also as an individual, and understand that the our discussion on both sides of that issue and there are complicated. bottom line is that we need to understand what drugs work when they work. we need to understand that patients did have access to promising drugs as soon as possible. companies make those decisions as to how they're going to handle that process. the fda has approved almost all the applications they received, and we need to have those discussions to come to a better resolution about how to address that issue. >> what i would say is that whatever we can do, i think i speak for a lot of the members of the committee, i'm probably a little more out there than some, but whatever we can do to help by changing the law to expedite that process we will do. >> we would be glad of those discussions. >> ms. furlong, did you want to make a comment about risk assessment? it is obvious and when your boys were sick, it would've taken anything that had any promise of

hope. >> i could tell you stories about looking in china to see there's some tea you might be up uphold about, but that was long ago. i think there's also it really is up to the companies. fda has always to my knowledge at least in duchenne and other fields been willing to entertain and talk about compassionate use? i think for the rare disease community is talks about and get us back to trial design but in general, trials are designed to test a sub set of patients. in the duchenne committee, the six minute walk test is standard outcome, primary outcome measure. that means a child with duchenne would have to walk six minutes and even further as learn more about the testing it's in a very narrow subset of people in that six minute walk test. ..

>> program was put into place at te national cancer institute. so with that longitude, that breadth of experience within your specialty, are there things that you want to share with others about what that experience has taught you? >> well, let -- what we did back in 1965 or whenever was a lot different than what we're doing to do. i don't want to take too much, take the time to really go into it. you may be aware of it. but here is the message: it didn't happen overnight. it took 40 years of research to get us to the tipping point

where we understood the genome and had the opportunity to take advantage of that and move forward. immunotherapy, the same story. it's taken us 40 years. that was a substantial amount -- i don't want to underestimate the value of research investment to get us to the point where we are where suddenly we look like we have so much to offer and to do. i also comment with regard to my copanellists that they have populations, and they have demonstrated that finding the patients where they are is critically important. we have a substantial amount of work to do to understand not only the clinical trial mechanism, but also the medical practice system so we can make sure that patients in communities -- i live in a small town in south georgia -- that my friends have opportunities to get these drugs, clinical trials and be part of that process. there's a lot of work to do. >> great. thank you, mr. chairman. i yield back. >> chair thanks the gentleman. now recognizes the gentleman from new york, mr. engel, five minutes for questions. >> thank you, mr. chairman and

mr. pallone, for holding this hearing. i'm pleased to have this opportunity to further consider how patient perspectives can both -- best be incorporated into the therapeutic development process. as the author of the als registry act and the wellstone husband collar dystrophy research education amendments of 2008 and 2013 along with my colleague, dr. burgess, i've worked to be a voice for those with rare diseases. i'm encouraged into the advancements we've made into the causes of these diseases as well as our progress, but obviously, we still have a long way to go. one of the most striking gains we've made is for individuals with due chen muscular dystrophy. our efforts have added an average of ten years to the life expect sanity of those with -- expectancy of those with duchenne. the patient community brings an important perspective and understanding to this process,

and i'm interested to see how we can best use that knowledge to assist medical researchers with therapy development. i'm particularly interested in the way the duchenne patient community is engage with the the fda to help inform the benefit/risk determine nations -- determinations as well as the community guidance document you referred to in your prepared testimony. could you please comment on how you hope to see these efforts affect the therapeutic pipeline and the various stakeholders who are part of that pipeline? >> yes, thank you, mr. engel, for the question. the benefit/risker origin -- originated with discussions with fda, and it was known that we were telling anecdotal stories that the ration was different in, for instance, duchenne muscular dystrophy. and in that the fda suggested that they agreed, but they didn't have anything they could rely on, any quantified,

evidence-based document that could help them headache those decisions. so -- make those decisions. we learned that their priority is disease stabilization, and they were willing to accept great deal of risk. in fact, they're living with great deal of risk as they know that their child has a fatal illness. so the fda has now asked us to expand that study to a greater number of patients than 120 patients and also to ask these questions of young men with duchenne. our hope is they will incorporate it into the review process and they will demonstrate how and when hay use it and when they don't and what makes sense as they make their decisions. >> thank you. and thank you for your advocacy and hard work. it's very much appreciated. dr. sommer, can you talk about the role you think that patient perspectives should play in developing therapies for diseases like als and muscular distoty for which quality of life is obviously and especially

important pack to haves -- factors to patients. how can the fda best consider the views of patients and families when examining the benefit/risk calculus for these diseases? >> thank you for that question, mr. engel. this really kind of expands across the entire field of rare diseases, but your question's particularly relevant for those two groups. patients often tell us about things that they wish were better that we never thought of. one of the things i've run across time and time again when we ask our patients what's the worst part of this disease, and a lot of times it's parents in the case of pediatric patients. sometimes the things we thought were most important were number nine or ten on the list. so i think when we look at our therapeutic targets are, what our quality of life targets are for these diseases, patient and family input is a huge factor. and i think it's something we can incorporate a lot better than we have. i think during the early stages particularly when we're designing our pivotal trial, clinical trials looking at what

end points are, i think those are going to become more and more important. the other thing, of course, is the small group sizes with these. many times it's hard to pick one single outcome variable that you're going to be able to achieve. the smallest study i've been involved with was five patients for an approval process. getting one exact target for that, fortunately, the effect of the drug was mass i have, so we were able to do it. but if it had been milder, i might have needed more than one outcome variable. so i think families can help us determine what's important there. they can help us, also, as we've talked about with some of what risk is tolerable in those situations. it's different. there are 7,000 different rare diseases. each one of these is unique in its own regard. but there are some commonalities like that. >> well, thank you, and thank you for your comments and also thank you for your interest, and i want to thank the panel for -- very interesting discussion. thank you, mr. chairman. >> chair thanks the gentleman, now recognizes the gentleman from florida, mr. bilirakis,

five minutes for questions. >> thank you, mr. chairman, i appreciate it. and thanks for, thank the panel for their testimony today. i know we've been talking about this, and you've had an opportunity. i want to give you more of an opportunity to respond on this. on wednesday i asked one of the witnesses about his statement in including patients in the clinical trial process, but i want to make sure that y'all have every opportunity to respond to this. if patients had a greater role in clinical trial design -- and i know you've touched upon this -- if trials measured qualitative data from patients like how do you feel, is it less painful, what have you, how would things be with different, and what would you like to see? we'll start with the -- >> i'd like to start. first of all, the patient-reported outcomes, i think, has been part of every clinical trial in cystic fibrosis for the last 10 or 15 years.

some of the tools are not the best at this point, but we're working to refine be them. we have just spent as a foundation a large effort to look at patient-reported outcomes as a specific, validated tool for cf. and it's going to be submitted to the fda and go through a validation process. in the past we've used one that was generally for lung disease, but it may not be specific. so this is a science that's evolving. i mean, you know, a decade ago or 15 years ago, 20 years ago, pros were not really incorporated. so it's a science that's evolving, and it has to be evolved not only there at the fda, it has to be evolved with the sponsors too, because they've got to be willing to incorporate those into the clinical trial process. so i'm encouraged by the process, but i will tell you just in this last trial we had where the lung function went up and the exacerbations went down, we didn't have a statistically significant improvement in the patient-reported outcomes because we're treating -- when

you're starting to treat the basic defect, you're treating the whole disease process. and you're looking at extending lives. and the patients may not feel that from day day-to-day, but over years you may have a tremendous impact on those patients. so a tool that can be used, but it shouldn't be used exclusively. >> thank you very much. ms. fur long, do you have a response? >> i agree, patient-reported outcomes are incredibly important, but i think this is where involving the patients in the design and conduct of clinical trials is really going to be important. because, for instance, how do we measure energy and endurance? how do we know that turning over in bed is important to patients as opposed to an outcome measure such as the six-minute walk test? for instance, as you can imagine, if a boy can still text at the age of 18, that gives him independence. if a child can walk up a single step, they can enter buildings. if a child can roll over in bed, that makes the family's quality of life much, much better.

