U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

56–271 PDF 2010

ELECTRONIC COMMUNICATIONS 

PRIVACY ACT REFORM 

HEARING 

BEFORE THE

SUBCOMMITTEE ON THE CONSTITUTION, 

CIVIL RIGHTS, AND CIVIL LIBERTIES 

OF THE

COMMITTEE ON THE JUDICIARY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED ELEVENTH CONGRESS 

SECOND SESSION 

MAY 5, 2010 

Serial No. 111–98 

Printed for the use of the Committee on the Judiciary 

( 

Available via the World Wide Web: http://judiciary.house.gov 

(II) 

COMMITTEE ON THE JUDICIARY 

JOHN CONYERS, JR., Michigan, Chairman 

HOWARD L. BERMAN, California 

RICK BOUCHER, Virginia 

JERROLD NADLER, New York 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

MELVIN L. WATT, North Carolina 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

MAXINE WATERS, California 

WILLIAM D. DELAHUNT, Massachusetts 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO PIERLUISI, Puerto Rico 

MIKE QUIGLEY, Illinois 

JUDY CHU, California 

TED DEUTCH, Florida 

LUIS V. GUTIERREZ, Illinois 

TAMMY BALDWIN, Wisconsin 

CHARLES A. GONZALEZ, Texas 

ANTHONY D. WEINER, New York 

ADAM B. SCHIFF, California 

LINDA T. SA ́ NCHEZ, California 

DANIEL MAFFEI, New York 

JARED POLIS, Colorado 

LAMAR SMITH, Texas 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

HOWARD COBLE, North Carolina 

ELTON GALLEGLY, California 

BOB GOODLATTE, Virginia 

DANIEL E. LUNGREN, California 

DARRELL E. ISSA, California 

J. RANDY FORBES, Virginia 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TOM ROONEY, Florida 

GREGG HARPER, Mississippi 

PERRY APELBAUM, Majority Staff Director and Chief Counsel 

SEAN MCLAUGHLIN, Minority Chief of Staff and General Counsel 

SUBCOMMITTEE ON THE CONSTITUTION, CIVIL RIGHTS, AND CIVIL LIBERTIES

JERROLD NADLER, New York, Chairman 

MELVIN L. WATT, North Carolina 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

WILLIAM D. DELAHUNT, Massachusetts 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

TAMMY BALDWIN, Wisconsin 

JOHN CONYERS, JR., Michigan 

STEVE COHEN, Tennessee 

SHEILA JACKSON LEE, Texas 

JUDY CHU, California 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

TOM ROONEY, Florida 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

DAVID LACHMANN, Chief of Staff 

PAUL B. TAYLOR, Minority Counsel 

(III) 

C O N T E N T S 

MAY 5, 2010 

Page 

OPENING STATEMENTS 

The Honorable Jerrold Nadler, a Representative in Congress from the State 

of New York, and Chairman, Subcommittee on the Constitution, Civil 

Rights, and Civil Liberties .................................................................................. 1 

The Honorable F. James Sensenbrenner, Jr., a Representative in Congress 

from the State of Wisconsin, and Ranking Member, Subcommittee on the 

Constitution, Civil Rights, and Civil Liberties .................................................. 2 

WITNESSES 

Mr. James X. Dempsey, Center for Democracy and Technology, Vice President 

for Public Policy 

Oral Testimony ..................................................................................................... 4 

Prepared Statement ............................................................................................. 7 

Mr. Albert Gidari, Perkins Coie LLP 

Oral Testimony ..................................................................................................... 21 

Prepared Statement ............................................................................................. 24 

Mr. Orin S. Kerr, Professor, The George Washington University Law School 

Oral Testimony ..................................................................................................... 34 

Prepared Statement ............................................................................................. 36 

Ms. Annmarie Levins, Associate General Counsel, Microsoft Corporation 

Oral Testimony ..................................................................................................... 43 

Prepared Statement ............................................................................................. 45 

APPENDIX 

Material Submitted for the Hearing Record .......................................................... 89 

(1) 

ELECTRONIC COMMUNICATIONS 

PRIVACY ACT REFORM 

WEDNESDAY, MAY 5, 2010 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON THE CONSTITUTION, CIVIL RIGHTS, AND CIVIL LIBERTIES, COMMITTEE ON THE JUDICIARY, Washington, DC. 

The Subcommittee met, pursuant to notice, at 2:53 p.m., in room 

2141, Rayburn House Office Building, the Honorable Jerrold Nadler (Chairman of the Subcommittee) presiding. 

Present: Representatives Nadler, Watt, Scott, Johnson, Cohen, 

Chu, and Sensenbrenner. 

Staff present: (Majority) David Lachman, Subcommittee Chief of 

Staff; Stephanie Pell, Counsel; (Minority) Caroline Lynch, Counsel; 

and Art Baker, Counsel. 

Mr. NADLER. This hearing of the Subcommittee on the Constitution, Civil Rights, and Civil Liberties will come to order. We apologize for coming to order late, but the votes on the floor necessitated 

that. We will begin by recognizing myself for a 5-minute opening 

statement. 

Today’s hearing is the beginning of a process through which the 

Subcommittee will revisit the statutory framework Congress established in the 1986 Electronic Communication Privacy Act, ECPA, 

in spite of the enormous technological advances which have taken 

place in electronic communications over the last 24 years. 

Because of the complexity of the subject, both legal and technological, this hearing will probably be the first of several we will 

hold as we consider what, if any, reforms should be made to the 

Act so that it might function more effectively in the future. 

ECPA was passed in 1986, well before we commonly used the 

Internet for e-mail, much less for cloud computing and remote storage, at a time when cell phones were rare, often the size of small 

kitchen appliances, and included no tracking technologies capable 

of mapping our every movement. Communications technology now 

evolves at an exponential pace. 

So in 1986 ECPA fixed the statutory standards law enforcement 

would have to meet to access private communications data in a 

technological environment as far removed from our own as that of 

1986 was from the day Alexander Graham Bell said, ‘‘Mr. Watson, 

come here. I need you.’’ in the first telephone call 110 years earlier. 

The lightning pace of innovation in communications technology 

brings with it enormous improvements in the quality of life for our 

2 

citizens that in many ways marked the age we live in as a new 

epoch, which might be called the Internet Age. But it must be said, 

particularly by the Committee on the Judiciary, that these events 

also provide criminals with new platforms for unlawful activity. 

Moreover, it must also be said here on the Subcommittee on the 

Constitution that these robust new communications technologies 

bring with them new opportunities for law enforcement agencies, 

charged to protect us from such criminals, to intervene in our private lives. Thus, we must consider whether ECPA still strikes the 

right balance between the interests and needs of law enforcement 

and privacy interests of the American people. 

This is only the beginning of a dialogue that must go on to include the input of, among others, law enforcement at the Federal, 

state and local level, private industry stakeholders across the complex network of networks that is modern communications, and academic experts on technology, privacy and Fourth Amendment 

issues. 

But today all of the Members of the Subcommittee can begin this 

inquiry through a dialogue that raises these issues with this distinguished panel of witnesses. Today we can begin the work of making 

ECPA work for our time and for all concerned. This is an enormous 

responsibility, and this Subcommittee needs everyone’s help to get 

it right. As such, all of us sit on this panel at least in part as students today. 

I thank you in advance for what you will teach us. 

As for myself, some of the questions I propose to the class are 

how have changes in the Internet made it difficult for private industry to determine its obligations under Title II of ECPA, the 

Stored Communications Act? How do current advances in location 

technology test traditional standards of the ECPA of 1986? 

More generally, in what ways have these and other technologies 

potentially subverted one of the original and central goals of ECPA, 

which was to preserve ‘‘a fair balance between the privacy expectations of citizens and the legitimate needs of law enforcement?’’ If 

we are out of balance, what concepts should guide reform? I know 

my distinguished colleagues will have other questions. 

