Can Some Internet Memes Finally Get Congress To Pass New Legislation To Protect Your Privacy Online?

from the the-last-time-we-reformed-our-privacy-laws... dept

For many, many years, we've been talking about the need for ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is an incredibly outdated piece of legislation from the 1980s that governs law enforcement's ability to access email and other electronic communications. This was the era before the internet was anywhere close to the mainstream (though it did exist). Among the various weird parts of the law, it says that any communication that is over 180 days old and still on a server is considered "abandoned" so that the government can access it without a warrant. Think about that in this era when you keep all your communications online. It was written when lawmakers thought people would "download" the messages off a server. That's just the most noteworthy problem -- there are all sorts of different definitions based on messages that have been opened or not opened and other oddities as well, almost none of which make sense.

Last year we noted that more than half of the House was co-sponsoring a bill put forth by Reps. Kevin Yoder and Jared Polis to reform ECPA in a big way. But even with so many supporting the law, it failed to move. A big hurdle? Both the IRS and SEC (note: not your standard law enforcement agencies) like the fact that they can use ECPA to snoop through electronic communications (without a warrant -- which those agencies can't get on their own anyway).

Yoder and Polis are back again with another attempt, and it's matched by a similar legislation in the Senate from Senators Patrick Leahy and Mike Lee. To get attention for the bill, Yoder, Polis and some other supporters took to Twitter in a bit of a meme fest, highlighting some historical facts to demonstrate just how long it's been since ECPA became law. It's worth scrolling through them all (though, there are a lot), because some are pretty funny:

At this point, it's a complete travesty that such a bill hasn't become law. People have explained the need for it for well over a decade, and more than half of Congress was signed on to co-sponsor it in the last Congressional term. Already this new bill has 228 additional co-sponsors in the House and another 6 co-sponsors in the Senate. The IRS and SEC's objections are simply ridiculous. Having more convenient access to someone's emails is no excuse for not better protecting the privacy of our online communications.

Of course, this isn't the only effort going on to protect privacy. Reps. Zoe Lofgren, Ted Poe and Suzan DelBene have also introduced a bill to update ECPA. It's pretty clear that Congress knows that the law needs to be updated, and it's time to get past whatever objections there are and actually start protecting our privacy.

Filed Under: communications, ecpa, ecpa reform, email, irs, jared polis, kevin yoder, memes, mike lee, patrick leahy, privacy, sec, suzan delbene, ted poe, zoe lofgren

Sen. Rockefeller Sitting On FOIA Improvement Act, Despite Two Unanimous Votes In Favor Of Passage

from the bipartisan-support-meets-gov't-agency-resistance dept

A FOIA reform bill that sailed through both the House (410-0) and the Senate Judiciary Committee (again with a unanimous vote) is currently stalled, having gone nowhere for the past two weeks thanks to Sen. Jay Rockefeller.

The Freedom of Information Act Improvements Act (hereinafter cited as "FOIAIA") helps put the "freedom" back in the FOIA -- something that has a chance to trim down the number of requests that result in fully-redacted pages or federal lawsuits. Rockefeller has expressed some concerns about the openness of the open records law improvements.

"I have a long record of support for open government and the FOIA process. I am concerned that provisions in this bill will have the unintended consequence of harming our ability to enforce the many important federal laws that protect American consumers from financial fraud and other abuses," Rockefeller said in a statement Friday. "According to experts across the federal government, these provisions would make it harder for federal agency attorneys to prepare their cases, and they would potentially give defendants new ways to obstruct and delay investigations into their conduct. I hope there is a way to address these concerns and pass the bill."

The two agencies offering up the most resistance to the bill appear to be the FTC and the SEC, both of which apparently feel the law creates a playground for targets of its investigations.

[S]ources said the agencies' concerns are that the legislation would allow companies to pierce the attorney-client and attorney work-product privileges, potentially giving targets of enforcement actions a roadmap detailing what kind or level of misconduct will trigger action and what kind is likely to be ignored.

There also appears to be a law enforcement contingent pushing for death of this bill as well.

"The bill would statutorily require government law enforcement agencies to withhold documents from a FOIA request only if they first establish that 'the agency reasonably foresees that disclosure would harm an interest protected by' the exemption invoked," said a Rockefeller aide who asked not to be named. "Consequently, the bill could expose law enforcement agencies to needless litigation and drain their already limited resources in defending FOIA decisions that have long been invoked for legitimate law enforcement purposes."

