What Each Surveillance Authority Actually Permits

One word, eight different powers

Arguments about surveillance nearly always run several distinct authorities together under a single word, and the distinctions they lose are the ones deciding whether a given claim is true.

The grid above takes eight of them and asks the same four questions of each. Who can be targeted. Who has to approve it. Content or only metadata. And whether anyone is ever told. It's ordered from the most constrained authority to the least, and the ordering does most of the work.

Read it top to bottom and the pattern isn't that the rules are weak. It's that the rules are strongest where the surveillance is most visible and weakest where it's least.

The baseline is a criminal wiretap, and it is strict

The top row is a measuring stick. An ordinary Title III wiretap in a drug case is the most constrained thing on this page. A named person, an enumerated offence, probable cause, a showing that normal methods have failed, minimisation requirements, and sign-off from a senior Justice Department official before the application even reaches a judge.

Then the part with no equivalent anywhere else in the grid. The target is told. An inventory notice goes to the person whose communications were intercepted, generally within ninety days.

That one provision explains the shape of everything below it. A power whose subject eventually finds out is a power that generates litigation, suppression motions, appellate opinions and public records. A power whose subject never finds out generates none of those, and is therefore much harder to describe accurately. Not because it's hidden, but because almost nothing forces it into the open.

Of the eight authorities here, one notifies its targets.

Section 702 lapsed in June and nothing stopped

This is the live fact and the reason the dataset carries a date.

Section 702 is the programme at the centre of the argument. Collection from American providers, targeting non-US persons abroad, with no individual warrant. The FISC approves the procedures once a year as a programme, not the targets, of which there have been more than two hundred thousand in a year. Americans' communications get collected when they correspond with a target, which is foreseeable rather than accidental.

Its statutory authority expired on 12 June 2026, after short-term extensions ran out and reauthorisation failed in Congress.

Collection continued anyway. The FISC certifications issued on 17 March 2026 run for about a year, and the obligations they place on providers run with them, so the programme operates into March 2027 on certifications granted under a statute that no longer exists. As of this writing in October 2026, no reauthorisation has been enacted.

That's not a scandal and nobody is hiding it. It's how the certification mechanism was built, and members of Congress on both sides described it in advance. It's worth stating plainly because it cuts against an assumption both camps make, that the sunset is the moment of decision. The sunset came, the decision didn't, and the surveillance was unaffected either way.

The biggest one is not in the statute books

If the question is which authority covers the most collection, the honest answer is probably Executive Order 12333, and it's the row almost nobody argues about.

It governs collection conducted outside the United States. No court has any role. Congress didn't pass it; a President signed it in 1981 and a President can amend it. Americans' communications get swept up when they transit foreign infrastructure, which an enormous amount of ordinary internet traffic does, and the protections that apply are procedures the executive branch writes and approves for itself.

It has no sunset, which is why there's no periodic fight about it. The authorities generating public argument are the ones Congress has to renew. That's a fact about congressional calendars, not about scale.

And the most permissive isn't an authority at all

The bottom row has no legal process attached because none is triggered.

Agencies buy location histories, device identifiers and browsing records from commercial data brokers, on the open market, with a procurement contract. The government's position has been that information available for purchase isn't a search, so nothing on this page applies. No warrant, no certification, no court, no notice, no obligation to count it.

The assessment that matters here isn't an advocacy group's. In January 2022 the Director of National Intelligence's own senior advisory panel reported, in a document declassified the following year at a senator's request, that commercially available information has grown to the point that it "has begun to replicate the results of intrusive surveillance techniques."

That's the intelligence community describing its own purchases, and it's the strongest single sentence available on this subject from any source.

What the grid doesn't tell you

It grades elements, not intrusiveness. A row can be tightly bound on all four questions and still be an enormous intrusion into one person's life. Another can be unbound on all four and touch nobody in a given year. The grid shows what the law requires, which is a different axis from what gets done.

It doesn't show volume. None of these authorities publish numbers that can be compared with each other and several publish none at all. Anybody telling you which one collects the most, this page included, is reasoning from structure rather than counting.

And it's only the United States. Every comparable democracy has an equivalent set with different balances. The UK's Investigatory Powers Act and the Five Eyes sharing arrangements are a whole subject this page doesn't open.

The useful question

Ask of any specific claim about surveillance: which row is this about?

A great many claims that sound extraordinary are accurate descriptions of the bottom two rows. A great many rebuttals that sound authoritative are accurate descriptions of the top two. Both sides can be quoting the law correctly and describing different things, which is why the argument never resolves and why the grid is laid out the way it is.

To check a claim, find the authority, read what it actually requires for the element at issue, and notice whether anyone is ever told. That last column determines how much you'll ever be able to find out.