U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

70–856 PDF 2011

S. HRG. 112–130 

THE ELECTRONIC COMMUNICATIONS PRIVACY 

ACT: GOVERNMENT PERSPECTIVES ON PROTECTING PRIVACY IN THE DIGITAL AGE 

HEARING 

BEFORE THE

COMMITTEE ON THE JUDICIARY 

UNITED STATES SENATE 

ONE HUNDRED TWELFTH CONGRESS 

FIRST SESSION 

APRIL 6, 2011 

Serial No. J–112–14 

Printed for the use of the Committee on the Judiciary 

( 

(II) 

COMMITTEE ON THE JUDICIARY 

PATRICK J. LEAHY, Vermont, Chairman 

HERB KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

CHUCK SCHUMER, New York 

DICK DURBIN, Illinois 

SHELDON WHITEHOUSE, Rhode Island 

AMY KLOBUCHAR, Minnesota 

AL FRANKEN, Minnesota 

CHRISTOPHER A. COONS, Delaware 

RICHARD BLUMENTHAL, Connecticut 

CHUCK GRASSLEY, Iowa 

ORRIN G. HATCH, Utah 

JON KYL, Arizona 

JEFF SESSIONS, Alabama 

LINDSEY GRAHAM, South Carolina 

JOHN CORNYN, Texas 

MICHAEL S. LEE, Utah 

TOM COBURN, Oklahoma 

BRUCE A. COHEN, Chief Counsel and Staff Director 

KOLAN DAVIS, Republican Chief Counsel and Staff Director 

(III) 

C O N T E N T S 

STATEMENTS OF COMMITTEE MEMBERS 

Page 

Grassley, Hon. Chuck, a U.S. Senator from the State of Iowa ............................ 2 

prepared statement .......................................................................................... 48 

Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont .................... 1 

prepared statement .......................................................................................... 62 

WITNESSES 

Baker, James A., Associate Deputy Attorney General, U.S. Department of 

Justice, Washington, DC ..................................................................................... 5 

Kerry, Cameron F., General Counsel, U.S. Department of Commerce, Washington, DC ............................................................................................................. 3 

QUESTIONS AND ANSWERS 

Responses of James A. Baker to questions submitted by Senators Franken 

and Leahy ............................................................................................................. 25 

Responses of Cameron F. Kerry to questions submitted by Senator Leahy ....... 32 

SUBMISSIONS FOR THE RECORD 

Baker, James A., Associate Deputy Attorney General, U.S. Department of 

Justice, Washington, DC, statement .................................................................. 36 

Kerry, Cameron F., General Counsel, U.S. Department of Commerce, Washington, DC, statement .......................................................................................... 51 

Tech Freedom; Competitive Enterprise Institute; Americans for Tax Reform’s 

Digital Liberty Project; Freedom Works; Campaign for Liberty; Washington 

Policy Center; Liberty Coalition; Center for Financial Privacy and Human 

Rights and Less Goverment, April 6, 2011, joint letter .................................... 64 

(1) 

THE ELECTRONIC COMMUNICATIONS PRIVACY ACT: GOVERNMENT PERSPECTIVES 

ON PROTECTING PRIVACY IN THE DIGITAL 

AGE 

WEDNESDAY, APRIL 6, 2011 

U.S. SENATE, 

COMMITTEE ON THE JUDICIARY, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:08 a.m., in room 

SD–226, Dirksen Senate Office Building, Hon. Patrick J. Leahy, 

Chairman of the Committee, presiding. 

Present: Senators Leahy, Whitehouse, Klobuchar, Franken, 

Coons, Blumenthal, and Grassley. 

OPENING STATEMENT OF HON. PATRICK J. LEAHY, A U.S. 

SENATOR FROM THE STATE OF VERMONT 

Chairman LEAHY. Good morning. Today the Committee will hold 

a timely and I think important hearing on the Federal Government’s use of the Electronic Communications Privacy Act, or 

ECPA, as we know it. It is one of the Nation’s premier digital privacy laws. ECPA has been a bridge between what are, of course, 

legitimate law enforcement needs but also the equally legitimate 

privacy rights of Americans. When the Committee held its first 

hearing on ECPA reform last September, I said that while there is 

general agreement that ECPA has become outdated by vast technological advances and changing law enforcement missions since the 

law’s initial enactment, the question of how best to update this law 

has no simple answer. We know it has to be updated. The difficult 

part is exactly how do we do it. 

Congress is considering many different approaches to ECPA reform, but I think there should be a few core principles to guide our 

work. Meaningful ECPA reform must carefully balance privacy 

rights, public safety, and security. Reforms must also encourage 

American innovation, and they have got to instill confidence in 

American consumers, law enforcement, and the business community. All these principles we should agree on. It is how best to do 

it. 

For many years, ECPA has provided vital tools to law enforcement to investigate crime and to keep us safe. At the same time, 

the law has been crucial to safeguarding Americans’ digital privacy 

rights. I know. I was one of the ones who helped write this bill. 

With the explosion, though, of cloud computing, social networking 

sites, and other new technologies, determining how best to bring 

2 

this privacy law into the Digital Age is going to be one of Congress’ 

greatest challenges. 

While still a useful tool for our Government today, ECPA is a 

law that is hampered by conflicting standards that cause confusion 

for law enforcement, the business community, and American consumers alike. For example, just to put it right down in the concrete, a single e-mail could be subject to as many as four different 

levels of privacy protections under ECPA, depending on where it is 

stored and when it is sent. There are also no clear standards under 

that law for how and under what circumstances the Government 

can access cell phone or other mobile location information when investigating crime or national security matters. And on that, it is 

a much different era than when I was first in law enforcement 

where, if police had legitimate rights and legitimate—reasons, 

rather, to get into a phone conversation, they would have their 

warrant, and they basically went and clipped on to some wires in 

one particular area. That is not the situation today, and, of course, 

it becomes even more aggravated in national security matters. 

So we are having this hearing so we can examine how these and 

other shortcomings impact the Government’s ability to fight crime 

and protect national security. We will also examine the Government’s views about various proposals being considered by Congress 

to update this privacy law. 

We are going to hear from the General Counsel of the Department of Commerce, who has unique insights into the impact of 

ECPA on American innovation, but also the views of the Department of Justice, which relies upon ECPA to carry out its vital law 

enforcement and national security duties. So I am glad both are 

here, and I will yield to my good friend from Iowa, the Ranking 

Member of this Committee, Senator Grassley. 

STATEMENT OF HON. CHUCK GRASSLEY, A U.S. SENATOR 

FROM THE STATE OF IOWA 

Senator GRASSLEY. Thank you, Chairman Leahy. This hearing 

provides us an opportunity to hear the Government’s view on the 

need to reform this law. 

At our 2010 hearing the Departments of Justice and Commerce 

both testified about the need for our laws to keep pace with technological developments. Both witnesses agreed that technology has 

changed significantly since the law was passed in 1986, but neither 

witness offered proposals. The hearing focused largely upon 

changes sought by private sector businesses and interest groups 

that have formed a coalition to reform the law. 

We in Congress need to work to ensure that our laws are up to 

date and do not negatively impact business innovation. We also 

need to address legitimate privacy concerns. 

We need to hear from the law enforcement community to ensure 

that we do not limit their ability to obtain information necessary 

to catch criminals and terrorists who use electronic communications. This statute, just like the PATRIOT Act, has specific meanings and definitions, and any amendment requires careful consideration to ensure that we do not create loopholes that make it harder 

for law enforcement to do their job. 

3 

Today we have an opportunity to follow up with both of those departments. No legislative proposal has been put forward by the administration. Instead, the witnesses, it seems to me, will point out 

areas where changes could be made to bring clarity to the law. 

I hope the Department of Justice changes what they view will be 

brought forward and what they feel will harm investigations. I also 

want to hear what Commerce has to say about changes that they 

feel are necessary to ensure that we remain competitive and how 

reforming our privacy laws could enhance business. 

