Why Electronic Data is Different than a Filing Cabinet (Perspective)

Microsoft recently challenged the court-ordered secrecy of warrants under the Electronic Communications Privacy Act (ECPA) by relying on physical search analogies like the knock-notice rule for home entry under the Fourth Amendment. Others commentators would treat electronic data like paper stored in a filing cabinet.

These positions make some sense. Public concern has been widespread since 2013 when global media began publishing unprecedented amounts of previously-classified information regarding U.S. government surveillance. Data about people is being used extensively by companies, by researchers, by marketers, by reporters, by governments — by everyone — and we should be paying attention. Further complicating matters for companies, U.S. court orders and discovery rules are often in tension with the restrictions on data disclosure imposed by other governments. More than ever, privacy is complicated, and privacy sells.

However, these analogies are not as fitting as they may seem. Electronic data isn’t precisely like paper in a filing cabinet, and ECPA orders aren’t quite the same as physical search of a house. Some electronic data is created by individuals, and some of it is created about them in circumstances that traditionally wouldn’t have raised privacy concerns. Physical location of electronic data can be tricky to nail down: it’s packetized and split apart when it’s in transmission, and when it’s digitized and stored in a cloud, it’s often housed in multiple, redundant locations. Interception of phone calls is a better analogy than a filing cabinet — and is something that is authorized by CALEA and similar laws in virtually every nation in the world. Even this, though, isn’t a perfect analogy.

The temptation is to address these definitional problems by drawing a bright line of non-cooperation. However, it would be foolish to pretend that there are no social costs to this.

In considering the needs of both privacy and security, there is a basic asymmetry at play. Privacy of personal information feels, well, personal. On the other hand, threats to public safety often feel more removed: A truck driver in Nice? Police shootings in Baton Rouge? The personal and tangible threat to our own privacy laid up against diffused and intangible public goods like safety and security highlight the struggle to balance those competing interests.

Effective legal analysis often rests on analogies, and it’s critical that we continue the dialogue that will lead us to more adept and nuanced analogies: analogies that will help us think clearly about the realities of electronic data, and about our collective interest in individual privacy as well as in public safety international security.

Freedom of speech and being free from unreasonable searches and seizures are not monolithic concepts. They don’t set bright line rules requiring notice about warrants in all instances; instead, they allow for checks and balances on governmental overreaching. As a former criminal defense lawyer, I’m familiar with the very real potential for abuse and government overreach in criminal investigations. However, as a former member of the intelligence community — and as someone who reads the news today — I’m also aware of the very real nature of threats that exist virtually and physically – everywhere.

As we continue searching for the right balance of laws, government owes the public transparency and accountability. The global community of nations owes business a more effective regime of international law that reduces jurisdictional conflicts over data privacy and data disclosure. Commentators owe the public more nuanced information than bumper stickers. Business owes the public a commitment to participate in the mechanisms that support safety and security. And each of us owe society a commitment to look beyond slogans and soundbites into the complexity of these issues as we consider how to balance our personal privacy interests with the public good.

The views and opinions expressed in the piece are those of the author and not those of the NSA/CSS.