Ron Wyden: It's Time To Kill The Third Party Doctrine And Go Back To Respecting Privacy

from the make-it-so dept

For years, we've written about the third party doctrine and its troubling implications for the 4th Amendment and your privacy -- especially in the digital era. If you're unfamiliar with it, the third party doctrine is the concept used by law enforcement (and, tragically, the courts) to say that you have no expectation of privacy or 4th Amendment rights in information you've given to a third party. The origins of this argument are not completely crazy, because there is a legitimate claim to the idea that if I entrust you with some private information, and you decide to disclose it, that my 4th Amendment rights haven't been violated. But that assumes a very different world. In today's digital world -- especially with cloud computing -- we "entrust" all sorts of information to third parties even though we still think of and treat that information like it's our own personal effects. These aren't cases in which I'm handing over a collection of journals to my neighbor to hold onto. Online services are treated as our own content -- which we can access, update and modify at any time from any device.

While the Supreme Court's recent decision in the Riley/Wurie cases suggests that it is becoming increasingly uncomfortable with law enforcement twisting old concepts onto new technologies to eviscerate privacy, the third party doctrine technically still stands -- and there has been little real discussion of it in Congress.

So it's good to see that Senator Ron Wyden is actually speaking out about why the third party doctrine needs to go. The speech is a good one, talking about oppressive governments and surveillance, and the rise of technology -- and how our laws have not kept pace when it comes to protecting our privacy against government intrusion. Then he digs in on the third party doctrine, noting that it was established by "judges who did not fully understand 20th Century technology, much less anticipate the technology we have today" and that it makes little sense considering the way we use technology today:

Some will still argue that by sharing data freely with Facebook, Google, Mint, Uber, Twitter, Fitbit, or Instagram, Americans are choosing to make that data public. But that is simply not the case. I might not have any expectation of privacy when I post a handsome new profile picture on Facebook, or when I send out a tweet to tell people I’ll be at the Tech Northwest conference. But when I send an email to my wife, or store a document in the cloud so I can review it later, my service provider and I have an agreement that my information will stay private. Neither of us have invited the government to have a peek. Basically, I think sharing this information with Google is like putting property in a safety deposit box, but the government thinks I’m posting it on a billboard out on I-5.

Citizens have agreed to a contract with Google or Mint that keeps their email or financial data private. In many cases these companies don’t even know what information they’re holding for you. Making information available to a service provider for a limited business purpose - so that they can give you a new app, or provide targeted ads, or do any other kind of business with you - is simply not the same as broadcasting that information to the public. In the view of the law this data should be as secure to your person as if it were sitting in a locked filing cabinet in your home office.

So how about fixing it? Well, he says, it needs to start by reforming the laws that cover the intelligence community, preventing them from bulk collection of the data you've handed to third parties.

I believe that any serious effort to reform this law needs to end the bulk collection of Americans’ personal information, starting with their phone records. I have been challenging this program for years on the grounds that isn’t just harmless old metadata. Furthermore, I believe that Congress needs to reform the Foreign Intelligence Surveillance Court, to make it more transparent and to include an advocate for the American people. Additionally, there needs to be much greater transparency from intelligence agencies about the scale and scope of domestic surveillance activities, and private companies should be given the ability to disclose much more information about requests they receive from the government. Most of all, Congress must close the loophole that intelligence agencies are currently using to read a significant number of Americans’ communications without a warrant.

But that's just the start. He calls out Executive Order 12333, which we've been discussing lately. That's the Ronald Reagan-signed executive order that lets the NSA collect whatever the hell it wants outside of the US. As was recently revealed, this program, which has no Congressional or Judicial oversight, is really the core program that the NSA uses. All the domestic spying under Section 215 and 702? That's just to "fill in the gaps." Wyden thinks its time that EO 12333 got reviewed and reformed:

The next step will be to seriously examine collection that is done overseas. When the Foreign Intelligence Surveillance Act was written in the late 1970s, it was written to only apply to collection done inside the United States. But that was back in an era when each country essentially had its own separate communications infrastructure.

Now those separate systems have been replaced by an integrated global communications network, in which calls and emails within one country might be routed through multiple different countries. When you combine that shift with new technology that makes it much easier to obtain large amounts of data, it no longer makes sense to assume that collection done overseas will not sweep up the communications of large numbers of law-abiding Americans.

