U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

58–409 PDF 2010

ECPA REFORM AND THE REVOLUTION IN 

CLOUD COMPUTING 

HEARING 

BEFORE THE

SUBCOMMITTEE ON THE CONSTITUTION, 

CIVIL RIGHTS, AND CIVIL LIBERTIES 

OF THE

COMMITTEE ON THE JUDICIARY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED ELEVENTH CONGRESS 

SECOND SESSION 

SEPTEMBER 23, 2010 

Serial No. 111–149 

Printed for the use of the Committee on the Judiciary 

( 

Available via the World Wide Web: http://judiciary.house.gov 

(II) 

COMMITTEE ON THE JUDICIARY 

JOHN CONYERS, JR., Michigan, Chairman 

HOWARD L. BERMAN, California 

RICK BOUCHER, Virginia 

JERROLD NADLER, New York 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

MELVIN L. WATT, North Carolina 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

MAXINE WATERS, California 

WILLIAM D. DELAHUNT, Massachusetts 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO PIERLUISI, Puerto Rico 

MIKE QUIGLEY, Illinois 

JUDY CHU, California 

TED DEUTCH, Florida 

LUIS V. GUTIERREZ, Illinois 

TAMMY BALDWIN, Wisconsin 

CHARLES A. GONZALEZ, Texas 

ANTHONY D. WEINER, New York 

ADAM B. SCHIFF, California 

LINDA T. SA ́ NCHEZ, California 

DANIEL MAFFEI, New York 

JARED POLIS, Colorado 

LAMAR SMITH, Texas 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

HOWARD COBLE, North Carolina 

ELTON GALLEGLY, California 

BOB GOODLATTE, Virginia 

DANIEL E. LUNGREN, California 

DARRELL E. ISSA, California 

J. RANDY FORBES, Virginia 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TOM ROONEY, Florida 

GREGG HARPER, Mississippi 

PERRY APELBAUM, Majority Staff Director and Chief Counsel 

SEAN MCLAUGHLIN, Minority Chief of Staff and General Counsel 

SUBCOMMITTEE ON THE CONSTITUTION, CIVIL RIGHTS, AND CIVIL LIBERTIES

JERROLD NADLER, New York, Chairman 

MELVIN L. WATT, North Carolina 

ROBERT C. ‘‘BOBBY’’ SCOTT, Virginia 

WILLIAM D. DELAHUNT, Massachusetts 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

TAMMY BALDWIN, Wisconsin 

JOHN CONYERS, JR., Michigan 

STEVE COHEN, Tennessee 

SHEILA JACKSON LEE, Texas 

JUDY CHU, California 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

TOM ROONEY, Florida 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

DAVID LACHMANN, Chief of Staff 

PAUL B. TAYLOR, Minority Counsel 

(III) 

C O N T E N T S 

SEPTEMBER 23, 2010 

Page 

OPENING STATEMENTS 

The Honorable Jerrold Nadler, a Representative in Congress from the State 

of New York, and Chairman, Subcommittee on the Constitution, Civil 

Rights, and Civil Liberties .................................................................................. 1 

The Honorable Trent Franks, a Representative in Congress from the State 

of Arizona, and Member, Subcommittee on the Constitution, Civil Rights, 

and Civil Liberties ............................................................................................... 3 

The Honorable John Conyers, Jr., a Representative in Congress from the 

State of Michigan, Chairman, Committee on the Judiciary, and Member, 

Subcommittee on the Constitution, Civil Rights, and Civil Liberties ............. 4 

WITNESSES 

Mr. Edward W. Felten, Director, Center for Information Technology Policy, 

Princeton University 

Oral Testimony ..................................................................................................... 10 

Prepared Statement ............................................................................................. 12 

Mr. Richard Salgado, Senior Counsel, Law Enforcement and Information 

Security, Google, Inc. 

Oral Testimony ..................................................................................................... 17 

Prepared Statement ............................................................................................. 19 

Mr. Mike Hintze, Associate General Counsel, Microsoft Corporation 

Oral Testimony ..................................................................................................... 24 

Prepared Statement ............................................................................................. 26 

Mr. David Schellhase, Executive Vice President and General Counsel, 

Salesforce.Com 

Oral Testimony ..................................................................................................... 39 

Prepared Statement ............................................................................................. 41 

Mr. Perry Robinson, Associate General Counsel, Rackspace Hosting 

Oral Testimony ..................................................................................................... 55 

Prepared Statement ............................................................................................. 57 

Mr. Paul Misener, Vice President for Global Public Policy, Amazon.Com 

Oral Testimony ..................................................................................................... 64 

Prepared Statement ............................................................................................. 66 

Mr. Kevin Werbach, Professor, The Wharton School, University of Pennsylvania 

Oral Testimony ..................................................................................................... 78 

Prepared Statement ............................................................................................. 80 

Mr. Fred H. Cate, Professor, Director, Center for Applied Cybersecurity Research, Indiana University 

Oral Testimony ..................................................................................................... 91 

Prepared Statement ............................................................................................. 93 

Mr. Thomas B. Hurbanek, Senior Investigator, Computer Crime Unit, New 

YorK State Police 

Oral Testimony ..................................................................................................... 101 

Prepared Statement ............................................................................................. 104 

Mr. Kurt F. Schmid, Executive Director, Chicago High Intensity Drug Trafficking Area Program 

Oral Testimony ..................................................................................................... 109 

Prepared Statement ............................................................................................. 112 

Page

IV 

Mr. Marc J. Zwillinger, Zwillinger Genetski, LLP 

Oral Testimony ..................................................................................................... 118 

Prepared Statement ............................................................................................. 121 

LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING 

Prepared Statement of the Honorable John Conyers, Jr., a Representative 

in Congress from the State of Michigan, Chairman, Committee on the 

Judiciary, and Member, Subcommittee on the Constitution, Civil Rights, 

and Civil Liberties ............................................................................................... 6 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD

Prepared Statement of the Honorable Henry C. ‘‘Hank’’ Johnson, Jr., a Representative in Congress from the State of Georgia, and Member, Subcommittee on the Constitution, Civil Rights, and Civil Liberties .................... 137 

Response to Post-Hearing Questions from Richard Salgado, Senior Counsel, 

Law Enforcement and Information Security, Google, Inc. ................................ 139 

Response to Post-Hearing Questions from Mike Hintze, Associate General 

Counsel, Microsoft Corporation ........................................................................... 143 

Letter from the Federal Law Enforcement Officers Association ......................... 147 

Prepared Statement of the Competitive Enterprise Institute (CEI), The 

Progress & Freedom Foundation, Citizens Against Government Waste, 

Americans for Tax Reform, and the Center for Financial Privacy and 

Human Rights ...................................................................................................... 150 

(1) 

ECPA REFORM AND THE REVOLUTION IN 

CLOUD COMPUTING 

THURSDAY, SEPTEMBER 23, 2010 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON THE CONSTITUTION, CIVIL RIGHTS, AND CIVIL LIBERTIES, COMMITTEE ON THE JUDICIARY, Washington, DC. 

The Subcommittee met, pursuant to notice, at 11:08 a.m., in 

room 2141, Rayburn House Office Building, the Honorable Jerrold 

Nadler (Chairman of the Subcommittee) presiding. 

Present: Representatives Nadler, Conyers, Watt, Johnson, and 

Franks. 

Staff present: (Majority) David Lachmann, Subcommittee Chief 

of Staff; Stephanie Pell, Counsel; and Art Radford Baker, Minority 

Counsel. 

Mr. NADLER. This hearing of the Subcommittee on the Constitution, Civil Rights, and Civil Liberties will come to order. To begin 

with I will recognize myself for an opening statement. 

Today’s hearing is the third in which this Subcommittee will consider the statutory framework Congress established in the 1986 

Electronic Communications Privacy Act, ECPA, in light of the enormous technological advances in electronic communications in the 

24 years since ECPA’s passage. At the last hearing we learned 

about advancements in cellular location-based technologies and related services and how such technologies, while enriching our lives, 

could provide law enforcement with more precise, and to many of 

us more sensitive, information about where we may be located at 

any given time. 

Today we will continue our examination of whether ECPA still 

strikes the right balance among the interests and needs of law enforcement, industry, and the privacy interests of the American people by discussing a new technology commonly referred to as cloud 

computing. It is important that the law sustain the public’s confidence in the security and privacy of their communications and information. That confidence is absolutely essential to fostering the 

emerging market for cloud computing services and the rapid innovation that is fundamental to that market’s health. 

This Subcommittee’s exploration of where the appropriate balance may lie with respect to the content and associated transactional information of electronic communications and data stored 

by certain third party providers must begin with a lesson about 

cloud computing technologies and capabilities. When ECPA was 

2 

passed back in 1986 few of us used e-mail or imagined a world 

where we could securely share information and edit electronic documents online with our colleagues or where, again online, a business could input, store, process, and access all data necessary for 

the management of its business processes, from sales to customer 

service. 

That world is here and it promises tremendous efficiencies for 

government, private industry, and individuals. It is an exciting 

technological advance and we must ensure that the law keeps pace 

in a manner that protects this market, protects the rights of consumers and the government’s law enforcement responsibilities. 

We are fortunate to have two distinguished panels of witnesses 

who bring a great deal of expertise to both the legal and technological issues before us, including witnesses who represent five 

major U.S. cloud computing companies. 

I should mention at this point that—and if I am wrong someone 

will correct me, I am sure, at some point today—cloud computing 

simply means—or the cloud simply means where the data is stored 

on a third party’s server—not in your home, but on somebody else’s 

server, so it is not given as much privacy protection under current 

law as if it were on your own computer at home. 

Along with other experts our witnesses today will educate us 

about what is happening in the cloud today and discuss the type 

of laws and rules that industry needs to promote the continuing innovation and growing efficiency that cloud computing affords to individuals and businesses of all types and sizes. This initial educational effort is, in my view, not only warranted but essential before we undertake any effort at amending or otherwise reforming 

ECPA. 

In many respects, at least for the moment, the testimony we hear 

and discussions we have today may raise more questions than they 

answer. Since we are to hear about technologies, both existing and 

perhaps yet to come, that are revolutionary—certainly by 1986 

standards—I want to acknowledge that our task will be a challenge 

to find the appropriate balance between privacy and law enforcement interests, to protect the public while preserving consumer privacy and confidence, to support rapid technological innovation and 

growth yet discern standards for law enforcement access that will 

not become outdated with each new generation of technology, 

which is to say every 6 months or so. 

Just as it would not have been possible for Congress to anticipate 

the exciting technologies we will be discussing today it is more 

than likely that in the years to come new technologies will present 

us with equally vexing legal questions. We must learn to take advantage of these emerging technologies without ushering in a new 

privacy-free civilization, to boldly go toward the creation of a new 

productive balance among the interests of law enforcement, personal privacy, and industry that no legislation has quite stricken 

before. 

This Subcommittee needs the assistance and input of all stakeholders—law enforcement, private industry, and civil liberties 

groups alike—to get this balance right, hopefully for at least another generation. I look forward to the testimony of our witnesses 

3 

today and to working with all stakeholders on this very timely mission. 

I yield back the balance of my time and I now represent the distinguished—I now recognize, rather, the distinguished gentleman 

from Arizona. 

Mr. FRANKS. Well, thank you, Mr. Chairman. 

Thank all of you for being here. 

And we are grateful that you are holding this hearing examining 

the need to update the Electronic Communications Privacy Act of 

1986, or ECPA, as it relates to cloud computing. This is the third 

in a series of hearings to examine ECPA and possible ECPA reforms. I can say, if there is one thing I hope or believe we can all 

agree upon it is that we don’t have a precise definition of cloud 

computing, and as someone said, there is an old quote that said, 

‘‘The secret to the universe is in the true naming of things.’’ It 

often means different things to different people. 

Today we will hopefully learn exactly what the cloud is and have 

a better understanding of how, if at all, ECPA falls short of addressing this new technology. Some proponents of ECPA reform 

propose requiring a search warrant for communications in the 

cloud, regardless of the age of those communications, how they are 

stored, or how they are accessed. This would be a fairly significant 

departure from current law. 

The information possessed by law enforcement in the very early 

stages of an investigation does not always have to lend itself to establishing probable cause for the purposes of obtaining a search 

warrant. A blanket warrant requirement for communications in the 

cloud, regardless of how or where they are stored, could potentially 

deprive law enforcement officials of essential building blocks for 

criminal investigations and may actually deprive them of their ability to establish probable cause for wire taps, physical searches, or 

arrests. 

I am always mindful of the potential encroachment on individual 

liberty and privacy by new technologies and I have tried to be one 

of the first to defend those rights. However, I will also be one of 

the first to protect the legitimate needs of law enforcement, including their ability to keep pace with rapidly changing technologies. 

Now, I am not aware of any of the practices by law enforcement 

that have inhibited the use of the development of these services. 

I am also not aware of any practices by the law enforcement authorities that have discouraged the willingness of individuals or 

businesses to store data in the cloud. 

There may very well be a need to clear up statutory ambiguities 

so that the police know what they have to do to obtain certain information and service providers know what they have to do, in 

terms of the law, to provide that information. But I am concerned 

that the increasing—I am concerned that increasing the evidentiary standard to such a degree as some have proposed would 

create a hurdle that is simply too high to clear. 

Cloud technology is a significant advancement in how we send, 

store, and process a very large array of data. Companies that provide these services have a vested interest in assuring a certain 

level of privacy to their customers, and obviously this has to be 

4 

weighed against the government’s legitimate need to access this 

data. 

And while we consider these issues I believe we must also be cognizant of other privacy-related issues. We should not simply focus 

on revising or restricting law enforcement access to the cloud; we 

must also be aware of who owns the cloud, who has access to the 

cloud, and whether there are sufficient safeguards to protect the 

cloud against criminal and foreign adversaries. 