so i think the use of patient-recorded outcomes, including the patient voice in the discussion about what the clinical trial looks like and what the measurements are, both primary and secondary, is going to be incredibly important. >> thank you, so much. do you have a comment? >> i think these outcomes are so critical. in the world that we're developing drugs in, which is in psychiatry often, in schizophrenia, depression, addiction, the end point of the clinical trial, the hard end point is asking people, essentially, how do you feel. how do you feel is typically embodied in a set of validated scales, but those often don't capture some of the most important parts of how they actually feel. a perfect example is an opioid dependence where critical questions they ask, is my craving going to go down? it may block the receptor and keep me from drinking, but is my craving going to change? that was not a validated end point. that was something we couldn't incorporate in the label, but

it's essential to patient's perception. >> good point. doctor? >> about four weeks ago at the oncology meetings they showed a picture of a lady who was 96 years old who had received a phase i drug. that in itself is a fascinating point, whose cancer completely resolved. and on the bottom end of the before-and-after picture, on the after picture you saw the trace of a little smile. and i noticed that smile, and i tweeted it, actually. i took a picture and tweeted it, and it got retweeted quite a bit. and then the lecturer said, yes, that really is a smile in front of 2,000 people. what i'm trying to say is by that example is that's what we have to -- we have to be able to measure and aggregate in a scientific way to show that the treatments make a difference. one example of one lady in an unusual situation, but something i think all of us would agree and i would echo the comments already made, so critical to

understanding particularly in on cog world what we do and how we do it and the goal we have to have of improving quality of life. >> thank you. dr. summar? >> yeah. i'll just use another example too. we had a new medication we were looking at. most of the patients with rare diseases are on the medicines they take for life, so it's every day, day in, day out, and these care plans are often complex and highly -- they really affect the whole family. so the new drug looked like it was promising from the standpoint of, you know, maybe a little bit better efficacy, a little bit better control. but it was five times a day instead of two or three times a day compared with the old one, and the families were like why would we add three more times a day of dosing for this small effect? no one had really bothered to ask them that before we started. so i think there's all of these things that really getting the patient input is going to make a difference. >> thank you so much. appreciate it. mr. chairman, can i ask one more question? >> you hay proceed. >> okay, thank you so much.

appreciate it. dr. balel, the venture philanthropy model has produced incredible results, congratulations. your foundation found your breakthrough drug when it helped translate some of the early research through the valley of death, and now you have the -- [inaudible] sounds similar to, i'm sorry. [laughter] how were you able to establish this program, and how can other groups adopt this similar model? >> well, it's a willingness to take risk, that's what you have to do in drug discovery. we were frustrated by the fact that companies were not getting involved in the orphan diseases, so the whole concept here was to say take some of the risk out of biotech companies or pharmaceutical companies to get engaged in cf research. as i said, we spent $42 million initially to start screening that led to kaleidiko. i think what's the most important and gratifying thing,

i know ms. furlong was my in my office a number of years ago, and it's the ability and what we're seeing is so many other organizations are feeling the same impatience our foundation felt 14 years ago in adopting this. the first time i talked about venture philanthropy at the bio meetings, we had ten people in the audience. and now it's really becoming really inherent in what many voluntary health organizations are doing. in fact, faster cures has been an organization that has been central to making some of that happen. there are law firms that specialize in it. so we love to share our ideas, we share ideas all the time, and it's been very gratifying throughout our community that we happen to be fortunate enough to start it, bill and melinda gates gave us $20 million to start our program. we had other dollars to really make that initial investment. >> can you tell us how you established against, successfully established the registry? >> as i say, it goes back a long time.

>> yeah. >> but, you know, dr. sa houston think was here several years ago when he was the head of the nih, and he says one thing about the cf community, it is a community with a culture of research. and every patient who goes to see, goes to one of our care centers is asked do you want to participate in a patient registry? and i think it's 99.5% of the patients that say, yes, i do. so it's all part of the culture. it's part of the culture the organization creates, it's the physicians, and it's the relationships. and the recognition that it's an important part of being, having a disease because we can't cure this disease without their involvement. >> very good. thank you very much. appreciate it. i yield back, mr. chairman. >> chair thanks the gentleman. dr. summar, i didn't get to you in my round. on wednesday we heard an idea thrown out there that, you know, there are vast amounts of data available that are not being utilized.

and we all know what an organ donor is. the idea was that we have data donors. now, how would this play, and you mentioned the irb system. what's your reaction to that? >> this is something we talk about when we're having coffee a lot. there are data sets all over the place. in fact, most of them end up usually lost when someone's computer gets recycled. we'll have, we had a physician lose, you know, 15 years of data because his excel spread sheet didn't update. i think a way -- to find a way that balances, obviously, people's desire for confidentiality versus the irreplaceable and often timesser reproducible amounts of data that are out there. my reaction to that would be i'd love to find a way forward with that. that one's going to -- you can see a lot of sides to that question, but i definitely think it's worth looking at. and i think what we find is a

lot of patients are like, yeah, i'll put it out there. i'm fine with that. there'll be a small core that won't, but i think most folks if you ask them would say would you feel okay with your data, you can see people opening up their genomes who had their genome sequencing, i'll publicly post be it along with my medical health history. a lot of folks want to help. >> i did that. >> thank you. >> that is a real thing that's happening right now. and, yeah, privacy is something we all value, but it also, the voluntary relinquishing of a portion of that for the greater good, i think that's something we ought to encourage -- well, not encourage, but we certainly shouldn't stand in the way if that's -- >> correct. >> and unfortunately, i can't say that we don't always respect that, that we shouldn't stand in the way. enough about that. >> all right. the chair thanks the gentleman. that concludes the questions of the members who are here.

another exciting, informative, very important hearing. thank you so much for coming. now, members will have follow-up questions, and we'll send those to you. we ask that you please respond promptly. i remind members, they have ten business days to submit questions for the record, and that means members should submit their questions by the close of business on friday, july 25th. i have a uc request statement for the record from the national health council. without objection, that'll be inserted into the record. without objection, the subcommittee's adjourned. [inaudible conversations]

[inaudible conversations] [inaudible conversations]

>> if you missed any of the hearing that we just showed you, you can watch it anytime in the c-span video library at c-span.org, and we do have more live coverage coming up here on c-span2. today kicks off the national governors' association summer meeting held this year in nashville. oklahoma governor mary fallon, who chairs the nga, kicked off the opening meeting this morning. later today they'll be joined by vice president joe biden to discuss state/federal partnerships. we'll have live coverage of that discussion beginning at 2 p.m. eastern here on c-span2. also coming up at 4, the education and work force committee will meet to focus on the role of education and economic development. guest speaker is senator lamar alexander who's the senior republican on the education

committee. the nga education committee is chaired by kentucky governor steve bashir. that'll be live, again, at 4 p.m. eastern here on c-span2. tune into booktv this weekend for the harlem book fair with discussions on the state of african-american literature, multicultural book publishing and the black arts movement. live coverage starts saturday morning at 11:45 eastern on c-span2's booktv. congressman ted poe of texas, digital privacy advocates took part in a presentation and discussion of federal digital privacy laws. this is about 90 minutes. >> good afternoon and welcome to the cato institute, both to those of you joining us here in the auditorium and those joining remotely via the magic of the moving pictures i'm told the young people today enjoy so much. my name is julian sanchez, i'm a

senior fellow here, and we're here to discuss the path towards digital privacy reform. and i refer not merely here to the unprecedented public scrutiny on government intelligence surveillance that has emerged over the past year as a result of leaks originating with former nsa contractor edward snowden. often i find in my experience seeking and writing about those issues that members of the public are shocked to discover that extraordinarily easy access to our most sensitive forms of digital information is not restricted to hypersecrettive spy agencies chasing international terrorists and spies, but that smaller-scale versions of similar capabilities are enjoyed by local prosecutors and police departments on the trail of drug dealers and tax evaders. certainly even collectively they

can't quite compete with nsa for sheer magnitude, but the explosion of digital surveillance by law enforcement is, nevertheless, quite staggering especially when we recognize that until extraordinarily recently, it has largely occurred out of public view. just to give you a taste of the information, the scale of this we've recently begun to become aware of using companies who we have representatives here today and which have voluntarily begun providing some transparency on that score, google in the second half of 2013 alone fielded more than 10,000 requests for government information about more than 18,000 accounts. 4,000 of those, 4,000 of those accounts were the targets of search warrants, the rest subpoenas and other kinds of court orders subject to much lower standards. only 11 of those orders were full-blown wiretap orders which require a fairly high standard of evidence, higher even than an

ordinary search warrant, and which we do have public information about because wiretap orders are aggregated and counted annually in a fairly detailed report. microsoft must be jealous, they fielded a measly 5,000 requests in the same six month period at the end of 2013 covering some 13,000 accounts. and, again, as for other companies, they've not voluntarily begun providing reports, we simply have no accurate picture of the scale of government access to either the contents of people's digital communications or equivalently-sensitive metadata about their online activities. this is so remarkable because the supreme court recently held in a unanimous ruling in reilly v. california, a search of a modern cell phone, the data on that phone, would typically expose to the government far more than the most exhaustive search of a house. this is sort of bringing out the

