The Federal Bureau of Investigation made tens of thousands of unauthorized searches related to US citizens between 2017 and 2018, a court ruled. The agency violated both the law that authorized the surveillance program they used and the Fourth Amendment of the US Constitution.

The ruling was made in October 2018 by the Foreign Intelligence Surveillance Court (FISC), a secret government court responsible for reviewing and authorizing searches of foreign individuals inside and outside the US. It was just made public today.

The FBI made unauthorized, warrantless electronic searches on American citizens

The program itself, called Section 702 and part of the broad and aggressive expansion of US spy programs in the years after 9/11, granted FBI agents the ability to search a database of electronic intelligence, including phone numbers, emails, and other identifying data. It’s intended for use primarily by the National Security Agency.

There’s a key limitation on Section 702: it can only be used to search for evidence of a crime or as part of an investigation into a foreign target. The idea is to monitor terrorism suspects and cyberthreats.

Yet the FBI vetted American sources using the database, according to The Wall Street Journal. The agents also used the database to search for information about themselves. Less amusingly, they also looked up friends, family, and coworkers. The court deemed this a clear violation of the Fourth Amendment, which protects against unreasonable search and seizure, because none of the searches of US citizens had proper warrants attached.

The FISC is responsible for evaluating the use of these spy tools in secret as part of the Foreign Intelligence Surveillance Act of 1978, which pushed these governmental deliberations behind closed doors under the guise of protecting national security. That’s why this ruling went a full year before seeing the light of day.

It’s public now because the government lost an appeal in a separate, secret appeals court, the WSJ says. The FBI must now create new oversight procedures and a compliance review team to protect against further surveillance abuse.