The review group advising President Obama on curbing the National Security Agency doesn’t go as far as privacy advocates worldwide want. The big question it raises is whether it gives Obama cover to substantially restrict bulk surveillance at home and abroad, a step he has never committed to taking.  That really would be a sea change for the NSA. But the review group is more comfortable toeing closer to the water’s edge on two of the biggest issues surrounding the NSA: mass surveillance of foreign publics and bulk collection of US citizens’ phone records.  On the former, the White House review group has vague recommendations for a subject that has sparked a diplomatic headache for Obama.  Foreigners, after all, are whom the NSA exists to spy on. And spying on foreign leaders, even allied ones, is the oldest trick in the signals-intelligence book.  Yet Obama has been confronted with outrage over a broader amount of foreigner-based spying than most anticipated existed. And since foreigners overseas don't have either US privacy rights under law nor powerful legislators to advocate for them, it's never been clear whether or how those NSA powers will remain intact.  The answer the review group offers is vague and preliminary, more a set of guidelines than a set of restrictions.  Foreign spying should be "exclusively" aimed at protecting US and allied national security, the review group says. Proper laws and executive orders should guide it. Oversight is necessary. Disseminating information about foreigners can't happen without a national-security reason. And it can't occur for "illegitimate" reasons like stealing trade secrets.  However, the NSA has argued for the last six months that all those conditions apply today. It's not clear what additional mechanisms would compel the NSA to follow those guidelines.  The exception is that the "highest-level approval" ought to exist for spying on foreign allied leaders – most likely the US president. That's a response to the anger brought by, among others, German chancellor Angela Merkel, who compared the NSA to the East German Stasi after learning NSA spied on her cellphone.  Also, the US should "explore understandings or arrangements regarding intelligence collection guidelines and practices with respect to each others’ citizens" with its closest intelligence partners. The report doesn't say it, but that's a reference to the "Five Eyes" intelligence alliance of the US, the UK, Canada, New Zealand and Australia. As the Guardian’s James Ball recently reported, the NSA has had a backdoor authority to spy on UK citizens without so much as telling Britain, although it's not clear how much that has occurred.  How will all this work in practice? It's hard to tell right now. But the report will probably serve to provoke a conversation rather than answer it, a fate that befalls many a presidential commission.  Still, the review group comes rather close to acknowledging privacy rights of foreigners and even endorses, in a caveated way, applying a privacy law, the Privacy Act of 1974, to foreign publics. Expect lots of legal disputes over that, should it be adopted.  Similarly, the review group stops shorter than civil libertarian groups want on the most domestically controversial aspect of the NSA’s bulk surveillance: the bulk collection of all US phone data for five years.  The review group endorses reforming Section 215 of the Patriot Act so that the government can only collect phone or other data pursuant to a Fisa court order “about particular individuals”. And it can only get that data if it has “reasonable grounds” to believe the information sought is “relevant to an authorized investigation intended” to stop terrorism or spying on the US. Plus, the order has to be “reasonable in focus, scope, and breadth.”  That sounds similar to the “reasonable, articulable suspicion” grounds the NSA currently uses to search through its databases of US call information. Only here, the big shift proposed would be to have a “private party” like a telecom firm hold the data, not the NSA.  Put differently, bulk collection by the NSA would be replaced with bulk storage by … someone else, probably the phone company, with the NSA able to search through the data. It’s not a total equivalence, since the Fisa court order for the data would effectively mean a court would approve the searches of the data at the point when the NSA wants it from the phone companies. That’s a possible new safeguard, even if it’s a quasi-safeguard.  But here’s where the devil is in the details. The NSA wants that data stored for three to five years. Right now the phone companies store it for up to 18 months. And civil libertarians object to having the phone companies act as middlemen for mass surveillance.  “Mass surveillance is still heinous, even if private company servers are holding the data instead of government data centers,” said Kurt Opsahl, of the Electronic Frontier Foundation.  “It’s not a solution to simply repackage the bulk collection under private control,” said Alex Abdo of the ACLU.  Not only that, the telecoms are already hinting at their opposition.  “It would be costly for us and more than that it would potentially open access to consumer data to other government agencies. Once they know that we are holding the information, what's to stop the IRS asking for it. It wouldn't just be the NSA anymore," a telecoms executive briefed on the report said on condition of anonymity.  Addressing the revelation that the NSA has undermined global encryption standards – ironically, making online data more vulnerable to criminals and US adversaries as well as the NSA – the review group’s guiding rule is almost medical: do no harm.  The US should “make clear” it will not take any action to design in backdoors, vulnerabilities or other mechanisms to weaken encryption, the review group recommends, nor should it secretly demand changes in cryptographic tools from software companies.  But the review offers no evident enforcement mechanisms to guarantee that the NSA, Department of Homeland Security, US Cyber Command or other agency concerned with cybersecurity will comply, aside from saying it should have the “force of law.”  The review also accepts at face value that the NSA’s assurance that it is not undermining encryption – despite NSA and GCHQ documents published by the Guardian in September thanks to whistleblower Edward Snowden that explicitly refer to “an aggressive, multipronged effort to break widely used encryption technologies.”  Still, the review states that the NSA “not store generic commercial encrypted data,” such as Virtual Private Networks that conceal where a user connects to the internet or the Secure Socket Layer protocol to protect data in transit online.  The apparent spirit of the recommendation is to allow the NSA to break specific codes, traditionally necessary for discovering foreign secrets, rather than to undermine codemaking writ large, which has significant consequences for a global economy that depends on secured data transfers.  Sascha Meinrath, the director of the Open Technology Institute and an adviser to the review group, was encouraged by the recommendation, despite long skepticism about the review group’s work.  “The review group's recommendations that the US government act to make internet communications more secure, rather than building secret surveillance 'backdoors', undermining security standards, and secretly stockpiling exploits to hack into people's computers, are important steps forward,” Meinrath said.  But the point at which the rubber hits the road, politically, is whether the telecom-storage proposal works as a compromise for the authors of the USA Freedom Act, the major legislative proposal in the House and Senate to end bulk suspicionless surveillance. If so, that could clear the way for Obama to endorse it, thereby allowing it to move in the Senate and probably ensure passage in the House through a coalition of Democrats and privacy-minded Republicans – even at the cost of civil libertarian opposition.  One of the bill’s authors is cautious so far.  Patrick Leahy, a stalwart Obama ally and just as stalwart a bulk-collection critic, is the chairman of the Senate judiciary committee. In a statement, Leahy said the recommendation “align[s]” with the USA Freedom Act.  But just as the review group stopped short of ending bulk surveillance on domestic call data, Leahy stopped short of calling for the report’s full implementation.  Instead, Leahy said he had invited the review group to testify before the committee, and he’ll “look forward to discussing their important recommendations”.  The ACLU’s Abdo sounded wary on Wednesday, even while hailing the report as “a rejection of the NSA’s most overwhelming surveillance programs”.  “The problem is Americans’ call records are extremely sensitive. No one, the government or the phone companies, should be stockpiling it,” he said.  Additional reporting by Dominic Rushe
Spencer Ackerman: Report leaves room for Obama administration to decide any number of next steps in addressing concerns over spy agency