There’s a growing consensus that giving the government this much leeway can’t be right. It’s one reason so many companies like the texting giant WhatsApp and iPhone maker Apple have moved to end-to-end encryption—to protect user data by making themselves immune to these government requests. Still, figuring out how the third-party rule should be changed is a daunting task, one that has tied Congress in knots. That’s in part because it also implicates the other side of the equation: law enforcement’s ability to obtain information it needs in criminal and terrorism investigations.

  CYBERSPACE: THE GOVERNMENT’S OWN FILE CABINET

  What’s at stake under the third-party rule was made clear in a clash between the government and the social media giant Twitter, during the government’s investigation of WikiLeaks, the international organization dedicated to exposing government secrets. In May 2010, U.S. Army Private Bradley (now Chelsea) Manning was arrested for allegedly passing hundreds of thousands of classified documents to WikiLeaks. In December of that same year, as part of its investigation of the massive leak, federal prosecutors issued to Twitter what is known as a 2703(d) order—or simply a D-order—to get records pertaining to three Twitter customers, one of whom—the computer security expert and activist Jacob Appelbaum—was a United States citizen. (The other two were Rop Gonggrijp, who founded the Netherlands’ first private Internet service provider, and Birgitta Jonsdottir, a member of Iceland’s Parliament.)3

  At the time, most tech companies simply would have complied. But Twitter, which has made its reputation on protecting user privacy, was different. It has long had a policy of notifying targets so they can defend themselves in court. Ben Lee, Twitter’s Vice President, Legal, explains that “modern platforms for communication and expression … create a certain level of responsibility … for the rest of society.” For that reason, he says, it is “hammered into” the minds of people at Twitter: “Protect the user where we can.” The goal of notifying the user, Lee emphasizes, is to “hold the government accountable to existing legal requirements before they can obtain user data.” 4

  When the government demanded the information from Twitter, it did so in a court filing kept secret from the users and the public. It is common for the government to try to keep such requests under wraps, which, as the WikiLeaks Three later pointed out, makes it difficult “to oppose an order because the individual does not know about it.” When Twitter refused to comply until the order was made public and the targets were notified, it was instant front-page news. Barton Gellman, writing in Time, wagged his finger at Twitter’s competitors: “It is beyond reasonable doubt that authorities asked other companies to supply the same kinds of information sought from Twitter, but none of them admit it.”5

  To be clear, the information the government sought in this case was not public. The government wanted everything Twitter had about the WikiLeaks Three other than their tweets: account names and user IDs, all personal addresses, payment information, session times, and IP addresses for devices from which tweets were sent. The targets complained the information could be “‘intensely revealing’ as to location” and would let the government create a “map” of their private associations.6

  Twitter’s fight to notify its clients ended in vain, because the court decided, remarkably, that the targets of government inquiry didn’t even have legal “standing”—a legal right to come to court to challenge the attempt to gather their data. Instead, the third-party information holder—in this case Twitter—was the only one who could fight their battles for them. Twitter’s Lee was “flummoxed” when prosecutors first made this argument. A former Legal Aid defender well used to sitting across the table from lawyers in the District Attorney’s office, he was surprised at the “aggressiveness with which they were approaching this.” Twitter pointed out in court that even if it had the resources to fight all these battles on behalf of their customers, “Twitter will often know little or nothing about the underlying facts necessary to support their user’s argument that the subpoenas may be improper.” As the ACLU aptly noted, third-party companies “just don’t have the capacity—or the incentives—to go to bat against the government each time there is a challenge to one of their user’s rights.”7

  What matters at the moment isn’t that the WikiLeaks Three lost, but why. The court ruled that the users could not complain about the government getting hold of their data, because they had “voluntarily” turned the information over to Twitter. “Voluntarily” is the trick word here. Even assuming using Twitter is voluntary, in today’s world we have little choice but to give our most intimate information to third parties all the time.8 Half the time, we don’t even know the information is being collected. Indeed, in ruling against the WikiLeaks Three, the court justified its position in part by saying the need to give over information like your IP address is “built directly into the architecture of the Internet.” That’s right, but it seems to undercut the court’s own argument that giving over the information is “voluntary.” It quickly becomes clear that “voluntary” in court-speak bears little relation to what ordinary human beings mean when they talk about giving something knowingly and freely to someone else.9

  Under current Supreme Court decisions, virtually any information you provide to anyone is “voluntarily” given and thus fair game for the government to grab. Unless you plan to keep your cash in a mattress, you need a bank and credit. These institutions have all your financial information. Search engine companies know if you looked into breast cancer symptoms, sought marriage counseling, worried whether your kid was autistic, or wondered how to treat your hemorrhoids. “Smart meters” tell utility companies not only how much electricity you are using, but which appliances are using it and when. Radio-frequency identification tags—“RFID”—implanted in your credit cards, your passport, your customer loyalty cards, even ticket stubs, reveal what you buy and where you go. Your cell phone provider not only knows where you’ve been, but where you are right at this moment. The “cloud” holds all your music, your photos, your instant messages, your love notes, and your spreadsheets—even if you’ve done nothing but upload them for your private use. The ACLU’s chief technologist Chris Soghoian has written, aptly, “In the cloud, the government is just one subpoena away.” In theory it may be possible to go off the grid and avoid opening yourself up to any scrutiny—the Unabomber pulled it off for a while—but for most of us it is impossible to live that way.10

