Civil Libertarians Wish CDT-Led Coalition Would Go Further on Changing ECPA
SAN FRANCISCO -- Civil liberties groups weren’t shy about airing publicly their dissatisfaction with the proposals of a sprawling coalition they've joined to seek a revamp of the federal Electronic Communications Privacy Act (ECPA). Representatives of the American Civil Liberties Union and the Electronic Frontier Foundation (EFF), members of the Digital Due Process Coalition, said they support its efforts but want to go considerably further in imposing probable cause and warrant requirements for government agents to get information about e-mail, cellphone calls and other newer forms of communications.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
Civil libertarians are disappointed that the coalition is working only on ECPA provisions regarding mandatory disclosure by service providers of communications data, EFF lawyer Kevin Bankston said late Tuesday. They support tightening the law concerning voluntary disclosure, too, he said at an American Constitution Society forum. The ACLU’s ECPA agenda is broader than the coalition’s -- http://xrl.us/bhxaxe -- said Nicole Ozer, the Northern California chapter’s technology policy director.
The House Judiciary Committee probably will hold its third hearing in September about changing ECPA, said Jim Dempsey, the Center for Democracy & Technology’s public-policy vice president who stitched together the coalition. “No legislation has been introduced,” and any bill “certainly wouldn’t move this year,” because of the elections, he said. Dempsey said he hopes that within a year, a bill will have been filed and “serious engagement by the administration” will be evident. The overhaul sought “is only going to happen” if the Department of Justice decides it needs clearer standards, and “it’s going to be a long process,” he said. Dempsey said meetings have been held with Justice and other administration officials. But he conceded that “we haven’t deeply engaged with the executive branch."
The coalition is seeking what it considers modest changes in the law, Dempsey said. The main ones are a warrant requirement to obtain communications content and for location tracking, and creating “a true judicial function” in decisions on a phone surveillance technique called pen registers, he said. Other members include AT&T, eBay, Salesforce.com and libertarian groups on the right, Dempsey said. The ACLU is leading grassroots efforts to change ECPA, he said. More than 40,000 people have gotten in touch with members of Congress over the past six months in support of updating ECPA, Ozer said.
Executives of Microsoft and Google, also part of the coalition, emphasized that what they consider differing, lenient and outdated legal standards under the law, and confusion about their interpretation, burden companies like theirs and hold back technology advances. The operators of Hotmail, Gmail and Yahoo Mail have to turn over messages more than 180 days old to government officials by subpoena, said Senior Counsel Richard Salgado of Google. Required notice to the account holder can be put off if, for example, it would endanger an investigation, he said.
Service providers are entitled to challenge officials’ information demands, but their legal, financial and publicity interests cut in favor of going along with them, Dempsey said. “The incentive is all in favor of ’ship it all off.'” Much information collection goes unnoticed, Bankston said. A decade passed before it became known that the government had been getting court orders to track cellphones without warrants, he said.
"We started seeing the cracks emerge in ECPA, and the real problems” with the arrival of Google’s Gmail and the service’s competition with Microsoft’s Hotmail to offer users massive storage at no charge, said Associate General Counsel Michael Hintze of Microsoft. Compliance with ECPA has cramped the company’s ability to market itself as protecting users’ privacy, he said.
The rise of cloud computing intensifies the importance of the level and clarity of legal protection for health and other sensitive information held on service providers’ servers, Hintze said. Corporate customers are in a better position to handle the risks than individuals, for whom “giving up even an iota of privacy is a real challenge,” he said. With the arrival of cloud operating systems like Windows Azure, there’s “an additional layer of complexity” added to cloud applications and operators, Hintze said.
ECPA is rife with “non-intuitive” distinctions between types of communication, information and service provider, Bankston said. “We don’t have clear rules for e-mail” almost 25 years “after the statute was passed,” though Congress had the technology in mind in creating the law, he said. Federal circuit courts and others disagree about the standards, which differ depending on where a message is and how long it has been there, Bankston said. The Justice Department’s position is that warrants are needed only to obtain unopened e-mails from in-boxes, he said. But some judges disagree, and no one is certain, Bankston said. “It’s a big mess,” Ozer said.
Google’s Salgado said Congress did as well as it could have with the law. Lawmakers couldn’t have foreseen in the mid-1980s the broadband and the drastic drop in storage costs that have resulted in mass use of new communications technologies for sensitive communications and in leaving messages on servers indefinitely instead of holding them on client computers and purging them often, he said. The statute just needs “freshening,” Salgado said. The 180-day cutoff “feels very arbitrary,” because the policy justification no longer seems to apply, he said. “If ECPA were a head of hair, I wouldn’t shave it,” Salgado said. “I'd just lose the mullet.”