In April, the government’s surveillance powers under Section 702 of FISA will expire. Since 2015, Congress’s efforts to rein in the surveillance state have largely focused on the NSA’s “FISA 702 database”, and in particular on two things:
(a) Closing the backdoor search loophole: Limiting, and requiring a warrant for, queries by other agencies of the 702 database for the communications of US persons; and
(b) Closing the data broker loophole: Requiring a warrant for agencies’ acquisition of commercially available information (CAI) on US persons from data brokers, where an agency acquiring that data on US persons directly would require a warrant.
News over the last few days (February 27, 2026 – March 2, 2026) suggests that the government either strongly plans to apply, or already is applying, AI tools that make the question of whether an agent gets a warrant for an individual query, look outdated.
According to reporting in the New York Times and elsewhere, the newly rebranded Department of War had been in talks with AI firm Anthropic, about the terms under which DoW would deepen its deployment of Anthropic’s LLM tool “Claude.” The two topics of disagreement between DoW and Anthropic were whether Claude could be
“used for the mass surveillance of Americans or deployed in autonomous weapons with no humans involved. […] the Pentagon wanted the company to allow for the collection and analysis of unclassified, commercial bulk data on Americans, such as geolocation and web browsing data […] Anthropic told the Pentagon that it was willing to let its technology be used by the National Security Agency for classified material collected under the Foreign Intelligence Surveillance Act.”
Maybe Anthropic’s people don’t understand that FISA is in fact used for surveillance on Americans. NSA’s “classified material collected under FISA” surely includes the 702 database, which in turn includes the communications of millions of Americans — specifically, those Americans who are the contacts of around 300,000 foreigners whom NSA deems to have information of foreign intelligence interest to the United States. It’s because FISA surveillance damages the privacy of so many Americans, that a bipartisan coalition has long proposed closing the loopholes above.
On Friday, the government declared that it would no longer contract with Anthropic, and would use OpenAI instead; OpenAI’s Sam Altman promptly declared that their agreement with the government was based on principles including “prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems.”
Focusing for the moment on the “mass surveillance” (Anthropic) / “domestic mass surveillance” (OpenAI) language here, our first observation is that to NSA and the Pentagon, what they do now is definitionally not “mass surveillance”, even if it implicates the privacy of millions of people; and it’s not “domestic mass surveillance” if the seeds, or targets, of the surveillance program, are non-US persons, even if the number of Americans whose communications are “incidentally” and warrantlessly collected and queried runs into the millions.
Focusing only on the 702 database, it’s plain that both Anthropic and OpenAI agreed in principle to a contract where their AI tools would ingest the database whole, and then spit out outputs according to the prompts created by agents, whether at NSA, DoW or other agencies. In other words, the contract would create (and possibly already has created) a new way of searching the 702 database, that would not explicitly trigger even any of the half-assed reporting requirements and purpose restrictions that exist today, and that certainly would not have been bound by any warrant requirement in legislation before this or previous Congresses.
An agent, in other words, gets to choose. Either they use the current system, where they “query” a “selector” of a US person, and log both the query and a justification for that query, for future auditing by the FISC; or they type a prompt that won’t need to be logged or justified into DoW-ChatGPT. How about this one?
Hey ChatGPT, produce a hyperlinked list of all communications meeting the definition of “classified material collected under the Foreign Intelligence Surveillance Act” that have a probability of above 50% (but why not 1%?) of containing evidence relating to terrorism (Use any of the definitions of international terrorism or domestic terrorism in any U. S. statute or executive order.)
Congratulations! You’ve just allowed DoW-ChatGPT to surface — or hallucinate entirely — “terrorist plots” based on communications involving “radical traditionalist Catholics”, parents protesting against critical race theory being taught in schools, protests of conservatives who believed the 2020 elections were stolen, Black Lives Matter protesters, Gaza protesters, and now “antifa-aligned domestic terrorism”, further defined so as to include, among other things, members of Congress exercising oversight over ICE facilities. These are just some of the ways the 702 database has already been abused to surveil Americans within the past five years.
Will DoW-ChatGPT’s output for this query constitute probable cause for an FBI investigation? Shouldn’t probable cause of a US person’s involvement in a crime be necessary first, before DoW-ChatGPT ingests their communications in the first place? If somebody “antifa-aligned” is prosecuted, will their attorney be able to challenge DoW-ChatGPT’s inferences in court? What if DoW-ChatGPT does make a mistake, and innocent Americans get shot while being arrested for an entirely hallucinated crime? Will anyone at DoW, or anywhere in the intelligence community, be personally liable for damages?
Or are we going to just dump this awesome new power in the government’s hands, and hope it all works out for the best?
Lawmakers must take note. Given this news, reformers can’t trust that the currently understood means whereby other agencies query NSA’s databases, is the only one, or even the preferred one. And reform proposals, from this moment on, must include appropriate language, making clear that each ingestion of a US person’s communications by an LLM deployed under contract with the US government, is a query for the purposes of reporting and of warrants, and is a separate event for Fourth Amendment purposes.