Transparency advocates point out that privileged attorney-client communications will remain privileged even with the passage of the bill and that government agencies will still retain the power to redact information and withhold documents -- they'll just need to start providing better explanations for these actions. As for the concerns about the new "forseeable harm" requirement? That requirement isn't even new.

"Agencies have been required to use this standard since 2009 when Attorney General Holder issued a memo requiring it. Agencies also used this same standard during President Clinton's term. It was only during President George W. Bush's term of secrecy that this standard was rolled back," [Patrice McDermott of OpenTheGovernment.org] wrote.

So, it appears Rockefeller is hoping the whole thing just goes away. The reform bill had already been watered down post-House passage and additional concerns raised by Tom Coburn had been addressed, resulting in him releasing his hold on the legislation late last week. Now, it's up to Rockefeller to do the same. If he doesn't do it by the end of the day on Monday, the bill dies.

As it stands now, Rockefeller is standing alone among his fellow senators and representatives. Two unanimous votes -- one in the House and one in the Senate -- are being negated by a single Senator. Supporters of FOIA reform are urging people to contact his office and make it clear that Rockefeller alone shouldn't get to decide whether this bill lives or dies, especially considering its path to this point.

Sen. Jay Rockefeller
Phone: 202-224-6472
Fax: 202-224-7665
Email: Sen.Rockefeller@opencongress.org
Twitter: @senrockefeller

Filed Under: foia, ftc, hold, investigations, jay rockefeller, sec, transparency

Is It A Shakedown When The Gov't Does It? SEC Much Less Likely To Prosecute You If You're A Big Campaign Funder

from the nice-business-here.-wouldn't-want-to-see-an-sec-investigation-happen-to-it dept

In the past, we've highlighted some questionable activities by the SEC, which is supposed to be stopping financial fraud, but often seems to be both arbitrary and capricious in its activities. However, reporter David Sirota is highlighting how the SEC is much less likely to prosecute a company if that company happens to be a big political contributor, because, well, duh. This is based on some recent research by Maria Correira at the London Business School on Political Connections and SEC Enforcement, which found that there's a pretty clear correlation.

If, as the saying goes, justice is blind, the data would show little correlation between firms' political expenditures and their likelihood of being prosecuted. Instead, Correira found that "politically connected firms are on average less likely to be involved in an SEC enforcement action and face lower penalties if they are prosecuted by the SEC." Specifically, Correira discovered that firms that increased their PAC contributions by $1 million over five years ended up halving their probability of being prosecuted.

Yes, correlation is not automatically causation, yada yada, but that doesn't mean there isn't a causal relationship here. I guess it's possible one could argue that a company that increases its PAC contributions is somehow less likely to be also engaged in financial shenanigans, but I'm not sure anyone would actually buy that.

There are some other bits of data that don't speak particularly kindly to the motives of SEC folks, such as that old revolving door:

Data from the Project on Government Oversight has documented that since 2001, more than 400 former SEC officials filed disclosure forms documenting their plans to represent firms before the SEC. Correira's report shows that this revolving door also influences financial prosecutions, as companies that employ lobbyists who once worked for the SEC "experience a larger reduction in the probability of enforcement and in penalties than those that do not."

Of course, it might not be entirely the SEC's fault. As Correira suggests, the SEC may be responding to basic incentives itself, in noting that investigations and prosecutions of politically "friendly" firms may create "political consequences for itself and its budget." Sirota more or less got a former SEC official to admit that this all goes into the thought process:

In an interview with IBTimes, former SEC counsel Scott Kimpel acknowledged that the agency does have to weigh how to best maximize its limited resources.

"At the end of the day, the SEC only has about 1,000 enforcement officials, so they can't possibly go after every single case of wrongdoing," he said.

As Sirota again notes at the end of his article, this issue is not just for the SEC, but for other federal agencies as well, including the DOJ, which more or less admitted that it wouldn't prosecute Wall Street firms connected to the 2008 financial mess, because it might have "a negative impact on the national economy."

It's not clear how you directly solve this issue, but it certainly does seem like a very real problem. Between the revolving door and the power of campaign contributions, it's been quite clear for a long time that the government is not the people's representatives any more (if they ever were).