That said, there is clearly a tension between the two points, and 

that was how we arrived at the current law, a carefully crafted 

compromise. The 1986 statute struck a balance then between privacy and law enforcement. Replicating that balance will be the key 

to any possibility of being successful on proposed legislation. 

I will put the rest of my statement in the record. 

[The prepared statement of Senator Grassley appears as a submission for the record.] 

Chairman LEAHY. Thank you very much. 

Our first witness will be Mr. Cameron Kerry. He is the General 

Counsel of the Department of Commerce. He serves as the Department’s chief legal officer, chief ethics, officer, and is Chair of the 

Department of Commerce Privacy Council. He has been a leader on 

work across the U.S. Government on patent reform and intellectual 

property issues and privacy security and efforts against 

transnational bribery. Previously he was a partner at Mintz Levin, 

a national law firm. In over 30 years of practice—and I might note 

personally I think I have known you for most of the 30 years of 

that practice—he has been a communications lawyer and litigator 

in a range of areas, including telecommunications, environmental 

law, toxic torts, privacy, and insurance regulation. He is a graduate 

of Harvard College and earned his law degree at the Boston College School of Law. 

Mr. Kerry, we will put your full statement in the record, but 

please go ahead, and then we will hear from Mr. Baker, and then 

we will go to questions. 

STATEMENT OF HON. CAMERON F. KERRY, GENERAL COUNSEL, U.S. DEPARTMENT OF COMMERCE, WASHINGTON, DC 

Mr. KERRY. Mr. Chairman, thank you and good morning. Mr. 

Chairman, Ranking Member Grassley, and members of the Committee, I am pleased to be joining you again to discuss updating the 

Electronic Communications Privacy Act of 1986. 

I am here today to say that the administration fully understands 

and supports the Committee’s rationale for reexamining this statute, and I am here to offer to you two recommendations. 

The first is that there should be a principled relationship between the legal protections and the procedures that apply to law 

enforcement access to electronic information and the legal protections and procedures for comparable materials in the physical 

world. What those protections and procedures should be should be 

determined by reference to a number of factors, including the privacy expectations of the parties involved, who has access to or control of the information, and the reasonable needs of law enforcement and national security. 

4 

The second is that the legal protection afforded to electronic content should not turn simply on factors that are disconnected from 

reasonable privacy interests of ordinary citizens. 

As the Chairman and as other members of the Committee observed when we were here last September, one may question 

whether the Stored Communications Act’s 180-day rule, the notion 

that privacy protection accorded to an electronic message could 

change 180 days after it is sent, should continue. If Congress wants 

to revisit this issue, the appropriate level of privacy protection once 

again should turn on an assessment of other factors, including the 

expectation of privacy of the parties to the communication, the 

mode of communication used in connection with the content, and 

who controls it, and, again, of course, the interests of law enforcement and national security. 

Since we were here in September, the Department of Commerce 

has been at work on a commercial data privacy framework to meet 

the needs of the 21st century information economy. When we were 

here in September, we told you that even though we had not asked 

about ECPA, a number of industry players came to us and volunteered concerns about the statute. 

Last December, we published a green paper that is included with 

my written testimony, which included the recommendation that, in 

light of changes in technology and changes in market condition, the 

administration should review ECPA with a view to assessing privacy protections in cloud computing and location-based services. 

That is a process which we are conducting. It is under with the Department of Justice and other administration colleagues. 

In response to the green paper, we have received further comments from industry and from consumer groups. All of these endorsed updating ECPA. So I would be happy to provide the Committee with a summary of those comments and what they had to 

say about the impact of ECPA in light of new technologies, the uncertainties and emerging gaps in privacy protection. 

There is another reason why this ongoing examination of ECPA 

is timely, which I discussed in my written testimony, and that is 

court decisions in recent years that have injected uncertainty on 

the standards and the privacy protections in emerging technologies. 

So, Mr. Chairman, as you and members of the Committee proceed with what you have said is a difficult, challenging process of 

striking a new balance, we stand ready to work with you, and now 

I stand ready to respond to your questions. 

Thank you. 

[The prepared statement of Mr. Kerry appears as a submission 

for the record.] 

Chairman LEAHY. Thank you, Mr. Kerry. 

I may note that in 37 years—I do not even want to think about 

how many thousands of hearings I have either attended or presided 

over. I think this is the first time I have had somebody give their 

testimony from an electronic pad, and so I—— 

Mr. KERRY. I am an early adopter, Mr. Chairman. We try to stay 

on top of technology. 

Chairman LEAHY. I have seen that, and I appreciate that very 

much. I do not use my old Selectric typewriter as much as I used 

to. 

5 

[Laughter.] 

Chairman LEAHY. That is a joke. I actually found one in a closet 

at home the other day. I do not whether to give it to the Smithsonian. 

Our next witness, James Baker, is the Associate Deputy Attorney 

General at the U.S. Department of Justice. He has worked extensively on all aspects of national security policy and investigations. 

He has been an official at the U.S. Department of Justice for nearly 

two decades, well respected by this Committee and by me for his 

work. He has provided the United States intelligence community 

legal and policy advice for many years. In 2006, he received the 

George H.W. Bush Award for Excellence in Counterterrorism, the 

CIA’s highest award for counterterrorism achievements. 

I am well aware of the background of that award, and it was 

justly and honorably deserved. 

Mr. Baker also taught at Harvard Law School, served as resident 

fellow at Harvard University’s Institute of Policy. 

Mr. Baker, please go ahead, sir. 

STATEMENT OF HON. JAMES A. BAKER, ASSOCIATE DEPUTY 

ATTORNEY GENERAL, U.S. DEPARTMENT OF JUSTICE, WASHINGTON, DC 

Mr. BAKER. Good morning, Mr. Chairman, Ranking Member 

Grassley, and members of the Committee. Thank you for the opportunity to testify on behalf of the Department of Justice here today 

regarding ECPA, and here with my colleague, Mr. Kerry, from the 

Department of Commerce. 

As you know, ECPA, which includes the Stored Communications 

Act and the pen register statute, is part of a set of laws that controls the collection and disclosure of both content and non-content 

information related to electronic communications, as well as content that has been stored remotely. These laws serve two functions, 

as folks have mentioned today. They are critical tools for law enforcement, national security, and cyber security activities, and they 

are essential for protecting the privacy interests of all Americans. 

ECPA has never been more important than it is now. Because 

many criminals, terrorists, and spies use telephones or the Internet, electronic evidence obtained pursuant to ECPA is now critical 

in prosecuting cases involving a wide range of crimes, including 

terrorism, espionage, and violent crimes. 

ECPA has three key components that regulate the disclosure of 

certain communications and related data. The first prohibits unlawful access to stored communications; The second regulates voluntary disclosures by network service providers of customer communications and records, both to Government and to non-governmental entities; and the third regulates Government access to 

stored communications and provides procedures for law enforcement officers to follow to compel disclosure of stored communications and related data. ECPA, as you know, was originally enacted 

in 1986, but it has been amended repeatedly since then, especially 

with substantial revisions in 1994 and in 2001. 

Mr. Chairman, the Department of Justice is charged with the responsibility of enforcing the laws, safeguarding the constitutional 

rights of Americans, and protecting the national security of the 

6 

United States. As such, we welcome these hearings on this very important topic. We appreciate the concerns that some in Congress, 

the courts, and the public have expressed about ECPA, and we 

know that some believe that ECPA has not kept pace with technological changes or the way that people today communicate and 

store records, notwithstanding the fact that ECPA has been 

amended several times, as I just mentioned. We respect those concerns, and we appreciate the opportunity to discuss them here 

today. We also applaud your efforts to undertake a renewed examination of whether the current statutory scheme appropriately accommodates such concerns and adequately protects privacy while 

at the same time fostering innovation and economic development. 

It is legitimate to have a discussion about our present conceptions 

of privacy, about judicially supervised tools the Government needs 

to conduct vital law enforcement and national security investigations, and how our statutes should accommodate both. For example, we appreciate that there are concerns regarding ECPA’s treatment of stored communications—in particular, the rule that the 

Government may use lawful process short of a warrant to obtain 

the content of e-mails that are stored for more than 180 days. And 

we are ready and willing to engage in a robust discussion of these 

matters to ensure that the law continues to provide appropriate 

protections for the privacy and civil liberties of Americans as technology develops. 

