Competing Interests: Enforcing Cybersecurity and Protecting Privacy By Ulka Ghanta

Transcription

1 Competing Interests: Enforcing Cybersecurity and Protecting Privacy By Ulka Ghanta March 2012 What is reasonable when balancing privacy rights with a need to enforce Cyber security? The 9/11 attacks forever altered the scope of privacy protections. And the courts and Congress continue to seek a proper middle ground. It is well established that the Fourth Amendment protects unreasonable searches and seizures and upholds the rights of the private citizen. In the case Katz v. United States, the Supreme Court developed a standard to determine whether a search and seizure was unreasonable. The Court explained there is a reasonable expectation of privacy if a person has a subjective expectation of privacy and a person in society would consider it reasonable, resulting in an unreasonable search under the Fourth Amendment. But what is reasonable? It is a concept that has stumped and evaded the courts, Congress, law enforcement, and the public for some time. In particular, the 9/11 attacks greatly altered the definition of how privacy should be protected by the government and law enforcement in light of potential terrorist threats to the country. However, technology has expanded exponentially since 9/11, and in the age of increasingly rampant communications via the Internet, SmartPhones, and other new electronic devices, maintaining privacy interests is even more challenging. Proposed amendments to the Electronic Communications Privacy Act (ECPA) endeavor to tackle this issue by engaging in the delicate dance between protecting national security and upholding a citizen s privacy rights. The 1986 Electronic Communications Privacy Act (ECPA) The ECPA was originally created to protect electronic communications and prevent unreasonable surveillance by the government. ECPA evidentiary protection standards are varied based on the length of time the electronic communication information is stored and its location. For example, stored on a personal hard drive is protected from seizure by a judicial warrant, but the same stored in a remote account is unprotected. When the act was passed in 1986, was largely stored on personal hard drives without being stored on third party servers, or more commonly known as cloud servers. s older than 180 days were considered outdated and largely discarded. Communications that are conducted within a personal residence, where there is a reasonable expectation of privacy, require that the government obtain a judicial warrant based on probable cause before gaining access to the communications. Under the ECPA, law enforcement can obtain access to any online communications (even if conducted at home) older than 180 days without a warrant and without showing probable cause as long as the information is relevant to a criminal investigation. The

2 EPCA standard for obtaining this information is considerably lower than probable cause. The government is only required to show clear and articulable facts that the information is needed to assist with a criminal investigation. Today, this means that any communications, including s, documents, and pictures, for example, that are stored in cloud servers and older than six months can be subject to a warrantless search. Popular sites such as Facebook, Dropbox, or the Apple ICloud storage system are used routinely by the public and hold information for much longer than six months. Thus, warrantless searches can apply to any financial, medical, and personal information placed on a cloud operating system that is not on one s personal hard drive. Before the advent of the Internet, this law appropriately gave law enforcement the ability to conduct surveillance without being too invasive, but the original law now seems obsolete. Case law regarding ECPA violations has been largely inconsistent, with some courts requiring judicial warrants to read s and access communications, and others supporting the use of a subpoenas to gain the same information. In addition, the ECPA does not cover geolocation information (i.e., real world geographic location information of an object such as a mobile phone). Consequently, the courts have been left on their own to determine to what extent geolocation information can be included or protected under this statute. Digital providers, media outlets, internet service providers, and consumer advocacy groups are frustrated with the lack of consistent legal guidance. As a result, Congress is attempting to rectify this problem and provide a comprehensive solution that can be upheld in the courts. The Department of Justice has been reluctant to accept ECPA reforms because doing so would require a higher burden for law enforcement and others to gain access to this information. Knowing the difficulties and time delays that can result in establishing probable cause, many law enforcement officials don t want to deal with those administrative hurdles. The real question is: What is too invasive and how do we draw a line? Senate bill S.1011 attempts to update the ECPA and answer that question. Electronic Communications Privacy Acts Amendment Last year, Senator Patrick Leahy introduced the S Electronic Communications Privacy Acts Amendment. The bill updates the EPCA s Stored Communications Act (SCA) provision, which regulates the voluntary and mandatory disclosures of electronic communications stored by Internet service providers (ISPs). The amendment eliminates the 180 day rule and requires law enforcement to obtain a warrant based on probable cause in order to obtain any stored communication. It also includes the protection of geolocation information. Therefore, any geolocation information derived from any electronic device (which would include Global Positioning System devices as well as SmartPhones) is protected.

