Legal Analysis of the NSA Domestic Surveillance Program:
Was the secret NSA surveillance program legal? Was it constitutional? Did it violate federal statutory law? It turns out these are hard questions, but I wanted to try my best to answer them. My answer is pretty tentative, but here it goes: Although it hinges somewhat on technical details we don't know, it seems that the program was probably constitutional but probably violated the federal law known as the Foreign Intelligence Surveillance Act. My answer is extra-cautious for two reasons. First, there is some wiggle room in FISA, depending on technical details we don't know of how the surveillance was done. Second, there is at least a colorable argument — if, I think in the end, an unpersuasive one — that the surveillance was authorized by the Authorization to Use Miltary Force as construed in the Hamdi opinion.

  This is a really long post, so let me tell you where I'm going. I'm going to start with the Fourth Amendment; then turn to FISA; next look to the Authorization to Use Military Force; and conclude by looking at claim that the surveillance was justified by the inherent authority of Article II. And before I start, let me be clear that nothing in this post is intended to express or reflect a normative take of whether the surveillance program is a good idea or a bad idea. In other words, I'm just trying to answer what the law is, not say what the law should be. If you think my analysis is wrong, please let me know in the comment section; I'd be delighted to post a correction.

  The Fourth Amendment. On the whole, I think there are some pretty decent arguments that this program did not violate the Fourth Amendment under existing precedent. There are a bunch of different arguments here, but let me focus on two: the border search exception and a national security exception. Neither is a slam dunk, by any means, but each are plausible arguments left open by the cases.

  The border search exception permits searches at the border of the United States "or its functional equivalent." United States v. Montoya De Hernandez, 473 U.S. 531, 538 (1985). The idea here is that the United States as a sovereign has a right to inspect stuff entering or exiting the country as a way of protecting its sovereign interests, and that the Fourth Amendment permits such searches. Courts have applied the border search exception in cases of PCs and computer hard drives; if you bring a computer into or out of the United States, the government can search your computer for contraband or other prohibited items at the airport or wherever you are entering or leaving the country. See, e.g., United States v. Ickes, 393 F.3d 501 (4th Cir. 2005) (Wilkinson, J.).

  As I understand it, all of the monitoring involved in the NSA program involved international calls (and international e-mails). That is, the NSA was intercepting communications in the U.S., but only communications going outside the U.S. or coming from abroad. I'm not aware of any cases applying the border search exception to raw data, as compared to the search of a physical device that stores data, so this is untested ground. At the same time, I don't know of a rationale in the caselaw for treating data differently than physical storage devices. The case law on the border search exception is phrased in pretty broad language, so it seems at least plausible that a border search exception could apply to monitoring at an ISP or telephone provider as the "functional equivalent of the border," much like airports are the functional equivalent of the border in the case of international airline travel. [UPDATE: A number of people have contacted me or left comments expressing skepticism about this argument. In response, let me point out the most persuasive case on point: United States v. Ramsey, holding that the border search exception applies to all international postal mail, permitting all international postal mail to be searched. Again, this isn't a slam dunk, but I think a plausible argument -- and with dicta that seems to say that mode of transportation is not relevant.]

  The government would have a second argument in case a court doesn't accept the border search exception: the open question of whether there is a national security exception to the Fourth Amendment that permits the government to conduct searches and surveillance for foreign intelligence surveillance. Footnote 23 of Katz v. United States left this open, and Justice White's conccurrence in Katz expanded on this point:
Wiretapping to protect the security of the Nation has been authorized by successive Presidents. The present Administration would apparently save national security cases from restrictions against wiretapping. We should not require the warrant procedure and the magistrate's judgment if the President of the United States or his chief legal officer, the Attorney General, has considered the requirements of national security and authorized electronic surveillance as reasonable.
  The Supreme Court also left this question open in the so-called "Keith" case, United States v. United States District Court, in 1972. Justice Powell's opinion in the Keith case concluded that there was no national security exception to the Fourth Amendment for evidence collection involving domestic organizations, but expressly held open the possibility that such an exception existed for foreign intelligence collection:
Further, the instant case requires no judgment on the scope of the President's surveillance power with respect to the activities of foreign powers, within or without this country. The Attorney General's affidavit in this case states that the surveillances were "deemed necessary to protect the nation from attempts of domestic organizations to attack and subvert the existing structure of Government." There is no evidence of any involvement, directly or indirectly, of a foreign power.
  The administration presumably takes the position that the President does have such power in cases involving foreign evidence collection, and that the NSA surveillance is such a case. The Supreme Court has never resolved the question, so it's an open constitutional issue. Nonetheless, between the border search exception and the open possibility of a national security exception, there are pretty decent arguments that the monitoring did not violate the Fourth Amendment. Maybe persuasive, maybe not, but certainly open and fair arguments under the case law.