This means that the rules that govern collection overseas will need to be substantially revised. These are governed by something called Executive Order twelve-triple-three, which is more than 30 years old and predates this sea-change in global communications. I was encouraged a few weeks ago when the Senate Intelligence Committee recognized this fact, and voted to advance a bill that would begin to establish some firmer rules in this area.

Finally, he talks about the need for ECPA reform -- another thing we've been discussing for years. ECPA is the 1986 Electronic Communications Privacy Act which is so woefully out-of-date, it's not even funny. It's the one that assumes if any communication is sitting on a server for more than 180 days, then it's "abandoned." Go look at how many emails in your Gmail account are over 180 days old... Even though more than half of the House is co-sponsoring an ECPA reform bill, law enforcement folks are protesting it, because they like the easy access. The DOJ loves to go on fishing expeditions with ECPA, as does the SEC and the IRS. Wyden says it's time for real reform.

There's much more that can be done, some of which he refers to in his speech, but it would be nice if Congress finally realized just how truly dangerous the third party doctrine is to our privacy.

Filed Under: ecpa, ecpa reform, metadata, nsa, privacy, ron wyden, surveillance, third party doctrine

Court Says Who Cares If Ireland Is Another Country, Of Course DOJ Can Use A Warrant To Demand Microsoft Cough Up Your Emails

from the say-what-now? dept

A NY judge has ruled against Microsoft in a rather important case concerning the powers of the Justice Department to go fishing for information in other countries -- and what it means for privacy laws in those countries. As you may recall, back in April, we wrote about a magistrate judge first ruling that the DOJ could issue a warrant demanding email data that Microsoft held overseas, on servers in Dublin, Ireland. Microsoft challenged that, pointing out that you can't issue a warrant in another country. However, the magistrate judge said that this "warrant" wasn't really a "warrant" but a "hybrid warrant/subpoena." That is when the DOJ wanted it to be like a warrant, it was. When it wanted it to be like a subpoena, it was.

Microsoft fought back, noting that the distinction between a warrant and a subpoena is a rather important one. And you can't just say "hey, sure that's a warrant, but we'll pretend it's a subpoena." As Microsoft noted:

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

The DOJ hit back earlier this month by basically saying, "yeah, whatever, let's pretend it's a subpoena and give us what we want already."

Overseas records must be disclosed domestically when a valid subpoena, order, or warrant compels their production. The disclosure of records under such circumstances has never been considered tantamount to a physical search under Fourth Amendment principles, and Microsoft is mistaken to argue that the SCA provides for an overseas search here. As there is no overseas search or seizure, Microsoft’s reliance on principles of extra-territoriality and comity falls wide of the mark.

Unfortunately, it appears that the judge just went with the DOJ's reasoning -- though, immediately stayed the ruling since Microsoft made it clear it plans to appeal. Judge Loretta Preska basically just upheld the magistrate judge's ruling that Microsoft could, in fact, be compelled to hand over data held overseas via a warrant under ECPA, the Electronic Communications and Privacy Act (which we've already noted has tremendous problems and needs to be reformed).

Beyond the problems this has for the 4th Amendment in the US, it's also going to create a mess in Europe, where they have much stricter data privacy rules, and where something like ECPA is clearly a problem. For the US to argue that it can make ECPA reach across the ocean into European servers is going to be a big problem -- especially at a time when Europeans are (rightfully) distrustful of the US government's ability to snoop on their data.

Filed Under: 4th amendment, data protection, ecpa, ecpa reform, email, eu, ireland, loretta preska, privacy, subpoena, warrant
Companies: microsoft

DOJ Tells Court That Of Course It Can Go On A Fishing Expedition Globally For Emails Microsoft Stores Overseas

from the because-we're-the-us-gov't-dammit dept

Last month, we wrote about Microsoft challenging the DOJ's attempt to use the outdated Electronic Communications Privacy Act (ECPA) to go fishing for emails held overseas. As Microsoft rightly noted, a warrant does not apply overseas. A magistrate judge tried to dance around this, saying that a warrant under ECPA is really kinda like a subpoena. But Microsoft points out how insane that is:

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The DOJ has responded to Microsoft's filing and basically says yeah, whatever, we can take whatever we want, and if it's overseas, who cares?

