we would submit the extension of the fourth amendment protections to e-mail and texts in storage over 180 days. we can all agree but the bill goes much father and we submits demonstrates a need for a comprehensive not piecemeal reform. in my testimony i have addressed a number but by far not all of the concerns that we have. i would like to highlight two places where this bill creates or perpetuates limitations on law enforcement that far exceed those imposed anywhere else in law. burdens greater than those related to the search of a home. burdens greater than those related to the search of a body cavity. while the e-mail privacy act expands and imposes a warrant requirement to compel disclosure of e-mail or text, the statute does not recognize any of the well established exceptions to the warrant requirement.

though would be applicable in every other circumstance, i know of no other area of the law where this is the case. second e-mail privacy act imposes no disrequirements unlike those found in the law. the government has long been required to serve a copy of the search warrant on the person at the property being searched. and that requirement makes sense, demonstrates to the homeowner or the business operator the authority for the search and the homeowner is free in the usual course to tell whoever they wish about it. but the government has never been required an the law has never required the government to reach out to third parties and notify them of the search. it's not a discovery provision designed to alert those who are under criminal investigation of the ongoing investigation. and although there are specific, in fact 2 1/2 pages of rules to%

control when that could be extended this is a rule that's never been imposed in any other context. in conclusion, i would just liking to say that criminals have and we have seen that they have unlimited access to these modern and powerful resources and they make full use of them. for us, on law enforcement side to do our job access to this information is critical. information covered by the sca has to be accessible to us. that access we respectfully recognize of course should be consistent with the private sif protections afforded by the constitution by congress should not as this bill proposes impose new unprecedented and unwarranted limitations that will tie our hands in doing our jobs. thank you. >> thank you mr. cook. mr. littlehail welcome. >> thank you for inviting me to testify. i'm a technical investigators in tennessee and serve on the

technology committee. as you know, state and local law enforcement agencies work the vast majority of criminal investigations in this country. it's critical for us in those cases hr-699 does not sufficiently protect that access. to give you some sense of the volume of electronic evidence, consider a an abduction of an infant. over the course of an investigation my unit exploited leads on social media accounts and mobile devices. whenever second counts my agents and i tried to make contact with providers to declare an emergency calling and recalling to make sure our process was expedited. we had to process hundreds of leads, any one could have been the key to finding the victim. we must also contend with the lack of structure governoring responsiven investigation we received a lead that the creator of a posting on

a social media platform may have information about the child's location. when we contacted the provider they noted that ecpa's emergency pro significance is permissive and demanded legal process before they turn over the records. we have know hr-699 has support but believe much is based on one part of the bill. creating a probable cause standard for stored con taenlt. advocates for reform the contents of the e-mail or documents stored in the cloud should be subject to protections as a desk drawer at home. it goes farther to create framework, approved standards, notice requirements and expanding definitions of covered records with greater protection of records stored by third party providers than the envelope in your desk and would do this without extending any tools that law enforcement can use to obtain evidence after we demonstrate probable cause and get a warrant. law enforcement controlled exceptions and time lines. bringing ecpa in balance should

put the physical and digital world on the same plain. hr-699 should be amended to reflect a balanced approach that protects privacy and ensures law enforcement can access the evidence it needs and when we get a warrant it should behave like a warrant, not a subpoena with a higher -- the newest provisions in the bill would require us to describe our case to targets of a criminal investigation as we're pursuing leads. we also urge the committee to carefully balance the need for notification against the resource burden it places on us. time spent complying with timelines means investigating crimes. you also ensure law enforcement can access the evidence we need reliably and quickly. speed is important in all investigations and ecpa should impose structure on service

providers response to legal demands. a requirement for automated exchange of legal process and records would help speed access to evidence, provide tran sparncy and authenticate process. warrants should look like warrants everywhere else. standard exceptions should exist and law enforcement should control whether or not they're invoked just like when executing warrants in the physical world. law enforcement should have rapid access in a life-threatening emergency but not always the reality. private scy groups suggest they unfounded. isn't law enforcement on the ground in the best position to assess the presence or absence of defense in a case. we do it in other contexts all the time and there's existing body of case law to determine whether or not we're correct. i want to emphasize how important this is.

