NSA MASS-SURVEILLANCE STACK (FISA §702 / PRISM–UPSTREAM / FIVE EYES)

OLYMPUS opened an institutional file — the largest in the drawer, and the one the rest of the drawer is filed inside. An agency has no Big Five and no Dark Triad, and the unit does not invent them; what an agency has is a legal stack, a collection footprint, and a compliance record, and those are the file. The subject is not one program but the assembled apparatus: PRISM and upstream collection under FISA §702, Executive Order 12333 collection abroad, XKeyscore as the search layer, the Utah Data Center as the storage layer, and Five Eyes as the sharing layer across five governments. It is catalogued here as the foundation layer — the substrate every other institution in this file operates on top of. And unlike most files in this drawer, part of this record is ADJUDICATED: the violations below are not a critic’s characterization but the surveillance court’s own repeated findings.

Institutional Archetype

THE FOUNDATION LAYER — The archetype is the substrate: the layer beneath the layer everyone argues about. The observatories map influence operations, the standards bodies grade the models, the labs train them — all of it on networks whose fiber the agency taps, whose platforms it compels, and whose stored take it keeps in exabytes against the possibility of future use. The instrument is not a report or a benchmark; it is collection itself — “nearly everything a typical user does on the internet,” in the agency’s own training-slide phrasing. The leverage is that the substrate outlives every argument conducted on top of it: programs get renamed, authorities get reauthorized, and the take keeps flowing. The finding is the shape of the stack and the compliance record it generated.

Mandate & Origin

The stack is a legal sediment, laid down in layers. FISA (1978) created the Foreign Intelligence Surveillance Court in response to the Church Committee’s findings on warrantless wiretapping and surveillance of domestic dissenters — the court that was supposed to say no. Executive Order 12333 (Reagan, December 4, 1981) became the primary authority for collection outside the United States: no judicial oversight, no warrants, no congressional reporting for routine overseas collection — and, per the Electronic Privacy Information Center, a privacy advocacy group, an order that has “never been subject to meaningful oversight by either courts or Congress.” After September 11, Stellar Wind ran warrantless wiretaps of Americans’ international communications outside FISA entirely; when the program surfaced, Congress responded with the FISA Amendments Act of 2008, which legalized the model going forward as Section 702 and granted the cooperating telecoms retroactive immunity. In April 2024, Congress passed RISAA (H.R. 7888; House 273–147, Senate 60–34, at midnight before expiration), reauthorizing §702 and expanding the definition of “electronic communications service provider” so broadly that critics argued it could compel almost any business operating Wi-Fi. Senator Ron Wyden called it “one of the most dramatic and terrifying expansions of government surveillance authority in history.” President Biden signed it the same day.

The machinery the stack authorizes, per the agency’s own leaked documents: PRISM — collection from nine US technology companies (Microsoft joined September 2007, then Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL, Apple by October 2012), accounting for 91% of the internet traffic NSA acquired under §702. Upstream — fiber-optic taps on the backbone itself, exemplified by Room 641A at AT&T’s Folsom Street facility (installed 2003, revealed by technician Mark Klein in 2006). MUSCULAR — a joint NSA/GCHQ tap on the unencrypted links between Google’s and Yahoo’s own data centers, placed overseas to fall under EO 12333 rather than FISA; 181 million records in one thirty-day window, commemorated internally by a slide reading “SSL Added and Removed Here” with a hand-drawn smiley face. XKeyscore — the search layer, 700+ servers at roughly 150 sites, at least 41 billion records collected in a single thirty-day period, queryable by name, phone, IP, or keyword on an analyst’s form with no warrant. Utah Data Center (Bluffdale, completed 2014, $1.5 billion) — exabyte-scale storage, built to keep the take indefinitely.

