J. G. Sandom ~ Author

404 — Obama admits DNI Clapper's fault over false Senate testimony ... but lets him off with a scolding

General James Clapper must go! If this man is above the law, it makes a mockery of the whole legal system . . . just as Obama made a mockery of the system and our country's values by failing to prosecute those in the IC who used torture — even if they were ordered to do so by senior officers. (Remember the Nuremberg trials: "I was ordered to do so," doesn't automatically get you off the hook.) People make mistakes; we are only human. But that doesn't mean we should escape the consequences of those mistakes. In this case, Clapper should have recused himself from answering Senator Wyden's questions during the open session. Of course, that would have implied that warrantless mass surveillance (under the PRISM program) was going on. Yes, Wyden forced his hand — and I'm glad he did, just as I'm glad whistleblower Ed Snowden forced the NSA's hand. But that, IMHO, was and is a Senator's job. REMEMBER: THEY WORK FOR US! The country — and our Constitution — is better off as a result. Check out this story from The Guardian.

James Clapper, director of national intelligence, listens as he testifies on Capitol Hill in Washington this week.

Obama admits intelligence chief fault over false Senate testimony

President continues to defend James Clapper in the face of calls for his resignation after 'untruthful' statement about bulk collection

Spencer Ackerman in Washington

President Barack Obama has said his director of national intelligence, James Clapper, ought to have been “more careful” in Senate testimony about surveillance that Clapper later acknowledged was untruthful following disclosures by Edward Snowden.

But Obama signaled continued confidence in Clapper in the face of calls for the director to resign from members of Congress who warn of the dangerous precedent set by allowing an intelligence chief to lie to legislative bodies tasked with overseeing the powerful spy agencies.

“Jim Clapper himself would acknowledge, and has acknowledged, that he should have been more careful about how he responded,” Obama told CNN’s Jake Tapper in an interview that aired on Friday.

Clapper has apologized to the Senate intelligence committee for testifying in March 2013 that the US government does “not wittingly” collect data on millions of Americans.

The answer was shown to have been untruthful when the Guardian published a top-secret court order from Snowden that showed the NSA was collecting the phone records of millions of US citizens.

In explaining his answer, the director first said he gave the “least untruthful” answer he could in an unclassified setting. Later he changed his story to say that he had forgotten about an authority claimed by the government under the Patriot Act to collect the records of every phone call sent and received in the US.

But in his first iteration of his explanation, delivered to NBC’s Andrea Mitchell, Clapper suggested that he believed the question was an unfair “'when are you going to … stop beating your wife' kind of question”,suggesting that he gave a deliberate answer to senator Ron Wyden. 

Obama suggested he accepted Clapper’s initial explanation as an excuse for untruthful testimony.

“His concern was that he had a classified program that he couldn't talk about and he was in an open hearing in which he was asked, he was prompted to disclose a program and so he felt that he was caught between a rock and a hard place,” Obama told Tapper.

“Subsequently, I think he's acknowledged that he could have handled it better.” [NOTE: Really? You think?]

Wyden has pushed back hard against the suggestion his question was unfair. His staff has pointed out that they informed Clapper’s office before the hearing that the senator would press the issue about bulk data collection, and asked afterward for Clapper’s staff to correct the record. No correction came.

Additionally, Wyden’s March 2013 question was spurred by a request from the senator for the NSA and Clapper’s office to publicly correct another misleading public statement in an unclassified setting, this one made by the NSA director, Keith Alexander, in July 2012 to the Def Con hacker conference in Las Vegas.

“I will tell you that those who would want to weave the story that we have millions or hundreds of millions of dossiers on people is absolutely false,” Alexander said in response to a moderator question.

For months afterward, in letters to the NSA and to Clapper’s office, Wyden sought a public correction, since, as a member of the Senate intelligence committee, Wyden was aware the NSA was collecting the records of every domestic phone call on a daily basis. Members of the committee are prevented by classification rules from disclosing what they learn in closed session.

At the most recent Senate intelligence committee hearing this week, Wyden again pushed Clapper on the untruthful statements. He said Americans’ trust in the intelligence agencies “has been seriously undermined by senior officials' reckless reliance on secret interpretations of the law and battered by years of misleading and deceptive statements that senior officials made to the American people. These statements did not protect sources and methods that were useful in fighting terror. Instead, they hid bad policy choices and violations of the liberties of the American people.”

Clapper’s lawyer, Robert Litt, wrote a letter to the New York Times editorial board earlier this month about the incident, denying that Clapper lied.

“I spoke with a staffer for Senator Wyden several days later and told him that although Mr Clapper recognized that his testimony was inaccurate, it could not be corrected publicly because the program involved was classified,” Litt wrote earlier this month.

Although Clapper’s defenders have said the director could not have requested to answer Wyden in closed session, lest he appear to tacitly confirm a classified program, that was the approach Clapper took during his testimony to the intelligence panel this week.

Clapper told Wyden that he would respond in closed session to questions on the NSA’s collection of data in transit across the global communications infrastructure and on whether the agency has ever exercised an authority it “sought and obtained” to conductwarrantless searches on “specific” Americans’ identifying information in its databases of foreign internet communications.

“I think at a threat hearing I would prefer not to discuss this, and have this as a separate subject,” Clapper said.

“This committee can’t do oversight if we can’t get direct answers,” Wyden said, ultimately receiving a commitment for a public answer from Clapper within 30 days.

While Clapper’s job has been safe for months, six members of the House of Representatives wrote to Obama on Monday calling for the director’s resignation.

Clapper’s continued service is “incompatible with the goal of restoring trust in our security programs and ensuring the highest level of transparency,” wrote the congressmen led by Representative Darrell Issa, a California Republican who chairs the oversight and government reform committee, and who is a fervent administration critic.

“I am actually confident that we can continue to have the best intelligence service in the world, but win back the confidence of both the American people, as well as folks overseas,” Obama told Tapper.

404 — In order to spy on domestic dissidents, just call them "terrorists", says former CIA director

Betty Medsger’s new book on the Citizens’ Commission to Investigate the FBI, “The Burglary”, contains some relevant and largely suppressed history about how former CIA Director Helms urged his agents to call political dissenters "terrorists", and exposes the historical gambit leveraged by intelligence agencies when they feel a domestic surveillance program (e.g. COINTELPRO or MHCHAOS) is about to be exposed: Say it's been stopped, and then hide its activities under another name. Check out this fascinating story from Privacy SOS. (See also this story from 2005 when the FBI went after various groups—such as Greenpeace, People for the Ethical Treatment of Animals (PETA) and the American-Arab Anti-Discrimination Committee (ADC)—using non-violent protests and civil disobedience to express political dissent by simply labeling them "domestic terrorists".) For more on the Media FBI burglary, click here.

