Agencies Say They Need Access to Americans’ Emails Without a Warrant [FTC and SEC]

Nextgov ^ | 9/16/15 | Kaveh Waddell

[markomalley]

A bi­par­tis­an bid to re­form an elec­tron­ic-pri­vacy law has the sup­port of the tech com­munity and the White House, but fed­er­al law en­force­ment of­fi­cials tell Con­gress the changes would hamper civil pro­sec­u­tion.

Civil law en­force­ment agen­cies like the Fed­er­al Trade Com­mis­sion and the Se­cur­it­ies and Ex­change Com­mis­sion would not be able to ob­tain crit­ic­al in­form­a­tion if the law were changed to re­quire crim­in­al war­rants for ac­cess to data stored on cloud ser­vices, ac­cord­ing to wit­nesses from those agen­cies testi­fy­ing in front of the Sen­ate Ju­di­ciary Com­mit­tee Wed­nes­day.

The law en­force­ment of­fi­cials were re­act­ing to bills from Sens. Mike Lee and Patrick Leahy, and Reps. Kev­in Yo­der and Jared Pol­is, that aim to up­date the Elec­tron­ic Com­mu­nic­a­tions Pri­vacy Act, or ECPA.

In its cur­rent form, ECPA pro­tects emails from gov­ern­ment snoop­ing for 180 days. When the law was ini­tially drawn up in 1986, email pro­viders routinely re­moved emails from their serv­ers a month or two after they were de­livered; users would gen­er­ally down­load the mes­sages they in­ten­ded to keep. Whatever re­mains on an email serv­er after 180 days is fair game for gov­ern­ment to ac­cess, with just a sub­poena—not a war­rant.

Today, ubi­quit­ous cloud-based email sys­tems like Gmail, which of­fer giga­bytes of stor­age for free, al­low the av­er­age user to keep his or her mes­sages—and cal­en­dars, con­tacts, notes, and even loc­a­tion data—on a pro­vider’s serv­ers in­def­in­itely.

The ECPA Amend­ments Act would re­quire law en­force­ment to get a war­rant to ac­cess serv­er-hos­ted in­form­a­tion, no mat­ter how old, and would re­quire the gov­ern­ment to no­ti­fy an in­di­vidu­al that his or her in­form­a­tion was ac­cessed with­in 10 days, with cer­tain ex­cep­tions.

But law en­force­ment of­fi­cials ex­pressed op­pos­i­tion to some of the bill’s pro­posed changes, ar­guing that its re­quire­ment for crim­in­al war­rants could leave civil lit­ig­at­ors without ac­cess to im­port­ant elec­tron­ic in­form­a­tion.

“The bill in its cur­rent form poses sig­ni­fic­ant risk to the Amer­ic­an pub­lic by im­ped­ing the abil­ity of the SEC and oth­er civil law en­force­ment agen­cies to in­vest­ig­ate and un­cov­er fin­an­cial fraud and oth­er un­law­ful con­duct,” said An­drew Ceres­ney, dir­ect­or of en­force­ment at the Se­cur­it­ies and Ex­change Com­mis­sion.

Ceres­ney and Daniel Sals­burg—chief coun­sel for tech­no­logy, re­search, and in­vest­ig­a­tion in the FTC’s con­sumer pro­tec­tion branch—said the SEC and FTC are not look­ing for the au­thor­ity to ob­tain data with just a sub­poena, and in­stead pro­posed a sys­tem where they could ob­tain a court or­der for ac­cess to the data. Such a pro­cess would no­ti­fy the in­di­vidu­al be­ing in­vest­ig­ated and give him or her the chance to make a case in front of the judge be­fore an or­der is gran­ted or denied.

But des­pite their op­pos­i­tion to the pro­posed change to ECPA, neither the SEC nor the FTC has ob­tained emails through an ad­min­is­trat­ive sub­poena in the past five years, Ceres­ney and Sals­burg said Wed­nes­day.

Ceres­ney said the de­cision to avoid sub­poen­as was made “in de­fer­ence” to on­go­ing con­ver­sa­tions about ECPA re­form. A 2010 fed­er­al court or­der also bound the gov­ern­ment’s hands by de­clar­ing ECPA un­con­sti­tu­tion­al—a de­cision the ECPA Amend­ments Act in­tends to co­di­fy in­to law—but Ceres­ney said the SEC does not in­ter­pret the court’s de­cision as an im­ped­i­ment to us­ing sub­poen­as to ob­tain data.