Creating barriers to law enforcement in the name of privacy may 

have the unintended consequence of inhibiting law enforcement investigations into data breaches and other privacy intrusions by 

hackers and spies and the like. ECPA reform is simply not about 

Federal investigations—or I should say it is not simply about those 

things. These laws govern every criminal investigation in the country. 

For this reason this Committee must be thoroughly balanced and 

informed in any ECPA reform it undertakes, and I hope all of you 

can help us understand the best way to move forward. I am grateful that you are here. I thank every one of you, look forward to 

your testimony, and yield back. 

Mr. NADLER. I thank the gentleman. 

I will now recognize for an opening statement the distinguished 

Chairman of the full Committee, the gentleman from Michigan, Mr. 

Conyers. 

Mr. CONYERS. Thank you, Chairman Nadler, and Trent Franks. 

I am always glad to be here with us three and the staff. 

As if this is not an important issue, I think it is being very undervalued by many on our Committee, certainly not those of you 

that have taken time to join us here in the hearing room today. 

It just so happens that I was the only one here in 1986, and that 

is not to date myself, but the one thing I can’t remember right now 

is whether the Chairman of the Committee was Jack Brooks or 

Peter Rodino. I am inclined to think it was Jack Brooks, of Texas, 

but we are researching it right now. 

Now, so far when we start talking about the reform and how— 

what we ought to consider it turns on whether or not we are going 

to restrict privacy or, in the name of law enforcement, we are going 

to be able to be more invasive. And sure enough, Trent Franks 

runs right into the conservative position of wanting to let the law 

enforcement people have their way more. And I am just predicting 

this; he didn’t really come out and say it, but we have been listening to each other now for a growing period of years. 

But is there something else involved here? And I am so glad we 

have got the witnesses here today. 

Of course we are going to have to balance it, but, you know, I 

am listening to questions of whether or not we are going to be able 

to work out agreements over cyberspace differences that are now 

becoming more discussed in our world. We now find out that not 

only do we have arms race control and nuclear control, we now 

have the whole question of how we can create severe damage to civilian populations through dismantling and disabling their cyber 

connections in terms of conflict. 

And so we move into this, I hope, not just worrying about how 

much law enforcement leeway are we going to get? Of course we 

5 

want to protect our people’s privacy as much as possible, but at the 

same time there seem to me to be other issues that I am hoping 

that you will bring up that are related to who is going to control 

and what happens—is this an infinite growth situation that we are 

in? Are there limits? Are we going to run out of what we need to 

work with or not? Or are there other considerations? 

And it is in that spirit that I join you today, and also ask unanimous consent to put my written statement in the record. 

Mr. NADLER. Without objection. 

Mr. CONYERS. Thank you, Mr. Chairman. 

[The prepared statement of Mr. Conyers follows:] 

6 


A-1.eps
7 


A-2.eps
8 

Mr. NADLER. Thank you. 

Without objection, all Members will have 5 legislative days to 

submit opening statements for inclusion in the record. Without objection, the Chair will be authorized to declare a recess of the hearing at any point. We will now turn to our first panel of witnesses, 

and instead of reading the usual boilerplate about our procedures 


A-3.eps
9 

we will follow the Committee’s usual procedures of questioning witnesses. 

Our first witness will be Edward Felten, who is a professor of 

computer science and public affairs at Princeton University and is 

the founding director of Princeton’s Center for Information Technology Policy. His research interests include computer security and 

privacy, especially relating to the Internet and computer product— 

and consumer products, and technology law and policy. 

He received his Ph.D. in computer science and engineering from 

the University of Washington, an M.S. in computer science and engineering from the University of Washington, and then his B.S. in 

physics with honors from the California Institute of Technology. 

Richard Salgado, our next witness, is a senior counsel with 

Google for information, security, and law enforcement matters. 

Prior to joining Google Mr. Salgado worked at Yahoo, focusing on 

international security and compliance. 

He also served as senior counsel in the computer crime and intellectual property section of the United States Department of Justice. 

Mr. Salgado received his law degree from Yale Law School. 

Michael Hintze is an associate general counsel in Microsoft Corporation’s legal and corporate affairs group. He joined Microsoft in 

1998 and his practice currently includes a number of regulatory 

and public policy issues, including privacy, security, telecom, online 

safety, and free expression matters worldwide. Mr. Hintze is a 

graduate of Columbia University School of Law. 

David Schellhase is—I hope I got that right—thank you—David 

Schellhase is executive vice president and general counsel of 

Salesforce.com, Inc., where he leads the legal, internal audit, and 

public policy teams. Mr. Schellhase joined Salesforce.com in 2002 

and has practiced law in the technology industry for 20 years. Mr. 

Schellhase is a graduate of Cornell Law School. 

Perry Robinson is associate general counsel at Rackspace 

Hosting. Mr. Robinson oversees Rackspace’s program for compliance with state and Federal law enforcement agency requests and 

leads their legal team on contractual matters relating to the provision of services to Rackspace’s customers. Mr. Robinson earned his 

J.D. from Baylor Law School. 

Paul Misener is Amazon.com’s vice president for global public 

policy and has served in this position for a decade. He is responsible for formulating and representing the company’s public policy 

positions worldwide as well as for managing policy specialists in 

Asia, Europe, and North America. Mr. Misener received his J.D. 

from George Mason University. 

I am pleased to welcome all of you. Your written statements in 

their entirety will be made part of the record. I would ask each of 

you to summarize your testimony in 5 minutes or less. 

To help you stay within that time limit there is a timing light 

at your table. When 1 minute remains the light will switch from 

green to yellow, and then red when 5 minutes are up. 

Before we begin it is customary—well, let me just say before we 

do this, the Chair reserves for himself the right to recess the hearing, which I anticipate doing only if there are votes on the floor. 

Before we begin it is customary for the Committee to swear in its 

witnesses. 

10 

If you would please stand and raise your right hands to take the 

oath? 

Let the record reflect that the witnesses answered in the affirmative, and you may, of course, be seated. 

I will now recognize for 5 minutes our first witness, Professor 

Felten, and use your mic please. 

TESTIMONY OF EDWARD W. FELTEN, DIRECTOR, CENTER FOR 

INFORMATION TECHNOLOGY POLICY, PRINCETON UNIVERSITY 

Mr. FELTEN. A lot has changed on the Internet since ECPA was 

passed in 1986. Back then there were only a couple thousand computers online. Commercial activity was strictly forbidden; the Net 

was only for research and education purposes. And several of the 

companies represented on this panel did not even exist. The eventual founder of Facebook was 2 years old. 

The computers at that time would not even be recognizable to today’s teenagers; the equipment is vastly different. Today’s cell 

phones are vastly better than the super-computers of 1986. But 

more important than these changes in equipment and sheer numbers of computers has been the change in the way people use the 

Internet, and one of the big changes there has been the move to 

cloud computing. 

As you said before, Mr. Chairman, the defining characteristic of 

cloud computing is that a person is—a person or company is taking 

their data and moving it onto someone else’s computer, and along 

with that taking the computation and other management functions 

and putting those as well onto someone else’s computer, typically 

a service provider’s computer. Cloud computing is used both by individuals and by businesses large and small. 

To give an example of the use of cloud computing by an individual let me talk about my own use of my personal calendar. I 

keep my calendar in the cloud. I have a deal with the service provider in which they support that. 

And that provides a number of advantages to me. First, it means 

that the data and the systems are professionally managed. 

The computers that store the master copy of my calendar are run 

by the service provider and not by me; the service provider’s employees take care of backing up the data, maintaining security, 

keeping everything up-to-date, and keeping everything running. I 

don’t have to worry about that at all. 

The second advantage is that my calendar is accessible to me 

anywhere—on my desktop computer, on my laptop computer, on 

my mobile phone. The service provider gives me software that runs 

on all of those devices and that software always gets an up-to-date 

copy of my calendar. If I change something in one of those places 

it is immediately reflected in the master copy and then in the other 

copies so that there is a single view of my calendar which I always 

see regardless of where I am. 

And the third main advantage is that it is easily shareable. I can 

give my wife, and my colleagues, and my students access to my calendar and they can see what I see in real time. Some of them, with 

my permission, can modify the calendar; others can just see. 

11 

Any kind of service which would benefit from these advantages 

of professional management, accessibility anywhere, and sharing 

can be put in the cloud and typically is, and there are many examples of different kinds of services that happen in the cloud—e-mail, 

document management, investment tracking, photo sharing, project 

management, hard drive backup, and many more. 

Cloud computing is also valuable for businesses. A business can 

take some of their back office computing operations—things like 

payroll, sales, and inventory—and move those into the cloud. 

They can also move their consumer facing technology infrastructure into the cloud. For example, an ecommerce company might 

take these servers that provide their image to customers and that 

customers interact with and put those in the cloud by hiring out 

that function to someone else. 

Even companies that are technically sophisticated often do this 

because they find it cheaper, due to the economies of scale, in having things centrally managed. As another example, I wrote my 

written testimony that was submitted earlier in a cloud documentediting system, and I did that because it was easy for me to use 

across devices, and because when I wanted someone to review the 

document and give me feedback they could easily do that by using 

the same cloud service, and we could interact and edit in real time. 

Now, in an ideal world people would be making the decision to 

use the cloud or not use the cloud based on considerations of technical efficiency and cost. They would be balancing those factors and 

deciding to do whatever was best in their individual case. But to 

the extent that a law like ECPA puts its thumb on the scale and 

pushes people toward putting their data and functions in the cloud 

or moving them out of the cloud you end up with solutions that are 

less technically efficient, more expensive, and harder to use, and 

you end up ultimately with less innovation in technology and in 

business processes. 

Thank you. 

[The prepared statement of Mr. Felten follows:] 

12 

PREPARED STATEMENT OF EDWARD W. FELTEN


EWF-1.eps
13 


EWF-2.eps
14 


EWF-3.eps
15 


EWF-4.eps
16 

Mr. NADLER. I thank the gentleman. 

I now recognize Mr. Salgado? 


EWF-5.eps
17 

TESTIMONY OF RICHARD SALGADO, SENIOR COUNSEL, LAW 

ENFORCEMENT AND INFORMATION SECURITY, GOOGLE, INC. 

Mr. SALGADO. Thank you, Chairman Nadler, Ranking Member 

Sensenbrenner, and Members of the Subcommittee. As Google’s 

senior counsel for law enforcement and information security I oversee Google’s response to government requests for user information 

under many authorities, including the Electronic Communications 

Privacy Act of 1986. I have also worked with ECPA extensively 

from a law enforcement perspective as a senior counsel in the 

criminal division in the Department of Justice. 

ECPA was a forward-looking statute for 1986, and much of it remains relevant today. But over my many years of experience in implementing, in trying to interpret, and frankly often wrestling with 

the statute I have seen large gaps grow between the technological 

assumptions of that earlier era and the reality of how electronic 

communication works today. 

As a result of those gaps, providers, users, law enforcement 

agents, investigators, and prosecutors, as well as judges often face 

complex and baffling rules that are difficult to explain and challenging to apply. Even more significant, however, in important respects ECPA now fails to provide the privacy protection that people 

reasonable expect, and that is why Google helped found and strongly supports the Digital Due Process coalition. 

The coalition, which many of you may have heard of, is a broad 

coalition. It includes telecommunications companies like AT&T; we 

have Internet companies, many of whom are represented on the 

panel today; and other organizations, including Americans for Tax 

Reform and the ACLU, among many other members that I haven’t 

mentioned. 

The coalition has proposed a set of common sense principles for 

updating ECPA. The reforms seek to preserve the structure of the 

statute and certainly the tools needed by law enforcement to perform their important functions, but are intended to ensure that the 

protections afforded to data stored in the cloud are no less than 

those extended to data stored in the home or in the office. 

Cloud computing is a new term, as has been noted, but most of 

us use cloud services every day even if the label isn’t particularly 

familiar to us. When you use the Web to send an e-mail, to edit 

a document, or to manipulate a calendar, as Professor Felten has 

reflected to us, you are actually using cloud computing services. 

The services now are very robust and very feature-rich. In fact, 

many companies are moving their entire I.T. infrastructure into 

the Internet-based cloud and getting the functionality through 

service providers. Shifting all of these computing tasks from our 

desktops to cloud providers offers tremendous social benefits, tremendous economic benefits, and security benefits. 

Today’s technology bears little resemblance to the mainframe 

computers of the 1980’s. Back then remote computing and storage 

were rare luxuries for companies, usually used for bulk processing, 

like payroll services or data backup. ECPA has not kept pace with 

the rapid technological advances that we have enjoyed in the last 

few years, and as a result the problems are becoming obvious. 

One example that has been alluded to already: Under ECPA the 

government must obtain a warrant to get the content of an e-mail 

18 

that is no older than 6 months, but for older messages the government can simply issue a subpoena, obviously without a judge’s approval, to compel the production of the e-mail’s content from a provider. Under the Department of Justice’s interpretation of ECPA, 

which has been rejected by the 9th Circuit, opened e-mail, regardless of the age, can be obtained using that lower subpoena standard. 

Distinguishing the privacy protections of e-mail based on age and 

by access of the user makes no sense today. In 1986 perhaps it did. 

Remote storage was so expensive that users rarely stored messages 

for very long; they either downloaded or deleted the messages soon 

after receiving them. Today people often keep messages and mail 

for indefinite periods of time, possibly forever. 

With Gmail, which is Google’s free mail service, Google offers 

enough free storage that space constraints are not a reason ever to 

delete an old mail. Many of our users have messages going back 

to when Gmail was launched over 6 years ago. Gmail accounts 

have essentially become the filing cabinets of today. 

The example reveals how parts of ECPA need to be updated for 

the 21st century. The Digital Due Process proposal would go far toward achieving that goal. Advances in technology depend not just 

on smart engineers, but also on smart laws that will not stand in 

the way of continued innovation and adoption of technology. 

