Congress Weighs Online Privacy Law Update - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Healthcare // Analytics
03:00 PM
Connect Directly

Congress Weighs Online Privacy Law Update

Email access is one issue on the table in Electronic Communications Privacy Act revision. Balancing constitutional guarantees with the needs of law enforcement won't be easy.

 Facebook's Futuristic Data Center: Inside Tour
Facebook's Futuristic Data Center: Inside Tour
(click image for larger view and for slideshow)
Members of the business, academic and the law enforcement communities on Tuesday urged U.S. congressional representatives to revise the rules of government data gathering, but they didn't ask for the same things.

The House Judiciary Committee's Subcommittee on Crime, Terrorism, Homeland Security, and Investigations held a hearing on the Electronic Communications Privacy Act (ECPA), a 1986 law updated in 1994 and in 2001 that covers how government agencies can conduct surveillance and how they can demand information from organizations and individuals.

Committee Chairman Bob Goodlatte (R.-VA) acknowledged that the ECPA, a law intended to balance privacy rights with the requirements of law enforcement, needs to change. The technology of 1986, he said, seems ancient when compared to the Internet-enabled world of 2013.

"ECPA reform must be undertaken so that despite the evolution of technology and its use in the world, the constitutional protections reinforced by ECPA will endure," he said in prepared remarks.

[ Navigating the slippery slope of employee surveillance? Read Watching Workers: Where's The Line? ]

The hearing focused on lawful access to stored information. As far as law enforcement is concerned, access should be easier and faster. Richard Littlehale, assistant special agent in charge, technical services unit in the Tennessee Bureau of Investigation, testified that any revision to the ECPA should ensure that communications providers respond to law enforcement demands for information in a timely manner.

"There is no requirement in current law -- including search warrant practice -- for providers to respond in a timely fashion to lawful process requests by governmental entities," he said in prepared remarks. "Some providers routinely respond in a timely way, but others do not."

He urged the inclusion of "a reasonable legal mandate for responsiveness," insisting that it need not be too costly or burdensome to communications providers.

Littlehale also argued for the inclusion of mandatory text message retention rules in any ECPA revision. "Billions of texts are sent every day, and some surely contain key evidence about criminal activity," he said.

Elana Tyrangiel, acting assistant attorney general in the Office of Legal Policy, a division of the U.S. Department of Justice, expressed similar concerns. The law, she said, has been instrumental in tracking down violent criminals. "In one case, a suspected serial killer who had killed more than ten people sent an anonymous letter to a newspaper reporter that identified the location of a victim's body with an 'X' drawn on a map," she said in prepared remarks. "Investigators recognized the mapping website on which the serial killer generated the map. They obtained from that website the IP address of the user who had generated the map and then used ECPA process served on the user's Internet service provider to obtain the physical address of the subscriber who had visited the mapping website."

Even as she acknowledged flaws in the law, such as the way that email older than 180 days is treated differently than newer email, she emphasized that any ECPA revision should not put civil investigations on different footing than criminal inquiries. She also said that differences in the way that content and non-content information -- routing information -- are treated under the Pen Register Statute and the Wiretap Act need to be harmonized.

Richard Salgado, director of law enforcement and information security at Google, meanwhile advocated updating the ECPA so that it's consistent with constitutional privacy protections. "...ECPA frustrates users' reasonable expectations of privacy," he said in prepared remarks. "Users expect, as they should, that the documents they store online have the same Fourth Amendment protections as they do when the government wants to enter the home to seize documents stored in a desk drawer."

Orin S. Kerr, a law professor at George Washington University School of Law, offered a more extensive overview of the problems with the ECPA. In addition to citing the absence of warrant protection for email older than 180 days, he noted that search engine queries are not protected under the ECPA.

Kerr also said that warrant requirements are vague, that warrantless access provisions in the law fail to satisfy the Fourth Amendment, and that the current statute does not place any limits on the amount of information a communication provider can turn over to the government.

When communications providers respond to a government demand for information, they might send all the data they have. This might be a substantial amount of information. As Kerr noted, the typical Gmail user has about 17,000 email messages stored in his or her account at any given time. "Investigators can scan through all of the contents of a person's digital life without limit," he said.

The challenge lawmakers face is revising the law in a way that balances privacy concerns and the public interest.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

How SolarWinds Changed Cybersecurity Leadership's Priorities
Jessica Davis, Senior Editor, Enterprise Apps,  5/26/2021
How CIOs Can Advance Company Sustainability Goals
Lisa Morgan, Freelance Writer,  5/26/2021
IT Skills: Top 10 Programming Languages for 2021
Cynthia Harvey, Freelance Journalist, InformationWeek,  5/21/2021
White Papers
Register for InformationWeek Newsletters
Current Issue
Planning Your Digital Transformation Roadmap
Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
Flash Poll