any effort to reform it should reflect its original balance assuring access to evidence through legal demands and protecting customer privacy. the balance proposed goes too far and extending all the burdens to a much broader range of records without any common law exceptions while requiring us to give unprecedented notice to investigative targets just because the evidence we're seeing is electronic. thank you for having me today and look forward to your questions. >> thank you. mr. calabrese. i think i have your pronunciation correct. >> you were right the first time. it's calabrese. but i'll take it. thank you. >> i'm on a losing streak here but go ahead. >> thank you mr. chairman for having me testify. that's the thing we appreciate the most. members of the committee, thank you for the opportunity to testify on behalf of the center for demackcy and technology.

it's a organization dedicated to protecting privacy, free speech and innovation online. we applaud the committee for holding a hearing on the communications privacy act, ecpa and urge the committee to speedily approve hr-699. the e-mail privacy act. when ecpa was passed in 1986 it relied on balancing three pillars. individual privacy, legitimate needs of law enforcement and support for innovation. changes in technology have eroded this balance. the reliance on trusted third parties for storage of our communications have left those communications with limited statutory protections. this void has created legal uncertainty for cloud computing. one of the major business innovations of the 21st century at at which u.s. companies excel. information to the government has increased from e-mails from

text messages to social networks posts and photos. most if not all of the information would not have been available in 1986. the technology has changed but the law has not creating a loophole for american's privacy protections. in the faces of the outdated statue, recognizing in cases like us v. warshack, that patch work is not enough on its own. it continues to lag behind technological change and harm smaller businesses that lack an army of lawyers. it also creates uncertainty around new technologies that rely on the use and storage of the contents of communications. reform efforts face a concerted assault from civil agencies that seek to gain new powers and blow a huge privacy loophole in the bill. agencies have blocked reform in spite of the fact that the sec

has confessed to never subpoenaing an isp post war spas shack. comby told this committee a change wouldn't have any affect on our practices. in fact, new civil agency powers would harm the privacy of ordinary citizens. imagine if the irs had had these powers back from 2010 to 2012 when they were improperly investigating the tax status of tea party organizations. during that investigation, the irs set lengthy time consuming questionnaires seeking information on what members were reading, facebook posts, donor lists and copies of materials they were dissell mating. while the irs's targeting was limited their subpoena authority is broad and likely could have been used here. if the irs had had the power that the se krechlt proposal

recommends be granted to all fed ram agencies they would have been able to go beyond gathering information directly from the target of the investigation. the irs would have enforced an order allowing them to go directly to the isp and seek the subject's e-mail while under the proposal the subject of the investigation would have been able to contest that order in court. civil standards are very low and it's clear the irs had an expansive idea of the information they could seek. this type of overreach is exactly why we can't grant agencies unjustified new authorities. support for privacy reform is deep and abiding. more than 100 tech companies, trade associations and public interest groups signed on to ecpa reform principles. signatories include the entire tech industry, span the political spectrum and represent privacy rights. consumer interests and free

market values. the e-mail private sif act has more than 300 cosponsors including a majority of republicans and democrats. a warrant for content has become the status quo. it is critical for the committee to approve. hr-699 in order to cure a constitutional defect in ecpa, protect individual privacy and assure that new technology is continued to enjoy robust constitutional protections. thank you. >> thank you mr. calabrese. and mr. salgatto. welcome. >> members of the committee, thank you for the opportunity to appear before you today. my name is richard salgatto. >> would you pull your microphone closer to you. >> sure. thank you. i'm director for law enforcement and information security for google. i oversee the company's

compliance with government requests including under the privacy act of 1986 otherwise known as ecpa. in the past i've worked on ecpa issues as a senior counsel in the u.s. department of justice. google strongly supports hr-699 which currently has 304 cosponsors. more than any other bill currently pending in congress. it's undeniable and unsurprising that there is strong interest in aligning ecpa with the 4th amendment in users' reasonable expectation of privacy. the original disclosure rules set out in 1986 were given the state of technology back then. in 2015 those rules no longer make sense. users expect as they should that the documents they store online of the same fourth amendment protections as they do when the government wants to enter the home to seize the documents

stored in a desk drawer. there is no policy or legal rational for there to be different rules. in 2010 the sixth circuit opined that ecpa violates the 4th amendment to the extent it does not requirement law enforcement to obtain a warrant. in doing so, the sixth circuit struck down ecpa's 180 day rule and the distinction between open and unopened e-mails. as irreconcilable with protections with the fourth amendment. it's observed by governmental entities and companies like googles and others. it's a modest codify occasion of the status quo. an implementation of the six occur cut's conclusions in warshack. two developments have occurred in support of updating ecpa back in march of 2013 both of which

have bearings to update the statute. the supreme court issued a landmark decision in riley versus california where held that generally officers must obtain a obtain to get contents from a cell phone. contra screen our general preference through categorical rules. to reinforce the constitutional imperative for rules in this area, the chief justice concluded his opinion with unambiguous direction to law enforcement. he wrote, the fact that technology allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the founders fought. our answer to the question of what police must do before searching a cell phone seized incident to arrest is accordingly simple. get a warrant. close quote.

