Following up on an August op-ed by Susan Landau, Bellovin, Blaze, Diffie, Landau, Neumann, and Rexford have come together on an important paper: The Protect America Act passed in August 2007 changes US law to allow warrantless foreign intelligence wiretapping from within the US of any communications believed to include one party located outside the United States. US systems for foreign intelligence surveillance located outside the United States minimize access to the traffic of US persons by virtue of their location. The new law does not—and could lead to surveillance on a unprecedented scale that will unavoidably pick up some purely domestic communications. The civil-liberties concern is whether the new law puts Americans at risk of spurious — and invasive — surveillance by their own government. The security concern is whether the new law puts Americans at risk of illegitimate surveillance by others. We focus on security. If the system is to work, it is important that the surveillance architecture not decrease the security of the US communications networks. The choice of architecture matters; minor changes can have significant effects, particularly with regard to limiting the scope of inadvertent interception. In attempting to collect communications with one end outside the United States, the new law allows the development of a system that will probably pick up many purely domestic communications. How will the collection system determine that communications have one end outside the United States? How will the surveillance be secured?
Risking Communications Security: Potential Hazards of the “Protect America Act” | 
