The U.S. government watches ordinary people through a wide mix of methods: tapping the fiber-optic cables that carry internet traffic, compelling tech companies to hand over stored emails and files, logging phone calls and cellphone locations, running facial recognition against driver’s license photos, reading license plates on every road, buying commercial location data from apps, monitoring bank transactions, and searching phones and laptops at the border. Understanding how the government spies on us means looking at both the technical methods and the legal authorities behind them, because those authorities range from statutes passed after September 11 to executive orders older than the modern internet, and courts have only started drawing the constitutional lines.
Internet Traffic and Stored Communications
Two broad approaches dominate digital surveillance. Upstream collection taps directly into the fiber-optic cables that carry the bulk of global internet traffic. Because roughly 80 percent of the world’s internet traffic passes through infrastructure on U.S. soil, agencies scanning that data for specific identifiers — email addresses, phone numbers, keywords tied to foreign intelligence targets — get an enormous window into global communications.
Downstream collection works the other way around. Instead of grabbing data in transit, the government compels technology companies to hand over what they already store. The best-known downstream program, PRISM, lets intelligence agencies obtain emails, chat logs, cloud-stored files, and social media data directly from companies like Google, Apple, Microsoft, and Meta.1Electronic Privacy Information Center. EPIC v. DOJ – PRISM
Both programs run on Section 702 of the Foreign Intelligence Surveillance Act, codified at 50 U.S.C. § 1881a. Section 702 authorizes the government to target people reasonably believed to be outside the United States to collect foreign intelligence.2Office of the Law Revision Counsel. 50 U.S. Code 1881a – Procedures for Targeting Certain Persons Outside the United States Other Than United States Persons The law prohibits intentionally targeting anyone known to be inside the country. But communications between a foreign target and an American get scooped up as a matter of course. This “incidental collection” leaves a substantial volume of Americans’ emails and messages sitting in searchable databases, even though those Americans were never the target.
The collected data falls into two categories. Metadata is the envelope information: who contacted whom, when, from which IP address, and for how long. Content is the message itself. Metadata sounds less invasive, but a detailed map of your contacts, timing patterns, and locations can reveal as much about your life as reading your messages would.
Phone Records and Location Tracking
Call detail records document every number you dial, every call you receive, the time each call started, and how long it lasted. They expose the shape of your social and professional life without capturing a single word of dialogue. Phone companies produce these records in response to court orders and government directives.
Location tracking runs on two tracks. Cell-site simulators — often called by the brand name Stingray — mimic a legitimate cell tower. When your phone connects to one instead of your carrier’s actual tower, the device captures your phone’s unique identifier and pinpoints your location. These simulators are deployed from vehicles, often in crowded areas or at public gatherings, to locate specific individuals or map everyone present.
Even without a simulator, your phone constantly generates location data. Every time it connects to a real cell tower, your carrier logs which tower handled the connection and when. This cell-site location information builds a rolling record of your movements. Investigators can request the logs to reconstruct weeks or months of travel, showing where you slept, where you worked, and which neighborhoods you visited. Your phone does not need to be actively in use for this tracking to happen; it occurs through the basic signal handshake your phone performs to stay connected.
In 2018, the Supreme Court imposed a significant check on this kind of tracking. In Carpenter v. United States, the Court held that the government’s acquisition of historical cell-site location records is a search under the Fourth Amendment and requires a warrant supported by probable cause.3Supreme Court of the United States. Carpenter v. United States Before Carpenter, investigators could get these records with a court order based on a much lower standard. The decision left room for emergency exceptions when lives are at risk, but it closed the door on casual, warrantless access to historical location data.
Cameras, License Plates, Aerial Surveillance, and DNA
Surveillance extends well beyond screens and signals. Facial recognition technology is layered onto existing camera networks in airports, transit stations, and public spaces. The FBI’s Next Generation Identification system holds a repository of criminal mug shot photos that law enforcement can search by submitting a probe photo and getting back a ranked list of potential matches as investigative leads.4Federal Bureau of Investigation. Next Generation Identification (NGI) State driver’s license databases and booking photos feed these systems, so you can be identified from a surveillance camera image without ever having been charged with a crime.