Former CIA director: In order to spy on domestic dissidents, just call them Terrorists

Back in 2012, the ACLU of Massachusetts published a report called ‘Policing Dissent’, exposing the Boston Police Department’s ‘red squad’ surveillance operations, directed at antiwar and economic justice organizers. Among the documents we obtained through a public records lawsuit were so-called ‘intelligence reports’ from the Boston police fusion center, the Boston Regional Intelligence Center (BRIC). These documents shocked the public. In files labeled “HOMESEC-DOMESTIC”, “GROUPS-CIVIL DISTURBANCE”, and “GROUPS-EXTREMISTS”,  detectives described the entirely peaceful activities of groups and individuals ranging from Veterans for Peace and CodePink to Howard Zinn and a former city council member.

While the BPD files didn’t explicitly call these non-violent activists ‘terrorists’, detectives working at a so-called ‘counterterrorism fusion center’ came about as close as they could get to doing so without spelling out the T word in black and white. But it's no secret that other law enforcement agencies jumped that shark long ago. In recent years, undercover informants have infiltrated antiwar movements targeted as "domestic terrorists". While the past decade's terror wars have given local, state, and federal law enforcement seemingly endless funds to pursue activists simply for challenging government policy, the US government's conflation of peaceful dissent with terrorism has a long history in the United States, dating back at least to the 1970s.

Betty Medsger’s new book on the Citizens’ Commission to Investigate the FBI, “The Burglary”, contains some relevant and largely suppressed history. In the wake of the Media, PA burglary and the subsequent newspaper articles exposing J. Edgar Hoover’s red squad surveillance programs, some CIA officers began to voice dissent internally about their own agency’s troubling domestic operations, codenamed MHCHAOS. In 1972, Medsger writes, CIA director Richard Helms

called his top aides together and said he was adamant that MHCHAOS would not be “stopped simply because some members of the organization [the CIA] do not like this activity.” He made changes in order to protect the program more now that the [dissident officers were] so determined to have it end. To the maximum extent possible, within the agency, the program and the agent then in charge of it, Richard Ober, would be identified with terrorism and not with American dissidents. The massive program would in fact have the same functions it always had, including the monitoring and destruction of the more than five hundred alternative newspapers staffs it had under surveillance. (At the same time, the FBI also monitored alternative and campus newspapers, sometimes suppressing them.)

Henceforth, Colby wrote in a memorandum after that meeting, the label “international terrorist” would replace “political dissident” as the target of the CIA’s illegal domestic operations. As part of this image transformation, Helms did what Hoover had done many times—and would do again in April 1971 to protect COINTELPRO when he thought it was about to be revealed—to minimize the possibility that secret operations would be exposed. Helms ended MHCHAOS in name, but continued it in reality with a new name: International Terrorism Group. It would be much easier for people, including people within the CIA, to accept the domestic operations if they thought they were aimed primarily at stopping terrorism rather than at stopping dissent.

It's common to hear law enforcement officials describe non-violent activists as terrorists today. History suggests we can thank former CIA director Richard Helms for that, at least in part. Years after his agency's assassinations, anti-dissent programs, antidemocratic coups, and other dirty tricks were exposed to the public in congressional hearings during the 1970s, Helms reportedly said that all of it was "just a congressional firestorm over nothing," Medsger writes.

The CIA's domestic operations offices are currently based in Denver, Colorado. Per an executive order signed by Ronald Reagan in 1981, the CIA is allowed to collect information about Americans. The details of the order are classified, so we can't be sure, but it's a safe bet to assume that if the agency wants to spy on American dissidents, it just calls them Terrorists.

404 — When you get a message, "You are registered as a participant in a mass disturbance," you know you should have used a Blackphone

Here's a cool story from The New Yorker about a new phone designed for the surveillance age, the ominously named Blackphone (kid of like Black Water!). A must-have if your conversations absolutely, positively have to be secure—but be wary of those apps. 

Blackphone’s primary selling point is that its “PrivatOS” operating system and Silent Circle software provide easy-to-use, end-to-end encryption for text messaging, phone calls, and video chats, tech that make it difficult, if not impossible, to spy on conversations.

A Phone for the Age of Snowden

Posted by Joshua Kopstein

Around midnight on Tuesday of last week, people near the barricaded city square at the center of mass protests in Kiev, Ukraine, received an ominous text message: “Dear subscriber, you are registered as a participant in a mass disturbance.”

The message was most likely sent by the Ukrainian government using what’s popularly known as an “I.M.S.I. catcher”—a controversial tool that disguises itself as a cell-phone tower so that nearby devices connect to it, revealing their locations and serial numbers and, sometimes, the contents of outgoing messages. It was a bleak reminder of how cell phones, one of the past decade’s most indispensable and ubiquitous pieces of technology, can silently leave their owners exposed to governments and high-tech criminals.

A number of companies have emerged in the post-Snowden world peddling products that claim to protect from that kind of unwanted surveillance. One of the most promising, a smartphone explicitly designed for security and privacy, called Blackphone, comes from a respected team of cryptographers. The device is a collaboration between Silent Circle, a security company co-founded by the cryptography pioneer Phil Zimmermann, and GeeksPhone, a Spanish startup that manufactures tinker-friendly handsets.

Blackphone’s primary selling point is that its “PrivatOS” operating system and Silent Circle software provide easy-to-use, end-to-end encryption for text messaging, phone calls, and video chats, using techniques pioneered by Zimmermann that make it difficult, if not impossible, to spy on conversations. The encryption scheme, which scrambles the contents of each message or call so that only the designated recipient can understand them, is designed based on the assumption that the cellular network and other devices are fundamentally untrustworthy.

Secure phones aren’t entirely novel, but they have, in the past, been either difficult to obtain or difficult to use. The N.S.A. developed some of the first encrypted telephone systems, like the Secure Telephone Unit, a safe-size, multi-thousand-dollar device that was released in the nineteen-seventies. More recently, the agency released blueprints for a secure Android phone called Fishbowl, though it’s hard to imagine who would use the device now. A German company called GSMK has also been producing a series of secure phones, called CryptoPhone, for a number of years. Like the Blackphone, the CryptoPhone uses a “hardened” operating system that makes the device more difficult to hack, but its programming code is available for anyone to look at, allowing its security to be independently verified by experts. (Blackphone is promising to release its source code at some time in the future, but right now its creators say their priority is making sure the phone ships.)

