I liked the fifth point, criminalizing Constitutional violations, at least until I read the next paragraph.  "software that sorts what can legally be captured from what cannot can violate the Constitution and the law if it uses the wrong algorithm or has a bug" makes the criminalization less palatable.  Who among us software devos would want criminal liability for bugs?

Actually I like the idea of criminalizing Constitutional violations in general.  Another place it would make a powerful difference IMHO would be around police misconduct and illegal searches.  Instead of suppressing illegal evidence and letting criminals walk because of police misconduct, allow the evidence but throw the cops that misbehave in jail.  Seems similar in concept to this proposal.

Back to FISA, require Executive, judicial, and Congressional oversight.  Period.  Maybe raise the bar and increase the scrutiny when communications are intermingled.

One thing, there needs to be some provision for exceptional circumstances that require timely action without warrants being issued, subject to retrospective review.  I'm thinking of a possible situation in which surveillance identifies a previously unknown actor involved in an operation in progress, and the time to obtain a warrant would significantly increase the likelihood of a successful attack.  That's where aggravated criminal charges should result in the event of abuse, IMNSHO.

Agreed that code reviews are a good thing, but I see problems in getting code implementing intelligence collection vetted in open forums.  Something a lot of folks don't realize is that classification is about preventing the adversary from gaining detailed knowledge about capabilities, including intelligence collection capabilities.

So, if we have open vetting of algorithms that select calls for monitoring and exclude those calls deemed protected, does it enhance the adversaries' ability to camouflage their calls to evade monitoring?
How much does that impair intelligence collection? 
How much does it enhance protection of constitutional rights?
Does the risk from impaired intelligence collection outweigh the protection of constitutional rights, or vice versa?

If the ability of adversaries to evade intelligence collection monitoring were to enable a successful attack, who would be blamed for the successful attack?

As long as the answer to that question is the folks who do intelligence collection, expect them to resist fetters on their ability to do their job.

Point is that there has to be a reasonable balance, and sometimes it falls short of the ideal.  Intuitively I would feel that technical oversight would be a particularly difficult point to craft an appropriate balance.

Let me bring up an example of a technical issue that I think the Congress can address without themselves having a deep understanding of the technology involved.

If I were to design a system to tap Internet email, extracting only communications that are between foreign persons located overseas (who are not protected by the Constitution), I would split the feed at major access points in the internet and run the full stream through filters that looked for information of interested contained in messages whose to and from addresses passed requirements of being identifiable as non-US persons located outside the US or specific people contained in my warrants database.

This would result in several types of data: Communications of interest that the gov't has a right to (foreign or warranted), communications that the gov't is known to no right to, and information of indeterminate type. Obviously interesting communications that is legitimate to tap should be turned over to a human.

But what is my system allowed to do with the rest? Must it discard or destroy it? Or would it be reasonable to take some of it and without letting any human see it, save it for later processing. If a warrant is added, for instance, or an address is alter found to be associated with someone for whom there was already a warrant, or an address is discovered to be outside the US, the historical data could be searched again and information of interest could be delivered to a human.

How about communications known to be between non-US persons located out of the US, but not recognized as being of any interest. Could it be kept for future rescanning? Could it be made available to humans to scan?

These questions determine how the code can be written and how information is stored, but are basically legal questions.

One criticism thrown at the current FISA law is that it no longer requires a specific facility (a specific email address, phone number, IP address) to be given in a FISA address.

The obvious reason to drop this requirement is that warrants should be for people, not equipment, and in this day and age a temporary address can be picked up for one shot use. Prepaid phones are common, IP addresses are assigned by DHCP in coffee-shops. MAC addresses can be changed. You can sign up for a web-mail account in minutes.

Warrants tied to specific facilities can be easily rendered useless by a clever enemy who understands how you build a sleeper cell. The 9/11 guys knew how to build sleeper cells.

So, is there really any problem with not requiring specific facilities?

On the other hand, the new FISA depends upon where someone is and who they are. US persons are protected. Communications within the US is protected. non-US persons outside the US are not. How do you know who someone is and where when you grab an email? I have email accounts in the UK and Germany, and a phone number in the UK. How do you know I'm a US citizen located in the US when I use them? What about the reverse?