Until now, intelligence analysts have been able to "query" the database so long as they've determined a given phone number is subject to "reasonable, articulable suspicion." Critics have said that gives the NSA too much power to snoop on people. So Obama is going to require that whenever an analyst wants to query the database, they'll have to get permission from the secret Foreign Intelligence Surveillance Court first. The FISA court has not previously been in the position of approving individual requests.
When the NSA does query the database, they can't go as far.
Given a certain phone number, the NSA is currently allowed to look at any phone number that is connected to the first, any number that is connected to that number, and any number that is connected to that number. It's what people in the industry call the "three hops" rule, for the three degrees of separation from the original number. Effective immediately, however, analysts will now be limited to making just two hops. It'll limit the range of people who will potentially fall under the NSA's gaze.
The phone records database may be put in the hands of a third party.
This is a longer-term change that won't take effect immediately. President Obama's advisers are going to have 60 days from Friday to recommend how to move the database away from government control. There are a few ways this could happen: 1) The data are held by the phone companies rather than being handed over; 2) the intelligence community relies on "existing programs and capabilities [...] to map terrorist connections," as a senior administration official put it Friday; or 3) some other idea.
It's not clear whether the second idea would mean getting rid of the database entirely. A cynic might worry that the database simply gets handed to another government agency. But officials Friday seemed to indicate otherwise.
"The bottom line is, we are ending the program as it currently exists," a senior administration official said. "The government will no longer hold this telephony metadata."
Obama will ask Congress to convene a panel of public advocates to represent consumers before the FISA court.
The members of this panel, to be drawn from civil liberties, technology and privacy advocates, will be given security clearances and other benefits. Their job will be to represent Americans, but only when the FISA court faces "novel issues of law," according to a senior administration official. In other words, those advocates will become involved when the FISA court encounters a question or type of data it hasn't dealt with before. But officials Friday weren't clear about whether they would be called in by the court or if they could weigh in of their own volition.
What don't these reforms cover?
These reforms are narrowly targeted at the NSA's phone metadata program under Section 215 of the Patriot Act. They don't cover other programs the government carries out under Section 215, such as the reported scraping of financial information by the CIA. They don't address the NSA's counter-encryption activities or any geolocation information that the NSA may have or may be collecting. They also don't address other programs like those conducted under Section 702 of the FISA Amendments Act, which is the authority under which PRISM operates. Some of the reforms, both on the telephony metadata surveillance and others that the President is announcing today, require an act of Congress, and given the Senate's general support for the NSA throughout the controversy, it's unclear how much traction these proposals will get. Much of the spying that happens internationally will also remain untouched.
Additional reforms aside from those affecting Section 215 include: Deciding not to spy on "dozens" of foreign heads of state or heads of government. Some protections applied to U.S. citizens abroad will also now be applied to foreign nationals. And companies will be able to make more disclosures about government data requests, including on National Security Letters, which will no longer be secret "indefinitely."