Section (3) is particularly interesting.
A communication identified as a domestic communication will be promptly destroyed upon recognition unless the Director of the NSA specifically determines, in writing, that
(3) the communication is reasonably believed to contain ... information necessary to assess a communications security vulnerability
What does this say for vulnerability researchers who happen to be American?