notably this committee is being asked about the rules. doing so would undermine the users' expectations of privacy and encroach on privacy protections. we urge the committee to reject such pleas. second, many states have enacted rules to bring their state versions of ecpa in line with the fourth amendment. hawaii, texas and maine have all done this. in addition earlier this year the california legislature overwhelmingly approved landmark legislation to update california's version of ecpa referred to as cal ecpa. not only does cal ecpa require a government to obtain a warrant but it also extends the warrant requirement to communications metadata and data stored on electronic devices. states are appropriately recognizing the fourth amendment protections ought to extend the

sensitive data stored in the cloud. hr-699 represents an update that would ensure communications content is treated in h a manner with other papers and effects protected by the fourth amendments. it's long past time for congress to pass this. thank you for your time and consideration and happy to answer any questions you may have. >> thank you. >> thank you very much mr. chairman and i appreciate the opportunity to come before you today to testify about the e-mail privacy act and the underlying principles of balancing privacy and law enforcement needs that are inherent here. as you know, i am a former prosecutor having spent 12 years in various roles throughout government. i then became a deputy assistant secretary for the department of homeland security with significant responsibility for our counterterrorism efforts and today i operate a small

consulting company and serve as a visiting fellow at the heritage foundation. from this perspective i am pleased to acknowledge that everybody on this panel agrees that a warrant requirement for content of e-mail is an appropriate response to changing technology. it seems to me almost beyond belief that notwithstanding the uniform agreement of that principle we have been unable to work out the details of how to implement that as a matter of statutory law. to my mind, that principle has its roots not in our agreement here, but rather, in the longstanding understanding of the privacy of one's personal papers and effects that goes back to the very foundings of this nation. the most famous case was the wilkes versus wood case. wilkes was a protester much like

some of the people in america today whose papers and effects were the subject of a general warrant. that act of search by the crown at that time was one of the most salient effects that drove the revolutionary movement. likewise, the ritz of assistance case which otus lost in massachusetts which was was john adams said lit the flame of the revolution. today e-mail are our private papers. the isp's that transmit my e-mail to you are the functional equivalent of the post office and the cloud storage system that i use to store that information is the functional equivalent of the file cabinet in my office. there is no ground that i can see that is consistent with what the framers understood our personal privacy and papers to be to exclude that information from the full protection of the

warrant. and i would add that our history of fourth amendment understanding has followed the development of technology by consistently applying that same principle when the supreme court was faced with the idea of telephones in the katz case back in the 1960's. they saw that those types of personal communications ought to be subject to the exact same sorts of constitutional protections. notwithstanding the fact telephones were unknown to the founders and over the decent of justice black who said history says there are no telephones if it's not in the 4th amendment, it shouldn't be in the 4th amendment. we have recently come to understand that the cell phones in our pockets are not just telephones. they're now mini computers that contain everything that we know and understand. so, too, i would submit with the content of our e-mail

communications and our stored whether it's google, microsoft or yahoo or drop box this is where we store our data today. what's the debate? what's left. all that i here that is left is the application of exceptions that are carvouts and restrictions on the general warrant requirement. that has an appeal to it doesn't it? i doubt that that's really what the advocates for the exceptions are suggesting. i have not heard any suggest that we should adopt as well the fourth amendment suppression rules for when evidence is wrongfully collected in violation of these exception requirements. the truth is that we have had no -- we have had -- when ecpa was first passed in the '80s no exception for emergency at all. the current statute was added in

2001 post 9/11 at the suggestion of the department of justice. it's strange we would see that exception and expansion of it held out now as a reason to oppose the fundamental changes that are necessary in light of technology. i would submit to you the time is right for change and principle is clear. in the are normal law enforcement context, they should have no more access to stored e-mail than they do to our stored private letters. i would urge this committee to give the bill before you plenty reconsideration and move it to the floor for consideration. i look forward to answering your questions. >> we'll now proceed under the five minute rule of questioning with the witnesses and i'll recognize myself. mr. salgatto. if congress were to issue a subpeen no to google would that

