Why CalECPA Was Necessary

CalECPA requires law enforcement agencies within California to secure a judicial warrant before searching the e-mail, documents or other electronic data of someone they investigate, whether stored on the electronic device itself or online in the “cloud.”

The reform should have been a no-brainer: searches of records stored in filing cabinets, and communications sent via the postal service, have long required judicial warrants. California's new law simply gives e-mail ' and, for instance, your documents stored on Google Drive ' the same protection.

As noted by groups including the Electronic Frontier Foundation, the ACLU of Northern California and the California Newspaper Publishers Association, California needed to adopt CalECPA because federal law has stagnated for nearly 30 years. The Electronic Communications Privacy Act of 1986 ' adopted long before the adoption of cloud-based email services like Gmail and Hotmail ' allowed law enforcement the power to search electronic communications like email without a search warrant if stored online for more than 180 days. Not addressed by Congress since then, digital privacy has languished at the federal level for a full generation as the law lost pace with now widely adopted technology.

Congressional inaction left the law outdated by not only changing technology, but also social practices and norms, as well as simple common sense.

In 1986, few people had e-mail accounts. Those who did typically downloaded messages to read them, since there were no widely available online file storage services. As a result, federal policymakers reasoned that the long established warrant requirement should protect unread emails, but that electronic messages should lose privacy protection after a few months, as if they had been discarded like physical trash.

Fast forward to the present: the typical Californian uses a service like Yahoo to read and store email without ever downloading messages, storing thousands of them ' including messages with sensitive personal information ' on the cloud for years. Meanwhile, many of us collaborate with colleagues using tools like those developed by Google/Alphabet, and communicate through social networking platforms like Facebook and Twitter.

Until Gov. Brown signed CalECPA into law, each of those practices were vulnerable to law enforcement scrutiny, with differing standards emerging from various cases. By adopting CalECPA, California has announced a clear standard that applies across the state.

Why California's New Laws Matter

California's new laws amount to a decision to step into the 21st century and effectively expand constitutional rights within the state.

The California constitution independently protects Fourth Amendment privacy interests beyond the federal baseline, and CalECPA helps codify those promises. It also insulates a frequently overlooked connection between privacy protections and First Amendment protected speech, association and dissent.

Privacy interests protected by the Fourth Amendment do not stand alone: without them, our First Amendment rights to participate in the political process would be largely meaningless. What good is the right to associate and assemble when the government watches and records everything you do, and monitors your supporters?

In states without California's new protections, police routinely claim the authority to search electronic data without judicial approval. Authorities in Virginia, for instance, asserted such authority as early as 2008. When Nathan Newhard was stopped for a traffic violation, police searched his phone, and then leaked nude photos of him and his ex-girlfriend, ultimately costing him his job at a local school.

California had similar problems. Authorities asserted the power to search the cellphones of anyone arrested, regardless of what prompted their arrest, and even gained the state Supreme Court's approval in 2011. Not until the U.S. Supreme Court in 2014 prohibited warrantless electronic searches incident to arrest did arrestees ' people suspected of violations not yet proven ' regain the benefit of judicial review.

Giving judges a chance to intervene before police execute searches, as California has done through CalECPA, helps prevent recurring abuses before they happen. The warrant safeguard protects not only privacy, but also your right to promote unpopular opinions and through it, our democracy.

Support from Law Enforcement

Beyond breathing new life into withering First and Fourth Amendment values, California's new law strikes a thoughtful balance between the powers of police and rights of communities.

In an emergency, CalECPA allows police to bypass the warrant requirement, as long as they later explain to a judge why the threat of death or serious bodily injury compelled them to act quickly.

Requiring judicial warrants before police search your cousin's gmail account also enhances public safety by introducing a uniform privacy standard across the state. Authorities in California need no longer guess when approaching a particular data provider what legal standard they must satisfy in order to obtain electronic records or data potential evidence in court. Before, state and local police confronted a patchwork of conflicting court decisions and unique policies at each company.