Automated license plate readers capture a different kind of movement data. High-speed cameras mounted on police vehicles, highway overpasses, and traffic signals photograph every plate that passes. Each capture logs the plate number, a timestamp, and GPS coordinates. Over weeks and months, the accumulated records map out daily routines: where you park at night, which routes you drive to work, how often you visit a particular address. Retention periods vary by jurisdiction, but in many places the records stay accessible for years even if you are never connected to any investigation.
Aerial surveillance operates at a wider scale. Persistent surveillance systems first developed for military use overseas have been tested in American cities. One program in Baltimore put cameras on a Cessna aircraft that circled over a 30-square-mile area for up to 10 hours at a time, continuously photographing the ground below. That kind of system lets investigators retroactively track any vehicle or pedestrian in the coverage zone by rewinding the footage. Drones offer similar capabilities at lower cost, and federal and local agency use of them keeps expanding.
The government also maintains CODIS, the national DNA database run by the FBI. It holds DNA profiles from convicted offenders, arrestees in states that authorize collection at arrest, and crime scene evidence. CODIS does not store names alongside the profiles; it stores numerical values at standardized genetic markers. When a crime scene sample matches a profile, the system notifies the relevant law enforcement agencies, who then coordinate to confirm the match and potentially seek a court order for a new biological sample.5Federal Bureau of Investigation. CODIS and NDIS Fact Sheet
Smart Devices in Your Home
Internet-connected devices in your home open another avenue. Doorbell cameras, voice assistants, smart thermostats, and fitness trackers all generate data that law enforcement can pursue. The legal process usually depends on what kind of information is sought: a subpoena may suffice for basic account details, while a search warrant is generally required for content like video recordings or voice commands.
Amazon’s Ring doorbell cameras show how this works in practice. Ring’s published policy says the company will not hand over video recordings without a valid search warrant, but it reserves the right to respond immediately and without owner notification when law enforcement asserts an emergency involving imminent danger of death or serious physical injury.6Ring Help. Learn About Ring Law Enforcement Guidelines Ring can only access footage if the user has an active subscription that was in place when the recording was made. In non-emergency situations, Ring says it notifies account holders before disclosing information unless prohibited from doing so.
The pattern is the same across the smart-device market. Manufacturers’ privacy policies promise to protect user data and simultaneously acknowledge that the company will comply with valid legal demands. Voice assistant recordings, smart TV viewing habits, and fitness tracker location logs have all been sought by investigators. The more connected devices you own, the more data points exist for the government to request.
Buying Data Instead of Getting a Warrant
One of the most contested methods involves no court order at all. Federal agencies, including the FBI, the Department of Homeland Security, and the IRS, purchase personal data from commercial data brokers. These companies aggregate information from thousands of smartphone apps, collecting precise GPS location histories, browsing habits, purchase records, and demographic profiles. The data is detailed enough to show where someone lives, works, worships, and socializes.
The appeal for agencies is obvious. Buying data on the open market sidesteps the warrant requirements that would apply if the government demanded the same information directly from your phone carrier or app provider. After Carpenter established that accessing historical cell-site location data requires a warrant, civil liberties groups argued that purchasing equivalent or more detailed location data from brokers amounts to the same constitutional intrusion through a commercial back door. No court has squarely ruled on whether Carpenter‘s warrant requirement extends to government purchases of commercially available location data, leaving the practice in a legal gray zone.
The IRS has used purchased cellphone location data in criminal investigations, subscribing to a commercial database that tracks the locations of millions of phones. The Treasury Department’s own inspector general flagged that practice as potentially unconstitutional. Agencies can spend millions of dollars a year on these contracts, and because the transactions are commercial purchases rather than legal process, there is often no public record of whose data was acquired or how it was used.
Financial Transaction Reporting
Your bank is required by federal law to report certain transactions directly to the government. Under the Bank Secrecy Act, any cash transaction exceeding $10,000 in a single day triggers a mandatory Currency Transaction Report filed with the Financial Crimes Enforcement Network (FinCEN). That includes deposits, withdrawals, currency exchanges, and multiple transactions that add up to more than $10,000 in a day.7U.S. Government Accountability Office. GAO-25-106500 – Currency Transaction Reports Your bank files the report automatically. You are not notified, and your permission is not required.
