Slide: 1 \/ of 1. Caption: Caption: The headquarters of the National Security Agency (NSA) in Fort Meade, Maryland.Jim Lo Scalzo\/EPA\/Redux <\/p>\n
The charter of the National Security Agency limits its powerful surveillance to the rest of the world, not US citizens. But one controversial carve-out in NSA rules has for years allowed it to vacuum up communications that arent to or from a foreign target, but merely about oneno matter who sends or receives it. Now the NSA says it will end that practice. And in doing so, it concedes a significant win to the privacy advocates who have fought it for years. <\/p>\n
The loophole the NSA is closing, as first reported by the New York Times, falls under the 702 provision of the Foreign Intelligence Surveillance Act. The NSAs interpretation of FISA allowed it to search the vast firehose of internet data that passed through its wiretaps of fiberoptic cables for certain selectors, or search terms, and collect that data if any part of the communication passed outside the USeven if one or both people communicating were in fact Americans. <\/p>\n
NSA will no longer collect certain internet communications that merely mention a foreign intelligence target, reads a statement from the agency. Instead, NSA will limit such collection to internet communications that are sent directly to or from a foreign target. <\/p>\n
Exactly why the NSA decided to end those about searches still isnt entirely clear. But privacy advocates are cautiously declaring a victory. <\/p>\n
The problem of this kind of about searching is that it meant actually scanning the contents of every email to see if the messages contain the target selector, says Robyn Greene, policy counsel at the Open Technology Institute. That implicates foreign affairs, human rights activism abroad, international businesspeople, lawyers who work internationally and researchersStopping about collection is a huge boon to privacy for both Americans and individuals abroad. <\/p>\n
For at least a decade, the NSA has interpreted FISA to allow it to collect so-called upstream data based on search terms that go beyond merely who send or received it. It also takes into account strings of information that might be included in the communications, like an email address, phone number, IP address, or the signature that identifies a certain piece of malware. In 2008, the Foreign Intelligence Surveillance Court, which serves as the judicial watchdog for the NSAs potential privacy violations, approved that legal interpretation in a classified ruling. <\/p>\n
The practice has remained contentious. Privacy advocates argue that its unconstitutionally indiscriminate, violating Fourth Amendment protections from warrantless searches of US citizens. Any American communicating about a certain selector could have their communications caught in the NSAs dragnet if their communications simply pass through a foreign server, something they have little or no control over. This could just be two people talking something, or a reporter writing a certain email address. It really broadens the aperture for the collection of communications without a warrant, says Andrew Crocker, an attorney with digital rights group EFF. In our view, its been unconstitutional all along. <\/p>\n
It also happens frequently. In 2011, for instance, the FISC revealed an estimate that about .2 percent were between Americans, amounting to tens of thousands of individual communications. The same year, it blocked the NSA from doing any upstream data collection for close to six months, though it never revealed why. In 2014, a report by the White Houses Privacy and Civil Liberties Oversight Board raised the issue of the broad, indiscriminate targeting of about searches once again. <\/p>\n
That board also pointed to the problem exacerbated by so-called Multi-Communication Transactions: Due to the complexities of how data is packaged and moves around the internet, the NSAs filter pulled in entire bundles of digital communications despite many of the messages containing nothing to do with the target selector. You would have one message that met the conditions to trigger collection, and then whoops, they got everything else in the same package including totally domestic emails, says Julian Sanchez, a privacy-focused research fellow with the Cato Institute. <\/p>\n
To deal with those inherent problems, the NSA at some point agreed to store the domestic communications it collected with special protections, and only grant access to analysts under certain, secret conditions. In its public statement, though, the NSA conceded to inadvertent compliance lapses, indicating that those special procedures failed. After reporting the violations to Congress and the FISC, the NSA decided to cease its about collection altogether, and even to delete older data collected under the practice. <\/p>\n
Even though the Agency was legally allowed to retain such about information previously collected under Section 702, the NSA will delete the vast majority of its upstream internet data to further protect the privacy of US person communications, the NSA statement reads. <\/p>\n
But while privacy advocates applaud that move, they also argue its not enough. Instead of leaving the decision to the NSAs discretion or secret court rulings, Congress should encode the rollback in law when it renews the Foreign Intelligence Surveillance Act later this year, says OTIs Robyn Greene. We need to codify an end to about collection in the law, says Green, This decision doesnt reduce that need for legislative reform, it highlights the need. In response to the NSAs statement, Senate Intelligence Committee member Ron Wyden said he intended to introduce that very legislation. <\/p>\n
Privacy advocates now hope that the NSAs decision to stop the about searches might reduce the chance that Congress will seek to authorize the practice. This takes off the table one of the most controversial elements in the reauthorization debate, the EFFs Crocker says. Straightforwardly, thats a good thing. <\/p>\n
<\/p>\n