Internet giants, US gov agree to loosen secrecy of private info slurps

Finer-grained reporting now permitted, sometimes, sort of

The US Department of Justice has agreed to allow internet companies to be more candid about what information they disclose to the government, albeit only slightly.

Facebook, Google, LinkedIn, Microsoft, and Yahoo! are among several companies that have been urging the feds to loosen the secrecy surrounding their data collection practices.

All five had sued the government to change its policies, but on Monday, they issued a joint statement to the effect that they would no longer pursue the matter through the courts.

"We filed our lawsuits because we believe that the public has a right to know about the volume and types of national security requests we receive," the statement read. "We're pleased the Department of Justice has agreed that we and other providers can disclose this information. While this is a very positive step, we'll continue to encourage Congress to take additional steps to address all of the reforms we believe are needed."

In a joint statement of their own, national intelligence head James Clapper and US Attorney General Eric Holder said, in effect, that they were only adjusting their policies because the White House ordered it.

"This action was directed by the President earlier this month in his speech on intelligence reforms," the statement read. "While this aggregate data was properly classified until today, the Office of the Director of National Intelligence, in consultation with other departments and agencies, has determined that the public interest in disclosing this information now outweighs the national security concerns that required its classification."

Not that all that much has changed. Previously, companies had been able to disclose how many so-called National Security Letters they have received but only in increments of 1,000, and they weren't allowed to say how many information requests they received under the Foreign Intelligence Surveillance Act (FISA). The new agreement only alters that somewhat.

Under the settlement, companies can now narrow their reporting to increments of 250, but only if they lump all of the National Security Letters and FISA requests together. If they want to list how many of each kind of request they get separately, they're still limited to reporting them in the thousands.

What's more, companies are restricted to reporting information about government surveillance requests only every six months, and when they do, the data they report must be six months old. In other words, a report issued at the beginning of one year will only cover disclosures made during the first half of the previous year – and if the government is spying on a brand-new service, it will be six months before anyone knows it for sure.

Another new rule allows companies to also disclose the number of "selectors" – individual data points such as usernames, email addresses, or other identifying information – that the government requested.

In a separate statement [PDF], Apple expressed its approval of the new rules and it updated its own reporting to reflect the new, finer-grained disclosure now allowed.

"We believe strongly that our customers have the right to understand how their personal information is being handled, and we are pleased the government has developed new rules that allow us to more accurately report law enforcement orders and national security orders in the U.S," the statement said.

According to Clapper and Holder, Monday's moves were only the first of several that will be made in response to President Obama's call for surveillance reforms.

"In the weeks ahead, additional steps must be taken in order to fully implement the reforms directed by the President," the Justice Department's statement said.

But it seems unlikely that these reforms will be enough to appease rights organizations such as the American Civil Liberties Union. On Monday, the ACLU issued a statement to the effect that while it approved of the proposed reforms, more must be done.

"Congress should require the government to publish basic information about the full extent of its surveillance," the group said, "including the significant amount of spying that happens without the tech companies’ involvement." ®