subpoena violate the fourth amendment? >> i would have to look into is how the fourth amendment applies to congress. i have not done enough research to be able to answer that with much confidence. i would say that the changes we're talking about today to ecpa would not in any way affect the investigative powers of congress. >> i think it's an important question however because if you can't answer that question for me right now, answer this question. what's the constitutional distinction between congressional and executive subpoenas? >> i would probably have to investigate that. the fourth amendment is what it is. if there is a restriction there that's based on the constitution that exists regardless of what we do with ecpa. >> if the subpoena issued to google for the contents of a customer's e-mails, the customer

might be a government employee who is acting outside of the government servers and e-mail system and storing data on google's cloud, what ability would the congress have to conduct oversight if your finding is it violates the fourth amendment? >> i don't know that it would. but i do know that congress would have all the authority it does now to direct the subpoena to the user -- >> we would appreciate you taking some time to think about answering that question. it's an important question with regard to how we address this. there either is not a violation in which the question rises what's the distinction between congressional or executive subpoenas or there is in which

case congress ability to conduct proper oversight of the executive branch is a very significant one. >> i would be happy to answer the question. i don't think it touches on the question of this particular bill but i would be very happy to look into that for you. >> thank you. mr. saresne, critics site to the fact the sec has not sought to service a subpoena in the five years since the circuit's decision. you have heard criticisms today. they say it's not really a problem that needs to be solved because of that fact. is this true and if so, why hasn't your agency sought to challenge the policy adopted by many providers following warshack? >> the decision was made at the the time -- i wasn't at the sec at the time. but it was made in excess of caution not to issue subpoenas

to isp's without consent of the subscriber. since i've been there we have held off on doing that in difference to the discussions. at the same time we have never felt like warshack precluded us from obtaining e-mail under the constitution pursuant to a subpoena with notice to the subscribe subscriber. it dealt with no notice to a subscriber. where a subscriber or the party you're seeking e-mail from or material from has precompliance review before a court that that satisfies the fourth amendment. we have not done it but there are cases ongoing. >> i know you haven't done it. i want to know why? >> that is because in excess of caution at the time and in deference to the discussions ongoing before congress about the decision of what to do to

reform ecpa. le from our perspective there are ongoing investigations that would benefit from isp subpoenas where we have not obtained e-mail that we do know exists but not able to obtain it because we have not been issuing a subpoena to isp's. >> how has that affected your ability to conduct investigations? >> i think it has affected our ability. we issue subpoenas to individuals all the time and all the time there is instances where those individuals -- >> before warshack you would issue a subpoena to a third party holder of those e-mails? >> that's correct. >> since then you haven't felt the need to attempt to do that and have the courts clarify this issue which now the congress is being asked to clarify. >> we have felt the need but have in deference in congress reforming ecpa. we have identified cases it would have been helpful to do

that to our efforts. >> one more question. in addition to serving the warrant on the customer hr-699 also requires law enforcement to provide notice to the customer of the nature of the law enforcement inquiry with reasonable specificity. is law enforcement required to provide such information to a person when they serve a search warrant on their home? what is the harm if the law enforcement is required to inform the subject of the nature of the law enforcement inquiry with reasonable specificity? [ inaudible ] >> turn your microphone on, please. >> sorry. in traditional search warrant practice, the requirement is simply that law enforcement leave a copy of the warrant of items seized on the premises to be search and to a service

provider of an entity in possession of evidence, we serve a copy of the warrant on them and we give them notice that we're requiring them to produce the records. hr-699 imposes an additional set of requirements that we actually discuss something about the nature of our investigation that goes beyond what's required in traditional search warrant practice. >> thank you very much. the gentleman from michigan is recognized for five minutes. >> thank you mr. chairman. before i begin my questioning. i would like to ask unanimous consent to introduce a statement from the gentlemyegentleman froo into the record. he's the lead democratic member on this bill and his views are worth consideration by the committee. could i get a unanimous consent request approved? >> without objection, remain

part of the record. >> thank you. let me begin my questioning with chris calabrese. i'm trying to find out why this bill is so popular from your point of view. the e-mail privacy act. 304 sponsors. privacy advocates, civil libertarians supports it. former prosecutors. fortune 500 companies and small businesses across the country. more than 100,000 americans have signed a petition urging the white house to support this measure. how come? >> well, i think that americans believe very strongly in the values that underpin this nation, the fundamental idea of privacy and a balance between