As we engage in that discussion, as several have referenced this 

morning, what we must not do—either intentionally or unintentionally—is unnecessarily hinder the Government’s ability to effectively and efficiently enforce the criminal law and protect national 

security. The Government’s ability to access, review, analyze, and 

act promptly upon the communications of criminals that we lawfully acquire, as well as data pertaining to such communications, 

is vital to our mission to protect the public from terrorists, spies, 

organized criminals, kidnappers, and other malicious actors. At the 

Department of Justice, we are prepared to consider reasonable proposals to update the statute—and indeed, as set forth in my written statement for the record, we have a few of our own to suggest— 

provided that they do not compromise our ability to protect the 

public from the real threats that we face. 

In closing, Mr. Chairman, it is important to note that ECPA protects privacy in another way as well. By authorizing law enforcement officers to obtain evidence from communication providers, 

ECPA enables the Government to investigate and prosecute hackers, identity thieves, and other online criminals. Pursuant to 

ECPA, the Government obtains evidence critical to our ability to 

prosecute these privacy-related crimes. 

Mr. Chairman and members of the Committee, ECPA is an important topic, and I look forward to taking your questions here 

today, and I would ask that my written statement be submitted as 

part of the record. 

Chairman LEAHY. It will be made part of the record. 

Mr. BAKER. Thank you, Mr. Chairman. 

[The prepared statement of Mr. Baker appears as a submission 

for the record.] 

7 

Chairman LEAHY. I was struck when you said you are willing to 

consider proposals we might have, and, of course, the fact is if we 

do not have proposals as we go forward, then we stay with the law 

the way it is, and I do not think anybody would find that best. So 

it is a case where this is not just let us consider what Congress 

thinks. The fact is either Congress acts or you are stuck with the 

old law. 

Mr. Kerry, I was pleased to learn the Commerce Department and 

the Justice Department are working together to consider potential 

updates to ECPA, so we would welcome any feedback. Can you give 

us a short summary of the progress of this partnership to date? 

Then I am going to ask the same question of Mr. Baker. 

Mr. KERRY. Well, we have been in active discussions really 

through the year to try to deal with proposals to update and restrike the balance. The written testimony that you have from each 

of us is a reflection of some of the direction that that has taken. 

We are certainly prepared to put our shoulders to the wheel with 

the Committee. I think the process of you, Senator, and the Committee holding our feet to the fire and developing this testimony 

has helped to advance the discussions, and I think we are in a position to move forward in a concrete way. 

Chairman LEAHY. Well, I would like to see the administration 

recommendations because, as I said, sometimes I find that inertia 

sometimes gets the greatest bipartisan support on the Hill, but I 

would like to see us move forward. 

So, Mr. Baker, I would ask you the same question: How is this 

work with Commerce going? 

Mr. BAKER. Yes, Senator, I agree with Mr. Kerry completely. We 

have been working on a whole range of issues related to surveillance, privacy, innovation, all of these issues. We have made, I 

think, substantial progress. I think the two statements together indicate that we have worked through a lot of issues. We actually got 

some concrete areas at least that we agree that we should focus on 

that are reflected in the statement. So I think that is significant 

progress. 

We have certainly been working at the Department of Justice on 

language that supports the proposals that we have put forward, or 

at least raised. We have not finished that work yet, even within the 

Department and with the interagency, so we have got some additional work to do in that regard. But we have made significant 

progress, Senator. 

Chairman LEAHY. For an incentive, I think there is a willingness 

of Republicans and Democrats to work together on this because 

when I talk about the inertia, I do not find many people who want 

to just stick with the law the way it is. It is outdated from both 

a national security point of view, but from a privacy point of view, 

and we worked very, very hard on the first law to get that balance, 

realizing that technology changes and a lot of the things that we 

could consider at the time we wrote the law, that those of us who 

worked on it knew technology might change, but none of us could 

predict where and to what extent. Nobody knew about the cloud at 

that time, for example. 

Now, let me ask you a couple of specifics. Last year, the Court 

of Appeals for the Third Circuit held the Government could be reVerDate Nov 24 2008 12:36 Nov 22, 2011 Jkt 070856 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\70856.TXT SJUD1 PsN: CMORC
8 

quired to obtain a search warrant before it could access an individual’s cell phone location data. Under ECPA the Government can 

obtain cell phone location data by several different methods, including seeking a court order, but the statute does not specify whether 

the Government must always establish probable cause to get this 

order, as would be the case with a search warrant. 

What is the Department’s view about the legal standard that 

should apply in order for the Government to access cell phone location information? 

Mr. BAKER. Senator, just to clarify, when we speak about cell 

phone location information, there is a variety of different types that 

are potentially available. So there is the very precise GPS type of 

information that might be available that more pinpoints accuracy. 

Chairman LEAHY. That is right. 

Mr. BAKER. And then you have cell site location information, 

which it is increasingly more accurate in terms of determining 

where a cell phone is, but it still is not as precise as—— 

Chairman LEAHY. It just says that cell phone is next to this— 

that cell phone is within the area of this cell tower, but it could 

be—— 

Mr. BAKER. There is a range of—— 

Chairman LEAHY. Yes. 

Mr. BAKER. Depending upon where you are, in a rural, suburban, 

or urban area, it depends. So it is key to understand that there are 

different technologies that exist with respect to cell phone location 

information. 

The Department’s policy now is that if we want the GPS Information, we have to go get a warrant in order to obtain that. For 

the cell site location information, the less precise information, we 

have to still go get a court order, a variety of orders depending 

upon whether it is historical or prospective, but in any event, you 

still have to go to court and get an order, albeit under a lower 

standard than you have for a warrant. 

Chairman LEAHY. Would it help to have some clarification specifically in this area? 

Mr. BAKER. Well, we think that based on the Third Circuit case 

that—and we have suggested that it is definitely an area that is 

worth examining. 

Chairman LEAHY. Well, let me ask you that, because we also 

have the D.C. Circuit. They vacated the life sentence of an individual who had been convicted, I believe it was in drugs, but he 

was—they had installed a global positioning device on his car to 

track him in connection, and they vacated it. 

Now, I understand the Department is considering appealing this 

case. Am I correct? Or are you aware of that? 

Mr. BAKER. I do not think we have—I would have to check on 

that. 

It is being reviewed by the Department right now, Senator. 

Chairman LEAHY. What is the legal standard to apply if you 

want to obtain information by using or installing a global positioning device? And does that change whether it is historical, as 

you had referred to earlier, or realtime? 

Mr. BAKER. So just to make sure I understand, the device you 

are talking about is a device that is attached to a vehicle—— 

9 

Chairman LEAHY. That is right. 

Mr. BAKER [continuing]. As opposed to a communications device. 

So it is a little bit different in that sense. 

Chairman LEAHY. A GPS device. 

Mr. BAKER. It is a GPS, but it is not a cell phone, it is not a personal—— 

Chairman LEAHY. That is right. You are not talking—— 

Mr. BAKER. Correct. 

Chairman LEAHY. It is simply a locator. 

Mr. BAKER. So there have been a lot of rulings on these kinds 

of cases over the years, and I think, unfortunately, the answer depends on the facts of the case. And so it depends where you are 

when you install the device, and it depends what the device is attached to and where it goes. In circumstances in which it would go 

into an area that is protected by the Fourth Amendment, then you 

would have to get a warrant to continue to monitor the signals 

from that device. But to the extent that the device is attached in 

an unprotected area, in terms of the Fourth America, and then 

travels in areas that are not protected by the Fourth Amendment, 

then currently you would not need a warrant to obtain that information. 

Chairman LEAHY. Thank you. And does it make a difference if 

it is historical information or realtime? 

Mr. BAKER. I guess it would depend. I am thinking about the 

beeper. I mean, I guess if you had the beeper recording for a period 

of time and then downloaded the information, that would be historical. But I think the same rules that I just discussed would apply 

in that context since it is not a communication device. 

