The IRS And SEC Want To Snoop Through Your Email Without A Warrant; Don't Let Them

from the speak-up,-fix-ecpa dept

We've talked a lot about ECPA reform -- which is the incredibly outdated "electronic communications privacy act" which actually makes sure that you have less privacy than other forms of communication. This isn't necessarily on purpose, but because the law was written in the mid-1980s when email itself was a relatively new concept. It includes some bizarre distinctions between opened and unopened emails and if a message has been "left on a server" for more than 180 days (at which point it's considered "abandoned" and not subject to a warrant). Obviously it never anticipated the kind of internet we have today. It also goes against basic 4th Amendment principles and treats electronic messages differently from physical messages.

There actually is a fair bit of support in both Congress and the White House to fix this... if we can get enough public support behind it, which includes getting more people to sign this petition. As with SOPA, there's a strong suggestion that if this petition tips the scales at 100,000, we can get the White House to come out in favor of ECPA reform.

What's standing in the way? Well, a bunch of government agencies, honestly. There are the obvious ones like the DOJ and DHS. That's to be expected. They always want to make it easier to snoop through emails and written communications. But apparently some of the strongest voices trying to block ECPA reform within the government are coming from the SEC and the IRS, because they too see plenty of advantages in trying to snoop through emails without having to take the trouble of getting a warrant.

As I write this, I'm participating in a Reddit AMA (Ask Me Anything) with Chris Calabrese from the ACLU, Mark Stanley from the Center for Democracy and Technology and Julian Sanchez from the Cato Institute. This coincides with a day of action involving a bunch of companies and organizations trying to get more people to speak out on the importance of ECPA reform. And, finally, the folks at TechFreedom have put together a great infographic, which we've also embedded below.

Filed Under: ecpa, ecpa reform, emails, irs, messaging, privacy, sec, warrants

An Important Week To Speak Up To Protect Innovation And Privacy

from the two-important-issues dept

Two separate, but equally important, issues are getting extra attention this week, and if you're concerned about innovation you should speak up on both of them. First, it appears that the House is set to vote on the Innovation Act, the patent reform bill. While we're extremely disappointed that Microsoft and IBM were successfully able to water down an important part of the bill, it's still important to get this bill passed. First off, there are a number of other good anti-troll aspects to the bill. Second, the Senate bill still has the "covered business methods program" which got stripped from the House bill. This is the part of patent reform that will make it much easier to get bad patents invalidated faster. For now, it appears that there's strong support from Senator Chuck Schumer for this particular part of the legislation in the Senate, so even if it's not in the House bill, it's possible it'll come back later. But if the House can't even pass the bill in the first place, it will definitely delay any patent reform. As such the Trolling Effects site has set up a tool to reach out to your Representative. Please use it. Phone calls can make a really big difference in getting Representatives to take an issue seriously, and this is a serious issue that needs support.

The second issue is what's known as ECPA reform -- which may sound boring, but is incredibly important. These are the very out of date rules concerning when law enforcement needs (and more importantly, when they don't need) to get a warrant to sniff through your personal data. A bunch of consumer rights groups, privacy rights groups and internet companies are all teaming up on Thursday for a day of action to get people to call upon Congress to finally update ECPA to protect your privacy. There's a White House Petition on this, and there are some solid indications that if that can get over 100,000 signatures, the White House may finally be willing to move on this, despite very strong resistance from the likes of the SEC and IRS who like that they get to snoop through your emails without a warrant. I'll be taking part in a Reddit AMA about ECPA reform on Thursday, and a bunch of companies and sites will be promoting ways to contact Congress about ECPA reform on that day as well. Oh, and also the folks over at TechFreedom have put together this astoundingly awesome infographic about "what's so bad about ECPA" that you should check out.

So, again, use today and tomorrow to let Congress (and your friends) know about the importance of passing patent reform, and on Thursday speak up about ECPA reform. These two issues are both quite important in encouraging innovation while protecting our privacy.

Filed Under: ecpa reform, innovation act, patent reform, patents, privacy, speak up

Tell The Government That It Needs To Get A Warrant If It Wants To Read Your Email

from the they're-not-getting-the-message dept

While there's been so much attention lately on the NSA's surveillance tactics and its legality, for years there's been a separate issue that we've been covering: the outdated ECPA (Electronic Communications Privacy Act) rules (written in the '80s) that cover law enforcement's ability to get access to your data, such as emails. The laws make almost no sense today, as they were written in a time when the internet was much more limited. The idea of everyone storing pretty much all of their information and communications online wasn't even a concept at the time -- and that creates bizarre and nonsensical rules, like arguing that emails that have been on a server for more than 180 days are considered "abandoned" and no warrant is needed to view them.