While there aren’t many technical details yet available, Blackphone seems to be reaching for a more mainstream audience by leveraging a consumer aesthetic that you might call “surveillance-state chic.” Its promotional video is awash in dystopian imagery: a hooded figure, dressed head-to-toe in black, navigates a dense urban sprawl, as surveillance cameras watch. “Technology was supposed to make our lives better,” the narrator gravely intones. “Instead, we have lost our privacy. We have become enslaved. Now, it’s time for a change.”

Some of the privacy advocates I’ve spoken with worry that using “black” or “dark” as a predominant sensibility sends the wrong message. These motifs “sound l33t, cool, and anarchistic, but that’s not the branding our goal needs,” said Brennan Novak, a designer who works on privacy software. “Having private conversations should not have the stigma of potentially dangerous and illegal activity attached to it.” Other services that use similar branding include Dark Wallet, a tool that promises to provide private Bitcoin transactions, and Dark Mail, a secure email system being developed by Silent Circle and the defunct Webmail provider Lavabit.

Perhaps more alienating is the fact that the level of privacy that Blackphone promises comes at a premium: in many ways, Blackphone is a vessel for Silent Circle’s existing subscription service, which has a monthly fee and requires both parties to install the apps in order to communicate completely securely. The company’s chief technology officer, Jon Callas, told me that he estimates that Blackphone’s up-front price will be less than the cost of the latest iPhone (six hundred forty-nine dollars) and will include a Silent Circle subscription for new customers. But, he emphasized, users will also be able to install other privacy apps and services, switch carriers, or load an entirely different operating system.

“They are selling expensive services and hardware to people who can afford it, and they are building silo’d communication systems,” said Nathan Freitas of the Guardian Project, a group that builds free privacy apps for smartphones and tablets. The group also makes pre-configured software that runs on commercial handsets from manufacturers like LG and Samsung, which it bundles with training and documentation that it sells to human-rights organizations at cost. Freitas’s goal, however, is to build a privacy layer that will work on any smartphone—even the cheap, plastic ones “available in the corner shop,” he said.

Still, Silent Circle has seen its subscriber base expand since the Snowden revelations. When I asked Callas whether Blackphone is meant for security-savvy professionals or for average people, he described his customer as “in between, or maybe a bit of both.” Blackphone’s advantage, he said, is that it makes encryption tools and privacy the default experience. “It would please me to no end if someone wrote an article on how to lock down and secure Android, and the cookbook ended with, ‘Or you could just buy a Blackphone,’ ” he told me.

At the end of the day, even a phone that provides completely secure texting, calling, and video chat offers users limited protection. The N.S.A.’s metadata program, which collects the phone records of virtually every American, and was declared illegal by a federal oversight board, gets its data from carriers, not from individual handsets. In a speech about the N.S.A., President Obama proposed changes to the program, but made clear that its core capabilities would remain intact. At the same time, a new Transparency Report shows that Verizon received requests for U.S. customer data from law enforcement more than three hundred and twenty thousand times in 2013; only eleven per cent of the demands included probable-cause warrants.

Meanwhile, data such as a phone’s location, as well as personal information accessed through “leaky” apps, are sent to cell towers as part of a phone’s normal functioning. A new report from the Guardian reveals that U.S. and U.K. intelligence agencies have been collecting data transmitted to third-party ad networks by “free” mobile apps like Angry Birds, which can include users’ age, location, sexual orientation, and other personal details. Surveillance tools, like the I.M.S.I catchers that the Ukrainian government probably used against protesters, can collect data about all of the devices around them—sometimes even when the devices are turned off. In other words, no matter how secure the smartphones themselves may be, the apps that people most want to download, and the networks they most want to use, continue to be vulnerable.

Yet even if Blackphone’s innovations reside purely in marketing, as some suspect, it might still represent a tiny step forward for mobile privacy. If it succeeds, said Freitas, “that could be all that is really needed for this type of solution to break through to a wider, mainstream market.”

Joshua Kopstein is a cyberculture journalist from New York City.

404 — A look at the new NSA chief, Vice Admiral Mike Rogers

Here's a decent story from The New York Times about the NSA's new chief, a Navy expert on cyberwar, Vice Admiral Michael S. Rogers.

Vice Adm. Michael S. Rogers in 2012.

N.S.A. Choice Is Navy Expert on Cyberwar

By DAVID E. SANGER and THOM SHANKER

WASHINGTON — In nominating Vice Adm. Michael S. Rogers as the new director of the National Security Agency on Thursday, President Obama chose a recognized expert in the new art of designing cyberweapons, but someone with no public track record in addressing the kinds of privacy concerns that have put the agency under a harsh spotlight.

Mr. Obama’s decision to pick a military officer, rather than a civilian versed in civil liberties issues, was made weeks ago, when he rejected his own advisory panel’s recommendation that the N.S.A. and the United States Cyber Commandhave separate leaders. By law the command, the Pentagon’s four-year-old cyberwarfare organization, must be headed by a military officer.

The result is that Admiral Rogers, now the head of Fleet Cyber Command, the Navy’s fast-growing cyberunit, will find himself in the public cross hairs in a way he has never been during a 33-year military career. Starting with his confirmation hearings, expected to begin as soon as next month, the admiral will be pressed on how he would carry out a series of changes that Mr. Obama announced two weeks ago.

But many of the biggest issues, including who will hold the vast database of phone call information and online activity of ordinary Americans that the N.S.A. searches for potential terrorists or nuclear proliferators, remain undecided. And Mr. Obama has deferred decisions on recommendations, also from advisers, that the N.S.A. stop its efforts to weaken commercial encryption and limit its activities to exploiting weaknesses in commonly available software to design cyberweapons.

“Mike’s now flying right into the hornet’s nest of the stuff the president didn’t decide,” said one senior adviser to the president. “And it’s all going to play out in public.”

It already has: The N.S.A.’s programs have been flayed by civil libertarians, sharply criticized by Silicon Valley companies that say their business is being undercut and denounced by American allies that have been routinely spied on.

As it made its widely expected nomination of Admiral Rogers, the administration announced its choice for deputy director of the agency: Rick Ledgett, the N.S.A. official who has been heading the task force assessing the damage done by the revelations of Edward J. Snowden, the former agency contractor. It will clearly be Mr. Ledgett’s job to put in place a series of internal changes designed to prevent a repeat of what officials have called the biggest leak of secret data in American history and to deal with its continuing effects.