Filed Under: campaign finance, funding, investigations, maria correira, politics, prosecutions, sec

Congressional Committee Thinks It Shouldn't Have To Answer The SEC's Questions About Insider Trading

from the we're-electable,-not-accountable dept

"Laws are for other people."
- Too many legislators to count

It's common knowledge that insider trading is illegal. In fact, we have an entire government agency in place to regulate trading and to investigate insider trading allegations. Executives have been sentenced to months (sometimes even years) in plush, well-appointed hellholes for participating in insider trading.

Members of Congress, however, were exempt from insider trading rules until 2012. An 2011 expose by 60 Minutes let millions of Americans know that members of Congress had plenty of access to market-changing information and were acting on it.

In a rare (ha!) show of self-preservation, a united House full of Congresspersons facing reelection battles passed the STOCK Act, which basically made Congress and its staffers play by the same trading rules as every other American.

In 2013, with Congressional members safely re-elected, the House decided to roll back its previous legislative effort in order to get back into the insider trading business. It tore out the stipulation demanding disclosure of trading activity -- the one thing citizens could use to verify adherence to the "no insider trading" rule -- stating that these disclosures were a "security risk." This sailed through with unanimous consent late on a Thursday afternoon (the end of the Congressional work week) and was signed by the President the following Monday.

Now, Congress is again claiming it doesn't need to submit to laws that govern US citizens and, again, it's doing this to avoid any transparency or accountability being applied to its trading activities.

The U.S. House Ways and Means Committee and a top staff member say the panel and its employees are "absolutely immune" from having to comply with subpoenas from a federal regulator in an insider-trading probe.

The committee yesterday responded to U.S. District Court Judge Paul Gardephe's order to explain why it hadn't complied with the U.S. Securities and Exchange Commission's requests for documents, phone records and testimony of aide Brian Sutter for more than a year.

The SEC is investigating a suspicious spike in health insurer trading volumes and prices ahead of a report that announced government payments to insurers would be increased, rather than decreased. This investigation claims that a Green Taureg LLC lobbyist sent the information to a Height Securities LLC analyst ahead of the official government announcement and that House Ways and Means staff director Brian Sutter may have been the originating source.

The Committee's legal rep has responded by claiming Congress is above the law or, if not above, very definitely adjacent to it, but certainly not within in and subject to federal subpoenas.

Kerry W. Kircher, the top lawyer for the House, said the SEC's request should be dismissed because the information it seeks concerns legislative activities protected by the Constitution, which can't be reviewed by federal judges.

Kircher also stated that his client does not and will not (EVER) have time for the SEC's "apply the insider trading rules to everyone" bullshit.

Sutter's connection to the investigation is "tangential" Kircher said, and would also interfere with his work because his schedule is "heavily, and nearly permanently, booked."

So, if anyone thought an SEC insider trading probe would bring more accountability to the House, those thoughts may now be dismissed to make room for more cynicism. There's a slim possibility the SEC may extract damning evidence, but it will have to fight its way through a House full of people with no conceivable reason to be compliant. Insider trading was a great Congressional job perk and its uncontested run helped pad the wallets of future lobbyists, board members and consultants. No one really wants to completely end it, but they'd certainly like people to stop talking about it.

Filed Under: brian sutter, congress, house ways and means committee, insider trading, privilege, sec
Companies: green taureg, heigh securities

More Than Half Of The House Co-Sponsoring Email Privacy Reform; So Why Isn't It Moving?

from the ecpa-reform-now dept

For quite some time we've talked about the importance of ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is woefully outdated. Passed in the 1980s, when the internet was just a small network that connected a few universities, it has allowed law enforcement and other government officials to snoop on your email based on some very outdated definitions and assumptions. As we've discussed in the past, one very obvious example, is the idea that, under the law, emails stored on a server for over 180 days are considered "abandoned" and that there's no need to get a warrant to view those emails. Of course, that was back when people expected old emails to be either deleted or downloaded. No one predicted "cloud" computing with virtually unlimited storage.

For years now, there's been a major effort at ECPA reform, to actually make sure that law enforcement needs a warrant to view your emails. It has had strong support in Congress for some time, but the main folks fighting against it are the SEC and the IRS, who like the fact that they can search through your emails without a warrant. In fact, the SEC seems to revel in its ability to do some very questionable things, in part thanks to ECPA.

