Yes, the U.S. government spies on us, and it does so under laws that most people have never read. Federal statutes authorize intelligence agencies to intercept phone calls, emails, and internet traffic; local police run their own tools that log your license plate, your face, and your public posts; and Americans routinely get pulled into surveillance databases even when they were never the target. In 2025, 63% of the articles in the President’s Daily Brief contained information gathered under a single program — Section 702 of the Foreign Intelligence Surveillance Act.1Privacy and Civil Liberties Oversight Board. 2026 FISA Section 702 Report Whether or not anyone is reading your email right now, the infrastructure to do it exists and runs around the clock.
The Laws That Authorize It
Government monitoring runs on three main legal pillars, each covering a different piece of what agencies can do.
The Foreign Intelligence Surveillance Act, passed in 1978 and codified at Title 50 of the U.S. Code, is the primary statute for electronic monitoring tied to national security.2Office of the Law Revision Counsel. 50 USC Chapter 36 – Foreign Intelligence Surveillance FISA created a secret court where government lawyers apply to monitor people suspected of acting on behalf of foreign powers. Judges review those applications with no opposing counsel and no public record. If the court approves, agencies can wiretap phones, search locations, and collect electronic communications tied to the target.
After September 11, 2001, Congress passed the USA PATRIOT Act to widen that reach.3Congress.gov. Public Law 107-56 – USA PATRIOT Act It authorized roving wiretaps that follow a target across devices without a separate court order for each one, and it expanded the government’s power to compel production of “any tangible things” relevant to a terrorism or espionage investigation.4Congress.gov. Origins and Impact of the Foreign Intelligence Surveillance Act Congress later passed the USA FREEDOM Act, which banned bulk collection of phone records and required agencies to use a specific identifier rather than sweeping up everything from a provider or zip code.
Much of what the NSA does overseas runs not on any statute but on Executive Order 12333, a Reagan-era directive that names the NSA as the government’s lead signals intelligence agency and gives it broad authority to collect foreign communications.5National Archives. Executive Order 12333 – United States Intelligence Activities Because this collection happens outside the United States, it faces fewer constraints than domestic programs. A 2022 executive order added limits, restricting bulk collection to specific objectives like counterterrorism, cybersecurity, and preventing weapons proliferation.
How Your Communications Get Collected
Under Section 702 of FISA, the NSA uses two main pipelines to pull in digital communications at scale.
The first is called upstream collection. The agency taps directly into the fiber optic cables and switching hubs that carry internet traffic, scanning what flows through for communications that match specific selectors like a targeted email address or phone number.6National Security Agency. NSA Stops Certain Section 702 Upstream Activities This captures both content and metadata. For years the NSA also collected messages that merely mentioned a selector in their body, even when neither sender nor recipient was a target. That practice, known as “about” collection, was halted in 2017 and formally banned by the 2024 reauthorization of Section 702.7Congress.gov. HR 7888 – Reforming Intelligence and Securing America Act
The second pipeline is generally called PRISM. Rather than grabbing data in transit, the government sends selectors to internet service providers through the FBI, and those companies are legally compelled to turn over matching communications — emails, stored documents, photos, video, chat logs.8Office of the Director of National Intelligence. NSA Implementation of Foreign Intelligence Surveillance Act Section 702 The providers involved include most of the major platforms Americans use every day. Because those companies hold years of stored data, PRISM gives agencies access to historical communications, not just live traffic.
How Americans Get Pulled In
Section 702 is supposed to be aimed at non-U.S. persons located outside the country. The statute explicitly prohibits targeting anyone known to be inside the United States or intentionally targeting American citizens abroad.9Office of the Law Revision Counsel. 50 USC 1881a – Procedures for Targeting Certain Persons Outside the United States Other Than United States Persons But if you email, call, or message someone overseas who happens to be a target, your side of the conversation gets swept up too. The government doesn’t need a warrant to keep it.
This is called incidental collection, and it happens constantly. Once your communication sits in a Section 702 database, FBI agents can search that database using your name, email, or phone number in what is commonly called a backdoor search. No traditional warrant is required. The 2024 reauthorization added guardrails: FBI personnel now need supervisor or attorney approval before running a search using an American’s identifier, they must document a specific factual basis, and searches designed solely to dig up evidence of a crime are prohibited with limited exceptions. Congress declined to require a full warrant. A federal district court ruled in February 2025 that the Fourth Amendment requires one.10Congress.gov. FISA Section 702 and the 2024 Reforming Intelligence and Securing America Act
What the Fourth Amendment Protects
The Fourth Amendment protects you from unreasonable searches and requires the government to get a warrant based on probable cause before searching your private communications in a criminal investigation. These protections apply to anyone inside the United States. Two Supreme Court decisions define most of what that means in practice.
