NSA Powers Expire as US Rolls Back Surveillance

Rand-Pauls-Patriot-Act-Filibuster-Just-Started.png

The US Senate packed up on Sunday evening without extending the expiring surveillance provisions of the Patriot Act, meaning that—for now, at least—the U.S. intelligence community is without tools that it says are vital to national security, including the National Security Agency's bulk collection of U.S. call data.

Thanks to the stubborn opposition of Sen. Rand Paul and a gamble with the clock by Majority Leader Mitch McConnell that sorely backfired, the Senate failed to deal with the three controversial parts of the post-9/11 act that reached sunset the moment the calendar turned to June.

The lapse appears likely to only last a few days, as lawmakers are expected to pass a White House-supported surveillance-reform bill—the USA Freedom Act—as soon as Tuesday that would revive the spying authorities, but with a host of transparency and oversight reforms tacked on.

Sweeping intelligence capabilities exposed by Edward Snowden shut down as hawks concede defeat on first major surveillance reform in a generation

Sweeping US surveillance powers, enjoyed by the National Security Agency since the aftermath of the 2001 terrorist attacks, shut down at midnight after a dramatic Senate showdown in which even the NSA’s biggest supporters conceded that substantial reforms were inevitable.

Almost two years after the whistleblower Edward Snowden revealed to the Guardian that the Patriot Act was secretly being used to justify the collection of phone records from millions of Americans, critics of bulk surveillance went further than expected and forced the end of a range of other legal authorities covered by the Bush-era Patriot Act as well.

The expired provisions, subject to a “sunset” clause from the beginning of June onwards, are likely to be replaced later this week with new legislation – the USA Freedom Act – that permanently bans the NSA from collecting telephone records in bulk and introduces new transparency rules for other surveillance activities. The USA Freedom Act, once passed, will be the first rollback of NSA surveillance since the seminal 1978 Foreign Intelligence Surveillance Act.

But until then, in addition to the expiration of the NSA’s phone records collection, the FBI is prevented from using powers granted under the Patriot Act, including the pursuit of so-called “business records” relating to internet use, hotel and rental car records and credit card statements.

Both developments represent a remarkable capitulation for the Republican Senate majority leader, Mitch McConnell, who had initially sought to simply extend the Patriot Act provisions, despite overwhelming support in the House of Representatives for the USA Freedom Act. McConnell and his colleagues who opposed reform were thwarted in their efforts by a growing backlash by Senate Republicans and, in particular, his Kentucky colleague, Senator Rand Paul.         

“This is the only realistic way forward,” acknowledged the Republican leader during a rare Sunday evening session just hours before the Patriot Act was set to expire. Shortly after, the Senate voted 77 to 17 to proceed to debate on the USA Freedom Act – a procedural hurdle that fell three votes short during another special session focused on surveillance reform nine days earlier.

The development was welcomed by the White House, which has also come to support the USA Freedom Act after Barack Obama proposed that the NSA could seek specific records directly from telephone companies instead.
“The Senate took an important – if late – step forward tonight,” White House press secretary, Josh Earnest, said. “We call on the Senate to ensure this irresponsible lapse in authorities is as short-lived as possible.”

Even Paul, after the procedural vote, conceded that the bill will now ultimately pass, although he appeared determined to drag it out as a long as possible. “Tonight begins the process of ending bulk collection,” he said. Paul, who is running for president on a libertarian-leaning agenda, believes the USA Freedom Act does not go far enough in tackling the surveillance abuses revealed by Snowden.

“I am not going to take it any more and I believe the American people are not going to take it any more,” Paul said, as he took the Senate floor for another of the extended speeches that have helped propel him into the public spotlight at a key moment in the Republican race for the presidency.

McConnell attempted to seek a temporary extension for additional Patriot Act powers to be affected by the expiration of powers unrelated to the NSA’s bulk domestic phone metadata program – including so-called “lone-wolf” and “roving wiretap” capabilities. But even a temporary continuation of those surveillance authorities were opposed by Paul, who has the power to block such attempts to speed up Senate business by seeking unanimous consent.