what government can do and having rules around how they can do it. all this bill does is the very modest step of bringing our privacy protections into the 21st century. and everybody agrees with that. a recent poll in the washington post said that 86% of americans supported reform. this panel is unified in saying that we need a warrant for e-mail. now we have minor issues around the edges but i believe this is a bill that would pass congress or pass the house of representatives by 300 or 400 votes. it is that popular, it is that commonsense. we need a markup. we can work out some of these issues around the edges and the american people can get the private sif protections that they want and need. thank you. >> thank you. also, in your testimony you mentioned that the bill faces a

concerted assault from civil agencies that seek to use statutory changes as a tool to gain new powers. so argue the powers are already on the books. why do you refer to the sec's proposal as a request for new powers? >> i think that if you don't use an authority for five years and there's questionable legal -- there's a questionable legal standard about whether you can use it at all, it's new authority. that's simply put. it simply can't be you have this assisting authority and you say it's incredibly valuable but you've held off on using it for five years. either what you're doing is in your investigations aren't important which we know is not true, or you don't think you have this authority. to me, there are really no other options that i think that this is authority.

>> thank you. mr. rosenswag. the government often conducts parallel, criminal and civil investigations to the same target. what would be the practical con consequences if we adopted a warrant standard for e-mail and criminal investigations and some lesser standard for those in civil investigations? >> there would be the risk that the exception would swallow the rule. i spent much of my early career prosecuting environmental criminal cases. regulatory area where the civil regulatory authorities had civil and administrative powers for securing evidence. there was a set of procedures, parallel proceedings procedures that were internal to the executive branch that governed the circumstances under which

those civilly collected evidence could be transferred to the criminal prosecution side for use in a criminal case. those rules were simply rules of grace at the discretion of the executive branch. that were not statutorily mandated or expressed in any constitutional limit. there would be at least some risk that in an effort to evade the warrant requirement that was created by reform of ecpa, criminal authorities would solicit the securing of that evidence through civil process under a lesser standard. i do not mean to ascribe ill motivation to anybody on any part of this process, but nonetheless, the interstitial pressures are very real. >> let me squeeze in one final question here. the sixth circuit in warshack to the extent that the stored

communications act permits the use of subpoenas to compel the production of e-mail, the statute is unconstitutional. given that holding is the mechanism proposed by the sec also unconstitutional? anybody want to try that in addition to you? >> i think it likely is. hasn't been tested in court. there are -- there is a history of restricting civil authorities for constitutionally protected material. there's also frankly some law that points to things called administrative searches that might be seen as validation of the sec's position. if i were to judge it, i would probably say come down against it but nobody makes a lot of money protecting the supreme

court. >> can it withstand a fourth amendment challenge in the courts, do you think? >> i would say no. >> thank you so much. thank you mr. chairman. >> thank you. the chair recognizes the gentleman from wisconsin. >> thank you. in the warshack case the sixth circuit ruled the content of america's e-mail is protected by the fourth amendment. i agree with that holding. now since that decision the sec has been unable to subpoena e-mail content from service providers. now, i read your testimony and listened to it. did offwrite it in 2009? >> no. i wrote it -- >> well, thank you very much. now the sec cannot currently subpoena e-mail content from service providers. is it truthful to testify that if hr-699 becomes law the sec will be denied the ability to obtain evidence?

>> i don't agree we're not able to do it currently. we have refrained from doing it and in deference to congress -- >> okay. i guess you're kind of ignoring the warshack decision. even ecpa written 30 years ago the sec could only subpoena e-mail content after it was older than 180 days. aren't you asking this committee to expand a legal authority that was found unconstitutional in a more limited form? >> we are not. i don't think -- >> why aren't you because you would like to be able to issue subpoenas on e-mail content that's less than 180 days old? >> we would defer. if congress decided -- >> no, no, no, no. the thing is, i think the court decide and you're not happy with the court decision and what your testimony says is that you would like to expand something that's

already been held unconstitutional. >> i disagree. >> well, i disagree with you. now, let me ask the whole panel just to ask yes or no. if congress gives civil agencies the authority to subpoena e-mail content to service providers would that law be constitutional? i think mr. sorezne said yes. can i get a yes or no answer from the other five panelists? >> i would love an opportunity to explain. >> i'm limited on time. yes or no please. >> yes, it would be unconstitutional. >> mr. littlehail. >> yes it would be. >> mr. calabrese. >> i believe no, it would not be. >> mr. salgatto? >> i believe no it would not be. >> mr. rosenswag. >> no, that's what warshack said. >> i think we heard from mr.

