Senate Panel Presses N.S.A. on Phone Logs

At a Senate Judiciary Committee hearing, the chairman, Patrick J. Leahy, Democrat of Vermont, accused Obama administration officials of overstating the success of the domestic call log program. He said he had been shown a classified list of “terrorist events” detected through surveillance, and it did not show that “dozens or even several terrorist plots” had been thwarted by the domestic program.

“If this program is not effective it has to end. So far, I’m not convinced by what I’ve seen,” Mr. Leahy said, citing the “massive privacy implications” of keeping records of every American’s domestic calls.

At the start of the hearing, the Obama administration released previously classified documents outlining the rules for how the domestic phone records may be accessed and used by intelligence analysts. And as senators debated the program, The Guardian published on its Web site a still-classified 32-page presentation, apparently downloaded by Edward J. Snowden, the former N.S.A. contractor, that describes a separate surveillance activity by the agency.

Called the XKeyscore program, it apparently gives N.S.A. analysts access to virtually any Internet browsing activity around the world, data that is being vacuumed up from 150 foreign sites.

Together, the new disclosures provided additional details on the scope of the United States government’s secret surveillance programs, which have been dragged into public view and public debate by leaks from Mr. Snowden, who remains stranded in a Moscow airport.

The hearing came a week after the House voted narrowly to defeat an amendment to shut down the N.S.A.’s domestic phone record tracking program. The 217-to-205 vote was far closer than expected, and it — along with shifting poll numbers — suggested that momentum against the domestic program was building. In recent days even some of the most outspoken supporters of the program have said they are open to adjusting it.

The Obama administration has been trying to build public support for its surveillance programs, which trace back to the Bush administration, by arguing that they are subject to strict safeguards and court oversight and that they have helped thwart as many as 54 terrorist events. That figure, Mr. Leahy emphasized, relies upon conflating another program that allows surveillance targeted at noncitizens abroad, which has apparently been quite valuable, with the domestic one.

Still, Senator Dianne Feinstein, the California Democrat who is chairwoman of the Senate Intelligence Committee, said she supported overhauling the program but keeping it in place because it generates information that might prevent attacks.

John C. Inglis, the deputy director of the N.S.A., said there had been 13 investigations in which the domestic call tracking program made a “contribution.” He cited two discoveries: that several men in San Diego were sending money to a terrorist group in Somalia, and that a suspect who was already under scrutiny in a subway bomb plot was using a different phone.

Robert S. Litt, the top lawyer in the Office of the Director of National Intelligence, testified that the Obama administration was also “open to re-evaluating this program” to create greater public confidence that it protects privacy while “preserving the essence of the program.” Administration officials have emphasized that the program collects only so-called metadata, and not the contents of phone calls.

Still, the top Republican on the committee, Senator Charles E. Grassley of Iowa, asked skeptical questions about the legal basis for the program while criticizing the director of national intelligence, James Clapper, for making inaccurate statements to Congress about it in March. Mr. Clapper has since apologized.

“Nothing can excuse this kind of behavior from a senior administration official of any administration, especially on matters of such grave importance,” Mr. Grassley said.

A series of slides describing XKeyscore, dated 2008, make it clear that the security agency system is collecting a huge amount of data on Internet activity around the globe, from chats on social networks to browsing of Web sites and searches on Google Maps. The volume of data is so vast that most of it is stored for only three days, although metadata — information showing logins and server activity, but not content — is stored for a month. Several of the pages were redacted by The Guardian.

Some of the servers the agency uses are run by foreign intelligence services of friendly nations, including Britain, Australia, Canada and New Zealand, but other servers may be on the soil of countries unaware the agency is mining Internet “pipes” on their soil. Some of the harvesting of data takes place on the coasts of the United States, and along the Mexican border. Most sites are in Europe, the Middle East, and along the borders of India, Pakistan, and China.

As Europe Presses Google on Antitrust, U.S. Backs Away

BRUSSELS — Google seems on its way to coming through a major antitrust investigation in the United States essentially unscathed. But the outlook is not as bright for Google here, as the European Union’s top antitrust regulator prepares to meet on Tuesday with Eric E. Schmidt, Google’s executive chairman.

In the United States, the Federal Trade Commission appears to be ready to back off what had been the centerpiece of its antitrust pursuit of Google: the complaint that the company’s dominant search engine favors the company’s commerce and other services in search queries, thwarting competition.

Yet in a statement last spring, Joaquín Almunia, the competition commissioner of the European Union, placed the contentions about search bias at the top of his list of concerns about Google. And in a private meeting this month, Mr. Almunia told Jon Leibowitz, chairman of the F.T.C., that European antitrust officials remain focused on that issue, according to two people told of the meeting, who asked not to be identified because they were not authorized to speak about it.

Mr. Almunia’s tougher bargaining stance, antitrust experts say, is not merely a personal preference.

European antitrust doctrine, they say, applies a somewhat different standard than United States law does. In America, dominant companies are given great leeway, if their conduct can be justified in the name of efficiency, thus consumer benefit. Google has consistently maintained that it offers a neutral, best-for-the-customer result.