constitutional heavy ammunition since the home is traditionally the most strongly-protected domain of privacy. the court further observed showing that they're somewhat clueful technologically at least that increasingly this kind of sensitive information is as likely to be stored remotely as locally and that, as they put it, cell phone users often may not know whether particular information is stored on the device or in the cloud, and it generally makes little difference. the court said it makes little difference to the user. under federal statute -- that is to say, the 1986 electronic communications privacy act -- it actually makes an enormous difference. under many circumstances the statute allows cloud to store contents or metadata about people's activities so detailed as to be equally invasive to be obtained due to mere subpoenas or other court orders with substantially lower standards

than search warrants. certainly, court orders in several districts, court rulings in several districts -- most notely the 2010 rorschach ruling -- have empowered major providers to insist on warrants for content at least. but this leaves us with an uncertain patchwork of ruleses leaving users, tech companies and law enforcement all fairly uncertain about the scope of legitimate government authority to demand information about users. almost everyone at this point acknowledges that this state of affairs is not tenable. more than half of members in the u.s. house of representatives have signed on to, as co-sponsors to legislation that would update privacy safeguards for the filed computing era. even the justice department and the fbi have effectively acknowledged that the law is out of date and amendments requiring warrants for remotely-stored content are appropriate. yet nearly 30 years after passage, reform has stalled. so today we're going to explore

why that is and what we might do about it. and before i introduce our panel of experts to discuss this, i am very pleased to say we have with us congressman ted poe to deliver introductory remarks. congressman poe represents the 2nd district of texas, apparently the first republican to hold that honor, and came to congress from a long career in the law including eight years as a prosecutor and two decades as a harris county judge where his wikipedia page will tell you he became notorious for creative sentencing, although representative poe assures he that many of those colorful stories should be marked -- [inaudible] [laughter] already relevant today -- her relevant today, he's opinion an advocate for digital privacy reform with his colleague, zoe lofgren. he sponsored the geolocation protection act which, as he put in an op-ed last year, aims to revise an outdated ecpa to

protect internet users from intrusive and unwarranted internet surveillance. i'm very pleased to welcome congressman ted poe. [applause] >> thank you, julian. thanks for the invitation to be here. it's good to see all y'all this afternoon. as julian mentioned, in my other life before i came to congress i spent 30 be years down at the courthouse -- 30 years down at the courthouse in houston, criminal courts building, which i dubbed the palace of perjury. and i spent that in time as a prosecutor and then as a judge, a felony court judge hearing criminal cases everything from stealing to killing and everything in between. because of that experience, i spent a great amount of time dealing with the u.s. constitution, primarily the bill of rights and primarily the fourth amendment. to give you a little background and then address the specific issues that we have here today, back in colonial days the

british were determined to make sure that goods wrought into the united states -- brought into the united states were not smuggled. because if they were smuggled, they didn't pay, the colonists didn't pay the tax that was due the king. so they had, came up with an idea to search the colonists -- primarily their businesses and their homes -- to see if any of those smuggled goods came in without paying the tax to the king. and they invented the document called the writ of assistance which was a flowery term for a general warrant for the british military to go into someone's residence or business and look for, really, anything. but primarily looking for smuggled goods where people didn't pay the tax that was due the king. this irritated the colonists a great deal. after all, they did have a war of independence. one of the reasons was because

of the writ of assistance. and after the war was over, we got our independence from britain, we wrote a constitution, and then we came up with a few bill of rights, ten of those, that really had their founding and purpose to prevent government from intruding the right of privacy of specific individuals under the new country. called the united states. which led to the enactment of the bill of rights, primarily the fourth amendment. i have it up here on the podium. i guess if i was high-tech enough, i would have it here on the screen, but it's on a poster. and i will read to you the fourth amendment, and you can look at it. there's a lot of provisions in it. volumes of legal treatises have been written about the fourth amendment. volumes. and we're not going to have a law school indoctrination on the fourth amendment, but let's just read it and then see how it applies to today's society in

2014. the right of the people to be secure in their persons, their houses, papers and effects against unreasonable searches and seizures shall not be violated. and no warrants shall issue, but upon probable cause, supported by oath or affirmation and particularly -- excuse me -- describing the place to be searched and the persons or things to be seized. what that means is this: that if law enforcement wants to search something in your residence or in your effects or in your property, the officer that wants to do the searching must go before an independent magistrate magistrate -- the buffer between law enforcement and the citizen -- and swear out an oath

under oath, a warrant to search a specific lace -- place for a specific thing or person. that's on the back end of the fourth amendment. it has to be very specific. it has to be specific enough under our law that if the be judge signed the warrant, the judge could give the warrant to a different person, and that law enforcement officer could read this warrant, know exactly where to go, know exactly what he's supposed to be seizing and who he should be arresting if there is an arrest. that's how specific the warrants have to be today. and that was the reason the fourth amendment was written the way that it was written. but the purpose is to secure arrives of the individual. so let's use a hypothetical. not a specific, it's not specific, really too specific, but it's a general hypothetical that i would like to just talk about. we have two notorious outlaws in

texas, that's where i'm from. one of them is ollie ogle thorpe and the other is bobby jo oglethorpe. they are bad guys. they rob people. they rob banks. and let's say they decide to come to washington, and they plot and scheme to rob the congressional credit union over in the longworth building. they go in inside, they rob the lace, they take the -- the place, they take the loot, and they make away their escape and get away, and they hide somewhere in washington d.c. that's all we know. they're not captured. but we know probably that the two individuals are somewhere in washington. so if law enforcement decided, okay, we're going to go get ollie oglethorpe and bobby jo oglethorpe, we know they're in

washington, they would go to a judge, they would say to a judge we know they're in washington. they would say we know they're in zip code 20003, but that's really all we know. we would like a warrant to go into all of the places in zip code 20003 and find bobby joe oglethorpe and his brother, ollie, and most importantly, get the loot. there is not a judge that would sign the warrant to allow law enforcement to go into every building and residence. we all though that's absurd. there is no way that would occur. because the residence or the place in the warrant is not specific enough to go to that location and find the oglethorpes and/or the money. that would be a general warrant. that would be warrants that maybe the british would have imposed back in colonial days. because the fourth amendment

prohibits that type of conduct. however, let's assume that the oglethorpes have spent some time on the internet discussing this criminal activity, discussing where they're going to hide, where they hid the money and some of their other criminal enterprises? if law enforcement had probable cause to believe that occurred, then they could go to appropriate judge and get a specific warrant and maybe go to one of these folks here and get that information, their e-mails. but let's say they don't have probable cause. they just don't have enough information to convince a judge they have probable cause to believe the information is there that they're looking for. so what do they do? they wait six months. and all of a sudden on six months and one day, without the use of a warrant stating probable cause, they hay seize that information -- they may

seize that information without probable cause because the law says you can. seize it. now, one would think that that's absurd. that just because it is six months and one day that the warrant requirement should not be required. but that is currently the law. because the law was written too long ago to keep up with modern technology. the electronic communications privacy act, as julian said, was written in 1986. the internet and all of our electronic knowledge and storage has changed since then. so because of that, zoe lofgren and myself and others have sponsored one piece of legislation -- and there's other pieces of legislation members of congress are signed onto -- to fix that problem and guarantee the right of privacy if e-mail

storage is over six months old stored in the cloud somewhere. well, the supreme court -- independent of this legislation -- well, the supreme court court ruled that you have a reasonable expectation of privacy if your e-mails are stored over six months in the cloud. i don't know how they would rule. i really don't. that's why it's up to congress has the responsibility to legally state there is an expectation of privacy, because that is the key phrase under our law and under the fourth amendment. what is the reasonable expectation of privacy of the citizen whose information or property or papers is being seized? i don't know what the judges on the supreme court would rule. they may say you don't have a

reasonable expectation of privacy. there's people in law enforcement say you don't have a reasonable expectation of privacy. we want to seize all that information. and then there's others who say, yeah, there should be a reasonable expectation of privacy. we can debate that issue theoretically forever. so congress must come in and say, yes, there is a legal expectation of arrives when your e-mails are stored in the cloud. go back to the situation with regular mail, now called shale mail, i guess, is what it's called. some of us still use snail mail. you know, of course, if you're writing a letter to someone and you seal the letter and you put the stamp over it, you actually give that letter to government. and government sends that letter all over the country until it finally reaches your mother-in-law's house. but there is a general expectation of privacy in the contents of that letter.

