PRISM: Section 702 FAA Surveillance Program (Revealed June 6, 2013)

Introduction

On June 6, 2013, two news organizations published simultaneously: the Washington Post, with reporting by Barton Gellman, and The Guardian, with reporting by Glenn Greenwald. Both published slides from a classified NSA PowerPoint presentation titled "PRISM/US-984XN Overview." The slides had been provided by Edward Snowden, a contractor for Booz Allen Hamilton working at an NSA facility in Hawaii, who had deliberately collected the documents and transmitted them to journalists.

The slides described a program called PRISM — formally designated US-984XN — under which the NSA collected communications content directly from the servers of nine major US internet companies: Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, and Apple. The program operated under Section 702 of the Foreign Intelligence Surveillance Act, as amended by the FISA Amendments Act (FAA) of 2008.

How PRISM Worked

Section 702 of FISA authorizes the collection of communications of non-US persons located outside the United States for foreign intelligence purposes. Under PRISM, the NSA served legal orders on US-based internet companies compelling them to provide communications content — emails, chat logs, files, photos, stored data — for targeted foreign intelligence subjects.

The companies could not publicly disclose these orders due to gag provisions. They provided data in response to individual court orders from the FISA Court, which operates in secret. The companies' subsequent denials of "direct access" to their servers by the NSA were technically accurate in a narrow sense — the NSA was not sitting inside their data centers with unrestricted access — but they obscured the legal compulsion to provide data on demand.

The Boundless Informant Tool

Among the documents Snowden provided was information about Boundless Informant, an NSA metadata analytics tool that tracked the volume and type of intelligence collected. Boundless Informant data showed that the NSA collected billions of records monthly under various programs. The tool's existence contradicted NSA Director Keith Alexander's 2012 Senate testimony in which he stated the NSA did not collect data on millions of Americans — Boundless Informant showed the scale of collection.

Congressional Response and PCLOB Review

Following the Snowden disclosures, NSA Director Keith Alexander testified before Congress, defending the programs as legally authorized and operationally necessary. President Obama acknowledged the programs and commissioned the President's Review Group on Intelligence and Communications Technologies, which issued a report in December 2013.

The Privacy and Civil Liberties Oversight Board (PCLOB) issued a detailed report on the Section 702 program in July 2014. The PCLOB found the program legally authorized under the FAA but raised significant concerns about the collection of US persons' communications incidentally captured during foreign intelligence collection — so-called "incidental collection" that could include vast amounts of wholly domestic communication.

Company Denials and Acknowledgments

All nine companies named in the PRISM slides issued initial denials of varying specificity. Google stated it did not provide the government with "direct access" to its servers. Facebook stated it did not provide "direct" or "backdoor" access. The denials were carefully worded to be technically accurate while avoiding confirmation of the legal compulsion structure.

In subsequent years, all major companies began publishing "transparency reports" disclosing the number and type of government requests they received annually. These reports confirmed ongoing legal compliance with FISA court orders.

Scope and Scale

The PCLOB's 2014 report confirmed that Section 702 collection touched a significant portion of all internet communications. "Incidental collection" of US persons' communications — captured because they communicated with targeted non-US persons — was acknowledged as a feature of the program's architecture, not an anomaly.

Verdict

Confirmed. The PRISM program is confirmed by the NSA slides, congressional testimony, the PCLOB 2014 report, and the subsequent company transparency reporting framework. The program operated under legal authority (Section 702 FAA) but the scale of incidental US-person collection and the secrecy of the FISA court orders raised documented constitutional concerns. This is confirmed surveillance, not conspiracy theory.

Mechanism: Downstream Collection From Nine Providers Under Section 702

Section 702 of FISA, added by the FISA Amendments Act (FAA) of 2008, does not authorize one collection method but two, run under a single statutory umbrella. PRISM is the "downstream" half: an NSA analyst tasks a "selector" — an email address, a username, a phone identifier — reasonably believed to belong to a non-US person located outside the United States, and a provider is compelled to hand over communications to and from that specific selector. No judge reviews each selector. Instead, the Foreign Intelligence Surveillance Court (FISC) approves a yearly certification and a package of targeting and minimization procedures that govern how selectors may be chosen and how any incidentally collected US-person data must be handled. "Upstream" collection, by contrast, taps the internet backbone itself — historically through companies like AT&T — and for years scanned transiting traffic not just for communications to or from a target but for any communication that mentioned a tasked selector, so-called "about" collection. PRISM's provider-side handoff and upstream's backbone tap are legally and technically distinct programs that both fall under Section 702, which is why fact-checks of "PRISM" and of "NSA mass surveillance" more broadly often talk past each other. The leaked slide deck itself listed the nine named providers with the specific dates each began supplying data: Microsoft (September 2007), Yahoo (March 2008), Google (January 2009), Facebook (June 2009), PalTalk (December 2009), YouTube (September 2010), Skype (February 2011), AOL (March 2011), and Apple (October 2012) — a staggered rollout over five years, not a single simultaneous switch-on.

