statement today's hearing is the beginning of a process through which this subcommittee will revisit the statutory framework congress established in the one nine hundred eighty six electronic communication privacy act in light of the enorm technological advances which have taken place in electronic communications over the last twenty four years because of the complexity of the subject both legal and technological this hearing will probably be the first of several we will hold as we consider what if any reforms should be made to the act so that it might function more effectively in the future that was passed in one thousand nine hundred sixty well before we commonly use the internet for email much less the cloud computing and remote storage at a time when cellphones were call a hundred ten years earlier the lightning pace of innovation in communications technology brings with it nor miss improvements in the quality of life for us citizens and in many ways mark live in as a new epoch which might be called the internet age but it must be said particularly by the committee on the judiciary that these events also provide criminals with new platforms for unlawful activity moreover it must also be said here in the subcommittee on the constitution that these robust new communications technologies bring with a new opportunities for law enforcement agencies charged to protect us from such criminals to intervene in our private lives thus we must consider whether the right balance between the interests in need of law and needs  and capabilities are the privacy rights of the public interest in expanding the public policy of encouraging the development of even better technologies and the legitimate investigative needs of law enforcement professionals for democracy and technology concentrates on privacy and government surveillance issues mr dempsey coordinates a digital privacy and security working group a forum for companies trade associations and public interest advocates interested in cybersecurity government surveillance and we represent a broad range of companies on privacy security internet electronic surveillance and communications law his practice also includes both civil and criminal allegations and regulatory compliance surveillance the courts and congress have long sought to balance three critical entrust the individual's right to privacy the government's need to obtain evidence to prevent and investigate crimes and respond to emergencies in the corporate interest in clear rules to provide confidence to consumers and afford the companies the certainty they need to invest in the development of innovative new services today it is clear that the balance among those three interests has been lost powerful new technology create more and more information about our daily lives the protections provided by judicial precedent in statute have failed t unconstitutional in many applications every witness at this table today agrees that it is outdated it needs to be reformed to provide strong privacy protections while also preserving the tools that law enforcement agencies need to act quickly to investigate crimes and respond to emergencies for the past several years the center for democracy and technology my organization has been sharing a dialogue among leading internet companies communications companies privacy advocates law professors and attorneys in private practice to discuss how working and how it needed to be updated as part of our group several former prosecutors and several alumni of the computer crime and intellectual property section at the department of justice in our discussions we were acutely aware of the needs of law enforcement we started with a list of over a dozen issues some of the privacy advocates scholars wanted to go farther strengthening the rules but the former prosecutors emphasized the importance of preserving a sliding scale of authority monthly and then even weekly ultimately we reached consensus on four principles consistent application of the warrant standard to private communications and documents consistent application of the warrant for location tracking of cell phones and other mobile how in some ways many ways actually these proposals are modest proposals would preserve all current exceptions including the emergency exception that permits disclosure of e mail and other content without a warrant service provider providing service to third parties we do not propose any change to the rules governing how you get information directly from the subject of an investigation the company could not hide behind if the government s we see our principles as the first step and i emphasize this just an opening framework in a process that will require public discussion of other stakeholders and most importantly addressing concrete hypotheticals about how the law would affect ongoing practices in the coalition is not urging the introduction of legislation many details to be discussed before we get to the legislative other issues might be brought forward in addition to the four that we've put on the table this committee and we're urging the senate judiciary committee to move cautiously to hold further hearings already indicated you would as an individual not representing particular service providers or clients but over fifteen years i've had the pleasure of working with industry and their implementation and compliance with that  communications assistance for law enforcement at the service providers in the middle every day the best way to determine whether that's out of balance take a look at what providers do every provider to the public or computing service provider to the public service providers have to understand how the law applies to them and the legal process they need to disclose communications and information provider security offices everyday deal with these requests from law enforcement and understand that they are important and sometimes life threatening but they also have privacy concerns and they must meet that imperative to protect user information so it's an untenable position for them they have a real identity crisis about what they are today working environment you could be just as easy  communication service provider as a remote computing service provider and who knows under the definition what is very difficult position so we know it's out of balance and we know clarity is important  providers they don't work with anybody else they make all the decisions on their own sometimes pursuant to judicial review by a judge but not with the work of any private party the opposite is true with new online crimes crimes committed using networks whether it's the internet crimes committed using telephones or simply a case where there happens to be evidence it's stored or available over some sort of a network whether the internet  or the cell network in all of those cases the government is working through the intermediary of the provider there is a company a company that runs a network that has data and the real question and the question that the electronic communications privacy act is designed to address is what should the rules be when the government wants data that the network has or when the network company the third party provider wants to disclose information to the government now that means that in order to understand the issues raised by act we need to