The suggestion has alarmed privacy advocates. “This is a sea change in government privacy policy,” Michael Macleod-Ball, acting director of the Washington legislative office of the American Civil Liberties Union (ACLU), said in a press release in August. “Without explaining this reversal of policy, the OMB is seeking to allow the mass collection of personal information of every user of a federal government Web site. Until the OMB answers the multitude of questions surrounding this policy shift, we will continue to raise our strenuous objections.”
According to the OMB official, the policy change is not a done deal. “There are no actual proposed changes in the sense that anything is hardwired to be changed,” he says. While he acknowledges that cookies carry potential privacy concerns, he says “making certain that people’s privacy is protected in an extremely robust way is going to be a paramount concern of this administration, should any changes be proposed.”
At the same time, he said, “it may be the case that there are ways in which judicious use of cookies on government Web sites can enable the Web sites to be more interactive, more robust, richer in terms of content and features and capabilities, so that they can really enable government to work better for people. That is the animating goal here.”
While most privacy advocates oppose changes to existing cookie policies on federal Web sites, most advocacy groups are calling for major changes to ECPA on the grounds that the 1986 legislation is seriously out of date and no longer adequately protects sensitive data.
“This very important law, which I think in many ways does effectively protect people’s privacy online, has understandably become outdated as the pace of technological change has increased,” says Kevin Bankston, a senior attorney at the Electronic Frontier Foundation. “There are at this point fundamental questions about what ECPA protects that are unanswered and maybe are unanswerable without additional congressional guidance.”
According to Bankston, nothing more pointedly demonstrates how out of date ECPA is than its provisions regarding e-mail. “E-mail is a technology that actually existed in 1986, and ECPA was drafted with that in mind,” he says. “And yet there still critical questions about how ECPA applies to e-mail.”
Under ECPA, for example, an electronic communication that has been in electronic storage with an electronic storage provider for 180 days or fewer requires a warrant if the government wants to access it. “The reason 180 days is required is because of differences in the past technology,” says Bankston. “Back in 1986, when you dialed into your e-mail service and you downloaded your e-mail, it was erased off the server. So if you had left your e-mail there for six months, the fair assumption was that you had abandoned it and therefore it was not deserving of special protection.”
What’s more, says Bankston, a number of emerging technologies aren’t specifically treated under ECPA. The issue of how ECPA applies to the government getting data from Internet search logs is, he says, “completely unsettled.”
While Bankston and other privacy advocates call for reforms in ECPA, no party is actively opposing such reform. Many privacy advocates, however, believe that the Department of Justice would prefer to see the current law remain as it is. “I think it is fair to say that they may be resistant,” says Jim Dempsey, vice president for public policy at the Center for Democracy and Technology. “To some extent, the Justice Department is doing a good job of manipulating the ambiguities and the loopholes in the statute now.”
While he did not directly respond to Dempsey’s charge of manipulating ambiguities and loopholes in ECPA, a Department of Justice official says, “We’ve been looking for places where there are gaps and trying to resolve issues. We’ve also been working within the structure created by Congress, which tried to be technology neutral to some extent in passing the statute. Where there are interpretive gaps, we are presenting that to the courts. And there is opportunity, of course, to have the courts interpret the statute.
“I wouldn’t say ECPA is out of date,” added the official, who asked that his name not be used. “I would say there are concepts in it where Congress might have had a technology in mind when it was legislating and that technology is no longer in place. The courts have then tried to adapt to newer technologies that replaced it.”
Nor has Congress actively taken up the issue of ECPA reform in recent years. According to Dempsey, “Up until now the issues have been discussed and debated only among the true ECPA nerds. It is a relatively small community of people who know about the statute, who understand the statute and who see how it works, so up until now the issue has not received a lot of public prominence.”
