Law
1:41 pm
Thu November 24, 2011

How Private Is Your Email? It Depends

Originally published on Thu November 24, 2011 5:36 pm

Do the police need a warrant to read your email? Believe it or not, two decades into the Internet age, the answer to that question is still "maybe." It depends on how old the email is, where you keep it — and it even depends on whom you ask.

Some big-name tech companies are now asking Congress to step in and clarify Americans' online privacy rights.

If you do run afoul of the law and you happen to be one of the millions of people who use Gmail then cops will likely be directing their inquiries to the legal department at Google, in Mountain View, Calif.

This building has the same college-dorm feel as the rest of the Google campus: a pool table, free food, young people in T-shirts. But that doesn't mean they're not busy. Every month, Google gets about 1,000 government requests for user data.

"We get agents calling us on the phone," says Richard Salgado, senior counsel at Google. "We get faxes and emails and snail mail. Sometimes we'll have an investigator show up in the lobby with a piece of paper."

Salgado says most law enforcement requests are legitimate, and Google complies promptly. But there are times when Google says "not so fast."

"My view and Google's view is that for the government to compel a provider to disclose the content of private communications, they need to get a search warrant," Salgado says.

Search Warrant?

A warrant means police have to show probable cause — it's a higher level of oversight, the kind of court order that cops need before they come into your home and, say, rummage through your desk.

The thing is, search warrants take more time and effort, so police sometimes point to the Electronic Communications Privacy Act of 1986; it says they don't need a warrant for older emails. Salgado admits that's true — and it's a problem.

"I think that your average user would be very surprised to hear the federal privacy statute that governs cloud computing would allow the disclosure of their emails with nothing more than an administrative subpoena," he says.

So Google insists on a warrant anyway — a warrant signed by a judge — on the theory that emails enjoy a higher, constitutional protection. Two federal appeals courts in different parts of the country have echoed this argument and most law enforcement agencies now do tend to get warrants. But tech companies say that doesn't resolve the bigger problem — that federal Internet privacy law is 25 years old and out of date.

To dramatize the point, the Center for Democracy and Technology, a privacy think tank, recently held a "retro tech fair" at the U.S. Capitol, featuring computers that are of the same vintage as the privacy law.

Jim Dempsey, the center's vice president for public policy, says industry has a financial interest here.

"They realize that their business depends upon the trust of their consumers," says Dempsey, who also helped organize Digital Due Process, an alliance of privacy groups and big tech companies that's trying to update the law. "And when they're selling their technology and selling their cloud computing services, they're constantly facing from Europeans and from others, 'Oh, Patriot Act, U.S. surveillance, our data is not secure if we trust it to an American company.' "

A Confusing Law

The law can also be just plain confusing. For instance, it provides greater privacy protection for communications than it does for stored documents. But what about, say, a document you're sharing with someone else online? Is that a form of communication or storage?

Dempsey wants to see a baseline of privacy protection for all online content, regardless of technology. That kind of sweeping new privacy standard raises some red flags for law enforcement, as Associate Deputy Attorney General James A. Baker told the Senate Judiciary Committee:

"If we were to raise the standard with respect to some electronic communications, even content, it's going to have an impact on law enforcement investigations," he said. "We have to be mindful of that; we have to be thoughtful about that. And so whatever proposals come forward, we have to look at that in that light."

An ambitious bill now in the Senate would cover everything from cloud computing to location data on phones. The chief sponsor, Democrat Patrick Leahy of Vermont, hopes to move it through the Judiciary Committee before the next election. But even if it passes the Senate, the bill faces a tougher challenge in the House, where the tech industry's lobbying muscle is less likely to overcome the Republican majority's reluctance to hamper law enforcement.

Copyright 2014 NPR. To see more, visit http://www.npr.org/.

Transcript

GUY RAZ, HOST:

It's ALL THINGS CONSIDERED from NPR News. I'm Guy Raz.