I thank the Subcommittee for giving the attention to this issue 

and urge you to help bring ECPA into the Internet age. Thank you. 

[The prepared statement of Mr. Salgado follows:] 

19 

PREPARED STATEMENT OF RICHARD SALGADO


RS-1.eps
20 


RS-2.eps
21 


RS-3.eps
22 


RS-4.eps
23 

Mr. NADLER. I thank the gentleman. 

I now recognize Mr. Hintze? 


RS-5.eps
24 

TESTIMONY OF MIKE HINTZE, ASSOCIATE GENERAL 

COUNSEL, MICROSOFT CORPORATION 

Mr. HINTZE. Chairman Nadler, Congressman Franks, Chairman 

Conyers, honorable Members of the Committee, thank you for the 

opportunity to discuss Microsoft’s perspectives on ECPA reform. 

We appreciate the attention with which this Subcommittee has approached the issue and we are committed to working with you, law 

enforcement agencies, and other stakeholders to ensure that we responsibly update ECPA for the era of cloud computing. 

ECPA was enacted into law in 1986 to address the issues being 

raised by new digital technologies. What are the appropriate standards under which law enforcement can compel service providers to 

disclose customer content and account information? ECPA addressed this issue by striking a balance between the legitimate 

needs of law enforcement and the public’s reasonable expectations 

of privacy. 

Technology has changed dramatically since 1986. Today we are 

in a new era of computing, one in which users are empowered to 

store unprecedented amounts of digital information online. 

This cloud computing revolution creates numerous benefits. It 

makes businesses more efficient and competitive by enabling companies of all sizes to access cutting-edge computing resources. It facilitates collaboration through anytime, anywhere access. And it 

provides new opportunities for innovation and job creation. 

Microsoft has participated actively in this transformation. We 

come to the issue of ECPA reform as a provider of desktop and 

server software that has moved into hosting online cloud-based 

services. 

Our history gives us a clear perspective on how ECPA has failed 

to keep pace with the technological time. Take the example of email. As we have heard, ECPA extends greater privacy protections 

to e-mail stored less than 180 days than e-mail stored for more 

than 180 days. 

For many years this distinction made sense. Even 10 years after 

the enactment of ECPA Microsoft was offering the first version of 

Microsoft Exchange, software in which a user typically would 

download e-mail to a local machine for it to be read and stored, 

after which it would no longer reside on the server. Because the email typically was downloaded to a local drive it was reasonable to 

conclude that e-mail left with a service provider for more than 180 

days was abandoned with little expectation of privacy. 

But shortly thereafter, in 1997, we acquired Hotmail, a Webbased e-mail service that enabled e-mails to be stored online or in 

the cloud for longer periods of time. This ability to retain e-mails 

online even after they were read began to call into question the justification for the 180-day distinction. Even then, however, the 

amount of storage available online was quite limited. 

But since 1997 the amount of online storage available to consumers has progressively increased to the point where it has become essentially unlimited. Today users regularly store e-mails and 

attachments, including photos, documents, and other data, online 

for years, and these users reasonably expect that this data will be 

just as private on day 181 as it was on day 179. 

25 

These concerns are not limited to individual consumers. Enterprises of all sizes are increasingly using products like Microsoft 

Business Productivity Online Suite to store their e-mail and confidential business documents in the cloud, but we regularly hear 

from enterprises considering the move to the cloud that doing so 

could negatively impact their privacy protection. 

In short, the balance Congress struck in 1986 has fallen out of 

alignment, putting more and more user data within the reach of 

law enforcement tools that require lower burdens of proof. This 

trend has serious potential consequences. 

Users will be deterred from adopting cloud services if they do not 

trust their data and will be kept private and secure in the cloud. 

In addition, cloud service providers will hesitate to invest in new 

innovation if there are not clear rules that make sense in the context of this evolving technology. 

To restore the balance the Congress struck in 1986 Congress 

should revisit ECPA and ensure that users do not suffer a decrease 

in their privacy protections when they move their data to the cloud. 

We believe that the principles advanced by the Digital Due Process 

coalition will enable citizens to trust their data will be subject to 

reasonable privacy protections while at the same time preserving 

the ability of law enforcement to collect the information necessary 

to protect the public. The principles will also provide greater clarity 

for all stakeholders, and we see them as a good starting point for 

the discussion. 

As Congress takes up the important issue of ECPA reform we believe it should also look at privacy and security issues related to 

cloud computing in the broader policy context. Users of cloud computing services must have confidence that their data will be kept 

secure and private not just vis-a-vis the government but also with 

respect to service providers and other third parties. The importance 

of protecting privacy and security also extends beyond the United 

States and can be impacted by the laws of other governments. 

To address these concerns Microsoft has proposed that Congress 

consider comprehensive legislation that advances privacy and security in the context of cloud computing, and in turn helps to promote 

confidence in the cloud. 

Thank you for the opportunity to testify today. Microsoft appreciates the Subcommittee’s leadership, and we look forward to working with you on these important issues. 

[The prepared statement of Mr. Hintze follows:] 

26 

PREPARED STATEMENT OF MICHAEL HINTZE


MH-1.eps
27 


MH-2.eps
28 


MH-3.eps
29 


MH-4.eps
30 


MH-5.eps
31 


MH-6.eps
32 


MH-7.eps
33 


MH-8.eps
34 


MH-9.eps
35 


MH-10.eps
36 


MH-11.eps
37 


MH-12.eps
38 

Mr. NADLER. I thank the gentleman. 

Mr. Schellhase is now recognized. 


MH-13.eps
39 

TESTIMONY OF DAVID SCHELLHASE, EXECUTIVE VICE 

PRESIDENT AND GENERAL COUNSEL, SALESFORCE.COM 

Mr. SCHELLHASE. Chairman Nadler, Chairman Conyers, Congressman Franks—oh yes, I am sorry—thank you for holding this 

hearing and inviting me to share my views with you. 

Cloud computing is emerging as a powerful engine for economic 

growth and jobs and it is important that we create a policy framework that supports it. Salesforce.com, my employer, is a leading enterprise cloud computing company that provides Internet-based 

business applications primarily for helping to automate sales and 

customer support functions to organizations of all sizes around the 

world. 

Instead of building and maintaining costly I.T. infrastructure our 

customers simply log onto our Web site and access our cloud services using a unique username and password. Over 82,000 organizations globally, including numerous U.S. Federal Government agencies and businesses in highly regulated industries, trust 

Salesforce.com to store and process their data. 

In my remarks today I will make reference to the enterprise 

cloud computing model. In doing so I will emphasize two points: 

First, U.S. public policy should support cloud computing because it 

is a powerful driver of economic growth and job creation. Second, 

in order to build confidence in cloud computing the rules for government access to data held in the cloud should be the same as for 

data held on premise. 

Every major analyst firm believes that cloud computing will see 

explosive growth. Gartner Group estimates that the worldwide 

market for cloud services will be worth $148 billion by 2014, and 

a recent Goldman Sachs report called the shift toward cloud computing ‘‘unstoppable.’’ 

Just as the electric power grid paved the way for the rise of the 

modern business economy, cloud computing is paving the way for 

the 21st century digital economy. By unleashing innovation and 

productivity cloud computing will create jobs not only in the technology industry but also create jobs in sectors as diverse as manufacturing, health care, and government. Cloud computing has already spawned scores of new companies, and as the market for 

cloud computing accelerates Congress should adopt policies that 

support the cloud computing model or, at a minimum, that do not 

discriminate against it. 

Government has a very legitimate—has very legitimate reasons 

to access privately-held data for such purposes as fighting crime 

and preventing terrorist attacks. In order to generate public confidence in the way that the government obtains this access, however, it is essential that the guidelines for them be applied in a predictable way that is appropriately transparent. 

At Salesforce.com we create trust in our cloud computing applications by maintaining robust security practices based on international standards, hosting a public Web site that shows the performance and trust of our system on a daily basis, and contractually agreeing to keep our customers’ data confidential with exceptions for due process of law. For many customers these actions are 

all the evidence they need to determine that they can trust the privacy and security of our data—of our cloud services. 

40 

For others, however, especially those outside the United States, 

these actions are not enough. These customers want something 

more. They want assurances that the U.S. government will not access their data without appropriate due process. 

At Salesforce.com we face this issue on a regular basis, principally from customers who believe that the current regulatory 

framework permits the U.S. government overly broad access to 

data stored in the cloud. We need to have clear laws that prove 

that this belief is unfounded. 

As a company, Salesforce.com cannot make representations to its 

customers that government will not gain access to data. What we 

can do is point to the legal process that the government must undertake to access data held in the cloud. This is where reform of 

the Electronic Communications Privacy Act is so crucial. 

Because ECPA codifies guidelines for U.S. government access to 

data it sends a clear signal to other countries about the confidentiality of data held in the cloud. As a result, it is important that 

Congress update ECPA to clarify that data stored and processed in 

the cloud on behalf of a customer has the same protections and 

standards for law enforcement access as data stored locally by that 

customer. 

As Congress contemplates ECPA reform it should embrace the 

concept of technology neutrality. In practice, technology neutrality 

that a particular kind of information will receive the same level of 

protection regardless of the technology platform or business model 

used to create, communicate, or store it. We are not asking for special treatment for data in the cloud, but rather for equal treatment. 

In order to assure technology neutrality in private communications, documents and other private user content stored in or transmitted through the cloud should be subject to the same warrant 

standard that the Constitution and the Wiretap Act have traditionally provided for privacy of our phone calls or the physical files we 

store in our homes. In practice, this recommendation would mean 

that the government must obtain a search warrant based on probable cause before it can compel a service provider to disclose a 

user’s private communications or documents stored online. 

By making sure that ECPA is technology neutral Congress can 

send a clear signal to individuals, companies, and governments 

around the world that they can safely use cloud computing platforms. We believe that doing so will unleash a wave of innovation 

and productivity that will drive economic growth and create jobs 

for years to come. 

Thank you. 

[The prepared statement of Mr. Schellhase follows:] 

41 

PREPARED STATEMENT OF DAVID SCHELLHASE


DS-1.eps
42 


DS-2.eps
43 


DS-3.eps
44 


DS-4.eps
45 


DS-5.eps
46 


DS-6.eps
47 


DS-7.eps
48 


DS-8.eps
49 


DS-9.eps
50 


DS-10.eps
51 


DS-11.eps
52 


DS-12.eps
53 


DS-13.eps
54 


DS-14.eps
55 

Mr. NADLER. Thank you. 

I will now recognize Mr. Robinson. 

TESTIMONY OF PERRY ROBINSON, ASSOCIATE GENERAL 

COUNSEL, RACKSPACE HOSTING 

Mr. ROBINSON. Thank you, Mr. Chairman, Members of the Committee. Thank you for taking the time to address this important 

matter. 

I am here on behalf of Rackspace Hosting, and unlike many of 

the other panelists, which are household names—is that a little bit 

better?—which are household names, Rackspace is a smaller organization. Provide just a little bit of background: We are a company 

that is based out of San Antonio, Texas. We were founded in 1998 

by four college students. 

Over the time we have grown. We have now got about 3,000 employees. We employ people in San Antonio, Texas; Austin; Chicago, 

Illinois; Herndon, Virginia. And we have had this growth in part 

due to the growth of the cloud. Rackspace is invested heavily in 

cloud technology and offers cloud servers, cloud sites, and cloud 

files to its customers. Now, I provide this information as background to the context in which ECPA applies to a company such 

as ours, which is an emerging organization. 

So I would also like to briefly explain some examples of how 

Rackspace provides cloud computing technology to its customers. 

Cloud technology can be somewhat challenging, I think, to understand at first. 

The concept at a high level, though, can also be very simple. In 

fact, for many consumers they are not aware of the times at which 

they are actually using cloud technology. 

To oversimplify the concept a bit, cloud servers is kind of like a 

motor pool, right, in which a vehicle is provided at just the right 

time for your use. Its function is the same as a physical vehicle but 

it has essentially been virtualized through computing code. 

The fact that this virtual instance is virtual and not physical in 

nature, though, doesn’t change the experience of the consumer 

itself. And so the end user of this technology oftentimes has the 

same understanding of the rights and implications of this use of 

technology as they would any other traditional form of communication. 

Cloud storage, on the other hand, makes use of file technology 

to provide storage which is provided through a connection to the 

Internet. Many applications, or apps, on mobile devices and telephones make use of such cloud storage. An example of such storage 

might be the storage of documents which are created on a mobile 

device or, as Professor Felten was saying, the use of an online calendar. 

For many of its customers Rackspace provides the base technology on which her customers are able to develop the use of cloud 

servers or cloud storage for the development of their businesses. 

Our customers are often businesses who are, themselves, providing 

services to an end user. Now, the complication here is that as you 

move down the chain you have a process which goes from the provider of the cloud services down to an end user and there is—and 

that created a gap, sometimes, in which, again, the end user 

56 

doesn’t always have an absolute understanding of how the technology is actually provided to them. 

In each case there are expectations by these users that their use 

of this technology—of cloud servers, of cloud files—is subject to control of the end user itself and that the content will not be accessed 

by third parties or others unless permission has been granted. This 

privacy expectation is a fundamental aspect of the acceptance of 

cloud technology. 

Rackspace believes that ECPA has fallen behind these advances 

in technology. To be clear, Rackspace does not believe that ECPA 

is flawed in its intent and does not seek to change the balance of 

the individual interests and the privacy of their electronic communication with the needs of law enforcement. 

However, Rackspace does see ECPA as having fundamentally 

failed to maintain pace with changes in technology. As a result, 

there is a great deal of confusion regarding the level of protection 

afforded to end users which is stored on or accessed through the 

cloud. 

These concerns translate to hesitancy regarding the adoption of 

cloud technology despite the benefits, the flexibility, and cost savings that it provides. They have a financial impact on the growth 

of businesses such as Rackspace, Rackspace’s other customers, and 

quite frankly, they have an impact on, potentially, the economy 

itself. 

