On Tuesday, Georgetown’s Law School hosted a Seminar titled “Lawful Access to the Cloud.” The seminar’s panelists grappled with how to find the right balance between civil liberties and legitimate law enforcement needs to access data in the cloud;.
The morning’s first panel focused on lawful access to data in the U.S., and the second panel focused on law enforcement access to data in the E.U. Bruce Schwartz, Deputy Assistant Attorney General at the U.S. Justice Department began the day by pushing back at the widespread perception that the U.S. has less protection than the E.U. for data stored in the cloud. In fact, he said, the U.S. has higher greater protections for electronically stored data than the E.U. The Center for Democracy and Technology’s President and CEO, Leslie Harris, responded that the most important criterion for laws and practices regarding lawful access to data in the cloud is conforming to citizen’s expectations. Harris submitted that most users would be very surprised at the permissiveness of the current legislative structure in the U.S. regarding lawful access to data in the cloud.
Next, Mark Rasch, the Director of Cybersecurity and Privacy Consulting at CSC, examined several of the ways that the cloud is different from previous technologies and explained how much of the legal structure regarding lawful access to electronic communication is hopelessly out of date. The final panelist, Fred Cate, Professor of Law and Director of the Center for Applied Cybersecurity Research at Indiana University, talked about how U.S. lawful access statutes need to change more quickly. He also argued that the U.S. government needs to do a much better job being transparent and accountable about lawful access to electronically stored information.
Peter Swire, Senior Fellow at FPF and the C. William O’Neill Professor of Law at the Ohio State University, began the second panel by explaining that the widespread use of encryption has led law enforcement to increasingly rely on accessing data stored in the cloud. Widespread encryption makes it very difficult for law enforcement officials to access encrypted electronic communications as they are being sent, so law enforcement places greater emphasis on accessing the unencrypted, stored communications in the cloud. Swire then gave an overview of UK data protection laws and pointed out that the laws in the UK in many respects are more permissive than U.S. law.
Following Swire, Google’s Richard Salgado talked about the practices his company follows regarding lawful access. Salgado explained that Google’s policies are based on the reasonable privacy expectations of users. Google, he said, works hard to be transparent and, when legal, provides notices to consumers when their data is accessed by law enforcement. Emilio de Capitani, former Head of Unit at the Committee on Citizens’ Freedoms and Rights in the European Parliament, rounded out the day. He gave an overview of E.U. laws governing lawful access and discussed some of the challenges facing E.U. member states as they try to increasingly standardize their policies for lawful access to data.
Throughout the day, several themes emerged time and again. The seminar made it clear that there is a significant amount of uncertainty about the laws and practices of lawful access in both the U.S. and the E.U. Secondly, U.S. laws regarding lawful access are very outdated and need to be updated to take into account the technological changes that have emerged during the last several decades. Finally, many foreign companies and countries believe that U.S. laws regarding lawful access, especially the PATRIOT Act, allow the U.S. government very significant access to electronically stored data. Regardless of the validity, this fear is having an adverse effect on the ability of U.S. cloud providers to sell their services overseas.
-Peter Swire and Steven Beale
WASHINGTON – Today, the White House announced that 9 new utilities have committed to adopting the industry-led Green Button Initiative, joining 6 previously announced commitments, for a total of 27 million homes committed.
The statement below can be attributed to Jules Polonetsky, Director and Co-Chair of the Future of Privacy Forum.
“Offering consumers access to their data provides the kind of transparency that enhances privacy. By showing consumers the details of energy usage data, utilities are taking an important step to ensure that smart meters are a key benefit intended to help consumers be smarter about energy use.
With appropriate privacy programs in place, access to data will increasingly empower consumers to use their data to manage smart home devices that will advance innovation and consumer control.”
For any questions, or to schedule a phone call with Jules Polonetsky, please email [email protected].
The Future of Privacy Forum (FPF) is a Washington, DC based think tank that seeks to advance responsible data practices. The forum is led by Internet privacy experts Jules Polonetsky and Christopher Wolf and includes an advisory board comprised of leading figures from industry, academia, law and advocacy groups.
