Previously, I wrote about a provision in the Intelligence Authorization Act (IAA) proposing to amend the “electronic communication service provider” definition (ESCP) under FISA Section 702(i). ECSP was expanded in the FISA reauthorization bill to include “any other service provider who has access to equipment that is being or may be used to transmit or store wire or electronic communications.” The original language was so broadly written that, according to organizations like Center for Democracy and Technology, it would have included local businesses like hotels, coffee shops, AirBnB hosts, news media headquarters, and journalist offices. Further, Senator Wyden also stated that the provision would allow “anyone with access to a server, a wire, a cable box, a wifi router, a phone, or a computer” to become a government spy.
Responding to concerns about the overbroad proposal, an amendment was added to state that an ECSP would not include a public accommodation facility, a dwelling, a community service facility, or a food service establishment, which is the current definition. The IAA amendment sought to further limit the scope of ECSP to “provider[s] of the type of service at issue in the covered [FISC] opinions.” The opinions are heavily redacted, and it is nearly impossible to determine which services would been covered by the amended definition.
The IAA got folded into the National Defense Authorization Act (NDAA), which was signed into law on December 23rd, 2024. According to Wired, a Republican senator objected to the amendment and it was ultimately left out of the law’s final version. Along with the issue of U.S. person queries, the ECSP definition is likely to be a focus of congressional debates on whether and how to further amend FISA Section 702 as it comes up for reauthorization in 2026.
The uncertainty surrounding the amended ECSP definition goes beyond the fact that the relevant FISC and FISC-R opinions remain heavily redacted. This debate highlights that the scope of not only FISA Section 702, but the Stored Communications Act and CLOUD Act agreements, all hinge on the statutory definitions of “electronic communication service” and “remote computing service.” Congress enacted these definitions in 1986, years before the World Wide Web was invented (1989) and released to the public (1993). The definitions have not been amended since.
Understanding these terms is central to any effort to make sense of the reach of U.S. law in the tech space. Unfortunately, as many legal observers well know, it is something of a herculean task to make sense of the decades worth of cases interpreting these terms.
In an upcoming series, I will explore what these terms mean in light of the computing and communication services available in the modern era, the implications for current flashpoints, and whether legislative reform is necessary.