Funding & Backers

For the commercial firms in this drawer the question is who pays them; for the agency the question runs the other way — whom it pays, and what the payment bought. The documented ledger: AT&T’s cooperation under the FAIRVIEW program ran at $188.9 million in a single year, per ProPublica and The New York Times. GCHQ’s Tempora — 200+ transatlantic cable taps whose take flowed to NSA under Five Eyes — paid BT and Vodafone tens of millions of pounds annually in secret. RSA Security received a $10 million NSA contract to make Dual_EC_DRBG — an algorithm the Snowden documents showed the NSA had backdoored — the default random-number generator in its BSAFE toolkit; RSA denied knowingly weakening its products. The contractor layer completes the diagram: Edward Snowden held his system-administrator access as a Booz Allen Hamilton employee, and Palantir — founded 2003 with initial CIA funding through In-Q-Tel, government contracts around 55% of revenue — now holds a Project Maven contract expanded past $1 billion. The funding model is the finding inverted: a substrate so entrenched that the private sector is paid to be part of it, indemnified when caught, and contracted to process the take.

Institutional Voice & Intent

The voice is the training-slide register — the tone of a corporate onboarding deck for a product that happens to be omniscience — in private; and the categorical denial in public. The two public specimens are on the record. NSA Director Keith Alexander, DEF CON, July 2012: the claim that the agency held “millions or hundreds of millions of dossiers on people” was “absolutely false.” Director of National Intelligence James Clapper, Senate testimony, March 12, 2013, asked whether the NSA collects “any type of data at all on millions or hundreds of millions of Americans”: “No, sir. … Not wittingly.” The bulk telephone-metadata program was running as he said it. After the leaks, Clapper called it the “least untruthful” answer available, then conceded in a letter to the committee that the testimony had been “clearly erroneous.” No charge followed.

Stated intent: Foreign intelligence. §702 targets non-US persons located outside the United States; the mission is terrorism, espionage, and adversary communications, under court-approved procedures.

Observed intent: Build and keep the substrate. Collect at the backbone, store at exabyte scale, share by default across five governments, and route around each constraint as it appears — overseas taps when FISA is inconvenient, executive order when statute is inconvenient, reauthorization with expansion when exposure is inconvenient.

Gap — with the defense at full strength. The government’s case, steel-manned: §702 is a foreign-intelligence authority of documented operational value; the FISA Court’s 99.97% approval rate (33,942 applications from 1979–2012, 12 denied) is defended by every former FISA judge who has spoken publicly as the product of self-selection — weak applications are withdrawn or modified before formal submission, and the Stanford Law Review found roughly 24.4% of applications underwent substantive changes after court inquiry. The PRISM companies stated they provided data only under specific legal orders and allowed no “direct access” to servers. And the system has corrected once: the USA FREEDOM Act (June 2015) ended bulk phone-metadata collection after the PCLOB found the §215 program illegal. All of that is on the record. So is the other side of the ledger, and the other side is adjudicated.

Interest: What each position pays, documented, with the best case its holders state. The positions are the agencies’, the statute’s and its opponents’; the personal record of the director who ran the stack through the 2018-2024 compliance cycle is on Paul Nakasone, who as director was the official-capacity defendant in Wikimedia v. NSA.