Rackspace believes now is the time to update ECPA and to bring 

clarity and predictability to the law so that people will know what 

protections are afforded to their data and their use of their technology, thereby allowing the sector to grow and create jobs and 

help drive the economy forward. 

Thank you for your time. 

[The prepared statement of Mr. Robinson follows:] 

57 

PREPARED STATEMENT OF PERRY ROBINSON


PR-1.eps
58 


PR-2.eps
59 


PR-3.eps
60 


PR-4.eps
61 


PR-5.eps
62 


PR-6.eps
63 

Mr. NADLER. Thank you. 

And we will now hear from—I will now recognize Mr. Misener. 


PR-7.eps
64 

TESTIMONY OF PAUL MISENER, VICE PRESIDENT FOR 

GLOBAL PUBLIC POLICY, AMAZON.COM 

Mr. MISENER. Thank you very much, Mr. Chairman, and Mr. 

Franks, and Chairman Conyers, and Members of the Subcommittee. My name is Paul Misener, and I am Amazon.com’s vice 

president for global public policy. On behalf of our company and 

our millions of customers, thank you very much for inviting me to 

testify on this important hearing. 

Amazon.com Web site began in 1995 as a place to buy books. 

Since then we have strived to be earth’s most customer-centric 

company where people can find and discover virtually anything 

that they may want to buy online. Now Amazon Web Services provides a family of cloud computing functions to small and large businesses, government agencies, academic institutions, and other 

users. 

Cloud computing, as others have described for the Subcommittee, 

is a means of providing, through the Internet, computing functions 

similar to what a desktop or laptop computing can provide but far 

more efficiently and reliably, and at much greater scales and 

speeds. For example, desktop PCs can store files like memos, 

spreadsheets, digital photos, and music. So can cloud computing 

services, only much more efficiently and reliably. 

A desktop computer’s hard drive can crash, for instance, potentially deleting files. Cloud computing storage done well, however, 

is redundant, and thus files are far more durable and the chance 

of unintentionally deleting them is virtually nil. 

Amazon offers data storage as Amazon Simple Storage Service, 

or S3. This service can be used to store and retrieve any amount 

of data at any time from anywhere on the Web. S3 gives users access to the same highly scalable, reliable, secure, fast, inexpensive 

infrastructure that Amazon uses to run its own global network of 

Web sites. 

The service aims to maximize benefits of scale and pass those 

benefits to users. In one example a company called ElephantDrive 

uses Amazon S3 storage to pride consumers an inexpensive way to 

make backup copies of digital files. 

Likewise, desktop PCs can perform calculations on data. Although many of us never perform calculations much more complicated than with spreadsheets, small and large businesses, researchers, and government agencies often need to perform complicated and data-intensive calculations. 

Desktop PCs are often not up to the task, and even dedicated 

local workhorse computers often can’t deliver satisfactory results or 

are a cost-prohibitive capital investment. Cloud computing, on the 

other hand, can provide virtually unlimited computation capacity 

that may be rented as needed rather than obtained through a 

large, wasteful, up-front capital expenditure that requires expert 

setup and maintenance and rapidly becomes obsolete. 

Amazon also offers a service known as Amazon Elastic Compute 

Cloud, or EC2, that is designed to make Web-scale computing easier. Just as S3 enables storage in the cloud, Amazon EC2 enables 

compute in the cloud. 

The EC2 Web interface allows users to obtain and configure capacity and control computing resources. Users may quickly scale up 

65 

capacity—and then down—as their computing requirements 

change, and they pay only for the capacity that they actually use. 

In one case an engineer at The Washington Post used the equivalent of over 1,400 server hours on EC2 to convert over 17,000 pages 

of First Lady Hillary Rodham Clinton’s newly-released documents 

into a Web-friendly format within just 9 hours and for less than 

$150. 

The benefits of these and other cloud computing services to businesses large and small, government agencies, to researchers, and 

other organizations are manifest. The power of expensive and complicated computer hardware is available immediately on a pay-asyou-go basis. No longer must an enterprise expend capital up front 

and endure delays. And the computing capacity is completely elastic, scaling up in time of high demand and down as appropriate. 

Bottom line, with cloud computing enterprises can focus their engineering resources on their own specialties. No longer must they 

manage the difficult tasks of building and maintaining computer 

infrastructure. 

Accordingly, we believe that it is in the public interest to ensure 

that there are no inappropriate legal impediments to cloud computing and that applicable law, including ECPA, is clear and current. We appreciate the Subcommittee’s interest in this matter and 

the investigation of whether and how ECPA should be modified. 

Amazon is a member of the Digital Due Process coalition, which 

has proposed clarifications of ECPA in four areas, covering requests for: one, the content of electronic communications; two, location information; three, real-time transactional data about communications; and four, broad information requests about broad categories of users. Although we are aware, for example, that the 

standards applied to location information may need clarification 

our experience primarily relates to requests for the content of communications, as a provider of remote computing service. 

With respect to the content of electronic communications we believe that ECPA requires law enforcement authorities to obtain a 

search warrant to compel disclosure. We do not release information 

without valid process and have not disclosed content without a 

search warrant. 

In order to protect the privacy of communications we certainly 

agree with our fellow members of the Digital Due Process coalition 

that this is how the law should operate: compelled disclosure of 

content should require a search warrant, just as obtaining content 

out of a person’s desk drawer would. If there is any significant ambiguity in ECPA, such as with respect to the age of a communication, we would support legislation to clarify that compelled disclosure of content may only come as a result of a search warrant, regardless of the age of a communication. 

Thank you again for the opportunity to testify on the important 

topic of cloud computing services. Amazon believes that these new 

services have important societal benefits, and if laws such as ECPA 

should be clarified to address cloud computing we support the effort. 

[The prepared statement of Mr. Misener follows:] 

66 

PREPARED STATEMENT OF PAUL MISENER


PM-1.eps
67 


PM-2.eps
68 


PM-3.eps
69 


PM-4.eps
70 


PM-5.eps
71 

Mr. NADLER. Thank you very much. 

We will now begin the questioning by—I will recognize myself for 

the 5 minutes. 

Professor Felten, in your testimony you described the many ways 

you use cloud computing technology and services in your professional and personal life. When you think about your and society’s 

digital life now as compared to 1986 do you think that ECPA’s 

1986 concept of electronic communications service and remote communications service accurately reflect network usage today, and if 

not why not? 

Mr. FELTEN. I think not. In 1986 it made more sense, in terms 

of people’s use of these services, to separate communication and 

computing into separate products and separate mental categories, 

but these days these computation, storage, and communication are 

really integrated together to provide a unified product that meets 

some need of the end user for managing a calendar, or document 

collaboration, or whatever it is that the user is wanting. Users 

often don’t think about and often don’t know what is happening behind the scenes to make all this work, and so it is a line that is 

not visible to a lot of the decision-makers, and it makes a lot less 

sense than it did then. 

Mr. NADLER. Thank you. And you also, in your testimony, discussed the fact that it may be difficult for a user to tell whether 

or not his or her data is stored in the cloud because cloud services 

can offer nearly the same user experience as local servers. And as 

someone who uses a computer all the time and never heard the 

phrase ‘‘cloud computing’’ until a few weeks ago I certainly never 

think about—or certainly never thought about—whether it is in the 

cloud or not. 

Elaborate on this concept, and how might a user be unaware or 

unsure of whether or not he is working or operating in the cloud, 

and why should it make a difference to him? 

Mr. FELTEN. Well, at one level it should not make a difference 

to the user as long as the job that they want done is being done 

well. It may prove to make a difference to the user if there is a 

legal line that gets drawn. 

But increasingly what users are after is the experience of solving 

their problem, doing their job without having—— 

Mr. NADLER. And they don’t care how it is done. They just care 

about the result; they don’t care how the problem is solved. 

Mr. FELTEN. Absolutely. 

Mr. NADLER. Thank you. 

Mr. Salgado and perhaps Mr. Hintze, my understanding is the 

Stored Communications Act, and specifically the electronic communications service and remote communications services distinctions 

can be difficult to apply to many of today cloud-based services, as 

Professor Felten just said. And of course, under the law ECS provides greater privacy protection than RCS. 

What position do you generally take regarding classifying services or information as either ECS or RCS and the legal process you 

require before disclosing information when you get law enforcement 

requests for the following: Web mail search—on the one hand, Web 

mail search, word processing, online photo video storage services, 

and on the other, names or I.P. addresses of users who search for 

72 

a specific phrase? And in answering the question, please indicate 

whether you must make creative arguments or take an aggressive 

view of the law in order to provide great privacy protections to your 

customers—in order to provide the privacy protections you thing 

they require. 

Mr. Salgado first? 

Mr. SALGADO. Thank you, Mr. Chairman. The question is complicated because of how the ECPA is written, so I apologize at the 

beginning for probably not being able to address each one of those 

categories, but it is the very fact of the complexity of ECPA that 

makes that difficult to answer. 

In in ideal world I would like to be able to tell you, this is the 

type of legal process we require for all those types of information 

and it is a result of a—it is the result of a thoughtful balance and 

a consideration of the equities of law enforcement and the interests 

of the users and the providers. That is not the situation and so the 

result is, as you list these different products each one of those requires a separate legal analysis, oftentimes requiring consulting 

with outside counsel, pulling out the statute again, rereading the 

statute to figure out what type of legal process is required for what 

types of data. 

The distinctions between RCS and material and ECS material 

are often arbitrary, and even within the category of ECS material—electronic stored material—the definition is so tiered and 

complex there is nothing intuitive about it. It often turns on whether the communication is, using the terms of the statute, in electronic storage. And I think a lot of people, if you ask them, ‘‘What 

does it mean to be in electronic storage?’’ would answer, ‘‘It means 

to be stored electronically,’’ and they would be wrong. And in fact, 

they would have to look at the statute to understand that that 

term is actually a very complex, tiered test to figure out whether 

something is in electronic storage for the purposes of the statute. 

This is where the 180-day rule comes in. That is the part of the 

definition of electronic storage. So the question you ask is a complex one because the statute doesn’t make it an easy answer. 

I think the Digital Due Process coalition members believe the answer to that should be, it requires a search warrant. It should require a search warrant. 

Mr. NADLER. And Mr. Heintz, would you comment on the same 

question? In particular, indicate whether your experience has necessitated the use of what one might call creative arguments or an 

aggressive view of the law in order to do your job properly. 

Mr. HINTZE. Certainly. I would be happy to. I would point out 

that, as Mr. Salgado’s experience as both a prosecutor and in business having trouble answering these questions, you know, I think 

that is indicative of the fact that all of us do and these are very 

complicated matters. 

You know, the various types of data that may become an issue 

here—of those probably the ones that ECPA speaks to most clearly 

would be e-mail, because that was one of those things that was 

contemplated at the time that ECPA was drafted. But as we have 

heard, the way e-mail is used has changed dramatically since 1986 

and a lot of those distinctions make—no longer make sense, although I think it is quite clear that e-mail is an ECS under ECPA 

73 

and the content of a message and the subject line would be considered content and protected by the warrant statute standard up to 

180 days or up to when it has been opened, except for in the 9th 

Circuit where it is—so crystal clear, right? 

Other services are even more difficult to discern and what the 

various levels of protection might be depending on the nature of 

the service, the nature of the data, the timeframe under which it 

has been stored electronically, what circuit you happen to reside in. 

Mr. NADLER. And all this is carefully considered in the privacy 

expectations by the customer, right? 

Mr. HINTZE. Yes, absolutely. 

You know, I think also, you know, some of these questions are 

theoretical. You know, the bulk of the requests we get from law enforcement are for traditional communications, e-mail. Some of these 

things we just simply haven’t gotten requests. 

But you look at new services like search that both Google and 

Microsoft provide, and the question is how that applies under these 

definitions. I mean, looking at the definitions you would have no 

idea. There are arguments that could be made in different ways. 

I mean, we think probably the best interpretation of search 

under ECPA is that the query itself would be content, yes, but you 

know, trying to find that and trying to discern that in the statute 

is very difficult. That is why we—one of the reasons we support the 

Digital Due Process coalition principles is that it makes those distinctions. While it doesn’t touch the definitions, per se, it says that 

all content, whether the content of a search query or the content 

of an e-mail, the content of your documents would be protected by 

the warrant standard for probable cause. 

Mr. NADLER. Thank you. 

Let me ask Mr. Schellhase and Mr. Robinson, both of your firms 

have indicated in your written testimony that you have customers 

who are concerned that the U.S. government has overly-broad access to their data that is stored in the cloud. What you appear to 

be saying is that overly-broad U.S. government access to data is a 

consideration for some customers in determining whether they 

should put their information in the cloud. 

How does such a concern affect your business model? How do you 

address this concern with your customers? What aspects of ECPA 

reform could address this issue specifically? 

Let me add one other thing: Why should we protect people who 

want to keep secrets from the government? Isn’t that for no good 

purposes? 

Mr. SCHELLHASE. I will answer first, Mr. Chairman. I think in 

part what we fight largely is a perception problem, right? And 

there is a perception on the part of many of our European customers and prospects that the U.S. government has undue access 

to data—— 

Mr. NADLER. More from European than from the American customers? 

Mr. SCHELLHASE. Yes. Much more from European customers. 

But nevertheless I think, you know, the defense that we fall back 

on, as I mentioned in my testimony, is we provide contractual assurances but we also look to the U.S. to have appropriate due process around accessing data, and so that—you know, so any consistVerDate Aug 31 2005 12:07 Dec 15, 2010 Jkt 000000 PO 00000 Frm 00077 Fmt 6633 Sfmt 6601 H:\WORK\CONST\092310\58409.000 HJUD1 PsN: DOUGA
74 

ency and reinforcement of consistency in the law benefits us when 

we sell to customers who have this perception. 