  Few today doubt this area of the law is ripe for change, but what makes it tough is that the government claims a good argument of its own. As the judge in the WikiLeaks case pointed out, “The purpose of a criminal investigation is to find out whether crimes have occurred.” The whole reason “the legal threshold for issuing a subpoena is low,” explained a judge in another Twitter user case, is that some investigations would never get off the ground if probable cause were required just to get started in the first place. This sort of worry is in part what has FBI Director James Comey stumping the country fretting about encryption and issuing dire warnings about the government “going dark.”11

  That’s the tension: protect the information, and law enforcement says it can’t go after some bad guys; weaken protections, and we all can say adios to any shard of security from government prying. Caught in the middle are the tech companies, which—frankly—have long tried to have it both ways. A company like Twitter, The New York Times pointed out, has to “play nice with the governments of countries in which it operates.” At the same time, the companies feel the need to reassure users of their privacy. Worse yet, says the president of the Electronic Privacy Information Center (EPIC), Marc Rotenberg, while “commercial providers like to act as though they are adjudicating a dispute between the government and users,” the truth is that many “want access to the data themselves” for commercial purposes such as promoting advertising. They want to hold it, but then it is right there in their hands when the government wants it. And so, Rotenberg concludes, “we are in this very weird triangular space.”12

  This tension between the needs of law enforcement and user privacy—made worse by tech companies’ own complex interests—triggered one of the great legislative standoffs in memory. For over half a decade it has been apparent to everyone involved—legislators, law enforcement, courts, the public—that the laws on the books regulating law enforcement access to digital information held by third parties are hopelessly out of date. Everyone is vulnerable at present. But Congress is paralyzed; the most it has even tried to tackle is access to email, the easiest case for privacy protections. And so the battle is fought out in the courts—the very courts that gave away all our data in the first place.

  WHAT YOU’VE “VOLUNTARILY” GIVEN AWAY

  In a trio of cases from the 1960s and 1970s, the Supreme Court concluded that if you’d given your data to a third party, it was not a Fourth Amendment “search” for the government to acquire it.

  The first case, from 1966, involved the notorious Teamsters Union leader Jimmy Hoffa. The government had gone after Hoffa for violating federal labor law. Hoffa was acquitted. Then the government caught him conspiring to bribe jurors. Critical to the government’s jury tampering case was the testimony of an informant named Partin. Partin agreed to rat out Hoffa to the feds in order to avoid prison for his own misdeeds. Hoffa complained that the government had placed Partin in his inner circle deliberately in order to gather information; the government insisted Partin was acting on his own initiative. Distinction without a difference, responded the justices: the Fourth Amendment simply doesn’t protect a wrongdoer’s “misplaced belief that a person to whom he voluntarily confides his wrongdoing will not reveal it.”13

  Many, justifiably, associate the government’s use of secret informants with totalitarianism. Still, the Hoffa decision has a certain logic to it. Hoffa had blabbed, and in doing so, to paraphrase the Supreme Court’s terminology, he’d “assumed the risk” that the third party he told would turn that information over to the government. Surely, if Partin had decided to go to the government on his own initiative with the incriminating information, no one would have had any problem with that.

  Pretty soon, though, the justices began to rob the idea of “voluntarily” giving information to third parties of all ordinary meaning. In the early 1970s, the government was investigating a fellow named Mitch Miller (no, not the television bandleader, for those old enough to remember) concerning a king-sized bootlegging operation. As part of its investigation, agents from the Bureau of Alcohol, Tobacco and Firearms used a subpoena to get Miller’s financial statements and deposit slips from his banks. Miller cried foul, but—relying on Hoffa—the justices concluded Miller had no Fourth Amendment rights. What the government had collected was “only information voluntarily conveyed to the banks and exposed to their employees in the ordinary course of business.” Just like Hoffa, the justices claimed, Miller took the “risk, in revealing his affairs to another,” that the information would be given to the government.14

  There are two nontrivial problems with applying Hoffa like this to Miller. First, it is not clear any of us “voluntarily” use financial institutions. What is the alternative, exactly? But second, what risk had Miller actually assumed? Sure, he put his money in a bank rather than stashing it in a cupboard. But the risk he took in doing so—that bank officials would reveal his financial records to the government—was close to zero. Bank officials never would have put two and two together, in part because they didn’t have half the information—i.e., any suspicion that Miller was bootlegging. What really happened in Miller was that a federal law required the bank to retain the records, and then the government used a subpoena to force the bank to turn them over. That all may be fine as an accommodation to the needs of law enforcement—we’ll get to that question in just a moment—but to claim the government came across the information “voluntarily” is to torture the English language.15