There's a simple way to fix all this: reform ECPA to protect private data and say that law enforcement needs to get a warrant to view that information. This is not a difficult requirement, and yet law enforcement has been fighting hard against it for quite some time. Back in September, we noted that if Congress really wants to protect online privacy, beyond just the NSA stuff a good first start would be comprehensive ECPA reform.

To that end, someone recently created a "We The People" petition on the White House website asking for ECPA reform, with a key message: the government should get a warrant.

Americans are deeply concerned about NSA surveillance.

But the NSA’s not the only problem. An outdated law says the IRS and hundreds of other agencies can read our communications without a warrant.

That law, known as the Electronic Communications Privacy Act (ECPA), was written over 25 years ago, before the services we use today even existed.

Right now, several bills in Congress would fix this by updating ECPA to require a warrant, but regulatory bodies are blocking reform in order to gain new powers of warrantless access.

We call on the Obama Administration to support ECPA reform and to reject any special rules that would force online service providers to disclose our email without a warrant.

While many are (perhaps reasonably) skeptical about the "We the People" petitions, they have been shown to be effective tools in getting the White House to take a position on important issues. And, while the DOJ is against this kind of ECPA reform, that's not to say that others in the White House couldn't be convinced to go the other way if they really believe there are enough people in support of such a program. So, check out the petition and let the White House know that it should fix the law so that if law enforcement wants your data, it needs to get a warrant.

Filed Under: ecpa, ecpa reform, email, petitions, warrants, we the people, white house

Now Is The Time To Reform Outdated Electronic Privacy Laws

from the vanishing-rights dept

Given everything that's been going on with the stories of NSA surveillance lately, it's more clear than ever that our electronic privacy laws are broken. For many years, we've written about the drastic need for ECPA reform. ECPA is the Electronic Communications Privacy Act, which was passed in 1986. As you can imagine, it's exceptionally outdated and convoluted (such as claiming that any emails on a server for more than 180 days should be considered "abandoned" and available for law enforcement to read -- a concept that makes no sense in an era of hosted email with tremendous storage). ECPA is regularly abused by law enforcement agencies seeking information on Americans. This goes well beyond what the NSA is doing in many ways. There's been support in Congress in the past for ECPA reform, but it's never quite made it.

A large group of organizations and companies -- including us at Floor64/Techdirt, along with (among others) EFF, Center for Democracy and Technology, Free Press, Fight for the Future, Demand Progress, ACLU, Engine Advocacy, CCIA, American Library Association, reddit, DuckDuckGo and more -- have teamed up to create VanishingRights.com, to push for a much needed update to ECPA's outdated rules. Instead, we'd like to see a return to basic 4th Amendment ideas like requiring a warrant to search for info. Sounds crazy, I know, but we're in an age where we actually have to tell Congress that it's time to respect the Constitution, because they seem to forget about it all too often.

The latest proposal to support ECPA reform, called the Email Privacy Act, or HR 1852, was introduced by Rep. Kevin Yoder and has 137 co-sponsors -- so it has significant support in Congress. But it needs more support if it's actually going to pass in this do-nothing Congress that we have.

Please check out the site, where you can let your elected officials that ECPA needs to be reformed, and that it should respect the basic tenets of the 4th Amendment. You can also read more about ECPA, why it's broken, and what it means for your privacy.

Filed Under: 4th amendment, ecpa, ecpa reform, email, privacy, vanishing rights, warrants

FBI Still Doesn't Think It Needs A Warrant To Read Your Email, Despite Court Ruling To The Contrary

from the of-course-not dept

The ACLU has continued its campaign to explore whether or not the government gets a warrant before scouring your email. Last month, they discovered that the IRS doesn't believe in getting a warrant -- leading to the IRS promising to change that policy. Now they've received some documents from the FBI in response to a FOIA request that again suggest that, despite the ruling in US v. Warshak, in which the 6th Circuit said that a warrant is needed to compel an ISP to turn over emails, the FBI believes it can access emails older than 180 days without a warrant, under ECPA. As we've discussed at length, ECPA (the Electronic Communications Privacy Act) is a very outdated piece of legislation which considers emails on a server over 180 days to be "abandoned" because no one considered a cloud computing future.