Mr. ROBINSON. Yes, a similar situation on Rackspace’s side. A 

good deal of my time is spent each week explaining to customers, 

both from the United States and customers in Europe and Canada, 

Australia, basically all over the world, exactly what circumstances 

in which their data may be accessed, right? And what becomes difficult is with the current state of the law, with ECPA that answer 

is not easy, right? And so it makes it a very challenging discussion. 

The answer, quite frankly, is if we are required by law to provide 

your information over we will have to do that. They say, ‘‘Okay, in 

what circumstance?’’ 

Well, that is a very long conversation. Where would you like to 

start? You get into the specifics of how ECPA applies and, you 

know, as some of the other panelists have mentioned you have to 

start at times, you know, going back to the statute, considering, 

you know, bringing in outside counsel especially. 

This makes it challenging to do business, and quite frankly it has 

an impact on our ability for our product. 

Mr. NADLER. Thank you very much. 

My time is expired. I now recognize the gentleman from Arizona. 

Mr. FRANKS. Well, thank you, Mr. Chairman. It seems like this 

is a pretty important subject. 

It occurs to me that even programs and whole systems essentially could eventually be completely operated in the cloud and all 

of the programs could be updated from there, even operating systems where you only have an Internet operating system intervening between the customer and the cloud. And it is a pretty impressive technology and so it does seem to be a very, very important trend. 

And I guess I will start out by asking you, Mr. Hintze—and I am 

assuming it is Hintze and not Hintze, correct? 

Okay, Mr. Hintze, you state that in a poll conducted by Microsoft 

earlier this year that 90 percent of the general population and senior business leaders say that they are concerned about the security 

and privacy of data as it relates to cloud storage, and I guess my 

question is, does this number specifically relate to concern about a 

government intruder or is this number broader to include criminals 

and other individuals seeking to hack into the cloud, and is that 

a significant issue? 

Mr. HINTZE. It certainly is a significant issue, and that number 

encompasses both. People are concerned about the impact on their 

privacy and security of their data as they put it in the cloud. 

Whether that is from the government, whether it is from the service provider itself, or whether it is from nefarious actors outside of 

the service provider who are trying to get into it. 

That is one of the reasons that we support a broad approach to 

addressing these privacy issues and security issues in the cloud. In 

addition to privacy vis-a-vis the government we think that there is 

a role for Congress in ensuring privacy vis-a-vis service providers’ 

own practices, which support broad privacy legislation affecting the 

private sector. 

We think that law enforcement should be given tools to go after 

the hackers who are trying to get into the cloud. We think there 

75 

is a role for giving service providers a private right of action to go 

after those malicious actors as well, and other similar enhancements of security online. 

And then, as I mentioned in my oral testimony, these issues are 

not simply U.S.-focused as well, and we think that as cloud infrastructures grow and data crosses borders we are seeing increasing 

challenges with respect to the laws of a foreign government that 

create conflict of laws issues, distinctions between law enforcement 

and privacy, and data retention and privacy, and we think there 

is a role for Congress to encourage the Federal Government to engage on a bilateral and multilateral basis to address some of those. 

Mr. FRANKS. Well, it takes me in a little different direction where 

I was going, but let me go ahead and ask this based on some of 

your comments: While the cloud would be subject to the jurisdiction 

of the United States, you know—or I guess that is if the cloud resides in the United States—wouldn’t a U.S.-based cloud with 

heightened access requirements for law enforcement be potentially 

a haven for laundered or data hiding, or would this be especially 

attractive to foreign customers as a result? In other words, does it 

represent any sort of a vulnerability for data to be stored in a cloud 

here in the United States and sort of hidden away based on some 

nefarious or malevolent purpose? 

Mr. HINTZE. As we have heard from other panelists today, today 

the concern is that the standards around government access to 

data may be lower than in other places, so there is a concern from 

foreign customers particularly about doing business with U.S. providers, which makes it challenging for us to sell our products and 

services to customers outside the United States. 

With the Digital Due Process coalition proposals we think that 

will bring more clarity and bring the statute back into balance and 

line with where the judgments were made between the interests of 

privacy and law enforcement back when they were in 1996. We 

view it as a fairly modest proposal, not one that would create such 

high barriers that the United States would be looked at as some 

kind of data haven that Switzerland—— 

Mr. FRANKS. I understand. 

Mr. HINTZE [continuing]. Computing. 

Mr. FRANKS. Well, Professor Felten, you state that even those 

few who don’t know or don’t even use the Internet or don’t have 

cell phones will still leave an extensive electronic trail online, including their health records and financial records, you know, and 

I guess I would ask you to elaborate both on the cell records that 

we leave, our health care records, all of the records that we leave 

just as a matter of doing everyday activities. 

Are those things left in the cloud somewhere? Is there a way to 

ever completely erase them? And in terms of the actual practice— 

and I don’t want to make this too complicated—of law enforcement, 

does law enforcement on a routine basis ask for that data that is 

just kind of somewhere out there floating without a clear reference 

point? 

Mr. FELTEN. Well, as to what data there is and where it might 

be stored, I as a consumer have little idea. Most businesses keep 

extensive records of the interactions they have with their customers. That is true in a lot of areas such as health care as well. 

76 

Cell phone companies have records which they keep for some 

length of time about the location and movement and calls, and so 

on. And in today’s world where computer storage is so cheap the 

default, in a lot of cases, is to keep everything in the hopes that 

there might be a business use for it. 

And so I think it is very difficult for consumers to really know 

exactly what exists, but as more things go online and as areas like 

health care move toward electronic records and toward networking 

you are going to see more and more of the characteristics of the 

cloud emerging there as well. 

Mr. FRANKS. But do you think—and I throw this last question 

out, Mr. Chairman, to anyone to—do you think that there is a vulnerability in general for the myriad amounts of information that 

represent text messages, and pictures, and things that people send 

all the time? Is that something that is regularly or even irregularly 

accessed by either law enforcement or hackers, or just in general? 

I mean, how safe is our information out there right now? Is it 

something where a lot of it is compromised? 

Mr. FELTEN. Certainly there are compromises and it is something that we should be concerned about. There are a lot of different types of data and they can be mosaicked together to get a 

lot of information about what people are doing, and especially to 

track down people who might have special concerns about being 

victims of crimes. I think it is an issue that is important even beyond the scope of ECPA. 

Mr. FRANKS. Mr. Chairman, it is an important issue and I yield 

back. 

Thank you all. 

Mr. NADLER. Thank you. 

I would like to follow up one thing Mr. Hintze said. You mentioned private right of action by victims of hackers? 

Mr. HINTZE. Among the things we have supported would be a 

private right of action for cloud service providers to go after—— 

Mr. NADLER. Cloud service providers. Does the victim already 

have that private right, does he not? 

Mr. HINTZE. I think under some cases that might be the case. We 

do think that the service providers have the resources and the incentives to really go after the hackers—— 

Mr. NADLER. And they don’t have that private right of action? 

Mr. HINTZE [continuing]. Private right of action today under the 

Computer Fraud and Abuse Act. 

Mr. NADLER. Thank you very much. I want to thank this panel 

for their expert testimony, and thank you. 

And let’s seat the second panel. We are going to have a series 

of votes in a few minutes but we can get some of this done before 

that series of votes. 

And again, thank you to the members of the first panel. 

We will now proceed with our second panel. I would ask the witnesses to take their places. In the interest of time I will introduce 

the witnesses while they are taking their seats, although I see they 

have already done that. 

Kevin Werbach is an associate professor of legal studies at the 

Wharton School, University of Pennsylvania. Professor Werbach coled the review of the Federal Communications Commission for the 

77 

Obama administration’s presidential transition team and was an 

advisor in broadband issues to the FCC and the National Telecommunications and Information Administration. 

Earlier in his career he served as counsel for new technology policy for the FCC during the Clinton administration. Professor 

Werbach received his J.D. from Harvard University and his B.A. 

from University of California at Berkeley. 

Fred Cate is the distinguished professor and C. Ben Dutton professor of law, adjunct professor of informatics and computing, and 

director of the Center for Applied Cybersecurity Research at Indiana University. 

I won’t ask you today, but sometime you will tell me what 

informatics is. 

Professor Cate served as a member of the National Academy of 

Science’s committee on technical and privacy dimensions of information for terrorism prevention, counsel to the Department of Defense technology and privacy advisory committee, and as a member 

of the Federal Trade Commission’s advisory committee on online 

access and security. He earned his undergraduate and law degree 

from Stanford University. 

Senior Investigator Thomas H. Hurbanek—and I hope I got that 

right—is a 24-year veteran of the New York State Police. He has 

been assigned to the state police computer crime unit since 1997, 

working on investigations and forensic cases involving computers 

and technology. His current assignment involves supervising the 

cybercrime and critical infrastructure response section of the computer crime unit, working jointly with Federal and state agency 

partners to respond to incidents impacting New York’s computing 

infrastructure. 

Kurt Schmid has been a law enforcement official for 40 years and 

currently serves as the executive director of the Chicago High Intensity Drug Trafficking Area, or HIDTA, program. Previous to this 

assignment Mr. Schmid served as senior law enforcement advisor 

for the Counterdrug Technology Assessment Center and the national director of the HIDTA program in the White House Office of 

National Drug Control policy in Washington for 10 years. 

Marc Zwillinger is a founding partner of Zwillinger Genetski, 

LLP, where for 10 years his practice has focused on issues related 

to Electronic Communications Privacy Act, the Wiretap and Communications Act, surveillance law and privacy. Previously Mr. 

Zwillinger ran the privacy and security practice groups at 

Sonnenaschein Nath & Rosenthal and at Kirkland & Ellis. 

Prior to that he served 3 years as a trial attorney in the computer crime and intellectual property section of the criminal division of the Department of Justice. Mr. Zwillinger earned his J.D. 

magna cum laude from Harvard Law School. 

I am pleased to welcome all of you. Your written statements will 

be made part of the record in their entirety. I would ask each of 

you to summarize your testimony in 5 minutes or less, and I presume you heard what I said about the lights earlier and what they 

mean. 

Before we begin it is customary for the Committee to swear in 

its witnesses. 

78 

If you would please stand and raise your right hands to take the 

oath? 

Let the record reflect that the witnesses answered in the affirmative, and you may be seated. 

Well, we can start the testimony. We will see how far we get before we are called to votes. 

So I will recognize Professor Werbach to begin. 

TESTIMONY OF KEVIN WERBACH, PROFESSOR, THE WHARTON 

SCHOOL, UNIVERSITY OF PENNSYLVANIA 

Mr. WERBACH. Thank you, Mr. Chairman, Congressman Franks, 

and Members of the Committee. 

On the prior panel you heard from a number of cloud computing 

vendors. As a business school professor who studies emerging technologies I would like to give you a broader picture of the business 

changes that the Internet has fostered in recent years. Reform of 

ECPA should be considered against the backdrop of these trends. 

Cloud computing is not just a set of popular services like Web 

mail or even a market segment; it is all around us. The quartercentury from the birth of the personal computer industry until 

2000 marked the progress towards, in the words of Microsoft’s 

original mission statement, ‘‘a computer on every desk and in every 

home.’’ 

Today the model is no longer one computer per person but many 

devices for each user in different locations offering different form 

factors and functionality. This multi-device era is necessarily a connected era because devices draw upon the network to offer services, 

and it is necessarily a cloud computing era. 

When users access their data from many devices that data must 

be stored remotely or synchronized through the network. In particular, the growth of mobile smartphones, like the iPhone and Android devices, and newer classes like netbooks, tablets such as the 

iPad, and set-top boxes eliminate the traditional assumption that 

a personal computer is the sole repository of a user’s information 

and application. As these devices proliferate file-hosting and software as a service will become integral parts of the computing experience rather than options. 

The Internet is no longer a nascent technology. There are over 

2 billion people around the world online. In 1986, when ECPA was 

passed, there were no Web sites; in 1996 there were roughly 

100,000; today there are over 100 million. 

Facebook was just founded in 2004. It now has half a billion 

members worldwide. I could give many other examples. 

As the external usage of the network has changed the internal 

components have evolved as well. Google probably has more Webconnected servers than the entire Internet did 15 years ago, all 

linked into a colossal virtual super-computer. 

Many other providers are building their own cloud data centers. 

All others tap into public clouds from companies like Amazon.com. 

Increasing bandwidth and storage are making the cloud architecture increasingly pervasive. These cloud-based services are online 

intermediaries. The Internet creates and depends upon a large 

number of such intermediaries, including search engines, 

79 

ecommerce marketplaces, social networks, content hosting tools, 

collaboration services, payment processors, and more. 

These intermediaries create value for users and sometimes become application platforms of their own. However, they also necessarily raise important privacy and security issues. By their very 

nature cloud computing intermediaries require users to give up 

physical control over their data. This distributed processing can be 

transparent to the end user who may not realize that her data is 

sitting in a pool of servers far away. 

In several statutes Congress effectively made a deal with online 

intermediaries. They avoid intermediary liability in return for commitment not to meddle with their users’ data and to establish orderly procedures for access when sought for legitimate purposes, 

such as law enforcement. This structure underlies the safe harbors 

of Section 230 of the Telecommunications Act of 1996 and Section 

512 of the Digital Millennium Copyright Act. 

This safe harbor approach provides confidence for all parties. A 

user has the confidence his or her information won’t be accessed inappropriately; the service provider has confidence it won’t accrue 

legal liability for the actions of its users; and law enforcement and 

other outside parties such as copyright holders have the confidence 

that service providers will provide them with access to necessary 

information subject to an appropriate process. 

All that, however, depends on clear definitions. If user data 

stored in the cloud is not subject to appropriate protections from 

unauthorized access, both private and governmental, trust in could 

computing could be undermined. 

