Intelligence Authorization Act for Fiscal Year 2015: section 309 [0]

"A covered communication shall not be retained in excess of 5 years, unless ... (iii) the communication is enciphered or reasonably believed to have a secret meaning;"

[0] https://www.congress.gov/bill/113th-congress/house-bill/4681...

That does not refute my point above. Section 309 only applies to incidentally acquired communication that is collected via the routes mentioned above. It does not allow the NSA to collect traffic between domestic endpoints just because it is encrypted.

"covered communication" is defined in the prior page (309.a). The definition stands alone, regardless of how "incidentally" appears on the same page, it makes no reference to proceeding limitation or definitions.

"...any nonpublic telephone or electronic communication acquired without the consent of a person who is a party to the communication, including communications in electronic storage."

You don't ignore section headings when reading laws. Besides that, nothing in that section discusses granting authority to collect "covered communication." The section is discussing the retention policies of communications collected by some authorized manner.

> You don't ignore section headings when reading laws.

You do when you are interpreting the laws. They're labels that carry as much weight as subsection markers. To say otherwise would imply that the "Patriot Act" by another name would be interpreted differently, or that bullet point "1" is more important that "2".

> nothing in that section discusses granting authority

Correct, it is a direction to those that already have such authority. While I enjoy the legal equivalent to the underhanded C contest as much as the next guy, the events that spawned this legislation make debating the finer points of section headings seem pretty silly.

You might recall that the NSA has a curious definition of "collect". They use "collect" where most of us would use "search the existing massive database that we already collected".

But collection is sweeping and worldwide (including domestic). We know that already.

Right. Bottom line: Securely encrypt end-to-end, if you want privacy. Or not. Either way, bet on stuff being retained.