Risk
6/11/2013
01:21 PM
50%
50%

NSA Prism: Patriot Act Author Questions Scope

White House says NSA's surveillance programs implement FISA and the Patriot Act -- but Patriot Act author is not so sure. Meanwhile, privacy groups turn up the heat.

FISC is meant to be a safeguard. Yet the court appears to rubberstamp all such requests; only .03% have been rejected. That's based on annual Justice Department reports to Congress, which said that from 1979 through 2012, out of over 33,900 surveillance requests lodged by the Department of Justice, the court rejected only 11.

"The FISA system is broken," Marc Rotenberg, executive director of Electronic Privacy Information Center -- a privacy rights group -- told the Journal. "At the point that a FISA judge can compel the disclosure of millions of phone records of U.S. citizens engaged in only domestic communications, unrelated to the collection of foreign intelligence ... there is no longer meaningful judicial review."

But Timothy Edgar, a former top American Civil Liberties Union lawyer who joined the Director of National Intelligence in 2006 as a senior civil liberties official, said the process is "definitely not a rubber stamp." He told the Journal that the low level of rejections was down to the extent to which Justice lawyers vet all such requests before submitting them to the FISC.

Similarly, the American Civil Liberties Union (ACLU) and Yale Law School's Media Freedom and Information Clinic Monday filed a motion with FISC, requesting that the court publish its legal opinions "evaluating the meaning, scope, and constitutionality of Section 215."

Do the surveillance programs overreach and violate Americans' privacy? Public opinion appears to favor, slightly, the current course of action. According to a Pew Research Center and Washington Postsurvey conducted from June 6 to 9, in response to the statement that "NSA has been investigating people suspected of terrorist involvement by secretly listening in on phone calls and reading emails without court approval," 51% of respondents said they found it acceptable, while 47% didn't. Meanwhile, 62% said that having the government investigate terrorist threats was more important safeguarding people's privacy, while 34% disagreed.

Several information security experts have suggested that if the surveillance programs are too broad, however, it's not the fault of the intelligence community. "The highest priority at the NSA is avoiding infringing on citizen's rights. I know none of you will believe me, but it's true," said Robert David Graham, CEO of Errata Security, in a blog post. "I'm regularly astonished by the degree to which they bend over backwards to protect [Americans'] privacy."

So if you want to blame someone, says Graham, look to Congress. "The rank and file of the NSA is not your enemy. They carry out the mission that politicians give them, and do not cross the line with an almost religious fervor," he said. "It's the politicians who have moved that line. It's every politician who voted to extend the Patriot Act and empower the FISA court that you have to fight."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
6/13/2013 | 11:36:51 AM
re: NSA Prism: Patriot Act Author Questions Scope
Now Sensenbrenner is disturbed? Programs like Prism are EXACTLY what the Patriot Acts were intended for. So Sensenbrenner is one of the authors (or more correctly, someone who let someone else write everything and he slapped his name on it) and he has no clue which broad antidemocratic, unconstitutional powers the Patriot Acts include? Maybe before anything else is done we need to make sure that naive and delusional politicians are removed from Congress.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2329
Published: 2015-08-31
Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not properly handled by ...

CVE-2014-2330
Published: 2015-08-31
Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other unspecified impact via unknown ...

CVE-2014-2331
Published: 2015-08-31
Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

CVE-2014-2332
Published: 2015-08-31
Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

CVE-2014-2570
Published: 2015-08-31
Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.