Earlier this week, the main ECPA reform bill in the House, sponsored by Reps. Kevin Yoder and Jared Polis, hit a new milestone: it currently has 218 co-sponsors, meaning that more than half of the House now has their name on the bill. And yet, the bill is still stalled out, because House leadership has been scared off by the SEC and IRS. Hopefully, the House will finally move forward on this bill.

And while Yoder notes in that article that the NSA revelations have actually helped give this bill momentum, it's important to note that this is separate from the NSA reform issue. ECPA reform is unrelated to the NSA stuff, but covers what other government agencies can do with your email. Both are important issues, but it would be great to finally get basic ECPA reform through. This is a fight that's been going on for over a decade, and with more than half the House supporting it, how much longer can Congressional leadership ignore it?

Filed Under: 4th amendment, ecpa, ecpa reform, irs, jared polis, kevin yoder, privacy, sec, warrants

Adding Insult To Injury: Companies DOJ Says That China Hacked Now Facing Probes Over Failure To Disclose

from the really-winning-fans-here dept

Earlier this week, we wrote about the DOJ filing an indictment against some Chinese hackers who are a part of the People's Liberation Army. We found the situation rather ironic, given all that the NSA has been accused of on the cyberespionage front these days. We also found the whole thing to be incredibly counterproductive as it wouldn't do a damn thing to stop Chinese hacking, but would likely lead to other countries filing criminal charges against NSA hackers.

What was particularly crazy was the DOJ's smug announcement about how it finally had "proof" of Chinese hacks, naming some specific companies which had been hacked. In theory, the DOJ thinks it's helping to protect those businesses, but the reality may be the opposite. It appears that the DOJ may have just created a massive headache for those companies, as they may be facing probes and possible shareholder lawsuits about failures to disclose the hacks to investors. It's not entirely clear they needed to do so -- and the companies insist they revealed all material information -- but from the article, it's clear that class action lawyers will eat this one up and file expensive and wasteful lawsuits.

“The question is would an investor have cared if Chinese hackers broke into a company and were messing around the place?” Jacob Olcott, a principal focusing on cybersecurity at Good Harbor Security Risk Management LLC in Washington, said in a phone interview. “As an investor, show me the evidence that you reviewed this thoroughly.”

So, not only did these companies -- Alcoa and Allegheny Technologies Inc. -- get hacked in a way where it's unlikely that any criminal charges will catch the folks who did the hacking, those same companies may face another legal headache over the failure to reveal they got hacked by the Chinese. So exactly whom is the DOJ helping here?

Filed Under: breaches, china, disclosure, doj, hackers, indictment, privacy, sec
Companies: alcoa, allegheny technologies inc.

SEC Is A Due Process Nightmare: Searches Emails Without A Warrant, Refuses To Share Exculpatory Evidence

from the the-sec-doesn't-like-the-constitution dept

Back in December, we wrote about the effort to push for ECPA reform by noting that one of the main government agencies fighting against it was the SEC, which wanted the ability to snoop through your emails without getting a warrant. If you don't remember, ECPA is an excessively outdated law from 1986, whose definitions make no sense in the internet era (especially one with cloud computing). The key example often given is that emails on a server that are over 180 days old are considered "abandoned" and thus no warrant is needed to access them. That may have kind of made sense in an era when people downloaded all of their email, but now that nearly all email remains on servers somewhere it makes no sense at all. There are other problems with ECPA similar in nature (opened vs. unopened emails are treated differently, for example), but it's clear the law is outdated.

Two stories popped up last week that raise serious concerns about the way that the SEC tramples on the Constitution. The first is that in a hearing, SEC boss Mary Jo White was asked why the SEC is so resistant to ECPA reform and what's wrong with getting a warrant, and more or less admitted that it's standard practice for the SEC to not get a warrant, but to rely on loopholes in ECPA to get access to emails. Prior to this, many had assumed that this was just a desire of the SEC, not that they were regularly doing it. But White's answer makes it clear that the SEC views this practice -- which seems like it should be a clear 4th Amendment violations -- as standard operating procedure. While she insists that the privacy issues aren't a huge deal, because the SEC tries to "give notice" to the subscriber whose email is being accessed, that still doesn't explain why paper documents require a warrant, and yet the SEC doesn't bother with the much higher standard (including judicial review) of a warrant for electronic documents.

