Post-Petraeus, Net Privacy Backers Hope For A Boost

Nov 16, 2012
Originally published on November 16, 2012 10:20 pm

The tech industry has been lobbying hard for an update to the Electronic Communications Privacy Act, the 1986 law governing online privacy.

Under an umbrella group calling itself Digital Due Process, companies and civil liberties groups have argued that the law is too loose with the privacy of data stored online, especially Web-based email and other documents on the cloud.

For instance, the law considers data that's more than six months old to be "abandoned" — not deserving of the same protection as real-time communications. A bill to change this has been languishing in the Senate Judiciary Committee since last year.

But in the wake of the FBI investigation that triggered Gen. David Petraeus' resignation, there's sudden new interest in the bill.

Tracking Government Queries

"The most recent news that's been all over the place certainly has highlighted this issue," says Richard Salgado, legal director at Google.

He can't comment, he says, on whether the company played a role in the Petraeus investigation. But the company does keep track of the total number of requests for information from government agencies, in order to shed light on those requests. The semiannual publication of Google's "Transparency Report" coincided with the Petraeus scandal this week.

Salgado says that of the nearly 8,000 requests for user data, the vast majority were for information to help identify the owners of email accounts and other online services.

"The police come to us with a subpoena and have identified an email address of interest to them, and have asked for information that the user provided in creating that email address," Salgado says.

That includes IP addresses — the numeric code of the computer you used when logging into that anonymous Gmail account you keep for private matters.

The fact that police can get that information with a subpoena — just a letter, usually without approval of a judge — is deeply disturbing to civil libertarians like Chris Calabrese, legislative counsel for privacy issues at the ACLU.

"Before the government engages in a really invasive investigation like this, a judge should be involved," Calabrese says. "They should use the same standard as if they searched your house: They should get a warrant, based on probable cause."

The ACLU and its tech industry allies want warrant-level protection for most online data — even data that experts call "transactional": the addresses of websites you've visited or your phone's location history.

A Burden For Law Enforcement

But Scott Burns, executive director of the National District Attorneys Association, says Americans should understand how much more work that would create. "The difference is, an investigative subpoena is a one- or two-pager, and a search warrant is a book report," Burns says.

All those extra warrants, he says, would make life "incredibly difficult" for police.

In Burns' opinion, asking for information that helps identify someone — or that person's Internet service provider — is simply not that intrusive.

"I don't think anyone would disagree with the fact that matching an ISP is much less invasive than an investigator looking over hundreds or perhaps thousands of emails or texts," Burns says.

And there's been a shift toward more protection for content — what's actually inside those emails and texts — in the past few years. While federal law doesn't require warrants for content left online for more than six months, in practice, Burns says, local and state prosecutors almost always do get them.

Google also takes this position, telling police to get a warrant for content, no matter how old. Salgado says the company takes that stance on constitutional grounds, despite the 1986 law that would seem to indicate no warrant is needed for content older than six months.

Still, the ACLU's Calabrese wants to see that standard enshrined in federal law. And with the Petraeus episode, he's hoping for new momentum.

"Always, the most difficult piece of privacy law is to put a face on it," he says. "Well, I think the Petraeus scandal has solved that particular problem."

But the Petraeus scandal has not yet put privacy on a fast track. One Senate staffer says members of Congress who support tighter rules want to wait to see more details about how — and why — the FBI took its investigation as far as it did.

Copyright 2013 NPR. To see more, visit http://www.npr.org/.

Transcript

MELISSA BLOCK, HOST:

Emails played a key role in the downfall of David Petraeus, and the FBI investigation into those emails is leading to renewed questions about law enforcement's access to electronic communication. Tech companies and civil liberties groups hope the scandal will breathe new life into efforts to make it harder for the governments to seek personal data online. NPR's Martin Kaste reports.

MARTIN KASTE, BYLINE: The tech industry has been lobbying hard for an update to the 1986 online privacy law. There is a bill in the Senate, but it's languished in committee since last year. Now, suddenly, there's new interest.

RICHARD SALGADO: The most recent news that's been all over the place certainly has highlighted this issue.

KASTE: Richard Salgado is legal director at Google. He can't comment on whether his company played a role in the Petraeus investigation. But he says most of the time, police come to Google asking for information that will help them identify a user - say, the owner of an email address.

SALGADO: The police come to us with a subpoena and have identified an email address of interest to them. And have asked for information that the user provided in creating that email address.

KASTE: The information includes IP addresses, the numeric code of the computer you used when you logged into that anonymous Gmail account that you keep for private matters. The fact that the police can get that with a subpoena - which is just a letter, usually without approval of a judge - is deeply disturbing to civil libertarians like Chris Calabrese, legislative counsel at the ACLU.

CHRIS CALABRESE: Before the government engages in a really invasive investigation like this, a judge should be involved. You know, they should use the same standard as if they searched your house, which is they should get a warrant based on probable cause.

KASTE: The ACLU and its tech industry allies want warrant-level protection for most online data, even data that experts call transactional - for instance, the addresses of websites you visited or your phone's location history. But Scott Burns says Americans should understand how much more work that would be.

SCOTT BURNS: The difference is, an investigative subpoena is a one- or two-pager, and a search warrant is a book report.

KASTE: Burns is head of the National District Attorneys Association. He says all those extra warrants would make life incredibly difficult for police. And he says asking for transactional data - say, the connection records from an internet service provider - is not that intrusive.

BURNS: I don't think anyone would disagree with the fact that, you know, matching an ISP is much less invasive than an investigator looking over hundreds and perhaps thousands of emails or texts.

KASTE: And in the last few years, there has been a shift toward more protection for content, for what's inside those emails and texts. While federal law does not require warrants for content left online more than six months, in practice, Burns says, local and state prosecutors almost always do get warrants. Google also takes this position, telling police to get a warrant for content, no matter how old. Still, the ACLU's Calabrese wants to see that standard enshrined in federal law, and he's hoping for new momentum.

CALABRESE: Always the most difficult piece of privacy law is to put a face on it. Well, I think the Petraeus scandal has, you know, solved that particular problem.

KASTE: But the Petraeus scandal has not yet put privacy on a fast-track on Capitol Hill. One committee staffer says members of Congress who support tighter rules want to wait to see more details about how and why the FBI took its investigation as far as it did. Martin Kaste, NPR News. Transcript provided by NPR, Copyright NPR.