Mr. Ledgett generated headlines weeks ago when, in an interview on the CBS News program “60 Minutes,” he said “it’s worth having a conversation” about giving Mr. Snowden amnesty from prosecution in return for a full accounting of what he took from the N.S.A.’s Hawaii office, and where the remaining, unpublished, data is.

The White House immediately rejected the idea of an amnesty, but Attorney General Eric H. Holder Jr. said recently that he would be open to talking about some kind of deal for Mr. Snowden if he returned from Russia.

If confirmed, Admiral Rogers will succeed Gen. Keith B. Alexander, who has served as N.S.A. director for nearly nine years and was the first to direct both the civilian spy agency and the Cyber Command. He announced last year that he would retire in March. Since then Admiral Rogers has been considered the most likely successor, because of his experience in code-breaking — the reason the N.S.A. was created by President Harry S. Truman six decades ago — and his understanding of the design of America’s new arsenal of cyberweapons.

Mr. Obama interviewed the admiral for the job last week, though the president left it to Defense Secretary Chuck Hagel, traveling in Poland on Thursday, to announce the appointment. Mr. Hagel pointed to the challenges the new director will face in a statement, saying, “Vice Admiral Rogers would bring extraordinary and unique qualifications to this position as the agency continues its vital mission and implements President Obama’s reforms.”

He added, “I am also confident that Admiral Rogers has the wisdom to help balance the demands of security, privacy and liberty in our digital age.”

A statement issued minutes later by the director of national intelligence, James R. Clapper Jr., made no reference to proposed policy changes at the N.S.A. or the need to conduct the kind of balancing Mr. Hagel referred to — a reflection, perhaps, of the arguments Mr. Clapper has made internally that many of the proposals undercut the N.S.A.’s ability to protect the country.

Admiral Rogers’s appointment would clearly be welcomed in the military intelligence community, where he is regarded as a trusted insider. He began his career not in intelligence or electronics, but in traditional surface warfare. He was commissioned via the Naval Reserve Officer Training Corps after graduating from Auburn in 1981, and worked in combat naval gunfire support, serving in operations off Grenada, Beirut and El Salvador.

But in 1986, after five years in the service, he made a leap that prepared him for the post he is now likely to take up: He began specializing in cryptology, and trained in both electronic and information warfare. A number of assignments to various warships and carrier strike groups followed, taking him to United States and NATO missions in the Balkans and in Afghanistan.

Eleven years ago, as the United States was invading Iraq, he joined the military’s prestigious Joint Staff, which works for the Joint Chiefs of Staff. He specialized in computer network attacks — what today is called cyberwar — and subsequently served in a series of senior staff positions that put him in the midst of the issues facing the Joint Chiefs.

In 2007, he moved to become director of intelligence for the military’s Pacific Command, where China and its tremendous cybersurveillance abilities are a priority. Two years later he became director of intelligence for the Joint Chiefs of Staff, and then was named commander of the Fleet Cyber Command, with responsibility for all of the Navy’s cyberwarfare efforts.

“I know of no other naval officer as deft as he in synthesizing seemingly disparate bits of information into a cohesive whole,” said a senior military officer, who would not speak on the record about a pending nomination. “He connects dots. Some people see the details and can describe them for you. Rogers sees the details and can tell you a story.”

The White House would not specifically say what part of Admiral Rogers’s background appealed to Mr. Obama, but his experience in cyberwarfare was undoubtedly a major element, according to people who have dealt with both the president and his nominee. From his first days in office, Mr. Obama was secretly immersed in America’s biggest offensive cyberattack mission, a program named Olympic Games that was aimed at Iran’s nuclear infrastructure.

It is unclear if Admiral Rogers was involved in that operation. But if he is confirmed, the country’s growing arsenal of cyberweapons will be under his command. He will also inherit dozens of new cyberteams, based on the military’s Special Forces, created by General Alexander to provide cybersecurity for the military and launch cyberattacks.

David E. Sanger reported from Washington, and Thom Shanker from Warsaw.

404 — Edward Snowden Nominated For Nobel Peace Prize

According to NPR, NSA whistleblower Ed Snowden has been nominated for the Nobel Peace Prize. Fantastic!

Edward Snowden, seen here in a photo provided by The Guardian, has been nominated for the Nobel Peace Prize by two Norwegian politicians.

Edward Snowden Is Nominated For The Nobel Peace Prize

by BILL CHAPPELL

Saying that Edward Snowden has "contributed to a more stable and peaceful world order" by exposing U.S. surveillance practices and forcing a new debate over security and privacy, two Norwegian politicians nominated the former intelligence contractor for the Nobel Peace Prize Wednesday.

If he were to win the award, Snowden, who gave a trove of classified documents to media outlets last summer, would join the ranks of popular Nobel Peace laureates such as Martin Luther King Jr., Nelson Mandela, and Mother Teresa.

The nomination comes from two Socialist Left Party members: former environment minister Baard Vegar Solhjell and Snorre Valen. Their letter to the Norwegian Nobel Committee was reported by Agence France-Presse.

Earlier today, Snorre Valen posted the nominating letter on a Norwegian site, including a version in English.

While the two Norwegians say they don't condone all of Snowden's actions, they say they're "convinced that the public debate and changes in policy that have followed in the wake of Snowden's whistleblowing has contributed to a more stable and peaceful world order."

The revelations of broad and powerful spying techniques that target electronic communications "have in effect led to the reintroduction of trust and transparency as a leading principle in global security policies," they write. "Its value can't be overestimated."

If you're wondering how Nobel nominees are chosen, so were we.

"A nomination for the Nobel Peace Prize may be submitted by any person who meets the nomination criteria," according to the Nobel website. Those criteria include members of national assemblies and governments, as well as university professors (a Swedish professor nominated Snowden for the award last year, but not until after the deadline, AFP says).

The website also notes what seems to be the only restriction regarding who can be nominated: "A nomination for yourself will not be taken into consideration."

The deadline for all Nobel Peace Prize nominations is February. The names will be pared down to a short list in March and May. The winner of the 2014 award will be announced in October.

Snowden's name came up today in Washington, where Director of National Intelligence James Clapper called for the former contractor and the journalists who received secret documents from him to give them back. As Eyder wrote for The Two-Way earlier today, the director said that unauthorized disclosures of classified material "continue to pose a critical threat."

"Snowden claims he's won and that his mission is accomplished," Clapper told the U.S. Senate Intelligence Committee, according to Reuters. "If that is so, I call on him and his accomplices to facilitate the return of the remaining stolen documents that have not yet been exposed to prevent even more danger to U.S. security."