What the ACLU found in these documents is that the FBI hasn't updated its Domestic Investigations and Operations Guide (DIOG) in response to the Warshak ruling, and it still suggests that agents can easily access such emails without a warrant. Instead, it says:

In enacting the ECPA, Congress concluded that customers may not retain a “reasonable expectation of privacy” in information sent to network providers. . . [I]f the contents of an unopened message are kept beyond six months or stored on behalf of the customer after the e-mail has been received or opened, it should be treated the same as a business record in the hands of a third party, such as an accountant or attorney. In that case, the government may subpoena the records from the third party without running afoul of either the Fourth or Fifth Amendment.

That's a... charitable interpretation of reality. That's what Congress felt back then, but based on a very different network setup. However, as the courts noted in Warshak, the 4th Amendment is still important and still rules.

The ACLU also asked different US Attorney's offices for their guidelines, and found that policies differed greatly based on location. Northern Illinois, for example, seemed to recognize the 4th Amendment. But others, including in Texas, still seem to think that no warrant is required. As the ACLU notes, this hodgepodge of rules and the fact that the FBI hasn't changed its guidelines in response to Warshak just highlights the need for comprehensive ECPA reform.

If nothing else, these records show that federal policy around access to the contents of our electronic communications is in a state of chaos. The FBI, the Executive Office for U.S. Attorneys, and DOJ Criminal Division should clarify whether they believe warrants are required across the board when accessing people’s email. It has been clear since 1877 that the government needs a warrant to read letters sent via postal mail. The government should formally amend its policies to require law enforcement agents to obtain warrants when seeking the contents of all emails too.

More importantly, Congress also needs to reform ECPA to make clear that a warrant is required for access to all electronic communications. Reform legislation is making its way through the Senate now, and the documents released by the U.S. Attorney in Illinois illustrate that the law can be fixed without harming law enforcement goals. If you agree that your email and other electronic communications should be private, you can urge Congress to take action here.

Filed Under: 4th amendment, ecpa, ecpa reform, email, fbi, privacy, warshak
Companies: aclu

IRS Investigators See No Need For A Warrant To Snoop On Emails

from the time-for-an-audit-of-aclu-folks dept

The ACLU filed a freedom of information act (FOIA) request last year, asking for details about whether not IRS investigators get warrants before reading people's private communications. After finally getting 247 pages of records (which don't fully answer the questions asked), the ACLU has noted that the documents suggest that the IRS likely read private emails regularly without obtaining a warrant. In their blog post, they note that in the US v. Warshak case, the 6th Circuit made it clear that the government must get a warrant to turn over emails, and it seems clear that the IRS had to change its policy because of that.

The documents the ACLU obtained make clear that, before Warshak, it was the policy of the IRS to read people’s email without getting a warrant. Not only that, but the IRS believed that the Fourth Amendment did not apply to email at all. A 2009 “Search Warrant Handbook” from the IRS Criminal Tax Division’s Office of Chief Counsel baldly asserts that “the Fourth Amendment does not protect communications held in electronic storage, such as email messages stored on a server, because internet users do not have a reasonable expectation of privacy in such communications.” Again in 2010, a presentation by the IRS Office of Chief Counsel asserts that the “4^th Amendment Does Not Protect Emails Stored on Server” and there is “No Privacy Expectation” in those emails.

Other older documents corroborate that the IRS did not get warrants across the board. For example, the 2009 edition of the Internal Revenue Manual (the official compilation of IRS policies and procedures) explains that “the government may obtain the contents of electronic communication that has been in storage for more than 180 days” without a warrant.

Of course, the IRS is not alone in this. That's the same way other government agencies have treated email thanks to the outdated nature of ECPA, the Electronic Communications Privacy Act, a law written nearly 30 years ago, which assumed that any content left on a server for over 180 days was "abandoned," because the idea of online messaging systems was foreign to folks in Congress at the time.

The bigger question, though, is whether or not the IRS paid attention to the ruling in Warshak and started getting warrants. As the ACLU notes, while not entirely clear, the answer is likely "no."

