Poorly Written Laws That Age Badly

Much has been written, not least by me, about the problematic nature of the Electronic Communications Privacy Act of 1986 in achieving its goal to protect privacy.   Especially since the USA-Patriot Act exacerbated its gaps by lowering the bar for law enforcement to obtain metadata, ECPA has been shown by courts to be so poorly written as to become a joke among appellate judges.  Privacy advocates, including me, call it Swiss cheese.  Metadata in Internet communications includes Internet Protocol addresses.  Web browsing translates into web pages.  Web pages equal content.  For the disclosure of content, the law requires a warrant.  Under ECPA, as amended, all it takes nowadays – in either criminal or our “secret” FISA court – is a letter filed with a clerk.  That’s why the Swiss cheese metaphor.

In the 9th Circuit plaintiffs are asking whether data mining practices of Google’s Gmail violates ECPA.   Market forces drive technology and social norms so hard in the United States that most people either wouldn’t think to ask the question or have accepted data mining and targeting advertising practices as the cost of “free” services.  Thankfully, plaintiff lawyers, those maligned implicit drivers of policy reform in this country, and their clients are forcing the question.  Judges, for once neither enamored with technology nor intimidated by Internet titans, are allowing those cases to proceed.   Is it an illegal interception of a person’s electronic communication for automated services to mine the contents of the mail for the Internet companies’ business purpose of selling that acquired information and/or using that information to target advertising.

If this state of affairs surprises you, you might ask yourself how is it that consumer Google or Box or Facebook – among the many other similar companies – offers you those cool services for free?  That information is how they pay for all of those servers and temperature control rooms and staff to manage them, write software, or web designers, project managers, vice presidents who make hundreds of millions of dollars right on up to the billionaire Page and Zuckerbergs of the world.

A word about higher education in this space needs to come out of college and university attorney cocoon and be shouted from the rooftops.  I could name names, but suffice it to say that there are some among that number who have led the charge to fight Google in particular – but Box and many other Internet and e-Text publishers/companies – to create enterprise contracts that prohibit data mining practices.   Because of their leadership, provisions prohibiting those practices have become the norm in higher education.  Let’s take a moment to thank them, because it was not always easy.  Internet companies railed against those provisions, but softened when they knew some money was coming their way via the enterprise nature of the agreement, and even more remunerative was the promise that once the student graduated – and the enterprise protections fell away – those companies had the graduates’ eyeballs and loyalty and all that information in an account that would take a lot of thinking and effort to change.   More hurtful to those efforts were the CFOs and CIOs and Directors of mail services who kept moaning about how law just gets in the way and makes everything take too long and don’t those attorneys know that we are in a new age???   In light of these cases making their way through the courts, those attorneys might have saved your job and/or your reputation.

We are in a cycle of history where the market and technology mow right over existing laws.  The glamour of shiny new devices and fascination of new services has the tendency to have us look away.  When we do look, we, I not least, complain about the gap between law and technology.  But now let us take a moment to reflect on the potential that even Swiss Cheese has to help us find middle ground between traditional norms and the brave new world.  FERPA was the compass that ground the laudable efforts of our leading college and university attorneys who fought data mining and advertisements in enterprise contracts for mail and storage and e-texts and portfolio sites, etc.  Low and behold, it is now ECPA, of all laws, that is the vehicle for a significant consumer privacy campaign.  Interesting how that funky, faulty law cuts both ways.   And take note, U.S. society, without a lot of fanfare, higher education actually led the way.