02:14 PM

Microsoft, Google Want Internet Privacy Changes

The Digital Due Process coalition says the same legal requirements for offline criminal investigations should apply to online information.

A group of prominent technology vendors including Microsoft and Google have formed a coalition calling for a rewrite of a decades-old Internet privacy law, saying the U.S. government currently has too much access to online information.

Calling themselves the Digital Due Process coalition, the group, which also includes eBay, Intel, AT&T, and the ACLU, wants to update the Electronic Communications Privacy Act to require the same legal due process for offline information in criminal investigations -- such as subpoenas and warrants -- to apply to online data.

ECPA went into effect in 1986 to specify standards for what access law enforcement agencies have to electronic communications and data. The group said that while ECPA was a "forward-looking statute" at the time, "it has been outpaced" since it has not been significantly revised in more than 20 years.

"ECPA is a patchwork of confusing standards that have been interpreted inconsistently by the courts, creating uncertainty for both service providers and law enforcement agencies, according to the group's Web site. "ECPA can no longer be applied in a clear and consistent way, and, consequently, the vast amount of personal information generated by today's digital communication services may no longer be adequately protected."

The group wants the law to accurately reflect people's current use of digital technology, which has clearly escalated since the law was drawn up.

At the same time, it wants ECPA to be flexible enough so law enforcement agencies can work with companies that maintain Internet infrastructure to investigate cybercriminals, sexual predators, and other potential criminals, the group said.

The Digital Due Process coalition is not asking for an entire rewrite of the law. Rather, it wants to update it to reflect some of what it considers the most important issues that arise under the current law: access to e-mail and other information stored in the cloud, access to local information, and the use of subpoenas to obtain data from online transactions.

To support its mission, the group has come up with several principles for the changes it wants to make to ECPA.

They include the following: information should be protected regardless of the technology or platform used to create, communicate or store it; all the same principles of U.S. criminal investigations should apply to online information; information should be protected whether it is in transit or storage; the content of communications should be protected by a court order based on probable cause; all stakeholders deserve clear and simple rules; and all exceptions that have been written into the ECPA over the years should be maintained.

The group's Web site contains a complete list of participants, principles, and other information about its goals.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Latest Comment: nice one good
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas in a thought-provoking discussion about the evolving role of the CISO.