to be outside the United States. 2. (U//FOULO) Determine whether selectors associated with FAA §§704 and 705(b) targets are tasked in thc ams with the AS | RRR 3. (U//EQUO) Determine whether queries performed using selectors associated with FAA §§704 and 705(b) targets comply with the targeting and minimization procedures. 4. (U/PQLO) Determine whether the Agency has implemented controls that, __ RRRES aRA RSENONA aR (U) Scope and Methodology o ’ (U/FOUO) This special study was conducted from March through August 2015. The Office of the Inspector General (O1G) review focused on NSA system controls and. manual processes for tasking and detasking selectors and querying data and on controls implemented in response to an FAA §704 purge incident. (U/POLOY We gained an understanding of FA §§704 and 705(b) controls and corporate controls by interviewing personnel from the Signals Intelligence Directorate’s (SID) Oversight and Compliance (SV), SIGINT Policy and Corporate |ssues St, | MAE. the Technology Directorate’s (TD) Office of ‘Compliance, (EEN. the Research sie eee a Directorate's (RD) Office of Complianc¢, aE. and the Office of ‘TOP_SECRETUSW/NOFORN: 17TOP SECRETUSUNOFORN ST-15-0002 the Director of Compliance. We interviewed personnel from the Office of General Counsel to discuss the FAA §§704 and 705(b) targeting and minimization procedures. We performed procedural reviews of gg] product |S aa (U/EQUO) We conducted this special study using the standards of the Council of the Inspectors General on Integrity and Efficieney, Quality Standards for Inspection and Evaluation, January 2012. Those standards require that we plan and perform the review to obtain sufficient evidence to provide a reasonable basis for our findings and conclusions according to our review objectives. We believe we have met that standard: we reviewed policies, procedures, and internal controls and interviewed personnel to determine whether taskings and detaskings and queries are being performed compliantly, and interviewed personnel to determine whether additional controls have been implemented to prev nt aes (U) Standards for Internal Control (U) Internal controls (U/OLUO) NSA/CSS Policy 7-3, Managers” Internal Control Program, 14 February 2012, implements the Government Accountability Office's Standards for Internal Control in the Federal Government, November 1999 (revised September 2014), and assigns managers responsibility to establish internal controls. We focused on internal controls for documentation, record, structure, authorization, and management when assessing processes and procedures for tasking and detasking and query compliance, Table A-I depicts the categories of internal controls outlined in NSA/CSS Policy 7-3. (U) Table A-1. Categories of Internal Controls en iY Established writen procedures that are complete, accurate, and available for Documentation | examination, Consists of regulations, policies, procedures, andlor standard operating procedures (SOPS), Record ‘A written description of what has happened. Key duties and responsibilities in authorizing, processing, recording, and reviewing official NSA transactions should be Separated among individuals. a) Managers should exercise appropriate oversight to ensure that individuals do not exceed or abuse their assigned authorities “Authorization Procedures are in place to prevent people from exceeding their authority oF misusing government resources. ‘Consists ofthe assignment, review, and approval of work This control Management requires that management provide guidance and training to reduce loss of resources and increase achievement of results, ‘Any method or device that can be used to restrict access to govemment Security resources. This control may ulize safes, vaults, locked rooms, locked desk ‘drawers, computer log-on identification, and passwords wTOP SECRETUSWNOFORN ST-15-0002 (U) Authorities and Restrictions (U) FAA §§704 and 705(b) Targeting and Minimization Procedures (SHANE) Mukasey Letter to the Director, NSA/CSS, 