privacy

What It Means for Our Movement That the NSA is Halting One of Its Worst Surveillance Practices

eff-nsa-utah-data-center

NSA’s data center in Utah

The New York Times broke the news Friday that the NSA is ending a surveillance program that has been the subject of years of criticism by civil liberties advocates and members of Congress alike. The news came in waves: a brief snippet from Charlie Savage, then a slightly longer update, then confirmation from the NSA, and then the final version (I assume) from Savage that went up hours after the original.  The NSA is promising to end the practice of collecting Americans’  emails and text exchanges with foreigners that mention key identifiers—like email addresses—that aren’t actually directed to or from the targets of NSA surveillance.  (For my fellow tech policy nerds, we call this “about” surveillance.)

Not only that, but the NSA promises to “delete the vast majority of its upstream internet data to further protect the privacy of U.S. person communications.”

My colleague Kate has a thorough write-up of how to consider this within the larger context of NSA reforms Congress needs to enact, and everyone should go read it. I’m not here to talk about the legal and technical landscape related to this announcement.

I just want to talk about how awesome this moment is.

For the better part of a decade, organizations like the ACLU and EFF have been confronting surveillance abuses by the NSA through the courts. Members of Congress like Senator Wyden have demanded answers to NSA surveillance. And whistleblowers like Mark Klein, Bill Binney, Thomas Drake, and Edward Snowden have risked their freedom to tell the American public the truth about what our government is doing in our name. Countless journalists—including the inimitable Glenn Greenwald and Laura Poitras—have spent years trying to tell the esoteric, muddled story of NSA digital surveillance in a way that regular people could understand.

I think of these actions as seeds of a movement. But the true power of public scrutiny only happened because people actually cared. And make no mistake: even if the FISA Court drove this decision, the ecosystem of resistance that has been built over years created the environment necessary for that decision to happen. Courts, even secret courts, don’t make decisions in a vacuum.

Millions of people—here in the United States and globally—honestly didn’t like the fact that the NSA was sitting on a mountain of intimate digital data like Scrooge McDuck on a pile of gold coins. People were incensed enough to email Congress in droves, ask questions at town halls, send letters to the editor, share articles on Twitter, and take to the streets in protest. I’ve been on those streets and spoken with many of those people, and I’ve been struck by how deeply personal this fight is to so many of them.

Something I’ve noticed in years of speaking to people about NSA spying is that many people are driven to protect the Internet itself. The Internet offers a way to connect millions of people globally to one another and to information, and it’s benefited so many of us in personal, daily ways. It’s not surprising we’re protective of it. For me and others, this fight feels personal because we genuinely like the Internet. It’s fascinating, it brings us joy, and we don’t want the NSA messing it up for us, our friends, and future generations.

And just like we couldn’t have a nice evening our with friends with a government goon standing next to us listening in on our conversations, we can’t enjoy the freedom of the weird, unpredictable, creative Internet when a digital Big Brother is casting a shadow over our communications.

And yes, for all there is still work to be done, this is a moment to celebrate.  Even though so many other aspects of our American political system are teetering toward a more oppressive state, we can all take a moment to enjoy the fact that someone in an NSA data center or office building right now is actually working on deleting millions of records from their databases.

This isn’t the end. I know we have a big fight in Congress this year around NSA spying, and that we need these changes—as well as others—clearly codified into law. But I for one am celebrating. Years of pressure and scrutiny, built on the foundation of damning leaked evidence, were the necessary catalyst for this moment. 

In the wake of the announcement, Edward Snowden tweeted that “People said speaking up isn’t worth the risk. Today, we can see they were wrong. Blow the whistle, change the world.”

Blowing the whistle on abuses is one way to fuel a movement. But remember that it doesn’t make a difference unless people are willing to care. We got to this moment not just because of a handful of brave whistleblowers who spoke out, but because millions of people listened to them and cared.

Important note: most of the time when I write about NSA spying or digital rights, I do it on the EFF blog in my capacity as a blogger for EFF, with strict legal oversight of everything I say. This is a blog post about my personal opinions and doesn’t reflect the views of EFF, or its legal positions or interpretations

Updating the Electronic Communications Privacy Act

Originally published on EFF Deeplinks blog.

Yesterday was a watershed moment in the fight for electronic privacy: the Senate Judiciary Committee overwhelmingly passed an amendment that mandates the government get a probable cause warrant before reading our emails. The battle isn’t over — the reform, championed by Senator Patrick Leahy (D-VT), still needs to pass the rest of the Senate and the House, and be signed by the President to become a law. But yesterday, thanks to thousands of people speaking out, we were able to begin the process of overhauling our archaic privacy laws into alignment with modern technology.

It was a big win for us, even if it was only the first step in the process of reforming privacy law to keep the government out of our inboxes. So we’re dedicating this EFFector to the battle to reform outdated privacy law: what the government can get, what the law ought to be, and what we’re doing to fix the gaping loopholes that leave users vulnerable to government snooping.

The Fourth Amendment and Electronic Privacy

The Fourth Amendment protects us from unreasonable government searches and seizures. In practical terms, this means that law enforcement has to get a warrant — demonstrating to a judge that it has probable cause to believe it will find evidence of a crime — in order to search a place or seize an item. In deciding whether the Fourth Amendment applies, courts always look to see whether people have both a subjective expectation of privacy in the place to be searched, and whether society would recognize that expectation of privacy as reasonable. The Supreme Court made this point clear in a landmark 1967 case, Katz v. United States, when it ruled that a warrantless wiretap of a public payphone violated the Fourth Amendment.