sure, there are exceptions. we're not going to talk about the exceptions. but as a general rule, government cannot go into that letter and read what you're writing your mother-in-law. can't do it. well, what if the government hangs on to that letter for six months? well, does that change your reasonable expectation of privacy? probably not. and this is going to not a private company, it's going to government has the duty to protect your right of privacy. e-mails, they're not going to the government. they're going through a server through a private enterprise, through a private corporation. that should be even more protected, not less protected, than regular mail. why? because it's not in the possession of the government. it's no in the possession of a private entity. but yet if government waits out the six months, then they can seize all of that information through the cloud. i think that's a violation of

the fourth amendment, and i certainly think congress should weigh in on this issue to make sure that it's a protected right under our constitution and legislatively. there are other examples. you have a safe deposit box, and you take over your birth certificates or whatever people put in safe deposit boxes. and you take it over to the bank, and you leave it there. is your right of privacy the right that you must require government to get warrant to search your safety deposit box forfeited after six months? because it's six months old? i think not. but yet for some reason, because the way the law was written in a time where all of this high technology didn't exist, the law allows for that seizure of information. and not only is it seized, the citizen doesn't know that it's seized. they're not informed that it was seized or what was seized.

going back to the search warrant requirement, now, the search warrant requirements differ from state to state, but they all require an affirmation or oath by the person who wants to do the searching. but in many warrants, criminal warrants, for example, in the state of texas, those warrants are returned to the judge, and the judge gets to review what is in the return, what was seized by government. and eventually those warrants can become public record so everybody is on notice as to what was seized. plus, the person that the property was seized from gets a copy of what was seized. that's how important warrants are except in the area of receiving information through e-mails. you not only don't know that your property e-mails were searched, you don't know what

was taken by goth. and further -- by government. and further, government keeps that information forever. and you may never know about that even if you're an innocent bystander. let's go back to ollie ogle thorpe and his brother, bobby joe oglethorpe. in their e-mail train of criminal activity, if you wait six months, the government can seize without warrant all of their e-mails. not just between each other and their criminal enterprise, but to whoever they were sending e-mails to or communicating with back and forth. and that third party, innocent party let's assume, certainly doesn't know about that. my personal opinion, that's a violation of the fourth amendment right to be secure in your persons and your papers and your effects under the fourth amendment to the constitution. so what does ecpa do? it basically applies the fourth

finish the changes in all the legislation, applies the fourth amendment standard to e-mails. there's a lot of reasons why that should happen. first, it puts people on notice as to what the rules are going to be. not wait for the supreme court or other courts to make maybe different opinions down the road as to whether it's lawful or unlawful now. put 'em on notice, congress has that responsibility to do so. but also we have a disadvantage -- i say "we," american companies have somewhat of a disadvantage because this rule, people know that this is what occurs, so other companies, other countries compete against the united states where people go to some other server where they don't have this problem with the right of privacy. who would have thought that this nation being the nation that's supposed to be the most democratic, freedom-loving,

protects the right of people to be secure in their houses, right of privacy would be second to countries that don't have that issue supposeedly, but yet recollect that right on their servers. -- protect that right on their servers s. that puts our american companies at a disadvantage. get a warrant, that's the bottom line. get a warrant. if you don't have probable cause to get a warrant, then you can't seize the information. that's what the standard should be. it should be -- it's been that way since we enacted the fourth amendment of the u.s. constitution, and it should with that way indefinitely. some say that the constitution is archaic, it doesn't apply, you can't make this work based on the constitution, i think it applies quite easily, the general rule to get a warrant if you want to seize the information that belongs to individuals whether it's in snail mail or whether it's in e-mail or whether it's a lockbox

at some bank. now, where is this legislation going? well, i hope it goes and passes this year. it is a bipartisan piece of legislation. all of this legislation is bipartisan. it's in the house, it's also in the senate, assed the judiciary committee -- passed the judiciary committee of the u.s. senate, a piece of legislation to protect the right of privacy, get a warrant if the e-mails are over six months of age. i would hope, i'm on the judiciary committee, i would hope we can get this through committee and on the floor this year. this is actually something that i think will pass. it will pass the house, it'll pass the senate in a bipartisan way. the president indicated some months ago now that he thought that there should be some ecpa reform as well. so i think that's something that ought to happen, something that ought to continue, we should continue to work on with other members of congress and move out

of the judiciary committee in the house and then get a floor vote on the house bill and get a floor vote now on the senate bill as well. now, i will stop at this point and take a couple of questions, see what's on your mind or comments if you wish. yes. >> [inaudible] >> treating what i would call the disease rather than the symptoms. so you use the fourth amendment to protect privacy, you know -- [inaudible] of government doing things that it shouldn't be be doing, asking, you know, thousands upon thousands of criminals -- [inaudible] that it just shouldn't be doing. so my question is, is there, you know, anything that binds the two -- [inaudible] >> i think i heard most of your

question. i'll try to respond to the parts that i heard, and you can correct me if i didn't get it correct. but, yes, this is just one issue of government oppressiveness of citizenry. law enforcement always seems to push the envelope as to whether they can do what they're doing to get information especially on what they think is criminal conduct. based on my experience at the courthouse, based on what we've seen. they will always interpret the law to the extent that allows them to seize the information. that's why when we draft this legislation, it has to be very specific so they know you can do this, and you cannot do that. but it's not just with what's stored in the cloud. i mean, you could talk about the nsa, for example. the massive amounts of data that

have been seized on americans from the nsa in violation of the patriot act, and they still have that information. we don't know all of the information they have because they're not telling us what they have on individuals. i will say this, you know, it's always in the name of national security. nothing wrong with national security, but that's the argument. we have to give up rights, is what we're told, in the name of safety and security. now, that argument has been used by governments always. and unfortunately, people his doorically -- whether it's a democracy or not -- have been kind of willing to give up their personal liberty in the name of hoping to get protection and safety. nsa, let me just give you this one comment. we have the undersecretary of

the justice department before -- we had the undersecretary of the justice department before the judiciary committee, and i asked him of all of the information that has been seized by nsa, all of it, how many people have been prosecuted up on this massive seizure of information in the name of national security? do you know what he said? maybe one. so actually what they're saying is not making us any safer. they're not getting the information that protects us from the bad guys because only one person maybe's been prosecuted. but they store this information on americans. i think the it's wrong. i think it's a violation of privacy. it certainly was also a violation of the patriot act. that's why week before last many of us got an amendment to make it more specific on what nsa could seize and what they cannot seize, and it is a symptom of a

bigger problem of government seizure of information on citizens. in violation of the law and the spirit of the fourth amendment. i don't know if that -- did that answer your question? >> i think we can squeeze in one more. i think we have microphones if we have any further -- >> one problem we've had for many decades now we've been forcing the fourth amendment -- with enforcing the fourth amendment is that the only remedy provided when the fourth amendment has been violated is excluding the evidence which means if the fourth amendment rights of an innocent person have been violated, there's no remedy. and i was wondering, does your legislation try to address that, provide some remedies to enforce, you know, to, you know, in case, in case those seizures that you're making illegally, in

case they are made, no -- [inaudible] also protecting innocent people. >> excellent be, excellent comment. and you're exactly right. the united states has come up with the philosophy of the exclusionary rule which means if evidence is unlawfully seized under the fourth amendment in a criminal case, that evidence is excluded and government may not use that evidence if a judge determines that it was unlawful through seized whether it's fourth amendment or whether it's a confession. that's the remedy under our law. i think your point is well taken as we move forward on ecpa, there has to be some other remedy aside from exclusion as to what we do with that information. certainly, i think we ought to eliminate that information if it's unlawfully obtained. but we need to have that debate and that discussion. i don't know the exact answer on what it should be, but it should be be something else besides if

the evidence is excluded. that doesn't help the individual who's the innocent person out there. it hay help the oglethorpes, but it doesn't help the innocent person whose information was seized and is still stored by government. good point. we need to add that into legislation before it gets out of our committee. one more be question, or are we done? [laughter] >> one more quick one. then we move on. >> quick question. technology -- [inaudible] >> hang on for a second. >> you have social media and things like secure portals that companies use to exchange information with each other and things like that that are all out in the cloud. so, you know, what's your next step once you get the e-mail protected? >> we have to address all of those issues as well. right now we want to solve the e-mail issue with ecpa. i think for passage we ought to deal specifically we mails so

that we can get something -- with e-mails so that we can get something and then amend it as we progress keeping in mind the spirit of the fourth amendment as well. all right. well, thank you very much for your attention, i appreciate it. thank you. [applause] >> thank you. and i'll invite our panel members to join me on stage here. we have, i think, as formidable a panel as one could ask for for an event like this. joining me here we have, if you're here, greg nojame, senior counsel at the center of technology as well as co-chair of the american bar association's committee on civil liberties. an attorney in private practice and director of legal services

