Cybersecurity Policy Report, Sharp Decline Seen in FBI’s Use of Foreign Intelligence Data for U.S. Investigations, (Oct 3, 2025)
Personnel at the Federal Bureau of Investigation have apparently become reluctant to investigate Americans using data collected about foreign intelligence targets following enactment of a surveillance reform bill last year, according to the Department of Justice Office of Inspector General (OIG).
One of the goals of the Reforming Intelligence and Securing America Act (RISAA) was to restrict the FBI’s use of foreign intelligence data to investigate Americans, the OIG noted in a report published yesterday.
RISAA reauthorized provisions of the Foreign Intelligence Surveillance Act (FISA), including FISA section 702, which empowers U.S. intelligence agencies to intercept communications of foreign intelligence targets. But the communications of Americans also get swept up when they interact with foreign intelligence targets, and the FBI has been caught improperly searching section 702 data for information about Americans.
RISAA required the FBI to tighten restrictions on “U.S. person queries” of section 702 data and audit the use of the section 702 database (CPR, April 22, 2024).
“RISAA requires that FBI personnel obtain approval from an FBI supervisor or attorney prior to conducting a U.S. person query of Section 702-acquired information,” it said. “RISAA also mandates that the [Justice] Department audit every query conducted by FBI personnel that the FBI identifies as a U.S. person query.”
The OIG found that the number of U.S. person queries dropped to 5,518 during the 12 months ending November 2024 from 57,094 during the previous 12 months. The number of such queries during the 12 months ending November 2021 was 2,964,643, it said.
“We found that the number of noncompliant queries ... has been reduced substantially post-RISAA,” the OIG said. “[I]t appears that the FBI is no longer engaging in the widespread noncompliant querying of U.S. persons that was pervasive just a few years ago.”
Most of the “noncompliant queries conducted post-RISAA were noncompliant due to administrative mistakes, such as typographical errors, rather than due to fundamental misunderstandings of the query standard. Witnesses we interviewed attributed the reduction of noncompliant queries at least in part to the reforms imposed by RISAA,” it added.
While some privacy advocates might view the decline as good news, the OIG noted that the decrease was causing apprehension at the FBI and DoJ’s National Security Division (NSD).
“Several FBI and NSD witnesses expressed a high degree of concern about the continuing decline in the number of queries and whether users are failing to run queries that they should run, which those witnesses believed could lead the FBI to miss potentially critical threat information. In an effort to mitigate that risk, the FBI and NSD have made efforts to communicate to FBI personnel the importance of conducting appropriate, compliant queries,” it said.
“Neither the FBI, NSD, nor the OIG has conducted an analysis of the reason(s) for the decline in queries. Many FBI and NSD witnesses we spoke to shared their views on the causes and significance of the decline in queries,” it stated.
Some witnesses suggested that “the administrative burden of conducting U.S person queries—including drafting a written justification and filling out a lengthy form to obtain attorney pre-approval—may be a factor discouraging users from running queries,” the OIG said.
Other witnesses “identified ‘audit fatigue’ as a potential contributor to the decrease in the number of queries,” it said, while some thought the “FISA Query Accountability Procedures may be a consideration for users running fewer queries because they are concerned that they may be subject to disciplinary actions for running noncompliant queries.”
“Several said that they had heard people use the term ‘FISA jail’ to describe the consequences for employees who ran noncompliant queries,” the OIG added. “Witnesses also noted that an exacerbating factor may be the fact that many queries do not return any results. Users may therefore believe that the potential benefits of running some queries do not outweigh the costs in terms of administrative burden, auditing, and potential professional consequences for noncompliance.”
MainStory: TopStory FederalLegislation DataPrivacy