Days before Clapper spoke on Capitol Hill, Snowden discussed the spy chief in an interview with German TV, as The New York Times reports:

"According to the transcript of the interview, Mr. Snowden cited previous testimony from Mr. Clapper, in March of last year, as a prime factor in his decision to leak information to the public about the agency's work. 'I would say sort of the breaking point was seeing the director of national intelligence, James Clapper, directly lie under oath to Congress,' Mr. Snowden said. 'There's no saving an intelligence community that believes it can lie to the public and the legislators who need to be able to trust it and regulate its actions. Seeing that really meant for me there was no going back.'"

404 — FBI Dir Comey acknowledges for first time that the bureau does not need warrant to obtain Americans’ cell site location info

FBI Director James Comey acknowledges for the first time publicly that the bureau does not need a warrant to obtain Americans’ cell site location information from carriers in intelligence investigations. We know where you are and we don't need no stinkin' judge telling us it's okay that we know where you are. Check out this story in The Washington Post.

Director of National Intelligence James Clapper, center, and other security agency officials testify on Capitol Hill on Jan. 29. "No," DNI Clapper should have said, "I really am telling you the truth this time. Honest."

U.S. intelligence director calls on Snowden to return NSA documents

By Greg Miller

The nation’s spy chief called on former intelligence contractor Edward Snowden to return a massive trove of classified documents on Wednesday during a congressional hearing on security threats that was dominated by heated exchanges over that security breach and the surveillance programs subsequently exposed.

Speaking before a Senate panel, James R. Clapper Jr., outlined an array of dangers to American interests including a rise in cyber threats and the emergence of Syria as a magnet for Islamist militants linked to al-Qaeda.

But after skimming through those developments, Clapper focused his opening remarks on Snowden, delivering a blistering stream of criticism in which he described the former contractor for the National Security Agency as a hypocrite who has severely undermined U.S. security.

Clapper said the documents exposed by Snowden have bolstered adversaries, caused allies to curtail cooperation with the United States, enabled terrorist groups to alter the ways they communicate, and put lives of U.S. intelligence operatives at risk.

“Snowden claims that he has won and that his mission is accomplished,” Clapper said. “If that is so, I call on him and his accomplices to facilitate the return of the remaining stolen documents that have not yet been exposed to prevent even more damage to U.S. security.”

Clapper did not clarify what he meant by “accomplices,” or whether he was referring to journalists who have received documents from Snowden. A spokesman said Clapper was “referring to anyone who is assisting Edward Snowden to further threaten our national security through the unauthorized disclosure of stolen documents related to lawful foreign intelligence collection programs.”

There were a number of sharply worded exchanges during the annual worldwide threat hearing — an ordinarily sober discussion — turning it into a platform for U.S. intelligence officials and some of their critics in Congress to vent months of pent-up frustration with the Snowden fall-out.

At one point, Sen. Ron Wyden (D-Ore.) decried what he described as a “culture of misinformation” among U.S. intelligence officials, cataloguing misstatements and falsehoods that had been exposed by Snowden.

Trust in those agencies “has been seriously undermined by senior officials’ reckless reliance on secret interpretations of the law and battered by years of misleading and deceptive statements,” Wyden said.

Among the most pointed examples was Clapper’s testimony before the same committee last year that U.S. spy agencies did not gather data on millions of Americans. Months later, Snowden’s disclosures showed that the NSA had secretly compiled a database containing the phone records of nearly every American.

The recriminations over Snowden come as President Obama has pledged to end the NSA’s collection of such records, and underscored the extent to which Snowden-related damage control has been a major distraction for spy agencies struggling to keep up with rapidly shifting security threats.

U.S. officials on Wednesday warned that political turmoil in the Middle East was accelerating the atomization of the al-Qaeda terrorist network, with offshoots gaining strength in Syria, Yemen, Iraq and Egypt.

Clapper said that Syria has attracted about 7,000 fighters from as many as 50 nations beyond its borders, including a steady flow from the Middle East and Europe. The trend has alarmed counterterrorism officials, raising concern that militants trained and indoctrinated in Syria might use their Western passports to carry out attacks against the United States or its allies.

Syria is “in some respects a new FATA,” Clapper said, referring to the tribal belt of Pakistan where al-Qaeda has been based for more than a decade. One of the leading militant groups in Syria, known as al-Nusra, “does have aspirations for attacks on the homeland.”

His concern was echoed by senior lawmakers, including Sen. Dianne Feinstein (D-Calif.), the chairman of the Senate Select Committee on Intelligence, who noted that the friction among Islamist groups in Syria had become “so dire that even al-Qaeda’s central leader . . . has denounced the activities of one group as too extreme to countenance.”

A spike in violence in Iraq has brought the number of attacks there to levels not seen since U.S. forces left in 2011, U.S. officials said.

They also warned of a spike in threat reporting associated with the upcoming Olympic Games in Sochi, Russia. Citing extensive security at the Olympic venues, Matthew Olsen, director of the National Counterterrorism Center, said “the greater threat is to softer targets in the greater Sochi area, and in the outskirts.”

On Iran, Clapper warned that a move by Congress to impose new sanctions could unravel a deal reached last year to ease economic penalties on Tehran in return for shutting down key parts of its nuclear program. North Korea, meanwhile, has expanded its uranium enrichment facility, he said, and restarted a plutonium reactor, following through on recent threats to resume nuclear weapons work.

U.S. officials repeatedly refused to answer questions about U.S. surveillance programs, citing their classified nature. Still, the hearing produced new hints about secret capabilities not exposed by Snowden.

Sen. Mark Udall (D-Colo.) noted that the CIA is banned from domestic spying and searches of Americans inside the United States, but asked CIA Director John Brennan if he could assure the committee does not engage in such operations.

“I can assure the committee that the CIA follows the letter and the spirit of the law in terms of what CIA’s authorities are,” Brennan said in a carefully worded reply.

Wyden, who works closely with Udall on intelligence matters, asked Brennan whether the CIA abides by a separate anti-hacking statute that makes it a crime to break into a network without authorization. “I would have to look into what that act actually calls for and its applicability to CIA’s authorities,” Brennan said.

Though far smaller than the NSA, the CIA’s Information Operations Center has for more than a decade carried out operations to penetrate adversaries’ networks, but is supposed to do so only overseas. 

Separately, FBI Director James Comey acknowledged for the first time publicly that the bureau does not need a warrant to obtain Americans’ cell site location information from carriers in intelligence investigations.

Instead, it relies on a lower standard that agents have reason to believe the data sought would be “relevant” to an authorized investigation. That may not be true for all types of location data, however. The Justice Department has stated that its policy in criminal probes is to require a warrant for the more precise GPS data, when investigators want it prospectively, in real-time.