Banks also must file Suspicious Activity Reports when a transaction of $5,000 or more looks like it could involve money laundering, tax evasion, or other illegal activity.8eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions For certain money services businesses, the SAR threshold drops to $2,000. “Suspicious” is defined broadly. It covers transactions that appear designed to avoid the $10,000 reporting threshold — a practice called structuring — as well as transactions with no apparent lawful purpose or patterns that don’t match a customer’s normal behavior. Deliberately breaking up deposits to stay under $10,000 is itself a federal crime, even if the underlying money is perfectly legal.
These reports feed a large database that law enforcement and intelligence agencies query during investigations. FinCEN processes millions of reports each year, and the data can surface connections between individuals, businesses, and financial flows that would otherwise stay invisible.
Device Searches at the Border
When you cross the U.S. border or pass through an international airport, federal agents have broad authority to search your belongings, including your phone, laptop, and other electronic devices. The authority comes from 19 U.S.C. § 482, which permits officers to search any person, vehicle, or container arriving in or departing from the United States.9Office of the Law Revision Counsel. 19 U.S.C. 482 – Search of Vehicles and Persons No warrant is required.
CBP policy draws a line between two kinds of device search. A basic search is an officer manually scrolling through your phone’s contents — photos, messages, apps, call logs. An advanced search, where agents connect external equipment to copy or analyze the device’s contents, requires reasonable suspicion of a law violation or a national security concern, plus approval from a senior manager.10U.S. Customs and Border Protection. Border Search of Electronic Devices at Ports of Entry In both cases, agents are limited to data stored on the device itself. They are not supposed to use your phone to reach cloud-stored information, and CBP policy requires officers to disable network connections before beginning a search.
U.S. citizens cannot be denied entry for refusing to unlock a device, though the device itself can be detained. Foreign nationals face a harder choice: refusing to present a device for inspection can result in denied entry. These searches happen without notice, and the volume of border device inspections has risen steadily in recent years.
The Legal Authorities
The government’s surveillance capabilities rest on a patchwork of statutes, court orders, and executive directives. Knowing the scaffolding helps clarify what is authorized, what has changed, and where the boundaries are still disputed.
FISA and the FISA Court
Congress passed the Foreign Intelligence Surveillance Act in 1978 to create a legal framework for intelligence gathering aimed at foreign threats. FISA established the Foreign Intelligence Surveillance Court, a specialized federal court in Washington, D.C., that reviews government applications to conduct surveillance, mainly when those activities are conducted in the United States or directed at U.S. persons.11Foreign Intelligence Surveillance Court. About the Foreign Intelligence Surveillance Court The proceedings are closed and classified. The government is the only party that appears before the court, and the targets of surveillance are never told a judge reviewed their case.
Section 702 of FISA, the authority behind both upstream and downstream collection, was most recently reauthorized by Congress in April 2024 under the Reforming Intelligence and Securing America Act. That reauthorization extended Section 702 for two years and imposed new restrictions: FBI personnel must obtain supervisory approval before querying the collected data for information about Americans, queries designed solely to find evidence of criminal activity are prohibited (with narrow exceptions), and all U.S. person queries must be audited.12Congress.gov. H.R. 7888 – Reforming Intelligence and Securing America Act The reauthorization also permanently banned “abouts” collection, the practice of intentionally collecting communications that merely reference a surveillance target rather than being sent to or from that target.
Section 215 and the End of Bulk Phone Metadata Collection
Section 215 of the USA PATRIOT Act was the authority the government used to justify the bulk collection of telephone metadata that Edward Snowden revealed in 2013. Under that program, the NSA collected call detail records on millions of Americans with no individualized suspicion. Congress partially reformed it in 2015 with the USA FREEDOM Act, which required the government to use more targeted search terms instead of vacuuming up all records. Section 215 itself expired on March 15, 2020, and Congress has not renewed it. The expiration eliminated one of the government’s most controversial bulk collection tools, though other authorities — particularly Section 702 and Executive Order 12333 — continue to provide broad surveillance powers.