A loss of trust in the Internet would impact far more than the 

companies providing cloud-based services. If users lose their trust 

in online intermediaries some will use encryption to make data less 

visible, some will keep more data locally even when the cloud architecture provides clear benefits, and some will simply engage in 

less activity online. These actions will be based on incomplete information and confusion. 

In other words, a drop in trust in online intermediaries will inevitably add greater friction to the Internet economy. The health 

of the Internet should be a national priority. American businesses 

and consumers have benefited enormously from the growth of our 

Internet economy during the past 2 decades and cloud computing 

represents the next evolution of that economy. 

Already, there are few Americans who do not have some of their 

data stored on remote servers by these online intermediaries. Congress must consider how to ensure that our legislative and regulatory regimes do not undermine the benefits the Internet provides. 

Thank you. 

[The prepared statement of Mr. Werbach follows:] 

80 

PREPARED STATEMENT OF KEVIN WERBACH


KW-1.eps
81 


KW-2.eps
82 


KW-3.eps
83 


KW-4.eps
84 


KW-5.eps
85 


KW-6.eps
86 


KW-7.eps
87 


KW-8.eps
88 


KW-9.eps
89 


KW-10.eps
90 


KW-11.eps
91 

Mr. NADLER. Thank you. 

We will now hear from our second witness. Professor Cate is recognized. 

TESTIMONY OF FRED H. CATE, PROFESSOR, DIRECTOR, CENTER FOR APPLIED CYBERSECURITY RESEARCH, INDIANA 

UNIVERSITY 

Mr. CATE. Thank you very much, Mr. Chairman, Mr. Franks. 

I have been asked to present a brief overview of the Stored Communications Act, and although I would rather describe almost anything else I will nevertheless take the next few minutes to do so. 

But before doing so I would like to say first, Mr. Chairman, how 

much I appreciate your holding these hearings today and the series 

of hearings that you have been holding about Electronic Communications Privacy Act reform. It is a critical issue and worthy of the 

attention that you and this Committee have been devoting to it. 

The primary constitutional limit on the government’s ability to 

obtain personal information about individuals is the Fourth 

Amendment. However, under the Supreme Court’s Third Party 

Doctrine records disclosed to or held by a third party receive no 

constitutional protection. Searches of these records need not be reasonable and no judicial oversight is involved. 

Congress responded to the Court’s Third Parry Doctrine decisions 

by enacting a variety of laws to put in place statutory protections 

where constitutional protections were missing. One of those was 

the Stored Communications Act, which deals, of course, as you 

know, with communications and other records in electronic storage 

such as e-mail and voicemail. 

The 1986 Senate report on the Stored Communications Act explains that computer users at that time generally used network 

services in two ways. First, they used networks to send and receive 

e-mail. 

Second, they used network services to remotely store and process 

data—in other words, to do things which they could not do on a 

local computer. Both of these sets of uses would receive no constitutional protection so Congress enacted statutory protection. 

And the Stored Communications Act divides stored electronic 

communications into two categories responding to these two predominant uses in 1986. An electronic communication service is defined by the statute as the temporary, intermediate storage of a 

wire or electronic communications incidental to the electronic 

transmission thereof, as well as storage for certain backup protections. A remote computing service is the provision to the public of 

computer storage or processing services by means of an electronic 

communication system. 

Now, records within an electronic communication service, an 

ECS, are further divides into subcategories based on the duration 

of storage. So government demands for records that are held as 

part of an ECS that have been stored for 180 days or less require 

a traditional warrant issued by a competent court. 

To obtain material within an ECS that has been stored for more 

than 180 days or to obtain material stored as part of an RCS, or 

remote communication service, the government has three options. 

It can use a warrant; it can use a subpoena, which has no involveVerDate Aug 31 2005 12:07 Dec 15, 2010 Jkt 000000 PO 00000 Frm 00095 Fmt 6633 Sfmt 6601 H:\WORK\CONST\092310\58409.000 HJUD1 PsN: DOUGA
92 

ment of a court; or it can use a court order based on specific and 

articulable facts, sometimes called a 2703D order, or a D order, for 

short. 

If the government chooses not to provide notice to the individual 

then a warrant is required. If it does provide contemporaneous, or 

in some cases delayed, notice then it may use a subpoena or a D 

order, at its election. Under either category of service, an ECS or 

an RCS, a service provider may voluntarily provide the records to 

the government certain to—subject to certain limitations. 

Now, complicating this already somewhat complicated picture is 

the fact that the Department of Justice believes, and most courts 

who have considered the issue to date have agreed, that the warrant requirement for records stored 180 or less only applies to unopened e-mail. If you have opened the e-mail it is automatically 

kicked into the more-than-180-days rule, which would allow access 

without the involvement of a court. 

Information about a customer’s account, as opposed to the content of a customer’s communication, may be obtained under a much 

lower standard, either, again, with a warrant, a 2703D order, or, 

in the case of telemarketing fraud, merely upon formal written request—it takes no judicial authorization at all. And even more 

basic information, what the statute refers to as ‘‘basic subscriber 

information,’’ such as name and address and length of service and 

type of service and means of payment, can be obtained with an administrative subpoena, a grand jury subpoena, or a trial subpoena—again, no involvement of a court; these can be issued by the 

law enforcement agency itself. 

This quite complicated set of arrangements is actually described 

in a chart in my prepared testimony. It is rare that I would ever 

refer you to a chart, but this is one instance in which the Committee might find it of some use. 

So let me conclude by noting, as I think you have heard already, 

the Stored Communications Act has been the subject of considerable criticism, and that criticism might be divided into a number 

of categories. I would encourage you to distinguish between two, 

however: those which related to the—what we might think of as 

the ambiguity or the drafting of the statute itself, and those— 

which I think have been highlighted this morning—those caused by 

the transformation in the technology, transformation which has actually rewritten the statute without any action by Congress or by 

this Committee. 

Thank you very much. 

[The prepared statement of Mr. Cate follows:] 

93 

PREPARED STATEMENT OF FRED H. CATE


Cate-1.eps
94 


Cate-2.eps
95 


Cate-3.eps
96 


Cate-4.eps
97 


Cate-5.eps
98 


Cate-6.eps
99 


Cate-7.eps
100 

Mr. NADLER. Thank you. 

As you may have noticed, the buzzers have rung. We have four 

votes on—five votes on the floor. It will probably take about 40, 45 

minutes, of which 10 minutes have already elapsed. So I thank the 

witnesses for their indulgence. 


Cate-8.eps
101 

I will recess the hearing until immediately after the last of the 

five votes, and I urge the Committee Members to return as soon 

as possible immediately after the last vote. Pending the completion 

of the votes on the floor the Committee is in recess. 

[Recess.] 

Mr. NADLER. The Committee will reconvene, and I thank everyone for their patience. We are about to hear from Mr. Hurbanek, 

is recognized. 

TESTIMONY OF THOMAS B. HURBANEK, SENIOR INVESTIGATOR, COMPUTER CRIME UNIT, NEW YORK STATE POLICE 

Mr. HURBANEK. Chairman Nadler, Congressman Franks, and 

Members of the Subcommittee, my name is Thomas Hurbanek, and 

I am a senior investigator with the New York State Police computer crime unit, a statewide detail of specially trained investigators and civilian staff that provides investigative and forensic support to state, local, and Federal law enforcement agencies. Thank 

you for the opportunity to testify about ECPA reform and the revolution in cloud computing. 

Today I would like to highlight the challenges that cloud computing presents to state and local law enforcement officers who are 

attempting to investigate and prevent crimes in order to protect 

the citizens and businesses within their jurisdiction. 

We can look at cloud computing from two perspectives. First, 

there is the delivery of computing services to end users over the 

Internet; second, the migration of business computing infrastructure to shared resources accessed over the Internet, which can be 

provided within the enterprise or provisioned from third party providers. 

The connected consumer of today can be accessing and storing information over the Internet using many devices—home and work 

computers, one or more smartphones or other devices connected to 

multiple wireless providers, GPS units, game consoles, e-readers, 

even vehicles. The consumer can be communicating with thousands 

of people using social networking sites, multiple e-mail messaging 

and Internet telephone accounts, and identities avilable from hundreds of possible providers while also transacting business with 

thousands of companies from around the world. 

Criminals have adopted every piece of this technology and used 

it to improve their ability to commit crimes or to victimize individuals and businesses worldwide with no regard for borders, laws, 

and jurisdiction. This can make investigations involving the Internet daunting for the majority of police officers and extremely challenging even for highly trained investigators with access to advanced tools and equipment. 

One example is the theft of online banking credentials, where 

highly organized groups are using very sophisticated attacks to 

compromise legitimate Internet sites, infect the computing devices 

we rely on, obtain legitimate access credentials, and steal millions 

of dollars from consumers, small-to medium-sized business, local 

governments, and school districts. Banking regulators estimate 

that more money is being stolen in online thefts than through traditional bank robberies. 

102 

In the state of New York there are nearly 20 million people. Citizens and businesses expect that when the call the New York State 

Police or one of over 500 local police agencies because they are a 

victim of crime that their case can be investigated. When the crime 

involves the use of devices connected to the Internet one of the primary sources of information are business records maintained by 

private sector entities from one-person, home-based business to 

multinational corporations. 

In New York State law enforcement does not have administrative 

subpoena power. Requests for subpoenas must first be reviewed by 

the district attorney and then presented to a grand jury. Each 

county has its own procedure and criteria for requesting and obtaining subpoenas, and in some jurisdictions they can be difficult 

to obtain, especially for investigations involving non-felony offenses. 

Time is our enemy in Internet investigations. Records and communications may not be retained or information may intentionally 

or accidently be deleted or corrupted. Technology has created many 

new sources of information that may be accessed by law enforcement equalized by the very number of private sector entities that 

must be contacted to build information during an investigation. 

The advances of cloud computing present even more challenges 

for law enforcement. I would like to highlight a few of these. 

Encryption: Companies are using advanced encryption technology 

to secure data transmitted across the Internet. This may create situations where law enforcement does not have the technological 

means to access communications regardless of the legal authority 

to do so. The recent concerns in many countries about the 

encryption implemented on Blackberry devices demonstrates this 

problem. 

Virtualization: We are rapidly moving to an environment where 

software applications run on virtual computers and servers that 

can instantly—— 

Mr. NADLER. Excuse me. Could you enlighten us what you mean 

by ‘‘virtual computers and servers’’? 

Mr. HURBANEK. Yes. Virtual computers would be a server that is 

run in memory, so it loads up and it runs only while the machine 

is running and then shuts down. It is not a physical device. So I 

could run—and the Rackspace guys could talk about this—I could 

run 100 servers in memory on one machine. Does that explain it, 

or—— 

So the applications or the computers could instantly be started, 

stopped, refreshed, removing traces of data that law enforcement 

has been able to access during the forensic examination of seized 

computers. These virtual environments can be operated outside of 

the United States. 

Data storage: With the evolution of cloud computing services the 

storage locations for data will often be out of the jurisdiction of 

state and local law enforcement. Data will also be stored outside 

of this country and not only in jurisdictions that have a friendly relationship with the United States. 

And apps: Applications in the cloud can be accessed from anywhere and data can be imported from one storage location, processed, and returned to the original location or another location. 

103 

At the New York State Police we cannot sit at our computer and 

access the extensive data about individuals and their transactions 

with companies on the Internet. There is no database that lets me 

choose an individual and identify all of the e-mail, messaging, and 

social networking accounts they use. I cannot access the subscriber 

information for all Internet-based telephone accounts like we have 

done in the past with telephone subscriber directories. 

I would like to close with an example from a recent case in New 

York State. While investigating a business and executing a search 

warrant at the business location it was discovered that there were 

no financial records about the business stored on site. All records 

were stored and processed on offshore servers which were accessed 

from the business and the accountants for the business accessed a 

limited number of records from a different location to prepare tax 

returns. 

This is just one example of how the technological advances and 

jurisdictional issues created by cloud computing may already be negating the fact that there are new sources of transactional records 

being maintained by companies operating on the Internet, especially in the case of state and local law enforcement. 

Thank you for the opportunity for the New York State Police to 

provide testimony. 

[The prepared statement of Mr. Hurbanek follows:] 

104 

PREPARED STATEMENT OF THOMAS B. HURBANEK


TBH-1.eps
105 


TBH-2.eps
106 


TBH-3.eps
107 


TBH-4.eps
108 


TBH-5.eps
109 

Mr. NADLER. Thank you. 

Mr. Schmid, you are recognized. 

TESTIMONY OF KURT F. SCHMID, EXECUTIVE DIRECTOR, CHICAGO HIGH INTENSITY DRUG TRAFFICKING AREA PROGRAM 

Mr. SCHMID. Thank you, Mr. Chairman and Representative 

Franks. 

I appear to you as a law enforcement official with over 40 years 

of experience, and many of those 40 years dealing with ever-evolving communication and computer technologies and the attendant 

challenge to preserve law enforcement’s lawfully-authorized electronic surveillance capability while maintaining the privacy rights 

of individuals and sustaining industry’s ability to keep pace in a 

fiercely competitive market. Preserving those intercept capabilities 

for law enforcement while reforming and aligning the ECPA to address new and emerging communication technologies are the primary themes of my testimony today. 

And, Mr. Chairman, if you would convey to Representative Conyers that, like Representative Conyers, I was also here in 1986 in 

my similar capacity. 

The face of crime today—many aspects of the traditional criminal 

landscape have changed significantly as a direct result of new technology. Law enforcement embraces new and innovative technologies, the entrepreneurial opportunities they present, and all of 

the other positive impacts these technologies have on our society 

today. 

However, law enforcement must be vigilant in how the criminal 

exploits them to harm others. Many criminals have exploited new 

technologies in ways not previously anticipated. As an example, 

more traditional crimes like prostitution, street corner drug trafficking activity, laundering and moving illicit proceeds, just to 

name a few, have taken on an entirely new dimension using 

networked technologies and offers the criminal a cloak of invisibility from traditional public or law enforcement observation and 

detection. 