Finally, an independent judicial check on electronic searches will prevent law enforcement goose chases and focus investigations on real crime. Dozens of federal surveillance operators have abused the government's powerful tools to monitor their former lovers and ex-wives. CalECPA ensures that police, highway patrol and sheriff's deputies in California will not join their ranks.

Motivated by these and other reasons, the state's major law enforcement organizations withdrew their opposition to the proposed reform. One police officer's union, representing nearly 2,000 officers in San Diego, went so far as to endorse the bill.

Union president Brian Marvel wrote that CalECPA “strengthens community relationships and increases transparency without impeding on law enforcement's ability to serve the needs of their communities ' “

Ultimately, police officers are citizens too. And, given how much they see about the degree of monitoring to which we are all routinely subjected, many feel concerns for their own families' privacy.

Responding to user concerns about privacy, tech companies also lined up to support CalECPA, and are poised to champion similar measures in other states. Companies from Apple, Facebook and Google to Twitter, Adobe and Mozilla all backed the new law.

Since Edward Snowden revealed in 2013 how federal intelligence agencies constantly spy on Americans, tech companies have heard an uproar from users who value privacy. Those concerns are reflected in their bottom lines, as global businesses'knowing that data stored in the U.S. is insecure and exposed to intelligence agencies'have increasingly turned to other sources for cloud storage.

California's new privacy protections will also help vulnerable communities. They ensure an external and independent check against otherwise unrestrained arbitrariness that are not only offensive in the abstract, but often reflect implicit biases.

For some of us, privacy is more than merely a preference. For survivors of domestic violence, transgender individuals, medical patients with mental health disorders or sexually transmitted diseases, and political dissidents, however, privacy is an existential right without which no public safety agency can ensure security.

Beyond California

California is not alone. Maine and Utah have also passed equally strong digital privacy bills. A handful of other states, including Texas and several in the upper Midwest, have adopted more limited protections (protecting either content, or location data, but not both). These visionary states are acting as laboratories for public policy, as envisioned by Justice Louis Brandeis.

For all its benefits, CalECPA does leave some cards on the privacy table. Sacramento can't regulate the NSA, which continues to monitor Americans on a dragnet basis. Even proposed federal reforms (as currently drafted) would restrict only law enforcement agencies, not recidivist intelligence agencies conducting widespread domestic surveillance even though it is both illegal and unconstitutional.

But as the center of both the tech and entertainment sectors, and the world's seventh largest economy, California's decision to limit police authorities and reinforce individual rights packs a political punch. Enshrining user privacy in law and subjecting electronic searches to independent judicial approval will encourage other states to follow suit and help inform judges whose cases require them to consider whether a litigant's expectations of privacy are reasonable.

The same legislative session that produced CalECPA also included other reforms to restrain law enforcement surveillance. Separate measures required a transparent public process before police purchase or deploy high-tech military surveillance equipment, such as Stingray cell site replicators and automatic license plate readers. Ensuring that police seek local approval before using these tools advances transparency, and promotes checks and balances, in addition to the privacy interests that CalECPA protects.

Legislators rarely limit law enforcement powers, and generally favor expanding them in order to appear tough on crime. But we don't often witness a confluence among industry, police, privacy organizations, libraries and groups representing minority communities. By expanding electronic privacy protections in California, Gov. Brown and the state legislature made a common sense choice with enormous implications for the Internet, our democracy and your family.

It's just a matter of time before policymakers in other state legislatures'and Congress'follow their lead.

Shahid Buttar is the director of grassroots advocacy for the Electronic Frontier Foundation (EFF). He's a constitutional lawyer focused on the intersection of community organizing and policy reform as a lever to shift legal norms, with roots in communities across the country resisting mass surveillance.

'

'

'

Shahid Buttar, The Recorder

October 16, 2015

Last month, California Governor Jerry Brown signed a crucial law with groundbreaking implications for privacy, the Internet and free speech. Sacramento's adoption of the'California Electronic Communications Privacy Act (CalECPA)'makes California the largest state to adopt digital privacy protections including both the content of messages and location data.