Then came Warshak, decided on December 14, 2010. The key question our FOIA request seeks to answer is whether the IRS’s policy changed after Warshak, which should have put the agency on notice that the Fourth Amendment does in fact protect the contents of emails. The first indication of the IRS’s position, from an email exchange in mid-January 2011, does not bode well. In an email titled “US v. Warshak,” an employee of the IRS Criminal Investigation unit asks two lawyers in the IRS Criminal Tax Division whether Warshak will have any effect on the IRS’s work. A Special Counsel in the Criminal Tax Division replies: “I have not heard anything related to this opinion. We have always taken the position that a warrant is necessary when retrieving e-mails that are less than 180 days old.” But that’s just the ECPA standard. The real question is whether the IRS is obtaining warrants for emails more than 180 days old. Shortly after Warshak, apparently it still was not

The IRS had an opportunity to officially reconsider its position when it issued edits to the Internal Revenue Manual in March 2011. But its policy stayed the same: the Manual explained that under ECPA, “Investigators can obtain everything in an account except for unopened e-mail or voice mail stored with a provider for 180 days or less using a [relevant-and-material-standard] court order” instead of a warrant. Again, no suggestion that the Fourth Amendment might require more.

As the ACLU notes, the IRS owes the American public a clear explanation of its view on warrants... and it should put in place a clear warrant requirement before snooping through emails.

Filed Under: 4th amendment, ecpa, ecpa reform, email, irs, privacy, warrants

US Government's Failure To Protect Public Privacy Is Driving Business Overseas

from the all-for-what? dept

As we've covered over and over again, the US government has made it clear that it wants access to your data. With things like the FISA Amendments Act, ECPA and various other laws, law enforcement plays the FUD card repeatedly, insisting that it needs to be able to go in and see data to "protect" the public. There's very little basis to make this claim. And, worse, by decimating online privacy, the US government may actively be driving business outside of the US to foreign countries that have stricter privacy laws that actually protect data from government snooping.

Many foreign companies are converging toward a common argument for why they’re better than their American competitors. It’s not that the foreign-made technology is better, more resilient, or more ubiquitous, nor that the foreign companies are more innovative or better managed. They compare not their businessmen but their politicians. They argue simply that American laws undermine any American product — that these laws fail to protect privacy of personal or business information of all users. This argument works partly because consumers claim to “avoid doing business” with companies they don’t trust to protect their privacy.

Basically, because law enforcement believes it needs to build a much bigger haystack as it searches for needles, we're handing other countries a key selling point in setting up services to compete with US services: "you can't trust any service based in the US, because it's subject to government surveillance." That may be a bit of an exaggeration, but I know I've see a number of companies lately who advertise the fact that they're not based in the US to suggest that they're more secure and can keep your data private. This is not the reputation the US needs or wants right now.

Filed Under: 4th amendment, economic impact, ecpa, ecpa reform, fisa, privacy, us government

Patrick Leahy Introduces Legislation (Yet Again) To Require Government Warrants To Get Your Electronic Info

from the dc-just-keeps-doing-remakes dept

It's been quite a day in terms of news out of DC. We've been talking about copyright/first sale, cybersecurity bills, the CFAA... and now Senator Patrick Leahy, for what feels like the 2,394th time, has introduced a plan to reform ECPA. Like the CFAA, ECPA is an extremely troubling and outdated piece of legislation where Congress tried to deal with "those computer things" back in the 1980s in a manner that just doesn't make any sense today. Mainly it has opened up massive loopholes for the US government to access your data with little to no oversight (for example, the law considers messages on a server for over 180 days to be "abandoned" and thus fair game for law enforcement, as it never considered the idea of cloud storage). Senator Leahy would like to update the law to protect our privacy, such that law enforcement would actually be required to get a warrant.

If all of this sounds familiar, you wouldn't be wrong. We've been discussing it forever. Leahy keeps introducing bills and they never seem to turn into law. Law enforcement has been his main antagonist on this, though the DOJ (somewhat surprisingly) appeared to concede today that ECPA needs significant reform, even calling out the 180 day issue explicitly in testimony before the Judiciary Committee:

Many have noted—and we agree—that some of the lines drawn by the SCA that may have made sense in the past have failed to keep up with the development of technology, and the ways in which individuals and companies use, and increasingly rely on, electronic and stored communications. We agree, for example, that there is no principled basis to treat email less than 180 days old differently than email more than 180 days old. Similarly, it makes sense that the statute not accord lesser protection to opened emails than it gives to emails that are unopened.

That said, the DOJ is likely to push back on significant parts of any ECPA reform effort, to make sure it still has the ability to trawl through as much data as possible. Much of the testimony seems to warn of a parade of horribles that could occur if (*gasp*!) it has to get warrants for everything.