Finally, I would like to observe that we are aware that privacy 

advocates and members of industry have worked together in an impressive common effort to derive and propose some common principles that should guide our inquiry on ECPA reform. I look forward to hearing them articulated by our witnesses here in person. 

It is my hope that we on this Subcommittee can emulate your 

example and come together in a bipartisan spirit as we forge ECPA 

reform legislation that will put needed reforms in place, hopefully 

this year. I welcome our witnesses, and I look forward to your testimony. 

With that, I yield back. And I will now recognize for an opening 

statement the distinguished Ranking Member of the Subcommittee. 

Mr. SENSENBRENNER. Thank you very much, Mr. Chairman. 

The purpose of today’s hearing is to examine the need to update 

the Electronic Communications Privacy Act of 1986. Today’s hearing is a result of calls by a coalition called the Digital Due Process 

to examine how far apart technology and the law may have become 

3 

and to see if reforms are necessary to keep the law current with 

constantly evolving technology. 

The genesis of ECPA in 1986 was a needed response to the emergence and rapid development of wireless communications services 

and electronic communications of the digital era. At that time email, cordless phones and pagers were by today’s standards in their 

infancy, and as these devices have become smaller, cheaper and 

more sophisticated, we have embraced them more and more in our 

everyday lives. 

The evolution of the digital age has given us devices and capabilities that have created conveniences for society and efficiencies 

for commerce. But they have also created conveniences and efficiency for criminals, as well as innovative new ways to commit 

crimes. Fortunately, new ways to detect and investigate crimes and 

criminals have also evolved. 

At the intersection of all these developments and capabilities are 

the privacy rights of the public, the economic interest in expanding 

commerce, the public policy of encouraging development of even 

better technologies, and the legitimate investigative needs of law 

enforcement professionals. 

While some of the issues we will hear about today have been 

heard before, this new initiative by the Digital Due Process coalition was officially launched on March 30th this year. There has 

been neither sufficient time to examine the concepts that are being 

advanced in any meaningful way, nor has there been time to hear 

from other stakeholders, including relevant members of the law enforcement community. 

While the Digital Due Process coalition makes note that some of 

the principles have been previously embraced by the House Judiciary Committee in 2000, it should be noted that just last year the 

full Committee voted down advancing the requirements for obtaining authority to utilize the pen register and for obtaining authority 

to utilize the trap and trace device. 

In fact, enhancing the standard for a pen register and trap and 

trace device drew strong opposition from the National District Attorneys Association, the National Sheriffs Association, the Fraternal Order of Police, and the International Association of Chiefs 

of Police, all of whom agree that the proposed changes to criminal 

pen register and trap and trace devices would unduly burden state 

and local law enforcement agencies, who regularly use these tools 

in state criminal investigations. 

There will no doubt be considerable debate on what may or may 

not need to be changed, but there will also be debate on how any 

needed change should be effected. I look forward to the witnesses 

today, and I look forward to having you start the debate. Let me 

say it won’t be the end of the debate. 

Mr. NADLER. In the interests of getting to our witnesses and 

mindful of our busy schedules, I ask that other Members submit 

their statements for the record. Without objection, all Members will 

have 5 legislative days to submit opening statements for inclusion 

in the record. Without objection, the Chair will be authorized to declare a recess of the hearing. 

We will now turn to our first panel of witnesses—in fact, our 

only panel of witnesses. 

4 

Jim Dempsey is vice president for public policy at the Center for 

Democracy and Technology, where he concentrates on privacy and 

government surveillance issues. Mr. Dempsey coordinates the Digital Privacy and Security Working Group, a forum for companies, 

trade associations, think tanks and public interest advocates interested in cyber security, government surveillance and related issues. 

He received his J.D. from Harvard Law School. Additionally, Mr. 

Dempsey was counsel to this Subcommittee under Chairman Don 

Edwards. He continues to carry on that work at CDT, and I am 

pleased to welcome him back. 

Albert Gidari is a partner at Perkins Coie—or Perkins Coie, I 

think, LLP, where he represents a broad range of companies on 

privacy, security, Internet, electronic surveillance and communications law. His practice also includes both civil and criminal litigation, investigations and regulatory compliance counseling. He is a 

graduate of the George Mason University School of Law. 

Orin Kerr is a law professor at George Washington University, 

who has written extensively on the Electronic Communications Privacy Act. From 1998 to 2001, Mr. Kerr was a trial attorney at the 

computer crime and intellectual property section of the U.S. Department of Justice. He earned his JD magna cum laude from Harvard Law School. 

Annmarie Levins is an associate general counsel at Microsoft 

Corporation. She manages the legal support for Microsoft’s U.S. 

and Canadian subsidiaries, directing the legal teams responsible 

for licensing and service transactions, anti-piracy investigations 

and enforcement, Internet safety work and other areas. Ms. Levins 

formerly served in the U.S. Attorney’s Office in Seattle and in the 

Southern District of New York. She graduated summa cum laude 

from the University of Maine School of Law. 

I am pleased to welcome all of you. Your written statements in 

their entirety will be made part of the record. I would ask each of 

you to summarize your testimony in 5 minutes or less. There is a 

light in front of you. When it turns yellow, that means you have 

a minute left. And I would advise you that the Chair is somewhat 

lax in—or latitude in that area maybe in interpreting the time 

limit. 

Before we begin, it is customary for the Committee to swear in 

its witnesses. 

Let the record reflect that the witnesses answered in the affirmative. 

You may be seated. 

And we will first—I now recognize Mr. Dempsey for 5 minutes. 

TESTIMONY OF JAMES X. DEMPSEY, CENTER FOR DEMOCRACY AND TECHNOLOGY, VICE PRESIDENT FOR PUBLIC 

POLICY 

Mr. DEMPSEY. Chairman Nadler, Members of the Subcommittee, 

good afternoon. Thank you for holding this hearing. 

In setting rules for electronic surveillance, the courts and Congress have long sought to balance three critical interests—the individual’s right to privacy, the government’s need to obtain evidence 

to prevent and investigate crimes and respond to emergencies, and 

the corporate interest in clear rules that provide confidence to conVerDate Aug 31 2005 12:02 Jul 29, 2010 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6601 H:\WORK\CONST\050510\56271.000 HJUD1 PsN: 56271
5 

sumers and that afford the companies the certainty they need to 

invest in the development of innovative new services. 

Today it is clear that the balance among those three interests 

has been lost. Powerful new technologies create and store more and 

more information about our daily lives. The protections provided by 

judicial precedent and statute have failed to keep pace. 

The major Federal statute setting standards for governmental access to communications, the Electronic Communications Privacy 

Act, or ECPA, was written in 1986, light years ago in Internet 

time. Among other key points, private information directly analogous to a telephone call or letter now falls outside of the traditional 

warrant standard when stored online. As a result, a major section 

of ECPA is probably unconstitutional in many applications. 

Every witness at this table today agrees that ECPA is outdated 

and needs to be reformed to provide strong privacy protections 

while also preserving the tools that law enforcement agencies need 

to act quickly to investigate crimes and respond to emergencies. 

For the past several years the Center for Democracy and Technology, my organization, has been chairing a dialogue among leading Internet companies, communications companies, privacy advocates, law professors and attorneys in private practice to discuss 

how ECPA was working and how it needed to be updated. We had 

as part of our group several former prosecutors and several alumni 

of the Computer Crime and Intellectual Property Section of the Department of Justice. 

In our discussions we were acutely aware of the needs of law enforcement. We started with a list of over a dozen issues. Some of 

the privacy advocates and scholars wanted to go farther in 

strengthening the rules, but the former prosecutors emphasized the 

importance of preserving a sliding scale of authorities. We met 

monthly and then even weekly. 

Ultimately, we reached consensus on four principles—consistent 

application of the warrant standard to private communications and 

documents, consistent application of the warrant standard for location tracking of cell phones and other mobile devices, true judicial 

review of pen registers and trap and trace devices—and we can go 

into more detail about what pen register/trap and trace devices are 

and how they work—and no blanket use of subpoenas. 

