Post-Petraeus, Net Privacy Backers Hope For A Boost

By Martin Kaste

Published November 16, 2012 at 4:42 PM CST

Online privacy advocates are hopeful the FBI investigation into retired Gen. David Petraeus' personal emails will put a human face on their efforts to update a stalled Internet privacy bill.

The tech industry has been lobbying hard for an update to the Electronic Communications Privacy Act, the 1986 law governing online privacy.

Under an umbrella group calling itself Digital Due Process, companies and civil liberties groups have argued that the law is too loose with the privacy of data stored online, especially Web-based email and other documents on the cloud.

For instance, the law considers data that's more than six months old to be "abandoned" — not deserving of the same protection as real-time communications. A bill to change this has been languishing in the Senate Judiciary Committee since last year.

But in the wake of the FBI investigation that triggered Gen. David Petraeus' resignation, there's sudden new interest in the bill.

Tracking Government Queries

"The most recent news that's been all over the place certainly has highlighted this issue," says Richard Salgado, legal director at Google.

He can't comment, he says, on whether the company played a role in the Petraeus investigation. But the company does keep track of the total number of requests for information from government agencies, in order to shed light on those requests. The semiannual publication of Google's " Transparency Report" coincided with the Petraeus scandal this week.

Salgado says that of the nearly 8,000 requests for user data, the vast majority were for information to help identify the owners of email accounts and other online services.

"The police come to us with a subpoena and have identified an email address of interest to them, and have asked for information that the user provided in creating that email address," Salgado says.

That includes IP addresses — the numeric code of the computer you used when logging into that anonymous Gmail account you keep for private matters.

The fact that police can get that information with a subpoena — just a letter, usually without approval of a judge — is deeply disturbing to civil libertarians like Chris Calabrese, legislative counsel for privacy issues at the ACLU.

"Before the government engages in a really invasive investigation like this, a judge should be involved," Calabrese says. "They should use the same standard as if they searched your house: They should get a warrant, based on probable cause."

The ACLU and its tech industry allies want warrant-level protection for most online data — even data that experts call "transactional": the addresses of websites you've visited or your phone's location history.

A Burden For Law Enforcement

But Scott Burns, executive director of the National District Attorneys Association, says Americans should understand how much more work that would create. "The difference is, an investigative subpoena is a one- or two-pager, and a search warrant is a book report," Burns says.

All those extra warrants, he says, would make life "incredibly difficult" for police.

In Burns' opinion, asking for information that helps identify someone — or that person's Internet service provider — is simply not that intrusive.

"I don't think anyone would disagree with the fact that matching an ISP is much less invasive than an investigator looking over hundreds or perhaps thousands of emails or texts," Burns says.

And there's been a shift toward more protection for content — what's actually inside those emails and texts — in the past few years. While federal law doesn't require warrants for content left online for more than six months, in practice, Burns says, local and state prosecutors almost always do get them.

Google also takes this position, telling police to get a warrant for content, no matter how old. Salgado says the company takes that stance on constitutional grounds, despite the 1986 law that would seem to indicate no warrant is needed for content older than six months.

Still, the ACLU's Calabrese wants to see that standard enshrined in federal law. And with the Petraeus episode, he's hoping for new momentum.

"Always, the most difficult piece of privacy law is to put a face on it," he says. "Well, I think the Petraeus scandal has solved that particular problem."

But the Petraeus scandal has not yet put privacy on a fast track. One Senate staffer says members of Congress who support tighter rules want to wait to see more details about how — and why — the FBI took its investigation as far as it did.