A government document can be released twice: once with the secrecy mostly intact, and later with a little less of it. That is the case with a 2008 summary explaining how the National Security Agency’s biggest surveillance authority actually operates. The record shows what changed between the two releases. It does not show why, or exactly when.
The paperwork on the table
The document is titled “FISA Amendments Act of 2008 Section 702 Summary Document,” prepared by the NSA’s Office of General Counsel and dated December 23, 2008. It carries the original classification marking TOP SECRET//COMINT//NOFORN//20320108, with a derivation note crediting NSA/CSSM 1-52, a classification guide dated January 8, 2007. A heavily redacted version of this summary was made public that same December.
Fifteen years later, a version with fewer redactions surfaced, following a Mandatory Declassification Review, or MDR, filed by the transparency outlet The Black Vault. An MDR is a formal request asking an agency to look again at a previously classified record and decide whether it still needs to be withheld. The Black Vault’s entry describing the newer version appeared in its Document Archive on November 10, 2023, listing the file at 20 pages and 4 megabytes. Neither the date the MDR was filed nor the date the document itself was actually released appears anywhere in the record. What exists is a start point, December 2008, and a later point where a different version appears. The gap between them is undocumented.
What Section 702 lets the government do
The summary describes the legal machinery behind Section 702 of the Foreign Intelligence Surveillance Act, added by the FISA Amendments Act of 2008 (Pub. L. No. 110-261, codified at 50 U.S.C. ยง 1881a), which took effect on July 10, 2008. It lets the government acquire foreign intelligence on non-U.S. persons believed to be located outside the United States without seeking an individual FISA court order for each target. Instead, the Director of National Intelligence and the Attorney General jointly approve annual certifications and adopt targeting procedures, with the NSA Director backing the directives that follow. Under those directives, providers of electronic communications services can be legally compelled to assist in the collection. The document frames this as a deliberate departure from traditional FISA practice, where the government had to show a court probable cause for each individual target before compelling assistance. Section 702, the summary states, is built for volume and speed rather than case-by-case approval.
The same text describes minimization procedures as the safeguard meant to apply when a U.S. person’s communications are incidentally picked up in that collection, limiting how the information can be retained, used, or shared. Congress has reauthorized Section 702 more than once since 2008, including in December 2012 and again in January 2018, each time without altering this basic structure.
Who is supposed to be checking
The document names two bodies responsible for watching how the targeting and minimization rules are followed: the NSA’s own Office of Oversight and Compliance, and the Department of Justice. That is as far as the record goes. It states who is assigned to monitor the program. It does not describe a specific audit, a specific finding, or a specific instance of non-compliance. The oversight structure is laid out; its record of use is not part of this document.
A release, not a verdict
An MDR produced a document with fewer blacked-out lines than the one released in 2008. No inquiry was opened into the Section 702 program as a result, no misconduct was alleged, and the text itself contains no finding about the program’s legality or effectiveness, because that was never its purpose. The Black Vault’s own November 2023 description called the release “an essential step toward transparency, allowing for a more informed public discourse about U.S. surveillance practices,” and credited its request with “successful efforts to lift some of the previous redactions.” Both are the publisher’s assessment of what the release accomplishes procedurally, not a judgment about the surveillance program itself. If there is a finding anywhere in this story, it belongs to whichever classification reviewers decided particular lines no longer needed to be withheld, not to anyone weighing what Section 702 does.
What the record doesn’t say
Three things are missing, and the record is simply silent on all three. It does not identify which specific passages were newly unredacted versus which remain blacked out; no comparison or redaction log accompanies the release. It does not give the date the MDR request was filed. And it does not give the date the less-redacted document was actually released, as distinct from the date The Black Vault wrote about it. None of this points toward a hidden answer. It is a gap in the paperwork trail, consistent with how agencies routinely handle these requests, not a sign of anything withheld beyond the ordinary course of declassification review.
A claim about a leak
The Black Vault also states that an unredacted version of the same document is reportedly circulating on other websites. It makes clear it has not verified, hosted, or used that material, and says it intends to keep working only through official declassification channels rather than profile leaked classified information. That is a claim about what exists elsewhere on the internet, made by the publisher about other sites. It is not a confirmed account of what an unredacted copy actually contains, and nothing in the declassified record speaks to it either way.