for the american -- [inaudible] discrimination committee as well as leadership counsel at the american civil liberties union. really a veteran of the fight for digital privacy and also one of the driving forces behind the digital due process coalition which we have several members represented on stage. also to my left we have nate jones who's an attorney in the legal and corporate affairs group at microsoft where he provides advice on a range of issues related to legal compliance and government access to data. he's also been on the other side, before joining microsoft he was a director for counterterrorism at the national security council staff at the white house and also previously counsel to the assistant attorney general in the national security division at doj. be he's also spent more than seven years working on capitol hill including five and a half as come for the senate judiciary committee. to my immediate left, david lieber, private policy counsel for google where he works on

privacy and data security issues. i hear occasionally those come up at google. previously, he was an associate at e-commerce and privacy practice and worked as a legislative aide to dick durbin on the senate judiciary committee. and finally to my right, katie mcauliffe who is federal affairs manager at americans for tax reform and executive director of the digital liberty radiologist. she researches not only digital privacy, but an impressively geeky portfolio. she previously was a staffer for congressman stearns and a radio professional both in the u.s. and abroad. her commentary has appeared in a dizzying array of national publications. she holds a master's in mass communication and telecom policy from the university of florida. so please welcome our panel. and i -- [applause] i want to begin, i guess i want to begin with greg because i

know really few people who are more well schooled in the intricacies, so before be we discuss current challenges, it's sort of important to have as clear an understanding of that byzantine statute as is possible before we talk about the need to change it. so i want to ask greg to sort of begin by trying to give us a quick thumbnail sketch of how ecpa works now and why once upon a time people thought that made sense. >> thanks, julian. again, i'm greg nojame with the center for democracy and technology. and i want to thank the cato institute for hosting the event and julian this particular. thank you very much. so ecpa is a statute from 1986, and just to put a little flesh on the bones of 1986, i imagine some people in the room weren't yet born in 1986. one of the leading car models was the ford maverick. i didn't have one, i couldn't afford one, but that was one of the leading car models.

we had just put away our eight-track tapes, and we were now using cassette tapes. that was the world in which this statute that governs privacy on the internet was born. when we first were using the internet, a lot of us used aol, american online. we downloaded the e-mail from the aol servers onto our computers. storage was expensive. so you know what you did? you printed that e-mail out because it was too expensive to save. and aol would only save it for a few days after you had downloaded it. that was the world in 1986. fast forward to today. storage is cheap. companies are out there saying why would you ever delete anything? and people don't delete stuff. they leave it forever, and they can -- and it's really cool. you can access it wherever you are. you can use this little device and access information in the cloud no matter where you are.

you could be in germany and do it. it's really, it's really amazing how much technology has progressed. but the law didn't. the law's stuck back in 1986. so it reflects its time. and so, for example, because the aols of the world would not save your e-mail for you for six months, if an e-mail was that would, six months old and still on aol's servers, it was their property. that's how it was looked at. you had basically abandoned it. it had become a business record of aol, and it was available to law enforcement with a subpoena. ..

so the statute doesn't reflect, doesn't set a rule for law enforcement access to the location that this little guy generate. every few seconds it pings off a down. and here is the call comes for greg, syndicate, that's what this one is doing every few seconds. a record is made that the phone is registering on that tower. what does they said a law enforcement access to that information? nothing. the reason it doesn't say anything is because it wasn't an issue to be resolved back in 1986. now we have to face these issues. judge poe, to his credit, has got legislation to face those issues in a very good way.

>> thanks, greg. address the next question to perhaps david, divide this up if you want. we had an array of course decisions beginning to address some of these problems. greg mentioned location. we now have at least federal just to courts or federal appellate courts be holding that even though historical information that's actually require a board because it's not like a valid phone number. information in your phone sending automatic with or without your knowledge so it doesn't fall under called the third party doctrine exempting that from fourth amendment protection. but you guys of course argued with some of the practical questions that arise as the result not just the federal statute but involving court

decisions, a case cold war shack saying it is applied to e-mail at least for as long as it is stored. this whole range of different types of content. you guys now i think both companies across the board require award for what you consider leading the way in terms of providing transparency about governmental class. i'm wondering to what extent you still get requests for content are the kinds of information without a warrant? and also let me, as i said, how you draw that line between content and metadata in the context were online, it's not only for what is content and what is metadata. go to webpage, the address tells you what the content is. the content, that metadata. i'm curious how you come what kind of problems you are finding arising, what sort of legal buzz -- puzzles and pushback from law

enforcement? >> no, i mean, thanks for that. you alluded to a case in 2010 where the sixth circuit held that users do in your a reasonable expectation of privacy in their e-mail, notwithstanding what to says that the distinction which can delay frustrates a result -- the events of our services. the court went a little further in more shack in sync extent that it does not require a warrant for enough content is unconstitutional. and i know that google and microsoft and others have relied on that decision and i think the perception at least initially was that our application of that decision beyond the sixth circuit was aggressive. but i was that there wasn't so much that it was our application of the war shack decision outside of the sixth circuit that should be focused, but rather the application of the fourth amendment outside of the

sixth circuit because the court decision in war shack addressed it on core fourth amendment principles. i don't think we have seen, particularly in recent years since the war shack decision a lot of pushback. we've heard periodically that there were efforts to challenge the notion that a word should be required in all circumstances. i think when we see this issue sort of crop up released from the google site he tends to come from state and local law enforcement agencies, some of whom are not as familiar with the worshack decision. they will file, issued a subpoena for content, will remind them or at least make them aware of the worshack decision and they tend not come at the time to come back to us or they will come back to his with a world. we haven't really seen a lot of pushback on that. from a broader public policy perspective i think one of the

bigger risk is not so much google's and microsoft's of the world will get a subpoena provide content because that's just not the case in practice. we demand a word for content to its smaller providers, some of whom may have hundreds of thousands or millions of users but are still sort fledgling businesses that don't have necessary the resources or the legal acumen to recognize the differences between what ecpa says and what the fourth amendment says, they'll see an official looking subpoena that is content based on a subpoena and they will provide it. those are the bigger risks from a public policy perspective which i think underscores the importance of codifying the award for content requirement. spent i agree with everything you said, davidson and out at a couple of things. one is we are operating in a global marketplace, where people have, people have less

familiarity with the legal requirements in the u.s. in particular smage when you talk about case law and how that's being implemented. so explain to people and reassuring them that a ward is required for content is sometimes difficult when dealing with people who are less familiar with our legal system. and applicable law. so i think there's a significant interest that we all have in making sure that this is clarified in the law. you know, the second thing i would say is i think what we are seeing here and what we're all talking about is trying to make sure that the law and the protections afforded to it under the constitution keep pace with not just technological developments but the way people and extent to which people use that technology, things they are storing in the cloud. you know, i think we are seeing important steps taken by the court, those things are helpful. we not getting a lot of pushback

on those things, but while the court has been a leader in recent weeks and months, and with worshack's early, there's a problem that we still have and that is not a comprehensive study louche and. it does delete a lot of gaps we don't know what the law is, what we're supposed to be doing, what we are not supposed to be doing. and we got a case going on in new york right now, facebook does as well, both of which raise important questions about what providers, legal rights are to challenge things when they receive them, and the geographic scope of legal process and whether or not congress actually meant worked when it said were and what the indications are that are in terms of what the particularity requirement which congressman cole talked about, and all the other aspects of the fourth amendment that that brings along with it. >> you mentioned the global market, competing. i'm curious to what extent you actually see this race as a

concern, either by individual users but by enterprise customers. i know if you're a large corporation and dealing with regulatory agencies or a local u.s. attorneys who might be looking into what other countries are doing, you might really prefer a subpoena or request for information come to your in house counsel rather than someone else's attorney. what extent domestically and internationally do you have a sense that there is a wariness about moving to the cloud for all the efficiency that my intel because of the practical differential in terms of their ability to ensure the privacy of that data? >> it's a huge issue. it's probably one of the things i underappreciated when i took this job, just how much time i would spend it with customer concerns on this, on the enterprise side. to sort use an example to sort of illustrate this, and i think this is another area where the

law hasn't really kept pace with technology in the way people are using it, if you're a large multinational corporation today and you're providing your own e-mail service and you have an on premise e-mail or cloud storage service, the government goes to you to get the information. and they serve an order, a spin or sometimes a search word on the company itself, goes to the general counsel's office and they figure out how to respond to it. there's a certain information that they possess that is afforded protection under the law. there is a great fear out there, not just about governments obtaining their information but doing it without their knowledge. and i think when you're talking about the company considering moving to the cloud, there are a lot of them that are concerned they will serve legal process on microsoft or google or somebody else and get that information without them knowing. because of the nondisclosure

order. our position is basically, you went to the multinational corporation yesterday, you should go to them tomorrow. we shouldn't be in the middle of that, and to the extent there are nondisclosure obligations, they should account for certainly the government interest in making sure that evidence isn't lost or lives are lost. but is often, almost always with do that without compromising the investigation. you can talk with companies general counsel office. they aren't going to notify the target. they are bound by the same nondisclosure obligations, and i think the law should account for that. one of the things that was interesting, i was recently reading the legislative history of expo, one of the things congress stressed and even account for about wrong when it through the 180 day line, one of the things they were trying to do and they made it very clear is to sort of promote the adoption of new technologies like this.

