02:14 PM

Microsoft, Google Want Internet Privacy Changes

The Digital Due Process coalition says the same legal requirements for offline criminal investigations should apply to online information.

A group of prominent technology vendors including Microsoft and Google have formed a coalition calling for a rewrite of a decades-old Internet privacy law, saying the U.S. government currently has too much access to online information.

Calling themselves the Digital Due Process coalition, the group, which also includes eBay, Intel, AT&T, and the ACLU, wants to update the Electronic Communications Privacy Act to require the same legal due process for offline information in criminal investigations -- such as subpoenas and warrants -- to apply to online data.

ECPA went into effect in 1986 to specify standards for what access law enforcement agencies have to electronic communications and data. The group said that while ECPA was a "forward-looking statute" at the time, "it has been outpaced" since it has not been significantly revised in more than 20 years.

"ECPA is a patchwork of confusing standards that have been interpreted inconsistently by the courts, creating uncertainty for both service providers and law enforcement agencies, according to the group's Web site. "ECPA can no longer be applied in a clear and consistent way, and, consequently, the vast amount of personal information generated by today's digital communication services may no longer be adequately protected."

The group wants the law to accurately reflect people's current use of digital technology, which has clearly escalated since the law was drawn up.

At the same time, it wants ECPA to be flexible enough so law enforcement agencies can work with companies that maintain Internet infrastructure to investigate cybercriminals, sexual predators, and other potential criminals, the group said.

The Digital Due Process coalition is not asking for an entire rewrite of the law. Rather, it wants to update it to reflect some of what it considers the most important issues that arise under the current law: access to e-mail and other information stored in the cloud, access to local information, and the use of subpoenas to obtain data from online transactions.

To support its mission, the group has come up with several principles for the changes it wants to make to ECPA.

They include the following: information should be protected regardless of the technology or platform used to create, communicate or store it; all the same principles of U.S. criminal investigations should apply to online information; information should be protected whether it is in transit or storage; the content of communications should be protected by a court order based on probable cause; all stakeholders deserve clear and simple rules; and all exceptions that have been written into the ECPA over the years should be maintained.

The group's Web site contains a complete list of participants, principles, and other information about its goals.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
8 Key Building Blocks for Enterprise Network Defense
Networks are changing rapidly -- and so are strategies for protecting them. This Tech Digest looks at the fundamentals for the next-gen environment.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In this episode of Dark Reading Radio, veteran CISOs will share their experience and insight into how organizations can get the best bang for their security buck.