Chairman LEAHY. Whether you put it on their garage or whether 

you put it on the—— 

Mr. BAKER. On the public street or something, where the car 

goes and so on, yes, all those factors are relevant to the analysis. 

Chairman LEAHY. Thank you. 

Senator Grassley. 

Senator GRASSLEY. I am going to start with Mr. Baker. This coalition that is promoting these changes wants to increase the standards to obtain non-content information through the—just a minute. 

I am on the wrong question. Just a minute. 

The coalition, a group of businesses and interest groups, as we 

know, supports a probable cause standard for obtaining all electronic communications regardless of its age, the location or storage 

facilities, or the provider’s access to information. Do you support 

raising the legal standard for obtaining all electronic communications to a probable cause determination? 

Mr. BAKER. Senator, I think that is the kind of concern that we 

have that I expressed in my statement, that we have to make 

sure—that the kinds of information we are talking about, especially 

when you come to non-content information, is critical for our ability 

to conduct investigations. And if we were to raise the standard 

with respect to some electronic communications, even content, it is 

going to have an impact on law enforcement investigations. We 

have to be mindful of that. We have to be thoughtful about that. 

And so whatever proposals come forward, we have to look at that 

in that light. 

10 

Senator GRASSLEY. Well, I think you just told me, and if you did 

not say this, say I interpreted you wrong. But my next question 

dealt with the probable cause determination, the effect on law enforcement. And you just told me it would be more difficult. 

Mr. BAKER. It would be more difficult. 

Senator GRASSLEY. Could this significant change also unduly 

burden the agencies and prosecutors and the courts? 

Mr. BAKER. It would impact our—let me just stick with the location information that Senator Leahy was asking about. We use that 

information as sort of the basic building blocks of investigations. So 

an IP address, a cell phone piece of information, where you were 

when you placed a particular call, these are the kinds of information that we use to locate people, suspects, and also to investigate 

links between suspects. So we use it as sort of the basic building 

blocks, and we also use that kind of information to build our way 

toward obtaining probable cause. And so we need to be able to obtain a certain amount of information to work our way to the more 

intrusive types of techniques that we have available. 

Senator GRASSLEY. Okay. It takes longer to prepare a 2703(d) 

order application than a subpoena, and it takes longer to prepare 

a search warrant application than a 2703(d) order application. If 

you would agree with those two statements, is it fair to say that 

raising the standard will slow down a criminal investigation? 

Mr. BAKER. I think it would have an impact along those lines, 

Senator, yes. It would consume more resources and require us to 

engage in more process. I think there is no doubt about that. 

Senator GRASSLEY. And since time is a critical factor during a lot 

of criminal investigations and speed is essential, if Congress slows 

down the process, then this could have real-life consequences, you 

know, particularly where human life is involved? 

Mr. BAKER. Absolutely, Senator. As I said, whatever we do in 

this area, we need to get the balance right. We need to make sure 

that we achieve all the objectives that we want to achieve. 

Senator GRASSLEY. Let me focus on the court for just a minute, 

and I referred to that just a couple questions ago. If all electronic 

communications, with emphasis upon ‘‘all,’’ required a search warrant, the courts would experience additional burdens as well, and 

these increased burdens on the court system would naturally increase the delays when investigating time-sensitive threats to 

human life. Would that be right? 

Mr. BAKER. Senator, I expect there would be some additional 

burden on the court. I have worked with judges for many years, 

and they are always ready to take on whatever the Government 

brings to them. So I am not sure that they would say that it would 

burden them that much, but I think it is additional requirements 

that we would have to meet and have to go to a court to achieve. 

Senator GRASSLEY. This coalition supports increasing the standard to obtain non-content information through pen register or trapand-trace orders. They are pushing for a standard to be at least as 

strong as that required under an electronic communication 2703(d) 

order. They are further pushing for this increased standard to 

apply to e-mail addresses, instant messages, texts, Internet protocols, addresses of Internet sites. 

11 

Currently does the legal process and authority for obtaining pen 

register information work well? 

Mr. BAKER. For obtaining pen register information? I think our 

perspective would be that it does work well actually currently. 

Senator GRASSLEY. And are you aware of any problems in using 

it? 

Mr. BAKER. Using the pen registers? 

Senator GRASSLEY. Yes. 

Mr. BAKER. I think the answer is we are generally satisfied with 

the way the statute is now. There was a particular amendment in 

2001 that was extremely helpful, so I think—with respect to all 

these, if I just may add, we are working through all these issues. 

I think everybody agrees that these are the significant issues to 

focus on. We do not have a cleared position from the administration 

yet on these proposals, but I think we have identified the concerns 

that we have. 

Senator GRASSLEY. If I could just have three short questions 

here. 

Chairman LEAHY. Go ahead. 

Senator GRASSLEY. Then that will finish this point. 

Do you think the legal standard to obtain information through 

pen register or trap-and-trace orders would be increased to a probable cause or 2703 standard? 

Mr. BAKER. I am sorry, Senator. Do I think it would be—— 

Senator GRASSLEY. The legal standard to obtain information 

should be increased. 

Mr. BAKER. Oh, again, this is an area—the pen registers and 

these kinds of things are the basic building blocks for our investigations, so any changes to those would have to be reviewed very 

carefully. Any changes to that standard would have to be reviewed 

very carefully. 

Senator GRASSLEY. Well, then, I will skip a question and go to 

my last one. Would not a change like this increase burdens on investigators, prosecutors, and the courts? 

Mr. BAKER. Yes. 

Senator GRASSLEY. Okay. Thank you, Mr. Chairman. 

Chairman LEAHY. Thank you very much. 

I will yield to Senator Whitehouse and then in a few minutes 

turn the gavel over to him. 

Senator WHITEHOUSE. Thank you, Chairman, and thank you, 

gentlemen, both for being here. I appreciate your work on this 

issue. 

I am going to be here until the end of the hearing because I will 

be taking over the gavel, so I am just going to ask a sort of brief 

set of overview questions now that are kind of in the nature of 

framing what the topics should be that we should be prepared to 

address as we go forward. And I assume that you are working on 

them as well. 

One obviously is how location information should be treated. As 

a general proposition, I do not know that there is an established 

privacy right cognizable under the Fourth Amendment regarding 

your location. If the police want to put a tail on somebody, they do 

not get a warrant for that or take any action, and they can follow 

to the best of their ability and figure out where somebody is. When 

12 

you move up to pen register and trap-and-trace, there is a more 

complicated standard. And when you go to a full-blown Fourth 

Amendment search warrant requirement and you are involved in 

content, there is a much higher standard. And as I understand it, 

we should be sorting out where the location information, which is 

now newly available really in ways that it was not when ECPA was 

written, where it falls into that array of possibilities. Correct? 

Mr. KERRY. Yes. 

Senator WHITEHOUSE. So that is one. Okay. We should review 

the question—as a general proposition, you both agree that warrants are ordinarily required to access content of a communication. 

Correct? 

Mr. BAKER. Not always. 

Senator WHITEHOUSE. Ordinarily. 

Mr. BAKER. Ordinarily. But—I am sorry. It depends. Not always. 

So we can talk about that. 

Senator WHITEHOUSE. But the 180-day rule under ECPA specifically allows access to content if it is more than 180 days old without a warrant—— 

Mr. BAKER. Correct. 

Senator WHITEHOUSE. We should review that determination 

given the change in technology and practice that has taken place. 

Correct? 

Mr. BAKER. We agree that is definitely an area that people want 

to talk about, and we are happy to engage in that discussion. 

Senator WHITEHOUSE. The next issue is private sector disclosures, and they come in two ways. One is private sector disclosures 

to other private sector commercial operators and whether we 

should put some restrictions on that so that, for instance, your ISP 

is not selling your location to McDonald’s so that every time you 

are within 100 feet of a McDonald’s you are getting a message saying, ‘‘Don’t you feel like a hamburger.’’ And at the same time, on 

the other side, there is the concern that the ISPs now have considerable access and considerable situational awareness about the 

cyber threat and what is happening out there, and ECPA restricts 

their ability to warn Government about those activities so that 

Government can be prepared to take national security protection 

action. And both of those are things we should be examining, correct? 