On Wednesday, March 14 FPF Senior Fellow Peter Swire gave a talk on “Facial Recognition by the Government: Privacy and Civil Liberties Issues.” The talk took place at the third installment in the U.S. Government Facial Recognition Legal Series. Wednesday’s forum was titled “Striking the Balance – A Government Approach to Facial Recognition Privacy and Civil Liberties.” The forum participants and speakers explored use cases for facial recognition across federal law enforcement and national security agencies, sought to deepen their understanding of the existing law and policy that governs facial recognition in these contexts, and identified gaps in legal/policy authority that may result in privacy and civil liberties vulnerabilities if left unaddressed The forums have been geared towards federal law enforcement and intelligence personnel.
Swire, a law professor at the Ohio State University, focused his presentation on the legal landscape surrounding privacy and facial recognition technology. To frame the discussion, he began by outlining two differing perspectives on facial recognition technology: 1) it has always been legal to observe people in public, and facial recognition technology is simply making this easier and 2) facial recognition technology allows an unprecedented ability to surveil and track people, and this information could be stored indefinitely and correlated with other personal information.
Next, he examined some of the constitutional issues surrounding facial recognition. Of particular importance in the facial recognition space is the fourth amendment. The fourth amendment requires warrants and probable cause for searches and prohibits unreasonable searches and seizures. Observing a person in public has traditionally not required a warrant. However, Professor Swire pointed out, the Supreme Court’s recent decision in U.S. vs. Jones may dramatically impact privacy by requiring law enforcement agents to obtain a warrant to conduct surveillance on suspects in public, something law enforcement has never had to do. However, the fourth amendment contains a consent exception; if an individual consents to a search, a warrant is not required. Professor Swire pointed out that some might argue that individuals consent to going outside or to other public places (i.e. a bank or mall) where security cameras are present.
Professor Swire also examined how several other laws might impact facial recognition technology. Some, including Justice Sotomayor, are worried that constant surveillance by the government could chill free speech and free association. Constant surveillance could also potentially lead to discrimination—while most Americans are familiar with the phrase “driving while black,” constant surveillance could lead to “walking while black.”
To finish his talk, Professor Swire advised the government attendees that not everything that is legal should be done. He recommended that law enforcement and intelligence agencies practice data minimization and conduct the New York Times test to determine whether or not a surveillance program is a good idea: if the program was detailed on the front page of the New York Times, would the public reaction be negative or positive?
Following Professor Swire’s talk, officials from government agencies including the FBI, OMB, DoD, and DHS presented on a range of topics including the impact of public perception on law and policy, biometrics privacy policies in different agencies, and gaps in facial recognition law and policy. The presenters and participants all agreed that they need to work hard to earn and maintain the public’s trust in their use of biometrics technology, including facial recognition services.
The presenters and government attendees showed a high degree of sensitivity to the privacy issues surrounding facial recognition technology. Additionally, they were aware that they are all in the same boat; as one government official put it, a big facial recognition privacy mishap by one government agency would tarnish legitimate facial recognition programs in every other agency. Conversely, any well-thought-out and run facial recognition program can help every agency build trust around facial recognition technology.
The presentation for the forum can be found here.
FPF co-chair Chris Wolf has written a column for SLATE that illustrates the tension in the EU between privacy law and other interests, as highlighted in a recent German episode. The piece links the recent episode to the current consideration of the proposed EU Regulation. For further context and a link, see here.
On Thursday, March 8, 2012 at the IAPP Global Privacy Summit, FPF’s Christopher Wolf sat down with Christopher N. Olsen, Assistant Director in the Division of Privacy and Identity Protection at the FTC. Together, they hashed out the do’s and don’ts of when companies might be subject to FTC enforcement. The clear answer is to comply with the FTC’s requests as much as feasibly possible. But what does that really mean for a company or its representing counsel? When and how should counsel go about negotiating with the Commission? Chris Wolf asked Olsen these practical questions and more regarding best courses of action, yielding important and valuable information for companies and their representing counsels facing potential FTC investigation or enforcement.
Also at IAPP, Tanya Forsheit, Founding Partner at InfoLawGroup LLP, presented on a panel titled, “The Ethos of Lawyers in a Networked World: Privacy, Privilege and Evolving Parameters.” Forsheit brought to light the implications of comments added in the ABA Commission on Ethics 20/20, providing that lawyers should keep abreast of changes, including risks associated with technology. Lawyers should be responsible when storing or transmitting confidential information through cloud computing, said Forsheit.
-Lia Sheena