Now, in some ways—many ways, actually—these proposals are 

modest. The proposals would preserve all current exceptions, including the emergency exception that permits disclosure of e-mail 

and other content without a warrant, even without a subpoena, in 

times of emergency. We do not propose any changes to FISA or to 

the national security letter provision in ECPA. 

Our proposals on e-mail and stored documents focus solely on 

compelled production from a service provider providing service to 

third parties. We do not propose any change to the rules governing 

how you get information directly from the subject of an investigation. A company could not hide behind ECPA if the government is 

investigating that company. The rules permitting subpoenas served 

directly on targets of an investigation will remain unchanged. 

As Chairman Nadler indicated, the companies and organizations 

endorsing this principle call themselves the Digital Due Process coalition. The coalition now includes major Internet and communicaVerDate Aug 31 2005 12:02 Jul 29, 2010 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6601 H:\WORK\CONST\050510\56271.000 HJUD1 PsN: 56271
6 

tions companies, major think tanks, and advocacy organizations 

ranging from the ACLU to Americans for Tax Reform and 

FreedomWorks. We are continuing to add new members each week. 

We see our principles as the first step—and I emphasize this— 

just an opening framework in a process that will require public discussion, the engagement of other stakeholders, and most importantly, dialogue with law enforcement agencies. We have already 

begun the process of discussing these principles with the Department of Justice, the FBI, and the National Association of Attorneys 

General. 

We intend to get very specific in follow-up discussions, addressing concrete hypotheticals about how updates to the law would affect ongoing practices. 

Mr. Chairman, the coalition is not urging the introduction of legislation. Many details remain to be discussed before we get to the 

legislative phase. Other issues might be brought forward in addition to the four that we have put on the table. We urge this Committee and we are urging the Senate Judiciary Committee to move 

cautiously, to hold further hearings, as you already indicated you 

would, to listen to the views of law enforcement, of the telephone 

companies and other carriers. 

Professor Kerr in his testimony has proposed some excellent 

questions that need to be and can be addressed and resolved. Some 

of them, speaking for CDT, I have answers to. Others of them I 

don’t have answers to yet. But we agree they need to be addressed. 

Our coalition foresees a long-term process of hearings, dialogue and 

consensus building. Together, though, we can re-establish the balance among those interests that were critical in 1986—law enforcement, privacy and business. 

I look forward to your questions, Mr. Chairman and Members of 

the Subcommittee. Thank you. 

[The prepared statement of Mr. Dempsey follows:] 

7 

PREPARED STATEMENT OF JAMES X. DEMPSEY


JXD-1.eps
8 


JXD-2.eps
9 


JXD-3.eps
10 


JXD-4.eps
11 


JXD-5.eps
12 


JXD-6.eps
13 


JXD-7.eps
14 


JXD-8.eps
15 


JXD-9.eps
16 


JXD-10.eps
17 


JXD-11.eps
18 


JXD-12.eps
19 


JXD-13.eps
20 


JXD-14.eps
21 

Mr. NADLER. Thank you. 

Mr. Gidari is recognized for 5 minutes. 

TESTIMONY OF ALBERT GIDARI, PERKINS COIE LLP 

Mr. GIDARI. Thank you, Mr. Chairman, Committee Members. It 

is a pleasure to be here. 

Today I appear as an individual not representing any particular 

service providers or clients, but over 15 years I have had the pleasure of working with many in industry in their implementation and 


JXD-15.eps
22 

compliance with ECPA and with the Communications Assistance 

for Law Enforcement Act. 

These service providers are caught in the middle every day. The 

best way to determine whether ECPA is out of balance is to take 

a look at what service providers do every day, and that is essentially guess. 

They try to understand what the law requires and implement it 

on a daily basis, but because the law relies so much on definitions, 

like an electronic communication service provider to the public or 

a remote computing service provider to the public, service providers 

have to understand how the law applies to them and the legal process they need to disclose user communications and information. If 

they don’t understand the bright line rule, then mistakes can be 

made, and those mistakes carry real consequences. 

We have cases, one heard just recently in the U.S. Supreme 

Court, where the service provider guessed wrong, thinking it was 

one thing when it was another, in disclosing communications on a 

lower standard than it should have and therefore being liable for 

that privacy breach. 

That is an untenable position for the men and women of service 

provider security offices, who every day deal with these requests 

from law enforcement and understand that those requests are 

valid, important, and sometimes life-threatening, but yet they also 

have user privacy concerns, and they must meet that imperative to 

protect user information. 

So it is an untenable position for them. They have a real identity 

crisis about what they are today when in a social networking environment, you could be just as easy an electric communications 

service provider as a remote computing service provider, and who 

knows under the definition what you are? It is a very difficult position. 

So we know it is out of balance, and we know clarity is important. As much as the academic debate about what the right standard is interesting, it isn’t as interesting to service providers as having a clear rule. So if there is anything that can come out of this 

hearing and future hearings, clarity first and foremost. 

I would like to observe also with location-based services, for 15 

years I have worked with wireless carriers and their response to 

law enforcement requests to use what is a remarkably robust and 

important tool for law enforcement, tracking capabilities, the ability to find a bad person or a kidnap victim in real time as quickly 

and as efficiently as possible. It is a great, great capability, but 

right now it is a muddle. 

Service providers haven’t got a clue what the right legal standard 

is, and within the same judicial district, you might have two magistrates who disagree and issue contrary orders for the standard 

upon which to disclose that information. And what information 

should be disclosed? How often? How frequently? It is not uncommon for law enforcement to ask for a phone to be pinged every 15 

minutes. 

In a lot of ways service providers’ security offices and their personnel feel like they are the customer service of some computer organization, having to respond to incessant and continuous requests. 

Now, they are important requests, but the fact is the law does not 

23 

state how often, how frequently, how rich, how detailed and to 

whom that information should be provided. The service providers 

simply need the clarity to understand what to do. 

Lastly, I would like to just observe that in ECPA there are some 

areas for improvement on transparency. It is difficult to make policy if one doesn’t know how much information is collected. And 

from a personal perspective dealing with the volume of requests 

every day, this Committee and the public would do well to have 

clear numbers before them. 

The number of user records requested on a daily basis is astronomical. We can commend Google, who recently published through 

their transparency project, a list of statistics that show the number 

of requests that they receive on a regular basis. Those numbers are 

dwarfed by the number of requests that service providers like wireless carriers receive every day. 

Just yesterday the administrator of the courts received the wiretap report, and that annual report tells you the number of wiretaps 

conducted each year. For the past year, 2009, the numbers went up 

26 percent. There is some good in those numbers. The U.S. stacks 

up pretty well compared to the rest of the world. If all we had was 

2,600 total Federal and state wiretaps last year, somebody is doing 

something right and reviewing them carefully and not over using 

them. 

Unfortunately, we don’t know how many pen registers have been 

implemented. We don’t know how many location orders are implemented. And we certainly don’t know how many user records have 

been asked for, used, and how long those are retained. If we could 

do anything to improve ECPA and its transparency, the collection 

and publication of that data would go a long way to helping the 

Committee make decisions on good, solid policy. 

Thank you, and I hope to answer any questions you have. 

[The prepared statement of Mr. Gidari follows:] 

24 

PREPARED STATEMENT OF ALBERT GIDARI


AG-1.eps
25 


AG-2.eps
26 


AG-3.eps
27 


AG-4.eps
28 


AG-5.eps
29 


AG-6.eps
30 


AG-7.eps
31 


AG-8.eps
32 


AG-9.eps
33 

Mr. NADLER. Thank you. 

And I now recognize Mr. Kerr for 5 minutes. 


AG-10.eps
34 

TESTIMONY OF ORIN S. KERR, PROFESSOR, THE GEORGE 

WASHINGTON UNIVERSITY LAW SCHOOL 

Mr. KERR. Chairman Nadler and Members of the Subcommittee, 

thank you very much for the invitation to be here today. 

