On October 17, the U.S. Office of the Director of National Intelligence (ODNI) released an interim status report on the implementation of Presidential Policy Directive 28 (PPD-28). PPD-28, issued on January 17 of this year in response to public outcry from the Snowden revelations, declared, “all persons have legitimate privacy interests in the handling of their personal information, and it ordered reforms of communications surveillance activities to provide greater protections for non-U.S. persons.
The Directive required ODNI to issue a report by July 2014 updating the President on its implementation. The Report, which has only now been made public, outlines broad principles while adding little by way of meaningful new protections. The few improvements the Report does contain are either optional for the implementing elements of the intelligence community or undercut by broad and sweeping exemptions. Consequently, the ODNI interim report is insufficient to address the broad U.S. surveillance programs that encompass the personal communications and transactions of the rest of the world.
ODNI’s final report is due in January 2015 and must contain concrete, measurable reforms to bring the United States in line with international law and the human rights protections to which all users should be afforded.
New protections
PPD-28 orders significant changes in the way the United States collects and uses intelligence. First, the Directive extends retention and dissemination protections, previously reserved only for U.S. persons, to all users. PPD-28 also places limitations on the use of data collected in bulk to certain categories, including detecting and countering espionage, terrorism, threats to the United States and its interests, and transnational crime.
In implementing these changes, the Report explains that ODNI has introduced a new limitation on the retention and dissemination of “foreign intelligence.” The ODNI Report states that information simply relating to the activities of foreign persons should not be retained or disseminated, as is currently allowed by the definition of “foreign intelligence” in Executive Order 12333. This change moves the U.S. closer toward compliance with the terms of the International Covenant on Civil and Political Rights (ICCPR), an international treaty to which the U.S. is a party. Article 17 of the ICCPR provides a right to privacy for all persons, no matter where they are located, a fact recently affirmed by the United National Office of the High Commissioner on Human Rights.
Despite these limitations, the ODNI Report fails to elucidate reforms on the collection of personal communications, the step in the surveillance process where reform is most urgently needed. Additionally, even the described limits on retention and dissemination only require that foreignness is not the sole basis for the retention or dissemination of their data. This does little to address the plethora of overbroad alternate categories that qualify as “foreign intelligence.” Data on a French grandmother or a Peruvian civil rights activists may still be subject to dissemination and retention for any one of the broad “intelligence requirements” provided for by Executive Order 12333 or otherwise determined to exist.
Failure to live up to promises
Despite the Report’s extension of the geographic coverage of retention and dissemination limitations, those protections, even for US persons, were and remain weak. According to the United States Signals Intelligence Directive 18, unencrypted communications to, from, or about U.S. persons may be retained for 5 years, unless there is an authorized foreign intelligence purpose, at which time the retention limits to not apply. ODNI’s Report states that the Intelligence Community “should consider [this limit] as a default position” for all persons “to the extent consistent with the protection of national security or law enforcement requirements [emphasis added].” This language, already permissive in nature, provides no restriction on the retention of data that executive officials unilaterally determine to impact any vague security interest, a decision that is not subject to congressional or judicial oversight.
Notably, even those few mandated additional protections enumerated in the ODNI Report are frustrated by exceptions and caveats. Perhaps the most important instance of this is the frequent declaration that, “it is important that elements [of the intelligence community] have the ability to deviate from their procedures when national security requires doing so,” which renders large chunks of the Report laughably meaningless. The absence of ongoing reporting requirements exacerbates the problem, failing to provide the public oversight and transparency mechanisms necessary for real reform.
What can be done
The ODNI’s final report should be publicly and fully released, without redactions or delay, when it is issued in January 2015. This final report must make clear that all members of the Intelligence Community have to interpret all enunciated privacy protections broadly and report publicly on their implementation and any notable outcomes.
More generally, the data of non-U.S. persons requires greater protections. In order to comply with the ICCPR, the ODNI must define clear, meaningful, and strong privacy protections for all persons at all stages of the communications surveillance process, from collection through use and deletion. Such protections should include a limited definition of “foreign intelligence,” which increases the standard for surveillance to prevent it from encompassing information that is not relevant to a legitimate aim.
If the ODNI fails to issue a satisfactory final report that lives up to these standards, members of Congress should step in immediately with legislation that respects the rights of global users, recognizes the United States’ international obligations, and provides meaningful protections against unaccountable communications surveillance.