Recent foreign and domestic terrorist attacks have tilted the advantage on surveillance toward law enforcement and security agencies, which are using these incidents to push for broader powers. Civil liberties advocates can take heart, however, in a privacy victory that has largely gone unnoticed.
In early June, Vermont Governor Peter Shumlin signed a sweeping privacy bill into law that curtails the ability of state law enforcement agencies to collect residents' personal data. The law is modeled on a broad privacy protection bill that California state lawmakers passed last September.
The Green Mountain State forbids the use of "stingrays," or simulated cell phone towers, except in cases where a fugitive is on the run. Stingrays, whose use by law enforcement agencies only came to light in 2013 after a Freedom of Information Act request by the ACLU of Northern California, are controversial because they can be used to indiscriminately sweep up all cell phone calls, texts, tracking data, and other electronic information within a given radius.
In restricting their use, Vermont follows the lead of Washington state and Virginia. The Old Dominion was the first jurisdiction to require a warrant to use stingrays to obtain personal data.
Additionally, if Vermont law enforcement agencies want to obtain residents' electronic communications and records, such as phone calls, emails, location data, or bank records, they can now only do so with a warrant, subpoena, court order, or the consent of the individual. Previously in Vermont, such records were obtained through the use of "inquests," secret court hearings that only police and prosecutors attend.
"Because the hearings are secret, it's been hard to find out whether a judge was present in all cases," explains ACLU Vermont Executive Director Allen Gilbert. "Some people said yes, others no. There are no publicly available records of these proceedings."
The law also requires Vermont law enforcement agencies to obtain a warrant before using drones for investigations or other purposes, such as monitoring protesters. At least other 20 states have passed laws regulating drone use in the past 18 months.
In recent years, the domestic use of drones has gradually spread. The Pentagon has admitted to deploying spy drones on U.S. territory in a "rare and lawful" way over the last decade. In 2015, the Justice Department acknowledged the FBI, DEA, and other federal agencies have used drones for domestic surveillance purposes. In 2013, the federal government gave seven local law enforcement agencies and nonprofit organizations $1.2 million to purchase drones. Still, there has been little public debate about their use in the United States, and state and federal lawmakers have been slow to enact regulations.
Although the Vermont bill restricts the actions of state law enforcement officials, state law does not apply to federal agencies like the NSA or FBI, which might choose to conduct surveillance on Vermont residents. For that, privacy advocates must continue to look to federal law.
Despite its limitations, the Vermont measure is an important milestone for privacy rights.
"For a first go-round, I thought it was adequate," says Vermont Senate Minority Leader Joe Benning, a Republican who was one of the bill's sponsors. "There's always the possibility of improving things, but we were starting from scratch. We're trying to get ahead of technology."
Indeed, as the pace of technological change continues to ramp up, state officials have to stay vigilant. "Vermont or any other state can always go further, as electronic issues are constantly evolving," says Gilbert.