Criminals have created entirely new, more effective ways to operate their illicit enterprises. Examples include using social networking applications as an instant communication tool to coordinate and conduct violent gang operations and attacks, a recruiting 

tool that can enlist and indoctrinate criminal cohorts from around 

the world, or an effective training platform to teach ways to avoid 

detection. Crimes like identity theft, human trafficking, child exploitation, among others, have taken on a global aspect as a result 

of access to these powerful technologies. 

As more and more users migrate from desktops and laptops to 

the now ubiquitous and powerful smartphone to conduct their computing and communication functions traditional data retention 

guidelines under ECPA no longer apply to providers of these services. These data retention gaps have often manifested themselves 

as an end of a trail of electronic evidence in many major criminal 

investigations. 

Simply stated, law enforcement must preserve its ability to conduct lawfully-authorized electronic surveillance and must have reaVerDate Aug 31 2005 12:07 Dec 15, 2010 Jkt 000000 PO 00000 Frm 00113 Fmt 6633 Sfmt 6601 H:\WORK\CONST\092310\58409.000 HJUD1 PsN: DOUGA
110 

sonable and expeditious access to stored information that may constitute evidence of a crime committed or about to be committed regardless of the technology platform on which it resides or is transferred. Retention of this information by service providers is of paramount importance to law enforcement, also. 

The law enforcement community has repeatedly learned that the 

criminal quickly adapts new technologies to his repertoire of tools 

not only to enhance his illicit activities, but also to create—and we 

hope only a temporary—safe haven in which to operate. Law enforcement, generally lagging the technological capability and/or the 

legal precedent to intercept or access communication and data, 

must deal with these difficult situations for sometimes long periods 

of time before solutions are found. Opportunities to sit at the table 

with industry, privacy advocates, and lawmakers prior to major 

technology rollouts are crucial to preventing sometimes years of unintended consequences. 

The rollout and subsequent activity facilitated by Congress enacting the Communications Assistance for Law Enforcement Act, or 

CALEA, in 1994 defined statutory obligations telecom carriers had 

to implement to help law enforcement preserve its ability to conduct lawful electronic surveillance. This action was taken by Congress to preserve the public safety. 

As challenging as it has been, CALEA also created the opportunity for law enforcement to sit at the table with industry and develop standards by which law enforcement requirements can be addressed. Absent CALEA, law enforcement’s ability to conduct lawful intercepts would have been significantly diminished or even 

eliminated. 

A similar approach addressing cloud computing and other emerging technologies seems reasonable and necessary in reforming 

ECPA. Law enforcement’s preference to preserving its ability to access relevant electronic data to detect, prevent, and solve crime is 

to sit at the table with lawmakers, privacy groups, industry, and 

others to articulate its concerns and requirements. Such a process 

will more likely result in effective legislation that balances privacy 

and public safety and sustains a reasonably equitable and level 

playing field for industry. 

If no action is taken to reform ECPA other less desirable outcomes, namely awaiting a court’s decision, sometimes promulgated 

by officials not sufficiently steeped in relevant technology, law enforcement operational or other privacy issues may determine how 

we deal with these complex issues. This type of undesirable outcome can lead to long periods of having to comply with flawed case 

law. 

In summary, law enforcement is constantly striving to preserve, 

not extend, its lawfully-authorized electronic surveillance and digital data access authority. A very important component of that 

preservation involves retaining, not relinquishing, established 

thresholds when subpoenas and search warrants are appropriate. 

Subpoenas assist law enforcement to focus on investigative targets, 

frequently serving as a tool to eliminate innocent persons from 

being investigated while serving to develop additional leads and 

evidence on the offender in question. 

111 

Our Nation’s citizens demand that law enforcement connect the 

dots to detect, prevent, and retrospectively investigate crime. Subpoena authority assists law enforcement to collect those dots. 

We live in a rapidly changing and dangerous world. Any erosion 

of law enforcement’s lawful access to digital information while 

criminals are continuing to empower themselves with these technologies of unprecedented capability create a perilous dilemma. 

State and local law enforcement agencies, unlike government 

agencies with abundant resources, are particularly susceptible to 

and challenged by criminals exploiting emerging communication 

technologies. A tragic but all too common—almost daily—example 

of this susceptibility is a violent crime, such as a homicide, committed in a local jurisdiction. A cellular smartphone is often the 

key to solving the crime. 

Quick access to data related to that phone often determines 

whether or not the offender is captured before he commits other 

egregious criminal acts. Lawful access to digital communication 

media and sufficient retention of those data by service providers 

are critical to state and local law enforcement’s daily investigative 

efforts and must be preserved. 

Thank you for the opportunity to appear before you today. I applaud your efforts to address this very important issue. Thank you. 

[The prepared statement of Mr. Schmid follows:] 

112 

PREPARED STATEMENT OF KURT F. SCHMID


KFS-1.eps
113 


KFS-2.eps
114 


KFS-3.eps
115 


KFS-4.eps
116 


KFS-5.eps
117 


KFS-6.eps
118 

Mr. NADLER. Thank you. 

And Mr. Zwillinger is now recognized. 

TESTIMONY OF MARC J. ZWILLINGER, 

ZWILLINGER GENETSKI, LLP 

Mr. ZWILLINGER. Thank you. Thank you, Chairman Nadler. 

I am pleased to be back before this Subcommittee to discuss 

ECPA reform and cloud computing. As you know, I have worked 

with ECPA for over 13 years, both as a former DOJ attorney who 

has taught prosecutors how to apply the law, and now as outside 

counsel for Internet service providers. 

Today I want to focus on three ways in which ECPA no longer 

strikes the right balance between law enforcement interests and 

user privacy when it comes to data stored in the cloud. First, emails and other private messages lack adequate protection under 

the law; second, the standard for law enforcement access to stored 

files like documents and photos is too low; third, ECPA’s failure to 

address civil litigant and criminal defendant access at all generates 

confusion and needless litigation. 

To elaborate on my first point, e-mails are not fully protected because ECPA does not state clearly enough that a search warrant 

is required to obtain all types of stored e-mails, and it does not protect e-mails regardless of age. In fact, ECPA’s protections run 

counter to user expectations. 

If you are a typical e-mail user, the messages that are most likely to be important to you and private are the ones that you have 

already read and decided to save. Those e-mails might include 

notes from a friend, communications with a health care provider, 

or intimate messages from a spouse. 

By contrast, the unopened messages in your inbox may be spam, 

or ads, or automatically-generated confirmations that you will delete without ever reading. Unfortunately, the unimportant and unopened messages may be more protected than the important ones. 

Under ECPA the government needs a search warrant to access 

messages in electronic storage for 180 days or less. But electronic 

storage is defined as temporary, intermediate storage incidental to 

transmission and the storage of such message for backup protection. 

When ECPA was passed, ISPs stored user e-mails only until the 

user logged in and downloaded their mail. That storage was, indeed, temporary and intermediate. After the user downloaded the 

messages the ISP generally kept nothing. 

Now services like Yahoo mail and Gmail and social networks retain messages until they are deleted by the user. If users don’t 

download their messages when does temporary and intermediate 

storage end? 

DOJ believes that temporary storage ends the moment a message becomes marked as ‘‘read,’’ even if it was only briefly skimmed 

on a mobile device. That interpretation of ECPA is arbitrary, as 

nothing magical happens when a user reads a Web mail message. 

It stays exactly where it has been since it was received—on a server in the cloud. In fact, a message can be marked as ‘‘read’’ or 

‘‘unread’’ regardless of whether the user actually looked at it. 

119 

Federal statutory protection for e-mails cannot really depend on 

how a user chooses to mark their mail. This ambiguity about the 

protections for e-mails stored in the cloud needs to be clarified. 

An additional way in which ECPA fails to properly protect e-mail 

is the 180-day rule. This statutory rule was based on the fact that 

in 1986 e-mails were only stored briefly by the ISP and any material it had after 6 months was likely to have been abandoned by 

a user. This assumption, which is described in the legislative history, has proven incorrect and it is time to get rid of that restriction. 

As to my second point, ECPA also underprotects stored files, like 

photos or documents. Here the unilateral delayed notice provisions 

are the culprit, making it too easy for the government to obtain private content without user notice or judicial oversight. 

In fact, the government can get the content of such files more 

easily than it can get transactional or other subscriber records. 

Allow me two examples: If the government wants a list of e-mail 

addresses with whom a user has communicated, it must apply for 

a court order and it must show specific facts that demonstrate the 

information is material to a criminal case. Similarly, any data besides basic subscriber information, such as a user’s gender or birth 

date, also requires a court order. 

But if a user stores a private journal in a password-protected file 

online the government can get that private journal with a mere 

subpoena and no notice to the user if it believes that providing 

such notice might interfere with a criminal case. If the same user 

kept the same journal on his laptop, law enforcement would need 

a search warrant to get it or it would have to serve the user directly with a subpoena so that he could object. 

So the government can get a user’s private journal from an ISP 

with a subpoena without judicial review or notice but needs a 

judge’s blessing to learn the user’s gender or birth date. That does 

not strike the right balance between privacy and law enforcement 

needs. 

In revising ECPA Congress should make clear that a subpoena 

with delayed notice is not enough to access private content stored 

online. Instead, the government should be required to show a magistrate that there is probable cause to believe a crime has been 

committed and that the user’s account contains evidence of that 

crime. 

Finally, I want to briefly comment on ECPA’s silence regarding 

access by civil litigants and criminal defendants. ECPA prohibits 

ISPs from disclosing the contents of communications to anyone 

other than the government. 

Often civil parties and criminal defendants are surprised by this 

and file motions to compel production that are misguided but costly. And while some courts have confirmed the absence of civil discovery provisions in ECPA, other judges do not initially recognize 

that such a prohibition exist because it is not mentioned in the 

statute specifically. 

This gets more complicated if a criminal defendant cannot get access to files that he believes are exculpatory and key to his defense. 

Some trial courts have ruled that the restrictions in ECPA are unconstitutional to the extent they interfere with a defendant’s right 

120 

to due process. An amended ECPA should clarify the general prohibition on disclosure but create exceptions in narrow circumstances 

with prior judicial review. 

In conclusion, changes in technology and user behavior have altered the way ECPA works in practice and the time is right for a 

revision that restores the prior balance between law enforcement 

needs and user privacy to reflect the uses of the Internet in the 

21st century. 

Thank you for the opportunity to testify today. 

[The prepared statement of Mr. Zwillinger follows:] 

121 

PREPARED STATEMENT OF MARC J. ZWILLINGER


MJZ-1.eps
122 


MJZ-2.eps
123 


MJZ-3.eps
124 


MJZ-4.eps
125 


MJZ-5.eps
126 


MJZ-6.eps
127 


MJZ-7.eps
128 


MJZ-8.eps
129 

Mr. NADLER. Thank you very much. 

I recognize myself first for questioning. 

Professor Werbach, we are mainly concerned with balancing necessary access to data in the cloud by law enforcement with the consumer’s interests and personal privacy. You said, as a number of 

others of our witnesses have said, that striking that balance corVerDate Aug 31 2005 12:07 Dec 15, 2010 Jkt 000000 PO 00000 Frm 00133 Fmt 6633 Sfmt 6601 H:\WORK\CONST\092310\58409.000 HJUD1 PsN: DOUGA

MJZ-9.eps
130 

rectly will act as a driver for growth in the cloud computing market 

and that not doing so would act as a deterrent to business growth. 

How could either uncertainty about government access or a popular perception that such access is not adequately governed impair 

that market, and what recommendations do you have from your 

perspective as a business expert to make sure that doesn’t happen? 

Mr. WERBACH. Well, in terms of impairing the market, as I said 

in my testimony, one issue is trust, that the growth of this Internet 

economy, which, as I described, is not just a narrow set of services 

but all the sorts of developments that are happening based on this 

infrastructure depends on users and service providers having a 

sense of trust that when they put their data online that it will be 

protected. And anything that interferes or diminishes that trust is 

going to have some retarding effect. 

Also, we are in a global environment here, so businesses make 

decisions about where they invest based on the environment. If 

they are going to invest in building infrastructure, and building 

services, and marketing, and building up customer bases here in 

the United States they have to feel a confidence level that the processes and procedures and protections around their data are appropriate, otherwise they may choose to make those investments somewhere else. 

So at every level the degree to which access to data and protection of data is carried out is going to have some influence on the 

decisions that get made and on the speed and trajectory of this 

marketing. 

Mr. NADLER. Thank you. 

Professor Cate, in your testimony you described several broad 

categories of criticism of the Stored Communications Act. One category concerns the lack of publicly available aggregate statistics detailing the extent to which third party providers are routinely compelled to deliver customers’ communications and other private data 

to law enforcement agencies. You indicate that because most service providers do not disclose this information Congress has no reliable data to determine the scale of requests and disclosures being 

made under the SCA. 

Why do you think Congress should have access to this type of information? What use might Congress make of such information? 

Mr. CATE. Thank you very much, Mr. Chairman. In most of the 

laws which Congress has enacted which provide for access by the 

government to private records it has required the government to 

file reports with Congress on either an annual or a semiannual 

basis saying how often do they use that authority and with what 

effect. So this is true of wiretaps; it is true of pen registers; it is 

true of trap and trace orders. 

Having those statistics gives Congress a sound empirical basis on 

which to evaluate how its laws are being used and whether they 

need to be changed. It also provides that same information for people such as those of us gathered at this table when making recommendations to Congress. And it provides information to the public and the press so that they know how those laws are being used 

and to what effect. 

But there is an additional value which I think is really quite important and should not be overlooked, and that is by making the 

131 

government agencies themselves keep those statistics, and therefore have to account internally for how they are using those, we get 

stronger oversight internally. So, for example, when the FBI, in reporting its use of national security letters, grossly underestimated 

its use of those, as pointed out by the Office of the Inspector General and the Department of Justice, it provided the Department of 

Justice an opportunity to go in and help build better procedures for 

making sure that the FBI was using its authority given to it by 

Congress appropriately. It is only by having that reporting requirement you see that opportunity carried out. 

