This NSA memo from 23 March 2012 presentation describes the agency’s proposal for a fourth FAA 702 certification that would allow it to target hackers “tied to malicious cyber activity”: see the New York Times article Hunting for Hackers, N.S.A. Secretly Expands Internet Spying at U.S. Border, 4 June 2015.
This 2010 certification from the Director of National Intelligence and the Attorney General asserts that procedures are in place to ensure foreign intelligence gathering stays within the boundaries of the law by targeting people “who are reasonably believed to be outside the United States.” The breadth of the authority is, however, very wide, allowing surveillance of communications “about” 193 countries and other entities specified in a separate document: see the Washington Post article Court gave NSA broad leeway in surveillance, documents show, 30 June 2014.
An undated chart showing the sources of 103 ‘accesses’ to communications or computers made in a single week in 2009 at an NSA facility in San Antonio, Texas. Twenty-four accesses were collected from the major internet companies under the authority of the FISA Amendments Act (FAA), 21 from Special Source Operations on privately owned communications infrastructure (SOO), 19 from intercept of foreign communications satellites (Fornsat), 16 from intercepted radio communications (Conventional), nine were acquired by US spy satellites (Overhead), seven from foreign intelligence services (2nd/3rd party) and one from Special Collection Service operations based at embassies and consulates (SCS): see the New York Times article No Morsel Too Minuscule for All-Consuming N.S.A., 2 November 2013.
A Targeting Rationale document details how NSA analysts should justify their targeting decisions: see the Washington Post article NSA broke privacy rules thousands of times per year, audit finds, 15 August 2013.
Procedures used by the NSA to target non-US persons under the FISA Amendments Act: see the Guardian article The top secret rules that allow NSA to use US data without a warrant, 20 June 2013.