Paul’s tactics provoked angry reactions from establishment Republicans, including a heated exchange with John McCain, who accused him of endangering national security to boost his presidential campaign. McCain said on Sunday that Paul “obviously has a higher priority on his fundraising and political ambitions than securing the nation”.
Paul, gesturing toward the acrimony that persists in the Senate even after the vote made passage of the USA Freedom Act a foregone conclusion, said his Republican opponents were rooting for a terrorist attack to embarrass him.
“Some of them I think secretly want an attack on the United States so they can blame it on me,” Paul said.
Obama and his intelligence chief, James Clapper, also made a final push on Friday for the Senate to pass the USA Freedom Act, alleging the expiration of the Patriot Act provisions would expose the US to terrorism.

But a Justice Department inspector general report found the FBI had come to use the business-records provision to amass “large collections” of Americans’ communications data. It noted that the spread of internet access had lead to an explosion in information accessible to the FBI, and cast doubt on Justice Department and congressional assurances that the authority, known as Section 215, is critical for counterterrorism.
“[T]he agents we interviewed did not identify any major case developments that resulted from use of the records obtained in response to Section 215 orders, but told us that the material produced pursuant to Section 215 orders was valuable in that it was used to support other investigative requests, develop investigative leads, and corroborate other information,” the DoJ report found.

Originally mindful of the privacy implications of Section 215, Congress permitted it to “sunset” after five years. Yet, with nearly all aspects of its practical applications hidden under extensive secrecy – especially the post-2006 addition of NSA bulk surveillance – reauthorization of the Patriot Act provisions had become routine.
The last time the legislation was considered, in 2011, it passed 72-23 in the Senate and 250-153 in the House.

But this time, Snowden’s revelations pierced the veneer of government secrecy and ushered in perhaps the most open debate about surveillance powers in the NSA’s 63-year history.
“No doubt it played a role,” Republican senator Dean Heller told the Guardian. “I think it played the same role for me as it did for most of the American people, who were surprised and stunned that the government had this sort of access to this kind of data.”

Nextgov:  http://bit.ly/1LZUvaK
Guardian: http://bit.ly/1GeNnsI

« Edward Snowden Answers Some Questions
Cyber Vulnerability Report 2015 »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

CyberArk Software

CyberArk Software

CyberArk is an established leader in privileged access management and offers the most complete set of Identity Security capabilities.

International Association for Cryptologic Research (IACR)

International Association for Cryptologic Research (IACR)

(IACR is a non-profit scientific organization whose purpose is to further research in cryptology and related fields.

AhnLab

AhnLab

AhnLab provides a range of information security solutions including network security, endpoint security, antivirus and consulting services.

Australian Signals Directorate (ASD)

Australian Signals Directorate (ASD)

The Australian Signals Directorate is an intelligence agency in the Australian Government Department of Defence.

Potomac Institute for Policy Studies

Potomac Institute for Policy Studies

Potomac Institute undertakes research on key science, technology, and national security issues facing society, Study areas include cybersecurity.

HYAS Infosec

HYAS Infosec

HYAS is a highly skilled information security firm developing the next generation of information security technology.

Cybersprint

Cybersprint

Cybersprint's Digital Risk Protection platform continuously monitors your digital footprint so you can make informed decisions on exposure to online threats, identify vulnerabilities and take action.

GreyCortex

GreyCortex

GreyCortex uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

Invensity

Invensity

INVENSITY is an interdisciplinary technology and innovation consulting company. Centres of excellence include Cyber Security and Data Privacy.

OISTE Foundation

OISTE Foundation

OISTE foundation allows users to control their digital identities using well-understood and secure algorithms that ensure the continued validity of an identity and its claims.

Lifetech

Lifetech

Lifetech is a software development, product engineering and system integration company. Cybersecurity services include SIEM deployment and training.

Dutch Institute for Vulnerability Disclosure (DIVD)

Dutch Institute for Vulnerability Disclosure (DIVD)

DIVD's aim is to make the digital world safer by reporting vulnerabilities we find in digital systems to the people who can fix them.

Iconium Software

Iconium Software

DataLenz by Iconium offers continuous and real-time tracking of your data assets delivering you the tools you need to successfully reach and maintain your target security standards.

Nitel

Nitel

Nitel is a leading next-generation technology services provider. We simplify the complex technology challenges of today’s enterprises to create seamless and integrated managed network solutions.

Mediatech

Mediatech

Mediatech, specialized in managed Cybersecurity and Cloud services, a single point of contact for your company's IT and infrastructure.

ZENDATA

ZENDATA

ZENDATA are an innovative provider of intelligent, tailored cybersecurity solutions to global companies and public sector institutions.