I think it might help to start with understanding why we are 

here. In traditional criminal investigations, the police do the work 

on their own. They walk the beat. They conduct their own searches. 

If they see evidence of a crime that they think they need, they take 

it. They don’t work with providers. They don’t work with anybody 

else. They make all the decisions on their own, sometimes pursuant 

to judicial review by a judge, but not with the work of any private 

party. 

The opposite is true with new online crimes, crimes committed 

using networks, whether it is the Internet, crimes committed using 

telephones, or simply a case where there happens to be evidence 

that is stored or available over some sort of a network, whether the 

Internet or the cell network. 

In all those cases, the government is working through the intermediary of the provider. There is a company, a company that runs 

a network that has data, and the real question, and the question 

that the Electronic Communications Privacy Act is designed to address, is what should the rules be when the government wants 

data that the network has, or when the network company, the 

third-party provider, wants to disclose information to the government? 

Now, that means that in order to understand the issues raised 

by ECPA, we need to think about what the data is and when does 

the government obtain it. So it may be helpful to think about two 

different kinds of data that the communications providers may 

have. 

One category is content of communication. That is the actual 

message that somebody may be sending or receiving over the network. It might be an e-mail. It might be a text message. In the case 

of a phone call, it would be the actual conversation that two people 

are having. 

And then there is lots of non-content information. The non-content information is information that the network is generating and 

using in order to deliver the communication. Now, we can understand what kind of content the network might have, because we as 

users of the network are aware of that. If somebody sends you an 

e-mail, for example, you know that the e-mail is there. 

Non-content information is quite different. The amount of information that may exist depends on the technology, depends on the 

network. It may depend on the company, depends on business decisions that each company is making as to whether to keep records, 

whether to generate certain records. And that means there are lots 

of records available, and those records may vary dramatically, 

based on the company and based on the technology. So that is the 

issue of what the records are that are out there. 

The next thing you need to think about is when is the government collecting the information. So again, we can think of two 

basic categories. The one category would be when the government 

comes to the provider and says, ‘‘We are going to compel you to disVerDate Aug 31 2005 12:02 Jul 29, 2010 Jkt 000000 PO 00000 Frm 00038 Fmt 6633 Sfmt 6601 H:\WORK\CONST\050510\56271.000 HJUD1 PsN: 56271
35 

close certain information. We want you to act on our behalf as our 

agent, essentially, and provide certain information.’’ 

Maybe it will be stored content that the government wants. 

Maybe it will be stored non-content information that the government wants, these records. And other times the government will 

want a real-time surveillance to occur, sometimes of content in the 

case of wiretapping, sometimes in the case of non-content information, for example, where somebody’s cell phone is located or who 

somebody is e-mailing. So that is the case when the government is 

compelling information. 

And then the flipside of that is what if the provider comes across 

evidence and wants to disclose it to the government? Maybe the 

provider has uncovered child pornography. Maybe the provider has 

discovered some evidence of some other crime and wants to provide 

that information either to the government or even to a non-government group. What should those rules be? That is the question that 

the Electronic Communications Privacy Act was designed to address in 1986. 

Now, of course, in 2010, technology has changed dramatically. 

And I am very glad to hear that the Committee has planned more 

hearings, because I think what really we need to hear from is we 

need to hear from these providers. We need to find out what information do they have. 

What are their practices? What is the technology? How does it 

work? What kind of cell phone location information do different 

providers have? How close can they get to finding out the location 

of the user of the phone? How long do they keep their records? 

So we need to find out from the providers what are their practices. And then we also need to find out from the government how 

do their investigations work? Those of us that watch a lot of television know we have seen a lot of Law and Order, and we know 

how those investigations work, or at least how they work on TV. 

But mostly we don’t know how these new online investigations 

work. We haven’t seen those investigations. Very few people have. 

So we need hearings to talk about not only the technology, but 

what are the kinds of cases that the government is working? How 

do these cases actually unfold? 

And I think it is only after getting that informed sense of what 

the technology is and how the investigations actually work that the 

Committee can think about what do these rules need to be like. 

How do these rules need to change? It has been a quarter century 

since ECPA was passed, and it is time to think about how the technology has changed and how to balance the security interests and 

privacy interests, given the technology of today, not the technology 

of 1986. 

So I am very glad that the Committee is interested in these 

issues. Obviously, today’s hearing is just the tip of the iceberg. 

There is a lot that we can talk about. But I think starting off by 

recognizing that this problem exists, both in terms of the new technologies and these new types of investigations, is a very important 

first start, and I am happy to be here. Thank you. 

[The prepared statement of Mr. Kerr follows:] 

36 

PREPARED STATEMENT OF ORIN S. KERR


Kerr-1.eps
37 


Kerr-2.eps
38 


Kerr-3.eps
39 


Kerr-4.eps
40 


Kerr-5.eps
41 


Kerr-6.eps
42 


Kerr-7.eps
43 

Mr. NADLER. Well, thank you. 

And we will now recognize Ms. Levins for an opening statement. 

TESTIMONY OF ANNMARIE LEVINS, ASSOCIATE GENERAL 

COUNSEL, MICROSOFT CORPORATION 

Ms. LEVINS. Thank you, Mr. Chairman. 

Mr. Chairman, Members of the Subcommittee, my name is 

Annmarie Levins. I am an associate general counsel at Microsoft. 

I manage the legal support for Microsoft U.S. and Canadian subsidiaries. My team is responsible for contracts with our customers 

and partners for anti-piracy and digital crimes investigations, for 

Internet safety work and other areas. 

Before joining Microsoft in 1998, I had the privilege of serving 

as an Assistant United States Attorney in Seattle for 3 years and 

before that in the Southern District of New York for seven. During 

my 10 years as an A-USA, I worked with many smart, dedicated 

law enforcement officers investigating organized crime, racketeering, narcotics and financial fraud cases. 

Thank you for this opportunity to share Microsoft’s views on the 

reform of ECPA. Microsoft is in a unique position to comment on 

the need for ECPA reform. We have offered Internet-based services 

for almost 15 years, dating back to MSN dial-up Internet service. 

We have offered Hotmail, our free Web-based mail service, since 

1997. 

Today we offer a full array of cloud computing services, including 

our hosted suite of Enterprise class e-mail, relationship management and collaboration tools, and our cloud-based storage and computing resources called Microsoft Azure. Our customers range from 

individuals to small and medium-sized businesses to some of the 

largest multi-national corporations in the world. 

From our vantage point, we have seen how the technologies governed by ECPA have evolved over the years since its enactment 

and the tremendous potential these technologies represent for all 

of our customers. Today users can store documents, data and communications to central locations and access them anywhere in the 

world on a wide variety of devices, including laptops, phones and 

other forms of personal devices. 

Increasingly, Web-based accounts are used interchangeably with 

local storage devices. As these Internet-based resources become 

part of our everyday computing experiences, users may not even realize that the legal protection afforded their data and documents 

are not necessarily the same when they use third-party storage and 

processing capabilities in place of their own computers or networks. 

While there has been a fundamental shift in the amount of sensitive information that we now trust to third parties, the law has 

not shifted in parallel to preserve reasonable privacy interests. 

Quite simply, the basic technological assumptions upon which 

ECPA was based are outdated. The nature of the protection afforded to stored electronic communications has not kept pace with 

the many innovations in online computing over the last 24 years. 

For example, ECPA extends greater privacy protections to e-mail 

storage for less than 180 days than e-mail stored for more than 180 

days. This distinction might have made sense in 1986 when e-mail 

services did not automatically retain messages for long periods of 

44 

time, but the distinctions no longer bear any relationship to reality. 

Hosted e-mail and other online services regularly store e-mails and 

other content for years, and users today reasonably expect these 

communications to remain just as private on day 181 as they were 

on day 179. 