Why CalECPA Was Necessary

CalECPA requires law enforcement agencies within California to secure a judicial warrant before searching the e-mail, documents or other electronic data of someone they investigate, whether stored on the electronic device itself or online in the “cloud.”

The reform should have been a no-brainer: searches of records stored in filing cabinets, and communications sent via the postal service, have long required judicial warrants. California's new law simply gives e-mail ' and, for instance, your documents stored on Google Drive ' the same protection.

As noted by groups including the Electronic Frontier Foundation, the ACLU of Northern California and the California Newspaper Publishers Association, California needed to adopt CalECPA because federal law has stagnated for nearly 30 years. The Electronic Communications Privacy Act of 1986 ' adopted long before the adoption of cloud-based email services like Gmail and Hotmail ' allowed law enforcement the power to search electronic communications like email without a search warrant if stored online for more than 180 days. Not addressed by Congress since then, digital privacy has languished at the federal level for a full generation as the law lost pace with now widely adopted technology.

Congressional inaction left the law outdated by not only changing technology, but also social practices and norms, as well as simple common sense.

In 1986, few people had e-mail accounts. Those who did typically downloaded messages to read them, since there were no widely available online file storage services. As a result, federal policymakers reasoned that the long established warrant requirement should protect unread emails, but that electronic messages should lose privacy protection after a few months, as if they had been discarded like physical trash.

Fast forward to the present: the typical Californian uses a service like Yahoo to read and store email without ever downloading messages, storing thousands of them ' including messages with sensitive personal information ' on the cloud for years. Meanwhile, many of us collaborate with colleagues using tools like those developed by Google/Alphabet, and communicate through social networking platforms like Facebook and Twitter.

Until Gov. Brown signed CalECPA into law, each of those practices were vulnerable to law enforcement scrutiny, with differing standards emerging from various cases. By adopting CalECPA, California has announced a clear standard that applies across the state.

Why California's New Laws Matter

California's new laws amount to a decision to step into the 21st century and effectively expand constitutional rights within the state.

The California constitution independently protects Fourth Amendment privacy interests beyond the federal baseline, and CalECPA helps codify those promises. It also insulates a frequently overlooked connection between privacy protections and First Amendment protected speech, association and dissent.

Privacy interests protected by the Fourth Amendment do not stand alone: without them, our First Amendment rights to participate in the political process would be largely meaningless. What good is the right to associate and assemble when the government watches and records everything you do, and monitors your supporters?

In states without California's new protections, police routinely claim the authority to search electronic data without judicial approval. Authorities in Virginia, for instance, asserted such authority as early as 2008. When Nathan Newhard was stopped for a traffic violation, police searched his phone, and then leaked nude photos of him and his ex-girlfriend, ultimately costing him his job at a local school.

California had similar problems. Authorities asserted the power to search the cellphones of anyone arrested, regardless of what prompted their arrest, and even gained the state Supreme Court's approval in 2011. Not until the U.S. Supreme Court in 2014 prohibited warrantless electronic searches incident to arrest did arrestees ' people suspected of violations not yet proven ' regain the benefit of judicial review.

Giving judges a chance to intervene before police execute searches, as California has done through CalECPA, helps prevent recurring abuses before they happen. The warrant safeguard protects not only privacy, but also your right to promote unpopular opinions and through it, our democracy.

Support from Law Enforcement

Beyond breathing new life into withering First and Fourth Amendment values, California's new law strikes a thoughtful balance between the powers of police and rights of communities.

In an emergency, CalECPA allows police to bypass the warrant requirement, as long as they later explain to a judge why the threat of death or serious bodily injury compelled them to act quickly.