3 Thus, the ECPA amendment does not allow law enforcement to have easy access to private files, records, or communications, but there are exceptions. If the government is given express consent by the owner of the device to access the information or if the government is responding to an emergency by the device user, then a warrant is not necessary. In addition, there are different requirements for geolocation information. For warrant based investigations, an ISP can be compelled to disclose contemporaneous (or real time) information. To obtain historical geolocation information, such as the subscriber s name and address, telephone records, or billing information, the government only needs a subpoena or consent under the lower specific and articuable facts standard. There are exceptions for national security interests as well. ISPs can voluntarily disclose electronic content to the government that involves combating a cyber attack against their network. The Attorney General and Department of Homeland Secretary are required to submit an annual Congressional report outlining the number of voluntary disclosures they received regarding cyber attacks. The amendment requires that notice be given to the consumer within three days of the warrant s issuance to make him or her aware of the warrant. However, the notice can be delayed to protect the life or physical safety of a person or to prevent threats against national security. The EPCA amendment attempts to codify one main standard requiring law enforcement to obtain a warrant based on probable cause, and so courts using the standard of specific and articulable facts under the Stored Communications Act would have to require adherence to a new standard. This amendment suggests that regardless of when or where the electronic information is stored, it should be guaranteed additional protection from government scrutiny. Carrier IQ and the Federal Bureau of Investigation A recent incident by a keystroke software company provides another example of the tension between government surveillance and privacy protection. Carrier IQ develops software to test network diagnostics that is used by many prominent mobile phone carriers. Companies such as AT&T, Sprint, and T Mobile have used the software technology on nearly 150 million phones to evaluate connectivity issues, data output, battery life, and other technical concerns. The company has stated its software only serves to improve user experiences with their SmartPhones. However Carrier IQ s software is installed onto SmartPhones in a way that is difficult to detect or remove by the consumer. An independent researcher recently posted a video Youtube that shows how the company s software could view the keystrokes made on his phone. The software s features enable Carrier IQ to see text messages, website traffic, applications used on mobile phones, and other data communications consumers may engage in on their phones. While it is troubling that Carrier IQ can see the information, it is even more disturbing that it could possibly share the information with the phone carriers. Major phone carriers such as Sprint, AT&T,

4 HTC, and Samsung claim that their end user licensing agreements authorize them to use Carrier IQ software to monitor application deployment and other data and cell site connectivity issues. Though Carrier IQ denies using the information for nothing more than gauging product efficiency and productivity, the company has not explained the exact basis for its applications and how much, if any, information is shared with cell phone carriers. As a result of the negative press, Sprint has started disabling the software from all its phones. Another party interested in the software technology is the Federal Bureau of Investigation (FBI). A senior employee from Carrier IQ stated the FBI approached the company about using its technology to monitor consumer activities. FBI director Robert Mueller denied receiving or obtaining any personal information about consumers from Carrier IQ during a congressional hearing last year. The FBI occasionally reaches out to companies like Carrier IQ to learn about emerging and new technologies which the FBI claims was the extent of its communication with the company. While Director Mueller denied communicating with Carrier IQ to acquire personal cell phone data, the FBI was not so confident when approached about its internal documents. The FBI denied an Associated Press request regarding its interactions with Carrier IQ by citing a Freedom of Information Act exception for any documents that relate to a law enforcement proceeding. It is unclear if the FBI actually used the software for its investigations or if it is possibly investigating Carrier IQ for federal violations. Even if Carrier IQ did not share the software or data (as it claims) with the FBI, the FBI could have obtained this information from the phone carriers or other sources themselves. In light of this situation, it is clear that passage of the ECPA amendment would protect any information collected by Carrier IQ that is stored or transmitted on these SmartPhones by requiring law enforcement to obtain a warrant to access the information. While the FBI may have quickly gathered and monitored cell phone information using Carrier IQ software, the ECPA amendments would make it more challenging for the FBI to act on that information. Over the course of 2011, targeted cyber attacks increased by over 400% and therefore law enforcement officials are certainly justified in prioritizing protecting the public from these attacks. At the same time, the ECPA amendments appear to provide an appropriate check on the reach of law enforcement s power. United States vs. Jones and beyond Limiting warrantless surveillance over private communications was most recently addressed by the Supreme Court in January. In United States vs. Jones, the Court ruled that installing a GPS device on a suspect s car and monitoring his activities for nearly a month was a physical intrusion that constituted a search under the Fourth Amendment, thereby violating his privacy rights.