• Extend §702 as written, with no warrant requirement for U.S.-person queries. Position: the director confirmed in March 2026, Gen. Joshua Rudd, told the Senate Intelligence Committee the law has “saved lives here in the homeland” and, asked by Sen. Ron Wyden whether a warrant should be required for searches of 702 data that include U.S. persons’ communications, called it “a topic that I need to look into and get a better understanding” (Nextgov, 29 January 2026); the Senate confirmed him 71-29 on 10 March (Reuters via Al-Monitor). Before the lapse the President asked Congress for an extension to “provide time for the selection and confirmation” of a permanent Director of National Intelligence, with Bill Pulte set to act in place of “outgoing DNI Tulsi Gabbard” (AP via PBS NewsHour, 10 June 2026), and on 6 June Senators Tom Cotton and Chuck Grassley wrote urging, “if necessary,” an executive order “to remedy the gap left by the lapse of FISA Title VII” (CRS Legal Sidebar LSB11444, 22 June 2026). What it pays: programmatic collection and query authority for the four agencies that hold §702 data, which ODNI counts at an estimated 349,823 targets in calendar 2025, 7,724 U.S.-person query terms used by NSA, CIA and NCTC and 7,413 by the FBI, whose queries “only run against the subset of collection in FBI systems–approximately 3.02% of Section 702 targets in CY 2025” (ODNI Annual Statistical Transparency Report for CY2025). Without the statute, CRS records, the government “will generally have to seek individual court orders from FISC for each target under FISA Title I” once the existing authorizations expire. Best case, the oversight board’s own: “The Board concludes that Section 702 remains highly valuable to protect national security, and that it creates serious privacy and civil liberties risks” (PCLOB, September 2023). Convergence: CIA, NCTC and the FBI hold the same authority and the same stake in its renewal, and the compelled providers below hold the statute’s compensation and liability shield.
• Keep the provider net wide (the 2024 Act, section 25). Position: the Act’s text. What it pays: the directive power reaches “any other service provider who has access to equipment that is being or may be used to transmit or store wire or electronic communications,” with four exclusions for entities serving primarily as a public accommodation facility, a dwelling, a community facility or a food service establishment (Pub. L. 118-49). Every provider inside the definition receives what the statute gives it: the Government “shall compensate, at the prevailing rate, an electronic communication service provider for providing information, facilities, or assistance,” and “No cause of action shall lie in any court against any electronic communication service provider for providing any information, facilities, or assistance in accordance with a directive” (50 U.S.C. 1881a(i)). Best case, as the text states it: the four exclusions mark the limit. Convergence: the compelled providers are paid and shielded, which is why the lapse put them in an unusual seat; the AP reported that “communications companies forced to provide data to the government under the law could try to cease that compliance” (AP, 12 June 2026), and CRS notes that the transition clause keeps existing directives in force and that Section 702’s liability protections “shall continue to apply to any directive.” No provider is named as having refused a directive in the sources read.
• The opposing faction: a judge between the government and the query. Position: the oversight board’s Recommendation 3, “The most critical safeguard for Americans’ privacy rights is to require individualized and particularized judicial review for all U.S. person query terms” (PCLOB, 2023, above); House Judiciary Committee Ranking Member Jamie Raskin on 9 June 2026, “It has never been our goal to allow Section 702 to sunset” and “a judge must come between the federal government and Americans’ private communications” (Raskin statement). What it pays: the House voted 198-218 on 11 June against a two-thirds suspension bill, H.R. 9238, that would have carried the authority to 2 July 2026 (Congress.gov). The AP reported the Democrats’ stated condition for renewal as the withdrawal of the acting-DNI appointment and a permanent nominee (“won’t support the renewal of Section 702”), so the two conditions on the record are a warrant rule and a personnel decision, and the vote fell between them. Best case, the board’s own, quoted above. Convergence: none documented beyond the vote itself.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

The stack is the floor of this entire file. Five Eyes — US, UK, Canada, Australia, New Zealand, formalized in the 1946 UKUSA Agreement — shares signals intelligence by default among NSA, GCHQ, CSE, ASD, and GCSB, under executive arrangements: no treaty, no statute, no court. Privacy International’s assessment: the arrangements are “shrouded in secrecy,” permitting intrusions that “circumvent domestic legal restrictions on state surveillance” — each member can receive about its own citizens what it could not lawfully collect itself. And the substrate now feeds the machines. The NSA AI Security Center applies AI/ML to speaker identification, machine translation across 90+ languages, and pattern detection; the October 2024 national security memorandum on AI directed NSA to stand up a classified AI-model testing capability within 120 days; Palantir processes enforcement databases, biometrics, financial records, and travel history under the expanded Maven contract. Same authorities (§702, EO 12333), same physical infrastructure (fiber taps, data centers), same institutional relationships (Five Eyes, FISA Court) — the transition is from a human analyst typing one XKeyscore query at a time to machine-learning systems correlating the same streams at machine speed. The operator cohort spanning the stack’s three construction eras is documented on this site’s revolving-door board under the tap-backdoor-trinity cluster; the full sourced record is on the research page.