and i think without clarifying this and without clarifying the law in some these other respects, the risk undermining the adoption of these new technologies, which provide a number of benefits as greg was alluding to. >> a follow-up because when we talked for about content e-mail, content generally. obviously, both microsoft and google, and many other companies, store enormous amount of content other than e-mails, including backup content of phones, but there is plenty of stuff that may be less sort of obviously content as opposed to metadata or some other kind of transactional records. create an event on a calendar, be active creating a calendar event, the content of the king negation or is it somehow the metadata even though you might sort of be hard for us to do

things. we mentioned location data, both microsoft and google have maps services of various kinds which would allow them to have repositories of somewhat detailed location data. in google's case i know google's registrar to fight off private litigation involving ads in gmail to stem the mail right keyword ads. i do know if anyone has done this yet but i can imagine a kind of creative prosecutor or law enforcement person saying you want a warrant for the content? we won't ask for the content. we want the catalogs so we can see if this user has been served ads about searching for, i don't know, tax dodges or marijuana or something like that. and when that ask you for content we're asking for your records of your ads. i'm curious if either to our situations where you've been pressed to draw that line achieve the difficult or where you are not sure whether you

would be able to hold the line? >> so, i mean, i think we talked a little bit about this in our transparent report. i mean, i can say broadly speaking that we've taken more expensive you about what constitutes content versus what is metadata. i think, julian, as you allude to the our survey number of errors that are in that gray area and those are issues candidly that congress might need to tackle in the next wave of ecpa reform. given the challenges we face just in terms of codifying this bright line were it was content will we don't know when this issue will be taken a. but we talked to thinks that are not clearly content or clear the metadata. i'll give an example, search terms for soda. those are things we consider to be content. but as greg was alluding to

before, they are pieces of data that congress didn't contemplate when it enacted ecpa in 1986, and i think as a result you have seen courts, district courts, appellate courts, magistrates all disagree about the extent to which, for example, location information requires a ward, whether simply as being collected prospectively versus retrospectively, or how long does the collection need to occur before the strictures of the fourth amendment upon. i think we'll continue to see those things crop up spent i just want to kind of put in there a little distinction, keep like about electronic privacy for breakfast a couple database that fit into this broad umbrella. we talk about content, talk about location and then metadata is always one of the favorite gray areas. i think your question about such meeting the ad blogs, what kind of defamation is that? that something went talked about but when you talk about two, from information the metadata.

who called you a time, metadata. seeking the backing track and find where the content is, if it doesn't get turned over to you. content is going to be it's electronically communicated. we have to talk about what does it mean, like you said an outlook calendar. so if i buy one other person, is that an e-mail? is that some kind of public king negation? i would wager to say that his content if you're fighting someone to meeting because i think most of us were expected to be the same if you set a wedding invitation in the mail. so when you look at those kind of things can look at e-mail, clout source, photo sort of like uncommitted like that that is stored online, between one or two of the parties, now we get into third party doctrine which is really where kind of the crux of this is, if i gave my information, katie mcauliffe, her stuff, to david over at google but not david specific,

to google told. is google considers the person that i just gave that information to? what they're doing is storing it like a file cabinet. you are not the person i could do so they shouldn't be able to be subpoenaed. if i had physically send it to david, david could be subpoenaed because he is at the other end of that e-mail. so just like very, very basic bare bones, talking but electronics communication content right now, talking about content in the know, that's what we're talking about. there's also location. there's beings and data dumps and all these other things but the warrant for content is tenable we're talking about right now and i think the main question that we are really debating and what congress needs to address and what congressman cole of the two was come what is unreadable and what is reasonable search and seizure. that's where our debate is here and i think me personally i think it's highly unreasonable to go through my e-mail, stored

with, stored with the google and not let me know about it. >> you mentioned an array -- may even bring us up-to-date on sort of where things stand out in terms of reform and maybe why we're sort of not there. congress in general very dysfunctional but there seems to be a sort of shocking anonymity, the very least worked for content makes sense, demanding, and seems to be stalled. can you sort of give us a sense of what the political landscape come sticking point you were on. >> sure. i don't necessarily think congress is dysfunctional. sometimes dysfunction is dysfunctional, right? depends on what side you were on, right? looking at this particular issue, and let's just talk about ward for content on the house side, to start out with.

you've got a bill that stalls -- solves the e-mail problem. also solves cloud document. no one in your is excited about that all. i don't know why you are here. so we've got legislation that will do that. then moving forward that something that 220, so correct me, we've got more, 220 in favor of this particular legislation, electronic communications privacy reform act. but it stuck in the judiciary committee. and i'm not quite sure how something that is supported high 220 members of congress can be stuck. i'm not quite sure how something with the broad support of companies, coalitions, think tanks, individuals, something that has such broad support can

be stopped and not move at all. wait, wait, wait. civil agencies don't have a probable cause standard. do you know what that means? that means that they can't get your enough anymore unless there's a ward requirement because they can only have subpoena authority but they will continue to read your e-mail so they want to carve out in legislation that says i'm a civil agency, that's okay, i have a civil ward. you need probable cause but i'm going to rejigging it anyway. because i do information should with the doj, i'm going to go in and do that, too. there's a loophole. that's why this isn't going anywhere. that's why it's not going anywhere. in the house or innocent of not going anywhere because the government wants to rejigging up without you knowing it. they want a subpoena. that's it. >> one of the, often a sense that the fourth amendment apply

strictly in the law enforcement and other regular purposes, less relevant somehow although the original impetus for the fourth amendment was of course custom searches, fundamentally regulatory search. >> could i just jump in? it's gotten to the point of absurdity, i have to say. the government's power should be at its zenith when it's investigating a crime. that's when it's power should be at its zenith. that's what should be able to really penetrate and get the most sensitive information and yet we are in this situation where, on the criminal side, there is a virtual -- there's a consensus. even doj says we think that ecpa needs an update and that we can live with award for content rule. and yet there's this notion that on the civil side, the

government's power is not investigating the terrorist that will blow something up it's investigating stock fraud or something like that. in that situation that ought to be a lower standard. it just seems absurd. >> absurd. spent i was wondering, i know you can't get into enormous decoder but both, since both companies are transparent, what is your sense of information people come looking for, what sort of the nature of those investigations? are you finding, is there any shift over time as different agencies become more aware of the democrats of capabilities and that of there being stored? and what they're asking for. now you run and location service. that's new information we can ask for. >> yeah, i mean, i think frankly law enforcement is sometimes a

little bit slow on the uptake, but services are public, they get on and use them and they eventually figure out a sort of how they operate and what data would need to be stored to operate service. and so i think they are becoming more and more sophisticated. in terms of the types of investigations, i don't think that's changed much since so much is it tied to legal authority. and that we are in war shy, postwar shack world were a records search were for content in all cases, it tends to be things that just a bill to get a search warrant to investigate. so that sort of drives a lot of the. but the datatypes and the data fields that are provide our sort of income but on what data there is in existence and how long it is stored and but specifically to ask for. we typically require them to be

very specific in saying what types of data they are seeking and request. they can't just do so and so sedated. they have to specify what fields and things they want. >> do you get a sense, both of you, or both companies to quite a lot of requests for information for transactional data or activity logs or other kinds of subscriber information. so that's the bulk of the request. i'm wondering what those tender look like and whether that's something that usually is fairly focus our weather, i mean, a number of accounts, significantly large number of requests to both companies. so i wonder if that's in general, request for a couple of accounts or you occasionally see -- well, what one might want to

rope in a lot of people at once? >> go ahead. >> yes, but with the caveat that wouldn't open talk about what we get on sort of the domestic side of things under ecpa. there's not, i mean, mention the bulk of the request that we receive and be sort of transactional information but it's not particularly exotic. it's basic subscriber information that users provide, for example, when they sign-up for a google account. so that could be name, you know, gender, information, you know, like that. and that's information that generally can be attained under ecpa with a subpoena. it is a significant percentage, somewhat in the neighborhood of 20-25%, that we can to get that does ask for content in which case we will add, we'll ask for a search warrant. but it's not, generally speaking, the type of information that we did is pretty run-of-the-mill stuff

that you can to provide when you sign up for our services. if i could just build upon what i think greg and katie wanted to before because i wanted to be clear in terms of the civil agency side of things. there's a perception that a ward for content will leave the agencies without a remedy to do the sorts of things that civil agencies to but in the case for example, of the streets and exchange commission, the fcc, to investigate and prosecute securities fraud. typically speaking, nate was alluding to this before, when your aunt is getting someone or initiating litigation, you're going to serve a demand or legal process on the target of the investigation. so you won't be going to a third party service provider. that is generally speaking how civil litigation works.