Microsoft believes that now is the time to address these issues. 

We are on the verge of a transformative age in Internet cloudbased computing. Cloud computing services can increase efficiencies for business and government, lower IT costs, create energy 

savings, and spur innovative job-creating enterprises. They will enable small and medium-size businesses, individual entrepreneurs 

and other innovators to tap into computing resources that previously had only been available to the largest companies, and at a 

fraction of the cost. 

These capabilities can drive innovation, make America’s businesses more competitive, and ultimately contribute to economic 

growth. But unless we are able to preserve and protect users’ privacy interests to meet their reasonable expectations, adoption of 

cloud computing services may be limited, and the full potential of 

cloud computing may not be realized. 

Indeed, in a recent poll conducted for Microsoft, more than 90 

percent of the general population and senior business leaders said 

they were concerned about security and privacy when they contemplated storing their own data in the cloud. This is among the 

reasons why Microsoft joined the Digital Due Process coalition in 

the launch of a new initiative to update ECPA. 

We understand the importance of supporting lawful investigations and spend significant resources every year to help make the 

online environment safer for all users. The Microsoft Digital 

Crimes Unit that I oversee was created specifically to assist law 

enforcement in pursuing digital crimes and to provide training to 

prosecutors and investigators around the world. 

In conclusion, Microsoft believes that the decisions about the 

right balance between users’ reasonable expectations of privacy and 

law enforcement’s legitimate interests should be made by Congress, 

with input from all key stakeholders, rather than as a result of unanticipated shifts in technology. 

We view the Digital Due Process coalition proposal as a good 

starting point for Congress’ inquiry. Ultimately, smart, targeted reforms of ECPA are essential to restore proper balance between privacy and law enforcement in the digital age and will help cloud 

computing fully deliver on its promise. 

Thank you for the opportunity to testify today. On behalf of 

Microsoft, we appreciate this Committee’s leadership in addressing 

these important issues, and we look forward to working with you. 

[The prepared statement of Ms. Levins follows:] 

45 

PREPARED STATEMENT OF ANNMARIE LEVINS


AL-1.eps
46 


AL-2.eps
47 


AL-3.eps
48 


AL-4.eps
49 


AL-5.eps
50 


AL-6.eps
51 


AL-7.eps
52 


AL-8.eps
53 


AL-9.eps
54 

Mr. NADLER. Thank you. 

The witnesses having completed their initial statements, we will 

turn to questions. And I will begin by recognizing myself for 5 minutes. 


AL-10.eps
55 

Mr. Dempsey, are any of the Digital Due Process principles intended to change a service provider’s ability to share information 

with law enforcement in an emergency? 

Mr. DEMPSEY. Absolutely not. We make it clear that there are 

emergency exceptions in the law right now, which permit disclosure 

of information without a warrant, without a subpoena, in emergency circumstances, and we would leave those untouched. 

Mr. NADLER. Thank you. 

Ms. Levins, you indicated in your testimony that ECPA relies on 

outdated notions of how individuals and businesses interact with 

information technology. I assume among other things you are talking about—well, we know you are talking about cloud computing, 

because you mentioned it specifically. 

Can you tell us more about cloud computing and why this technology is ‘‘transformative?’’ And what benefits does it offer to society? And how do we support such technological progress as we attempt to balance the interests of privacy and law enforcement? All 

in about 5 minutes. 

Ms. LEVINS. Thank you, Mr. Chairman. I would be happy to address that. 

Cloud computing is important, because it opens the door for everyone to use the most powerful computer capabilities there are. It 

used to be that you couldn’t afford to buy that kind of computing 

capability and storage unless you were a big company, but now you 

can use your desktop, your laptop, and use storage facilities that 

are maintained by a third party to do that kind of computing and 

storage that was previously unavailable on your home network. 

Mr. NADLER. Storage or storage and computing capacity? 

Ms. LEVINS. Both. 

Mr. NADLER. Both. 

Ms. LEVINS. Both. 

So that is the first part. I mean, and I think that that opens 

doors to all kinds of businesses to expand the way they do business 

in ways that weren’t even thinkable when ECPA was passed in 

1986. 

Mr. NADLER. And what do you think the implications for the development of cloud computing are if government access to e-mail 

content stored in the cloud continues to be subject to a legal standard different from that applied to other forms of data storage? 

Ms. LEVINS. And I think that is a critical question, because what 

we found and what our poll showed is that people are very concerned that by putting data in the cloud, are they going to have 

the same level of privacy and security that they would have if they 

maintained it within their own four walls of their company or 

home. I think that they will be reluctant to move to the cloud and 

take advantage of this opportunity, if they aren’t assured of what 

the standard of that privacy is and it doesn’t meet their reasonable 

expectations. 

Mr. NADLER. So we have to make sure that there is a standard 

of privacy equal to what they would be on your own personal hard 

drive, or just a certainty of letting people know at some other level? 

Ms. LEVINS. Well, certainty is important, but I think in fact if 

you are talking about content, people expect that what they would 

have on their hard drive, in their personal hard drive, should be 

56 

protected in the same way. Put the other way, the information in 

the cloud should be protected in the same way that their—— 

Mr. NADLER. And to the same legal standard. 

Ms. LEVINS [continuing]. Hard drive would. And that is particularly true, I think, of corporations, I would guess. 

Mr. NADLER. Now, but the importance of maintaining privacy in 

the cloud is what you just said, but we have to maintain security 

in the cloud, too. How do you balance them? 

Ms. LEVINS. Well, I don’t think they are inconsistent. And Microsoft, for example, has taken lots of steps to make sure that we have 

the best security that we can, and we are constantly working toward meeting the highest standards that are recognized in the industry. 

We think one of the most important things that could happen in 

this area is to have greater transparency about the security practices that companies offering cloud services are adopting and using. 

So it goes hand-in-hand with privacy. Users want to know that 

their information is safe, and they want to know that it is being 

secured and their privacy is being secured. 

Mr. NADLER. Thank you. 

Professor Gidari—Mr. Gidari—you indicated in your testimony 

with respect to location-based information that there has been a 

magistrate’s revolt for several years. Can you describe what you 

mean by this phrase and in what ways, if any, it has been fomented by the government’s interpretation of ECPA? 

Mr. GIDARI. Yes, Mr. Chairman. 

Over the last 3 or 4 years, a number of magistrates have objected 

to automatically approving, as part of pen register orders, requests 

to disclose the location of a cell phone in real time prospectively on 

an ongoing basis. They objected to using the pen register standard 

alone or in combination with what is known as a specific and 

articulable facts order, or as the government calls it, a hybrid 

order, to authorize that disclosure. 

Other magistrates disagree and believe that the standard is acceptable. But about three to one ratio, these magistrates have believed that a probable cause standard is necessary to track and follow an individual. 

And that mini revolt, if you will, has resulted in very inconsistent standards within judicial districts, as a magistrate sitting 

next to another magistrate could completely disagree, and have disagreed, issuing orders that have different standards. So one person 

might be tracked according to one standard, another one to a higher standard. And then within the states themselves, the ECPA, of 

course, that is the floor. 

Mr. NADLER. But you would get that in any event. Even if we 

wrote a standard in law, a more specific standard, you would get 

judges disagreeing with that, and until it went up to the circuit or 

Supreme Court, you would have judges sitting next to each other 

issuing different decisions, no? 

Mr. GIDARI. You certainly would, from a service providers’ perspective. Which rule applies? Which order should pertain? What responsibilities do they have to their users to object to that order? 

The rules for location information today just simply don’t state 

under—— 

57 

Mr. NADLER. They should state it more specifically. 

Mr. GIDARI. Absolutely. 

Mr. NADLER. Mr. Dempsey, you look like you wanted to comment 

on that. 

Mr. DEMPSEY. I am just saying that right now you sort of have 

an open field, a green field—sort of no guidance at all. 

Mr. NADLER. So we need statutory guidance. 

