White House updates CIA rules for handling Americans’ information

The New York Times

WASHINGTON — The Obama administration has overhauled and lifted a veil of secrecy from rules governing the CIA’s power to gather and use information about Americans, including setting new limits on what it may do with large sets of digital files that might contain private information.

The last time the government issued a comprehensive set of such rules — known as the Attorney General Guidelines because the Justice Department must sign off on them — was during the Reagan administration. They were classified, but some portions became public, as did parts of supplemental procedures added by later administrations.

The Obama administration, after spending the last several years consolidating and rewriting the rules, has issued a new, comprehensive set, and it is making all 41 pages of the rules public.

The CIA director, John Brennan, signed the new rules on Jan. 10, and Attorney General Loretta Lynch signed them on Tuesday. They are set to take effect in mid-March, 60 days after Ms. Lynch signed them.

Benjamin Huebner, the CIA’s privacy and civil liberties officer, said the “biggest change” was the creation of rules for dealing with huge volumes of digital files that have not been evaluated.

Because the digital files make it more likely that the CIA will incidentally collect Americans’ information, he said, the new rules require the agency to purge data that has not been evaluated within five or 25 years, depending on the sensitivity.

Mr. Huebner identified two more rules that did not exist before: more stringent requirements for officials to document their justification when using an American’s name or identifier as a search term when examining a large set of digital files, and a new requirement for periodic audits of such searches to make sure officials are complying with the limits of when such a search is permissible.

The guidelines reveal that CIA operatives may attend conferences or visit internet forums that are generally available to the public. But they need higher-level approval to participate in events or go to places that are not generally open to the public without saying who they are.