Mr. KERRY. That is correct, Senator, yes. Those are actively at 

work in interagency processes within the administration. 

Senator WHITEHOUSE. It seems to me that as we move more into 

the cyber realm, there are searches and then there are searches. 

And the Constitution concerns itself with searches in which somebody gains awareness of your personal papers and communications. 

That strikes me as the fundamental protection of the Fourth 

Amendment. Where you have a mechanism that potentially no 

human actually is aware of that scans the flow of data that goes 

through cyber space and simply alerts when it determines that a 

virus or a malware or some kind of threat is attached to that content, it is conceivable in that circumstance that no person actually 

locates that, although technically is remains a search because an 

agent has deployed this technology and has actually scanned the 

packet of content. Is that a distinction that is worth beginning to 

13 

pursue? That seems to be a novelty nowadays. You know, in the 

old days, if somebody went through your papers, it was an agent 

and they were looking at it, and your privacy was really implicated 

in a very significant way when another person was looking at your 

papers. If all that is happening is that the content of your e-mail 

stream is being scanned for known malware and viruses and that 

is causing a safety action to be taken to protect the Internet, that 

is a slightly different piece of—it is a slightly different privacy interest involved there, isn’t it? 

Mr. BAKER. Senator, these are exactly the right kinds of questions to ask and areas to think about. I have seen some folks analogize what I think you are talking about to a situation like a dog 

sniffing luggage at the airport for either explosives or for narcotics 

or something like that, and they go along the line and, you know, 

sniff what is there, and then they alert only on the thing that has 

contraband in it. So it is a different regime. It depends on the context. Airports are different than a lot of other things. But in any 

event—— 

Senator WHITEHOUSE. Conceivably, there is even less of a privacy 

interest in this because what happens when the dog alerts is that 

your suitcase gets opened and people plow through it, and a human 

knows what you have in your suitcase, and that affects the privacy 

interest; whereas, it is not unusual that what happens to a digital 

alert is that simply the message is rerouted and nobody actually 

ever gets awareness of the content. 

Mr. BAKER. Well, that is one way you could do it, certainly, but 

I think there would be an interest in looking at that communication and trying to analyze it from a cyber security perspective to 

have a better idea where it came from, what its purpose is, and 

what its destination is. 

Senator WHITEHOUSE. All right. My time has expired, and I just 

to figure out who was here first. 

Senator Franken was here first. 

Senator FRANKEN. Thank you, Mr. Chairman, and thank you, 

gentlemen, for your testimony. 

ECPA gives citizens privacy protections with respect to law enforcement, but ECPA also says when an ISP can share our information with other businesses or the general public, and I am worried that these privacy protections are just far too weak. 

Here is an example. If I make a phone call from my smart phone 

and my phone company learns of my location, they cannot go out 

and sell that information or give it to anybody unless they have my 

express consent. But I use the same smart phone to do a Google 

search, under certain court decisions that same phone company 

would likely be free to give my location information to any business 

or person that it wants to. The difference is that my phone call is 

covered by the Telecommunications Act, and my Internet search is 

covered by ECPA. 

Mr. BAKER. and Mr. Kerry, are you aware of this discrepancy? 

And what do you think of it? 

Mr. KERRY. I am aware of the discrepancy, and that, in fact, is 

the case. I mentioned the effort that we have undertaken to address privacy policy in the commercial data context. Indeed, a couVerDate Nov 24 2008 12:36 Nov 22, 2011 Jkt 070856 PO 00000 Frm 00017 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\70856.TXT SJUD1 PsN: CMORC
14 

ple of weeks ago, the administration announced support for baseline privacy regulation in the online area. 

The issue of what usage, what resale, what communication with 

third parties can be made of the kind of location information that 

you described, among many other kinds of information that people 

generate as they go online, is one of the issues that needs to be addressed as part of baseline privacy protection. 

Senator FRANKEN. And as part of rewriting this bill? 

Mr. KERRY. I am not sure that that necessarily fits under changing ECPA. There are aspects of it that need to be addressed under 

ECPA, as Mr. Baker said in response to earlier questions. Trying 

to establish some certainty on Government access to geo-location 

data and other location data is certainly an appropriate subject for 

consideration. 

Senator FRANKEN. Well, this specific issue with location is part 

of a broader problem in ECPA, and you note in your testimony, Mr. 

Baker, that ECPA allows ISPs to disclose customer records to pretty much anyone they want as long as it is not the Government. 

That includes information on whom you e-mail, when you e-mail, 

and to some extent the websites that you visit. This is totally out 

of line with the Cable Act and Communications Act, which require 

cable and phone companies to get your consent before making these 

disclosures to third parties. 

Mr. BAKER., I applaud the Department’s position that this part 

of ECPA may be insufficiently protective of customer privacy. 

Would you agree that in this respect ECPA’s consumer privacy protections represent a lower standard than the kind of protections 

our law provides to cable and phone service customers? 

Mr. BAKER. I think it is lower with respect to the providers that 

ECPA applies to when compared to the regulations under the Communication Act and the Cable Act, those kinds of things that apply 

to different companies or at least companies wearing different hats 

at different times. And as you said, yes, it is one provision of ECPA 

that allows this more robust sharing of consumer data—not communications, not the content, but the data. 

Senator FRANKEN. So it is a lower standard. 

Mr. BAKER. It is a lower—well, it permits it. It permits the sharing without more to anybody who is not a governmental entity. 

And if I could just note that a foreign government falls within that 

category. In other words, it prohibits disclosures to the U.S. Government or a State government. It does not prohibit disclosures to 

a foreign government. So we are—— 

Senator FRANKEN. Thank you for that distinction. 

Mr. Kerry, Minnesota is home to a lot of so-called cloud computing businesses. These are businesses that allow other businesses or individuals to store their e-mails, documents, and photos 

remotely instead of on their computers. I recently heard from one 

company in Minnesota, N Stratus. They said they are losing business because they cannot definitively tell their prospective clients 

when and how the Government will access their information. Because of this uncertainty, people are not deciding to put their documents on the cloud. They are choosing to keep their documents on 

their own computers and servers. 

15 

Mr. Kerry, I am sure you have heard of many companies that are 

in this situation. How can we amend ECPA to help businesses like 

N Stratus? 

Mr. KERRY. Senator Franken, I certainly have heard that from 

a great many companies. I spoke yesterday at a gathering of technology and software general counsels. There was a lot of interest 

in this issue. We have seen in the development of e-commerce that, 

you know, people’s willingness to trust vendors with credit card information was a critical threshold to get across. You see the same 

thing with cloud computing. 

Harris research, market research by computing companies, indicates a very large number of both businesses and consumers are 

concerned about their privacy and their security in putting information into the cloud-–80 percent in the Harris survey. 

One of the reasons that we have engaged in the privacy and security discussion at the Department of Commerce is because trust 

is such a critical component of the digital economy, and cloud providers need to be able to assure their customers that what they 

provide to them in the cloud is as trustworthy as physical records 

or other ways of storing digital information, and that, you know, 

they have no competitive disadvantage with other business models. 

That is the clear message that we have gotten from a great many 

companies in this area. 

Senator FRANKEN. Thank you. 

Senator WHITEHOUSE. Senator Coons. 

Senator COONS. Thank you, Senator Whitehouse. And I must 

say, as I read the background of the briefing in the materials in 

preparation for today’s hearing, I initially thought I must be mistaken that the murkiness of the legal field—it was the last memo 

I read before falling asleep last night. I thought it was my error. 

It is a truly unclear and unresolved legal landscape in the balance 

between Fourth Amendment interests and privacy rights between 

the law enforcement and the commercial. We have here a statute 

that has truly been exceeded by developments in technology over 

the last decade and more. And I am concerned about the uncertainty for law enforcement, for companies, for individuals in their 

privacy rights, and the interests of law enforcement. 