In Europe, antitrust experts say, the law prohibits the “abuse of a dominant position,” with the victims of the supposed abuse often being competitors. “The Europeans tend to use competition law to level the playing field more than is the case in the United States,” said Herbert Hovenkamp, an antitrust expert and law professor at the University of Iowa. (Mr. Hovenkamp advised Google on one project, but no longer has any financial connection to the company.)

The European rationale, legal experts say, is that shielding competitors to some degree preserves competition and enhances consumer welfare in the long run.

“Europe has a stronger hand to play with Google because of its standards,” said Keith N. Hylton, a professor at the Boston University School of Law.

The European antitrust regulators, like their American counterparts, have been in negotiations with Google for several months. The F.T.C. is expected to announce its decision within days, while the European timetable seems not as tight and is likely to go into next year.

The investigations in the United States and Europe really started with accusations of search bias. Rivals complain that the search giant gives more prominent placement and display for its online shopping and travel services, for example, than to competitors. The potential antitrust concern is that such specialized, or “vertical,” search services — like Yelp or Nextag — are partial substitutes for Google’s search engine because they also allow people to find information.

In his public statement in May, Mr. Almunia identified four areas of concern in Europe’s antitrust investigation of Google. The first concern he cited was search bias.

“Google displays links to its own vertical search services differently than it does for links to competitors,” Mr. Almunia said in a statement then. “We are concerned that this may result in preferential treatment compared to those of competing services, which may be hurt as a consequence.”

His other three concerns are ones that Google is preparing to address with a set of voluntary commitments in the United States, according to two people briefed on Google’s talks with the F.T.C., who declined to give their names because they were not authorized to speak about them.

Google, according to the people, has agreed to refrain from copying summaries of product and restaurant reviews from other Web sites and including them in Google search results, a practice known as screen scraping.

James Kanter reported from Brussels and Steve Lohr from New York. Claire Cain Miller contributed reporting from San Francisco.

Europe Presses Google to Change Privacy Policy

In a letter to Google, the regulators stopped short of describing the company’s 10-month-old data collection policy as illegal. But it noted that Google did not appear to adhere to Europe’s approach to data collection, which requires explicit prior consent by individuals and that the data collected be kept at a minimum.

The regulators couched their requests as “practical recommendations.” But when asked what regulators would do if Google did not accede and make changes, Jacob Kohnstamm, head of the Dutch data protection authority, said national regulators probably would take legal action to compel changes.

“After all, enforcement is the name of the game,” Mr. Kohnstamm said.

The request was made at a news conference in Paris by the French regulator, known as CNIL, or the National Commission for Computing and Civil Liberties, which was enacted on behalf of all European data regulators.

Google announced the new policy in January, billing it as a way to streamline and simplify the privacy practices it employed worldwide across about 60 different online services, and to introduce greater clarity for users

Google informed customers of its services, which include Gmail, Google Maps and YouTube, of the changes until they took effect in March, requiring them to agree to them in order to access their accounts.

European regulators voiced their concerns almost immediately and CNIL conducted an inquiry that lasted semonths.

Isabelle Falque-Pierrotin, the chairwoman of CNIL, said her agency was giving Google “three to four months” to respond to its concerns.

“If Google does not implement these recommendations, we will pass to a different phase, a phase of sanctions,” Ms. Falque-Pierrotin said.

Enforcement of privacy law in Europe remains a matter for national regulators. In France, CNIL has the legal ability to fine companies as much as €300,000, or about $390,000, for privacy breaches. But it remains unclear whether CNIL will levy a fine and whether other E.U. countries follow suit.

Google said in a statement that it believed that what it calls its privacy policy was legal.

“We have received the report and are reviewing it now,” Peter Fleischer, the Google global privacy counsel, said in the statement. “Our new privacy policy demonstrates our longstanding commitment to protecting our users’ information and creating great products. We are confident that our privacy notices respect European law.”

If adopted, the recommendations could have consequences on some of Google’s main businesses, which depend on consumer profiling for the targeting of advertising.

Jeff Gould, the president of SafeGov, a group based in San Francisco representing companies that sell software and hardware to governments, said Google’s privacy policy is very similar to that used by Microsoft and Facebook.

“Their approach is that we can take anything we learn from you from our services to build a profile of a user to serve targeted ads,” Mr. Gould said in an interview. “My view is that is a completely legitimate model if you give the consumer the opportunity to opt out.”

Google’s current privacy policy requires users to accept it before being able to use the full range of services, Mr. Gould said.

“The Europeans want Google to ask the user to give their consent explicitly and on a much more specific level, to permit the collection of data for targeted ads.”

“If Google did that responsibly, I don’t think it would kill their business,” Mr. Gould said. “But that is the 64,000 Terabyte question.”

In the letter sent to Google, the European data regulators said Google’s new policy allowed the company to “combine almost any data from any services for any purpose.”

“Google did not set any limits to the combination of data nor provide clear and comprehensive tools allowing its users to control it,” the letter said.

The regulators also noted that Google failed to tell the French investigators how long it kept certain kinds of data, despite being asked to.

The group asked Google to make several specific changes to give consumers more awareness and control over their data, including an interactive online presentation of how the data is used.