Policy —

Gov’t review panel suggests NSA stop holding massive phone database

Today's report is surprisingly critical of many NSA practices.

Telephone wires.
Telephone wires.

The panel set up by President Barack Obama to review widespread National Security Agency surveillance has produced a report in remarkably short order, and it contains a surprising suggestion: the NSA should stop collecting its massive trove of telephone data.

Instead, the data should be kept by a third party, possibly the telephone companies, suggests the report from the five-person Review Group on Intelligence and Communications Technologies. The suggestion comes just two days after the bulk data program was reviewed for the first time by a federal judge who was not on the intelligence court; he found that the program is likely unconstitutional.

The report (summary, full report) released today, suggests more than 40 other changes, some of them far-reaching. It recommends splitting up control of the NSA and US Cyber Command, limiting National Security Letters (NSLs) sent out by the FBI, making the head of the NSA a civilian post, and creating a "Civil Liberties and Privacy Protection Board" with greater oversight over NSA activities.

The panel also states that the government should "fully support and not undermine efforts to create encryption standards." It has recommendations for strengthening the privacy of non-US citizens, something that has been little debated since the leaks began in June.

Obama met with the panel earlier today, according to an early report in The Washington Post; he is free to accept or reject the panel's suggestions. He has rejected some of the report's suggestions in the recent past, such as splitting up NSA command. An unnamed official told the New York Times that the recommendations are “significantly more far-reaching than many expected.”

The NSA's bulk collection of phone data was the first program revealed based on information leaked by former NSA contractor Edward Snowden. The program, authorized by the Foreign Intelligence Surveillance Court (FISC), keeps a five-year database of every phone call made in the United States. The program does not collect the contents of calls, but it allows intelligence operatives to search which numbers called other numbers and how long the calls were, and it provides other "metadata" about phone use.

Suggested reforms

Congress should pass a law that "terminates the storage of bulk telephony meta-data by the government under section 215," states the panel in Recommendation 5. The government should be able to acquire such data, which would be held by a private third party, after getting permission from FISC, and the request must be "reasonable in focus, scope, and breadth."

Companies that receive orders to hand over bulk data should be allowed to disclose basic information about the requests—for instance, the number of requests complied with—to the public on a periodic basis. Providing more disclosures is something that major tech companies like Google and Microsoft have asked to do.

NSLs should be tied to a specific investigation and subject to judicial approval, the panel states. The gag orders attached to such letters—which were ruled unconstitutional by one judge in March—should only be used when there are "reasonable grounds" to think that disclosure would threaten national security. They shouldn't stop anyone from talking to a lawyer and challenging the letter, and they shouldn't remain in effect for more than six months.

Information about the use of bulk collection of "business records," NSLs, and other secret methods of information-gathering "should be made available to Congress and to the American people to the greatest extent possible, consistent with the need to protect classified information."

To limit the NSA's reach into Americans' lives, the panel said the NSA "should be clearly designated as a foreign intelligence organization" and that any missions not involved in collecting foreign intelligence ought to be reassigned elsewhere. 

Privacy and civil liberties officials should gain new prominence in the NSA and other parts of the government. "We recommend the creation of a privacy and civil liberties policy official located both in the National Security Staff and the Office of Management and Budget," the report says.

Moreover, the existing Privacy and Civil Liberties Oversight Board, an independent agency created in 2004 to advise the president, should morph into a new "Civil Liberties and Privacy Protection Board" with greater oversight over intelligence.

"The Civil Liberties and Privacy Protection Board should be an authorized recipient for whistle-blower complaints related to privacy and civil liberties concerns from employees in the Intelligence Community," the report states.

Early reactions from some groups pushing for more transparency have hailed the report as a step forward but emphasized that there's considerably farther to go. "Mass surveillance is still heinous, even if private company servers are holding the data instead of government data centers," stated Electronic Frontier Foundation lawyer Kurt Opsahl.

The American Civil Liberties Union welcomed the report as well. "NSA’s surveillance programs are un-American, unconstitutional, and need to be reined in," said ACLU director Anthony Romero. "We urge President Obama to accept his own Review Panel’s recommendations and end these programs."

Channel Ars Technica