The phrasing "without legal authorization" is the superhighway-sized qualifier which lets anything through, here. Of course they consider everything they do to be 'legally authorized', under their own strained interpretations that are hidden from others' review and challenge, and which include things like provisional authorizations that don't require a warrant.<p>We know they consider any calls known to be 'foreign' already legally authorized. No warrant needed, little reporting, little oversight.<p>Then, anything else that they guess with 51% confidence is foreign, until they discover otherwise, is also authorized: they can start listening, before they have a warrant, and perhaps never needing one. Operating in secrecy, there are a number of ways they could have their fingers on the 51% scales, here: nudging a few extra algorithmic signals into the analysis until they hit the 51% threshold, or pretending not to hear any other indicators of domesticness. (A US citizen might want to answer all calls not with "hello" but instead "I am a US person", if you want them to stop listening... though from the myriad of reports, it's not certain that the enforcement is much stronger than an analyst-self-reported "honor system" and "oops, I'll try not to do that again".)<p>But then also, multiple reports seem to indicate they can <i>start listening</i> to <i>previously-recorded believed US person calls</i> with merely the intent to pursue a FISA warrant within the next 7 days. What if they start that and get more evidence to push the foreignness-confidence over 51%? Perhaps no warrant application is then necessary. What if they use their 6 days and 23 hours of listening and then decide, false lead? Does this "free look at anyone for any reason" have any cost for the analyst? (Was it this sort of temporary-unilateral-overreach that let an analyst access stored intercepts of former President Bill Clinton's email in 2009? [1])<p>If the internal controls are as good as they claim, they ought to be able to report exactly how many domestic calls/emails were heard/viewed, in the sort of 'inadvertent' and quickly-self-corrected errors many officials have already have described on-the-record.<p>[1] <a href="http://www.wired.com/threatlevel/2009/06/pinwale/" rel="nofollow">http://www.wired.com/threatlevel/2009/06/pinwale/</a>