With the recent decision in the Fricosu case, ruling that one can be forced to provide the password to your encrypted hard drive, you may be thinking it is better to store things “in the cloud”. In fact, it can be worse, as cloud storage currently requires no warrant for law enforcement to access any of your data which has been stored in the cloud for at least 180 days.
The Electronics Communication Privacy Act (ECPA), says, specifically, that:
A governmental entity may require the disclosure by a provider of electronic communications services of the contents of an electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days ..with prior notice from the governmental entity to the subscriber or customer if the governmental entity … uses an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury subpoena…”
(Note that the above excerpt has been edited to make it more readable – if you want to read the entire ECPA, and parse it out for yourself, you can read the text of the ECPA here.)
Now, you may be thinking that in order to issue a subpoena, an agency would need to get permission of the court. And you would be wrong. In fact, lawyers even in private practice issue subpoenas all the time; in most states all you need is an active, open case.
What this means, as the ECPA (a law which is nearly 25 years old) stands, is that any electronic communication that you have stored in the cloud for more than 180 days can be demanded without a warrant. And you can be sure that the definition of “electronic communication” that a governmental agency would apply would be elastic enough to include anything in electronic form.
Senator Leahy, of Vermont, has been trying to get amendments to the ECPA passed in order to tighten this up, but so far he has had neither party nor administration support.
So at least for now, if you are using storage in the cloud, you may want to be sure that nothing you store in the cloud stays there for more than 180 days.
|Get notified of new Internet Patrol articles!