The AP's Privacy, and Ours
The offices of the Associated Press in Manhattan, New York May 13, 2013. Reuters/Adrees Latif
On a Friday afternoon in May, a lawyer for the Associated Press received a letter from the Justice Department informing the news agency that, unbeknownst to it, the DoJ had obtained two months’ worth of phone records for twenty AP phone lines—including the personal and office lines of five reporters and an editor—at several AP bureaus. The records were obtained without the approval of a court, and without advance notice to the AP or the affected journalists.
The press is, as expected, up in arms, as are members of Congress from both parties. But it’s far from clear that the DoJ did anything wrong. Because the subpoena was issued in an ongoing criminal investigation, there is only limited public information about why the prosecutor made such a sweeping request. But the leak being investigated was indisputably serious. It concerned an ongoing CIA operation that had apparently infiltrated a terrorist cell of Al Qaeda in the Arabian Peninsula. Whoever revealed that fact was no whistleblower; it’s difficult to see any possible justification for revealing that we had infiltrated a terrorist cell. The AP, at the government’s request, did delay publishing the story, but that hardly exculpates the leaker, who compromised a critically important ongoing investigation. Attorney General Eric Holder called it one of the gravest leaks he’s seen in his entire career.
The Justice Department sought the AP records only after spending months pursuing other avenues to identify the leaker, including interviewing 550 people. Only when the interviews proved fruitless did he seek the reporters’ phone records. Five reporters and one editor worked on the story, and if there was no other way to narrow the inquiry, it’s possible that the request for records was justified, and would have been authorized had the Justice Department sought court approval.
We know from past experience that there are legitimate grounds for concern about overclassification, punishment of whistleblowers and the chilling of press freedoms. But that doesn’t mean that every leak is an act of heroism, or that every journalist should be immune from criminal investigation. Our legitimate concerns will lose credibility if we too often respond with a jerk of the knee.
But the specifics of the leak and subpoena are much less important than what the incident reveals about the law’s failure to protect not just the press’s confidential communications, but the privacy rights of us all in the digital age. Consider this: in 2011 alone, cellphone companies responded to 1.3 million subpoenas and other requests from law enforcement for subscriber information, including text messages, phone data and location information. Verizon alone responded to more than 260,000 requests. And the numbers have been increasing dramatically each year. AT&T received an average of 700 law enforcement requests a day in 2011, up by 300 percent from 2007.
Why the dramatic increase? So many of us carry smart phones, on which we record our transactions—phone calls, text messages, e-mails, Internet browsing and the like. Smart phones also transmit to our service providers a record of our physical whereabouts. This information can be highly useful to criminal investigations. It can refute an alibi, help identify co-conspirators, track fraudulent transactions and the like. But it can also disclose nearly everything about our personal lives that we do not keep stored exclusively in our (as yet) unwired brains.
Thanks to the Supreme Court, these records receive no Fourth Amendment protection when, as in the AP investigation, the government gets them from a third party, in this case the phone company. Long ago, the Court ruled that we have no “reasonable expectation of privacy” with respect to information we share with others, and therefore no protection against the government’s obtaining that information from a third party. Because everything we do on our phones is “shared” with our service provider at a minimum, the Fourth Amendment requires no warrant or probable cause for the government to seek such information.
Since the Supreme Court has essentially bowed out, our protections depend on Congress. Current law requires, for example, that the government obtain a court order that evidence is relevant to a criminal investigation in order to obtain real-time phone records of whom one calls and for how long. It imposes a somewhat higher standard, requiring “specific and articulable facts,” for stored e-mail addressing data. But even that requirement—a standard less rigorous than probable cause—does not apply to stored records of phone transactions. That’s why the DoJ could obtain the AP reporters’ phone records (and ours) without a court order or a specific showing of need.
More disturbing still, if the government wants to read the content of our e-mails, not just the address information, the Electronic Communications Privacy Act (ECPA) requires it to obtain a warrant only if the e-mails are less than six months old; once they’ve been stored for more than six months, they lose that protection. At the time the law was enacted, e-mail storage space was limited, and it was thought that few e-mails would be stored that long. But with the advent of unlimited storage in the cloud, the norm today is to keep all but junk e-mail. Should the contents of our e-mails be available to government prying just because they are far down in our inbox?
In other words, the problem here is not one of press freedom. It’s more fundamental: it’s about privacy generally. The Fourth Amendment’s protections are increasingly going the way of the land line and the cassette player, rendered obsolete by technological innovations. We are unlikely to give up carrying our homing devices, otherwise known as cellphones. Unless we insist on statutory protection, it’s not just AP reporters but all of us who will be at the mercy of a prosecutor’s discretion.
Senator Charles Schumer has revived a federal press shield law, but that’s not sufficient. The problem goes much further. Four members of Congress (Republicans Justin Amash and Mick Mulvaney, and Democrats Zoe Lofgren and Jared Polis) have introduced a bill to require court orders for access to phone records—not just for the AP or other members of the press, but for us all. And last year a Senate committee approved amendments to the ECPA that would protect the contents of all e-mails, eliminating the outmoded six-month time limitation. These legislative reforms, and others, are critical if we are to preserve privacy in an age when law enforcement officials make more than 1.3 million requests a year to our communications service providers for our most private information.