Doesn’t it depend on whether unmasking is pursuant to a national security investigation?
Not that I know of. The "minimization" protocol does anticipate that the identity of US persons might be "unmasked" before the report is "disseminated" (another loaded word that I haven't found a good legal definition for), and it spells out the standards to be applied to justify this "unmasking before dissemination," but I see no penalty for unmasking willy-nilly.
For what it's worth, the object of all this FISA stuff is "Foreign Intelligence," not "national security." The law is called "Foreign Intelligence Surveillance Act", not "National Security Surveillance Act."
The distinction matters when evidence is brought to bear against a person charged with a crime, because the government is allowed to seek foreign intelligence without a warrant. But because the public would revolt if it knew how much is was surveilled, the Congresses and Court created this FISA protocol to reduce the chance of some judge throwing out evidence, while simultaneously making the people believe the surveillance has reasonable limits protecting the public from being snooped willy nilly.
I know from following the cases that the civil penalty part of the FISA law is toothless. The government just asserts "state secret" and the civil claim goes away.
Leakers can get in real trouble though.