Feeds

Internet giants, US gov agree to loosen secrecy of private info slurps

Finer-grained reporting now permitted, sometimes, sort of

The essential guide to IT transformation

The US Department of Justice has agreed to allow internet companies to be more candid about what information they disclose to the government, albeit only slightly.

Facebook, Google, LinkedIn, Microsoft, and Yahoo! are among several companies that have been urging the feds to loosen the secrecy surrounding their data collection practices.

All five had sued the government to change its policies, but on Monday, they issued a joint statement to the effect that they would no longer pursue the matter through the courts.

"We filed our lawsuits because we believe that the public has a right to know about the volume and types of national security requests we receive," the statement read. "We're pleased the Department of Justice has agreed that we and other providers can disclose this information. While this is a very positive step, we'll continue to encourage Congress to take additional steps to address all of the reforms we believe are needed."

In a joint statement of their own, national intelligence head James Clapper and US Attorney General Eric Holder said, in effect, that they were only adjusting their policies because the White House ordered it.

"This action was directed by the President earlier this month in his speech on intelligence reforms," the statement read. "While this aggregate data was properly classified until today, the Office of the Director of National Intelligence, in consultation with other departments and agencies, has determined that the public interest in disclosing this information now outweighs the national security concerns that required its classification."

Not that all that much has changed. Previously, companies had been able to disclose how many so-called National Security Letters they have received but only in increments of 1,000, and they weren't allowed to say how many information requests they received under the Foreign Intelligence Surveillance Act (FISA). The new agreement only alters that somewhat.

Under the settlement, companies can now narrow their reporting to increments of 250, but only if they lump all of the National Security Letters and FISA requests together. If they want to list how many of each kind of request they get separately, they're still limited to reporting them in the thousands.

What's more, companies are restricted to reporting information about government surveillance requests only every six months, and when they do, the data they report must be six months old. In other words, a report issued at the beginning of one year will only cover disclosures made during the first half of the previous year – and if the government is spying on a brand-new service, it will be six months before anyone knows it for sure.

Another new rule allows companies to also disclose the number of "selectors" – individual data points such as usernames, email addresses, or other identifying information – that the government requested.

In a separate statement [PDF], Apple expressed its approval of the new rules and it updated its own reporting to reflect the new, finer-grained disclosure now allowed.

"We believe strongly that our customers have the right to understand how their personal information is being handled, and we are pleased the government has developed new rules that allow us to more accurately report law enforcement orders and national security orders in the U.S," the statement said.

According to Clapper and Holder, Monday's moves were only the first of several that will be made in response to President Obama's call for surveillance reforms.

"In the weeks ahead, additional steps must be taken in order to fully implement the reforms directed by the President," the Justice Department's statement said.

But it seems unlikely that these reforms will be enough to appease rights organizations such as the American Civil Liberties Union. On Monday, the ACLU issued a statement to the effect that while it approved of the proposed reforms, more must be done.

"Congress should require the government to publish basic information about the full extent of its surveillance," the group said, "including the significant amount of spying that happens without the tech companies’ involvement." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
Don't even THINK about copyright violation, says Indian state
Pre-emptive arrest for pirates in Karnataka
The police are WRONG: Watching YouTube videos is NOT illegal
And our man Corfield is pretty bloody cross about it
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
Oz biz regulator discovers shared servers in EPIC FACEPALM
'Not aware' that one IP can hold more than one Website
Apple tried to get a ban on Galaxy, judge said: NO, NO, NO
Judge Koh refuses Samsung ban for the third time
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.