The Third Party Doctrine, or How the Supreme Court Got Us Into This Mess

In 1979, the Supreme Court created a crack in our Fourth Amendment protections. In Smith v. Maryland, the Court ruled that the Fourth Amendment didn’t protect the privacy of the numbers we dialed on our phones because we had voluntarily shared those numbers with the phone company when we dialed them. This principle — known as the Third Party Doctrine — basically suggests that when we share data with a communications service provider like a telephone company or an email provider, we know our data is being handed to someone else and so we can’t reasonably expect it to be private anymore.

The government took this small opening created by Smith v. Maryland and blew it wide open. It argued that this narrow 1979 decision about phone dialing applied to the vast amount of data we now share with online service providers — everything from email to cell phone location records to social media. This is bogus and dangerous. When we hand an email message to Gmail to deliver on our behalf, we do so with an intention that our private communications will be respected and kept in strict confidence, and that no human being or computer will review the message other than the intended recipient. But the government argues that because we handed our communications to a service provider, the Fourth Amendment doesn’t require them to
get a warrant before snooping around our inbox.

Luckily, the courts are beginning to agree with us. In a leading case where EFF participated as amicus, United States v. Warshak, the Sixth Circuit Court of Appeals agreed with us that people had a reasonable expectation of privacy in their email, even if it is stored with a service provider, and therefore the government needed a search warrant to access it. And in the recent Supreme Court case, United States v. Jones, Justice Sotomayor said that she thought the Third Party Doctrine was outdated, while she and four other Justices — including Justice Alito — raised concerns about the information gathered by our
cellphones.

The Eighties Were Good for a Lot of Things — But Not Sustainable Email Privacy Law

It’s not just the Constitution, however. Congress has made clear that certain forms of data are protected by federal statute as well. Following the Katz decision, Congress passed the Wiretap Act in 1968, supplementing the strong Fourth Amendment privacy protections in phone conversations by enacting a comprehensive set of federal statutes. These statutes were designed to ensure that law enforcement has a compelling reason before intercepting phone calls.

And as electronic communication started to become more prevalent, Congress passed the Electronic Communications Privacy Act (ECPA) in 1986 that somewhat improved the privacy rights around certain electronic communications. But as it reflects the technology of 1986, ECPA has aged poorly. It doesn’t address documents stored in the cloud, information revealing our personal associations, or the vast quantities of location data our mobile devices collect on us everyday. And, as a result of loopholes in the law, the Department of Justice, citing ECPA, has argued that it has a right to access emails without a warrant as soon as they are 180 days old, or have been opened and left on the server.

We think that 180-day limit and a distinction between opened and unopened email is arbitrary and wrong. As the Washington Post said in an editorial earlier this week, “If you left a letter on your desk for 180 days, you wouldn’t imagine that the police could then swoop in and read it without your permission, or a judge’s.”

That’s why this week’s vote was so important: it was a critical first step in updating ECPA to evolve with the modern technologies we use today, and to close archaic loopholes that give government too much access with not enough judicial oversight.

What EFF and Activists Like You Are Doing

We’re taking a two-prong approach.

First, we’re fighting for the Fourth Amendment in the courts. We practice impact litigation, taking on clients pro-bono in cases where we believe we can create positive legal precedent around digital privacy and government surveillance. We also submit amicus briefs in cases where we don’t have a direct client, such as in the Warshak and Jones cases noted above. In Warshak we argued that the government could only access emails stored on an ISP with a search warrant, notwithstanding the third party doctrine. And in Jones, we argued the government’s attachment of a GPS tracking device to a car for 28 days was a Fourth Amendment “search,” meaning a warrant was required. The Court agreed with us in both cases, and
as a result privacy protections are stronger now than in the past. And we’ve filed many more amicus briefs this past year, arguing for a search warrant requirement in cases involving cell phone location records [PDF], GPS devices, and home video surveillance.

Second, we’re creating a movement of engaged Internet users and rallying them to demand the government stay out of our email. Yesterday’s win was a result of the tens of thousands of concerned individuals who signed our petition to Congress calling for ECPA reform and who spoke out in other ways. We’re also teaming up with advocacy groups, web companies, start-ups, and venture capitalists in demanding ECPA reform through the Digital Due Process coalition. And we recently joined other advocacy groups in launching VanishingRights.com.

What aren’t we doing? Compromising. Unfortunately often the pressure in DC inside politics is to trade off one important right against another. We don’t think that’s EFF’s role. Instead, we’re advocating for what’s best for the Internet and Internet users, and while we are flexible, we aren’t willing to horse trade with your privacy and due process.

Want to read more about ECPA and our work to reform it? Check out these links:

Take action: Don’t let privacy law get stuck in 1986

Attempt to Modernize Digital Privacy Law Passes the Senate Judiciary Committee

ECPA and the Mire of DC Politics: We Shouldn’t Have to Trade Video Privacy to Get Common-Sense Protections of our Email

Don’t be a Petraeus: A Tutorial on Anonymous Email Accounts

Reform to Require Warrant for Private Online Messages Up for Vote, but Down on Privacy

When Will Our Email Betray Us? An Email Privacy Primer in Light of the Petraeus Saga