Feeds

Internet giants, US gov agree to loosen secrecy of private info slurps

Finer-grained reporting now permitted, sometimes, sort of

Beginner's guide to SSL certificates

The US Department of Justice has agreed to allow internet companies to be more candid about what information they disclose to the government, albeit only slightly.

Facebook, Google, LinkedIn, Microsoft, and Yahoo! are among several companies that have been urging the feds to loosen the secrecy surrounding their data collection practices.

All five had sued the government to change its policies, but on Monday, they issued a joint statement to the effect that they would no longer pursue the matter through the courts.

"We filed our lawsuits because we believe that the public has a right to know about the volume and types of national security requests we receive," the statement read. "We're pleased the Department of Justice has agreed that we and other providers can disclose this information. While this is a very positive step, we'll continue to encourage Congress to take additional steps to address all of the reforms we believe are needed."

In a joint statement of their own, national intelligence head James Clapper and US Attorney General Eric Holder said, in effect, that they were only adjusting their policies because the White House ordered it.

"This action was directed by the President earlier this month in his speech on intelligence reforms," the statement read. "While this aggregate data was properly classified until today, the Office of the Director of National Intelligence, in consultation with other departments and agencies, has determined that the public interest in disclosing this information now outweighs the national security concerns that required its classification."

Not that all that much has changed. Previously, companies had been able to disclose how many so-called National Security Letters they have received but only in increments of 1,000, and they weren't allowed to say how many information requests they received under the Foreign Intelligence Surveillance Act (FISA). The new agreement only alters that somewhat.

Under the settlement, companies can now narrow their reporting to increments of 250, but only if they lump all of the National Security Letters and FISA requests together. If they want to list how many of each kind of request they get separately, they're still limited to reporting them in the thousands.

What's more, companies are restricted to reporting information about government surveillance requests only every six months, and when they do, the data they report must be six months old. In other words, a report issued at the beginning of one year will only cover disclosures made during the first half of the previous year – and if the government is spying on a brand-new service, it will be six months before anyone knows it for sure.

Another new rule allows companies to also disclose the number of "selectors" – individual data points such as usernames, email addresses, or other identifying information – that the government requested.

In a separate statement [PDF], Apple expressed its approval of the new rules and it updated its own reporting to reflect the new, finer-grained disclosure now allowed.

"We believe strongly that our customers have the right to understand how their personal information is being handled, and we are pleased the government has developed new rules that allow us to more accurately report law enforcement orders and national security orders in the U.S," the statement said.

According to Clapper and Holder, Monday's moves were only the first of several that will be made in response to President Obama's call for surveillance reforms.

"In the weeks ahead, additional steps must be taken in order to fully implement the reforms directed by the President," the Justice Department's statement said.

But it seems unlikely that these reforms will be enough to appease rights organizations such as the American Civil Liberties Union. On Monday, the ACLU issued a statement to the effect that while it approved of the proposed reforms, more must be done.

"Congress should require the government to publish basic information about the full extent of its surveillance," the group said, "including the significant amount of spying that happens without the tech companies’ involvement." ®

Intelligent flash storage arrays

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.