Here's the entire relevant section from a 2019 CRS report on the matter [minus the footnotes]:
Policy and Legal Authorities
Policy and authorities for initiating and managing ties between the [intelligence community] IC and foreign intelligence
services, and specifying the roles and responsibilities of personnel supporting these relationships,
are found in statute, executive orders, and intelligence directives.
Intelligence Community Directive (ICD)-403, Foreign Disclosure and Release of Classified
National Intelligence, states U.S. Government policy on disclosure of U.S. intelligence to foreign
state or non-state intelligence entities:
U.S. intelligence is a national asset to be conserved and protected and will be shared with
foreign entities only when consistent with U.S. national security and foreign policy
objectives and when an identifiable benefit can be expected to accrue to the U.S. It is the
policy of the U.S. Government to share intelligence with foreign governments whenever it
is consistent with U.S. law and clearly in the national interest to do so, and when it is
intended for a specific purpose and general limited in duration.
ICD-403 also requires that determinations to disclose or release U.S. intelligence should take into
account the professional ability of a foreign intelligence service to protect the classified
intelligence from subsequent compromise posing a risk to U.S. national security. However,
In exceptional cases, there may be a benefit to U.S. interests to disclose or release
intelligence to foreign entities under conditions where the recipient’s safeguards are likely
to be inadequate. In such cases, the anticipated benefits must outweigh the potential
damage of a likely compromise.
Intelligence Community Policy Guidance 403.1 (ICPG-403.1) further expounds policy in ICD-
403 by providing criteria for disclosing or releasing classified intelligence to a foreign
intelligence entity. Its guidance pertains to classified U.S. intelligence only, which does not
include other classified information, such as defense, military, or diplomatic information that is
not intelligence. Disclosure or release of classified intelligence is appropriate when it:
- is consistent with U.S. foreign policy and national security objectives;
- can be expected to result in an identifiable, commensurate benefit to the U.S.;
- supports a U.S. diplomatic, political, economic, military, or security policy or
treaties; and
- aids U.S. intelligence or counterintelligence activities.
An intelligence sharing agreement is often formalized in a memorandum of
understanding (MOU) between the U.S. IC element and its foreign intelligence
counterpart. There are hundreds of these agreements between the IC and foreign
intelligence services. They are not legally binding and are generally classified. [5 U.S.C. §552(c)(1) provides this exception from normal foreign contacts disclosure requirement.] This can
present challenges for congressional oversight. As one observer of the Intelligence
Community remarked, “The near invisibility of liaison arrangements to oversight by
elected officials is problematic. Oversight mechanisms have not kept pace with global
issues.”
For military exchanges that include other types of classified information as well as
intelligence, the Department of Defense (DOD) uses General Security of Military
Information Agreements (GSOMIA) that detail the level of classification for the
exchange and the categories of information that can be exchanged. Whether an MOU or
GSOMIA, these agreements provide formal frameworks for intelligence relationships that
can be fundamental to broader security relationships (legal enforceability
notwithstanding).
(Emphasis mine.) So, as I noted in an early comment of mine, the executive essentially defines and implements what is legal in this area, with little external oversight. Thus emphasizing the legality of the matter is somewhat hollow, in my opinion.
It's been noted, for instance, in one recent article I read that the Biden administration has said they decided not to share with Ukrainians exact names and locations of "senior" Russian commanders they know about, only (as noted in another piece) the positions of "mobile headquarters"... but that it would also be entirely legal for them to given Ukrainians much more detailed info in that regard. The only reason for not doing that is that the Biden administration thinks doing so would be interpreted as escalatory by the Russians.
Actually, that was just the lead section of CRS report; there are two further sub-sections there spanning a couple more pages, which make a full quote a bit unwieldy, but the rest is talking about how authority is delegated further down the chain, and to very selectively summarize/quote that...
The DNI has the statutory authority to “oversee the coordination between elements of the
Intelligence Community and the intelligence or security services of foreign governments or
international organizations on all matters involving intelligence related to the national security or involving intelligence acquired through clandestine means.” [50 U.S.C. §3024(k)]
[...]
The Director of the CIA (D/CIA) is responsible for implementing the DNI’s foreign intelligence engagement policy and coordinating foreign intelligence relationships. These responsibilities are
specified in Executive Order (EO) 12333, United States Intelligence Activities: CIA has the
authority “under the direction and guidance of the DNI ... to coordinate the implementation of
intelligence and counterintelligence relationships between elements of the IC and the intelligence
or security services of foreign governments or international organizations.”
As you an see, it gets into the realm of Executive Orders and then IC agencies own rules (like DNI's ICDs) pretty quickly from that.