Actions & Leadership Choices

The adjudicated record. This is the section where the file needs no characterization, because the courts supplied their own. A 2011 FISA Court opinion by Judge John Bates — classified until the government released it in August 2013, in the wake of the Snowden disclosures and an EFF FOIA suit — found that NSA’s collection of domestic internet communications under §702 violated the Fourth Amendment; the program continued in modified form. The FBI ran more than 278,000 queries of §702 data later found non-compliant with the court’s own standards — including searches on 100+ Black Lives Matter protesters, January 6 suspects, journalists, and a sitting member of Congress — over 8,000 improper queries in 2022 alone, against a 2021 baseline of 3.4 million warrantless US-person searches per the ODNI’s own transparency reporting. The FISA Court issued opinions in 2018, 2019, 2020, and 2022 decrying “persistent and widespread” violations. The compliance cycle is itself the finding: improper queries, discovery, new procedures, new violations, newer procedures, newer violations — at no point the suggestion that a warrantless database of Americans’ communications, queryable by thousands of federal employees on an unaudited form, is the problem.

The backdoor ledger. Under BULLRUN, documented in the Snowden files, the agency worked to insert vulnerabilities into commercial encryption. Its showpiece, the Dual_EC_DRBG standard, carried NSA-chosen curve points that let the holder of the secret relationship predict output and derive keys. In 2012 an unknown third party — widely attributed in Bloomberg reporting and by security researchers to Chinese intelligence, never officially confirmed — modified the parameters in Juniper Networks’ implementation, locking the NSA out of its own backdoor while opening the traffic to someone else. When Senator Wyden’s staff asked in 2018 for the agency’s “lessons learned” report on the incident, the NSA said it could not locate it. The deed pattern: weaken the commons, lose control of the weakness, lose the paperwork.

The continuity ledger. Four administrations, one direction. Bush launched Stellar Wind; Congress legalized it retroactively. Obama campaigned on reform, tripled NSA searches of Americans’ communications after 2011 rule changes, and — in January 2017, his final days — authorized sharing of raw, unminimized signals intelligence with all sixteen other intelligence agencies, where the prior procedure masked American identities first. Trump signed the 2018 reauthorization eight days after tweeting, the morning of the House vote, that FISA had been used against his own campaign. Biden signed the 2024 expansion after the ACLU noted he had previously said §702 would violate civil liberties. Electoral politics changed the signatures, not the trajectory.

The whistleblower ledger. Three routes, one destination. Mark Klein revealed Room 641A in 2006; Congress answered with retroactive telecom immunity — his disclosure was not disproven but immunized. Edward Snowden (timeline: copying began April 2012; first publication June 5, 2013; Espionage Act charges June 14; Moscow June 23 after passport revocation; Russian citizenship September 2022) still faces charges under a statute that recognizes no public-interest defense — he could not argue at trial that what he revealed was unconstitutional, even where a court later found exactly that. Daniel Ellsberg, who beat the same statute in 1973 only through government misconduct, called him a patriot; the disclosures won the 2014 Pulitzer and produced the one statutory rollback (USA FREEDOM) and encrypted data-center links across the industry. The apparatus charged the messenger, immunized the carrier, and kept the take.

