< The Other Privacy Debate


Friday, May 28, 2010

While the debate over Facebook’s privacy policy has garnered all the attention, a lesser known but far more wide-ranging battle for online privacy has also been in the works. The Electronic Communications Privacy Act governs how law enforcement officials may access information about us stored online. But the act was drafted in 1986. Remember 1986? That was the year of Chernobyl. It was the year a lady named Oprah Winfrey began her talk show, and when the most popular movie was:

[TOP GUN SOUNDTRACK] Top Gun. In short, it was a long time ago. Most people hadn't even heard of the internet and far fewer had actually used it. Digital Due Process is a coalition of companies, including Google and Microsoft, civil liberties groups, political organizations and academics, working to update the Electronic Communications Privacy Act, also known as ECPA. According to Kevin Bankston, a senior staff attorney at the Electronic Frontier Foundation, which is part of Digital Due Process, the government has easy access to much of your life online, and ECPA provides woefully inadequate protections.

KEVIN BANKSTON: The ECPA has what we think is an outdated distinction between services that provide you communications service, say, your email provider or your ISP or whatever, and services that provide you storage or processing of your data. So Gmail is providing you communications service and your emails are relatively strongly protected, while your Google Doc, which you’re merely storing with Google, is weakly protected, such that the government could obtain your documents with only a subpoena. And in many cases, this can be done without any notice to the subscriber, so that you don't even have an opportunity to try and fight that subpoena.

BOB GARFIELD: There is no judge he has to persuade that this document is significant for his investigation.

KEVIN BANKSTON: Exactly - another great example of an anachronism in the law that doesn't make any sense anymore. Right now the law pretty clearly requires a warrant if the government wants to get your email. But that warrant requirement only applies for emails that are 180 days old or less. And you’re probably wondering, what’s with this six-months cutoff, where did that come from?

BOB GARFIELD: What’s with the six-month cutoff? Where did that come from?

KEVIN BANKSTON: Well, that kind of made sense in 1986, because back then, no one stored their email with their provider. You would dial into your provider and download your email and have it deleted off the server. So if there was email sitting on an email provider’s server after six months, it was safe to assume you'd abandoned that email and any privacy interest you might have. And so, we think - and one of our principles is pushing for removing this false and arbitrary 180-day cutoff, whereby you lose privacy protection the older your email gets.

BOB GARFIELD: Tell me exactly what your revision of the law would require a warrant for.

KEVIN BANKSTON: Well, any content that you store or transmit through the internet, if the government wants copies of those, they need to go to court, they need to prove probable cause of a crime, and particularly specify the things they want and get a judge to sign off on it before they can get it. It would also include, importantly, the logs that the search engines keep of what you search for, which has been a point of great controversy. There’s disagreement about how the law currently applies there, but we can't brook any lack of clarity on that score when such sensitive records are at issue. People treat the search engine like their most trusted friend. People tell Google things that they might not tell their spouse or their priest or their doctor. And so, it’s very important to the coalition to strongly protect that incredibly sensitive search data.

BOB GARFIELD: Kevin, you’re trying to get legislation but sometimes these things are nudged along by the courts, who themselves can rule that existing law is obsolete or just plain wrong. Have there been court decisions which will support you when hearings are held on the subject of ECPA?

KEVIN BANKSTON: To the extent that there are decisions, they don't always impact how the government operates as much as we'd like them to. One good example – I talked about how, under the law, the government needs a warrant for emails that are less than 180 days old. The government’s position is that it can get all of your email, everything in your inbox, everything in your sent folder, everything in your drafts folder. They can get all of that without a warrant, except for those few emails sitting in your inbox that you haven't read yet. And the Ninth Circuit Court of Appeals agreed with us, and said that regardless of whether your email is opened or unopened, it’s still protected by the ECPA. Despite that, the government routinely seeks emails less than 180 days without a warrant, and on occasion even will get orders from outside of the Ninth Circuit to send them into the Ninth Circuit, which includes California where most of the email providers are based. There's the other issue of when we do get opportunities to litigate these questions, it’s very common for the government to back down in order to avoid court decisions that disagree with it. We've seen this - the federal government in Colorado issued a court order to Yahoo! And Yahoo!, to its credit, pushed back and said, no, we think, under the law, you have to get a warrant. And we at EFF jumped into that case as friends of the court. And so, there are all these forces arrayed against the government in Colorado, ready to litigate this question. And the government dropped its application.

BOB GARFIELD: So you’re supposing that the government doesn't want court decisions. If they face resistance, they immediately, uh, sort of melt back into the population to fight at another place, another day.

KEVIN BANKSTON: In the end, the ambiguity of the law serves the government. If they get pushed back, they can just drop it and bring it up with a different judge later. And, in the meantime, we're all the losers because we are deprived of clear rulings on what the law means.

BOB GARFIELD: All right, Kevin, thank you very much.



BOB GARFIELD: Kevin Bankston is a senior staff attorney at the Electronic Frontier Foundation.