Mr. DEMPSEY. The statute would—we would try to make it as 

specific as possible and precise as possible, but at least it would 

provide some context within which the courts would operate. 

Mr. NADLER. Okay. Thank you. 

My final question is to Professor Kerr. In some of your recent 

scholarship in applying the Fourth Amendment to the Internet, you 

talk about replacing the inside-outside distinction common to 

Fourth Amendment jurisprudence with the content-noncontent distinction. 

Can you tell us what this means and how you believe it extends 

consistent application of the Fourth Amendment principle to cyberspace? And is the analogy perfect, or does it give rise to any notable exceptions we should be aware of? 

Mr. KERR. The basic idea here is when courts are considering 

how to apply the Fourth Amendment, which was created for a 

physical space, to a network environment, they should think about 

how to create a set of rules that tries to replicate how the Fourth 

Amendment applies in the physical world to this network space. 

And the basic idea is that the contents of some of these communications, these actual messages, are the online equivalent of stuff 

that would happen inside and would be protected by the Fourth 

Amendment in the physical world. 

On the other hand, the non-content information that a network 

creates is essentially the online equivalent to transactional information that would have occurred outside in the physical world. 

Now, if you follow that idea, the basic idea is that networks are 

doing for us what we used to do in the physical world. Basically, 

the network is coming to us instead of us having to go out into the 

world. And the idea is it creates a rough parallel between how the 

Fourth Amendment should apply in the physical world and how 

the Fourth Amendment should apply in the Internet. 

Now, of course, it is just a Law Review article. We don’t know 

whether courts are ever going to follow this. And in fact, there is 

a Supreme Court case right now, Quon versus City of Ontario, in 

which the Supreme Court is trying to figure out for the first time 

how does the Fourth Amendment apply to text messages. I went 

to the oral argument, and the justices were as puzzled about this 

question as anyone could be. 

So we are just trying to figure out these issues, and the idea that 

content-noncontent distinction is just an initial first start to try to 

figure out how the Fourth Amendment should apply, and by analogy, how the statute could be drafted to recognize the stronger protection for content and for noncontent. 

Mr. NADLER. Thank you very much. 

My time has expired. I will now recognize the distinguished gentleman from North Carolina. 

Mr. WATT. Thank you, Mr. Chairman. 

58 

I think I will acknowledge at the outset how ill prepared technologically I feel to engage in this discussion, and ill prepared, yes. 

I feel like a Neanderthal in this area. So let me—I want to ask a 

couple of questions that—and then I just want somebody to give me 

some examples of the kinds of things that are going out there that 

we should be worried about, given the failure to update the statute. 

But let me talk about process first. 

Mr. Dempsey, you talked in your testimony about a long period 

of dialogue and consensus building being needed. 

Mr. Gidari, you seemed to suggest, although not explicitly, that 

clarity was more important than substance of where you get to, so 

I am trying to figure out how long we should be working on this 

before we get to some kind of legislative solution. Is clarity of a 

rule more important than getting the rule right, the new standard 

right? 

What kind of time are you talking about for dialogue and consensus building, Mr. Dempsey, and does that fit with your urgency 

for clarity, even if the clear standard is the wrong standard? 

Mr. DEMPSEY. Well, honestly, I think, you know, my own timeframe is if a year from now we could be here with that piece of legislation that would be, you know, a markup or something a year 

from now would be a good target. But I think it is going to take 

a while. We are not pushing, as I said, for introduction of legislation immediately. 

I think we do have, and as we go through this process here, we 

do have some touchstones, and we can think about some of the 

analogies. They only take you so far, but they help. Take what we 

are talking about in terms of cloud computing. If you have a document on your computer in your office, or if you have that document 

printed out, that is protected by the Fourth Amendment—a person’s house, his papers and effects. I think nobody has any doubt 

that ‘‘papers’’ includes your laptop. 

If, however, as now—and by the way, if you—— 

Mr. WATT. Wait a minute, now. You are going to take my whole 

5 minutes talking about something that I am trying to find—you 

say a year from now, and I—let me give—— 

Mr. DEMPSEY. Okay, but I do want to come back to the question 

here of what are the guideposts we have that get us both the clarity and the substance. 

Mr. WATT. I am just talking about the timeframe now. I am not 

even talking about what the content is. Is a year from now too long 

from a clarity perspective, Mr. Gidari? 

Mr. GIDARI. I think lawyers will find ambiguity in a No Smoking 

sign for the rest of our lives, but if that is the case, fix it, fix it 

right. If it takes a little longer to do that, we would rather have 

it right than wrong. But that doesn’t mean they are inconsistent. 

Mr. WATT. So the real question I am trying to get to is what risk 

do we run in this interim? And that is where I get to the second 

part of the question. I mean, what are the horror stories that are 

going on out there? I mean, give me a couple of concrete horror stories that is going on in this interim while we are trying to either 

build consensus or get the standard right. 

Mr. DEMPSEY. Well, here is one example. Every one of us probably has 5, 6, maybe 10 years worth of e-mail stored, either stored 

59 

on our local computer or often stored with a service provider like 

MSN or Gmail or another provider. 

Mr. WATT. That is somewhere in a cloud stored. 

Mr. DEMPSEY. That data is stored on a remote—— 

Mr. WATT. Which I had never heard of until today, but that is 

all right. 

Mr. DEMPSEY. We are talking here just about, you know, when 

people used to draw a picture with a computer over here and a 

computer over here and then a cloud in the middle, that Internet 

server is in the cloud. 

Mr. WATT. I get the concept. 

Mr. DEMPSEY. And that is where a lot of our data is going. 

The way ECPA now works, it says that that e-mail 180 days old 

or less is protected by the Fourth Amendment warrant standard. 

The minute it turns 180 days old, it is available with a mere subpoena issued without judicial approval. 

The Justice Department takes the position that the minute that 

e-mail is opened at all—in fact, from the sender’s perspective, the 

minute it is sent, it loses its warrant protection. Fully protected 

passing over the wire, the minute it reaches—you finish sending it 

or the minute the user, the intended recipient, opens it and looks 

at it, it falls outside of the protection of the warrant. 

Same document, if you print it out, leave it on your desk, protected. Same document, you put it in a box and you lock it in one 

of those storage lockers out in the suburbs, protected by the Fourth 

Amendment. But locked up in the cloud, not protected by that requirement. 

In the Ninth Circuit, the Ninth Circuit has rejected the Justice 

Department view and has said that a warrant is required. So what 

happens now is if the warrant is subject to the jurisdiction or the 

subpoena is subject to the jurisdiction of the Ninth Circuit, it is rejected, and a warrant is required. If it is outside of that, it is a little unclear. 

In Colorado a month ago the Justice Department sought e-mail 

without a warrant. Yahoo said, ‘‘No, go get a warrant, even though 

we are outside of the Ninth Circuit.’’ The Justice Department 

backed down, said okay, withdrew the request. 

That is the kind of uncertainty you are getting. And there is 

overarching it all the possibility that these cases will percolate up 

through the courts and that the statute will be held unconstitutional, if the Justice Department pushes its position. 

Mr. WATT. Because it is too vague? 

Mr. DEMPSEY. No, because the warrant is not. Where the statute 

currently permits access without a warrant, if Professor Kerr is 

right that a warrant is required, that content is like a letter, it is 

like a phone call, it should be protected, so you do run that constitutional risk. 

I still agree with Mr. Gidari and my initial statement that, you 

know, we have lived with that ambiguity now for 5, 10 years. I just 

don’t see how we are going to push this forward. Given the law of 

unintended consequences, we want to make sure we don’t screw 

things up worse. 

Mr. WATT. Thank you. 

I am way over my time, so I will yield back. 

60 

Mr. NADLER. In that case, we will recognize the gentleman from 

Virginia for 5 minutes. 

Mr. SCOTT. Thank you, Mr. Chairman. 

Mr. Dempsey, it seems to me that a person doesn’t think any different about an e-mail as saved in the cloud as on the computer. 

