The panel said the NSA should be barred from undermining digital encryption, which guards electronic files from prying eyes, and Internet companies should be allowed to make more information public about the number and types of government information demands they receive. The group also called for ending the NSA's bulk collection and storage of data about phone calls, although it was less specific about collecting email and other Internet communications.
It's unclear whether President Barack Obama will embrace the recommendations, which were outlined in a 300-page report released Wednesday, one day after Obama met with top Silicon Valley CEOs and heard their concerns about government surveillance. The president said he'll issue his own proposals next month.
Industry representatives voiced cautious optimism Wednesday, after complaining previously that newly revealed NSA programs have compromised both the privacy of Internet users and the global business of Internet companies by diminishing their customers' confidence that online data is safe from outside prying.
"It seems to make some positive recommendations," said Ed Black, CEO of the Computer and Communications Industry Association, which represents Google (GOOG), Yahoo (YHOO) and Microsoft, among others.
Some Internet activists praised the report. "It is a blueprint for restoring privacy in America," said Marc Rotenberg of the Electronic Privacy Information Center. But others said it skirted key issues.
"We're concerned that the panel appears to allow the NSA to continue the mass collection of emails, chats and other electronic communications of Americans under the pretext that the NSA is 'targeting' foreigners overseas," said Trevor Timm at the Electronic Frontier Foundation.
In outlining its recommendations, the advisory group stressed the importance of protecting the United States from terrorism and other threats. "We're not in any way recommending the disarming of the intelligence community," panelist Michael Morell, a former deputy CIA director, told reporters in Washington, D.C.
But the five-member group, which included legal and security experts, also said the government must protect privacy and civil liberties, which it called "fundamental values that can be and at times have been eroded by excessive intelligence collection."
In a major recommendation, the panel called for the NSA to halt its practice of stockpiling telephone company "metadata," which include the times and duration of millions of Americans' phone calls, but not their content. A federal judge called that program "Orwellian" this week and ordered it to stop, although he stayed his order to allow an appeal.
Government and industry officials, however, said it may be impractical to follow the panel's suggestion of having phone companies keep those same records on file for several years.
The panel made several recommendations for increasing oversight of government surveillance programs by the White House and courts. A group of leading Internet companies including Apple (AAPL), Google, Facebook and Yahoo requested more such oversight in an open letter last week, although they did not propose specifics.
Several of those companies declined to comment Wednesday, except for a joint statement that said they "look forward to a continued dialogue with the White House."
Among other things, the White House panel said court approval should be required for National Security Letters, which the FBI has used to demand customer information and business records without a warrant, under the Patriot Act. It also proposed appointing a "Public Interest Advocate" to argue for privacy and civil liberties in the Foreign Intelligence Surveillance Court, which approves many data-gathering programs.
Addressing another issue that struck a nerve in Silicon Valley, the panel said the NSA should be barred from trying to compromise commercial encryption programs through various means, including persuading industry bodies to adopt weaker standards. Google, Facebook and other Internet companies have invested heavily in encryption to protect users' data against hackers and outside threats.
The panel also urged strict limits on exploiting "zero-day" flaws in commercial software, a reference to vulnerabilities that software makers have not had time to patch.
(c) 2013 the San Jose Mercury News (San Jose, Calif.)
