Given the earlier reports
suggesting that the "independent" task force set up to review the NSA's activities had come back with a list of suggestions for changes that were mostly cosmetic, rather than substantive, it was a bit of a surprise to see the White House come out today to say that those earlier reports were incorrect and
that they were releasing the report in full today (way ahead of schedule). And, now the report is out
. After giving it a single read (300+ pages), it is
a lot more substantial than many of us expected -- so much so that even the NSA's biggest apologists are "shocked"
at how "awkward" it must be for the White House to claim to set up an independent task force, and then have it come back with recommendations that are quite different than what the White House itself has been proposing. It's as if the NSA's apologists assumed this was long in the bag, and that the task force itself was always a joke. Turns out that's not the case.
That's not to say this is perfect. There are significant areas where it seems the recommendations could and should go much further. But it does argue for reining in significant amounts of surveillance, providing much greater oversight, protecting non-US persons' privacy as well as US persons, and a variety of other very real changes. It also (as Judge Leon did on Monday) says that there's no real evidence the bulk collection of metadata was useful in any real way... but, oddly, then allows the program to continue, but in a different manner: having the telcos retain the data in case it's later needed (along with relevant court approvals) rather than just keeping the whole database to troll through. There are all sorts of problems with mandatory data retention as well, but we'll talk about that eventually.
It recommends putting significant restrictions on the ability of the FISA court to force companies to disclose private information, and also includes restrictions on the regularly abused "national security letters" process, which the FBI frequently uses to get information without a warrant. It supports much greater transparency about the programs, including allowing companies to reveal details of the number of requests they received for information. And, as mentioned above, they don't just stop at protecting the privacy of US persons, but non-US as well, including that any spying on non-US persons needs to have a direct national security purpose, and cannot be based on political or religious views alone. It also recommends against revealing information about non-US persons, such as the reported plans to leak the porn viewing habits of certain non-terrorists with views with which the American government disagreed.
The report clearly notes the drift by the NSA away from its core mission of national security, and suggests that various actions need to get back to having a specific national security reason. It also argues for splitting up parts of the NSA by designating the NSA itself as only covering foreign intelligence, moving its "Information Assurance Directorate" and (as we'd discussed last week) finally separating US Cyber Command from the NSA (something the White House has apparently already rejected). The report highlights the need for greater privacy assurances, including reconstituting the Civil Liberties Oversight Board into the Civil Liberties and Privacy Protection Board -- and granting it much more power for oversight, while also placing a Special Assistant to the President for Privacy in the executive branch. As many had expected, it also recommends making the FISA court a more adversarial process (something the White House has suggested it may be open to).
The report also recommends that the NSA be blocked from trying to undermine or weaken encryption standards, and actually says that the White House should support greater use of encryption across the board.
There are recommendations to better lock down information within the intelligence community to prevent another Snowden from walking off with documents... but also more avenues for whistleblowers, including having them go to that newly constituted privacy board.
It's final recommendation is one that's most telling, and one of the issues that's most confused me throughout this process. It suggests that the government start actually doing a "cost-benefit" analysis of the various security efforts it engages in. As we've noted, the incredible thing about the revealed programs is that they provided very little benefit, but the costs were astounding, both in managing the programs themselves, but, more importantly, in the impact economically and diplomatically of having those programs revealed.
Now, this report is just a set of proposals, which the White House can reject. In fact, it's likely that many will be rejected or ignored. But, to actually have this review board -- which many expected to be nothing more than yet another rubber stamp -- issue something this detailed, comprehensive... and which really does recommend some very real changes, is a pleasant surprise.
Your move, Mr. President.