Microscope Monday: Massachusetts’ proposed Electronic Privacy Act (S. 796 / HD 1014)

microscope

Howdy and good morning, lovers of the Internet freedoms!

It’s time for another in our “Microscope Mondays” series, where we take a good hard look at pending legislation here in Massachusetts relevant to surveillance. Previously, we’ve covered a praiseworthy effort to restrict the use of drones for law enforcement purposes and Martha Coakley’s should-be-better-known “Let’s Wiretap All Of The Things Even Though Crime Is Down” bill. This week, it’s the turn of S. 796 / H. 1684, “An Act Updating Privacy Protections for Personal Electronic Information”, sponsored by Senator Karen Spilka and departing Representative Marty Walz.

So, what does this bill do? It:

(1) Specifies that warrants to companies providing electronic communication services for the content of phone calls, cloud data or location data, must be obtained only where there is probable cause, and:

such records or information constitute evidence of or the means or instrumentalities of the commission of a specified criminal offense under the laws of the commonwealth

In other words, the warrant can’t be for a general fishing expedition; it has to be connected to the investigation of an actual criminal offense under state law. This would seem like something you could assume, but it really isn’t. Without strict constraints, it’s easy to, as Stalin’s secret police chief Lavrenti Beria used to say, “Find me the man and I’ll find you the crime”.

Sentence first. Verdict afterwards.
Sentence first. Verdict afterwards.

(2) Explicitly defines and adds “location information” as a proper subject for warrant protections

In older surveillance law, location data was not a relevant and separate concern, because the items being wiretapped, like your home phone, were usually fixed in place. However, cellphones and other Internet-linked devices now contain a record of all the places you go during a given day. So, location information now has more intrusive content than it used to do, and it is appropriate to make it separately subject to the protections of a warrant if it is to be obtained by law enforcement. See, on the narrower question of whether a warrant should be required to search a cellphone incident to arrest, this excellent article by legal scholar Orin Kerr.

This section may imply that if it passes, law enforcement would be required to obtain a warrant in order to access location information. Right now, it is common practice to use an administrative subpoena instead, which has a far lower evidentiary burden.

(3) Expands the scope of the statute to cover Massachusetts corporations.

In a way, this is the most telling requirement of this bill. It used to be assumed, after the Church Committee reforms of the 1970s, that a warrant would be required in order to search phone company data on American nationals. As it turns out, this section tells us that law enforcement in Massachusetts has been collecting data on US persons without a warrant using US-based phone companies as an intermediary. This fits with the effort by the Massachusetts AG’s office to legalize the warrantless gathering of information on phone calls at phone company “switching stations”. It is, this section tells us, no longer safe for state law to assume that law enforcement will keep their hands off Americans’ data.

(4) Requires police obtaining warrants for these forms of information to specify the corporation possessing the information and describing “the record systems and information to be provided”

This section tries again to constrain law enforcement data requests. Law enforcement would not be able to execute a “general warrant” for phone information, but would have to specify the company targeted. However, this may be a case where the technology is running ahead of the law. Within a few years, we may well see local law enforcement doing what they’re already doing in Michigan and California, and using devices like the Stingray to collect the location and contents of cellphones without having to go through the phone company to make the request.

If the police use this new kind of equipment to vacuum up all cellphone data in the vicinity (like during a protest), will the police try to say ahead of time that the target is “all major US phone companies”? Will they have to specify ahead of time which protesters’ phones they want to tap? If so, then good; these kinds of “particularity” requirements are very much in the spirit of the protections in the Fourth Amendment. The whole point of the Fourth Amendment (and Article Fourteen of the Massachusetts state constitution) is that you can’t go randomly fishing among a crowd of potentially suspicious people. You have to have an idea ahead of time of whose data you want. Otherwise, law enforcement would happily define the scope of a warrant as “Somerville” and have a free hand to search anywhere within the town.

(5) Requires notification to the subject of the warrant within 7 days, though this notification can be delayed for up to 180 days on request.

In principle, we should know if we are under surveillance within reasonable time of the surveillance beginning. But what happens, even if this law passes, if the police don’t notify you? It concerns me that this legislation does not yet contain any enforcement. If you violate this law, nothing specific will happen to you. The worst that will happen is that a case may proceed to trial and be thrown out because a warrant was not obtained. That’s not enough. Fewer than 5% of cases ever proceed to trial. Before that, law enforcement will still be able to use the information obtained through an improper search as part of the plea bargaining process. The absence of enforcement still leaves people vulnerable to such abusive actions by law enforcement.

(6) Allows warrantless gathering of information on an “emergency” basis, but requires law enforcement to document after the fact why “an emergency involving immediate danger of death or serious physical injury to a person requires obtaining without delay of the information relating to the emergency”.

The documentation requirement in this bill is fairly strong, and gives little cause for concern. While I’m not thrilled by such provisions, it’s routine for there to be such an “emergency exception” in any bill with a feasible chance of passing the Massachusetts legislature.

(7) Prescribes an appropriate form of words for a warrant request.

CONCLUSION

This bill is worth supporting, and please thank Senator Spilka and Representative Walz at the links above for introducing it. We hope that the departure of its major sponsor in the House after June will not hamper too much its chance of passing. Our thanks to the ACLU of Massachusetts for making this bill one of their priorities this session. However, we think its language could be improved in committee. We would like the bill to be clearer about whether law enforcement would no longer be able to use administrative subpoenas to obtain location information, and about whether it would effectively outlaw the use of police data interception devices that go around the phone companies.

Leave a Reply