On matters of surveillance, source protection, and access to information, there are concrete things the government could be doing but isn't.