Filed Under: ecpa, ecpa reform, patrick leahy, privacy, reform, warrants

Congress Tries, Yet Again, To Fix Outdated Electronic Privacy Laws

from the that-4th-amendment-thing dept

We've been writing about ECPA reform for ages. In case you haven't been following this, ECPA is an incredibly outdated law concerning the privacy of electronic communications. As it stands now, thanks to some oddities in the law, the government can often access your online data with little oversight (among the many oddities in the bill, it considers emails on a server for more than 180 days "abandoned" and accessible by the government without a warrant). While many politicians in Congress claim that they're in favor of ECPA reform, little ever seems to happen with it. Late last year it had looked like a deal might have been worked out whereby Congress would approve strong ECPA reform that would respect the privacy of our data, in exchange for also reforming privacy laws concerning video rental data (basically a favor to Netflix and Facebook).

Law enforcement, as always, flipped out about the ECPA reform bit, and at the very, very end of Congress, the video rental reform stuff passed while ECPA reform was left on the cutting room floor.

This week, however, ECPA reform has been brought back once again, this time in the House, by Rep. Zoe Lofgren, along with Reps. Ted Poe and Suzan DelBene. The proposed bill, called The Online Communications and Geolocation Protection Act, is embedded below. It's a strong bill, meaning law enforcement folks are likely to flip out again. Among the reforms, it would set up a clear and consistent standard for requiring a warrant for government access to electronics communication. That is, it will get rid of the hodge podge of ECPA rules that change based on how old the communications are, if it's been opened, if it's a draft, etc. Now, we just get one rule, across the board, and that rule is get a warrant. It also requires (with a few exceptions) that notice be given to the user/account holder, so that people actually know when the government goes looking through their data.

In an attempt to appease law enforcement, the bill leaves in many "exceptions," that will allow law enforcement to bypass these rules in certain cases. The bill would be stronger without these exceptions, but there's no way the bill passes without something like that in there.

As you may have realized from the name, the bill also has a section dealing with "geolocation" information. This is important because there are a bunch of ongoing fights concerning the privacy of your location data (obtained via mobile phones, GPS devices and such). As we've covered here repeatedly, the courts have been ruling every which way on the legality of law enforcement accessing this kind of data, and so the bill tries to clarify that, and puts in place prohibitions on the government intercepting location info without a warrant (with, of course, a few key exceptions -- including in an emergency, if the person gives consent or if the data is already public).

It's a good bill that deserves support. While it may not be perfect, it's a hell of a lot better than what we have now. This would be a huge step up in protecting our privacy from government intrusion, which means it's going to be an uphill battle against law enforcement interests to get it passed. That said, maybe this is finally the year when all those elected officials who claim ECPA reform is important get their act together and vote to approve real reform.

Filed Under: congress, ecpa, ecpa reform, geolocation data, privacy, zoe lofgren

Apparently, Congress Isn't Actually Interested In Requiring A Warrant For Law Enforcement To Read Your Email

from the it-was-all-a-charade dept

Yes, we've already covered the rejection of key amendments in the FISA Amendments Act renewal, but that wasn't the only case of Congress ignoring the public's privacy concerns as they close out this session.

Back in September, we noted that Senator Patrick Leahy, who has been working on much needed reforms for ECPA (the Electronic Communications Privacy Act) -- such as requiring law enforcement get a warrant to read your email -- had attached his ECPA reform plan to an update of the Video Privacy Protection Act (VPPA). While I know some privacy folks were worried about this update to the VPPA, I don't have much of a problem with it. The original VPPA, written as a quick response to a video store revealing Robert Bork's (somewhat boring) video rental history during his Supreme Court nomination hearings, did seem a bit limiting -- especially for online video sites such as Netflix that wanted to add some useful social features. However, it was the ECPA reform part that was more important. Attaching ECPA reform to VPPA reform didn't make some privacy folks happy, but they seemed willing to go along with the VPPA changes if it really meant that we'd get warrant requirements for emails and other digital messages.

There were some attempts to water down that ECPA reform at the end of last month, but the Senate Judiciary Committee kept the warrant requirement in there and rejected various attempts to weaken the bill. As we noted, however, it still was a long way from becoming law, given the need to pass a full Senate vote and to have a companion House bill make the rounds. We assumed that there would be no movement until next year and the new Congress.

But... late last week, the House rubberstamped the VPPA update, and the Senate, almost immediately signed off on the House's version, which the President is expected to sign any moment now. In case you missed it, that means that the ECPA reforms -- which were supposed to be bundled with the VPPA to make the whole thing palatable -- got dropped entirely. And now we get the VPPA reforms and no ECPA reform at all. Neat trick. "Bundle" two things to get support... and then at the last minute drop one part and rush through the other.

Filed Under: congress, ecpa reform, privacy, vppa, warrant