  Foreign Intelligence Surveillance Act. Now let's turn to FISA, a 1978 law that Congress enacted in response to the Keith case. FISA goes beyond the Keith case, including foreign intelligence surveillance in its scope even though it was left open as a constututional question.

  Specifically, 50 U.S.C. 1809 prohibits "electronic surveillance" except as authorized by statutory law: "A person is guilty of an offense if he intentionally . . . engages in electronic surveillance under color of law except as authorized by statute." "Electronic surveillance" is defined in 50 U.S.C. 1801(f) to mean, in relevant part:
(1) the acquisition by an electronic, mechanical, or other surveillance device of the contents of any wire or radio communication sent by or intended to be received by a particular, known United States person who is in the United States, if the contents are acquired by intentionally targeting that United States person, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes;
(2) the acquisition by an electronic, mechanical, or other surveillance device of the contents of any wire communication to or from a person in the United States, without the consent of any party thereto, if such acquisition occurs in the United States. . . .
  A "United States person" is defined in 50 U.S.C. 1801(i) as "a citizen of the United States [or] an alien lawfully admitted for permanent residence." A "wire communication" is defined as a communication that is traveling by a wire; I don't know if "radio communication" is a defined term, but I assume it refers primary to satellite communications.

  Putting aside the AUMF and statutory exceptions for now, let's consider whether the NSA surveillance program violates the basic prohibition of 50 U.S.C. 1809 — intentionally conducting electronic surveillance. I think the answer is probably yes. If the surveillance tapped wire communications under 1801(f)(2), the case is pretty clear: the surveillance involved people in the U.S. and survillance in the U.S., and that's all that is required. If the surveillance involved radio communications (satellite communications, I'm guessing), that's a bit trickier. There is at least a little wiggle room in Section 1801(f)(1). For example, you could say that the border search exception eliminates Fourth Amendment protection, such that there was no reasonable expectation of privacy and therefore there would be no warrant required in an analogous criminal case. In that case, the tapping of the radio communication wouldn't count as "electronic surveillance." I don't think we know the details of how the communucations were obtained, so I think it's fair to say that the surveillance probably violated the basic proibition but it at least arguably depends on some of the technical details we don't know.

  Now, on to the exceptions. 50 U.S.C. 1802(a)(1) provides in relevant part:
Notwithstanding any other law, the President, through the Attorney General, may authorize electronic surveillance without a court order under this subchapter to acquire foreign intelligence information for periods of up to one year if the Attorney General certifies in writing under oath that--

(A) the electronic surveillance is solely directed at--
(i) the acquisition of the contents of communications transmitted by means of communications used exclusively between or among foreign powers, as defined in section 1801(a)(1), (2), or (3) of this title; or
(ii) the acquisition of technical intelligence, other than the spoken communications of individuals, from property or premises under the open and exclusive control of a foreign power, as defined in section 1801(a)(1), (2), or (3) of this title; [and]