serezni. mr. cook how do you square that position with the sixth circuit court's holding. >> the subpoena at issue there was a grand jury subpoena, one with no notice to anybody. the fourth amendment has never imposed a warrant requirement without any exceptions or without any other way to make a reasonableness clause. >> mr. littlehail. >> congressman i believe that the due process provided by the sec proposal offers a significant amount of protection, the same sort contemplated by the fourth maend r amendment. i believe the courts view that as sufficient protection. >> well, you know, the issue is is that there can't be a motion

to quash a subpoena until its served. even if there's an immediate motion to quash a subpoena, isn't there the risk of a constitutional violation here? >> congressman, there isn't. that's because our subpoenas are not self-executing. we need to go to a court and compel production. >> well, except that warshock seems to indicate the opposite. well, you know, the thing is is that here we're having to balance the fact that apparently the position of law enforcement is that they want to expand what is currently the law. and the position of those who are privacy advocates say the law is the law and codify it. i think this is a slam-dunk for congress to make a determination because we already have something that everybody seems to think is okay, you know,

except a few people that would like to expand the dragnet. with that, i yield back. >> chair, thanks. >> thank you mr. chairman. i'm glad we're having this hearing today as has been mentioned at the beginning of the hearing. over 300 members of congress are sponsoring the legislation. so it hasn't been a close call for most of us. there is a bill that encompasses the provisions in this bill but also goes to geo location. mr. cook, the doj enacted a policy requiring a warrant before deploying a cell site similar like a stingray to locate a suspect using their cell phone. does your association support

that policy? >> the answer to that, of course is yes, that use of a stingray or trigger fish cell site simulator under certain circumstances would trigger fourth amendment pro ex thes. that is to say that either a warrant or one of the exceptions and many occasions when law enforcement uses a stingray and it does so on the emergency aid or in circumstances exception. >> if you support this absent the circumstance exception which we're not arguing against, would you consider that a warrant for any means of obtaining real time geo information should be favorably supported by your group? >> i'm not sure i -- >> for example, you don't need a stingray to identify where a person is with the cell phone

but the identification issue is the same. wouldn't that logic extend to that? >> well, when law enforcement seeks perspective tracking of a suspect as was the case in jones, an ongoing tracking, then the fourth amendment is implicated. i think jones resolved that for us. >> i think it did as well. shouldn't that same logic apply also to historical locations? >> that's a great question. as i can tell from your question, you're fully familiar with the courts struggling with that issue, the fourth and fifth circuit and other courts divided on that. part of the division i think is driven by an understanding of the technology. the technology with respect to some location information is that it's just not as specific as gps tracking. with respect to that, the courts have recognized that --

>> i don't want to run out of time. i have assuming that you -- the technology issues are resolved and it's not the u.s. attorney's association's job to do that, logically shouldn't the fourth amendment apply to historical records as well as perspective records? >> the other doctrine that touches on that is the smith and miller third party records doctrine. >> which has also been not favorably received recently by congress. let me turn to you mr. selgatto. we have approached this whole issue from the point of the fourth amendment and the constitution and the right to privacy and the like. but it also has an impact on american business. the most important technology companies in the world are located in the united states. can you comment on the impact,

if the any, on american business for a perception in other countries that privacy is not secure if you use an american product? >> thank you. yes, i certainly can easily burn up the rest of your time with an answer to that question. it is a significant impact on american industry that there's a perception outside of the united states, europe it's no secret holds this perception. the data held by u.s. companies is somehow there for the taking for u.s. government. this bill, the e-mail privacy act is a good step towards getting rid of that misperception making sure our statutes reflect the true protections the fourth amendment offers. >> you may not have the answer. this is not an issue just for google but for facebook and all the isp's and microsoft has a big case in ireland right now and the like. has anybody added up the dollars

at risk to the u.s. economy on this privacy issue? >> you know, that may have been done. i need to get back to you with that. it's not on the tip of my tongue. >> fair enough. i would like to just mention that the chief justice conclusion in riley versus california is quote, our answer to the question, what policy -- police must do before searching a cell phone seeks incident to arrest is accordingly simple, get a warrant. how does that decision apply to the legislation we're considering today in your judgment? >> i think it illustrates the point that the supreme court wants us to have right rules so the law enforcement officer in the field knows what to do. and when we're talking about the fourth amendment and our right to privacy we're not messing around with gray areas that we recognize the significance of this right to americans and recognize the significance of

the privacy interests. we have clear rules and the rules should be to default to a warrant. >> thank you very much. my time has expired mr. chairman. >> chair recognizes from the gentleman from iowa. >> thank you. i thank the witnesses for your testimony. first it was mentioned that there's a general agreement among the panel, i believe, and others that except for a few people who would like to expand the dragnet. i would ask mr. cook and mr. littlehale. is there anything in this bill that expands the dragnet? mr. cook? >> well -- so of course i'm troubled by the characterization -- >> let me define dragnet. that would be is there anything in this bill that expands your ability to do investigations that maybe makes innocent citizens more vulnerable? >> no, sir.

