informationliberation
The news you're not supposed to know...




An Introduction to Austrian Economics: Understand Economics, Understand Everything
The Century of the Self: The Untold History of Controlling the Masses Through the Manipulation of Unconscious Desires
The Disappearing Male: From Virility to Sterility

The Obama Deception: The Mask Comes Off
Operation Gladio: The Hidden History of U.S. Sponsored False Flag Terrorism in EuropeThe New American Century: The Untold History of The Project for the New American Century
(more)
Article posted Nov 15 2012, 12:54 PM Category: Big Brother/Orwellian Source: EFF.org Print

When Will our Email Betray Us? An Email Privacy Primer in Light of the Petraeus Saga

BY HANNI FAKHOURY AND KURT OPSAHL AND RAINEY REITMAN, Electronic Frontier Foundation

The unfolding scandal that led to the resignation of Gen. David Petraeus, the Director of the Central Intelligence Agency, started with some purportedly harassing emails sent from pseudonymous email accounts to Jill Kelley. After the FBI kicked its investigation into high gear, it identified the sender as Paula Broadwell and, ultimately, read massive amounts of private email messages that uncovered an affair between Broadwell and Petraeus (and now, the investigation has expanded to include Gen. John Allen's emails with Kelley). We've received a lot of questions about how this works--what legal process the FBI needs to conduct its email investigation. The short answer? It's complicated.

The Electronic Communications Privacy Act (ECPA) is a 1986 law that Congress enacted to protect your privacy in electronic communications, like email and instant messages. ECPA provides scant protection for your identifying information, such as the IP address used to access an account. While Paula Broadwell reportedly created a new, pseudonymous account for the allegedly harassing emails to Jill Kelley, she apparently did not take steps to disguise the IP number her messages were coming from. The FBI could have obtained this information with just a subpoena to the service provider. But obtaining the account's IP address alone does not establish the identity of the emails' sender.

Broadwell apparently accessed the emails from hotels and other locations, not her home.  So the FBI cross-referenced the IP addresses of these Wi-Fi hotspots "against guest lists from other cities and hotels, looking for common names." If Broadwell wanted to stay anonymous, a new email account combined with open Wi-Fi was not enough. The ACLU has an in-depth write-up of the surveillance and security lessons to be learned from this.

After the FBI identified Broadwell, they searched her email. According to news reports, the affair between Petraeus and Broadwell lasted from November 2011 to July 2012.  The harassing emails sent by Broadwell to Jill Kelley started in May 2012, and Kelley notified the FBI shortly thereafter.  Thus, in the summer of 2012, when the FBI was investigating, the bulk of the emails would be less than 180 days old. This 180 day old dividing line is important for determining how ECPA applies to email.

Compared to identifying information, ECPA provides more legal protection for the contents of your email, but with gaping exceptions. While a small but increasing number of federal courts have found that the Fourth Amendment requires a warrant for all email, the government claims ECPA only requires a warrant for email that is stored for 180 days or less. 

But as the Department of Justice Manual for searching and seizing email makes clear, the government believes this only applies to unopened email. Other email is fair game with only a subpoena, even if the messages are less than 180 days old.  According to reports, Patraeus and Broadwell adopted a technique of drafting emails, and reading them in the draft folder rather than sending them.  The DOJ would likely consider draft messages as "opened" email, and therefore not entitled to the protection of a search warrant.

In a nutshell, although ECPA requires a warrant for the government to obtain the contents of an email stored online for less than 180 days, the government believes the warrant requirement doesn't apply for email that was opened and left on the server - the typical scenario for webmail systems like Gmail -- even if the messages are less than 180 days old. So, under the government's view, so long as the emails had been opened or were saved in the "drafts" folder, only a subpoena was required to look at contents of Broadwell's email account.

Confused? Well, here's where things get really complicated.  The government's view of the law was rejected by the Ninth Circuit Court of Appeals, the federal appellate court that covers the western United States, including California, and the home to many online email companies and the servers that host their messages. As a result, the DOJ Manual notes that "Agents outside of the Ninth Circuit can therefore obtain such email (and other stored electronic or wire communications in "electronic storage" more than 180 days) using a subpoena..." but reminds agents in the Ninth Circuit to get a warrant.

News reports show that the FBI agents involved in the Petraeus scandal were in Tampa, Florida.  Thus, according to the DOJ Manual, they did not need to get a warrant even if the email provider was in California (like, for example, Gmail): "law enforcement elsewhere may continue to apply the traditional narrow interpretation of 'electronic storage,' even when the data sought is within the Ninth Circuit."

A subpoena for email content would generally require notice to the subscriber, though another section of ECPA allows for delayed notice, for up to 90 days. The FBI interviewed Broadwell for the first time in September, about 90 days after the investigation began in June.

However, many providers nevertheless protect their users by following the Ninth Circuit rule, and insist upon a warrant for the contents of all email. In EFF's experience, the government will seek a warrant rather than litigate the issue. Thus, assuming the service provider stepped up, it is likely that the government used a warrant to obtain access to the emails at issue.

If a warrant was used, note that a warrant is often quite broad, and the government may well have obtained emails from other accounts under the same warrant. And as result, there's no telling how much email the FBI actually read.

The government is required to "minimize" its collection of some electronic information. For example, under the Wiretap Act, the government is supposed to conduct its wiretapping in a way that "minimize[s] the interception of communications not otherwise subject to interception." This ensures the government isn't listening to conversations unrelated to their criminal investigation.