One comment, if I might, in opening and follow-up to what Senator Grassley said. The only concern for law enforcement, I think, 

is not just speed. It is also efficacy. The county police department 

over which I had responsibility before this, we could kick down 

doors, arrest people, haul them out, but if it was not done in a way 

that was legally sound, if the evidence was not gathered in a legally sound way, then lots of the investigation and the prosecution 

ultimately would be wasted. And the uncertainty of the legal standards under which you are proceeding with investigations and prosecutions here I think puts law enforcement equally at risk as the 

possibility of raising the standards in a way that would slow down 

law enforcement. Law enforcement needs to be both swift and certain and done in a way that protects the privacy rights that makes 

America a unique place. 

I would like to follow up on some of the questions Senator 

Franken was asking about the tensions between consumer interests and privacy rights. 

16 

Mr. Kerry, how do the U.S. protections for stored communications, data, and documents, particularly those stored in the cloud— 

we were talking about the tension between paper records, internal 

records, and those that are electronic but offsite. How does this 

compare with protections abroad? What is the status of the EU 

Data Privacy Directive? And how do our protections compare 

around the world given that many companies now are truly global 

in terms of the communications and the documents? 

Mr. KERRY. Thank you, Senator Coons. As a general matter, certainly as it is perceived, the European protections under the European Data Privacy Directive are more extensive, certainly more 

prescriptive than those under the United States regime. Part of 

that is because there is no comprehensive protection in the United 

States; so we have some very strong sectoral regimes, we have 

strong common law, FTC protections, but there are gaps. 

So part of our effort is to fill those gaps. That is a major reason 

for the administration’s endorsement of baseline privacy protection. 

It is a key ingredient in cloud computing and data, the free flow 

of data as an instrument of trade and of economic growth. We have 

seen over the past years, the past couple of years, that the digital 

sector, the information economy, is leading the way out of the recession. It is a key component of our economic growth, so we need 

to take steps internationally to align our privacy law with consumer expectations. That is the effort on the data privacy front. I 

think it is an appropriate effort under ECPA. 

Senator COONS. Thank you, Mr. Kerry. 

Mr. BAKER. Your written testimony argued current protections 

for communications stored longer than 180 days makes sense because analogous paper records can be accessed with just a subpoena. Are stored e-mail communications really analogous to 

records accessible with a subpoena? And how do you make that 

analogy? 

Mr. BAKER. I guess we make the analogy based upon where you 

are storing them, with whom, for how long, and so on. So in the 

paper world, if you store your records with someone else, depending 

upon a lot of facts and circumstances, so we can go into that if you 

want, but we can go and we can use a grand jury subpoena, for 

example, go to that third party, deliver the subpoena, and demand 

the records. Even somebody’s personal records that they maintain 

in their own house, we can go with a grand jury subpoena and ask 

for those records. There may be some other issues there in terms 

of them producing them, but the basic idea is we can subpoena 

records when they are in the hands of either yourself or third parties if we do not want to use a warrant. 

Senator COONS. And at what point does the standard rise to requiring a warrant? 

Mr. BAKER. Well, if we are going to intrude on a protected privacy interest, so if we want to go—if we do not think you are going 

to produce the documents from your house, we want to go in your 

house and take them, we get a warrant that authorizes us to do 

that. If we thought that a third party even would pose a threat or 

might destroy the records, something like that, we would go and 

get a warrant and take them from the third party. 

17 

Senator COONS. And given the dramatic developments in the last 

decade in terms of the capacity for storage for e-mail—I think none 

of us 20 years ago had years of stored e-mail just sitting out there 

somewhere—how do you measure emerging privacy standards and 

how do we strike an appropriate balance in the law enforcement 

context? 

Mr. BAKER. Well, I think for us our obligation on that last part 

is to come up and explain to you what we think the proposed 

changes would have on our ability to do our jobs. I think that is 

what we need to do. 

I think it is difficult and I think courts are struggling with actually understanding what people’s personal subjective expectations 

of privacy are because in some circumstances people want to share 

a lot of data with others in the world. But the question under the 

Fourth Amendment is not only what do they subjectively think, but 

what objectively is a reasonable expectation of privacy. And that is 

what I think Congress is going to struggle with over the next period of time to understand that and try to deduce that. 

I think it is hard to understand, though. I think it is hard to actually figure out what people’s reasonable conceptions of privacy 

are today. 

Senator COONS. And I do think—— 

Senator WHITEHOUSE. Senator Blumenthal. 

Senator BLUMENTHAL. Thank you, Mr. Chairman. 

I want to focus on the area of potential legislation that you have 

identified as No. 6 in your testimony, Mr. Baker, restricting disclosures of personal information by service providers, that is, the commercial disclosure of information, sharing, exchanging, selling information, where I think a lot of consumers are most directly impacted. We can debate in this Committee hearing the standards 

that ought to apply to disclosure by service providers to the Government, but as we have seen in the security breach that occurred, 

reported just recently occurred sometime in the past with Epsilon, 

literally millions of consumers are now going to be at risk of 

phishing, potential identity theft as a result of the breach of security concerning Epsilon that has received information from some of 

the major retailers around the country. And both as to content and 

non-content information, I think there is a significant privacy interest at stake here, as you very correctly identified in your testimony. 

And, in fact, I have asked the Attorney General of the United 

States to begin an investigation. I sent him a letter yesterday concerning the Epsilon breach, and I would like to emphasize to you 

now how concerning I believe this breach is. I have asked for this 

investigation literally within the last 24 hours, so I am not going 

to ask you for a response here on behalf of the Department. But 

I believe that it is extraordinarily important for the Department of 

Justice to indicate its interest in this area. 

I would like to ask in my question to you whether you believe 

that there is a need for more explicit restrictions. You say there are 

none now in the legislation concerning disclosure, sharing, exchange of this kind of information, whether you believe this is an 

appropriate topic for us to legislate on in reforming ECPA. 

Mr. BAKER. Thank you, Senator. Obviously, as the statement reflects, we certainly think it is an area—we agree—I mean, the 

18 

Commerce Department agrees that this is an area that we should 

look at. How you exactly change the rules, if at all, is another matter, but it is an area that a number of people have raised, and so 

it seems to be a legitimate area of inquiry. 

Obviously, if people want to share information voluntarily for 

whatever purpose, they are free to do so. That is clear. And I do 

not think anybody is talking about trying to restrict people’s ability 

to voluntarily share information to take advantage of all these 

amazing technologies that are out there for a whole range of different purposes. But the question is: To what extent should the 

companies be able to share that information consistent with their 

obligations to their customers? And should law enforcement be in 

a different position with respect to such data than private sector 

entities are? Maybe they should be. Maybe they should not be. But 

at least the key thing is to understand that. 

One quick final point. With a lot of this data, as Mr. Kerry said, 

people are very concerned about their privacy. We understand it. 

And as you reference, they are also concerned about their security, 

the security of all this data that is out there. And the more data 

you share and the more data third parties have, the more data, you 

know, that is subject to the kinds of cybersecurity threats that Senator Whitehouse was referencing. 

Senator BLUMENTHAL. Well, let me ask you very directly. If there 

were a requirement, for example, carrying out the policy that you 

have just articulated so well that people ought to be given the 

choice whether to share data or not, that Best Buy or L.L. Bean 

should be required to get a consumer’s consent before they share 

that information, law enforcement would be impacted in absolutely 

no way. 

Mr. BAKER. Well, I think if they agree to it—and I believe that 

in many circumstances they do agree to it. When you accept the 

terms of service, when you click ‘‘I agree’’ after you read or at least 

see these long statements that are out there, that is a legally binding contract, and so—— 

Senator BLUMENTHAL. Well, sometimes they do and sometimes 

they do not. But my question to you really is separate and apart 

from what the means of consent might be. It is whether law enforcement would have an interest or would be impacted—in other 

words, to put it more directly, I would posit the theory that the law 

enforcement of and the protection and security of the United States 

of America would not be impacted if L.L. Bean or Best Buy would 

be required to have a great big box requiring consumer consent before they share or sell this information, because it would not impact the standard that you would need to go to a service provider 

and seek the same information. You are in two separate realms of 

legal accountability. 