Requiring judicial warrants before police search your cousin's gmail account also enhances public safety by introducing a uniform privacy standard across the state. Authorities in California need no longer guess when approaching a particular data provider what legal standard they must satisfy in order to obtain electronic records or data potential evidence in court. Before, state and local police confronted a patchwork of conflicting court decisions and unique policies at each company.

Finally, an independent judicial check on electronic searches will prevent law enforcement goose chases and focus investigations on real crime. Dozens of federal surveillance operators have abused the government's powerful tools to monitor their former lovers and ex-wives. CalECPA ensures that police, highway patrol and sheriff's deputies in California will not join their ranks.

Motivated by these and other reasons, the state's major law enforcement organizations withdrew their opposition to the proposed reform. One police officer's union, representing nearly 2,000 officers in San Diego, went so far as to endorse the bill.

Union president Brian Marvel wrote that CalECPA “strengthens community relationships and increases transparency without impeding on law enforcement's ability to serve the needs of their communities ' “

Ultimately, police officers are citizens too. And, given how much they see about the degree of monitoring to which we are all routinely subjected, many feel concerns for their own families' privacy.

Responding to user concerns about privacy, tech companies also lined up to support CalECPA, and are poised to champion similar measures in other states. Companies from Apple, Facebook and Google to Twitter, Adobe and Mozilla all backed the new law.

Since Edward Snowden revealed in 2013 how federal intelligence agencies constantly spy on Americans, tech companies have heard an uproar from users who value privacy. Those concerns are reflected in their bottom lines, as global businesses'knowing that data stored in the U.S. is insecure and exposed to intelligence agencies'have increasingly turned to other sources for cloud storage.

California's new privacy protections will also help vulnerable communities. They ensure an external and independent check against otherwise unrestrained arbitrariness that are not only offensive in the abstract, but often reflect implicit biases.

For some of us, privacy is more than merely a preference. For survivors of domestic violence, transgender individuals, medical patients with mental health disorders or sexually transmitted diseases, and political dissidents, however, privacy is an existential right without which no public safety agency can ensure security.

Beyond California

California is not alone. Maine and Utah have also passed equally strong digital privacy bills. A handful of other states, including Texas and several in the upper Midwest, have adopted more limited protections (protecting either content, or location data, but not both). These visionary states are acting as laboratories for public policy, as envisioned by Justice Louis Brandeis.

For all its benefits, CalECPA does leave some cards on the privacy table. Sacramento can't regulate the NSA, which continues to monitor Americans on a dragnet basis. Even proposed federal reforms (as currently drafted) would restrict only law enforcement agencies, not recidivist intelligence agencies conducting widespread domestic surveillance even though it is both illegal and unconstitutional.

But as the center of both the tech and entertainment sectors, and the world's seventh largest economy, California's decision to limit police authorities and reinforce individual rights packs a political punch. Enshrining user privacy in law and subjecting electronic searches to independent judicial approval will encourage other states to follow suit and help inform judges whose cases require them to consider whether a litigant's expectations of privacy are reasonable.

The same legislative session that produced CalECPA also included other reforms to restrain law enforcement surveillance. Separate measures required a transparent public process before police purchase or deploy high-tech military surveillance equipment, such as Stingray cell site replicators and automatic license plate readers. Ensuring that police seek local approval before using these tools advances transparency, and promotes checks and balances, in addition to the privacy interests that CalECPA protects.

Legislators rarely limit law enforcement powers, and generally favor expanding them in order to appear tough on crime. But we don't often witness a confluence among industry, police, privacy organizations, libraries and groups representing minority communities. By expanding electronic privacy protections in California, Gov. Brown and the state legislature made a common sense choice with enormous implications for the Internet, our democracy and your family.

It's just a matter of time before policymakers in other state legislatures'and Congress'follow their lead.

Shahid Buttar is the director of grassroots advocacy for the Electronic Frontier Foundation (EFF). He's a constitutional lawyer focused on the intersection of community organizing and policy reform as a lever to shift legal norms, with roots in communities across the country resisting mass surveillance.

'