(B) there is no substantial likelihood that the surveillance will acquire the contents of any communication to which a United States person is a party.
  Does this exception permit the monitoring? Note that (i) and (ii) are both dealing with "foreign power, as defined in (a)(1), (2), or (3) of this title." FISA's definition of "foreign power" appears in 50 U.S.C. 1801:
(1) a foreign government or any component thereof, whether or not recognized by the United States;
(2) a faction of a foreign nation or nations, not substantially composed of United States persons;
(3) an entity that is openly acknowledged by a foreign government or governments to be directed and controlled by such foreign government or governments;
(4) a group engaged in international terrorism or activities in preparation therefor;
(5) a foreign-based political organization, not substantially composed of United States persons; or
(6) an entity that is directed and controlled by a foreign government or governments.
  So as I read the statutes, Congress was trying to give an exception for monitoring foreign governments (a1, a2, a3) but not terrorist groups (a4, a5, a6), so long as no citizens or lawful permanent resident aliens were being monitored. There are interesting questions of how that might have applied to Al Qaeda in Afghanistan, but I don't think we need to reach them. It's my understanding that the program monitored both citizens and non-citizens, so I don't see how the exception is applicable.

  (Aside: Remember back in 2003 when a copy of the Administration's "Domestic Security Enhancement Act" — sometimes dubbed "Patriot II" — was leaked to the press? Section 501 of that Act would have made "providing material support" to a terrorist group an automatic ground for terminating citizenship. This is just a guess, but I wonder if the thinking was that this would make the NSA warrantless monitoring program legal under FISA. An individual who made regular contact with Al Qaeda could be giving them material support, and the individual would then no longer be a United States person and could then be legally subject to monitoring. Just speculation, but it might explain the thinking behind the legislative proposal. Anyway, back to our regularly scheduled programming.)

  Authorization to Use Military Force. The next question is whether the Authorization for Use of Military Force, Pub. L. No. 107-40, 115 Stat. 224, justified the monitoring. The authorizaton states in relevant part:
AUTHORIZATION FOR USE OF UNITED STATES ARMED FORCES.
(a) IN GENERAL.--That the President is authorized to use all necessary and appropriate force against those nations, organizations, or persons he determines planned, authorized, committed, or aided the terrorist attacks that occurred on September 11, 2001, or harbored such organizations or persons, in order to prevent any future acts of international terrorism against the United States by such nations, organizations or persons.
  I assume that the Administration's claim is that the AUMF counts as a "statute" that authorizes the surveillance: 50 U.S.C. 1809 states that "A person is guilty of an offense if he intentionally . . . engages in electronic surveillance under color of law except as authorized by statute," so if the AUMF authorized the electronic surveillance, then the NSA program didn't violate FISA.

  The Supreme Court considered the legal effect of the AUMF in Hamdi v. Rumsfeld. Yaser Hamdi was being held as an enemy combatant, and claimed that his detention violated 18 U.S.C. 4001. Section 4001(a) states that "[n]o citizen shall be imprisoned or otherwise detained by the United States except pursuant to an Act of Congress." Given Justice Thomas's very broad reading of the AUMF in his dissent, I think the key interpretation is that of Justice O'Connor's plurality opinion, joined by Chief Justice Rehnquist, Justice Kennedy, and Justice Breyer. Justice O'Connor concluded that the the AUMF was "an act of Congress" that authorized Hamdi's detention, such that the detention did not violate 4001(a):
  The AUMF authorizes the President to use "all necessary and appropriate force" against "nations, organizations, or persons" associated with the September 11, 2001, terrorist attacks. 115 Stat. 224. There can be no doubt that individuals who fought against the United States in Afghanistan as part of the Taliban, an organization known to have supported the al Qaeda terrorist network responsible for those attacks, are individuals Congress sought to target in passing the AUMF. We conclude that detention of individuals falling into the limited category we are considering, for the duration of the particular conflict in which they were captured, is so fundamental and accepted an incident to war as to be an exercise of the "necessary and appropriate force" Congress has authorized the President to use.
  The capture and detention of lawful combatants and the capture, detention, and trial of unlawful combatants, by "universal agreement and practice," are "important incident[s] of war." Ex parte Quirin, 317 U. S., at 28. The purpose of detention is to prevent captured individuals from returning to the field of battle and taking up arms once again. . . .
   . . .
  In light of these principles, it is of no moment that the AUMF does not use specific language of detention. Because detention to prevent a combatant's return to the battlefield is a fundamental incident of waging war, in permitting the use of "necessary and appropriate force," Congress has clearly and unmistakably authorized detention in the narrow circumstances considered here.
   . . .
  Hamdi contends that the AUMF does not authorize indefinite or perpetual detention. Certainly, we agree that indefinite detention for the purpose of interrogation is not authorized. Further, we understand Congress' grant of authority for the use of "necessary and appropriate force" to include the authority to detain for the duration of the relevant conflict, and our understanding is based on longstanding law-of-war principles.
  . . .
  The United States may detain, for the duration of these hostilities, individuals legitimately determined to be Taliban combatants who "engaged in an armed conflict against the United States." If the record establishes that United States troops are still involved in active combat in Afghanistan, those detentions are part of the exercise of "necessary and appropriate force," and therefore are authorized by the AUMF.
  So does the AUMF authorize the surveillance? As often happens when you're trying to draw guidance from an O'Connor opinion, it's not entirely clear. Under her opinion, the key question is whether the act is "so fundamental and accepted an incident to war" that it falls within the authorization. But that depends on the level of generality you chose to use to define "the act." Is "the act" spying on the enemy? In that case, perhaps it is a fundamental incident to war. Or is "the act" conducting U.S. domestic surveillance of U.S. citizens? In that case, the answer is no, it's not a fundamental incident to war.