Mr. BAKER. I see what you are saying, Senator. Yes, I think that 

is right. Obviously, we do investigate the kinds of crimes that you 

are talking about, so we have an interest in what is being shared 

and what information is out there and what information we have 

to investigate the unlawful disclosure of. But I think you are right. 

It at least puts us in no worse a position, but in terms of looking 

at privacy and understanding what the rules of the road are with 

respect to privacy, it is at least a legitimate area of inquiry. 

19 

Senator BLUMENTHAL. Thank you. 

Senator WHITEHOUSE. Senator Klobuchar. 

Senator KLOBUCHAR. Thank you very much, Mr. Chairman. 

Thank you to both of you for joining us today to talk about this 

important topic. As a former prosecutor, I see both sides: the fundamental right to privacy, but also the way criminals can try to 

take advantage of our respect for that privacy by claiming communications are protected and by making it very hard to get at things. 

So that is the way I look at this and have had some interesting 

times in my past jobs trying to get information. 

I wanted to talk about, first of all, cloud computing. It was raised 

by two other Senators, and I have been working in the last 6 

months on a bill with Senator Hatch that we are going to put out 

shortly, and I wondered if you could talk, Mr. Kerry, about how 

Commerce is looking at that as you look at this bill and how you 

are going to work cloud computing into ECPA as you move ahead. 

Mr. KERRY. Thank you, Senator. We will be interested to work 

with you on that bill. 

The Obama administration has made cloud computing a priority, 

and it is part of the technological initiatives that Federal agencies 

have been directed under a Cloud First Initiative to move toward 

cloud computing. It provides important economic advantages of 

scalability, of efficiency, which, as the digital economy leads the 

way to economic growth, is an important driver of innovation, of 

economic growth, of our ability to compete in the world and to 

outcompete and outinnovate the rest of the world. So that is an important driver here. 

I spoke earlier—I do not recall whether you were here at the 

time—about the concern among cloud computing companies about 

leveling the playing field, about enabling them to provide the same 

assurance of trust in both privacy and security that their competitors have, both, you know, in the United States and around the 

world. So aligning the law to consumer privacy expectations is an 

important step toward that. 

Senator KLOBUCHAR. Very good. 

Mr. BAKER. What is the current law for data stored in the cloud 

under the Privacy Act? And does the Justice Department have any 

proposals for updating as it relates to that data? 

Mr. BAKER. Well, the law—it depends on a lot of different facts 

and circumstances. In particular, it depends upon whether the information is in transmission still or whether the transmission has 

been completed and it has been received by the intended recipient 

of the communication if you are talking about communications data 

in the cloud. Obviously, you can store non-communications data in 

the cloud as well—business records and other things that corporations, for example, might want to store with a third party, or individuals—photos, things of this nature. 

So I think the answer is it depends upon the kind of communication that you are talking about, and I think different rules would 

apply depending upon the amount of time that it has been stored 

there, whether it is in transmission or not, things of this nature. 

So it is a relatively complicated area. 

Also, there is a key distinction in the law between content and 

non-content, as we have been talking about, so if the Government 

20 

wants non-content information, one set of rules applies. And if we 

want content information, a different set applies. 

Senator KLOBUCHAR. Okay. In your testimony you explained the 

difference between cell site location, cell phone tower information, 

and GPS location information, and you mentioned that some courts 

seem to confuse the two. Your testimony states that since cell site 

information is much less precise than GPS information, the burden 

for law enforcement should be lower to obtain it. 

It seems to me that the appropriate burden on law enforcement 

depends heavily on the precision of the information. I was hoping 

you could clarify just how precise the cell site information is. I have 

had some experiences with this before when I was a prosecutor, 

and I know that it gives a location within a cell tower’s area and 

can often be as precise as giving location within a cell sector. But 

how precise is it in real-world terms? 

Mr. BAKER. So my understanding is that—again, we are talking 

about a cell site, so one tower, and then that is divided up into sectors. And so if the company has the information and it is available, 

it can identify it with respect to the particular sector. As I mentioned earlier, it depends upon whether you are in a rural area, a 

suburban area, or certain urban areas. And the ranges that I have 

seen have been from 5 miles, so it ‘‘pinpoints’’ you within 5 miles 

of where you are, to 1 to 2 miles as you get into a more heavily 

populated area, to up to 100 yards. So that is the lowest amount 

that I have seen, 100 yards. 

A key thing also that I would suggest the Committee should 

think about is not only the precision but also the issue with respect 

to the voluntariness of the sharing of that information. So generally speaking, it is information that when you move around or 

when you have a communication, when you move around through 

certain sectors and certain areas, or when you have a communication, when you initiate a communication, that is when this data is 

obtained. And so at least in our minds, it does bear similarities to 

the type of pen register information that you collect when you are 

at your home in your private residence and you decide to make a 

phone call and you reveal something about where you are at that 

date and time. 

Senator KLOBUCHAR. Okay. Thank you very much. 

Senator WHITEHOUSE. Before we conclude, I see Senator 

Blumenthal is still here. Would you like to do a second round? 

Senator BLUMENTHAL. I would, Mr. Chairman. I wonder if you 

would like—— 

Senator WHITEHOUSE. No, why don’t you proceed? I have to be 

here anyway, so I will wrap up. 

Senator BLUMENTHAL. Thank you, Mr. Chairman. And thank you 

again for your testimony. 

I would like to pursue some of the areas that we began discussing relating to the consent provisions and the need and advisability perhaps of restrictions. In your testimony, Mr. Baker, you 

say there are no explicit restrictions on a provider disclosing noncontent information. Are there any restrictions, in your view? 

Mr. BAKER. Well, one thing that comes to mind is the kinds of 

documents that we were talking about earlier, so you could have 

21 

a contractual limitation that the provider agrees to when you agree 

to engage in that service. So that is one off the top of my head. 

Senator BLUMENTHAL. I am sorry. When I asked the question, I 

should have said that your testimony says that ECPA contains no 

explicit restrictions, and I assume from your answer that that kind 

of contractual provision is not in ECPA. 

Mr. BAKER. That is correct. That is correct. As we discussed earlier, I think with Senator Franken, there are other parts of law 

that restrict other entities from disclosing certain types of data 

that is comparable at least, so there are other parts of law that affect that. But when we are talking about ECPA, there is no explicit 

limitation. 

Senator BLUMENTHAL. And in your view, are those protections 

sufficient right now? Or should we consider it as part of this process? I know that you have suggested it may be appropriate, but 

given the administration’s interest in privacy for consumers, would 

that be an appropriate area? 

Mr. BAKER. Let me just first correct what I said. When I say 

there is no limitations, that is on the non-content information, so 

just to be clear about that. 

The administration does not have a position yet on the exact answer to this question, but we can see that it is a legitimate question to ask. And so that is what we—you hear this all the time, 

but we are happy to work with you to try to figure out what the 

answer is here and whether additional protections are appropriate, 

required—again, with trying to get the balance right between all 

these different interests that we are trying to achieve—privacy, innovation, and security. 

Senator BLUMENTHAL. Well, I would welcome and I do welcome 

that willingness to work together. And I wonder whether there is 

a task force or a working group within the administration that is 

focusing on this issue, as often there is on matters of policy like 

this one. 

Mr. KERRY. Senator Blumenthal, in fact, there is. There is a Subcommittee of the National Science and Technology Council, which 

I co-chair with Assistant Attorney General Christopher Schroeder 

of the Office of Legal Policy, that is carrying forward the work to 

define what a privacy bill of rights should contain. We are actively 

at work on that, digesting the comments that we have received on 

the Commerce Department Green Paper and moving as quickly as 

we can to an administration white paper that would flesh out these 

questions and deal with a broad set of issues about commercial 

data privacy. 