Why would the e-mail in the cloud be any different than the e-mail 

stored in that storage bin in the suburbs that you talked about? 

Mr. DEMPSEY. I don’t think it should, and the conclusion that we 

came to in our preliminary dialogue is that it shouldn’t. 

If you go back to 1986, I think what you end up with is this was 

a distinction based upon the way the technology worked in 1986. 

Storage was expensive, and service providers did not store e-mail. 

If you go back to the early days of AOL, you read that, you 

downloaded it, it was deleted from the computer of the service provider. 

Congress thought 180 days would be the absolute conceivable 

outside limit, and after that it was sort of like abandoned property 

or a—— 

Mr. SCOTT. Well, once it gets into the cloud, can anybody get access to it? 

Mr. DEMPSEY. The—— 

Mr. SCOTT. I mean, beside—I mean, could I look into Representative Watts’ cloud? 

Mr. DEMPSEY. No, no, no, no. It really is—the cloud actually is 

potentially more secure in some ways than local storage. You have 

the service providers of cloud storage capabilities making a lot of 

effort to secure that information. 

Mr. SCOTT. So this is being kept in a place that is secure from 

anybody else, and it is just I am the only one that can access my 

part of this cloud. 

Mr. DEMPSEY. You or the person to whom you give consent. 

Mr. SCOTT. And so I have an expectation that this is private information. 

Mr. DEMPSEY. That is certainly the way the average person looks 

at it. That is one of these changes that has occurred, the technology 

changes that have occurred in the past 10 years that we are talking about. 

Mr. SCOTT. Ms. Levins, when Microsoft has to respond to a lot 

of warrants and subpoenas, it costs money. Does the government 

incur any of the expense, or they just let you worry about it? 

Ms. LEVINS. Congressman Scott, that is not my area of expertise. 

I would have to get back to you with that information. I know my 

colleagues do know that. I don’t have that with me. 

Mr. SCOTT. Does anybody know who—what—— 

Mr. GIDARI. The statute authorizes reimbursement for non-toll 

records, so phone companies give them away for free in large 

amounts, but electronic communication service providers are entitled to charge for them. Not all of them do. Many provide that service to law enforcement for free. Others charge a reasonable cost. 

Mr. SCOTT. But some information can be obtained fairly easily. 

Some takes a little complication where you have to program the 

computer and pay expenses to get the information, and some of it, 

I imagine, gets kind of expensive after a while. 

Mr. GIDARI. That is right. 

61 

Mr. SCOTT. And you can charge for that expense? 

Mr. GIDARI. That is correct. 

Mr. SCOTT. Does anybody have any concern, if we keep talking 

about how government does all this surveillance, that we might 

publicize their techniques and compromise investigations? 

Mr. DEMPSEY. I have always thought that we could have the discussion without compromising techniques. I think we can talk at 

the level of specificity necessary to draft a clear statute, incorporate 

the Fourth Amendment principles, and do that in a way that 

doesn’t get into the technology at all. In fact, technology neutrality, 

I think, is one of the principles that we are trying to achieve here. 

Mr. SCOTT. Okay. 

And with the pinging the cell phone, can anybody ping somebody 

else’s cell phone, or is that just something the company can do? 

Mr. GIDARI. Something only the company can do. 

Mr. SCOTT. And I think there is an expectation that you are not 

being followed, because the company isn’t supposed to be following 

you around, and the only way the government can do it is—what 

does the government need to order the company to find out where 

you are? 

Mr. GIDARI. Depends on which magistrate you visit, but at least 

a pen register order and a specific and articulable facts order combined, but in many jurisdictions, a probable cause order—a probable cause warrant issued under Rule 41. 

Mr. SCOTT. But for a government request, I should have an expectation that I am not being pinged and shown up on somebody’s 

computer screen. Is that a reasonable expectation, or, you know, 

should—— 

Mr. GIDARI. It is more than a reasonable expectation. 

Mr. DEMPSEY. And that is the way I think that carriers have designed their services. A number of carriers offer services whereby 

parents, for example, can—who are the subscribers to the service— 

can find out, for example, where their children are. But that is the 

case of the subscriber controlling their account. 

There are a variety of services now being offered where I can 

share my location with my friends. The companies who have designed those services have been very, very careful to design them 

in a way so that the user has control. To override that user control, 

the company has to be involved. The company has to be compelled 

to do something. 

And some of those services offer very, very precise location capability, in a sense almost pinpointing a person on a map. A number 

of those companies have said that they will insist upon a warrant 

for disclosure of that information, and I think they have strong constitutional argument for that. But the statute, as we have said, it 

is completely unclear. 

Mr. NADLER. Thank you. 

I now recognize the gentleman from Georgia. 

Mr. JOHNSON. Thank you, Mr. Chairman. 

If I were someone’s wife, and I was out on the town running 

around with all kinds of males and females and engaged in doing 

my own thing pretty much, and I am wanting to keep all of that 

secret, I am certain that no one on the panel would want the husband of—or they would not want my husband to be able to go to 

62 

the phone company and say, ‘‘Look, I need to find out where my 

wife is, because I am going to kill her when I find her.’’ None of 

you all would want that to happen, would you? 

And so no one is saying anything, so I assume—— 

Mr. DEMPSEY. No. 

Mr. JOHNSON. Okay. All right. 

And now, what if I were a law enforcement officer—the husband. 

Or what if my husband was a law enforcement officer? Is there 

any—and only thing this law enforcement officer did was to go get 

a subpoena, which he carries around blank subpoenas, and comes 

to a cell phone provider and says, ‘‘Look, I am conducting an investigation, and you must provide this information to me.’’ Should that 

law enforcement officer, or any other law enforcement officer, be 

able to obtain that information, the whereabouts of his wife? 

Mr. GIDARI. They would be shown the door with that request, the 

door to the courthouse, where they would have to ask a judge to 

approve an order to get it. 

Mr. JOHNSON. But that may be true at your cell phone company, 

but it is not necessarily compelled by law that the cell phone company refrain from producing those documents. Is that correct? 

Mr. DEMPSEY. Congressman, there is actually an interesting case 

that has emerged in the 11th Circuit recently, which dealt not with 

the location information, but instead with some e-mails. 

And the case clearly involved a certain amount of favoritism on 

the part of the prosecutor and the sheriff in that area, who at least 

allegedly were doing a favor for a friend in defending that friend 

against some civil litigation or some civil controversy, issued a subpoena, like you say, served the subpoena on the service provider, 

and the service provider did turn over that e-mail. 

The case has gone up to the 11th Circuit, and unfortunately, this 

is one of the cases that I think went in the wrong direction. Professor Kerr has also written about it, criticizing the decision in this 

case, but the 11th Circuit held that there was zero constitutional 

privacy interest in that e-mail and that the sheriff and the prosecutor, in essence acting off on their own, had not violated anybody’s rights. 

Mr. JOHNSON. So, and the reason why it was not private is because it was in the cloud somewhere? 

Mr. DEMPSEY. Yes, there was this notion that they had, which 

we think is wrong, that privacy was lost because of the use of that 

technology. 

Mr. JOHNSON. Yes. 

Is there anybody who would agree with the 11th Circuit decision 

in that case that is sitting on this panel? 

Yes, okay. All right. Well, you know, I have been sitting here all 

day trying to find something that someone on the panel would say 

that would incite me to issue forth with tough questions, but you 

all have deprived me of that option, and I am pretty much, I guess, 

singing to the choir when I say that I would hate to see either with 

content or with noncontent information requested by law enforcement, to use your analogy, Mr. Kerr—or not your analogy, but your 

terminology, I would hate to see a company turned into a agent for 

law enforcement at the expense of their customer. 

63 

To me the issues that we confront are easily dealt with by legislatively extending the Fourth Amendment. And I do believe that 

there is an inherent right to privacy, which is implied in really the 

first nine amendments, but certainly the Fourth Amendment. All 

we have to do is just extend it to these new areas that have come 

to the fore since we have been embarked on this pursuit of intellectual supremacy, if you will. 