Overseas records must be disclosed domestically when a valid subpoena, order, or warrant compels their production. The disclosure of records under such circumstances has never been considered tantamount to a physical search under Fourth Amendment principles, and Microsoft is mistaken to argue that the SCA provides for an overseas search here. As there is no overseas search or seizure, Microsoft’s reliance on principles of extra-territoriality and comity falls wide of the mark.

A bunch of tech and telco companies have all jumped into the case on Microsoft's side as well, noting that the DOJ's argument would almost certainly violate data privacy laws in other countries, not to mention piss off governments around the globe. The crux of the argument, as per usual with the DOJ, is that when it wants data, it will twist and twist and twist the laws to enable it to get access to as much data as possible, with as little scrutiny as possible. This is just one of many reasons why we need serious ECPA reform -- such that it actually respects the 4th Amendment. But, in this case, it would be nice to have a judge realize that even under such an outdated law, the DOJ's interpretation is simply out of line.

Filed Under: doj, ecpa, email, jurisdiction, overseas, sca, subpoena, warrant
Companies: microsoft

More Than Half Of The House Co-Sponsoring Email Privacy Reform; So Why Isn't It Moving?

from the ecpa-reform-now dept

For quite some time we've talked about the importance of ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is woefully outdated. Passed in the 1980s, when the internet was just a small network that connected a few universities, it has allowed law enforcement and other government officials to snoop on your email based on some very outdated definitions and assumptions. As we've discussed in the past, one very obvious example, is the idea that, under the law, emails stored on a server for over 180 days are considered "abandoned" and that there's no need to get a warrant to view those emails. Of course, that was back when people expected old emails to be either deleted or downloaded. No one predicted "cloud" computing with virtually unlimited storage.

For years now, there's been a major effort at ECPA reform, to actually make sure that law enforcement needs a warrant to view your emails. It has had strong support in Congress for some time, but the main folks fighting against it are the SEC and the IRS, who like the fact that they can search through your emails without a warrant. In fact, the SEC seems to revel in its ability to do some very questionable things, in part thanks to ECPA.

Earlier this week, the main ECPA reform bill in the House, sponsored by Reps. Kevin Yoder and Jared Polis, hit a new milestone: it currently has 218 co-sponsors, meaning that more than half of the House now has their name on the bill. And yet, the bill is still stalled out, because House leadership has been scared off by the SEC and IRS. Hopefully, the House will finally move forward on this bill.

And while Yoder notes in that article that the NSA revelations have actually helped give this bill momentum, it's important to note that this is separate from the NSA reform issue. ECPA reform is unrelated to the NSA stuff, but covers what other government agencies can do with your email. Both are important issues, but it would be great to finally get basic ECPA reform through. This is a fight that's been going on for over a decade, and with more than half the House supporting it, how much longer can Congressional leadership ignore it?

Filed Under: 4th amendment, ecpa, ecpa reform, irs, jared polis, kevin yoder, privacy, sec, warrants

Microsoft Challenges Idea That US Government Can Go Fishing For Emails Stored Outside The US

from the going-to-be-an-important-fight dept

Back in April, we wrote about a magistrate judge ruling that Microsoft had to comply with a warrant asking for data that was held on servers in Dublin. Microsoft argued, quite reasonably, that a US warrant doesn't apply outside of the US. Unfortunately, magistrate judge James Francis disagreed, saying that while it's true that traditional warrants only apply inside the US, this is different because it's "digital." He argued that because the issue was about information, rather than physical property, it could be considered more like a subpoena than a warrant. As we noted, Microsoft made it clear that it would challenge this ruling, and now it has done so, arguing that the ruling flies in the face of the law and the Constitution. This summary from Microsoft's filing is pretty clear on what an incredibly big deal this is, with the government basically seeking to get the best of a subpoena and a warrant without any of the protections and limits required of either:

The Magistrate Judge issued a warrant under the Electronic Communications Privacy Act ("ECPA") that on its face, purports to authorize the Government to search any and all of Microsoft's facilities worldwide. Microsoft moved to vacate the warrant because the private email communications the Government seeks are located in a Microsoft facility in Dublin, Ireland and because Congress has not authorized the issuance of warrants that reach outside U.S. territory. The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad. To end-run these points. the Government argues, and the Magistrate Judge held, that the warrant required by ECPA is not a "warrant" at all. They assert that Congress did not mean "warrant" when using that term, but instead meant some previously unheard of "hybrid" between a warrant and subpoena duces tecum. The Government takes the extraordinary position that by merely serving such a warrant on any U.S.-based email provider, it has the right to obtain the private emails of any subscriber, no matter where in the world the data may be located. and without the knowledge or consent of the subscriber or the relevant foreign government where the data is stored.

