Earlier this week, Google, AOL, Microsoft, and other tech companies in the business of storing tremendous amounts of user data joined forces with civil-liberties outfits like the ACLU and the Electronic Frontier Foundation to push for an overdue upgrade to the Electronic Communications Privacy Act.
Simply put, the crux of the problem with EPCA's antiquatedness is that, written in pre-Web 1986, the law's understanding of digital data is a complete functional mismatch with the way that we actual think about the possession of electronic information today. That's not surprising. Hotmail didn't exist back when Congress passed the statute on "electronic communications." There was no Flickr, no Google Docs. But now, more and more of the e-mails, photos, and documents that we think of as our papers and effects, per the Fourth Amendment, are stored not on our computers in our homes or other domains that the law treats as protected spaces. When we're sitting in our desk chairs, whether our e-mail sits locally in our Outlook inbox or on Google's dedicated Gmail server "cloud" makes no practical difference in our expectations of ownership or privacy. But to the law, they are very different circumstances. Thus, the need to upgrade EPCA.
One of the big asks of the Digital Due Process Coalition is to make it so that law enforcement would need a search warrant approved by a judge to access digital records held on behalf of a citizen by a third-party vendor, rather than the simple subpoena standard now in use. (Here's the rest of what the DDPC is advocating for, including some interesting stuff on the protection of users' mobile location data.) Of course, the subpoena standard is easier for law enforcement to meet. And that's going to be the pushback against upgrading EPCA to increase the protections around digital data held off-site -- that applying warrant standards to the cloud would tie the hands of law enforcement.
Which brings us to the politics of the cloud privacy question. Now, if this were, say, 2005, law enforcement would be the dominant argument on Capitol Hill. National-security objections would be raised. There's a good chance that advocates for increased digital privacy protections would be painted as protectors of child pornographers. But the combined lobbying forces of Google and Microsoft and the ACLU and EFF and so on is something new. The big tech companies have their own motives, of course, but their increasing political leverage raises hopes that user experience will actually inform the next stages of privacy law.
--Nancy Scola
