New White House Rules on Surveillance Fall Short, Privacy Group Says

More than a year after leaks from Edward Snowden exposed a government program collecting bulk phone records, the Obama administration has failed to halt the practice that even its own advisers want to end.

Today the White House revealed new rules it has implemented in the last yeargoverning how the NSA and other agencies can collect and store data on U.S. citizens and foreign nationals. But rather than address the fundamental problems intrinsic to the phone records collection program, the changes focus on other ancillary policies. For instance, one new rule requires intelligence agencies to scrub any private information about Americans that gets vacuumed up in bulk collections of data, as in when spy agencies target a foreign national and collect the content of communications belonging to an American in the process. When that information has no intelligence purpose, agencies are now required to purge it. The new rules also indicate that private information collected about foreigners must be scrubbed after five years if it holds no intelligence purpose.

Foreigners will now also be able to petition U.S. courts to block the misuse of their private information if that information was passed to U.S. law enforcement agencies by a foreign government.

The new rules also address the government’s use of so-called National Security Letters—secret letters that the FBI can serve to internet service providers and other businesses to get them to hand over records about users. National Security Letters can be issued without the involvement of a judge or court and come with an indefinite gag order preventing businesses from disclosing to anyone that they received such an order. They were ruled unconstitutional in 2013 by a federal judge in California. The government is currently appealing that ruling. In the meantime, the White House has refused to halt their use, but the new rules at least place a deadline on the gag orders. Going forward, gag orders accompanying an NSL will terminate either when an investigation involving an NSL is closed or three years after an investigation is opened—whichever comes first. The White House has included an exception, however, allowing any midlevel FBI official to extend the secrecy of an NSL if they can justify in writing why it’s needed.

The Electronic Frontier Foundation, which first brought the NSL case against the government, says the new rules don’t address the main problem: namely that agents can simply issue them to a business without any court oversight and the fact that a gag order exists in the first place, for any duration.

“It doesn’t change the essential problem,” says Kurt Opsahl, deputy general counsel for the EFF. “It is still a gag issued without court authority and can be continued indefinitely (simply on the say of an FBI agent) without court involvement.”

He also says the government needs to clarify what the three-year deadline means for NSLs that have already been issued to businesses.

“I would like some clarification if everybody who received an NSL more than three years ago and doesn’t get a note gets to talk about it now,” he says.

Opsahl also says the new rule on purging bulk-collected data that belongs to Americans is problematic, because of the qualifier that it not serve an intelligence purpose.

“It gives a tremendous amount of discretion keeping in mind that foreign intelligence information is a very broad term,” he says.

The biggest change privacy groups were hoping for from the White House but didn’t get? To halt its phone records collection program. Despite recommendations last year that the government halt its bulk collection of phone records metadata—which it collects from telecoms about all calls made to or from the U.S.—the White House has kept it going.

“[The Administration has not implemented the Board’s recommendation to halt the NSA’s bulk telephone records program, which it could do at any time without congressional involvement,” the Privacy and Civil Liberties Oversight Board said in a statement about the new rules.

The board recommended that telecoms maintain the records, rather than letting the government collect and retain them, and make them available to the government only for targeted searches upon court order. The White House indicated that the government will continue to collect and store the data because telecoms have not yet devised a system to store the records and make them available to government when appropriate.

“The companies are saying ‘if you want us to do it, you must compel us to do it,’” aU.S. intelligence official told the New York Times. “So we need to compel them.” As the Times points out, that is a process that would require congressional action.

The section of the Patriot Act that the government has used to authorize the bulk collection of phone records will expire in June. Congress will either need to renew the law by then or pass a new law that authorizes phone companies to retain the data for government.

For now, the government has established new rules for using the collected metadata. A report released today by the Office of the Director of National Intelligence indicates that since February 2014, the intelligence community has been required to seek advance approval from the Foreign Intelligence Surveillance Court for each query term it intends to use to search the collected data and must limit the results of queries to two “hops” away from the queried phone number. This means that the government cannot search an extended string of phone data involving people who called people who called people who might be associated with a terrorist organization. That would be three hops. Instead, analysts can only search data within a two-hop radius from a phone number associated with a terrorist organization.