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

Verizon has stepped in as well, pointing out that if the original ruling is allowed to stand, it could have significant negative impact on the ability of US businesses to get non-US users to trust them -- an increasingly important issue in light of the Snowden revelations.

The magistrate’s ruling, if left standing, could cost U.S. businesses billions of dollars in lost revenue, undermine international agreements and understandings, and prompt foreign governments to retaliate by forcing foreign affiliates of American companies to turn over the content of customer data stored in the United States.

The recent revelations about U.S. intelligence practices have heightened foreign sensitivities about the U.S. government’s access to data abroad, generated distrust of U.S. companies by foreign officials and customers, and led to calls to cease doing business with U.S. communications and cloud service providers. Studies have estimated that this distrust will result in tens of billions of dollars in lost business over the next few years. The magistrate’s ruling, if left standing, will dramatically increase the harm to American businesses. It would mean that foreign customers’ communications and other stored data would be available to hundreds or thousands of federal, state, and local law enforcement agencies, regardless of the laws of the countries where the data is held. Foreign customers will respond by moving their business to foreign companies without a presence in the United States.

If you hadn't figured it out by now, this case is going to have tremendously important ramifications for privacy around the globe.

Filed Under: doj, ecpa, email, international, james francis, magistrate judge, privacy, sca, subpoena, warrants
Companies: microsoft

Can Senator Leahy Actually Get Anything Done To Help With Civil Liberties And Innovation?

from the weakest-'powerful'-senator dept

Senator Patrick Leahy is often considered one of the most powerful Senators. He's the most senior Senator, third in the presidential line of succession (after the VP and the Speaker of the House) and the head of the powerful Senate Judiciary Committee. He's often presented as a "friend" to both the technology and civil liberties communities -- even though many in both of those communities still view him skeptically for his all out support for dangerous copyright legislation in the PROTECT IP Act (PIPA), which would have seriously messed with the underlying DNS structure of the internet. Even so, on a variety of other issues, including NSA reform, ECPA reform and patent reform, he's often been seen as leading the charge.

But over and over again, it seems that charge is... to go nowhere.

Politico has a story about how last week was a disaster for the tech industry in Washington DC. For all the talk about how Silicon Valley has been flexing its lobbying power, patent reform was killed, a good NSA reform bill was replaced with a bad one (leading the tech industry to pull its support) and the fight for immigration reform went the way it normally does -- nowhere beyond people yelling at each other.

But what I found even more interesting is just how powerless the "powerful" Senator seems to be on so many of these issues. Leahy has been the leading Senate voice for ECPA reform (requiring a warrant to search your electronic data) for years -- and it has pretty widespread support. And yet, he's unable to get it to move forward because the the SEC and IRS want to be able to read emails without a warrant. Really?

Similarly, for over a decade, Leahy has been the point person on patent reform in the Senate, promising to finally reform the system to stop abusive patents. The bill he finally got through in 2011 did absolutely nothing after it was watered down and watered down and watered down some more. And this year, when it looked like there might finally be a bill with at least a little (not nearly enough) progress towards stifling abusive patent practices, he got completely shut down by the trial lawyers and Harry Reid.

And, now we're basically relying on Senator Leahy to fix the NSA reform package. He introduced the companion to the USA Freedom Act in the Senate, and many in the tech and civil liberties communities are hopeful that Leahy will stand firm in actually reforming the NSA. And while he's been saying all the right things about reforming the NSA, given his track record, you have to start to wonder: can this super powerful Senator actually get this done right?

Yes, getting anything done in Congress is a pretty difficult process these days (perhaps for good reason). But we keep hearing about how Senator Leahy is so powerful and such a friend to innovation and civil liberties. But over the past few years, it's been a lot of tough talk, and nothing ever seems to actually get done. It really begins to make you wonder if he's such a "friend" to these communities after all.

