Presidential Policy Directive 28

Presidential Policy Directive 28
Name	Presidential Policy Directive 28
Date signed	March 2014
Signed by	Barack Obama
Type	Presidential policy directive
Jurisdiction	United States
Subject	Privacy, surveillance, signals intelligence

Presidential Policy Directive 28 is a March 2014 executive instrument issued by Barack Obama addressing limits on signals intelligence collection and use with respect to non-United States persons and allies. The directive sought to balance National Security Agency operational needs with privacy and civil liberties concerns raised by disclosures of surveillance practices involving Edward Snowden, PRISM, and related programs. It articulated principles for protecting privacy in foreign intelligence activities and influenced subsequent dialogues among international partners such as the European Union, United Kingdom, and Germany.

Background

The directive was developed amid global debate triggered by disclosures attributed to Edward Snowden concerning collection programs operated by the National Security Agency, Central Intelligence Agency, and Federal Bureau of Investigation. International reactions from leaders including Angela Merkel, David Cameron, and institutions such as the European Commission pressed the United States to clarify commitments toward privacy and data protection. Domestic pressure from civil liberties organizations including the American Civil Liberties Union, Electronic Frontier Foundation, and members of Congress such as Senator Rand Paul and Representative Jim Sensenbrenner shaped the context for an administrative response. Prior instruments influencing the directive included Executive Order 12333, the FISA Amendments Act of 2008, and guidance from the Office of the Director of National Intelligence.

Content and Provisions

The directive established constraints on signals intelligence activities, emphasizing limits on collection, use, and dissemination with respect to foreign persons and allies. It set out principles such as purpose limitation, minimization, and oversight involving entities like the National Security Council, Office of the Director of National Intelligence, and the Department of Justice. Provisions addressed handling of incidentally collected data concerning persons linked to partners such as the United Kingdom, France, and Germany, and sought to prohibit bulk collection targeting headquarters of foreign governments represented by missions to organizations like the United Nations in New York City. The text directed analysts to employ policies consistent with protections found in instruments such as the International Covenant on Civil and Political Rights and to coordinate with privacy authorities in jurisdictions exemplified by the European Court of Human Rights and national data protection agencies like the Bundesbeauftragte für den Datenschutz in Germany.

Implementation and Impact

Implementation required coordination among intelligence agencies, the Department of Defense, and executive oversight bodies including the Privacy and Civil Liberties Oversight Board. Operationalizing the directive led to updated procedures within the National Security Agency and revisions to oversight practices involving the Foreign Intelligence Surveillance Court and congressional intelligence committees chaired by figures such as Senator Dianne Feinstein and Representative Mike Rogers. The directive influenced bilateral talks with countries including Brazil, Japan, and Mexico over cross-border communications, cloud services operated by corporations like Microsoft, Google, and Apple, and transatlantic agreements such as the Privacy Shield negotiations. It contributed to changes in how signals intelligence products were classified, shared, and declassified in responses involving institutions such as the United Nations General Assembly and the North Atlantic Treaty Organization.

Legal and Policy Context

The directive operated within the legal architecture shaped by statutes and precedents such as the Foreign Intelligence Surveillance Act, decisions by the United States Supreme Court including opinions affecting surveillance law, and executive authorities like Executive Order 12333. It interacted with international legal frameworks associated with the European Convention on Human Rights, trade agreements like the Transatlantic Trade and Investment Partnership debates, and standards promoted by the Organisation for Economic Co-operation and Development on privacy. The directive also reflected policy debates involving legislative measures such as the USA FREEDOM Act and judicial reviews by the Foreign Intelligence Surveillance Court of Review.

Reactions and Criticism

Responses varied across stakeholders: civil liberties advocates including the American Civil Liberties Union and Human Rights Watch welcomed constraints yet criticized the directive as insufficient without statutory reform. Allies such as Germany and France sought stronger, binding assurances; political leaders including Vladimir Putin used disclosures to press geopolitical arguments. Industry groups representing Amazon (company), Facebook, and Verizon Communications advocated for clearer rules affecting transnational data flows. Members of Congress from both parties, including Senator Ron Wyden, questioned transparency and implementation, while intelligence community officials defended the need to retain operational flexibility. Legal scholars referencing work at institutions like Harvard Law School, Yale Law School, and Georgetown University debated whether executive guidance could substitute for legislative safeguards.

Subsequent Developments and Legacy

The directive's principles informed later policy shifts, contributing to reforms such as amendments in the USA FREEDOM Act, negotiation of data transfer frameworks like the EU–US Data Privacy Framework, and evolving declassification practices overseen by the National Declassification Center. It left a legacy in prompting greater public discourse on surveillance governance, influencing academic research at centers like the Berkman Klein Center for Internet & Society and stimulating transnational policy work within the Council of Europe and the G20. While debates over the balance between intelligence collection and privacy persist in venues such as the United States Congress and international fora like the G7, the directive remains a reference point for executive efforts to articulate surveillance constraints and partner assurances.

Category:United States intelligence community Category:Privacy law Category:Barack Obama