The statute’s own record, 2024 to 2026. The 2024 Act did four things in its own text. It required FBI personnel to “obtain prior approval from a Federal Bureau of Investigation supervisor” before a query using a U.S.-person query term, with an exception where the query could help mitigate a threat to life or serious bodily harm (section 2); it struck the clause that let “abouts” collection resume (section 22); it widened the definition of “electronic communication service provider” (section 25, quoted under Interest above); and it set the sunset at two years after enactment, 20 April 2026 (section 19) (Pub. L. 118-49). The approval it required for FBI queries is an internal one, an FBI supervisor or attorney, not the oversight board’s recommended court authorization of query terms. When the date arrived Congress extended rather than reauthorized, twice. Pub. L. 119-84 (H.R. 8322, signed 18 April 2026) moved the repeal to 30 April and passed the House by unanimous consent and the Senate by voice vote (Pub. L. 119-84); Pub. L. 119-87 (S. 4465, signed 30 April) moved it to 12 June and passed the House 261-111 under suspension of the rules (S. 4465 action record). On 11 June H.R. 9238 failed 198-218, and the CRS record of the next day reads “This provision was automatically repealed on June 12, 2026,” all of Title VII of FISA with it. What kept the collection running is a transition clause the 2008 Act has carried since the beginning: any order, authorization or directive issued under Title VII “shall continue in effect until the date of the expiration of such order, authorization, or directive.” CRS reports that “Lawmakers and congressional aides have stated that the Foreign Intelligence Surveillance Court (FISC) authorized the government to conduct surveillance and engage in other activities under Section 702 for one year in March 2026,” the AP wrote that “A March opinion from the secretive Foreign Intelligence Surveillance Court certified the program’s renewal,” and the order itself is not public: Senators Cotton and Warner asked that it be declassified “within 15 days” and, per CRS on 22 June, “no such order appears to have been published” (CRS LSB11444; AP, 12 June 2026). The statute lapsed; the collection did not, and the document that says so is secret.

The record in ODNI’s own reporting. The calendar 2025 report counts “INCREASE (349,823 in CY 2025 from 291,824 in CY 2024)” targets and says “the number of non-U.S. persons targeted has consistently increased year over year.” It records FBI U.S.-person query terms at 7,413 against 5,518, while saying FBI queries “remained lower than previous years, in large part because of the increased focus on technical and policy controls,” and FBI U.S.-person queries run for discovery purposes at 1,081 against 113. The counting is not the 2021 counting the paragraph above quotes: ODNI says the FBI deduplicated its U.S.-person queries from the calendar 2022 report on, and now reports unique query terms. The report also records the court: “In 2025, the FISC issued three Section 702 Certification Orders–one denial and two approvals.” The denial, on 20 February 2025, was of a new counternarcotics certification and came with the finding that “the FISC found that NSA’s and CIA’s minimization and querying procedures should explicitly incorporate the higher necessity standard”; the amended application was approved on 9 April and the renewal on 18 March (ODNI ASTR CY2025). ODNI’s release of the March 2025 opinion on 12 September 2025 carries the court’s own conclusion that “the certifications and procedures met all the statutory requirements in FISA” and that the FBI’s reforms “seem to be improving the FBI’s overall query compliance record” (ODNI news release 29-25). That is the court at the end of the compliance cycle described under the adjudicated record above, and it reads the other way from 2018 to 2022. Both are on the record.

The oversight board and the courts of appeals. The Privacy and Civil Liberties Oversight Board’s 2023 report states that although targets can only be non-U.S. persons, “through incidental collection the government acquires a substantial amount of U.S. persons’ communications as well,” which is the line between targeting, which the statute bars for any person “known at the time of acquisition to be located in the United States,” and what the collection acquires anyway (PCLOB, 2023; 50 U.S.C. 1881a(b)). Two appellate opinions bound the litigation record. In United States v. Hasbajrami the Second Circuit held on 18 December 2019 that “the collection of the communications of United States persons incidental to the lawful surveillance of non-United States persons located abroad does not violate the Fourth Amendment,” and remanded because the record was too sparse to say whether the queries run on the defendant were reasonable; the district court’s remand opinions are on the docket, filed 21 January and 10 February 2025 (Second Circuit opinion; E.D.N.Y. docket). In Wikimedia Foundation v. NSA/CSS, naming General Paul M. Nakasone as Director, the Fourth Circuit held on 15 September 2021 that although the district court “erred in granting summary judgment to the government as to Wikimedia’s standing,” “the state secrets privilege requires the termination of this suit” (Fourth Circuit opinion). A plaintiff that reached the Fourth Circuit twice against Upstream collection was therefore ended on a privilege, not a merits ruling.

