This is pretty much the very same problem the German BND has right now, I'd guess pretty much any intelligence service which conducts mass surveillance has this

This is pretty much the very same problem the German BND has right now, I'd guess pretty much any intelligence service which conducts mass surveillance has this problem of "surveil everything, except stuff from your domestic population". How to find out if your target belongs to the domestic population without looking into any content of that target? German BND supposedly does some of the filtering by country domain extension i.e. users with a "@xyz.de" mail address are supposedly exempted from BND scrutiny. Which is of course yet another flawed approach because not every German has a .de mail address. Case in point, I have an account with German mail provider GMX that ends on .net. That method would also make it stupidly easy to evade any scrutiny by the BND. Imho this is a problem that doesn't have a good solution or any solution at all, for this to actually work in reality security services would need to be clairvoyant.