Meanwhile, concerning a separate issue, Mark Cuban and his lawyer published an op-ed in the Wall Street Journal last week, discussing the SEC's totally bogus case against him for insider trading, which got tossed out by a lawyer. The key issue they discussed is how the SEC had exculpatory evidence that proved Cuban had done no wrong from back in 2004 -- and then did everything possible to avoid turning over that evidence, as is normally required in legal proceedings.

In a criminal trial, the federal government has long been obliged to promptly turn over to the defense any evidence that could show that the accused did not commit the offense of which he is accused. The Brady rule (announced in the 1963 Supreme Court case, Brady v. Maryland), prevents one-sided prosecutions in which the defendant is kept in the dark about information that might show that he is innocent.

The government's job as criminal prosecutor is not to obtain convictions, but "to do justice," according to the traditional legal maxim. It should be required to follow the Brady rule in civil trials as well. But the SEC does not, even when it accuses a citizen of fraud. Had the agency complied with this simple rule in its recent insider-trading case against one of us, Mark Cuban, it is unlikely that a lawsuit would even have been filed, let alone go to trial.

At issue were notes the SEC had concerning the details of Cuban's conversation with the CEO of Mamma.com, the search engine Cuban had invested in (and then sold all his shares in), which showed that, contrary to the SEC's claims in the case against him, Cuban had never made certain promises. When Cuban and his lawyer asked for these notes, the SEC resisted.

The SEC, however, resisted the disclosure of these notes for the next three years. Even up until the time Mr. Cuban took the stand, the SEC continued to fight to keep the notes from being shown to the jury by asking the judge to exclude them from evidence. Fortunately, the judge disagreed and the jury ultimately cleared Mr. Cuban of a charge of insider trading.

So, reading both of these stories, we see that the SEC feels that it is free to ignore both the 4th Amendment (against search and seizure without a warrant) and the 14th Amendment (concerning due process). Don't we think that agencies of the federal government should be required to follow the Constitution -- especially basic concepts like protecting the privacy of individuals and giving them basic due process? And, for those of you who think this is no big deal, because it's the SEC, and the SEC just goes after big bad bankers and the like, recognize that the agency following right behind the SEC in fighting ECPA reform is the IRS. Do you feel it's similarly okay for the IRS to search your emails and electronic records without a warrant while also believing that it need not share any of the exculpatory evidence it finds, proving your innocence, while bringing a case against you for violating the law?

Oh, and just for the hell of it, let's take this a step further. Just a few weeks ago, the NY Times reported on an increasingly popular tactic of law enforcement to effectively use the SEC to trick people into effectively implicating themselves in criminal cases. It tells the story of a low-level guy who worked at a law firm, and was asked by the SEC to "help out" with an investigation. Only at the last minute, was it mentioned that someone from the district attorney's office would be present -- and at no time was there any indication that the guy was being investigated for criminal behavior. But thanks to the SEC smokescreen, the guy was indicted, and he's still not sure why.

So, now it's an SEC that ignores the Constitution, searches emails without a warrant, hides exculpatory evidence and surreptitiously uses these "investigations" to help build out criminal charges against people on a highly questionable basis. See the problem, yet?

The folks over at VanishingRights.com are fighting to reform ECPA, which would at least solve half of the problem above. Right now, the SEC and the IRS remain the main government agencies aligned against such reform. It's time to tell those agencies that they need to obey the Constitution too.

Filed Under: 4th amendment, due process, ecpa, ecpa reform, irs, mark cuban, mary jo white, sec, warrantless searches, warrants

Feds Own Cybersecurity Efforts Are A Joke: Employees Have 'Gone Rogue' To Avoid 'Ineptitude' Of IT Staff

from the get-your-house-in-order dept

One of the key parts of the various cybersecurity bills that have been pushed over the past few years is the idea that the federal government would help the private sector better protect against attacks. Of course, for that to makes sense, you'd think that the federal government would have its own "cybersecurity" house in order. However, a report from the Senate shows what even it describes as "ineptitude" by various government agencies. Pick your agency and you'll find problems. Let's take a look at Homeland Security, one of the agencies that has been vying for control of the federal cybersecurity budget. Turns out that DHS's own cybersecurity team repeatedly failed to install basic security updates for easy targets of hackers like Microsoft applications and Java (tip: if you're using Java, you're probably not secure). As the report notes, this is "the sort of basic security measure just about any American with a computer has performed." But not DHS cybersecurity employees!