CONDUCT verdict: ADJUDICATED — “PERSISTENT AND WIDESPREAD” (the court’s words, not ours). Scoped precisely: the adjudication attaches to the documented §702 compliance record and the 2011 Fourth Amendment finding — not to every program, not to every employee, and not to the stated foreign-intelligence mission, whose defenders’ case is presented above at full strength. What the verdict covers, it covers on the surveillance court’s own repeated findings; no file in this drawer carries heavier paper.

Alliance Map

These run at the same time, and the overlap is the finding. The same two officers jointly authorize the collection and certify it to the court; the court approves it in secret; four agencies query the take; five governments share it; the providers who carry the directives are paid by the Government and immune from suit for complying; and, since 12 June 2026, the statute that created all of it is repealed while the directives it issued are not. None of those ties is a coordination claim. Each is a documented relationship in a record produced by Congress, the courts, the oversight board or ODNI.

Reach Assessment

Institutional: The stack is upstream of every institution in this file — the platforms it compels, the cables it taps, the five governments it shares with by default. Reach measured not in citations but in acquisition: 91% of §702 internet take through nine companies, 41 billion records in a thirty-day XKeyscore window, exabytes at rest in the desert. Memetic: The Snowden disclosures reset the world’s prior on what a state collects — after June 2013, “assume it’s collected” stopped being paranoia and became the documented baseline the entire encryption debate runs on. Civilizational: The foundation layer is the one part of the control grid that predates, and will outlast, every argument about AI: the same authorities and the same fiber now feed machine-learning systems that do at machine speed what analysts once did one query at a time. The FISA Court was created in 1978 to constrain surveillance; by 2013 it approved 99.97% of applications; by 2024 the statute it oversees had been expanded rather than narrowed. The constraint became the permission. The court that was built to say no learned to say yes — and the layer it authorizes is the one everything else in this file is built on.

Score basis. Atk 10 is reach: the Attorney General and the Director of National Intelligence may direct any provider to give “all information, facilities, or assistance necessary to accomplish the acquisition,” the 2024 Act widened the provider definition to “any other service provider who has access to equipment that is being or may be used to transmit or store wire or electronic communications,” and ODNI counts an estimated 349,823 targets for calendar 2025, up from 291,824 (50 U.S.C. 1881a; Pub. L. 118-49; ODNI ASTR CY2025). It is the top of the scale because the party that must act is every provider the definition reaches, and the output reaches four agencies at once. Def 9 is funding insulation: the Government pays the providers it compels “at the prevailing rate” and no cause of action lies against them for complying, so no provider carries the cost or the liability of the collection, and the Fourth Circuit ended the Wikimedia suit on the state secrets privilege (Fourth Circuit). It is not a 10 because the Foreign Intelligence Surveillance Court issued a denial in February 2025 and required the NSA’s and CIA’s procedures to incorporate the higher necessity standard, and because the House refused on 11 June 2026, 198 to 218, to extend the statute and it was repealed the next day, a removal the program had to survive rather than one it was insulated from (H.R. 9238). Hp 10 is entrenchment: the authority was extended in 2024 under a two-year sunset, then twice more in April 2026, and when Congress then declined to extend it the transition clause kept every issued “order, authorization, or directive” in effect until it expires, which CRS dates to one year from the March 2026 orders (CRS LSB11444). Removal was attempted by inaction and the program did not stop. The same sidebar says that once the March 2026 authorization expires the government “will generally have to seek individual court orders from FISC for each target under FISA Title I,” which is the one dated cost of removal on the record. Peers on the same values: BIS CBDC at 8/10/10, hazard 88, shares hp 10 on a 1930 convention and a headquarters agreement, where this file’s rests on a statute that has been extended repeatedly and survived its own repeal; China Surveillance Bloc at 10/9/6, hazard 93, shares atk 10 and def 9 and differs on hp, 6 against 10, with a hazard of 93 against this file’s 88; this file does not move to close that gap, because a repeal the program survived is evidence of entrenchment, not of its absence. OpenAI at 9/8/9, hazard 88, ties on hazard with a lower reach and insulation than this file’s 10 and 9. The values hold.

