Legal Commentary

The most important law protecting privacy online is the federal Electronic Communications Privacy Act (ECPA). But the law is now nearly 25 years old, and it is riddled with anachronisms and saddled with unnecessary complexity. Yesterday, a new group calling itself Digital Due Process launched, with the goal of helping Congress effect meaningful ECPA reform. I am proud to be part of the group, but I joined only recently, so I can't take credit for the excellent work they have already accomplished. The list of my co-signers is impressive, a list of some of the most important Internet companies and online privacy groups, including, as Declan McCullagh notes, some odd bedfellows.

I'm excited about the response to yesterday's launch, both from the media and from prominent members of Congress, and I look forward to helping shape a bill in any way I can.

The specific changes our group has requested are all important, but I wanted to highlight two that I think will do a lot for Internet privacy. First, the police should not be able to track the location of your cell phone without first demonstrating probable cause. (If it shocks you to learn that they often do so with less than probable cause, call your Congressman!)

Second, the police should not be able to monitor the telephone numbers you dial and the email addresses with which your correspond without articulating the reason for the surveillance. Under the current law, an officer need merely "certify" the relevance of the surveillance to an investigation, and the judge's role is basically a rubber stamp--one court referred to the judicial role as "ministerial."

ECPA was written in the days of the mainframe. It hasn't kept up well with two decades of innovation. I hope Congress agrees that it is now time to update ECPA for the Internet age.