Key Evidence: The Slides and the Providers' Own Escalation

Only a handful of the roughly 41 slides in the "PRISM/US-984XN Overview" deck were ever published, and Gellman and Greenwald both withheld operational details at the government's request. What was published was enough to be independently checked: internal NSA branding, the FAA 702 legal citation, and the provider join-date table above, which no outside party could have fabricated and which no named company disputed on the facts, only on the characterization of "direct access." The companies' response went beyond the carefully worded denials described above. On June 18, 2013, Google filed a motion with the FISC itself, asking for a declaratory judgment that it had a First Amendment right to publish the aggregate number of FISA orders it received; Microsoft, Yahoo, Facebook, and LinkedIn filed parallel motions within days. Rather than litigate the question, the government notified the court on January 27, 2014 that it would permit the companies to publish banded aggregate figures, and the Director of National Intelligence declassified the underlying data. That a group of the largest technology companies in the world chose to sue their own government's secret court over the right to describe the scope of the program, and that the government settled rather than defend the gag order, is itself evidence that the underlying legal compulsion was real, not a mistaken inference from the slides.

Official Findings: PCLOB and the Declassified FISC Opinions

The clearest confirmation that the government had, in the past, misrepresented the scope of Section 702 collection to its own overseers came from the FISC itself. On October 3, 2011, then-presiding FISC Judge John D. Bates issued an 81-page opinion finding that NSA's upstream collection, as it was then being conducted, was unconstitutional under the Fourth Amendment in part because it was sweeping in an estimated 56,000 wholly domestic communications a year. Bates noted this was the third time since 2008 the government had disclosed to the court that it was collecting more than it had represented. That opinion, along with a related November 2011 ruling, remained classified until the Office of the Director of National Intelligence declassified it in August 2013, two months after the Snowden disclosures forced the issue into public view. The Privacy and Civil Liberties Oversight Board's July 2014 report — and its 2023 follow-up report reassessing the program nearly a decade later — drew on this same body of FISC opinions and NSA compliance filings, and both found the program operating within a real, court-supervised legal structure while continuing to flag unresolved problems, particularly around FBI queries of Section 702 data using US-person identifiers.

The Strongest Counter-Argument — and Where It Holds

The most serious objection to characterizing PRISM as "mass surveillance" is that Section 702 collection is targeted, not bulk: a company cannot be ordered to hand over "everyone's data," only communications tied to a specific tasked selector believed to belong to a non-US person abroad, under a legal framework a federal court reviews annually. This distinction is real and it is documented, not a talking point invented after the fact — PCLOB's reports and the FISC's own declassified opinions describe exactly this selector-based architecture, and it is meaningfully different from the NSA's separate, since-ended bulk telephone metadata program under Section 215. Where the counter-argument runs out of room is incidental collection: because a target's communications with anyone, including Americans, are collected in full, and because upstream's former "about" collection swept in communications merely referencing a selector, PCLOB itself acknowledged that a substantial share of the communications in NSA's Section 702 holdings involve at least one party who is a US person. The 2011 Bates opinion shows this was not a hypothetical risk but a documented, recurring compliance failure for years. So the "targeted, not bulk" defense correctly describes the legal mechanism and correctly rebuts claims of an unrestricted backdoor; it does not show that incidental US-person collection is rare or that oversight caught every problem before disclosure forced the issue.

Aftermath: From the USA FREEDOM Act to the 2024 Reauthorization

The disclosures produced a decade of legislative revisions rather than repeal. The USA FREEDOM Act, signed June 2, 2015, ended the NSA's bulk telephone metadata program and, for the first time, gave the FISC a mechanism to hear an independent legal voice — an amicus "special advocate" — on significant novel questions, a reform later applied to Section 702 opinions as well. In 2017 the NSA announced it would stop upstream "about" collection and purge the previously gathered data, directly responding to the compliance history the Bates opinion had exposed. Congress reauthorized the underlying Section 702 authority in January 2018 through 2023, and again on April 20, 2024 through the Reforming Intelligence and Securing America Act (RISAA), which extends the authority to April 2026, statutorily bars any resumption of "about" collection, and adds new supervisory-approval and reporting requirements after further reported FBI query failures. PRISM's downstream mechanism, now publicly acknowledged rather than secret, remains active today — reauthorized, not dismantled, each time Congress has revisited it.