What else? Well, just in DHS, there were the following problems:

Sensitive databases protected by weak or default passwords. At NPPD, which oversees DHS’s cybersecurity programs, the IG found multiple accounts protected by weak passwords. For FEMA’s Enterprise Data Warehouse, which handles reports on FEMA’s disaster deployment readiness and generates other reports accessing Personally Identifying Information (PII), the IG found accounts protected by “default” passwords, and improperly configured password controls.

Computers controlling physical access to DHS facilities whose antivirus software was out of date. Twelve of the 14 computer servers the IG checked in 2012 had anti-virus definitions most recently updated in August 2011. Several of the servers also lacked patches to critical software components.

Oh, and then there's the following concerning our good friends at ICE, Immigrations and Customs Enforcement, the group that styles themselves as Hollywood's personal police force:

To take just one example, weaknesses found in the office of the Chief Information Officer for ICE included 10 passwords written down, 15 FOUO (For Official Use Only) documents left out, three keys, six unlocked laptops-- even two credit cards left out.

Moving on to the Nuclear Regulatory Commission. Here things are so bad that the report notes that NRC employees believe their own IT staff is "inept" and they've "gone rogue."

Perceived ineptitude of NRC technology experts. There is such “a general lack of confidence” in the NRC’s information technology division that NRC offices have effectively gone rogue–by buying and deploying their own computers and networks without the knowledge or involvement of the department’s so-called IT experts. Such “shadow IT” systems “can introduce security risks when unsupported hardware and software are not subject to the same security measures that are applied to supported technologies,” the NRC Inspector General reported in December 2013.

And this has resulted in a bunch of problems, such as storing sensitive data on unsecured shared drives, including the details of the NRC's cybersecurity programs. Also on an unsecured shared drive? A commissioner's passport photo, credit card image, home address and phone number. The NRC also failed to report security breaches:

How often does the NRC lose track of or accidentally expose sensitive information to possible release? The NRC can't say, because it has no official process for reporting such breaches.

Moving on to everyone's favorite government agency: the IRS. The report notes that every year the GAO finds 100 cybersecurity weaknesses in IRS systems, and the IRS fixes half of them. Then the GAO does another audit... and finds another 100 problems with the IRS's cybersecurity. Among the problems? Failure to encrypt sensitive data. Failure to fix known vulnerabilities. And, the ever popular weak passwords:

Examples of easily-guessed passwords are a person’s username or real name, the word “password,” the agency’s name, or simple keyboard patterns (e.g., “qwerty”), according to the National Institute of Standards and Technology. In some cases, IRS users had not changed their passwords in nearly two years. As a result someone might gain unauthorized access to taxpayers’ personal information and it “would be virtually undetectable,” potentially for years. GAO has cited IRS for allowing old, weak passwords in every one of its reports on IRS’ information security for the past six years.

How about an organization like the SEC, who deals with tons of sensitive information? Apparently, they're so careless and cavalier about this stuff they used personal email accounts, unencrypted information and often used unsecured open WiFi connections -- including once at "a convention of computer hackers."

Team members transmitted sensitive non-public information about major financial institutions using their personal e-mail accounts. They used unencrypted laptops to store sensitive information, in violation of SEC policy--and contravening their own advice to the stock exchanges. Their laptops also lacked antivirus software. The laptops contained “vulnerability assessments and maps and networking diagrams of how to hack into the exchanges,” according to one SEC official.

The investigation also found that members of the team took work computers home in order to surf the web, download music and movies, and other personal pursuits. They also appeared to have connected laptops containing sensitive information to unprotected wi-fi networks at public locations like hotels--in at least one reported case, at a convention of computer hackers.

And yet these folks claim they can help secure everyone else's computers?

Filed Under: cybersecurity, dhs, federal government, homeland security, irs, nrc, sec, senate

If You're An American Who Believes In The 4th Amendment, You Have No Excuse Not To Sign This Petition

from the don't-let-it-continue dept

We've written a few times recently about the importance of ECPA reform, to bring a woefully out of date law into the 21st century. Specifically, we've urged people to sign this White House petition in favor of ECPA reform. That petition closes soon, and it's still a bit short of the 100,00 goal.