think about what the data is and when does the government obtain it so it may be helpful to think about two different kinds of data that the communications providers may have one category as contents of communication that the actual message that somebody may be sending or receiving over the network might be an e mail might be a text message in the case of a phone call would be the actual conversation the two people are having and then there's lots of non content information the non content information is information that the network is generating and using in order to deliver the communication now we can understand what kind of content depends on the technology depends on the network may depend on the company depends on business decisions that each company is making as to whether to keep records whether to generate certain records and that means there are lots of records available and those records may vary dramatically based on the company and based on the technology so that's the issue of what the records are that are out there the next thing you need to think about is when is the government collecting the information so again we can think of two basic categories one category would be when the government comes to the provider and says we're going to compel you to disclose certain information we want you to act on our behalf as our agents essentially and provide certain information maybe it'll be stored contents of the government maybe it will be stored non content information of the government wants these records and other other times the government will want real time surveillance to occur sometimes of content in the case of wiretapping sometimes in the case of non content information for example  where somebody's cell phone is located or who somebody is e mailing so that that's the case when the government is compiling information and then the flip side of that is what if the provider comes across evidence and wants to disclose it to the government maybe the provider has uncovered child pornography maybe the provider has discovered some evidence of some other crime and wants to provide that information either to the government or even to a non government group what should those rules be that's the question that the electronic communications privacy act was designed to address in one thousand nine hundred now of course in two thousand and ten technology has changed dramatically and i'm very glad to hear that the committee has planned more here because i think what really we need to hear from is we need to hear from these providers we need to find out what information do they have what are their practices what is the technology how does it work what kind of cell phone location information to different providers how close can they get to finding out the location of the user of the phone how long do they keep their records so we need to find out from the providers what are there and then we also need to find out from the government out of their investigation those of us to watch a lot of television we've seen a lot of law and order and we know how those investigations work how they work on t v but mostly we don't know how these new online investigations where we haven't seen those investigations very few people have so we need to talk about not only the technology but what are the kinds of cases that the government is working out of these cases actually unfold and i think it's only after getting that inform sense of what the technology is and how the investigations actually w d disagree issuing orders that have different standards one person might be tracked according to one's standards another one to a higher standard and then within the state themselves  we would try to make it as specific as possible imprecise as possible but at least it would provide some context in which the courts would operate thank you my final question is to professor occur in some of your recent scholarship in applying the fourth amendment to the internet you talk at how you're prepared technologically feel to engage in this discussion and  me i want to ask a couple questions and then i just want somebody to give me some examples of the kinds of things that are going out there that we should be worried about  clarity was more important than substance where you get to so i'm trying to figure out how long we should be working on this  before we get to some kind of legislative solution is clarity of a rule more important than getting the rules right  legislation that would be a markup something from now would be a good a good target but i think it is going to take a while we're not pushing for introduction of legislation immediately i think we do take what we're talking about in terms of cloud computing if you have a document on your computer in your office document printed out protected by the fourth amendment out in the suburbs protected by the fourth amendment but locked up in the cloud not protected by that requirement in the ninth circuit the ninth circuit has rejected the justice department and has said that a warrant is required so what happens now is if the warrant is subject to the jurisdiction of the subpoena is subject to the jurisdiction of the ninth circuit it's rejected in a warrant is required if it's outside of it's a little unclear in ok back to the question that's the kind of uncertainty you're getting now and there is overarching it all the possibility that these cases will percolate through the courts and that the statute will be held unconstitutional if the justice department pushes its position because because a warrant is not where the statute currently permits access without a warrant is right that a warrant is required that content is like a letter it's like a phone call it should be protected so you do run that constitutional risk i still agree with my have an expectation that i'm not being very in essence almost pinpointing a person on a map a number of those companies have said that they will insist upon a warrant for disclosure of that information and i think they have a strong constitutional in their opinion that has been entrusted to a third party in such a way that you have surrendered your privacy interest in it i think the correct analogy is the storage locker analogy in which a warrant is required to protected the letter is interesting because the letter is protected of course in the hands of the post office seventy seven when the supreme court ruled that the fourth amendment does protect the letter moving through the mail system the copy of the letter that i read is protected the copy of the letter that the recipient has protected the recipient they can always voluntarily turn it over but to force them to disclose it would require a warrant or a subpoena served directly on them so you've got this crazy quilt that the average individual has absolutely no idea about and increasingly the services are being designed in a way to make all this completely seamless and completely not apparent to the user so we have these increasingly powerful blackberries and hand held mobile internet devices we're constantly accessing information remotely sometimes it's on the device sometimes it is and increasingly it becomes even less clear where it is and it's time to dispense with technology platform rules by which people do not leave their lives and how people do not base their