  The real crusher happened in the decision in Smith v. Maryland. This seemingly limited case from 1979 has become crucial to defining our rights in the information age. A woman was robbed. Then she started getting threatening and obscene phone calls. Once, the caller, who said he was the robber, asked her to step outside while he drove by her place. The police soon spotted the vehicle in her neighborhood, and obtained the car owner’s name and address by tracing the license plate number. Then they arranged for the phone company to install a “pen register”—a device that records the phone numbers a caller dials—which showed that Smith was phoning the woman from his home. This information was used in turn to get a warrant to search Smith’s house, where yet more evidence was found to convict him. Smith asked to have all the evidence thrown out, on the ground that installing the pen register was a warrantless “search.”16

  The Court held Smith had no expectation of privacy in the phone numbers he dialed, because—as you surely can guess by now—“[w]hen he used his phone, [Smith] voluntarily conveyed numerical information to the telephone company and ‘exposed’ that information to its equipment in the ordinary course of business.” This makes less sense than Miller. Unlike the bank, the phone company wasn’t even holding the information the government wanted. The government had to have the company attach a device to collect the information. Still, the Court said that it didn’t matter whether the phone company chose to collect this sort of information on its own or not: “Regardless of the phone company’s election” the company “had facilities for recording it and was free to record.” Translated: If a third party is capable of gathering the information the government wants, it can make them collect it and turn it over.17

  If the logic of Smith were solid, it gets very difficult to see why the government can’t just ask the phone company to record your conversations whenever it wants. After all, the phone company is every bit as capable of recording conversations as it is phone numbers dialed—the fact that they don’t do it doesn’t mean they couldn’t. The justices in Smith distinguished Katz, in which—as we saw in the last chapter—they held that wiretapping was out, by stressing that the pen register didn’t capture the content of conversations, just the phone numbers dialed. But, as Justice Stewart, the author of the Katz decision said—dissenting in Smith—most people would not “be happy to have broadcast to the world a list of the … numbers they have called.” Not because it would incriminate them, but “because it easily could reveal … the most intimate details of a person’s life.”18

  Given what a creep Smith was, it is easy to see why the Supreme Court ruled as it did, but nothing can reel back the unfathomable license the decision has been taken to grant the government. Smith has been used to justify everything from location tracking to bulk data collection by the National Security Agency. Police officials take full advantage of this third-party rule, in numerous cases, to obtain big helpings of personal information. In 2012, cell phone companies reported they’d received 1.3 million demands from law enforcement for everything from texts to location information. And, consistent with the “triangular” positioning of the tech companies, it has even turned into a major revenue stream for the businesses. AT&T alone took in more than $8 million dollars that very year by turning over its customers’ information in response to law enforcement demands. At a private conference held in Washington, D.C., for law enforcement and their vendors, Sprint Nextel’s “manager of electronic surveillance”—that’s quite the job title, no?—described how it had set up a dedicated website so police could access customer information directly from their desks. “The tool has just really caught on fire with law enforcement,” he bragged.19

  SUBPOENAS: A LICENSE TO PRY

  What makes matters worse still is how the government gets its hands on most of this third-party information—by using a subpoena. A subpoena is an order to produce documents or other information at a given place or time, backed up by the threat of being held in contempt of court. Unlike with a warrant, to get a subpoena law enforcement officials need not show probable cause, and they don’t even have to get permission from a judge. In the Miller case, the Supreme Court blithely described how Treasury agents “presented” the bank presidents “with grand jury subpoenas issued in blank by the clerk of the District Court, and filled in by the United States Attorney’s office.”20

  The origin of prosecutors’ “blank check” authority to issue subpoenas rests in the traditional function of the grand jury, an evidence-gathering body that dates back as far as twelfth-century England. Grand juries, usually composed of from twelve to twenty-three people, are empaneled to investigate crime in the community. If the grand jury concludes there is cause to believe a crime has been committed, it hands down an indictment, signaling the start of criminal proceedings. The Supreme Court has said that a grand jury “can investigate merely on suspicion that the law is being violated, or even just because it wants assurance that it is not.” Its job “is not fully carried out until every available clue has been run down and all witnesses examined.” Given this “broad brush” role, the logic runs, it would make no sense to require probable cause even to begin investigating. As the Twitter court pointed out, requiring probable cause would stop an investigation in its tracks before it got going.21

  If you are wondering, reasonably, how to square grand jury fishing expeditions with the probable cause requirement of the Fourth Amendment, the answer rests in the fact that historically the grand jury was separate from the government. Just like the Fourth Amendment itself, the grand jury was understood as a check on government. The grand jury’s “most valuable function,” the Supreme Court has said, is “not only to examine into the commission of crimes, but to stand between the prosecutor and the accused.”22