18 August 2008, required NSA to proceed under §704 and §705(b) of FAA to conduet foreign intelligence that previously had been authorized by the AG solely pursuant to §2.5 of E.O. 12333. (SHSWRELTOUSA, FVEY) National Security Agency's Standard Minimization Procedures for Acquisitions Targeting United States Persons Reasonably Believed to be Located Outside the United States Pursuant to Section 704 of the Foreign Intelligence Surveillance, 28 July 2008, establishes NSA’s standard minimization procedures for acquisitions targeting U.S. persons (USPs) reasonably believed to be outside the United States pursuant to §704 of FISA. ‘These procedures also apply to FAA §705(b). (U) National policies and procedures (U) Executive Order 12333, United States Intelligence Activities, as amended (2008), authorizes NSA/CSS to collect, process, analyze, produce, and disseminate SIGINT information and data for foreign intelligence purposes to Support national and departmental missions. (U) Department of Defense (DoD) Regulation 5240.1-R, Procedures Governing the Activities of DoD Intelligence Components that Affect United States Persons, December 1982, establishes procedures governing the activities of DoD intelligence ‘components that affect USPs. (U) NSA policy (U) NSA/CSS Policy 7-3, Managers’ Internal Control Program, 14 February 2012, establishes policy and prescribes procedures and responsibilities for the NSA/CSS Internal Control Program. (U) NSAJCSS Policy 1-23, Procedures Governing NSA/CSS Activities That Affect US, Persons, 30 July 2013, establishes procedures to protect the privacy rights of USPs. (U) SID policy (U/FOUO) USSID SPOOI8, Legal Compliance and U.S. Persons Minimization Procedures, 25 January 2011, prescribes policies and procedures and assigns responsibilities to ensure that the missions and functions of the United States SIGINT System (USSS) are conducted in a manner that safeguards the constitutional rights of USPs. (U/EQUO) USSID SP0019, NSA/CSS Signals Intelligence Directorate ~ Oversight ‘and Compliance Policy, 13 November 2012, outlines the oversight and compliance policy and procedures governing SIGINT activities by elements of the USSS operating under the Director, NSA. TOP SECRET/SU/NOFORN 19TOP SECRETSINOFORN (U) APPENDIX B: ADDITIONAL INFORMATION (U) Tasking and Detasking Compliance (U) System controls (Ul/EOUO) IM systems controls were evaluated in TD's development environment for the following scenarios: (U) Taskings +L RR ane I RENE NS RCE ‘A SOO A aa + Lo RN TE PETERS SLA AST ET ARE RTE EAST eS + | (Ol RSENS EES TT PEE (U) Detaskings + | OEMS ean ETRE] Ts |_|. eT PERERA Pea EO RES ae (U) Detasking requests (U/EQUO) We reviewed analyst requests in fgg to detask selectors associated with the gy FAA §§704 and 705(b) targets who had documented U.S. travel from aaa We found that analysts had submitted the detasking requests before targets arrived in the United States to comply with the FAA §§704 and 705(b) targeting and minimization procedures.TOP SECRETUSL/NOFORN ST-15-0002 (U/FOUe) | oS (U/POUO) (U/FOU0) aaa (U//FOUO), ee LE a Oa ARO ERAN ee ER Es ee OE 2 SSUR 10 55 \ a a Perea a] © (S/REL-TO USA, FEY) ea STR ORE PTL TET aS " (U//EOUO) Examples of DNR and DNI selectors include telephone numbers and e-mail addresses, respectively 2 (SOSEREL TOUS AM‘TOP_SECRET/SUW/NOFORN ST-15-0002 a RE ST EE (U/FOUO) Controls Implemented in Response to an iy | The Agency plans to perform reconciliations one month ata time starting with J and will perform monthly reconciliations as new data is received. DR RS ETE FOP SEC MUNQEORN 22‘TOP SECRET/SW/NOFORN ST-15-0002 (U) APPENDIX C: FULL TEXT OF MANAGEMENT RESPONSE (U) SID RESPONSE SIGNALS INTELLIGENCE DIRECTORATE Memorandum 18 December 2015 és FROM: Signals Intelligence Dinstonste (SID) TO: Ofiee ofthe lnspeetor General (OIG) SUID: (L443) SID Response tothe Draft Report om the Special Stay of NSA Controls Comply withthe PIS Amendments Aet 704 and 708(b) Fangeting and Minimization Procedures (sr-isonn3) (C1 