U.S. officials defended the NSA’s collection of Americans’ phone records, which a federal judge and separate White House advisory panels have said violates the Constitution and has been of little use in detecting terror plots.

Comey said he understood privacy concerns about the program, but said it helps the bureau assess whether there is a broader terrorist cell or network in the United States in the aftermath of an attack like the bombing of the Boston Marathon. “It allows us to do in minutes what would otherwise take us in hours,” Comey said.

Ellen Nakashima contributed to this report.

404 — Terror suspect finally gets chance to challenge constitutionality of Section 702, warrantless mass surveillance

Here's a great story from Ellen Nakashima in The Washington Post about the first "with standing" challenge to Section 702 of the Patriot Act, the clause that authorizes the NSA to conduct warrantless mass surveillance.

Jamshid Muhtorrov of Aurora was arrested Jan. 21, 2012 in Chicago, accused of providing and trying to provide material support for the Islamic Jihad Union, which the U.S. State Department has designated as a terrorist organization.

[Read the challenge from Muhtorov]

Terrorism suspect challenges warrantless surveillance

By Ellen Nakashima

A Colorado man facing terrorism charges became on Wednesday the first criminal defendant to challenge the constitutionality of the National Security Agency’s warrantless-surveillance program.

Jamshid Muhtorov, a refugee from Uzbekistan, filed a motion in federal court in Denver to suppress any evidenceobtained from the surveillance on grounds that it was unlawful.

“Mr. Muhtorov believes that the government’s surveillance of him was unlawful for the simple fact that it was carried out . . . under a statute that fails to comply with the Fourth Amendment’s most basic requirements” that the government obtain a warrant and that the monitoring be reasonable, his attorneys said in a 55-page document.

Muhtorov’s case is likely to be the first in which a court weighs the constitutionality of a law that has stoked controversy since it was passed in 2008 as a revision to the Foreign Intelligence Surveillance Act. The issue ultimately could be decided by the Supreme Court.

Known as Section 702 of the FISA Amendments Act, the law enables the government to monitor communication targeting foreigners. It previously had been challenged, but last year the Supreme Court dismissed a case brought by a group of lawyers, journalists and human rights activists, stating that the plaintiffs could not prove they had been subject to the surveillance.

Muhtorov, however, in October became the first defendant to be notified by federal prosecutors that evidence from the warrantless-surveillance program was used in his case. That notice essentially gave him standing to mount a legal challenge.

In a related development in a different terrorism case, a federal judge in Chicago for the first time ordered that a defense lawyer be allowed to review classified evidence obtained under FISA. In the law’s 36-year history, no defense attorney has ever been permitted to view such material, with courts deferring to government arguments that to do so would harm national security.

But in an order issued Wednesday, Judge Sharon J. Coleman said, “This court believes that the probable value of disclosure and the risk of nondisclosure outweigh the potential danger” of allowing the attorney, with proper clearances, to see the material.

The case involves a Chicago man, Adel Daoud, 20, who is accused of plotting to bomb a bar. His trial is scheduled for April.

“The adversarial process is integral to safeguarding the rights of all citizens,” Coleman wrote, “including those charged with a crime.”

In the Colorado case, Muhtorov, 37, is charged, along with another man, of attempting to provide material support to the Islamic Jihad Union, an Uzbek group designated as a terrorist organization; its members, the government says, have trained with and provided support to al-Qaeda. Muhtorov is not accused of plotting an attack on American soil. He has pleaded not guilty.

The Justice Department declined to comment on either the Muhtorov or Daoud cases.

Muhtorov, a legal permanent resident, was arrested in January 2012 and is being held pending trial. According to a criminal complaint, he said he was “ready” to die for the group’s cause. If convicted, he faces 15 years in prison.

The evidence against Muhtorov consists of e-mails and phone calls intercepted in 2011. At least one e-mail exchange is allegedly with an account linked to the Islamic Jihad Union. But the government has not told him which communications it obtained without a warrant, and whether they were used as the basis for subsequent warrant applications.

Muhtorov’s attorneys argue that the 2008 law grants powers “far more sweeping than the authority that the government” has exercised with the traditional court order under FISA, which requires a warrant from a judge and a finding that the target is an agent of a foreign power.

They argued that the Supreme Court has emphasized that a surveillance statute is reasonable only if it is precise and discriminate. The FISA Amendments Act “is anything but,” said the lawyers from the federal public defender’s office and the American Civil Liberties Union.

The 2008 law was passed in the wake of controversy over the revelation that the George W. Bush administration had since 2001 conducted a program of warrantless surveillance exclusively under executive power. The law authorized the government to collect large amounts of e-mails and phone calls from U.S. phone and Internet companies without showing probable cause that each target is a foreign agent. As long as the individual is “reasonably believed” to be located overseas, and a court has signed off on the targeting procedures, no individual warrant is required. The decision on whom to target is left to the intelligence agencies.

“The absence of an individualized suspicion requirement means that the government can engage in the wholesale collection of U.S. persons’ international communications,” the attorneys wrote.

The government also can search communications into and out of the United States for information about targets — not just to or from targets — as long as it believes that those targets are overseas, the lawyers argued, citing documents leaked by a former NSA contractor, Edward Snowden.

Intelligence officials have argued that the program is legal and effective. They credit it with having helped thwart dozens of terrorist plots at home and abroad. “It continues to be one of our most important tools for the protection of the nation’s security,” Director of National Intelligence James R. Clapper has said.

They point to rules that protect the privacy of Americans whose communications are collected either inadvertently or because they were in contact with a foreign target.

Muhtorov’s attorneys cited a 2011 ruling, declassified by Clapper last year, that showed concern by the Foreign Intelligence Surveillance Court about a government pattern of “substantial misrepresentation regarding the scope of a major collection program.” In the case of Section 702, the court found that the NSA had been using the law to collect e-mails that were not related to the targeted address and that the “volume and nature of the information” was “fundamentally different from what the Court had been led to believe.”

“We’ve learned over the last few months that the NSA has implemented the law in the broadest possible way, and that the rules that supposedly protect the privacy of innocent people are weak and riddled with exceptions,” ACLU Deputy Legal Director Jameel Jaffer said in a statement. “Surveillance conducted under this statute is unconstitutional, and the fruits of this surveillance must be suppressed.”

Muhtorov’s challenge has its roots in the case rejected by the Supreme Court last year. In deciding to dismiss, the Supreme Court relied upon the assurance by the U.S. solicitor general that the government would notify criminal defendants when it had used evidence from the surveillance.