Mr. NADLER. Thank you. 

Mr. Hurbanek, I was intrigued by one thing you said. You talked 

about a law enforcement investigation in which a warrant was 

served on a business and that warrant proved fairly useless because there was no information there; everything was stored in the 

cloud. 

Now, I assume that if you had the warrant—or if the law enforcement agency, not you—if the law enforcement agency had the 

warrant for the business they could have gotten a warrant, if necessary, to look at the same information in the cloud. But would 

that have done any good if the cloud is stored in a virtual situation? In other words, you seem to have indicated a situation for 

which the issue is not whether—I mean, there has been an implicit 

discussion here today as to whether we should require a warrant 

for some of these things, but you have described a situation where 

whether you have a warrant seems to be irrelevant because given 

the warrant you can’t get the information. 

Mr. HURBANEK. Yes, Mr. Chairman, and that—we have evolved 

from where we used to drive to a business and take all of their 

computers out on a big truck. 

Mr. NADLER. You should turn on your microphone. 

Mr. HURBANEK. It is on. 

Mr. NADLER. Okay. Go ahead. 

Mr. HURBANEK. Okay. So we no longer drive to the business and 

take the records in a truck; we would go to a business and extract 

whatever data we had in our warrant. This is moving so now the 

data—— 

Mr. NADLER. You would go to the business and extract whatever 

data you had in the warrant by accessing their computers on the 

site? 

Mr. HURBANEK. Yes. 

Mr. NADLER. You wouldn’t take the computer? 

Mr. HURBANEK. No. We don’t take boatloads of business computers very often anymore. And so now the data may be hosted by 

the third party in the cloud which, if in the United States, we 

would have access to and we could get there and secure the data. 

The concern then becomes, what if the data is not in this country? And because of the business means and the opportunities 

around the world it is quite possible. Now, we have a lot of legitimate businesses testifying here today; those are not the only people 

offering places to store data. 

Mr. NADLER. So if I were an illegitimate business, or if I were 

a business that wanted to cut some corners I would probably—and 

if I were thinking about it—I would store it abroad. 

132 

Mr. HURBANEK. And you see that a lot with Internet gambling 

and things like that. Or the recent thing with military secrets—the 

person who published those on the Internet specifically is doing 

that from certain countries, not from within the United States. 

Mr. NADLER. I see. Now, assume a frequent traveler keeps his 

private diary online instead of at his bedside table. This user keeps 

it stored in the cloud so he can type diary entries when he travels 

so that he doesn’t have to ever leave his diary in a strange hotel 

room; he has been doing so for several years. The account he keeps 

it in is password-protected and he has shared the password with 

nobody. 

Mr. Zwillinger and others suggest that law enforcement can get 

access to this diary by serving a subpoena to an online service provider and certifying that providing the user with notice may cause 

him to destroy evidence or flee the jurisdiction. Is that true? And 

if so, should that be the law? 

Mr. HURBANEK. That is interesting that—and the lawyers have 

identified all of the problems with ECPA. It is very confusing. We 

don’t know where to begin. 

In a traditional criminal investigation we would come upon the 

existence of a diary maybe through interview, and we might search 

for the diary. In the virtual world, in the cloud, if we became aware 

that the person kept a diary the first question we have to ask is, 

where? 

Where might the diary be stored? How would we find it? Who 

has it? Does it even exist? 

We can’t make the barriers to even finding the mere existence 

of the diary so strenuous that we can’t conduct our investigation. 

Whether or not we can access the content and obtain the diary is 

pretty well written. 

Mr. NADLER. Mr. Schmid, do you have anything to say on that? 

Mr. SCHMID. Thank you, Mr. Chairman. By example, it gets more 

and more complex for law enforcement. Back in 25 years ago, 

when—as an example, when we would conduct a lawfully-authorized court-ordered wiretap we would serve typically one order on 

the phone company, service provider. 

Today it is not unusual for a law enforcement officer or investigation to have to serve seven, eight, nine different court orders to be 

able to either access or ascertain where some of these data are 

lying. So it becomes very, very complex. And add that to the dimension of being a foreign-owned business; that really throws us way 

out of the ballgame. 

So it does become extraordinarily complex in just the process of 

how we access—— 

Mr. NADLER. Okay. Thank you. 

My time is running short so I will ask Mr. Zwillinger one quick 

question. 

As I have listened to your testimony today I am struck by how 

some of the assumptions that Congress made in 1986 about consumer and business network and how to protect consumer privacy 

obviously do not hold true in today’s technology environment. Everybody has said the same thing. 

You make the case in your testimony that, counterintuitively, 

non-content transactional data sometimes receives more protection 

133 

than content. Given your law enforcement background, what might 

the law enforcement argument be, if any, to justify continuing the 

legal framework whereby some types of content are more easily obtained than some types of transactional records? Any justification 

for that? 

Mr. ZWILLINGER. Yes. You know, I don’t think the Department of 

Justice or law enforcement disagrees conceptually that content 

should be more protected than non-content. I think when you shift 

what the law has evolved to they are going to want to defend the 

status quo because, as Mr. Schmid said, it is more efficient for 

them. 

But in order—— 

Mr. NADLER. Excuse me—all this massive confusion is more efficient for them? 

Mr. ZWILLINGER. I agree with you, Mr. Chairman. You know, I 

don’t think it is that confusing either, because—let me give you an 

example. 

They would probably try to defend the status quo by saying that 

when you store things online with a service provider, since the 

service provider has some right to access the data the individual 

has given up some of their privacy. But I don’t think that is right. 

That is not the way the law generally works. 

If I store my photos in an online album and only my wife and 

I have the password, and we do that so they don’t get burned in 

a fire and we can see them wherever we go, we are not intending 

to give up any protection to the service provider, and the fact that 

a service provider could access them does not take away our privacy interests. It would be like law enforcement saying, ‘‘You have 

photo albums in your house but we can get them without a search 

warrant because when the photos were developed the person at 

Kodak could see the pictures, and therefore you gave up your privacy interests.’’ 

We don’t think that way. We don’t say there is no privacy in a 

phone call because the operator in 1967 could have listened in. 

So I think that is what the argument would be. I think they have 

made that argument before. I just don’t think it works well anymore. 

Mr. NADLER. I see. 

Thank you very much. 

I now recognize the distinguished gentleman from Arizona. 

Mr. FRANKS. Well, thank you, Mr. Chairman. 

Professor Cate, if I could start with you and maybe give a couple 

of others a shot at it, what do you believe would be the one most 

significant change to ECPA that would clarify what you believe is 

not clear and what is confusing to law enforcement officials, and 

service providers, and courts in general? What is the one thing that 

we could do to bring some clarity and balance to the whole thing? 

Mr. CATE. Thank you very much, Congressman. I would like to 

see the law move to a requirement that a warrant is required to 

obtain content without regard for whether the content is in an email that has been opened or not and without regard for how long 

it has been stored so that we would draw a bright line, universally 

applied, to say when seeking content the same condition, whether 

you come to my home computer, you go to my service provider, or 

134 

you go to some recipient’s computer, it would be the same legal 

standard in all of those settings. 

Mr. FRANKS. Mr. Hurbanek, what would you say to that? 

Mr. HURBANEK. I think it requires a case-by-case debate. I think 

our concern is mostly that the initial records can be obtained, that 

we—and that the Federal Government take some leadership that 

helps the states craft statutes that make sense for us. 

I know that is a big lift, but right now it is very difficult for us 

to initiate investigation. It is tough to get subpoenas and it is tough 

to get started. So we need to look at this as to what information 

is material and relevant early on, and then what steps do we have 

to take beyond that. 

Mr. FRANKS. And what would you—can you first just tell us what 

the term ‘‘going dark’’ means? 

Mr. HURBANEK. Going dark? That is an FBI discussion about the 

fact that we are losing our ability to see what criminal enterprises 

are doing. Even if we had the rights to tap into the communication 

we technologically may not be able to see them. 

Mr. FRANKS. Mr. Chairman, that almost seems like the elephant 

in the room here, is that regardless of the potential accessibility by 

law enforcement that the technology is outrunning that, and that 

because of the virtual capability of being able to access the cloud 

and then essentially disappearing without any, you know, electronic traceable data, it almost seems to me like that is going to 

be a real boon to the bad guys. 

Mr. Hurbanek, I will go ahead and stay with you for a moment. 

Can you explain what is meant by storing records in the—by storing a record in the cloud and what is a private cloud? Help us understand what a private cloud is. 

Mr. HURBANEK. Well, the private cloud—clearly business isn’t 

completely ready to put all of their corporate secrets and enterprises out with a third party. That is an evolution that is taking 

place. 

The private cloud is when a company such as Amazon, 

Rackspace, Microsoft—all the ones that are here—provide you with 

the technology within you enterprise. So the data may still be traveling over the Internet; the data may still be stored in multiple locations and accessed remotely. But you do maintain enterprise control of it. 

Those will then scale to external third parties partially, and ultimately completely. Even the Federal Government is studying how 

to outsource to the third party. 

Mr. FRANKS. Well, I want to—if I could I just want to go down 

and ask each one of you to just—a couple sentences at the most— 

to tell me, from your varying perspectives, what you believe—the 

same answer would be the question I asked Professor Cate—what 

is the one thing that you would do that you think would be most 

significant to protect what you consider to be the most significant 

issue involved here? 

Professor Werbach? 

Mr. WERBACH. I would agree with Professor Cate that something 

to remove these artificial distinctions and to recognize that today 

putting information on these remote servers is not fundamentally 

different for users than storing them locally on a computer. 

135 

Mr. FRANKS. Skip you here, Professor. 

Mr. Hurbanek, would you take a shot at it? 

Mr. HURBANEK. And my answer would be that whatever framework is set up it needs to be straightforward and understandable, 

and we need to efficiently be able to access it through whatever 

courts or prosecutors, and through whatever third party companies 

house the data. 

Mr. FRANKS. And would that take with it any sort of mandate 

that the information be indexed in some way that would be proprietary to law enforcement to be able to access? 

Mr. HURBANEK. We don’t normally ask companies to index the 

data for us. They are indexing data and storing data for their business purposes. We just ask that if it is relevant that we can get 

access to it. 

Mr. FRANKS. Mr. Schmid? 

Mr. SCHMID. To appropriately align the statutory and regulatory 

aspects of a reformed ECPA to the current technology. And that involves actually bringing clarity not only to this body but also brings 

clarity to law enforcement. And that seems to be where a lot of the 

confusion and a lot of the issues that really, really prevent us from 

doing our job effectively have come. 

Mr. FRANKS. The way things are going that might also include 

trying to discover a new type of physics. You know, it looks like—— 

Mr. ZWILLINGER. On the same question I would agree with the 

professor at the other end of the table. I think a probable cause requirement for content in the cloud is the one thing you could do. 

And just to respond to Mr. Schmid earlier, the types of materials 

we are discussing were not generally in the cloud or stored online 

in 1986. That is, a content requirement where you have a probable 

cause for all content really restores the balance to where it was; 

this content was stored locally. 

So it is not relinquishing or giving up law enforcement access 

and law enforcement will still have the building blocks for investigations through records—transactional records, subscriber information. But content should be protected by a warrant. 

Mr. FRANKS. And there is no one on the group here that believes 

that having some type of warrant requirement for content specifically would severely restrict or significantly restrict law enforcement’s capability to protect us? Anyone? No? 

Mr. CATE. If I may, Congressman, I would just point out that the 

Congress, again, in ECPA put in place a very significant wiretap 

warrant requirement, and in the time since that has been put in 

place we have seen just over 40,000 wiretap orders granted and 

fewer than 40 denied by courts. So the argument that is often 

made about warrants is that it is not a new impediment; it doesn’t 

result in the data becoming unavailable. It is a new process for getting access to the data that requires that some other person other 

than just the investigator be involved, play some oversight role. 

Mr. FRANKS. Yes. 

Mr. CATE. Thank you, sir. 

Mr. FRANKS. Thank you all very much. 

Thank you, Mr. Chairman. 

Mr. NADLER. I thank all the witnesses. It is clear we have two 

problems, one of which we can address here, and that is the proper 

136 

standards, and subpoenas, and warrants, and so forth, and the 

other is advancing technology. 

I would simply observe that that advancing technology is part of 

the war between offense and defense that has been going on since 

time immemorial and will continue to go on. And at one point offense has got the trump hand and at the other hand the defense, 

and that will continue going on. But we have to deal with the legal 

consequences of as it is now and as it will be in the reasonably 

foreseeable technological future. 

So I want to thank all the witnesses for the helping hand you 

have given us today. 

Without objection, all Members have 5 legislative days to submit 

to the Chair additional written questions for the witnesses which 

we will forward and ask the witnesses to respond as promptly as 

they can so that their answers may be made part of the record. 

Without objection all Members will have 5 legislative days to submit any additional materials for inclusion in the record. 

And again, thanking our witnesses. And with that, this hearing 

is adjourned. 

[Whereupon, at 2:12 p.m., the Subcommittee was adjourned.] 

(137) 

A P P E N D I X 

MATERIAL SUBMITTED FOR THE HEARING RECORD


B-1.eps
138 

f 


B-2.eps
139 


D-1.eps
140 


D-2.eps
141 


D-3.eps
142 

f 


D-4.eps
143 


C-1.eps
144 


C-2.eps
145 


C-3.eps
146 

f 


C-4.eps
147 


E-1.eps
148 


E-2.eps
149 

f 


E-3.eps
150 


F-1.eps
151 


F-2.eps
152 


F-3.eps
153 


F-4.eps
154 


F-5.eps
155 


F-6.eps
156 

Æ 


F-7.eps