- The law shifts prior approval to ex-post control for many surveillance powers.
- Services can hack, intercept, and copy data without prior authorization, affecting innocent third parties.
- Technical risks, zero-days, and vulnerabilities no longer need to be described before hacking.
- Untargeted interception of all cables for up to a year is allowed for exploration, with data shared with foreign agencies.
- Restrictions on bulk domestic internet interception are removed.
- Algorithms can search bulk intercepted data without prior external review to find targets.
- Bulk data can be stored indefinitely without relevance checks, with limited binding ex-post oversight.