Guide to Section 702 Value Examples October 2017

Set forth below is a guide to officially released information on the value of information collected under Section 702 of the Foreign Intelligence Surveillance Act (FISA). This information has been made available consistent with the Principles of Intelligence Transparency for the IC.

********************

Five Value Examples - Listed in FISA Amendments Act: Q&A (April 2017) The IC prepared a Q&A document describing Section 702 and other provisions of FISA.

Why is FISA Section 702 necessary to informed U.S. engagement with the country. protect national security? Section 702 collection provides NSA with Title VII of FISA is vital to keeping the nation sensitive internal policy discussions of safe. These authorities provide the foreign intelligence value. government with a uniquely effective way to acquire information about the plans and NSA has used collection authorized under identities of terrorists and terrorist FISA Section 702 to develop a body of organizations, including how they function knowledge regarding the proliferation of and receive support. These authorities also military communications equipment and enable collection of information about the sanctions evasion activity by a sanctions- intentions and capabilities of weapons restricted country. Additionally, Section 702 proliferators and other foreign adversaries collection provided foreign intelligence who threaten the U.S., and inform information that was key to interdicting cybersecurity efforts. Losing these shipments of prohibited goods by the target authorities would greatly impair the ability country. of the United States to respond to threats and to exploit important intelligence Based on FISA Section 702 collection, CIA collection opportunities. Some examples of alerted a foreign partner to the presence the significant information collected through within its borders of an al-Qaeda FISA Section 702 include: sympathizer. Our foreign partner investigated the individual and subsequently NSA has used collection authorized under recruited him as a source. Since his FISA Section 702 to acquire extensive insight recruitment, the individual has continued to into the highest level decision-making of a work with the foreign partner against al- Middle Eastern government. This reporting Qaeda and ISIS affiliates within the country. from Section 702 collection provided U.S. policymakers with the clearest picture of a CIA has used FISA Section 702 collection to regional conflict and, in many cases, directly uncover details, including a photograph that

1 enabled an African partner to arrest two seeking advice regarding how to make ISIS-affiliated militants who had traveled explosives. The NSA passed this information from Turkey and were connected to planning to the FBI. Using a National Security Letter a specific and immediate threat against U.S. (NSL), the FBI was able to quickly identify the personnel and interests. Data recovered individual as Najibullah Zazi. Further from the arrest enabled CIA to learn investigation revealed that Zazi and a group additional information about ISIS and of confederates had imminent plans to uncovered actionable intelligence on an ISIS detonate explosives on subway lines in facilitation network and ISIS attack planning. Manhattan. Zazi and his co-conspirators were arrested and pled guilty or were NSA FISA Section 702 collection against an convicted of their roles in the planned email address used by an al-Qaeda courier in attack. As the Privacy and Civil Liberties Pakistan resulted in the acquisition of a Oversight Board (PCLOB) found in its report, communication sent to that address by an “[w]ithout the initial tip-off about Zazi and unknown individual located in the United his plans, which came about by monitoring States. The message indicated that the an overseas foreigner under Section 702, the United States-based individual was urgently subway bombing plot might have succeeded.

Hajji Iman – Described in DNI Testimony (June 2017) Director of National Intelligence (DNI) Daniel Coats testified before the Senate Select Committee on Intelligence (SSCI) on June 7, 2017.

Before I wrap up my remarks I want to This search was ultimately successful provide one final example that I have for primarily because of FISA section 702. the purposes of today's hearing chosen to declassify using my authority as the director Indeed, based almost exclusively on of National Intelligence to further illustrate intelligence activities under Section 702, the value of Section 702. Before rising NSA collected a significant body of foreign through the ranks to become at one point intelligence about the activities of Hajji the second in command of the self- Iman and his associates. Beginning with proclaimed Islamic State of Iraq in Al Sham, non-Section 702 collection, NSA learned of ISIS, Hajji Iman was a high school teacher an individual closely associated with Hajji and imam. Iman. NSA used collection, permitted and authorized under Section 702 to collect His transformation from citizen to terrorist intelligence on the close associates of Hajji caused the U.S. government to offer a $7 Iman which allowed NSA to develop a million reward for information leading to robust body of knowledge concerning the him. It also made him a top focus of the personal network of his -- of Hajji Iman and NSA's counter terrorism efforts. NSA, along his close associates. with its IC partners, spent over two years from 2014 to 2016 looking for Hajji Iman. Over a two-year period, using FISA Section

2

702 collection and in close collaboration location. U.S. forces returned fire killing with our IC partners, NSA produced more Hajji Iman and the other associates at that intelligence on Hajji Iman's associates location. Subsequent Section 702 collection including their location. NSA and its tactical confirmed Hajji Iman's death. partners then combined this information, the Section 702 collection which was As you can see from this sensitive example, continuing and other intelligence assets to Section 702 is an extremely valuable identify the reclusive Hajji Iman and track intelligence collection tool and one that is his movements. subject to a rigorous, effective oversight program and therefore, allow me to Ultimately this collaboration enabled U.S. reiterate my call on behalf of the forces to attempt an apprehension of Hajji Intelligence Community without hesitation, Iman and two of his associates. On March my call for permanent reauthorization of 24th, 2016, during the attempted the FISA Amendments Act without further apprehension operation shots were fired at amendment. the U.S. forces’ aircraft from Hajji Iman's

ISIS Recruiter Shawn Parson – Described in FBI Testimony (June 2017) On June 27, 2017, Carl Ghattas testified at a hearing before the Senate Judiciary Committee. He is the Executive Assistant Director for the FBI’s National Security Branch.

