The Senate Judiciary Committee held hearings last week on the need to reform the increasingly badly outdated Electronic Communications Privacy Act, the 1986 legislation that governs how the cops conduct telephone and Internet surveillance in criminal investigations. Two officials from two different government agencies offered up rather strikingly different testimony.
Cameron Kerry of the Commerce Department acknowledged what legal scholars and technologists have been saying for years: The law’s byzantine and inconsistent standards—which provide wildly varying levels of protection for the same e‑mail as it’s being composed, sent, received, read, and archived—are wholly out of touch with the ways we actually use technology today. The distinctions the law draws make no real sense in principle, and are confusing and needlessly burdensome to Internet companies in practice.
By contrast, James Baker of the Justice Department was eager to sing the praises of ECPA in its current form, and to raise FUD (that’s “Fear, Uncertainty, and Doubt for the non-geeks) about reforms proposed by the Digital Due Process Coalition, a group of civil liberties advocates and tech companies that are urging Congress to update the law. Let nobody say that DOJ is behind the curve on technology: Baker’s testimony is almost totally virtual, a simulation of a real argument, worthy of the Matrix. But as with Oakland and cyberspace, when you look a little more closely, there’s no there there.
A surprising amount Baker’s time was devoted to establishing that electronic records—whether e‑mail contents, Internet “metadata,” or cell phone location information—are often useful to investigations. Well, of course they are! So are phone wiretaps! So are physical searches of homes! There wasn’t really any doubt about that, was there? They’re useful, of course, precisely because they tend to reveal private information about people’s activities. The question is what standard is appropriate, and whether that standard should exhibit some kind of basic consistency, both with respect to a single communication at different stages, and across technologies.