In a major change to how America’s largest tech companies handle online privacy, Google revealed this week that it requires warrants for users’ email content and data stored in the cloud, imposing hurdles to government access to data beyond the scope of a 1986 electronic privacy law.
But even as Google’s policy is a big step forward for digital due process advocates, it doesn’t extend to a significant portion of the information Google releases to law enforcement agencies such as IP addresses used to access Google accounts, message time stamps, and to and from fields. And Google’s recently released transparency data shows that getting information on your online activities can still largely be done without a warrant.
The report shows less than a quarter of the 8,428 government requests for U.S. user data they received in July to December 2012 were search warrants, and 88 percent of requests were fully or partially complied with. The U.S. led country rankings in terms of total number of requests made and the percentage of requests complied with.
Wired quotes Google spokesman Chris Gaither on Google’s newly outlined warrant policy, which has been in effect for an unclear amount of time: “Google requires an ECPA search warrant for contents of Gmail and other services based on the Fourth Amendment to the Constitution, which prevents unreasonable search and seizure.” Google’s interpretation is novel because under the Electronic Communication Privacy Act of 1986 (ECPA), messages over 180 days old stored in the cloud only require an administrative subpoena — rather than a warrant approved by a judge — largely due to how email technology worked in 1986: It was very unusual for data to remain on external servers because of hosting costs, leading to a belief that any data left on an external server for that could be considered abandoned.
While our use of technology has changed dramatically since 1986, the law has not: An attempt to update the law last year stalled over the holidays. And while the law does not require a warrant to access some data, two federal appellate courts came to differing conclusions on the issue in 2010, one stating that obtaining the content of email messages stored on an email provider’s server requires a warrant, and another allowing magistrate judges discretion to require warrants from the government when requesting location information from cellphone providers — although both rulings only apply to their judicial district.
Google’s public stance on warrants may signal that tech companies are no longer willing to quietly accept the lack of progress on technology policy. In many sectors it has become clear our laws have not kept up with the pace of technological innovation, yet the biggest success of the tech sector last year focused on preventing bad legislation rather than updating woefully outdated regulation.