Why is this important to you? Because, without it, it's much easier for the government to snoop on your emails without a warrant. What people want is for emails and regular mail to be treated the same, which is simply not the case today. While this is a separate issue from the NSA stuff, it does matter quite a bit, and this is a chance for there to be a real win that helps protect your privacy. Fighting against this proposal are a variety of government agencies, led by the IRS and the SEC, which have made good use of this loophole to read emails without getting a warrant. This is not what the law was intended for at all. It's a loophole based on the outdated law, which was written in 1986, before anyone could comprehend things like web-based email. The IRS and SEC like having this loophole, and they don't want it to go away. In fact, they want it to be made explicit, rather than an accidental loophole of history. That should be a massive affront to folks who believe in the 4th Amendment and the basic concept that a search should require a warrant based upon probable cause.

I know that many people have dismissed the whole concept of White House petitions, and take a rather cynical view of the whole thing. That's a very dangerous approach here, only helping to further the problems:

1. Yes, it's true that the White House has ignored certain petitions in the past. It's also true that there are certain issues where the White House doesn't really seem to care what people have to say, it's made up its mind.
2. But, that is not always the case, and the White House has used these petitions to take strong positions in the past -- including on things like SOPA and mobile phone unlocking. When accompanied by a strong campaign beyond just the petition, the White House seems open to taking certain issues more seriously. This is one of those.
3. By all indications, there are some in the White House who agree that ECPA is out of date and needs to be fixed. There appears to be an internal debate about where the official White House position will be -- whether it's siding with the IRS and SEC -- or with the 4th Amendment rights of the public. Having a ton of signatures from the American public on their side will absolutely help those in the White House who support real and meaningful ECPA reform push back against the agencies.
4. This isn't an empty gesture. There are bills in the House and Senate to fix ECPA, close the loopholes and protect your 4th Amendment rights. Getting White House support could finally push those bills over the edge and make them law.
5. Sticking with the cynical approach and refusing to sign guarantees failure. Not signing works to the advantage of the IRS and SEC and others who like using this loophole. Even if you're cynical about this, signing the petition at least gives it a chance to influence the debate.

And, yes, I know that outside of the general debate over ECPA, people will look at the NSA situation and argue that it doesn't really matter what the law says. That's not true. Yes, the NSA issue is a big one that needs to be dealt with, but this is about a loophole that goes way beyond the NSA, and is used and abused by different government and law enforcement agencies. Here's a real chance to push back on that and to score a real victory for privacy. Letting cynicism and apathy dictate your move here guarantees that the forces pushing against your 4th Amendment rights win. So take a chance and sign the petition.

Filed Under: 4th amendment, ecpa, ecpa reform, irs, petition, privacy, sec, warrants

The IRS And SEC Want To Snoop Through Your Email Without A Warrant; Don't Let Them

from the speak-up,-fix-ecpa dept

We've talked a lot about ECPA reform -- which is the incredibly outdated "electronic communications privacy act" which actually makes sure that you have less privacy than other forms of communication. This isn't necessarily on purpose, but because the law was written in the mid-1980s when email itself was a relatively new concept. It includes some bizarre distinctions between opened and unopened emails and if a message has been "left on a server" for more than 180 days (at which point it's considered "abandoned" and not subject to a warrant). Obviously it never anticipated the kind of internet we have today. It also goes against basic 4th Amendment principles and treats electronic messages differently from physical messages.

There actually is a fair bit of support in both Congress and the White House to fix this... if we can get enough public support behind it, which includes getting more people to sign this petition. As with SOPA, there's a strong suggestion that if this petition tips the scales at 100,000, we can get the White House to come out in favor of ECPA reform.

What's standing in the way? Well, a bunch of government agencies, honestly. There are the obvious ones like the DOJ and DHS. That's to be expected. They always want to make it easier to snoop through emails and written communications. But apparently some of the strongest voices trying to block ECPA reform within the government are coming from the SEC and the IRS, because they too see plenty of advantages in trying to snoop through emails without having to take the trouble of getting a warrant.

As I write this, I'm participating in a Reddit AMA (Ask Me Anything) with Chris Calabrese from the ACLU, Mark Stanley from the Center for Democracy and Technology and Julian Sanchez from the Cato Institute. This coincides with a day of action involving a bunch of companies and organizations trying to get more people to speak out on the importance of ECPA reform. And, finally, the folks at TechFreedom have put together a great infographic, which we've also embedded below.

Filed Under: ecpa, ecpa reform, emails, irs, messaging, privacy, sec, warrants