Filed Under: civil liberties, ecpa, ecpa reform, patent reform, patents, patrick leahy, politics, senate judiciary committee, usa freedom

SEC Is A Due Process Nightmare: Searches Emails Without A Warrant, Refuses To Share Exculpatory Evidence

from the the-sec-doesn't-like-the-constitution dept

Back in December, we wrote about the effort to push for ECPA reform by noting that one of the main government agencies fighting against it was the SEC, which wanted the ability to snoop through your emails without getting a warrant. If you don't remember, ECPA is an excessively outdated law from 1986, whose definitions make no sense in the internet era (especially one with cloud computing). The key example often given is that emails on a server that are over 180 days old are considered "abandoned" and thus no warrant is needed to access them. That may have kind of made sense in an era when people downloaded all of their email, but now that nearly all email remains on servers somewhere it makes no sense at all. There are other problems with ECPA similar in nature (opened vs. unopened emails are treated differently, for example), but it's clear the law is outdated.

Two stories popped up last week that raise serious concerns about the way that the SEC tramples on the Constitution. The first is that in a hearing, SEC boss Mary Jo White was asked why the SEC is so resistant to ECPA reform and what's wrong with getting a warrant, and more or less admitted that it's standard practice for the SEC to not get a warrant, but to rely on loopholes in ECPA to get access to emails. Prior to this, many had assumed that this was just a desire of the SEC, not that they were regularly doing it. But White's answer makes it clear that the SEC views this practice -- which seems like it should be a clear 4th Amendment violations -- as standard operating procedure. While she insists that the privacy issues aren't a huge deal, because the SEC tries to "give notice" to the subscriber whose email is being accessed, that still doesn't explain why paper documents require a warrant, and yet the SEC doesn't bother with the much higher standard (including judicial review) of a warrant for electronic documents.

Meanwhile, concerning a separate issue, Mark Cuban and his lawyer published an op-ed in the Wall Street Journal last week, discussing the SEC's totally bogus case against him for insider trading, which got tossed out by a lawyer. The key issue they discussed is how the SEC had exculpatory evidence that proved Cuban had done no wrong from back in 2004 -- and then did everything possible to avoid turning over that evidence, as is normally required in legal proceedings.

In a criminal trial, the federal government has long been obliged to promptly turn over to the defense any evidence that could show that the accused did not commit the offense of which he is accused. The Brady rule (announced in the 1963 Supreme Court case, Brady v. Maryland), prevents one-sided prosecutions in which the defendant is kept in the dark about information that might show that he is innocent.

The government's job as criminal prosecutor is not to obtain convictions, but "to do justice," according to the traditional legal maxim. It should be required to follow the Brady rule in civil trials as well. But the SEC does not, even when it accuses a citizen of fraud. Had the agency complied with this simple rule in its recent insider-trading case against one of us, Mark Cuban, it is unlikely that a lawsuit would even have been filed, let alone go to trial.

At issue were notes the SEC had concerning the details of Cuban's conversation with the CEO of Mamma.com, the search engine Cuban had invested in (and then sold all his shares in), which showed that, contrary to the SEC's claims in the case against him, Cuban had never made certain promises. When Cuban and his lawyer asked for these notes, the SEC resisted.

The SEC, however, resisted the disclosure of these notes for the next three years. Even up until the time Mr. Cuban took the stand, the SEC continued to fight to keep the notes from being shown to the jury by asking the judge to exclude them from evidence. Fortunately, the judge disagreed and the jury ultimately cleared Mr. Cuban of a charge of insider trading.

So, reading both of these stories, we see that the SEC feels that it is free to ignore both the 4th Amendment (against search and seizure without a warrant) and the 14th Amendment (concerning due process). Don't we think that agencies of the federal government should be required to follow the Constitution -- especially basic concepts like protecting the privacy of individuals and giving them basic due process? And, for those of you who think this is no big deal, because it's the SEC, and the SEC just goes after big bad bankers and the like, recognize that the agency following right behind the SEC in fighting ECPA reform is the IRS. Do you feel it's similarly okay for the IRS to search your emails and electronic records without a warrant while also believing that it need not share any of the exculpatory evidence it finds, proving your innocence, while bringing a case against you for violating the law?

Oh, and just for the hell of it, let's take this a step further. Just a few weeks ago, the NY Times reported on an increasingly popular tactic of law enforcement to effectively use the SEC to trick people into effectively implicating themselves in criminal cases. It tells the story of a low-level guy who worked at a law firm, and was asked by the SEC to "help out" with an investigation. Only at the last minute, was it mentioned that someone from the district attorney's office would be present -- and at no time was there any indication that the guy was being investigated for criminal behavior. But thanks to the SEC smokescreen, the guy was indicted, and he's still not sure why.