so if there is a person that's being investigated, that they are the target of investigation and information within their control, they'll have a legal obligation to provide that information. to the extent they're uncooperative or intransigent, the acc and of agencies have remedies to enforce the subpoena and individuals that don't comply with the subpoena can be hit with sanctions. they get hit with adverse items. they can be prevented from pursuing claims. there are all sorts of remedies i think that civil agencies have to sort of ensure that bad actors can be perpetrating -- can't be perpetrating fraud. if we focus on the means by which that happens, for example, of gaining enough from third party service providers and not the end of the investigation, which is to prevent the ongoing fraud at many different, i think we're missing the boat. i think there are other remedies. some of which exists under ecpa. extent there's a concern about

the destruction of evidence. you do need of any legal process at all, google or microsoft and survey preservation request. that will freeze the account and ensure that any information that is destroyed isn't really from the destroyed the a lot of examples i think that we've heard where this may end up being a problem where civil agencies don't have a work requirement tend to be sort of edgy cases and they tend to be in hypothetical or theoretical terms. the art actually samples of actual cases where these things tend to create problems are taking to come off in sort of well, you can imagine a situation where a person is doing something, but without sort of real-world examples how this is impacting civil agencies, it's difficult to craft a solution that would address the problem they've been raising. we think there adequate remedies under existing law, and that's what we think there should be a

bright line board for content standard. >> going off of that again, the next thing where doc about, criminal versus civil. on the criminal side joe toward probable cause for standard which would be used to go to the third party and also be notified of the target. on the civil side there is no word authority can't be directed to me as the target. remember, this site over here life, death, limb, children, women, all the scary words go over here. money and white-collar things and, i don't know, other kinds of fraud goes over here. so the art emergency exception for when someone is missing the there's exceptions for when someone is getting hurt. that is taken care of. and law enforcement domestic law enforcement has agreed that that makes sense. but if we want to find out stuff of value, i don't know, who is your affiliation?

..

there is another bill that's just straight up fo up or infer content in the senate and passed as great we are good to go if there are changes we are not good to go. it becomes worse than the wall is right now. there are a kind of array of the buildout. and specifically. what do you see as moving this farther. which are the best prospects right now and which are less likely to move blacks >> i will jump in on that. the ones with the best prospects are the ones that are in the

content right now and the reason i'm saying that is because it is a relatively simple concept. it's been well debated on both sides. the house judiciary committee has had a couple of hearings they haven't moved a bill. the senate has had hearings and moved a bill -- information it is not yet right, particularly at this point in the calendar to have that kind of legislation moving. it would be hard to account for those that have come up and it's just going to weigh things down so if i had my, it would be the yoder pollis bill in the house for the content and as advanced as it is the counterpart identical to the bill that went through the senate judiciary committee. to respond to one of the

questions that was asked of the representative question was. he covers those on ways to communicate. his bill goes to all content and it is defined as the substance report to the communication. so it doesn't matter the electronic structure a few well it's all content covering all of it. it would be a war and required for all of it. >> obviously if it is a facebook message -- since greg didn't bring up the location one of the things i find particularly troubling.

to say we have a suspect and we need to know and want to confirm that he either was or wasn't at the scene but rather we have three robberies that are committed by the same person and given everything that is near each of those locations will look for anyone that is in all three places obviously gathering huge amounts in a way that isn't linked to the suspicion about any of them is that something that either of you are aware of having been attempted with respect to the location data pertained by google or microsoft? >> i don't mean to give them any ideas.

in a lot of ways for example to the irs until recently had in their manual a section saying if you are investigating and you want to read the e-mail you may do so with a subpoena they finally agreed they should do that anymore but for a lot of things like what's your affiliation and are you having too many communications with the key party patriots having too many communications with political candidates that maybe should hold the tax into question. a lot of that is the kind of information that would be revealed by the metadata. if you are particularly concerned about aggressive reasons that you see as at least in some quantity requiring additional protection. >> for me personally speaking for myself as probably an unofficial liberty i personally

care much more about content and about location then i personally do about the metadata at this point because metadata is one of the checks law enforcement can use to make sure that you've turned over all of the e-mails that have been sent. so when you say don't get rid of anything, they can check and say you can lead us t this to so ani need to see that. you know, that's kind of thing right now i think is important especially if we are talking about protecting content, which granted it's an innocent it's all content that we are talking about the actual meat and potatoes of the e-mail. so i think -- i find that to be the most important and i also find location information to be very important and look forward to working on that a lot more as craig was saying. it's become complicated with the decision that came out. you are dealing with about location. these are two different types of

locations that you need a different type of law. i clicked this button here so it goes in my code so when you phou search the phone what can you search? these are the kind of things that are being discussed and the decisions that are coming down and moving forward into the location space that needs to be taken into an account before kind of talking about what will be done with the location and also what is the future going to look like so what is perspective and richer spec is going to look like. you might say that perspective seven days. establish this as a pattern where someone is going and what they are doing. as a kind oit's a kind of talkit that you move closer and say it doesn't really tell you that much but if we keep going down this route is that we are going, wayne is one time going to be too much and we don't know all that so that is a discussion

that is ongoing. and that a lot of members are taking very seriously and looking into that and as things change in technology progresses and we see things there will be a lot more discussion about the decisions of the supreme court that have been helpfu helpful i. >> i would be surprised actually if the congress got to the location information before the supreme. and i say that because there is now a split in the circuits by the 11th circuit ruled that you need a warrant for the location storage site location information. and the third circuit said you might need a warrant for the circumstances and one other circuits that i think it was the fifth. one circuit said you do not need a warrant is that there is a split and so it is right for the supreme to weigh in. part of the issue is as the representative was pointing out

is a violation of the fourth amendment you have the remedy is that you get the evidence excluded. so what does that mean? it means a lot of crime and all defendants will claim fourth amendment rights were violated and you get a body of law that develops about whether those rights were violated. they do not have an exclusionary rule. the consequence is that you don't get the same development of the law except when the fourth amendment claim. if you can make the statutory claim they violated the statute and so i guess to get this evidence excluded, you get a lot more cases coming up through the courts. we don't have that many cases because we are only in the fourth amendment land when it comes to the exclusionary rule. >> in the fourth amendment law you don't want to make adverse

gets turned down by the judge and ask another judge later but you certainly don't want a circuit court ruling against the investigators and judges and orders. as of the fourth amendment law tends to meet by guilty people trying to overturn convictions which is perhaps not the most healthy sort of structural condition for the development of the protective wall and also concerned about innocent people including the context when the metadata at least when it is transactional don't always require notice to the people if the data is obtained which means if the data is obtained about you, the data about what websites were visiting and what people you're communicating with, if you are not invited because there is no evidence that you are up to anything, you may never learn a has-been and therefore have no opportunity to bring a sanction for violation

of your federal constitutional rights, which incredibly rare anyway. but if you wanted to do with lack the opportunity. so i think part of the issue is that there is obviously an analog is out o data-gathering leading the charge here. so, not as much of the public awareness about how incredibly frequent that kind of visual search is much more frequent than the traditional wiretaps. i guess before we shift audience questions going through the last remarks we can jump to the audience. i spent washington a long time and i've never worked on an issue where there was so much consensus. how often do you see google and microsoft sitting shoulder to shoulder in the same position. how often do you see the americans for tax reform and the aclu in the same letter.

it's extraordinary there is a website you can read about this coalition on that www. jewll due process.org and see how many people have gotten behind these principles. how many academics and how many political groups went across the political spectrum. it's really amazing. >> it is really worth thinking google and yahoo!, microsoft companies and increasingly i never thought this would have beebeen the telecommunications n at a telecommunications carriers that in the last couple of years have begun voluntarily disclosing information about the quantity of the government quest for information. so, if a positive trend i hope we see continue. i'm glad it's something that these companies have been taking the lead on.

let thlooks like the audience jn with questions and i will be less tolerant than the representative in that i will and force a three sentence rule which is to say somewhere around the end of the third sentence if not before i would hope that your voice rises in such a way so as to suggest by that inflection that the interrogative is being posed. let's start there. >> picking up on the last point why does the metadata seemed to get such a task lacks it strikes me if i have a communication with julian it doesn't say much about the content, but if i hae the same e-mail that is addressed to the five of you that is somewhat indicative of the subject into the content of what the e-mail is about. so why the pass?

