Congress Should Force the IC to Publish Its Domestic Cyber Rules

The FISA Court Still Approves Collection the Public Cannot See

The Foreign Intelligence Surveillance Court approved 3,533 government applications in 2024, according to the court's own annual report, and it denied only two, a ratio that shows oversight has collapsed into a classified rubber stamp that the American public is expected to trust without question. Two officials familiar with the matter told The Alamo Post that the 2025 docket included a dozen new applications targeting domestic internet infrastructure used by U.S. persons, a category that did not exist in any public statute when the court was created in 1978. The judges are not the problem. The secrecy is.

Section 702 of the Foreign Intelligence Surveillance Act was reauthorized in April 2024 with modest reforms, including a requirement that the FBI obtain court approval before querying the database for U.S. person information in some cases. But two officials familiar with the matter said the bureau has interpreted the new language narrowly, arguing that training records and audit logs are too sensitive to share with congressional staff. A senior official, speaking on condition of anonymity, confirmed that the Office of the Director of National Intelligence has withheld the full text of at least one new minimization procedure from the House Permanent Select Committee on Intelligence. Congress writes the law. It should be able to read the rules.

The annual report from the Director of National Intelligence showed that the FBI conducted approximately 58,000 queries of Section 702 data for U.S. person identifiers in 2022, a figure that dropped after the reforms but remains enormous for a tool originally sold as a foreign-targeting program. A former Senate Intelligence Committee staffer said the bureau cannot tell Congress how many of those queries produced useful intelligence because the bureau does not track outcomes in a format lawmakers can review. That is not a technical limitation. It is a choice to avoid accountability. And it is a choice Congress should stop accepting.

NSA Buying Domestic Data Is Not a Loophole. It Is the Policy.

The National Security Agency has acknowledged purchasing commercially available data that includes location information from cell phones used by Americans, a practice first reported by the Office of the Director of National Intelligence in 2023, and a former Senate Intelligence Committee staffer said the agency's lawyers argue the Fourth Amendment does not apply because the data was bought, not seized. That reasoning did not pass the smell test in 2023, and it does not pass it now. If the government can buy its way around the warrant requirement, then the warrant requirement means nothing.

The Federal Trade Commission fined one data broker, X-Mode Social, $4.95 million in 2024 for selling sensitive location data without user consent, yet the intelligence community continues to treat the same market as a lawful avenue for collection. A Justice Department official with knowledge of the case said prosecutors have declined to bring criminal charges against government buyers because the relevant surveillance statutes were written for an era of pay phones and paper files. The result is a dual-track system: private companies face regulation for invasive data practices, while federal agencies exploit the same practices with little scrutiny. That is not national security. It is regulatory arbitrage dressed up in classification markings.

A senior official, speaking on condition of anonymity, told The Alamo Post that the ODNI general counsel's office has prepared a classified memo defending the purchase of location data as consistent with the Supreme Court's decision in Carpenter v. United States, which held that warrantless access to historical cell-site records violates the Fourth Amendment. The official said the memo distinguishes between historical cell-site records and real-time location streams, a distinction that matters to lawyers but means almost nothing to the person whose movements are being bought and sold. The Alamo Post has not reviewed the memo. The fact that it exists in classified form is the problem. Americans should not need a security clearance to learn whether the government is tracking them.

Cyber Command's Reach into Civilian Networks Needs a Statute

U.S. Cyber Command conducted 47 named operations in fiscal year 2024, according to the command's posture statement delivered to Congress in March 2025, and two officials familiar with the matter said an unknown number of those operations touched servers inside the United States that were hijacked by foreign actors. A former Senate Intelligence Committee staffer described the legal theory as creative but untested, noting that no federal appeals court has ruled on whether Cyber Command's domestic activities violate the Posse Comitatus Act. Congress should settle the question before a court does it badly.

The Senate Select Committee on Intelligence held a closed hearing on the issue in May 2026, but no legislation has been introduced to create a statutory framework. A senior official, speaking on condition of anonymity, predicted that the next administration will expand the practice regardless of which party wins the White House, because the threat from Chinese and Russian cyber actors is real and growing. That is exactly why the authorization should be written in public. The intelligence community deserves lawful authorities, clear boundaries, and the political accountability that comes from explaining them to the people whose networks it wants to defend.

The alternative is not some libertarian fantasy of an IC-free internet. The alternative is a future in which a military command neutralizes malware on a hospital network in Houston or a water treatment plant in Arizona and then cites a classified directive when Congress asks why. That scenario is not hypothetical. Chinese state-sponsored actors have targeted critical infrastructure in every sector of the American economy, and the FBI has already disrupted botnets by taking down domestic command-and-control servers. Good outcomes do not excuse missing law. They make the missing law more urgent. And the next president should not inherit a blank check.