This is just human nature, but if we stick with the ideals of the 

founding fathers, particularly with respect to the Fourth Amendment, I think that our job should be easy. 

And I guess there could be an argument that we just leave each 

case up to the the courts to flesh out and ultimately to the U.S. 

Supreme Court, but I am afraid that we would—I am afraid to 

leave it up to the U.S. Supreme Court when we can put those 

things into legislation, which clears up the ambiguities that may 

arise. 

So I think this is a very important hearing. It bears upon the individual rights that we in this country oftentimes take for granted, 

but they are what made America what it is. So thank you very 

much. 

And I notice that the Chairman is now thinking about—thinking 

pensively as we proceed. 

Mr. NADLER. And you yield back? 

Mr. JOHNSON. At this time, yes. 

Mr. NADLER. Then I will recognize the gentlelady from California. 

Ms. CHU. So, Mr. Dempsey, I would like to ask a question about 

the fate of an e-mail that I would send out, but under different circumstances with regard to privacy and the Fourth Amendment. 

Let us just say I e-mail a friend, Sarah, and what would happen 

to the fate of that e-mail if she has read it versus hasn’t read it 

or with regard to if 8 months have passed versus tomorrow, whether it is on a Gmail account or whether it is on her hard drive? Or 

what if I took the content of that information and put it in a letter 

and just mailed it? 

Mr. DEMPSEY. In the Appendix A to my testimony, I talk about 

this example, and if I was better at graphics, I would have tried 

to it do a chart that showed this, because it really does almost take 

a matrix to explain this. 

While the e-mail is in transit, moving over the wires, so to speak, 

or moving through the network, it can be intercepted only with a 

warrant, a wiretap order issued under the Wiretap Act. 

Once it reaches the inbox, so to speak, the computer of the service provider of Sarah, the intended recipient, it comes under the 

Stored Communications Act and at least until she opens it, that email sitting in her e-mail box is protected again by the warrant requirement. 

After she reads it, under my reading of ECPA, for 180 days it 

remains protected by the warrant requirement. After 180 days, on 

day 181, it loses the warrant protection. So you go from warrant 

to non-warrant. 

An interesting example is if you are using Gmail, by the way, 

and you—or any other remote Web-based e-mail service—and you 

draft your e-mail and don’t send it, because you haven’t finished it, 

64 

you are going to come back the next and finish it and send it, while 

that e-mail is sitting on the server of Google, it is available regardless of age. 

It is available with a mere subpoena. It is not protected by the 

warrant at all, because Google is at that time acting as a provider 

of remote computing services, not as a provider of electronic communication services. They are storing the e-mail. 

Once 180 days passes, then Google again reverts to its status as 

a remote computing service. It is available with the subpoena. The 

Justice Department argues that the copy of the e-mail that you 

might store, since you store all your outgoing e-mail, if it is stored 

in the cloud, loses its protection as soon as you send it, because it 

is no longer in transit in temporary storage incident to transmission. It is sort of your copy. 

Now if you had printed out a copy and kept a copy in your office, 

that is protected by the Fourth Amendment. If you have a copy on 

your desktop or laptop, that is protected by the Fourth Amendment. But the copy that is stored in your account, according to the 

Justice Department, from the minute you push ‘‘send,’’ that is not 

protected by the warrant. 

Mr. NADLER. Will the gentlelady yield for a moment? 

Ms. CHU. Yes. 

Mr. NADLER. And the Justice Department in effect is saying that 

because you pressed the ‘‘send’’ button, the Fourth Amendment 

doesn’t apply, because it is no longer your papers? 

Mr. DEMPSEY. It applies only—I think everybody would admit 

that it applies to the e-mail in transit. 

Mr. NADLER. But why doesn’t it apply continuing? 

Mr. DEMPSEY. They argue, I think, that it is—it is hard to articulate their theory. It is a stored record, in their opinion, that has 

been entrusted to a third-party in such a way that you have surrendered your privacy interest in it. 

Now, I think the correct analogy is the storage locker analogy, 

in which a warrant is required to go into the storage locker. There 

are cases having—they analogize it to something like a check, a 

cancelled check which goes to the bank. 

Mr. NADLER. That is even more strange, when they say that it 

is not protected by the Fourth Amendment before you finished it. 

Mr. DEMPSEY. If you store it with some—if you leave it on some 

remote server. 

Mr. NADLER. I thank the gentlelady for yielding. 

Ms. CHU. And so if you have it on the hard drive, it is protected, 

but if it is in the cloud, it is not protected. And if it is a letter, I 

am presuming you are saying it is protected. 

Mr. DEMPSEY. The letter is interesting, because the letter is protected, of course, in the hands of the post office. This goes back to 

1877, when the Supreme Court ruled that the Fourth Amendment 

does protect the letter moving through the mail system. The copy 

of the letter that I retained is protected. The copy of the letter that 

the recipient has is protected vis-a-vis the recipient. They can always voluntarily turn it over, but to force them to disclose it would 

require a warrant or subpoena served directly on them. 

So you have got this crazy quilt that the average individual has 

absolutely no idea about. And increasingly, the services are being 

65 

designed in a way to make all this completely seamless and completely non-apparent to the user. 

So we have these increasingly powerful Black Berries and 

handheld mobile Internet devices. We are constantly accessing information remotely. Sometimes it is on the device. Sometimes it 

isn’t. Increasingly, it becomes even less clear where it is. And it is 

time to dispense with these technology-based, platform-based rules 

by which people do not lead their lives, people do not base their 

lives on these distinctions from 1986. 

Ms. CHU. Thank you. 

I yield back. 

Mr. NADLER. I thank the members of the panel, unless any member of the panel wants to say anything else. 

In which case without objection, all Members will have 5 legislative days to submit to the Chair additional written questions for 

the witnesses, which we will forward and ask the witnesses to respond as promptly as they can so that their answers may be made 

part of the record. Without objection, all Members will have 5 legislative days to submit any additional materials for inclusion in the 

record. 

Mr. Dempsey, you wanted to make a statement. 

Mr. DEMPSEY. Yes, Mr. Chairman. Sorry, I did have one thing. 

I have a very good memo that was prepared by Becky Burr at the 

WilmerHale law firm, talking about some of these issues, and I 

would like to, with your permission, enter this into the record of 

the hearing as well. 

Mr. NADLER. Well, if you will give it to us, without objection, it 

will certainly be entered into the record, and I thank you. 

[The information referred to follows:] 

66 


E-1.eps
67 


E-2.eps
68 


E-3.eps
69 


E-4.eps
70 


E-5.eps
71 


E-6.eps
72 


E-7.eps
73 


E-8.eps
74 


E-9.eps
75 


E-10.eps
76 


E-11.eps
77 


E-12.eps
78 


E-13.eps
79 


E-14.eps
80 


E-15.eps
81 


E-16.eps
82 


E-17.eps
83 


E-18.eps
84 


E-19.eps
85 


E-20.eps
86 


E-21.eps
87 


E-22.eps
88 

Mr. NADLER. With that, I thank the witnesses. And the hearing 

is adjourned. 

[Whereupon, at 4:06 p.m., the Subcommittee was adjourned.] 


E-23.eps
(89) 

A P P E N D I X 

MATERIAL SUBMITTED FOR THE HEARING RECORD

90 


A-1.eps
91 

f 


A-2.eps
92 


B-1.eps
93 


B-2.eps
94 


B-3.eps
95 

f 


B-4.eps
96 


C-1.eps
97 


C-2.eps
98 


C-3.eps
99 


C-4.eps
100 


C-5.eps
101 


C-6.eps
102 


C-7.eps
103 


C-8.eps
104 


C-9.eps
105 

f 


C-10.eps
106 


D-1.eps
107 

Æ 


D-2.eps