Computer World – by John Ribeiro
The Central Intelligence Agency on Wednesday updated rules relating to the collection, retention and dissemination of information on Americans, including putting a limit of five years on holding certain sensitive data and introducing restrictions for querying the data.
The announcement by the spy agency comes a few days before President-elect Donald Trump takes charge, and could address concerns expressed by civil rights groups about the collection and handling of information on Americans in the course of overseas surveillance. Such information is collected by the CIA under Executive Order 12333.
Earlier this month CIA Director John Brennan and Attorney General Loretta E. Lynch approved the new rules, called the Attorney General Guidelines, to update the CIA’s procedures, some of which had not been significantly updated since 1982, the agency said in a statement. The new rules come into force on March 18.
Under the new rules published online, unevaluated information is presumed to include incidentally acquired information concerning Americans. Unevaluated information, such as nonpublic telephone and electronic communications, including communications in electronic storage, acquired without the consent of a person who is party to the communications, must be destroyed no later than five years after the information was made available to the agency.
Unevaluated information anticipated to have “U.S. Person Identifying Information” that is significant in volume or sensitivity shall also be subject to the same rules. The five year limitation can be extended in certain circumstances such as an imminent threat to human life, with certain procedures and authorizations to be followed first.
The new rules also place limits on the querying of such data. Queries of particularly sensitive data sets, such as the contents of communications, must be accompanied by a statement explaining the purpose for the query when retrieving information concerning an American, the agency said.
The CIA is also trying to collect less data. “Today, in addition to traditional intelligence scenarios, a single storage device may contain the equivalent of millions of pages of information, hours of video, thousands of photos, or more,” the agency said in its statement.
The Attorney General Guidelines require the agency to take steps to limit information collection to the smallest subset of data necessary to achieve its intelligence objectives, which would also mean fewer instances of accidental collection of information of U.S. citizens in unevaluated data.