This report is the first time that the US intelligence community has disclosed even an approximate number of FBI searches of US data using the Foreign Intelligence Surveillance Act of 1978. The law focuses on threats from outside the United States, but also allows the FBI and the CIA Central and others search data for Americans’ information on the condition that there is a properly confirmed foreign intelligence purpose.
The report does not indicate that the FBI acted inappropriately. The report highlights the vast amount of intelligence that the bureau can use to pursue infiltrators, spies and terrorists.
More than half of the FBI’s inquiries were related to attempts to hack into critical US infrastructure by foreign cyber actors in early 2021, according to the report. That includes about 1.9 million inquiries related to a specific cyber threat from Russia against critical infrastructure of the United States, according to the FBI.
It is unclear what Russian hacking efforts the FBI was referring to. The office declined to comment.
While the hacking campaign that exploited SolarWinds and other software vendors appeared to be targeting US government agencies, the malicious code used by the attackers was downloaded by thousands of companies, including hundreds of electrical utilities.
The Biden administration blamed Russia’s foreign intelligence service, SVR, for the so-called SolarWinds campaign, which was discovered in December 2020 — a claim the Kremlin has denied. US officials believe that in January Russian authorities detained the person responsible for the pipeline breach, but it is unclear whether the Russians will pursue the prosecution of this individual.
The number of FBI inquiries detailed in the report from the Office of the Director of National Intelligence is not the same as the number of individuals whose data has been examined. Administrators can search an individual’s email address, name, and any other identifier, sometimes multiple times – all of which count as unique queries.
It’s also possible that the number of inquiries about Americans’ data was much lower than the 3.4 million disclosed in the report. According to the report, the FBI sometimes conducts large queries from hundreds or even thousands of terms, and if one term is associated with an American person, each term in the combined search counts as a search for an American person.