Sources: PRISM (Wikipedia); PCLOB 2023 Report on Section 702 (PDF); EFF: Upstream vs. PRISM; XKeyscore training slides (Guardian, archived); The Intercept: XKEYSCORE; H.R.7888 (Congress.gov); ACLU: Senate Reauthorizes and Expands Section 702; EFF: Senate and Biden Shamefully Renew and Expand 702; EPIC: FISA Court Statistics 1979–2022; Stanford Law Review: Is the FISC Really a Rubber Stamp?; CDT: FBI’s Misuse of FISA 702; ACLU: NSA Documents Released Since June 2013; Washington Post: NSA Infiltrates Links to Yahoo, Google Data Centers (Oct 30, 2013); Room 641A (Wikipedia); MUSCULAR (Wikipedia); Tempora (Wikipedia); NSA Spying Relies on AT&T’s “Extreme Willingness to Help” — ProPublica, Aug 2015; EO 12333 Full Text (ODNI, PDF); PCLOB: EO 12333 Public Capstone Report (PDF); EPIC: Executive Order 12333; Yale Law School: Newly Disclosed Documents on Five Eyes; Privacy International: Five Eyes; EFF: Obama Expands Surveillance Powers on His Way Out (Jan 2017); The Intercept: Obama Opens NSA’s Vast Trove to Entire Intelligence Community; ACLU: Biden Knows 702 Is Unconstitutional Yet Defends It; Dual_EC_DRBG (Wikipedia); James Clapper (Wikipedia); Keith B. Alexander (Wikipedia); Utah Data Center (Wikipedia); NSA: Artificial Intelligence Security Center; Memorandum on AI and National Security (Oct 2024, archived); DefenseScoop: DOD Raises Palantir Maven Contract to $1B+; Snowden Surveillance Archive (York University); 50 U.S.C. 1881a — govinfo, 2024 edition; Reforming Intelligence and Securing America Act, Pub. L. 118-49; Pub. L. 119-84; S. 4465, Pub. L. 119-87; H.R. 9238 — Congress.gov; CRS Legal Sidebar LSB11444: The Impact of FISA Section 702’s Repeal, 22 June 2026; ODNI Annual Statistical Transparency Report, CY2025; ODNI: March 2025 FISC Section 702 certification opinion, release 29-25; United States v. Hasbajrami, 2d Cir. 18 Dec 2019 — govinfo; United States v. Hasbajrami — E.D.N.Y. docket, govinfo; Wikimedia Foundation v. NSA/CSS, 4th Cir. 15 Sep 2021 — govinfo; Ranking Member Raskin statement on FISA Section 702, 9 June 2026; AP via PBS NewsHour: Trump sticks with Pulte, 10 June 2026; AP: A key US government surveillance program is set to expire, 12 June 2026; Nextgov: Trump nominee to lead NSA commits to backing controversial spying law, 29 Jan 2026; Reuters via Al-Monitor: US Senate confirms NSA director, 10 Mar 2026; Paul Nakasone — profile.