So, now it's an SEC that ignores the Constitution, searches emails without a warrant, hides exculpatory evidence and surreptitiously uses these "investigations" to help build out criminal charges against people on a highly questionable basis. See the problem, yet?

The folks over at VanishingRights.com are fighting to reform ECPA, which would at least solve half of the problem above. Right now, the SEC and the IRS remain the main government agencies aligned against such reform. It's time to tell those agencies that they need to obey the Constitution too.

Filed Under: 4th amendment, due process, ecpa, ecpa reform, irs, mark cuban, mary jo white, sec, warrantless searches, warrants

ECPA Reform Petition Passes 100K Signature Threshold With A Last-Minute Surge

from the and-now-we-wait... dept

The We the People petition to reform the ECPA in order to give email the same Fourth Amendment protection that snail mail enjoys narrowly passed the 100K signature threshold needed to (theoretically) prompt a response from the administration.

The last-minute push to hit the mark was impressive. Reminded by the post here yesterday that I hadn't actually signed the petition yet, I went and remedied that around 5 pm (CST) yesterday evening. At that point, it looked as though the petition would be an also-ran, having only gathered about 78,000 signatures with just a few hours remaining.

Needless to say, I was a bit surprised to read this morning that it had hit 100,000 signatures. The Hill rather hopefully states that the White House "must" now respond to the petition, but as we've seen in other cases, the response is either long-delayed (the Snowden petition is going on its fifth month of being ignored) or treated to an administrative pat on the head and a brief rehash of the Official Talking Points.

One would hope this one does prompt a serious response. The only reason this law hasn't been updated is because treating email 180 days old or older as "abandoned" cuts down on the requirements law enforcement and investigative agencies need to meet to access it. These entities obviously benefit heavily from the clearly outdated law and have no interest in seeing this convenient loophole in Fourth Amendment protection closed. The administration has long defended our nation's intelligence and investigative agencies, so it may have little interest in making their jobs "harder." On the other hand, this support has seen a marked decline over the past few weeks, and there are indications that some in the White House really do want to fix this, so there may be some hope yet.

On the plus side, The Hill reports that the DOJ has already weighed in on this topic.

At a House hearing in March, Elana Tyrangiel, the acting assistant attorney general for the Justice Department's Office of Legal Policy, agreed that updating ECPA has "considerable merit."

"We agree, for example, that there is no principled basis to treat email less than 180 days old differently than email more than 180 days old," she said "Similarly, it makes sense that the statute not accord lesser protection to opened emails than it gives to emails that are unopened."

This step in the right direction was unfortunately tempered by a massive step backward.

But she urged lawmakers to exempt civil regulatory investigations from the warrant requirement. She explained that regulators investigate conduct that is unlawful, but not necessarily criminal. She argued that because regulators often do not have access to the warrant power, the requirement would impede critical government investigations.

This "exemption" basically defeats the entire purpose of ECPA reform, and in some ways, makes things worse. It takes a little loophole in the law, which came about because of changes in technology, then widens it and puts a giant stamp of approval on it. It goes from a little loophole that violates the 4th Amendment to a big official law that violates the 4th Amendment.

On top of that, frankly, I'm of the opinion that government investigations could use a few more impediments. And it's not as if regulators can't compel production of email through subpoenas. Just because they're not pursuing criminal charges doesn't mean they're completely out of options. When you're looking to close a loophole, it's hardly beneficial to create a giant open door in its place. Civil regulatory agencies should treat the email it seeks like it does any other document. If it can't just seize these because an arbitrary amount of time has passed, then it shouldn't be able to do so with email. The rules need to be standardized, not undermined by exceptions and justifications.

Filed Under: ecpa, ecpa reform, petition, white house

If You're An American Who Believes In The 4th Amendment, You Have No Excuse Not To Sign This Petition

from the don't-let-it-continue dept

We've written a few times recently about the importance of ECPA reform, to bring a woefully out of date law into the 21st century. Specifically, we've urged people to sign this White House petition in favor of ECPA reform. That petition closes soon, and it's still a bit short of the 100,00 goal.