Section 702 is an extremely valuable and expressing his desire to commit an attack critical investigative tool for the FBI. Every against Western interests. As in any FBI division conducting national security investigation, we used a range of investigations benefits from information investigative tools and techniques, including collected by 702. That’s whether the Section 702, in the investigation of Parson. information is shared by the NSA as a tip or We did this in an effort to detect any attack whether the information is collected on a planning that was underway and assess the target relevant to an FBI investigation. Let extent of his influence. me share with you an example which I, exercising my discretion as an original In November 2014 Parson traveled from classification authority, have determined Trinidad and Tobago to Syria and became can be declassified to help the American increasingly vocal online. The FBI’s people better understand the value of investigation, including information Section 702, especially with respect to its collected pursuant to 702, revealed that fight with ISIS. Parson was a trusted member of a prolific ISIS network. Parson was a key player in this In October 2013, the FBI started network. investigating Shawn Parson, a foreign person from Trinidad and Tobago. This was The network used the Internet and more done after he posted comments online importantly social media to distribute

3 prolific amounts of English language bases located in Colorado, Ohio, and soft terrorist propaganda. They encouraged targets in New York City, Chicago and Los their online followers to carry out attacks in Angeles. Western Europe and across the United States. They used social media daily—they Information obtained through Section 702 used those postings daily—and directed coverage not only revealed Parson’s communications with people rapid fire and persistent terrorist propaganda but it also spread their message encouraging people was instrumental in identifying additional to attack. Parson was a native English members of Parson’s network. The FBI speaker and he even appeared in an ISIS shared this information about Parson’s recruiting video. network with the rest of the Intelligence Community. We also shared it with trusted This network identified American military international partners. Sharing Parson’s men and women and posted their names contacts with our international partners and addresses online. They instructed their was critical as it led to the identification of online followers to “kill them in their own additional ISIS facilitators and supporters in lands, behead them in their own homes, those countries and it potentially prevented stab them to death as they walk their attacks in those countries as well. streets thinking they are safe.” Parson personally encouraged his followers to Parson was eventually killed in Syria in attack U.S. policy officers, U.S. military September 2015.

Attack on Nightclub in Turkey – Described in FBI Testimony (June 2017) On June 27, 2017, Carl Ghattas testified at a hearing before the Senate Judiciary Committee (same hearing as above). I can also walk the committee and the In working together with our foreign service American public through something that partners in Turkey, we were able to identify impacted Americans overseas. This the individual who conducted that attack. occurred … on December31st of last year in And we were able to go up on Section 702 Istanbul, Turkey. collection on that particular individual. Based on that collection, we were able to identify where that individual was located There was a particular individual who was and pass that information to the targeting a night club in Turkey and was appropriate Turkish authorities who going to conduct a terrorist attack at that apprehended him and took him into particular nightclub. He did, in fact, conduct custody. that attack… And he was responsible for the deaths or injuries of 38 people from 14 So it was instrumental in helping us find an different countries. [Note: Media reporting individual who perpetrated an attack in indicates 39 deaths and 70 injuries]. One of another country, helped us find an those individuals was an American who was individual who had shot an American, and it shot in the hip. helped us prevent that individual from

4 acting any more on his own planning and ideology.

Counterterrorism Example – Described in NSA Public Statement (August 2017) NSA statement posted on its website.

Section 702 Saves Lives, Protects the This collection provided the necessary Nation and Allies. The U.S. Intelligence insights and reporting on the attack that Community relies on Section 702 of the refuted the terrorist organization's denial of Foreign Intelligence Surveillance Act in the any involvement. Specifically, Section 702 constant hunt for information about foreign collection provided a direct claim of adversaries determined to harm the nation responsibility from the terror group's or our allies. The National Security Agency, leaders and included a list of terrorists for example, uses this law to uncover the trained for the operation. This was crucial identities or plans of terrorists. for supporting timely U.S. and coalition …. force planning and operations against Last year a foreign attack resulted in the terrorists in the region. deaths of more than 20 people. Who was …. behind it? Had they also taught others how ADM Michael S. Rogers - Commander of to carry out such malicious acts? It was U.S. Cyber Command and NSA Director - has NSA's Section 702 collection that revealed emphasized that this law is an absolutely the identities of the overseas terrorists who essential tool to help secure both our were responsible. nation and allies.

5