The Washington PostDemocracy Dies in Darkness

The real winners in the fight over government surveillance

A sign stands outside the National Security Administration (NSA) campus in Fort Meade, Md. (Patrick Semansky/AP)

After the Senate passed legislation aimed at reforming a program that collected data about the phone calls of millions of Americans, Senate Majority Leader Mitch McConnell (R-Ky.) quoted an Associated Press headline calling the bill a "victory for Edward Snowden" and added his own twist: "It is also a resounding victory for those currently plotting attacks against the homeland," he said.

Supporters of the legislation would dispute that argument, pointing instead to the Constitution or the public at large. But there's another group that won big Tuesday night: Tech companies.

"The Internet industry's support for surveillance reform was critical — and exceptional to the extent that until the Snowden revelations, although they had sometimes gotten involved in law enforcement, they'd steered clear of national security since it was such a sensitive topic," said Kevin Bankston, the executive director of New America's Open Technology Institute.

[Congressional action on NSA is a milestone in the post-9/11 world]

A slew of major tech companies were tied to National Security Agency surveillance in some of the first reports sourced to former government contractor Edward Snowden. Reporting and documents released in June 2013 revealed that many of the biggest names in tech, including Google, Facebook, Apple and Microsoft, were part of a program called PRISM that let the spy agency tap into services -- accessing things like chats, documents and e-mails.

Other revelations showed how the agency evaded security measures and infiltrated the links between some companies' data centers.

[NSA Secrets coverage]

This was a major problem for the tech industry, which operates in a global marketplace where its competitiveness depends on customers trusting companies to keep their information safe. "Companies recognized that those tactics -- and news of those tactics — posed a clear and present danger to U.S. tech industry," said Bankston.

So over the last two years, tech companies have been on the defense — waging a campaign to distance themselves from government spying by advocating for surveillance reform and rolling out new protections for in their own systems and at the user level.

And with the passage of the USA Freedom Act Tuesday, they're claiming their first significant policy win.

The bill re-tools a controversial NSA program that sucked up information about Americans' phone calls by moving custodianship of the bulk data from the government to communications companies after a six month transition period, while extending three provisions of the USA Patriot Act that briefly sunset over the weekend. It also provides new transparency measures and limits on the scope of the data the government can via several mechanisms.

Tech companies were enthusiastic about their support for the measure. Reform Government Surveillance Coalition, formed by companies including Apple, Facebook, Yahoo, Google, and Microsoft after the Snowden revelations, signed onto a letter supporting it.

"We were all in," said Jessica Herrera-Flanigan, a spokesperson for the Coalition. The group, its individual members, and other tech industry associations had "too many meetings on the hill to count" in support of the bill, she said.

But the legislation, which has been signed into law by President Obama, was not without controversy. It split privacy groups, with some who wanted to see the Patriot Act provisions stay expired arguing that the bill didn't go far enough — and protected companies complicit in spying.

One section of the law requires the government give companies compensation for "reasonable expenses" incurred while providing information or technical support as required by the statute. Another blocks legal action against companies for complying with the law.

"The bill legalizes mass surveillance of Americans — it pays companies to spy on you and then gives them liability protection so you can't sue them," said Sascha Meinrath, the leader of an independent technology institute called X-lab that was previously associated with New America, in an interview with the Post last month before USA Freedom became law.

Bankston defended the provisions, arguing that they are in "practically every other" similar law that requires companies provide information to the government. Herrera-Flanigan said the group hadn't focused on those issues — instead pushing hard for transparency provisions and an end to government bulk collection.

"There were a lot of folks who wanted to see an expiration of the USA Patriot Act provisions — but the thing [the USA Freedom Act] gave you is some of those transparency mechanisms which went far beyond section 215, the part everyone was focused on because it was expiring," said Herrera-Flanigan.

Some, including Meinrath, worried that once USA Freedom passed, momentum on more comprehensive surveillance reform would dwindle — with tech companies being able to point to the legislative victory to shore up their privacy credibility. "They are making the most marginal pivot possible to restore their brands — what's driving them is not a restoration of civil liberties, it's maximizing profits," he said.

But in comments after the bill was passed, tech companies pointed to continue advocacy on surveillance.

"There is obviously more to do, and with our partners, we will continue to push for greater transparency and privacy protections moving forward,” said Facebook vice president of U.S. public policy Erin Egan in a statement. In a blog post, Susan Molinari, Google vice president for Americas public policy and government relations, said that law is "a critical first step" and the company looks forward to "working with Congress on further reforms in the near future."

However, the exact nature of those next steps are unclear.

A spokesperson for Google declined to comment on what the company saw as the next specific steps for surveillance reform in the U.S., while Facebook spokesperson Jodi Seth said the company would continue working with the Reform Government Surveillance coalition "to focus on remaining surveillance related issues both in the U.S. and globally."

Herrera-Flanigan said the Coalition would continue tackle surveillance as outlined in its founding principles, but did not name a specific target of those efforts.

Bankston is optimistic that Internet companies will continue to push for changes to surveillance policies. "At this point, you have a relatively stable and long term alliance from companies that regularly take potshots on each other on other issues, but have been meeting and collaborating on these issues."

He also pointed to another privacy debate that the Coalition and many tech companies are already engaged in: A fight over whether the government should make tech companies build ways for law enforcement to access secured content into their products.

And privacy has increasingly become a major talking point for tech companies — from Yahoo's pitch to be the most "trustworthy" tech company to Apple chief Tim Cook's denunciation of the data collection-based advertising at the heart of some competitors' business models.

Plus, the legal authority behind the PRISM program that caused so much concern for tech companies when it was revealed wasn't affected by USA Freedom, Bankston said. "This is just the beginning of the fight that will culminate in 2017, when that law is set to sunset," he argued.