Why is this important to you? Because, without it, it's much easier for the government to snoop on your emails without a warrant. What people want is for emails and regular mail to be treated the same, which is simply not the case today. While this is a separate issue from the NSA stuff, it does matter quite a bit, and this is a chance for there to be a real win that helps protect your privacy. Fighting against this proposal are a variety of government agencies, led by the IRS and the SEC, which have made good use of this loophole to read emails without getting a warrant. This is not what the law was intended for at all. It's a loophole based on the outdated law, which was written in 1986, before anyone could comprehend things like web-based email. The IRS and SEC like having this loophole, and they don't want it to go away. In fact, they want it to be made explicit, rather than an accidental loophole of history. That should be a massive affront to folks who believe in the 4th Amendment and the basic concept that a search should require a warrant based upon probable cause.

I know that many people have dismissed the whole concept of White House petitions, and take a rather cynical view of the whole thing. That's a very dangerous approach here, only helping to further the problems:

1. Yes, it's true that the White House has ignored certain petitions in the past. It's also true that there are certain issues where the White House doesn't really seem to care what people have to say, it's made up its mind.
2. But, that is not always the case, and the White House has used these petitions to take strong positions in the past -- including on things like SOPA and mobile phone unlocking. When accompanied by a strong campaign beyond just the petition, the White House seems open to taking certain issues more seriously. This is one of those.
3. By all indications, there are some in the White House who agree that ECPA is out of date and needs to be fixed. There appears to be an internal debate about where the official White House position will be -- whether it's siding with the IRS and SEC -- or with the 4th Amendment rights of the public. Having a ton of signatures from the American public on their side will absolutely help those in the White House who support real and meaningful ECPA reform push back against the agencies.
4. This isn't an empty gesture. There are bills in the House and Senate to fix ECPA, close the loopholes and protect your 4th Amendment rights. Getting White House support could finally push those bills over the edge and make them law.
5. Sticking with the cynical approach and refusing to sign guarantees failure. Not signing works to the advantage of the IRS and SEC and others who like using this loophole. Even if you're cynical about this, signing the petition at least gives it a chance to influence the debate.

And, yes, I know that outside of the general debate over ECPA, people will look at the NSA situation and argue that it doesn't really matter what the law says. That's not true. Yes, the NSA issue is a big one that needs to be dealt with, but this is about a loophole that goes way beyond the NSA, and is used and abused by different government and law enforcement agencies. Here's a real chance to push back on that and to score a real victory for privacy. Letting cynicism and apathy dictate your move here guarantees that the forces pushing against your 4th Amendment rights win. So take a chance and sign the petition.

Filed Under: 4th amendment, ecpa, ecpa reform, irs, petition, privacy, sec, warrants

The IRS And SEC Want To Snoop Through Your Email Without A Warrant; Don't Let Them

from the speak-up,-fix-ecpa dept

We've talked a lot about ECPA reform -- which is the incredibly outdated "electronic communications privacy act" which actually makes sure that you have less privacy than other forms of communication. This isn't necessarily on purpose, but because the law was written in the mid-1980s when email itself was a relatively new concept. It includes some bizarre distinctions between opened and unopened emails and if a message has been "left on a server" for more than 180 days (at which point it's considered "abandoned" and not subject to a warrant). Obviously it never anticipated the kind of internet we have today. It also goes against basic 4th Amendment principles and treats electronic messages differently from physical messages.

There actually is a fair bit of support in both Congress and the White House to fix this... if we can get enough public support behind it, which includes getting more people to sign this petition. As with SOPA, there's a strong suggestion that if this petition tips the scales at 100,000, we can get the White House to come out in favor of ECPA reform.

What's standing in the way? Well, a bunch of government agencies, honestly. There are the obvious ones like the DOJ and DHS. That's to be expected. They always want to make it easier to snoop through emails and written communications. But apparently some of the strongest voices trying to block ECPA reform within the government are coming from the SEC and the IRS, because they too see plenty of advantages in trying to snoop through emails without having to take the trouble of getting a warrant.

As I write this, I'm participating in a Reddit AMA (Ask Me Anything) with Chris Calabrese from the ACLU, Mark Stanley from the Center for Democracy and Technology and Julian Sanchez from the Cato Institute. This coincides with a day of action involving a bunch of companies and organizations trying to get more people to speak out on the importance of ECPA reform. And, finally, the folks at TechFreedom have put together a great infographic, which we've also embedded below.

Filed Under: ecpa, ecpa reform, emails, irs, messaging, privacy, sec, warrants