Strip NSA of power to collect phone data records, Obama review panel says

• Review proposes greater authority for spying on foreign leaders

• Government 'should be banned from undermining encryption'

• Forty-six recommendations in 300-page report released early

theguardian.com, Dan Roberts in Washington and Spencer Ackerman in New York,18 December 2013

Barack Obama will read the report over the holidays before deciding which
recommendations he will choose to accept. Photograph: Zhang Jun/Xinhua/Corbis

The National Security Agency should be banned from attempting to undermine the security of the internet and stripped of its power to collect telephone records in bulk, a White House review panel recommended on Wednesday.

In a 300-page report prepared for President Obama, the panel made 46 recommendations, including that the authority for spying on foreign leaders should be granted at a higher level than at present.

Though far less sweeping than campaigners have urged, and yet to be ratified by Obama, the report by his Review Group on Intelligence and Communications Technology comes as the White House faces growing pressure over its so-called “bulk collection” programs from US courts and business interests.

Earlier this week, a federal judge ruled that the bulk collection program was likely to be in violation of the US constitution, describing it as “almost Orwellian” in scope.

The White House was stung into releasing the report weeks earlier than expected after meeting America’s largest internet companies on Tuesday. The firms warned that failure to rebuild public trust in communications privacy could damage the US economy.

In its report, the review panel, led by former security officials and academics including the husband of one of Obama's top advisers, said the NSA should be removed of its power to collect the metadata of Americans' phone calls. Instead, it suggested that private companies such as phone carriers retain their customer records in a format that the NSA can access on demand.

This is likely to anger the intelligence community, which argues for direct access, but also fall foul of telephone companies, who have privately warned those drafting more ambitious reforms in Congress that such a scheme would be impractical and dangerous.

“In our view, the current storage by the government of bulk metadata creates potential risks to public trust, personal privacy, and civil liberty,” says the report. “The government should not be permitted to collect and store mass, undigested, non-public personal information about US persons for the purpose of enabling future queries and data-mining for foreign intelligence purposes.”

It also proposes continued NSA spying on foreigners, merely requiring higher clearance to “identify both the uses and the limits of surveillance on foreign leaders and in foreign nations.”

On the security of the internet, the report says the US government should not "undermine efforts to create encryption standards" and not "subvert, undermine, weaken or make vulnerable" commercial security software.

The Electronic Frontier Foundation, one of the privacy advocates suing the Obama administration over the bulk surveillance, expressed disappointment with the review group report. “The review board floats a number of interesting reform proposals, and we're especially happy to see them condemn the NSA's attacks on encryption and other security systems people rely upon,” attorney Kurt Opsahl said.

“But we’re disappointed that the recommendations suggest a path to continue untargeted spying. Mass surveillance is still heinous, even if private company servers are holding the data instead of government data centers.”

After meeting the report’s authors on Wednesday, the White House said Obama would be taking a copy with him to read over Christmas and would decide which recommendations to accept before delivering his state of the union address on January 28.

“It's an extremely dense and substantive exercise, which is why, in response to a 300-plus page report with 46 recommendations, we are not going to come out with an assessment five minutes later,” said spokesman Jay Carney.

Carney acknowledged there was “no question” that the Snowden disclosures had helped lead to the review process and “heightened focus here at the White House and more broadly in the administration, around the United States and the globe.”

For months, the NSA, the phone companies and reform-minded legislators have doubted the viability of having the phone companies store call data on the NSA's behalf.

The NSA has pointed to cumbersome and varied file formats that prevent analysts from quickly searching through the companies' data troves, particularly those proprietary to the telecos. They have also fretted that the companies only keep customer data for 18 months, while they argue they need a historical database of every domestic call going back as few as three years and as many as five.

The companies themselves fear expensive legal and technical morasses that mass data storage on behalf of the NSA may portend.

Meanwhile, civil libertarians and reform-minded legislators believe the databases themselves are problematic. Having the phone companies store them, to provide access to the NSA, is insufficient, they believe.

“Bulk collection of personal data should simply end,” said Alan Butler, an attorney for the Electronic Privacy Information Center.

It remains to be seen whether the legislators behind the USA Freedom Act, the major legislative vehicle before the House and Senate to end NSA domestic bulk call data collection, will be satisfied with the proposal. But at least one member of the House intelligence committee who has sided with the reformers, California Democrat Adam Schiff, called it a “very positive step” and urged Obama to get out in front of the coming swell of legislation.

“With the strong likelihood of congressional action, as well as a recent adverse decision by a federal district court judge, I believe the president would be well served to take the advice of the board and restructure the program as soon as possible. It would be better to have this undertaken in an orderly and expeditious fashion, than to wait for it to be compelled by the Congress or the courts,” Schiff said on Wednesday.

The White House has said Obama will not decide on which of the panel’s reforms to implement until the new year. But last week, the administration decided against one of its recommendations, that would split the NSA from the US military’s Cyber Command.

The decision was reached, White House officials said, because Cyber Command’s task of protecting US military networks from hostile attack and launching wartime online counter-attacks is too ambitious for Cyber Command, which only became operational in 2010.

Accordingly, the NSA director will remain a military general or admiral, contradicting the review group’s recommendation that a civilian should take the helm of the world’s largest spy agency.

Civil libertarian groups have been skeptical of the report for months, fearing that the White House established the insider panel to give Obama and the NSA cover to implement merely cosmetic changes. Advisers to the panel have told the Guardian since September that the panel was stopping well short of meaningful privacy reforms.

As late as Sunday, White House officials told reporters that the report would not be released until January. But in the days since, the NSA and the Obama administration have been buffeted by criticism, from a widely ridiculed 60 Minutes documentary on the NSA, to Judge Richard Leon’s scathing ruling, to the tech giants’ impatience with the surveillance agency.

The report’s authors were Richard Clarke, a former US cybersecurity adviser; Michael Morell, a former deputy CIA director; Geoffrey Stone, a University of Chicago law professor; Peter Swire, who served earlier on Obama's national economic council; and Cass Sunstein, a Harvard law school professor who is married to UN ambassador Samantha Power.

Just before the White House released the review's report, a different group advising Obama, the Privacy and Civil Liberties Oversight Board, which has held public hearings into the NSA for months, announced it will release two studies of its own, one into bulk collection of domestic phone data and the other into bulk foreign communications collection.

The reviews, due around late January and early February 2014, will also assess the operations of the secret Fisa court overseeing surveillance and provide "recommendations for legislative and program changes," the board announced on Wednesday afternoon.

Related Article:

NSA phone surveillance program likely unconstitutional, federal judge rules