  In the end, my best sense is that the AUMF doesn't extend to this. I have three reasons. First, O'Connor's opinion says the following about detention for interrogation: "Certainly, we agree that indefinite detention for the purpose of interrogation is not authorized." It seems to me that surveillance and wiretapping is pretty similar to interrogation: the point of both is getting information about your enemy. Second, it doesn't seem like wiretapping counts as a "use of force." If you read the text of the AUMF, it doesn't seem to me that it authorizes wiretapping. Finally, note that Congress passed the Patriot Act about a month after passing the AUMF; if Congress had intended the AUMF to give the president wide authority to conduct domestic surveillance against Al Qaeda, I don't think they would have spent so much time amending FISA for terrorism investigations. So at bottom, I think the AUMF probably didn't authorize this, although the Hamdi case gives some colorable (if ultimately unpersuasive) arguments that it might.

  Article II. The final argument is that Article II of the Constitution gives the President inherent authority to conduct such monitoring. The Administration introduced this theory in a supplemental brief filed in the FISA Court of Review:
  The President Has Inherent Authoritv to Conduct Warrantless Electronic Surveillance to Protect National Security from Foreign Threats.

  In considering the constitutionality of the amended FISA, it is important to understand that FISA is not required by the Constitution. Rather, the Constitution vests in the President inherent authority to conduct warrantless intelligence surveillance (electronic or otherwise) of foreign powers or their agents, and Congress cannot by statute extinguish that constitutional authority. Both before and after the enactment of FISA, courts have recognized the President's inherent authority to conduct foreign intelligence surveillance. See, e.g., Butenko, 494 F.2d at 608 (grounding exception to warrant requirement in the President's Commander-in-chief and foreign-affairs powers; noting that the country's self-defense needs weigh on the side of reasonableness); Truong, 629 F.2d at 914 (citing the President's foreign affairs power as justifying an exception to the warrant requirement); cf. United States v. United States District Court (Keith), 407 U.S. 297, 308 (1972)(reserving the question whether the President's foreign-affairs powers justify exception from warrant requirement).
  So the argument, as I understand it, is that Congress has no power to legislate in a way that inteferes with the President's Commander-in-Chief power, a judgment made, I suppose, by the President himself.

  I have been unable to find any caselaw in support of this argument. Further, the argument has no support from the cases cited in the government's brief. In all three of those cases — Butenko, Truong, and Keith - the Courts were talking about whether the President's interest in conducting foreign intelligence monitoring creates an exception to the Warrant Requirement of the Fourth Amendment. In other words, the issue in those case was whether the Constitution bars warrantless surveillance absent Congressional action, not whether Congressional prohibitons in this area cannot bind the Executive branch.

