Asus' FREE Speech Money Club

[basserdan]

The Fight Over Privacy and Secrecy in Government Investigations


By PETER J. HENNING
MAY 16, 2016



(please note: The underlined words are 'clickable' links when accessed via the link at the bottom of this page)

The debate over privacy has intensified since the battle between Apple and the Justice Department emerged over unlocking the iPhone of one of the San Bernardino shooters, a conflict that ended in March when the government said it found a way to unlock the device. Add to that the question of whether it is appropriate for the government to ask a court to prohibit a company from revealing that it is seeking customer information, and the intertwined issues of privacy and secrecy will force Congress to finally deal with the world of digital information.

The challenge will be striking the right balance between the government’s need to obtain information for law enforcement — a significant priority these days — with the desire to keep at least some personal information private, a growing concern as more sensitive data is stored online.

One front in the battle over privacy and secrecy has been the government’s power to obtain email and other electronic communications. The Fourth Amendment prohibits unreasonable searches of homes and papers, but the courts have been reluctant to extend that protection to off-site storage of electronic information, something far removed from the 18th century Bill of Rights.

Congress first dealt with the issue in the Stored Communications Act, adopted in 1986 at the dawn of the digital age. The law requires the government obtain a warrant for communications held for 180 days or less by a computer service provider, which means establishing probable cause that the evidence is related to a crime. For emails older than that, however, a grand jury or administrative subpoena can be used to compel their production, as long as the person whose information is sought is notified.

Why the different level of protections based on the age of the communications? Thirty years ago, Congress considered any messages over 180 days old to be abandoned, and therefore subject to reduced protection. This distinction does not make much sense now, but in the early days of emails when they were seen as a cutting-edge innovation, no one thought that a message of more than six months would be of much importance.

The House of Representatives unanimously passed the Email Privacy Act on April 28 to offer greater protection to electronic communications by requiring the government to get a search warrant for any email, regardless of how long it has been stored on a server. The bill is before the Senate Judiciary Committee, and its chairman, Senator Charles E. Grassley, Republican of Iowa, is reported to have put a companion measure on the committee’s calendar for consideration.

The legislation has drawn significant criticism from the three commissioners of the Securities and Exchange Commission, who sent a letter to Senator Grassley explaining the potential impact on its investigations. Unlike federal prosecutors, the S.E.C. does not have the authority to obtain a search warrant, so it would be unable to compel the production of any electronic records held by an Internet service provider if the law passes unchanged.

In an op-ed article in The New York Times, Mary Jo White, the chairwoman of the commission, called for an amendment to the bill to allow the agency to obtain email evidence by going into court in a manner similar to how the Justice Department establishes probable cause for a warrant. Otherwise, the agency could not “obtain critical electronic evidence of wrongdoing, and people committing fraud could make their digital trail vanish with a single keystroke,” according to Ms. White.

This is not the first time Congress has heard this complaint. Andrew J. Ceresney, the head of the S.E.C.’s enforcement division, made a similar argument about the Email Privacy Act in testimony before the House Judiciary Committee last December, but to no avail.

The S.E.C.’s willingness to follow a procedure similar to obtaining a warrant as a prerequisite to obtaining emails would make it more difficult to obtain evidence because issuing an administrative subpoena involves no judicial review. Given the prevailing tide in favor of enhancing the privacy of electronic communications, this concession is the best way for the agency to maintain access to emails.

If the legislation is not changed, then other agencies, such as the Commodity Futures Trading Commission and the Federal Trade Commission, would similarly be unable to obtain emails as part of their investigations. This type of evidence is standard fare because the communications can provide crucial insight into the knowledge and intent of participants — the key to establishing most regulatory violations.

Whether Congress wants to hamstring civil enforcement actions, which occur much more frequently than criminal prosecutions, is something that should be addressed explicitly in deciding how to enhance the privacy afforded electronic communications.

The flip side of privacy is secrecy – how much authority should the government have to keep its investigations from becoming known when it seeks personal information. That is an issue that has come to the forefront as technology companies object to demands that they not notify customers when their information is sought.

Under another provision of the Stored Communications Act, the government can seek an order prohibiting the service provider from notifying customers for 90 days if it can show a good reason for maintaining secrecy, such as a potential threat to personal safety or destruction of evidence. The order can be renewed if the government shows a continuing need for confidentiality.

Microsoft filed a lawsuit against the Justice Department in April, claiming that these secrecy orders violate its First Amendment right to communicate with customers along with the Fourth Amendment, and asking the court to declare this part of the law unconstitutional. It pointed out that in the last 18 months, it had received 2,600 orders to refrain from notifying customers about warrants or subpoenas seeking their information.

Corporations have constitutional rights, but it may be difficult for Microsoft to show that it has an unfettered right to inform customers about a government inquiry that involves their information when that could present a danger to public safety or jeopardize an investigation. The lawsuit appears to be intended more to highlight how the growth of secrecy orders presents a threat to customer privacy, especially if they become almost a matter of routine.

That issue arose last week when Magistrate Judge James Orenstein of the United States District Court in Brooklyn issued an opinion denying Justice Department requests in 15 cases, two involving Facebook, for orders prohibiting disclosure of subpoenas for customer electronic records.

The judge found that prosecutors asserted that disclosure would jeopardize the investigation without any evidence showing why, especially when at least one subpoena was directed to a potential victim and not a target of the case. “The boilerplate assertions set forth in the government’s applications do not make such a showing,” he wrote, while affording prosecutors a right to renew the requests if there were additional facts supplied to support imposing a secrecy order.

This is not the first time Judge Orenstein has been a thorn in the government’s side on the issue of privacy. In February, he denied a request that Apple extract data from an iPhone in a drug case, ruling in favor of the company on arguments almost identical to those raised in the San Bernardino shooting case.

An order directing a company not to inform its customer is issued “ex parte,” which means that only the prosecutors and judges are involved in the procedure. With no one present to oppose a request, there is the danger that secrecy becomes the rule rather than the exception to efforts to obtain digital information.

The interesting question is whether Judge Orenstein’s opinion will prompt other judges to question these requests for secrecy, perhaps imposing a higher threshold than the Justice Department has been accustomed to when requesting such orders. What Microsoft seeks in its lawsuit may actually come about more through judicial scrutiny than an expansive reading of the rights of corporations.

The Email Privacy Act would amend the law by allowing a secrecy order for up to 180 days in any case that involves obtaining email, while also recognizing a right for service providers to notify customers of any effort to obtain their information. The momentum is certainly present to expand the privacy protections afforded to electronic information because Congress rarely shows the type of unanimity the House did in passing the bill.

It is worth taking a moment to consider how administrative agencies should fit into expanded privacy protections, and how much secrecy should be afforded when the government seeks that information.

http://www.nytimes.com/2016/05/17/business/dealbook/the-fight-over-privacy-and-secrecy-in-government-investigations.html