Will ECPA reform be carved up like a turkey?
With Congress set to break for its August recess this Friday, Capitol Hill is under pressure to get certain business done, for good or bad. That includes moving forward with reforming the Electronic Communications Privacy Act, a regrettably out-of-date bill that is simply inadequate to protect our privacy and civil rights online.
Right now, the chief instrument of reform is a bill sponsored by Sens. Patrick Leahy, D-Vt., and Mike Lee, R-Utah. I’ve written about the bill before; it requires federal agencies such as the Internal Revenue Service, Federal Elections Commission, Federal Communications Commission and the Securities and Exchange Commission to obtain warrants before gaining access to private citizens’ data held on cloud servers. The SEC wants a carve-out so that they won’t need a warrant, a carve-out that may prove lethal.
The SEC has found a champion in Sen. Chuck Grassley, R-Iowa. Grassley is pushing for an exemption for the SEC, though he has yet to draft legislative text for said exemption. Still, his opposition to the bill is largely unnecessary.
The SEC has been able to enforce its subpoena powers against the targets of investigations since before the Internet even existed. These powers, under Rule 34 of the Federal Rules of Civil Procedure, have been upheld in various courts. In one case involving a government agency, FTC v. Sterling Precious Metals, LLC, the court explicitly stated:
The undersigned finds the Flagg court’s reasoning to be persuasive. In the present case, the FTC is not asking for information proprietary to the Web host. Rather, it only requests that compartmentalized information relevant to the operation of Sterling’s website. As a customer of its Web host, Sterling surely has the contractual right to obtain that data. Accordingly, that information is within its control under Rule 34 and must be provided to the FTC. Moreover, the court notes that in this context, complying with the request would not impose any great burden on Sterling. Accordingly, the FTC’s motion will be granted as to Request 17. Sterling may either obtain the information from its web host and then turn it over to the FTC, or alternatively, provide the FTC with written consent to obtain its code from the relevant party(ies).
The SEC also has the power to order cloud providers to freeze a subject’s account, under 18 USC § 2703 (f); The Leahy-Lee bill does not affect that power. Nor does it affect the SEC’s power to subpoena “transactional” information about the account: when it was made, how often it was used, etc. (“metadata,” if you will.)
What Leahy-Lee would do is require direct subpoenas on the subjects of an investigation. As it used to be done, on local data, subpoena subjects would be allowed to review data first and be given a chance to assert privileges (i.e., between a lawyer and a client.) But if the SEC has its way, it will simply issue a subpoena on the service provider, who has no idea what is and isn’t relevant to the investigation, and won’t be able to do the data review that is necessary for these things. This could include personal correspondence that is completely irrelevant to an investigation, or even trade secrets or, as I mentioned before, privileged communications. It would also be a massive amount of data to sift through, a very inefficient use of government resources.
And as pointed out above, such a subpoena would not even be necessary. Opponents to the Leahy-Lee bill don’t need to worry. The SEC will still be able to conduct its investigations after the reform bill is in place, and these investigations will not be imperiled. The bill takes necessary steps to protect individuals’ digital privacy and civil rights, but does not hamstring government agencies.
Notably, this bill is championed not just by civil rights activists, but also by major players in the information technology industry, who are taking a strong stand toward protecting their users’ rights. A carved-out bill will be vigorously opposed and will likely go nowhere. A bill without carve-outs–the same bill that passed the Senate Judiciary Committee with bipartisan praise–is just what the American people need.