In Carpenter v. United States, decided in 2018, the Court held that people have a reasonable expectation of privacy in the record of their physical movements captured by cell towers.11Supreme Court of the United States. Carpenter v United States The FBI had obtained 127 days of a suspect’s location history from his wireless carrier without a warrant. The Court said that wasn’t acceptable, calling historical cell-site records “near perfect surveillance” that lets the government reconstruct your movements backward in time. After Carpenter, law enforcement needs a warrant for long-term location data from phone companies.
Carpenter carved out a narrow exception to a much older rule called the third-party doctrine. In Smith v. Maryland, the Supreme Court held that you have no reasonable expectation of privacy in information you voluntarily hand over to a third party — the logic being that once you share something with a company, you assume the risk it could be disclosed to the government.12Justia Law. Smith v Maryland, 442 US 735 (1979) That doctrine still governs most of what investigators can get without a warrant: your bank records, the phone numbers you dial, the subscriber information tied to your accounts. Carpenter treated location data as different because of how revealing it is. For other records held by companies, the old rule still applies, and the government can obtain them with a subpoena or court order that falls well short of a warrant.
Surveillance By Your Local Police
Federal intelligence programs get the headlines, but the surveillance closest to your daily life is probably run by your local police department. These tools operate in ordinary criminal investigations, sometimes with no investigation at all.
Cell-site simulators, commonly called Stingrays, are portable devices that impersonate cell towers. Every phone in range connects to the fake tower and reveals its unique identifier and precise location. The Department of Justice issued a 2015 policy requiring federal agents and state or local officers working with them to obtain a search warrant before deploying one, except in emergencies.13Department of Justice. Use of Cell-Site Simulator Technology State and local departments operating independently may face different rules.
Automated license plate readers are cameras mounted on cruisers or fixed structures that photograph every plate that passes, logging the plate number, location, date, and time. Many agencies retain that data for months or years; some keep it indefinitely. The accumulated records let police reconstruct where a vehicle has been, when, and how often, without ever tailing it. No warrant is typically required because license plates are visible in public.
Public camera networks feed into centralized monitoring hubs where software can scan faces against databases of mugshots, driver’s license photos, and other records. By the end of 2024, at least fifteen states had enacted some form of restriction on police use of facial recognition, ranging from outright bans to requirements for judicial approval. Body-worn cameras add another layer of recorded footage from everyday interactions.
Police also use specialized software to monitor public social media posts in real time. These tools track individuals across platforms, flag keywords tied to geographic areas, and use pattern-recognition algorithms to identify connections between users. Courts have generally held that publicly posted content carries no reasonable expectation of privacy, so law enforcement can read it without a warrant. When police want private messages or account data that isn’t publicly visible, they typically need a warrant or court order served on the platform.
Data collected by one agency rarely stays in one place. Fusion centers, joint operations where local, state, and federal agencies share intelligence, provide authorized personnel access to databases maintained by different agencies.14Office of Justice Programs. Fusion Center Guidelines Executive Summary A license plate scan by a local officer, a social media flag from a state fusion center, and a metadata record from a federal program can all end up feeding the same investigation.
What You Can Do
You can’t opt out of federal surveillance authority, but you can find out what agencies have on you and reduce what they collect going forward.
The Freedom of Information Act gives anyone, citizen or not, the right to request records from federal agencies.15FOIA.gov. Freedom of Information Act Frequently Asked Questions You can submit a request to the FBI, NSA, or DHS asking for records about yourself. The request must be in writing and describe what you want; there’s no special form and no upfront fee, and the first two hours of search time and first 100 pages are usually free. Be realistic about what comes back. Agencies can redact anything covered by exemptions for national security, law enforcement, or personal privacy, and processing often takes months.
No federal law currently requires technology companies to build backdoor access into encrypted products. Telecommunications carriers aren’t required to decrypt communications they don’t already have the ability to decrypt, and internet services like messaging apps fall outside the wiretap-assistance mandates that apply to traditional phone companies.16Congress.gov. Law Enforcement and Technology – The Lawful Access Debate End-to-end encrypted messaging means only you and the person you’re talking to can read the content: not the platform, not the government. Using encrypted messaging apps, enabling full-disk encryption on your devices, and choosing email providers that support encryption all limit what even a lawful intercept can capture. Encryption doesn’t hide metadata, but it makes the content of your communications far harder to reach.
Most surveillance, federal and local, feeds on data you generate voluntarily. Reviewing your privacy settings on social media, using a VPN to obscure browsing from your internet provider, turning off location services when you don’t need them, and being selective about which apps get your contacts and microphone all shrink the pool of information available to anyone monitoring you. None of these steps make you invisible. They raise the cost of collecting your data, which is often enough to keep you out of the dragnet that catches everything by default.