It’s all on “The Cloud” these days — our documents, our photos, our finances, our music, our lives.
It’s so ubiquitous and growing so fast that one recent study said that by 2025 the cloud will be home to an estimated 175 zettabytes of data — whatever the heck that means.
Actually, a zettabyte is a trillion gigabytes, all stashed on the system of remote servers that make up the all-knowing cloud that didn’t even really exist 15 years ago. The researchers said that if that data was burned onto CDs the stack would reach the moon 23 times, which would probably look a little like my car in college.
With all that data floating around out there, we probably don’t often consider who can access it and when and how.
As of Tuesday, Utah became the first state in the nation with a law on the books making it explicit that police and law enforcement must obtain a warrant from a judge before obtaining digital data from third parties, including e-mail providers and cloud services like Dropbox and Google Drive.
Rep. Craig Hall, R-West Valley City, sponsored House Bill 57 after reading about Missouri voters amending that state’s constitution to add electronic records to existing protections — patterned after the Fourth Amendment to the U.S. Constitution — prohibiting warrantless searches and seizures of physical records.
“Statutes have not kept pace with new technology. For example, I think everyone would agree … if I sat down and drafted a document and saved it on my hard drive, if law enforcement wanted that document they would have to get a warrant,” said Hall.
“It’s a little less clear if I sit down at my laptop and store it on Dropbox or Google Drive. … There’s a lot of case law out there that says once you transmit information to a third party you lose that legitimate expectation of privacy.”
The bill was backed by the American Civil Liberties Union and the Libertas Institute, a libertarian think tank.
Libertas Institute president Connor Boyack said previously law enforcement had been able to obtain electronic records without judicial oversight.
Until 2014, for example, law enforcement had the authority to issue “administrative subpoenas,” which let investigators request data without going to a judge. That practice was largely suspended in Utah after a Tribune investigation found the subpoenas were not being used in emergency situations, as law enforcement had touted the tool.
Other times, Boyack said, law enforcement around the country has been able to get information simply by asking for it. Now, he said, officers have to get a judge to grant access to specific information or risk the evidence being unusable in court.
“Our entire lives are catalogued on these little surveillance devices we carry with us everywhere — our locations, our behaviors, our photos, our interactions with others,” Boyack said. “There’s been a disconnect where there is this expectation of privacy where people assume that information on their phone is safe from snooping and government eyes and that’s not been true in the cloud.”
Dan Burton, a spokesman for the Utah Attorney General’s Office, said their investigators have to get a warrant to access content on an account. Under the law, subscriber information — like a name or address — can be obtained through an investigative subpoena, which must be approved by a judge.
Despite some initial concerns, the Attorney General’s Office was able to hammer out a compromise with Hall and the bill ended up passing both the House and Senate unanimously.
“We’re not saying law enforcement should not be able to get that information,” Hall said. “We’re just saying that if law enforcement wants that information they should obtain a warrant. In these days, law enforcement can get a warrant in minutes.”
He’s right.
Judges are on call 24 hours a day to approve warrant requests and, as my colleague Jessica Miller reported last year, half of all warrants are approved in less than three minutes with some being signed off on in as little as 30 seconds.
So it’s not as if the Legislature has erected some insurmountable hurdle.
And there are reasonable exceptions to the warrant requirement. Police don’t need to get a warrant in cases where there is an imminent risk of serious injury or death or if a suspect is livestreaming a sexually exploitative crime.
Hall’s bill could become a model for other states interested in protecting digital records. Libertas and the ACLU are working with partners in other states and Hall recently discussed his bill on the National Conference of State Legislatures podcast.
Ultimately, it would be worthwhile for Congress to establish these kinds of protections nationwide — and possibly a good legislative fit for Sen. Mike Lee, R-Utah.
Because as our digital world rapidly evolves and the zettabytes pile up, clarity when it comes to accessing that data and protecting our privacy will only become more important.
Follow @RobertGehrke