Why Section 702 Must Be Reauthorized to Combat Cyber Threats

The FBI’s cyber division is urging Congress to reauthorize Section 702 of the Foreign Intelligence Surveillance Act, warning that allowing the intelligence-gathering authority to lapse would create critical vulnerabilities in U.S. Defenses against foreign cyber threats targeting hospitals, water systems, power grids and other essential infrastructure.

Drawing on two decades of experience investigating cybercrime and foreign influence operations, a former FBI official writes in The Cipher Brief that Section 702 remains a vital tool for identifying and disrupting threats before they materialize, particularly those linked to Iranian, Chinese and ransomware groups operating with state tolerance or support.

The authority enables the collection of communications involving non-U.S. Persons located abroad when there is a foreign intelligence purpose, and has been instrumental in detecting pre-positioned access by Chinese hackers in U.S. Telecommunications and transportation networks, uncovering Iranian plots to assassinate dissidents and officials on American soil, and tracking ransomware gangs that increasingly operate under the direction of foreign adversaries seeking to destabilize critical systems.

In one example cited, Section 702-derived intelligence allowed the FBI to identify exactly which part of a major U.S. Transportation hub’s network had been compromised by Chinese operators, enabling timely alerts to operators and the closure of a backdoor before it could be activated during a potential crisis.

The writer acknowledges past compliance failures in how the FBI queried data collected under Section 702, noting that pre-2021 practices were unacceptable and drew criticism from the Foreign Intelligence Surveillance Court (FISC). However, reforms instituted since then — including improved training, supervision and accountability measures — have been validated by the same court, which found the changes are producing the desired effect.

While concerns about government access to commercially available data are legitimate and warrant separate legislative attention, the author argues they should not be conflated with the reauthorization of Section 702, which addresses distinct national security needs and operates under a different legal framework.

With adversaries actively probing U.S. Infrastructure and refining their capabilities, the author contends that letting Section 702 expire would hand opponents a tactical advantage, allowing them to operate more freely in already-compromised networks without the risk of early detection.

Reauthorizing the authority, maintaining oversight reforms and addressing commercial data issues on a separate track, the piece concludes, would preserve the FBI’s ability to connect the dots before attacks occur — a capability that, from the front lines of cyber defense, has proven essential to preventing harm rather than merely responding to it.