Executive Order 12333
Executive Order 12333, first signed by President Reagan in 1981 and amended several times since, governs how intelligence agencies collect and handle information outside of the FISA framework. It is the primary authority for intelligence activities conducted overseas, where FISA’s court-order requirements do not apply. The order directs agencies to use “the least intrusive collection techniques feasible” when collecting information inside the United States or targeting U.S. persons abroad, and it requires Attorney General-approved procedures for techniques like electronic surveillance and physical searches.13National Archives. Executive Order 12333 – United States Intelligence Activities In practice, EO 12333 governs a vast amount of signals intelligence collection that takes place on foreign soil but inevitably captures communications involving Americans.
National Security Letters
National Security Letters let the FBI demand subscriber information, call records, and financial data from companies without first going to a court. Authorized under 18 U.S.C. § 2709, an NSL can compel a phone company or internet provider to turn over a customer’s account details and transaction records as long as the information is relevant to a counterintelligence or counterterrorism investigation.14Office of the Law Revision Counsel. 18 U.S. Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records The FBI issues thousands of these letters each year.
NSLs often come with a nondisclosure requirement, a gag order that prohibits the recipient company from telling anyone, including the customer whose data was requested, that the demand was made. The gag order is not automatic; the FBI must certify that disclosure could endanger national security, interfere with an investigation, threaten diplomatic relations, or put someone’s life at risk. Violating a gag order can result in up to five years in prison under 18 U.S.C. § 1510.15Office of the Law Revision Counsel. 18 U.S. Code 1510 – Obstruction of Criminal Investigations
NSLs are not entirely unchecked. The statute explicitly provides for judicial review, and the recipient can challenge both the data demand and the gag order in federal court.14Office of the Law Revision Counsel. 18 U.S. Code 2709 – Counterintelligence Access to Telephone Toll and Transactional Records In practice, most companies comply without litigating, but the legal avenue exists.
What Courts Have Said and What You Can Do
The Fourth Amendment protects against unreasonable searches and seizures, but its application to modern surveillance has been uneven. For decades, the “third-party doctrine” held that information you voluntarily share with a company — phone numbers you dial, bank records you generate — loses its Fourth Amendment protection because you already exposed it to someone else. Carpenter carved a major exception into that doctrine by holding that detailed location records are too revealing to access without a warrant, even though a phone company technically possesses them.3Supreme Court of the United States. Carpenter v. United States
The decision left several questions open. The Court expressly said it was not addressing real-time location tracking, tower dumps (where the government obtains records of every phone connected to a particular tower), or conventional security camera footage. The biggest unresolved issue — whether the government can simply buy the same kind of location data from a data broker instead of demanding it from a carrier — has not yet been decided by any court. Legal scholars have argued that buying data to route around Carpenter undermines the ruling’s logic, but until a court agrees, the practice continues.
The FISA Court operates almost entirely in secret, and for most of its history its proceedings were purely one-sided, with only the government appearing. Reforms after the Snowden disclosures introduced a panel of independent lawyers who can be asked to weigh in on novel legal questions, but their participation is not mandatory and the court’s opinions are rarely declassified in full. For surveillance conducted under Executive Order 12333, there is even less judicial involvement; the executive branch largely oversees itself, with compliance reviewed by agency inspectors general and congressional intelligence committees rather than independent courts.
If you believe you have been subjected to unlawful surveillance, your practical options are limited. You can file a Freedom of Information Act request with the relevant agency, though FOIA responses are slow and agencies routinely invoke national security exemptions to withhold records. For surveillance conducted under certain executive authorities, a redress mechanism established by Executive Order 14086 in 2022 lets individuals lodge complaints that are reviewed by the Office of the Director of National Intelligence’s Civil Liberties Protection Officer, though that process was designed primarily for EU citizens and its practical value for Americans remains unclear. The deepest structural problem is this: the programs that affect the most people are the ones that are hardest to challenge, because the people whose data was collected rarely find out it happened.