But when it comes to email, such minimization requirements aren't as strong. The DOJ Manual suggests that agents "exercise great caution" and "avoid unwarranted intrusions into private areas," when searching email on ISPs but is short on specifics. The New York Times reported that FBI agents obtained access to Broadwell's "regular e-mail account." They could have read every email that came through as they investigated the affair. Possibly, the FBI could have read an enormous amount of email from innocent individuals not suspected of any wrongdoing.

And while the Fourth Amendment requires search warrants to be specific and particular, as noted earlier, it's not entirely clear whether the FBI got a search warrant to search Broadwell's email. Even if it did get a warrant, the government has argued that broad warrants are needed in electronic searches because evidence could be stored anywhere. While some courts have pushed back on this broad search authority when it comes to email, many courts still give the government wide access to email and other forms of electronic content.

Sound confusing? It is. ECPA is hopelessly out of date, and fails to provide the protections we need in a modern era.  Your email privacy should be simple: it should receive the same protection the Fourth Amendment provides for your home. 

So why hasn't Congress done anything to update the law? They've tried a few times but the bills haven't gone anywhere. That's why EFF members across the country are joining with other advocacy groups in calling for reform. This week, we're proud to launch a new campaign page to advocate for ECPA reform. And we're asking individuals to sign EFF's petition calling on Congress to update ECPA for the digital era so that there can be no question that the government is required to go to a judge and get a warrant before it can rummage through our email, online documents, and phone location histories.

We know that major privacy scandals can prompt Congress to get serious about updating privacy law.  The Video Privacy Protection Act was inspired by the ill-fated Supreme Court nomination of Judge Robert Bork, after a local Washington reporter obtained Bork's video rental records. And the Foreign Intelligence Surveillance Act was inspired by the findings of the Church Committee, which showed that the FBI had warrantlessly surveilled Dr. Martin Luther King, Jr. and many other activists.  If we learn nothing else from the Petraeus scandal, it should be that our private digital lives can become all too public when over-eager federal agents aren't held to rigorous legal standards.

Congress has dragged its feet on updating ECPA for too long, resulting in the confusing, abuse-prone legal mess we're in today. Join EFF in calling on Congress to fix the law.





Latest Big Brother/Orwellian
- Government Wastes Taxpayers' Money On Crappy "Shark-Like Spy Drone"
- Silk Road Prosecutors Rely on Slander As Trial Approaches
- Copyright Law as a Tool for State Censorship of the Internet
- Bill Aimed At Shutting Off NSA's Water Starts Moving Forward Again
- Baltimore Prosecutors Withdraw Evidence Rather Than Talk About Police Department's Stingray Usage
- Detekt: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
- 2nd Grader's Homework Teaches 'The Government GIVES Us Our Rights'
- Feds Put Fake Cell Towers On Planes, Spied On Tons Of Innocent Americans









Comments Add Comment Page 1 of 1
Anonymous

Posted: Nov 15 2012, 5:33 PM

Link
6464 When I first heard about this on the radio and I heard the name Jill Kelley, I thought...well, you can probably guess who I thought they were talking about at first.


Add Comment
Name
Comment

* No HTML


Verification *
Please Enter the Verification Code Seen Below
 


PLEASE NOTE
Please see our About Page, our Disclaimer, and our Comments Policy.


FAIR USE NOTICE
This site contains copyrighted material the use of which in some cases has not been specifically authorized by the copyright owner. Such material is made available for the purposes of news reporting, education, research, comment, and criticism, which constitutes a 'fair use' of such copyrighted material in accordance with Title 17 U.S.C. Section 107. If you wish to use copyrighted material from this site for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner. It is our policy to respond to notices of alleged infringement that comply with the DMCA and other applicable intellectual property laws. It is our policy to remove material from public view that we believe in good faith to be copyrighted material that has been illegally copied and distributed by any of our members or users.

About Us - Disclaimer - Privacy Policy



Advanced Search
Username:

Password:

Remember Me
Forgot Password?
Register

Psychotic Vegas Cop Filmed Beating Man For Filming In Viral Video Queitly Hired By Another Dept. - 12/17Cops Called For Wellness Check Beat Innocent Man, Pile On False Charges; Jury Exonerates, Twice - 12/17Cop Was Not Fired Despite 75 Counts of Stalking and Harassment -- Now He Just Shot a Mother and Her Daughter - 12/17Ontario Cop Sucker-Punched Good Samaritan Grandmother & Broke Her Leg With Karate Kick - 12/17Florida Cop Gets Schooled in Law After Harassing Man for Playing Rap Song, "F**k tha Police" - 12/16Ignorance Is No Excuse for Wrongdoing, Unless You're a Cop - 12/17Police Using Social Media Posts to Determine "Threat Score" of Suspects - 12/16High Profile Witness In Alleged Excessive Force Case Records His Own Stop And Arrest - 12/16

Rialto, CA Police Made to Wear Cameras, Use of Force Drops by Over Two-ThirdsCop Who Karate Chopped NY Judge In Throat Gets Off Scot-FreeFlorida Cop Smashes Compliant Woman's Face Into Car -- "Maybe Now You Can Understand Simple Instructions"VIDEO: Lapel Cam Reveals A Day In The Life Of A U.S. Police Officer (Tasing, Beating, Breaking & Entering, Stomping On Heads... and Laughing About It)Caught On Tape: Officer Sucker Punches Inmate In Face, Files Report Claiming 'Self Defense'Insult Person On Twitter, Go To JailSWAT Team Brings TV Crew To Film Raid Against Threatening Internet Critic -- Raids Innocent Grandma InsteadCop Karate Chops NY Judge In The Throat
(more)

 
Top