  Consider the citation to the Butenko case. Here is the relevant section, from 494 F.2d at 608:
  Both executive authority in the foreign affairs area and society's interest in privacy are of significance, and are equally worthy of judicial concern.
  . . .
  The importance of the President's responsibilities in the foreign affairs field requires the judicial branch to act with the utmost care when asked to place limitations on the President's powers in that area. As Commander-in-Chief, the President must guard the country from foreign aggression, sabotage, and espionage. Obligated to conduct this nation's foreign affairs, he must be aware of the posture of foreign nations toward the United States, the intelligence activities of foreign countries aimed at uncovering American secrets, and the policy positions of foreign states on a broad range of international issues.
  To be sure, in the course of such wiretapping conversations of alien officials and agents, and perhaps of American citizens, will be overheard and to that extent, their privacy infringed. But the Fourth Amendment proscribes only 'unreasonable' searches and seizures. And balanced against this country's self-defense needs, we cannot say that the district court erred in concluding that the electronic surveillance here did not trench upon Ivanov's Fourth Amendment rights.
  As I read this analysis, it is entirely focused on the Fourth Amendment, and specifically whether the President's Commander in Chief power should trigger a relaxed Fourth Amendment standard. That seems quite different from a claim that Article II makes Congressional regulation inoperative. The same goes for the citation to Truong, 629 F.2d at 914. In the course of discussing whether the Courts should require a warant for foreig intelligence surveillance, the court tried to balance the ability of courts to regulate intelligence surveillance with the strong governmentg interest:
  Perhaps most crucially, the executive branch not only has superior expertise in the area of foreign intelligence, it is also constitutionally designated as the pre-eminent authority in foreign affairs. The President and his deputies are charged by the constitution with the conduct of the foreign policy of the United States in times of war and peace. Just as the separation of powers in Keith forced the executive to recognize a judicial role when the President conducts domestic security surveillance, so the separation of powers requires us to acknowledge the principal responsibility of the President for foreign affairs and concomitantly for foreign intelligence surveillance.
In sum, because of the need of the executive branch for flexibility, its practical experience, and its constitutional competence, the courts should not require the executive to secure a warrant each time it conducts foreign intelligence surveillance.
  While the Court was recognizing the President's constitutional role, it was in a very specific context: balancing reasonableness in the context of Fourth Amendment law to determine whether the surveillance required a warrant. Again, this doesn't seem to go to whether Congress can impose binding statutory prohibitions beyond the Fourth Amendment.

  Conclusion. Anyway, that's my tentative take; I hope it's helpful. It's entirely possible that I goofed the analysis somewhere along the way; FISA, the AUMF, and Article II aren't my area of expertise, so we should consider this post a work in progress. I look forward to comments — civil and respectful, please.

  UPDATE: A lawyer I know who works in this area e-mails in additional thoughts:
  Of course you're right that Keith and Katz reserved the question whether the President may engage in warrantless surveillance of foreign-based threats to the national security. While the Supreme Court has never addressed the issue, a number of federal appellate courts, some of which you cite at the end of your post, answered that question in the affirmative in the years immediately after Keith. See, e.g., United States v. Brown, 484 F.2d 418 (5th Cir. 1973); United States v. Butenko, 494 F.2d 593 (3d Cir. 1974) (en banc); United States v. Buck, 548 F.2d 871 (9th Cir. 1977); United States v. Truong, 629 F.2d 908 (4th Cir. 1980). But see Zweibon v. Mitchell, 516 F.2d 594 (D.C. Cir. 1975).
  The interesting question is whether FISA somehow extinguishes this inherent Presidential power to conduct foreign-intelligence surveillance. There's a respectable argument that it does. FISA repealed Title III's reservation clause (18 USC 2511(3)), in which Congress expressly had forsworn any intent to regulate the collection of foreign intelligence. Given that repeal, we might be in Category Three from Justice Jackson's Steel Seizure concurrence — "When the President takes measures incompatible with the expressed or implied will of Congress, his power is at its lowest ebb, for then he can rely only upon his own constitutional powers minus any constitutional powers of Congress over the matter. Courts can sustain exclusive Presidential control in such a case only by disabling the Congress from acting upon the subject."
  If you're in the mood for more, check out posts on this from Marty Lederman and Daniel Solove.