With many Americans leading an increasingly digital life, it's not surprising that the government is turning to things like cell phone and email records when conducting investigations. But what rights do we have when it comes to giving up that information?
Apple and cloud storage service Dropbox are the latest companies to join an effort that calls on the government to obtain warrants before accessing email and other cloud-based data.
At this point, access to tech-based records are governed by the Electronic Communications Privacy Act (ECPA). But the bill was first enacted in 1986, well before the Internet, email, or smartphones. As a result, it is "significantly outdated and out-paced by rapid changes in technology and the changing mission of our law enforcement agencies after September 11," according to Sen. Patrick Leahy, a Vermont Democrat who introduced a bill in May that would update ECPA.
Leahy's update would apply to technologies like email, cloud services, and location data on smartphones. If the government wanted an ISP to hand over emails on a particular customer, for example, they would need to first obtain a warrant. At this point, the government abides by a rule that provides access to email after 180 days, depending on the circumstance. Leahy's bill would also extend to location-based data, and allow private companies to collaborate with the government in the event of a cyber attack.
In an effort to get major tech companies to back Leahy's bill, the Electronic Frontier Foundation launched the "Who Has Your Back" campaign earlier this year. It called on companies like Amazon, Apple, AT&T, and more to sign an online petition that included a request for companies to "fight for user privacy in Congress" by joining what is known as the Digital Due Process Coalition (DDP).
"Members of DDP are working to set legal standards that uphold due process, privacy, and law enforcement effectiveness — like requiring search warrants from the government when it seeks private communications and information, and requiring the government to prove to a court that the data being requested is relevant to actual, authorized law enforcement action," according to the EFF.
More specifically, the companies who have joined DDP support an overhaul of ECPA. Apple and Dropbox are the latest firms to make the pledge, which has also received support from Amazon, AT&T, Facebook, Google, and Microsoft.
"As we enter that next phase in the fight for electronic privacy reform, it's good to know that we'll have Apple and Dropbox on our side," the EFF said in a statement. "We're especially pleased to have these new allies as we approach the 25th anniversary of ECPA's passage on October 21st, which will be a focal point in our campaign to get a 21st century upgrade to our electronic privacy laws."
As part of the "Who Has Your Back?" campaign, the EFF is also asking companies to: tell users about data demands; be transparent about government requests; and fight for user privacy in the courts. So far, no company has fully satisfied all four requests to EFF's liking, though Google and Twitter have gotten the closest. The organization is still waiting on replies from Comcast, MySpace, Skype, and Verizon, according to a chart it produced.
Apple and Dropbox have actually found themselves in some privacy-related hot water this year. Apple, of course, got mixed up in the location-based data snafu, while a June code update left Dropbox password-free for about four hours.
Other bills tackling location data, meanwhile, include the GPS Act, which provides guidelines for how and when government agencies, law enforcement, and private companies can access someone's location-based data. A separate bill from Al Franken would also require consumers' permission for companies to access location data.
At this point, however, all three bills are still stuck in committee and have not seen any major action. EFF acknowledged that "now comes the harder part: actually getting a good bill passed by Congress and signed by the President."