Senator BLUMENTHAL. And I know that the President has talked 

about a privacy bill of rights, which can mean a lot of things to a 

lot of different people. But I would just suggest—and I would be 

eager to work with you—that it should encompass this area which 

is so vitally important to consumers and individuals who may have 

no idea that very private information has been shared or sold by 

entities with which they are doing business. 

Mr. KERRY. Thank you, Senator. We are hard at work, and I assure you that that is one of the topics we are working on. 

Senator BLUMENTHAL. Thank you. 

Thank you, Mr. Chairman. 

22 

Senator WHITEHOUSE. Thank you, Senator Blumenthal. 

Let me close first by thanking both of you for your service and 

for your work on this issue. I think the testimony today has made 

clear that there is a lot of work to be done, not only on our side 

but also on the administration’s side in arriving at positions, which 

I assume you consider to be an important part of the equation here. 

I do not know if it is your position that you are going to raise 

issues and we are going to resolve them all here without the administration ever taking a position or if this is an area in which 

you think the administration should take a position, but I am going 

to assume the latter and hope that to be true. 

With respect to the issue of cybersecurity, I am interested in any 

information that either of you might be able to provide about the 

timing of the conclusion of the interagency process, and the background to this question is that really I want to say over a year ago 

the Senate Commerce Committee completed its work, led by Chairman Rockefeller and Senator Snowe, who both also serve on the Intelligence Committee. Homeland Security I think also about a year 

ago completed its work. I believe it has been nearly a year since, 

with Senator Mikulski and Senator Snowe, I wrote the Intelligence 

Committee Cyber Security Task Force report. And in order to proceed to repairing the gaps in our National cyber security, we need 

to close on this issue. And it is very hard where there are discrepancies between where one Committee or another wants to go to resolve those discrepancies without a position being taken by the administration. And given the fact that the interagency process appears to have taken over a year at this point and that during that 

time the discussions back and forth between the executive and legislative branch have been reduced to, as best I can tell, zero but, 

in any event, very, very slender channels of communication, I think 

it is really important that we begin to open that up so that we can 

begin to legislate in this area and do so in a meaningful way. 

The folks who are attacking us are not waiting. I was visiting 

with a CEO of an American energy company that announced a new 

product on the media, and within the first 2 hours of that announcement, the CEO’s personal e-mail had been attacked 60,000 

times. And, clearly, there are forces outside this country who want 

nothing more than siphon up all of our intellectual property that 

they can so that they can compete with us using our own knowledge against us, without paying for it, without licensing agreements, without any of the sort of accoutrements of rule of law in 

this area. And I would not be surprised if the number in terms of 

the loss to the U.S. economy is in the trillions at this point. And 

it is constant. It is thousands of attacks a minute, not thousands 

of attacks a day. 

And so when that is the timeframe of the attack, to spend a year 

in an interagency process and shut down the engagement necessary between the executive and legislative branches for that period before we can go forward I think is a necessary process, but 

it is one that is not without peril, and it is one that is not without 

cost. 

So the sooner we can bring it to its conclusion, the better off we 

will be as a country, and the safer we will be. So I hope very much 

you can provide some insight into when you think we might begin 

23 

to re-engage on the cyber security bill, and even if the interagency 

process is not concluded to its last final comma and period, at least 

it will be sufficiently through its path that the administration feels 

that it can begin to re-engage with us. 

What can you tell me about that? 

Mr. KERRY. Well, Senator Whitehouse, thank you. It is an urgent 

process. I can tell you that that interagency process is winding up. 

Both Mr. Baker and I have participated in a number of deputies 

Committee meetings to resolve some of the top-line issues. The rest 

of more detailed proposals are now in the final processes of circulating interagency. So I do not want to put a date on it, particularly with the prospect of a Government shutdown looming. But, 

you know, I think we are very close, a matter of some weeks away 

from being able to share proposals with Congress. 

Senator WHITEHOUSE. I had not thought of it in the context of 

the Government shutdown, but I guess you are right. Pretty significant national security cost to precipitate with a Government shutdown. 

Mr. KERRY. I think so. 

Senator WHITEHOUSE. Mr. Baker, anything to add? 

Mr. BAKER. I am not sure exactly when the process will be finished. We have made substantial progress in the past period of 

time. As you know well, these are very difficult issues. They raise 

a lot of the same kinds of issues that we talked about today in 

terms of security in a different context, but security, privacy, innovation, all of these things are front and center in the cyber security 

debate. 

I agree with your assessment of the threat. It is very grave. We 

need to move forward as expeditiously as possible. These are difficult issues to work our way through, and so we are doing that. 

And I would say that we have made substantial progress in at least 

teeing up a lot of these issues for decisionmakers to make a call 

on. So I think there is a lot of work that has been done. 

You may not feel as though it is a communication. I can tell you 

that from our end it feels like you are shouting with a bullhorn. 

So we have heard you that you want us to come up with proposals 

quickly. I am referring to the whole Congress. We get that message 

loud and clear, and so we are doing our homework and doing what 

we need to do on our end so that we can have something that is 

an administration position to come back to you with. 

Senator WHITEHOUSE. For sure it will be this year, will it not? 

Mr. BAKER. I beg your pardon, Senator? 

Senator WHITEHOUSE. It will be for sure within this year, will it 

not? 

Mr. BAKER. I am not going to sit and swear to you in front of 

the United States Congress—— 

Senator WHITEHOUSE. You are not under oath. 

Mr. BAKER. Yes, Okay. 

[Laughter.] 

Senator WHITEHOUSE. I am asking for your assessment of—I 

mean, realistically. 

Mr. BAKER. Realistically, I think yes. Yes. 

Senator WHITEHOUSE. Okay, good. Because I think it is important that we take up a cyber security bill this year and begin to 

24 

move to repair some of the very wide open vulnerabilities that we 

have that are being exploited to vast effect by our economic rivals 

and our National security adversaries. 

Let me close—— 

Mr. KERRY. And I would second that view, Mr. Chairman, for 

what it is worth. 

Senator WHITEHOUSE. Yes, thank you. Let me close by saying 

that I really appreciate Chairman Leahy having called this hearing. Many years ago he was involved very deeply in the drafting 

of the original ECPA proposal. I think that the principles that he 

brought to that debate and the determination with which he sought 

through to a conclusion are lasting ones that should continue to inform what we do going forward and inspire us as we make these 

corrections. 

What has changed in the meantime has nothing to do with those 

principles or with his personal determination to achieve the right 

balance, but the landscape itself has changed as technology has 

changed. And surfaces that used to be in shadow are now in sunlight; surfaces that used to be in sunlight are now in shadow. We 

have to adapt to those changes, but I do believe that we can bring 

the same principles and the same desire for a sensible balance and 

the same determination that Chairman Leahy showed when he 

originally did it, and I think that will see us in good stead as we 

work through the updates that intervening events have precipitated. 

So I look forward to working with you on that. Thank you very 

much for your testimony here today and for your work going forward. We will keep the hearing open for an additional week in the 

event that anybody wishes to add anything to the record—we will 

keep the record of the hearing open for an additional week. We are 

not going to keep the hearing open for an additional week. 

The hearing is adjourned. Thank you. 

[Whereupon, at 11:29 a.m., the Committee was adjourned.] 

[Questions and answers and submission for the record follow.] 

25 


70856.001
26 


70856.002
27 


70856.003
28 


70856.004
29 


70856.005
30 


70856.006
31 


70856.007
32 


70856.008
33 


70856.009
34 


70856.010
35 


70856.011
36 


70856.012
37 


70856.013
38 


70856.014
39 


70856.015
40 


70856.016
41 


70856.017
42 


70856.018
43 


70856.019
44 


70856.020
45 


70856.021
46 


70856.022
47 


70856.023
48 


70856.024
49 


70856.025
50 


70856.026
51 


70856.027
52 


70856.028
53 


70856.029
54 


70856.030
55 


70856.031
56 


70856.032
57 


70856.033
58 


70856.034
59 


70856.035
60 


70856.036
61 


70856.037
62 


70856.038
63 


70856.039
64 


70856.040
65 


70856.041
66 


70856.042
67 

Æ 


70856.043