i think the bill limits in a couple of unprecedented ways law enforcement's ability to do their job. >> that's my understanding of it as well. mr. littlehale. >> yes, i share that concern. >> and you would share the characterization mr. cook as well? >> i believe the bill imposes additional limitations on traditional search warrant practice and even if the standard approved governing additional category of records as contemplated in the bill is given, we will have less authority with respect to those records than we would with records in the physical world, yes. >> thank you all. i turn to mr. selgatto. from a google perspective when i or a citizen signs up for an e-mail account, there's a long agreement that's there that i have to confess i have not studied that but say i agree and sign up for my e-mail and glad to have the service and works really good. am i waiving some protection to

privacy in that agreement? >> well not with regard to what we're talking about here. the agreement certainly talks about how we use the information and where we might be needing to disclose it in order to provide the service. it's meant to describe to you and those interested in knowing what's happening. with regard to this bill and the fourth amendment we will honor search warrants served on us in valid legal process -- >> will you honor subpoenas. >> we do, but not for content. for what the statute says we honor them for. it's our presence to let users know when we get this request unless informed by gag order that we're not able to, so we will honor all of those rules that congress has set in place and that the fourth amendment established. we also will honor requests to preserve information while law enforcement goes through the effort of getting a search

warrant which may take a period of time. >> are you aware of any isp's that have a different policy than you're describing here with google's. >> there may be slight differences in how the be sligh differences in the poll say or they work, but the pattern i'm describing is certainly one that the large companies omt under. >> practice is pretty close to the mirror of the act we're discussing or the legislation we're discussing? >> yes, sir. i think that's right. i'm not aware of providers who are producing content on anything less than any subpoena at this point. >> so i would burn more time on that but i'd appreciate your response. i would like to turn to mr. rosenwig because i believe you gave the clearest definition of modern electronics versus the postal service from a constitutional -- the founders' era. this is still the constitutional era. i would put it this way isp equals pof office and e-mails

equal filing cabinet. >> that would be my summary or stored e-mails. >> yeah, stored e-mails. >> and so from a -- could i have -- could i have the right to if i had an isp provider that said we want to waive -- will you waive your authority, will i waive my constitutional protections and hand that data over to an isp provider i could do that willingly, couldn't i, under the constitution and current law? >> oh, you can consent to anything provided your consent is voluntary and not coerced. >> right. >> you could -- you don't -- if the police come to your door and say can i get the letters in your file cabinet, you don't have to require a warrant. you can say, sure, come on in if you want to. >> you are familiar with california versus greenwood? >> yes. >> the distinction here warshack

and california versus greenwood, if you take your garbage out to the curb it's not protected by any fourth amendment right. if i delete my e-mails and they're within the custody of an isp and i waived my right to privacy, that would be open access, then, to the investigators? >> i would say no. but i'd have to think about that. my sense is that when i delete the e-mail, i'm intending not to throw it to the curb as garbage but rather to eradicate its existence altogether. if i'm aware of a fact a copy is kept, maybe, but i don't think i'm aware. >> we're getting where we need to go with this panel i think is a distinction between greenwood and warsha and are they garbage or aren't they. i appreciate the panel. this has been a clarifying testimony today. and i thank the chairman and yield back the balance of my

time. >> at this time the gentle lady is recognized. >> thank you, chair. i want to thank the chair for holding this hearing and thank all of you for taking the time to be with us here today. do you dispute the continued availability of preservation orders on court interference to enforce administrative subpoenas on targets of s.e.c. investigations should the e-mail privacy act pass? >> so, if the question is whether preservation requirements should be contained in the statute and the ability to obtain from a subscriber should that also be required? >> do you think if the e-mail privacy act passes, do you think that you're going to continue to have the ability of presservation orders and court interference to enforce administrative subpoenas? >> i believe that is still something one could ob table under t obtain under the proposed statute but you can't obtain