The civil law en­force­ment of­fi­cials’ com­ments about ECPA re­form were met with im­me­di­ate back­lash from the tech com­munity, which has come out in strong sup­port of the changes.

“The FTC claims to be a cham­pi­on of con­sumer pri­vacy, yet the agency wants ac­cess to Amer­ic­ans’ data without a war­rant,” said Ber­in Szoka, pres­id­ent of Tech­Free­dom, a tech­no­logy think tank. “The Com­mis­sion’s testi­mony today con­firms long-stand­ing ru­mors that it will only sup­port ECPA re­form if it gets a carve-out from the bill’s war­rant re­quire­ment.

“This is the is­sue that has stalled ECPA re­form for over five years, des­pite over­whelm­ing bi­par­tis­an sup­port,” Szoka ad­ded. “The FTC’s testi­mony is care­fully craf­ted to sound reas­on­able, but the agency is simply help­ing to ob­struct the ma­jor pri­vacy re­form of our gen­er­a­tion.”

Google and BSA-The Soft­ware Al­li­ance, a prom­in­ent tech as­so­ci­ation, ap­peared in a sep­ar­ate wit­ness pan­el be­fore the com­mit­tee, call­ing for swift change in or­der to im­prove cus­tom­ers’ pri­vacy and al­le­vi­ate busi­ness pres­sures.

“By cre­at­ing in­con­sist­ent pri­vacy pro­tec­tion for users of cloud ser­vices and in­ef­fi­cient and con­fus­ing com­pli­ance hurdles for ser­vice pro­viders, ECPA has cre­ated an un­ne­ces­sary dis­in­cent­ive to move to a more ef­fi­cient, more pro­duct­ive meth­od of com­put­ing,” said Richard Sal­gado, the dir­ect­or of Google’s law en­force­ment and in­form­a­tion se­cur­ity branch.

[markomalley]

WTF??? The justification for giving NSA and FBI warrantless access was for national security.

But the Federal Trade Commission??????

[BenLurkin]

Next it’ll be the EPA and the EEOC

[SandRat]

No Warrant. NO ACCESS!

[a fool in paradise]

How about prosecuting congress critters for insider trading???

[seawolf101]

The department of agriculture has a need to review everybody’s personal email. This email thing has gene too far.

[taterjay]

OK...Hillary’s first.

[faithhopecharity]

Go to North Korea or communist China if you want to spy on the cutizens, you f@@@ing basturds ! This is USA!

[Secret Agent Man]

Fuch big brother. Sideways.

[KarlInOhio]

The IRS and Department of State need your email because they have lost so much of their own.

[MarchonDC09122009]

This dovetails with Obola’s Behavioral Health Data Executive order that he signed yesterday.
See related threads.

Gov’t accelerating ability to obtain and analyze as many sources of citizen data for purposes of profiling to improve service offering.
Umm, yeah.

Jim, can we have a BigBrother link added to at the top of the news page (next to OpSec) for this type of news?
Fellow privacy professionals indicate there are many related developments on the horizon, and privacy advocacy rights orgs are trying to fight this.
Thx

[L,TOWM]

This is such horses—t! The SEC already has access to e-mails sent and received from companies (Brokerage Firms and larger Investment Advisors) and if they are investigating those entities for fraud, they don’t need a warrant or a subpoena at this point; they just “request” it. The regulated companies have no option but to comply with the request or cease doing business.

If they suspect fraud from an issuer, they should get a criminal complaint and a warrant. Absolutely livid with these a-—holes right now!!!!

[Basket_of_Deplorables]

Use Proton mail—feds hate it!

https://en.wikipedia.org/wiki/ProtonMail

How about we keep electronic communication private, cancel the war on drugs, stop monitoring bank transactions, and kick out every male with a first, middle, or last name of mohammed?

[Nifster]

Where is EFF when we need them most?

[G Larry]

Dear Agency,

We know your Big Brother fantasies have you believing you could prevent all crime if citizens had no privacy, but, that’s not the way this country or the Constitution works.

[antidisestablishment]

Also use encrypted chat software:

Wikr

[Chgogal]

Total BS. Get the darned warrant.

Now I am back with Rand. Dammit!

[RedHeeler]

This reminds me of a song- “ Ahummua mumao mao a hummua moo mao mao”... forget who sang it. Seemed like it was popular during the 60’s, particularly in the north china sea area, of the Gulf of Tonkin. Who knows, what the echo is in deep water.

[Califreak]

Bird-The Trashmen

[RedHeeler]

Hecky durn. Thanks.

[EternalVigilance]

Amendment IV

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.