>> i think it is partly a historic artifact that when the courts were coming up with rules for what was going to be protected by the warning tripwire that is a case smith versus maryland where the issue was how about the numbers you'd idle on a phone is that going to be protected by the warrant requirement when that information is stored for the telephone company and the court said it's not as revealing as the content is. it doesn't even tell you whether the call is completed or do you even talked to. they are in the phone company to make the call so maybe it should be warrant protected. what has changed is that there is so much more metadata that can paint a much fuller picture of what our activities are. there is a growing consensus that about to be protected at a higher level than it is.

one of the digital due process organizations goes to the data collected in real time. we are moving in that direction and in particular the content most likely to be protected by the warrant requirement is going to be location information just because it is so revealing. it's going to get past its ranking. so the content in my e-mail is this is in my mind right now the content in my e-mail is more revealing than perhaps the gps location and that is more revealing than perhaps my communication. if you walk to work the next ten people most will think i'm

babbling. we have to look at where we are and what can't be done and it is a great universe for everything that's perfect. i tend to believe any need metadata is indistinguishable from the content. it's the scenario to what you are discussing but it's not just if you send an e-mail the content is obvious. there are things of no real analog and the telephone context. i might take out a craigslist application looking for foot fetishes, just saying. craigslist will create a specific e-mail account corresponding than only add of course if the metadata in that sense the fact that i am going to the e-mail addresses to let you veryouvery specifically what pertains to because the only

purpose for which that e-mail exists is with that specific ad. there are e-mail addresses that are in themselves and a sense of the kind of content for action. so i sent an e-mail to subscribe at unitarian universalist.org or angry libertarians.org. that tells you that i'm attemptini amattempting to joinl discussion group. that is a first issue under the naacp of alabama. in princeton they wrote an interesting affidavit and one of the challenges to the 215 program saying how in quantity the metadata can in fact be effectively as dealing in the content because the content is structured and more attractive over the analysis test but it's the sort of in a sense it requires the technical understanding of that how

revealing that can be. we have a couple more in the middle. >> what is the situation now if the post office uses the electronics orders couldn't collect the addresses and names because it has been in the computer. >> the cia -- all these agencies do that routinely. by statute one of the first federal privacy statutes was legislation protecting the privacy of postal communications and they understood people would not use the postal system as baby leaves the conten content e read indiscriminately. it appears that at least with respect to i guess the snail mail metadata in the content that is routinely analyzed by

the intelligence agency. [inaudible] >> i don't believe it's been challenged. >> even on the criminal side you get a cover that allows you, it allows the fbi to get the information on the envelope. i think that it probably hasn't been challenged as of late i think it is pretty much accepted. the issue that we are talking about is what is inside of the envelope and not what is outsi outside. >> you have to expose the information because you are asking them to deliver the letter. and the analogy sort of i think works the same way on the content side there is a theory

that you are exposing the metadata and asking them to use that information to convey your communication where they don't really need to inquire into the content of the letter itself. it's a wreck or do they need for the communication. how that works on the internet which a century has sort of a nesanest ofanest of sudden envee inside of another is a kind of interesting and difficult puzzle. one of the things we think they are probably doing is essentially looking into the envelope, looking at the back of bone envelope. this is a whole array of the legal puzzles of how the analogy's apply. the courts are not always super attuned to the technical details that may make the simple analogies break down when you start getting into the details.

>> i think we can do one more. >> it's good to hear the content sort of acknowledge the fundamental speechlessness of the metadata versus content. but my question is about the old riley decision which was preventing a search of the telephone device incidents to a rest and so does that apply specifically only to the device that has a cell phone or radio in it or for example if i have my laptop in the car would this apply to that? >> it's where roberts basically says these are the many computers wminicomputerswe can r cameras were arbitrarily pick one of the 100,000 functions that they serve as the name for the whole device but honestly

the thing i do is make phone calls. they have been out for that -- they have an app for that? the amount of data that is stored on it has the capability and doesn't seem to be at the core of a lot of the decisions. >> [inaudible] were they ready to try that against a simple laptop clicks the >> i don't think that's necessary. when you read the case there is no question that a laptop content would also be protected. david, you had some commentary about the case and what it means for the cloud.

>> julianna eluded to this at the outside. there are some fairly strong and powerful rhetoric into the decision. in the law-enforcement agencies in the context it was i'm just going to read from it or answer to the question of what the police must do for searching the cell phone to a rest is accordingly simple. get a warrant. but the other thing that he discussed them and again that tt julian e. alluded to is that most of them don't necessarily know whether it is being stored locally on the phone itself or in the cloud and he said it makes little difference. that has enormous implications for the issues that we are talking about today. while it is unlikely that we will see a case that comes before the supreme court in part because we don't see the challenge is happening at a lower court that underscores the importance of the congress

codifying the content standard but there is no question that if you read the decision that it's more broadly applicable than just the content of the communications that might be stored locally on the device. there are implications for the cloud that otherwise the discussion that justice roberts went into in the decision would be necessary. >> as one of the political philosophers would put it i know my rights, so you don't need a warrant for that and perhaps at some point in the near future that injunction would apply equally in the cloud and on physical devices. please join me in thanking the panel. [applause]

[inaudible conversations] [inaudible conversations] we are live in nashville for day number one of the governors association summer meeting oklahoma governor mary fallin who is the chair and vice chair governor hagan lugar of colorado kicked off the meeting and we will show that to you in just a moment. but live in a few minutes vice president joe biden will be joining the group to discuss the state federal partnershistate ft

is set to start in about five minutes. and later at 4:00 the educational workforce committee will need to focus on the role of education and economic development. the guest speaker is lamar alexander and he's the senior republican on the committee. we will have that for you but right now a part of this morning's opening news conference. good morning. welcome everyone. it's good to hear have you here. you are playing with your back to the audience is the only issue on behalf of the senate of tennessee, it's great to welcome you here. we have been looking forward to this conference. tennessee has hosted the national governors association conference twice before. we hosted it in gatlinburg in a sleepy mountain town and then in 1984 exactly 30 years ago, the governor lamar alexander hosted the national governors association. the special guest that year

included ronald reagan and howard baker unfortunately as you know he passed away a week and a half ago. and the entertainment was many parole who at the time lived next to the governor. it is fun to welcome everyone back. we have had a great time showing already our fellow governors off a little bit about tennessee with great entertainment last night. we have productive meetings scheduled today and more of a chance for us to show things that we think make tennessee one of the very best states. it's my privilege this morning to introduce my friend and fellow governor and most importantly the chairman of the national governors association mary fallin. >> thank you very much. [applause] >> thank you governor. it's a great pleasure to be in tennessee and nashville and i'm here from oklahoma to take back by wonderful country and western singers back to the state of oklahoma.

just joking. we had a robbery this week talking about how many of our great performers are living here in nashville and we certainly are very proud of the great music industry that has been created in this wonderful town and it's always fun to hear the great entertainment and see nashville and we appreciate the governor and christy arranging such a wonderful time for us and we have a very active agenda on public policy that we are also going to have some fun while we are here so thank you governor for having us and we are proud to be here today to kick off the 2014 national governors association meeting in nashvil nashville. before i begin there's a couple of things i would like to share with you about our per gram and while we will be doing this week and i'm happy to be joined here by the vice-chairman of the national governors association, the governor of colorado, governor john haga hicken luperd the best practices committee and

the national governors association he has been working very hard on the various policy issues. thank you for all of the work that you have done on behalf of the association. we have had a very full agenda this weekend this weekend and a lot of work to talk about and this is the time of year the governors can come together, they can share ideas, talk about the public policy, best practices, about frankly what works and what doesn't work and it is just a great opportunity for all of us to come together. and i want to just start out by sharing with you some of our top chance, some of our opportunities that we have had this past year during my term. first i want to start with an issue that is very critical. that is water infrastructure. the governors have fought very long for a bipartisan piece of legislation that would provide the state with resources to address very critical water and infrastructure needs throughout the nation. as the governor of oklahoma, i

know very well how the drought and the extreme drought can affect the state economy, the tourism, the water available to the residence and certainly to the industries throughout the state and how important it is to our quality of life. so last month we are very proud of the president signed into law a water resource development act which included many of the nga recommendations the governors had worked very hard to suggest to congress and we are very proud of that. ..