them from the isps when the provider doesn't provide them to us. >> one problem with the e-mail privacy act it leads targets of investigates to delete e-mails thereby destroying evidence. are you telling this committee that the e-mail privacy act would be to blame if you don't issue a preservation order on an isp from day one of an investigation, is there any reason whatsoever that you wouldn't take that step, that very simple step, which can be done directly by the s.e.c. without a judge's involvement? >> we would certainly take that step. the problem is the preservation doesn't, then, allow us to then obtain the e-mail from the isp. certainly we would do that and try to preserve the e-mail and make sure it's available, but the next step would not be available. >> your comment that this would lead people to delete e-mails doesn't really hold water if you have a preservation order the information's going to be saved there, so -- >> but if a person deleted the e-mail and we subpoenaed the

person, they wouldn't have it. the only entity that would have possession, custody or control of the e-mail would be the isp. >> if you have a preservation order then the isp is going to preserve the information. >> if they preserve it and we can't obtain it -- >> i don't know about you but i use e-mail to keep in touch with my husband and my family and my homes and back home in washington state and across the country and i'm sure everyone in this room and building would tell a similar story. as e-mail has gone mobile it's virtually indistinguishable from a phone call or a text message and no doubt contains very important details of people's personal lives stored in the cloud by companies like mark salgado's. i find it highly disturbing in your testimony today seems to suggest the s.e.c. views e-mail service providers more like a witness or an informant that you should be able to tap directly for information as opposed to

the digital home of intimate communications. so, let me ask you this. if the s.e.c. wants a box of documents, sitting in a target's home, can you use an administrative subpoena to walk in and take documents? >> we cannot. >> please explain to us why you think we should give you the ability to do exactly that with the digital equivalent, how that could possibly comport with simple expectations of privacy and due process? and without a shred of meaningful evidence from you so far or anyone else that this -- that the lack of this authority will have any impact on your ability to carry out investigations whatsoever. >> we view the isp as a third party storage provider much like an iron mountain provider would be for hard copy documents kept at a storage facility and in the circumstance where hard copy documents are kept in a storage facility we can go to that storage facility with notice to the person who has -- uses that storage facility and try to obtain those documents by a

subpoena and that i think is the analogy that we would draw that would be appropriate in these circumstances and from our perspective we do have instances in the past when we did issue an isp subpoenas where we can show we ob tained significant evidence in investigations for that purpose. as to the last number of years when we haven't used it, we don't know what we've lost, but certainly our investigation -- >> i want to get your view, mr. calabrese, on this in terms of the role of the third party provider being the home of people's personal communications. >> well, it's clearly our digital home. i mean, you would find much more sensitive information about me in the cloud than you honestly would in my house at this point if you wanted fills cal documents there much more sensitive are at my house. the thing i'd also like to point out that we haven't really touched upon here, the standard for accessing information in the civil context is very low. it's mere relevance. it's not a high standard of probable cause. also the number of things that a

predicate, a civil agency has, sort of simply misfilling out your taxes, for example, are much greater than the criminal predicates for a warrant. so, we're talking about a much lower standard, much greater number of ways that we can access information. that means that we're poe tentially opening up the cloud to much greater invasion by civil agencies even than we would by criminal agencies and i think that's exactly backwards. >> if you give me just a couple more seconds, mr. chair, you talked about cases, can you give me the specific names of those cases? >> we have -- we have a number of cases and we'll be happy to provide it to your staffs and includes an accounting fraud case where an e-mail indicated someone was using earnings management and an insider trader case where an e-mail contained a tip and just one last thing to answer mr. calabrese's point, we would be fine if congress established a probable cause

standard as the standard that we would have to meet. whatever congress would like to establish for us to have to meet we're fine meeting that standard. what we need is some mechanisms in instances where the individual does not produce to us e-mail and deleted it or otherwise destroyed it. >> i think we already discussed with post-warshak you never needed that authority. so my time's expired. >> the gentle lady's time has expired and the gentleman from texas mr. gohmert is recognized. >> thank you, mr. chairman and all the witnesses for being here. for anyone that can answer, if someone deletes an e-mail that he or she has already sent out, would the isp be able to retrieve that at some point? >> i'd be happy to answering that. it may vary from company to company. there -- in most cases i think it's fair to say that there would be some short period of time between the point of

deletion and when the system purges the content that's been deleted so there would be some period of time. that time period may vary from provider to provider. >> couldn't it be retrieved from the person to whom it was sent? >> it certainly could. so, there may be many communicants. >> i'm not a co-sponsor at this time even though i'm one of the persons proudest of the work that kev. kevin yoder has done to this point. i think it's fabulous. i think it's important. my concern has been that we left a provision at page ten, for example, that allows a governmental entity on apply for a court order so that they can still not inform the individual. and that's fine to my mind if there's a question of endange