Risk
6/11/2013
01:21 PM
Connect Directly
RSS
E-Mail
50%
50%

NSA Prism: Patriot Act Author Questions Scope

White House says NSA's surveillance programs implement FISA and the Patriot Act -- but Patriot Act author is not so sure. Meanwhile, privacy groups turn up the heat.

FISC is meant to be a safeguard. Yet the court appears to rubberstamp all such requests; only .03% have been rejected. That's based on annual Justice Department reports to Congress, which said that from 1979 through 2012, out of over 33,900 surveillance requests lodged by the Department of Justice, the court rejected only 11.

"The FISA system is broken," Marc Rotenberg, executive director of Electronic Privacy Information Center -- a privacy rights group -- told the Journal. "At the point that a FISA judge can compel the disclosure of millions of phone records of U.S. citizens engaged in only domestic communications, unrelated to the collection of foreign intelligence ... there is no longer meaningful judicial review."

But Timothy Edgar, a former top American Civil Liberties Union lawyer who joined the Director of National Intelligence in 2006 as a senior civil liberties official, said the process is "definitely not a rubber stamp." He told the Journal that the low level of rejections was down to the extent to which Justice lawyers vet all such requests before submitting them to the FISC.

Similarly, the American Civil Liberties Union (ACLU) and Yale Law School's Media Freedom and Information Clinic Monday filed a motion with FISC, requesting that the court publish its legal opinions "evaluating the meaning, scope, and constitutionality of Section 215."

Do the surveillance programs overreach and violate Americans' privacy? Public opinion appears to favor, slightly, the current course of action. According to a Pew Research Center and Washington Postsurvey conducted from June 6 to 9, in response to the statement that "NSA has been investigating people suspected of terrorist involvement by secretly listening in on phone calls and reading emails without court approval," 51% of respondents said they found it acceptable, while 47% didn't. Meanwhile, 62% said that having the government investigate terrorist threats was more important safeguarding people's privacy, while 34% disagreed.

Several information security experts have suggested that if the surveillance programs are too broad, however, it's not the fault of the intelligence community. "The highest priority at the NSA is avoiding infringing on citizen's rights. I know none of you will believe me, but it's true," said Robert David Graham, CEO of Errata Security, in a blog post. "I'm regularly astonished by the degree to which they bend over backwards to protect [Americans'] privacy."

So if you want to blame someone, says Graham, look to Congress. "The rank and file of the NSA is not your enemy. They carry out the mission that politicians give them, and do not cross the line with an almost religious fervor," he said. "It's the politicians who have moved that line. It's every politician who voted to extend the Patriot Act and empower the FISA court that you have to fight."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
6/13/2013 | 11:36:51 AM
re: NSA Prism: Patriot Act Author Questions Scope
Now Sensenbrenner is disturbed? Programs like Prism are EXACTLY what the Patriot Acts were intended for. So Sensenbrenner is one of the authors (or more correctly, someone who let someone else write everything and he slapped his name on it) and he has no clue which broad antidemocratic, unconstitutional powers the Patriot Acts include? Maybe before anything else is done we need to make sure that naive and delusional politicians are removed from Congress.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.