But the solicitor general at the time did not know that the Justice Department had a policy to conceal such evidence from defendants. He learned of it only after some criminal defendants sought clarification of remarks that Senate Intelligence Committee Chairman Dianne Feinstein (D-Calif.) made in late 2012 that the government had used evidence from warrantless monitoring in certain cases. The department reversed its policy last year.

404 — Scoble says Nokia's Trapster goes too far over privacy line

I must agree with Rob here. This is creepy. You can just imagine the mayhem you could cause with this knowledge, and how easy it would be to identify the one walking the line.

Trapster shows where people walk inside stores and in parking lots.

Here you can see a user, Paraminder, drive to work on Trapster.

Trapster potentially shares personal info with everyone, including user names. Not dangerous here, but matched up with blue lines on other screen shots it certainly is.

Nokia’s Trapster is too far over the freaky line

Robert Scoble

Why trust is the new currency in the Age of Context, and why Nokia lost it here.

In the Age of Context lots of companies will go over the freaky line. What is that line? Where at least some people are uncomfortable with the privacy implications of the service. At EVERY speech I’ve given about our new book privacy comes up and people tell me they are scared by this new world that we’re heading into where systems like Google Now help you based on all sorts of private data, from where you are standing to who has sent you airline plans.

But there are some “over the freaky line” concerns that are actually valid because they could put users into real harm. I believe this is one such case.

Figuring out where the freaky line is is one of a product designer’s top jobs in 2014 (and really this falls on corporate leadership in the CEO and CMO office, which increasingly will gain power over the IT budgets in the future, I believe).

Lately I’ve been looking at location-based services to make sure I didn’t miss anything that is important in the Age of Context we’re headed into (if you haven’t read the book Shel Israel and I wrote about the future of mobile, titled “Age of Context,” you really should because it’ll get you up to speed on how data from location, social, mobile, and sensors are being fused together and what this means for the future of privacy) and I looked back at Trapster. I thought it might have been killed by now, in the shadow of Waze, which, at least in San Francisco area, does a LOT better job (Waze is now owned by Google and some of the data reported by users on Waze now shows up on Google Maps but that data doesn’t come close to the freakiness of what Trapster shares with other people).

But Trapster is still alive and is being pushed by Nokia. Trapster still has a team with a budget of millions of dollars per year being poured into it by Nokia and dozens of employees. In fact, on April 30, 2013, on the Trapster blog it shows they have 30 employees.

What I found, though, scared me and showed me a company too far over the freaky line to be safe. Trapster is similar to Waze in that it lets drivers report cops, accidents, and other hazards which are shared with other drivers. I hadn’t used Trapster in a while because Waze has thousands of times more users in San Francisco and cities I’ve tried both on. Waze isn’t over the freaky line the way Trapster is which you’ll see in a moment.

Here’s what’s going on: Trapster shows your driving behavior on other people’s mobile phones as a blue line. A traceable path. Waze doesn’t do that, Trapster does. The blue line is there to show people that someone has just driven there and hasn’t reported any cops or other driving problems. The thing is this blue line sticks around for hours (I believe two, in my testing) and can be captured as a friend did on my account. He called me after I reported a cop and said “hey, did you just make a U Turn?”

Why yes I did. “Oh, how did you know that?” I asked. “I’m watching you on Trapster.”

Turns out that because Trapster has so few users it’s easy to “stalk” individual users based on these blue lines (I have several examples of where friends of mine and me have “stalked” users as they drive around town in real time). Especially if they use their real name as their user name, like I do. But even if not, if you know where someone lives or works you can easily figure out who different blue lines belong to. I did this to one employee who works at Trapster as I watched him drive home. These blue lines even continue after you stop driving and I can see what stores you visited and where you walked, even.

Competitor Waze doesn’t do that and when I’ve talked with Waze officials they tell me they are careful not to show your car exactly where it is in real time to other drivers, either, to keep stalkers from “attaching” themselves to you and following you around. In fact, in my testing, Waze obfuscates your real location in a pretty deep way and doesn’t show you at home or at work. Trapster, on the other hand, starts sharing your blue line as soon as you get up to about 35 miles per hour and shows everywhere you go, see screen shots below for more.

This is a case where a product designer hasn’t put enough privacy into the system and isn’t clear enough with the risks involved.

I’m getting more and more attuned to this problem because of all the speeches I’ve given because of the book I wrote. Yesterday, for instance, I talked with product designers at Expedia (company that helps travelers with their plans), and they are feeling pressure to come up with new cool location-based features, but that team is very focused on privacy fears because they know that many people will switch products because of lack of trust and aren’t willing to take huge risks in order to put new features in place. The conversations I’m having with companies like Expedia and Ford and Ritz Carlton execs show that privacy is a HUGE concern in corporate world because they know that it could piss off rafts of customers if they get it wrong.

The thing is they know there is value in going over the freaky line too and are watching as companies like Uber ask customers to share a HUGE amount of location data in order to build new billion-dollar businesses. Uber knows where you are standing, for instance, a few years ago THAT would have been “over the freaky line” for a limo company to ask for. But Uber doesn’t share that data with the public so isn’t nearly as freaky as Trapster is (and Uber even takes other steps to protect privacy and make it hard to stalk people who use its service. For instance it uses the Twilio API to obfuscate phone numbers from your driver).

What do I recommend to companies to make sure they gain trust when doing over the freaky line stuff?

1. Disclose EVERYTHING you are doing to gather data. Visit Google, for instance, at its privacy site at http://google.com/privacy — it shows everything it collects on you. I couldn’t find clear wording on Trapster’s info screens, privacy policy, terms of use that your location will be shared with other people. Plus, even after your blue lines disappear, we aren’t sure whether that data is kept on Trapster’s servers and for how long. What happens to that data? Is it given over to government authorities (I bet it will be turned over if a court order is received).

2. Make the data correctable. If it made a false assumption, make that correctable too. One app noticed I live on a golf course and kept showing me info about golf. I hate golf. Don’t have any interest in playing or lessons but there was no way to shut the app up. Same thing on Trapster. Once I realized my data was being shared in public I couldn’t correct it to make it to my liking. I couldn’t hide my blue line when I got close to things I might care about keeping private, like my son’s schools, my home, or my work.

3. Let me turn it off. I couldn’t figure out how to make it not share my blue line with others in Trapster’s case. Maybe there’s a setting somewhere I missed, but I couldn’t find it and if I can’t find it other users can’t find it either. With such “freaky” data, though, that could lead to really nasty consequences product designers have to be far more careful in order to gain my trust.

