Lost: Fourth Amendment, Last Seen Heading Toward Cloud
The next time you think about having your data ride shotgun in the Cloud, think about this: "Under current law… data stored in the cloud is less protected against government overreaching than data stored locally," writes CDT President Leslie Harris in her latest Huffington Post article, "Don't Tread on My Cloud." (However, if you live in Kentucky, Michigan, Ohio or Tennessee you catch a break. Those states are covered by the single federal appeals court to rule data stored in the cloud has Fourth Amendment protections.)
The judicial landscape around this issue of government access to data stored in the cloud is a "crazy quilt of statutory provisions and judicial decisions" that creates uncertainty in users of cloud-based services, Harris writes.
Things go sideways in a hurry when data moves from being being stored on your personal home computer or printed out and placed in a filing cabinet, where that data is given full Fourth Amendment protections, barring government agents from rummaging around your hard drive and locked files unless they have a warrant, issued by a judge, based on probable cause.
[T]he U.S. Justice Department argues that you surrender your Constitutional rights when you store that very same data with a cloud service provider. Under the government's view, a cloud service provider can be forced to disclose whatever it has with a mere subpoena, issued by a prosecutor or an FBI agent, with no approval by a judge and without any reason even to suspect the record subject to be involved in criminal conduct. Digital data deserves the same checks and balances long applied in the offline world.
Harris concludes her column saying that its clearly time to update the Electronic Communications Privacy Act (ECPA). A coalition of groups, including CDT, have called on Congress to do exactly that. "[T]he initial author of ECPA, Sen. Patrick Leahy has himself concluded that the law is now outdated and he has introduced legislation to reform ECPA and require a warrant for government access to proprietary or private data stored in the cloud," Harris writes.