02:14 PM

Microsoft, Google Want Internet Privacy Changes

The Digital Due Process coalition says the same legal requirements for offline criminal investigations should apply to online information.

A group of prominent technology vendors including Microsoft and Google have formed a coalition calling for a rewrite of a decades-old Internet privacy law, saying the U.S. government currently has too much access to online information.

Calling themselves the Digital Due Process coalition, the group, which also includes eBay, Intel, AT&T, and the ACLU, wants to update the Electronic Communications Privacy Act to require the same legal due process for offline information in criminal investigations -- such as subpoenas and warrants -- to apply to online data.

ECPA went into effect in 1986 to specify standards for what access law enforcement agencies have to electronic communications and data. The group said that while ECPA was a "forward-looking statute" at the time, "it has been outpaced" since it has not been significantly revised in more than 20 years.

"ECPA is a patchwork of confusing standards that have been interpreted inconsistently by the courts, creating uncertainty for both service providers and law enforcement agencies, according to the group's Web site. "ECPA can no longer be applied in a clear and consistent way, and, consequently, the vast amount of personal information generated by today's digital communication services may no longer be adequately protected."

The group wants the law to accurately reflect people's current use of digital technology, which has clearly escalated since the law was drawn up.

At the same time, it wants ECPA to be flexible enough so law enforcement agencies can work with companies that maintain Internet infrastructure to investigate cybercriminals, sexual predators, and other potential criminals, the group said.

The Digital Due Process coalition is not asking for an entire rewrite of the law. Rather, it wants to update it to reflect some of what it considers the most important issues that arise under the current law: access to e-mail and other information stored in the cloud, access to local information, and the use of subpoenas to obtain data from online transactions.

To support its mission, the group has come up with several principles for the changes it wants to make to ECPA.

They include the following: information should be protected regardless of the technology or platform used to create, communicate or store it; all the same principles of U.S. criminal investigations should apply to online information; information should be protected whether it is in transit or storage; the content of communications should be protected by a court order based on probable cause; all stakeholders deserve clear and simple rules; and all exceptions that have been written into the ECPA over the years should be maintained.

The group's Web site contains a complete list of participants, principles, and other information about its goals.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.