5 The Court decided that police should obtain a warrant before engaging in almost any form of GPS surveillance. Though the Court did not prescribe an actual standard for when the tracking become a search (i.e., how many days), Justice Alito explained it occurred before the four week mark. Also the Court s opinion was largely focused on the physical intrusion of the police s action and why in this particular case this type of surveillance was deemed unconstitutional. The Court also left the door open for government surveillance and whether a warrant is required for short term monitoring of a suspect. While the Justices described various levels of government invasion and how they could be deemed intrusive, such as closed circuit television video monitoring, the Court decided that it would address that issue at another time. Despite not setting a clear cut standard on electronic surveillance, the general sentiment from the Justices was that government surveillance and reasonable expectations of privacy should be reexamined in the digital age. Justice Scalia wrote that situations involving merely the transmission of electronic signals without trespass would remain subject to scrutiny from the Supreme Court. Justice Sotomayor said it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. Thus, while the standard for what is deemed a reasonable privacy expectation continues to evolve, it is clear that the law must keep up with ever increasing technological advancements. New technology allows one to use data all over the world, and it is reasonable for society to believe that no matter where they are, their , phone, pictures, and other communications are protected and not subject to warrantless surveillance. While the Jones decision answers one area where privacy standards should be more largely recognized, it is clear more people expect that the online and electronic communications they convey in their daily lives should have greater protection from government scrutiny. Senator Leahy s bill has not passed out of committee, and getting floor time to debate and pass the bill will be even more difficult in light of this election year with the divided, partisan Congress. But arguably there is no better time to act on these issues and set the record straight for what communications society does and should expect protection for in the rapidly ever changing digital age.

6 Source List: 1) David Kravets, Aging Privacy Law Leaves Cloud E Mail Open to Cops, Wired Magazine, October 21, 2011, turns twenty five/. 2) Andy Greenberg, FBI Says Carrier IQ May Be Used in Law Enforcement Proceedings, Forbes magazine, December 12, 2011, says carrieriq may be used in law enforcement proceedings/. 3) David Kravets, Carrier IQ explains Secret Monitoring Service to FTC, FCC, Wired Magazine, December 14, 2011, ftc fcc/. 4) Sari Horwitz, Carrier IQ faces federal probe into allegations software tracks cellphone data, The Washington Post, December 14, 2011, probing carrier iq/2011/12/14/giqa9nceuo_story.html. 5) Hayley Tsukayama, FBI hasn t sought Carrier IQ data, chief says, The Washington Post, December 15, 2011, hasnt sought carrier iq data chiefsays/2011/12/15/giqab4vowo_story.html. 6) Adam Clark Estes, Yes, even iphones can spy on you too, The Atlantic Wire, December 1, 2011, even iphones can spy you too/45606/. 7) Caryn Tamber, Probable cause is still the rule for cell site data, The Daily Record, July 31, ) Seth Rosenbloom, Wolf in the Digital Age: Voluntary Disclosure Under the Stored Communications Act, 39 Colum. Human Rights L. Rev ) Erwin Chemerinsky: Keeping Up with the Joneses How Far Does the Reasonable Expectation of Privacy Go?, American Bar Association Law Journal, November 1, 2011, 10) Adam Liptak, Justices Say GPS Tracker Violated Privacy Rights, The New York Times, January 23, 2012, use of gps is ruled unconstitutional.html?pagewanted=2&_r=1. 11) John W. Whitehead, U.S. v. Jones: The Battle for the Fourth Amendment Continues, New Jersey Today, January 24, 2012, s v jones the battle for the fourth amendment continues/ 12) Symantec Intelligence Report: November 2011, _linkedin_2011nov_worldwide_intelligencereportnov ) Theofel v. Farey Jones, 359 F.3d 1066 (9th Cir. Cal. 2004). 14) United States v. Weaver, 636 F. Supp. 2d 769 (C.D. Ill. 2009). 15) United States v. Jackson, U.S. Dist. LEXIS (D.D.C. 2007). 16) Katz vs. United States, 389 U.S. 347 (1967). 17) United States v. Jones, 132 S.Ct. 945, 953 (2012). 18) United States v. Jones, 132 S.Ct. 945, 957 (2012). 19) Hearing on Oversight of the Federal Bureau of Investigation Before the S.Comm. on the Judiciary, 112 th Cong. (2011) (statement of Robert S. Mueller III, Director Federal Bureau of Investigation).

7 20) Richard M. Thompson, Governmental Surveillance of Cell Phones and Vehicles, Congressional Research Service, December 1, Ulka Ghanta rejoined the University of Maryland Center for Health and Homeland Security (CHHS) as a Senior Law and Policy Analyst in October Ms. Ghanta currently works with the Exercise and Training branch of CHHS helping to develop, test, and evaluate emergency management exercises for state and local agencies.