This memoeundum provides the NSA-CSS OIG a response tothe subject dra report (0 Ho444 Five recommendations were idemied by the OIG for SID remediation: 1 (SV), BASVI TSW) 4 (SUE, and § (SOD), (1 aatiedy SID concurs with the OIG findings and recommendations, Comective action plans and target completion dates for each ofthe five reconsmendations are includ inthe enclave (U ebe Please cunt 966-5707 13) you have any questions, nel: as Depoty Chie! of Stall for SIGIN | Policy && Corporate hates (S02) TOP SECRETUSUNOFORN 23TOP SECRETYSNOFORN ST-15-0002 NSA/CSS OFFICE OF INSPECTOR GENERAL | (U//#040} Management Response to Draft Report on the Special Study of NSA | Controls to Comply with the FISA Amendments Act 704 and 705(b) Targeting and Minimization Procedures (ST-15-0002) (1y/ (498464 SID is required to provide management corrective actions for the subject draft report. In accordance with IG-11357-12, “Coordinating Office of Inspector "the OIG will evaluate the management response and determine ‘whether changes to a finding, conclusion, of recommendation can be supported General Reports, 1) SID agrees with the O1G's findings strategy has been developed for immedi consideration Rect | Action Planned Corrective Measure Target | Blement ‘Completion Date 1d recommendations and the following te remediation, and offers comments for O1G 1 Sv (U] Comment: Request that S2 Compliance be added | (U) N/A. to Recommendation 1 as contributor. (e865 TI 959.5959 S2.Compliance L [U//F8¥0) Recommendation 1: Implement a process | 1 to periodically monitor for compliance all queries performed using selectors associated with FAA 704 and | ermine whether | 10//#0¥0) Corrective Action Plan: SV will develop an | SOP to document SV's procedures processes to | periodically monitor for compliance all queries | performed using selectors associated with FAA 704 and FAA 705() taste Tiseatigated the SOP wil be | eveloped by SRT This SOP will inchude procedures fn 4TOP-SECRET/SINOFORN ST-15-0002 8v3 si -SBCRET//NoRORR (queries of FAA 702 data exehided upstream data. Ttis ¢stimated that the periodic compliance verfeation reviews ml be inlet 0) 00-4887, SV3 WHO Recommendation Zips | of queries performed using selectors associated with FAA 704 and 705(b) targets waske with TD to obtain records that also inch lary recor. (U) Corrective Plan: SV will develop an SOP to document SV's procedures/processes to periodically monitor for compliance all queries performed using selectors associated with FAA 704 and FAA 705(b). targets, The SOP will also inchide the WFNS} Recommendation Dopp send periodic reminders to the SID workforce to specily that queties performed using selectors associated with Rnalysts must also be reminded periodically that queries of FAA 702 data using USP. Selectors aust exclude upstreain data by removing the PAA 702 upstreaun authority from the search criteria Po prevent tate trorn Penn er [U/HFOUO} Corrective Action Plan: SV will develop/ post two compliance advisories ~ one for the PAA 704/705b queries, and one for FAA 702 queries Based on trend analysis of any non-compliant queries liscovered during the planned periodic complianc verification reviews (as agreed to in Recommendation 1, SV will issue periodic reminders, as needed, to the SID workforce that references back to the two compliance advisories to improve awareness, ‘969-0021, SV4 (WComment: Request that S2 Compliance be lo Recotnimendation 4 as contributor UL > : TE 0° SECRET; WOFORS- dW NTATOP SECRETUSNOFORN mpliance L Recommendation 4 (0) FOUG} Develo document consistently and compl 704 and 7031p) targets} tems must be available to all D worklorce of the new {U//PO¥O} Request: Title VII Authority Lead concurs (U/ 4206} Management action plan will J —_—ST-15-0002 27 a ] ~seoner//noronn- | - EGE - (U1 Proposed Change: Renumnber Recommendation § Corrective Action Pian SNe Vil Authority Ee | SECRET//NOFORE- TOP SECRET/SU/NOFORNTOP SECRET/SUNOFORN ST-15-0002 (U) This page intentionally left blank. ‘TOP-SECRETUSL/NOFORN 28