Today’s Other ECPA Reform News: Location Privacy Hearing in the House

The big news today in electronic privacy is the Senate Judiciary Committee’s approval of Senators Leahy and Lee’s bill (S. 607) to update the Electronic Communications Act (ECPA). However, just as that committee was signing off on a requirement that the government obtain probable cause warrants before seizing your private communications content and files stored in the cloud, members of Congress on the other side of the Hill were grappling with the other hot ECPA reform issue: location privacy.

The one-hour House hearing, entitled “ The Electronic Communications Privacy Act (ECPA), Part 2: Geolocation Privacy and Surveillance”, was convened by crime subcommittee Chairman Sensenbrenner—who is a co-sponsor of Representative Chaffetz’s “GPS” Act (HR 1312) to require warrants for location tracking, and who was also announced today as the newest co-sponsor of Representatives Lofgren and Poe’s comprehensive “Online Communications and Geolocation Protection Act” ECPA reform bill (HR 983). Both bills implement key ECPA updates that we at CDT have been promoting for years, both through the Digital Due Process (DDP) coalition and more recently through the Digital 4th coalition.

This morning’s hearing witnesses included Catherine Crump, a staff attorney at the American Civil Liberties Union, a DDP and Digital 4th coalition member, who has signficant experience litigating issues of location privacy (written testimony); a former Department of Justice ECPA maven now in private legal practice, Mark Eckenwiler (written testimony); and technical expert Professor Matt Blaze, there to educate the committee about the various technologies of location tracking (written testimony). Also testifying, about the general usefulness of location tracking to criminal investigations, was Peter Modafferi of the International Association of Chiefs of Police (written testimony). Notably not present was the DOJ itself, with Mr. Sensenbrenner opining that the government had declined to publicly testify because it still lacks a sensible position on how the law should treat location tracking.

I (via @kevinbankston) and CDT technologist Joe Hall (via @joebeone) were both in attendance and live-tweeting, so you can check out our blow-by-blow account on Twitter. To briefly summarize, though, there was a notable albeit somewhat rough consensus between both the Representatives and the witnesses that:

• Location data is critically important to modern law enforcement investigations;
• The current legal standards for location tracking are unclear—a “patchwork”, as Judiciary Committee Chairman Goodlatte described it;
• Legislation is necessary to clarify those standards;
• Finding the right balance between privacy and the needs of law enforcement on this complex technological issue may be difficult; but
• When it comes to tracking a phone using its Global Positioning System (GPS) chip, a warrant based on probable cause should be required—which is not clearly codified in the law right now, but which is DOJ’s current policy.

Where consensus broke down was on the question of how the law should treat non-GPS, network-based phone tracking; that is, tracking based on what cell towers you are closest to. The two witnesses with law enforcement backgrounds were skeptical that warrants should be required for cell tower data, which they contended was very general and imprecise.

However, as we explained in yesterday’s preview post and as Professor Blaze reiterated today, cell tower-based data is getting more and more precise every day, as the number of towers—and the number of “small cells” like “picocells” and “femtocells”—steadily increases. Even now, that data can sometimes be as effective if not more effective than GPS at locating you within a private space like your home and office. Therefore, and as Ms. Crump repeatedly noted, only a probable cause warrant for location data will sufficiently protect our Fourth Amendment reasonable expectation of privacy. And, as Professor Blaze pointed out in his closing remarks, legislation that isn’t technology neutral—legislation that tries to apply different standards to different tracking technologies—“is doomed to become increasingly meaningless.”

We agree and we look forward to continuing our work with Congress to pass ECPA reform legislation that will strengthen and clarify the law’s protection of our locational privacy regardless of whether the government uses GPS tracking, cell tower-based tracking, or new tracking technologies that are only now being imagined. Thanks to Representative Sensenbrenner for holding today’s hearing on this critical issue, and to the witnesses for their helpful testimony—which you can watch online at the committee’s website.