I noted something in the batch of Semiannual Section 702 Assessments I Con the Record released in January that may explain one reason why the government has such problems giving defendants who’ve been captured in Section 702 surveillance the notice required under the law.

Starting with the 14th Assessment — the one released in February 2016, which covers December 2014 to May 2015 (which also began to integrate feedback from PCLOB), the assessments started to reveal that disseminated reports don’t identify where information on a US Person comes from.

23 (C//NF) NSA does not maintain records that allow it to readily determine, in the case of a report that includes information from several sources, from which source a reference to a U.S. person was derived. Accordingly, the references to U.S. person identities may have resulted from collection pursuant to Section 702 or from other authorized signals intelligence activity conducted by NSA that was reported in conjunction with information acquired under Section 702. Thus, the number provided above is assessed to likely be over-inclusive. NSA has previously provided this explanation in its Annual Review pursuant to Section 702(l)(3) that is provided to Congress.

Presumably, the reports track that intelligence in the report comes from Section 702, or else they wouldn’t be able to track how often serialized reports contain US person information derived from Section 702- or PAA-acquired data, which is where this footnote appears. (In this reporting period, 9.7% of reports including US person information.) But they don’t track which tidbits come from 702 and which come from — say — EO 12333 authorized information or foreign partners.

Given that these reports get circulated outside of NSA (and even outside those people cleared into Section 702), that might mean someone with a dual intelligence/law enforcement role would see the information, pursue further investigation, and yet not know that the investigation “derived” from 702 data, which would then mean the defendant might never get notice.