Feeds

Tech giants CAN disclose US spooks' data demands - but with heavy restrictions

Related: Apple received just 250 data requests in 2013

Internet Security Threat Report 2014

Apple has announced that it received less than 250 requests for data from US intelligence agencies in the first half of last year after the Obama administration slightly loosened restrictions on disclosing spooks' data requests.

After months of negotiations between the Obama administration and tech firms, from Yahoo! to Facebook, the Department of Justice filed with the secretive Foreign Intelligence Surveillance Court to allow "more detailed disclosures" about the amount of data the government tries to get out of web companies and communications providers.

The change of heart follows a speech earlier this month by President Obama, when he said he would take steps to reform America's intelligence operations. These would include more declassification of future opinions of the surveillance court that have "broad privacy implications".

The new rules allow tech firms to report numbers of national disclosure orders they get listed by the thousand, but with no specifics about the type of data that's requested – and potential delays in disclosure of up to six months.

Agencies also get elbow room on any requests they make to new platforms or services that haven't already been outed as subject to intelligence orders, getting a two-year delay to hide the fact that they're pursuing new avenues of information.

Although companies are able to disclose more information about intelligence orders, they're still restricted by a number of rules - hence the vague report from Apple. The DoJ allows communications providers to report the number of "national security letters" (NSL) - administrative subpoenas typically used by FBI agents to demand data related to national security - received or the number of customer accounts affected by NSLs in the thousands.

Companies are also allowed to report the number of Foreign Intelligence Surveillance Act (FISA) requests for content they get in the thousands, the number of customer "selectors" - meaning identifiable information like email addresses or usernames - in the thousands and FISA orders for "non-content" like metadata, again restricted to the thousands.

But if companies want to narrow the numbers down under a thousand, they have to conflate NSLs and FISA orders into a single number reported in bands of 250 or affected customer selectors in the same bands. Firms are only allowed to report every six months, subject to the six-month or potential two-year delays.

Apple went for the second option in reporting its figures for the six months up to the end of June last year, when it said it got under 250 intelligence orders in total. The company also said that it received 927 law enforcement account requests for information on 2,330 accounts and that data was disclosed on 747 accounts and non-content data was revealed for 601 of the requests.

"The number of accounts involved in national security orders is infinitesimal relative to the hundreds of millions of accounts registered with Apple," the firm said. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.