Do the police need a warrant to read your email? Believe it or not, two decades into the Internet age, the answer to that question is still maybe. It depends on how old the email is, where you keep it. It even depends on whom you ask. NPR's Martin Kaste reports that some big-name tech companies are asking Congress to step in and clarify online privacy rights.

MARTIN KASTE, BYLINE: If you do run afoul of the law and you happen to be one of the millions who use Gmail, then the cops will likely be directing their inquiries to this building – the legal department at Google in Mountain View, California. This building has the same college dorm feel as the rest of the Google campus. There's the pool table, free food, young people in T-shirts. But that doesn't mean they're not busy. Every month, Google gets about 1,000 government requests for user data.

RICHARD SALGADO: We get agents calling us on the phone, we get faxes and emails and snail mail. Sometimes we'll have an investigator show up in the lobby with a piece of paper.

KASTE: Richard Salgado is senior counsel at Google. He says most law- enforcement requests are legitimate, and Google complies promptly. But there are times when Google says, not so fast.

SALGADO: My view, and Google's view, is that for the government to compel a provider to disclose the content of private communications, they need to get a search warrant.

KASTE: A warrant means police have to show probable cause. It's a higher level of oversight – the kind of court order that cops need before they come into your home and, say, rummage through your desk. The thing is, search warrants take more time and effort, so police sometimes point to the Electronic Communications Privacy Act of 1986. It says they don't need a warrant for older emails. Salgado admits that's true, and it's a problem.

SALGADO: I think that your average user would be very surprised to hear the federal privacy statute that governs cloud computing would allow the disclosure of their emails with nothing more than an administrative subpoena.

KASTE: So Google insists on a warrant anyway – a warrant signed by a judge, on the theory that emails enjoy a higher constitutional protection. Two federal appeals courts in different parts of the country have echoed this argument, and most law- enforcement agencies now do tend to get warrants. But tech companies say that still doesn't resolve the bigger problem – that federal Internet privacy law, which is 25 years old and, they say, out of date.

To dramatize the point, the Center for Democracy and Technology, a privacy think-tank, recently held a retro tech fair at the U.S. Capitol, featuring computers that are of the same vintage as the privacy law.

JIM DEMPSEY: We've got a Compaq portable 3 from 1987 running that bright-orange-colored screen with Word Perfect 5.1.

KASTE: Jim Dempsey is the CDT's vice president for public policy. He also helped to organize Digital Due Process, an alliance of privacy groups and big tech companies that's now trying to update the law. He says industry has a financial interest here.

DEMPSEY: They realize that their business depends upon the trust of their consumers. And when they're selling their technology and selling their cloud computer services, they're constantly facing – from Europeans and from others – oh, Patriot Act, U.S. surveillance, our data is not secure if we trust it to an American company.

KASTE: The law can also be just plain confusing. For instance, it provides greater privacy protection for communications than it does for stored documents. But what about, say, a document you're sharing with someone else online – is that a form of communication or storage? Dempsey wants to see a baseline of privacy protection for all online content, regardless of technology. That kind of a sweeping, new privacy standard raises some red flags for law enforcement, as Associate Deputy Attorney General James A. Baker told the Senate Judiciary Committee.

JAMES A. BAKER: If we were to raise the standard with respect to some electronic communications – even content - it's going to have an impact on law- enforcement investigations. We have to be mindful of that, we have to be thoughtful about that. And so whatever proposals come forward, we have to look at that in that light.

KASTE: There is a bill now in the Senate. It's ambitious, covering everything from cloud computing to location data on phones. The chief sponsor, Democrat Patrick Leahy, hopes to move it through the Judiciary Committee before the next election. But even if it passes the Senate, the bill faces a tougher challenge in the House, where the tech industry's lobbying muscle is less likely to overcome the Republican majority's reluctance to hamper law enforcement.

Martin Kaste, NPR News. Transcript provided by NPR, Copyright NPR.