That’s the rub. By doing something freaky and not putting me in control (and not giving me enough utility to make being that far over the freaky line worth it) Nokia has lost my trust.

I no longer believe that Nokia is a company that can properly guide us into the age of context and that should be frightening to executives at that company since they no longer have the phone business to fall back on. Nokia should be leading us into this new age where even Mercedes is building a contextual car and Nokia should be showing all of us how to go over the freaky line in a responsible, trusted, way.

This is why Google has gotten so many scared with its acquisitions of robot, artificial intelligence, and home automation companies recently. What new risks to our lives will show up because of all of this surveillance-era technology? We don’t yet know and are looking to companies to carefully build new products that have great utility with a minimum of risk to us personally.

This lack of care with over-the-freaky-line privacy features from a company as important as Nokia is definitely troubling. Here’s some screen shots that show why Trapster is over the freaky line.

404 — Driverless cars ripe for hacking warns expert re Internet of Things to Come

Yet another scene right out of my forthcoming novel, 404, where a car is hacked for nefarious purposes—death. Check out this story in The Guardian.

Google's self-driving car

Self-driving cars irresistible to hackers, warns security executive

Researchers have already hacked a normal car, so how what are the risks once self-driving cars reach our roads?

Alex Hern

 

Self-driving cars will prove an irresistible target for hackers if they ever hit the roads, a top security executive has warned.

Speaking exclusively to the Guardian, Eddie Schwartz, the vice president of global security solutions for Verizon's enterprise subsidiary, said that the cyber-security industry is still 40 years from maturity, and that the first half of the 21st century will see the number of targets increase exponentially.

"All of the major automobile manufacturers are working on self-driving cars," Schwartz explained. "For cars to be able to self-drive, they have to be able to negotiate with each other. You can't negotiate something like that without having some security principles behind it. So cars have to do basic things that we do with each other, like recognise each other – authentication.

"OK, I authenticate to you, that means there has to be an underlying artefact, a certificate or something like it that says 'you're an authorised car, and I'm an authorised car, therefore we can exchange this information really fast.' And you stop and I turn.

Schwartz described "a million applications" in the car industry alone designed for machine-to-machine communications with potentially a million underlying security issues.

Even normal cars are susceptible to hacking attacks. In August, a pair of researchers demonstrated attacks on a Ford SUV and Toyota Prius which enabled them to slam on the brakes, jerk the steering wheel, or accelerate the car using a laptop plugged into the the diagnostics port.

In 2011, a different team of researchers managed to penetrate similar systems through bluetooth, mobile data and even a malicious audio file burned onto a CD played in the car's media player.

But self-driving cars have many more avenues of communication with the outside world, and – definitionally – less oversight from a driver to correct any errors.

A ransom for your medical data?

As well as self-driving cars, Eddie Schwartz cautioned that the entire field of machine-to-machine communications, also known as "the internet of things", presents an enticing target to hackers.

"How many IP-based [internet connected] devices does the average person have in their home today? Most people can't even count them. If you ask them, they would probably say 'oh, I have two computers and a whatever', but the reality is it's probably more like 20 to 30 if they start thinking about it… You're going to see a spill from 4 or 5bn IP devices to hundreds of billions over the next 10 years."

Schwartz cautioned that with the growth of new devices and services in the health space the potential for malicious hacks will grow exponentially, including devices that gather intimate personal medical data.

"These are going to be embedded solutions. It's going to be wireless communications or NFC. These are machine-to-machine communications, and for critical care, they are going to have telemetry going on 24/7.

"There's an underlying security and privacy issue: imagine ransom-ware [software such as Cryptolocker that breaks devices and demands a fee to fix them] in that world."

404 — Big tech cos thrown tech start-ups to the wolves in Admin-TechCo agreement on disclosures

Here's a good story from Nicole Perlroth of The New York Times about how small tech start-ups were hung out to dry in recent TechCo-Admin agreement on disclosures.

Mark Pincus of Zynga and Marissa Mayer of Yahoo were among the technology companies executives who attended a meeting with President Obama at the White House in December.

Did Big Internet Companies Handicap Start-Ups in FISA Rule Changes?

By NICOLE PERLROTH

SAN FRANCISCO — A small but significant caveat in a new agreement brokered between the Obama administration and Google, Facebook, Yahoo and Microsoft could cast a long shadow over America’s technology start-ups.

Intelligence officials agreed only to allow communication providers to disclose more specific information about data sought by government agents because of a new provision that bars companies less than two years old from disclosing such information for a period of two years.

That caveat effectively means that no one will know whether the government is eavesdropping on a new email platform or chat service for two years.

Ladar Levison, the founder of Lavabit, the email service used by Edward Snowden that was the target of a government investigation last year, said the new rules would cast a pall over new technology companies while doing little for the established companies.

“While our courts are allowed to keep ethically dubious court orders secret, it will remain impossible to trust private data to American companies,” Mr. Levison said. “As an American businessman, this reality is terribly upsetting.”

Until now, technology companies were forbidden from acknowledging government requests they received under the Foreign Intelligence Surveillance Act. Now, under the terms of the new agreement, the government will allow companies that are older than two years old to disclose the number of FISA orders they receive in increments of 1,000. They can publish that number in increments of 250, if they lump the number of FISA requests with the number of so-called National Security Letters they receive.

Companies will also be allowed to release the number of “selectors” – user names, email addresses or Internet addresses, for instance – that the government sought information about and will be allowed to publish the information every six months, with a six-month delay.

Because of those amended rules, Google, Facebook, Yahoo and Microsoft agreed to dismiss their lawsuits before the Foreign Intelligence Surveillance Court.

But Mr. Levison said the number of FISA requests was less important than the kind of information sought by each request. If a FISA order asks a company to turn over its source code or encryption keys, for example, one order could affect thousands of users.

“They’re asking companies to do some pretty scary things, well beyond what they would ask for in a normal criminal order and doing it because there is no civilian oversight,” Mr. Levison said. “What we really need is information about the means and methods the government is using to conduct these investigations.”

Other privacy advocates note that though it seems like bigger technology companies are throwing their younger counterparts to the wolves, the belief that there is no legal precedent for Monday’s agreement means start-ups are still free to mount their own legal challenges to disclosure restrictions.

“We were disappointed that the technology companies abandoned their fight in FISC which we believed they were going to win,” said Nate Cardozo, a staff lawyer with the Electronic Frontier Foundation, referring to the Foreign Intelligence Surveillance Court. “The start-ups are still free to raise their own challenges, which, frankly, they would win.”

“The First Amendment goes a lot further than today’s settlement,” Mr. Cardozo added.