Want our metadata? Get a warrant, Rep. Ted Lieu says.
While the federal government needs a warrant to seize your laptop, it can access revealing details through what lawmakers say is a glaring back door: cloud-stored metadata, the information tucked within files that offers clues about who created them, when and how.
The data may seem innocuous, given that it doesn't reveal the full contents of any given document, video or image. But lawmakers say it can be used to identify key facts in an investigation, such as who was involved, what role they played and when the events took place.
While federal law shields certain data against warrantless government surveillance, agencies can seize metadata from third-party cloud providers without a warrant.
Rep. Ted Lieu (D-Calif.) told me during an interview Tuesday he finds that loophole "deeply troubling and disturbing, because metadata … can provide significant information to the government that invades a person's privacy."
To that end, Lieu is unveiling Wednesday the Warrant for Metadata Act, which would require agencies to get court approval to access metadata from cloud-service providers, according to a preview shared exclusively with The Technology 202.
"I think it's time that we bring the law into the 21st century," he said.
Lieu said that while there are limits on how the government can track a person's location data, for example, tapping into metadata can render those protections moot.
"The FBI can't just track you everywhere you go without first getting a court order for them to do that," he said. "Well, metadata has all sorts of location information, and right now because there's been no change in our law, they can just get that information."
The bill marks lawmakers' latest attempt to advance the debate around surveillance reform, which has languished despite bipartisan concerns about federal snooping.
In recent months, a bipartisan group of lawmakers have pushed to boost transparency around court-sanctioned government surveillance and to limit agencies' ability to mask their data collection by issuing gag orders to technology and telecommunications companies.
Earlier this month, the House Judiciary Committee unanimously advanced bipartisan legislation that aims to make it more difficult to secure and prolong gag orders that bar companies from disclosing surveillance against their customers, while also limiting how long they can run.
Separately, a bipartisan group of senators led by Sen. Ron Wyden (D-Ore.) introduced legislation last month that would require agencies to eventually notify users that their data has been seized from a third party, as first reported by The Technology 202. The bill seeks to expand protections around the collection of electronic data such as emails or texts.
Lieu's legislation takes a more direct approach, seeking to create tighter limits for the collection of certain data itself. Those efforts have run into resistance from officials concerned that greater restrictions will impede government investigations.
The debate around surveillance reform gained renewed attention after it was revealed that, during the Trump administration, the Justice Department secretly subpoenaed email records from numerous journalists in an attempt to identify their sources of leaked information.
The revelations prompted outcry from leaders on Capitol Hill and in Silicon Valley who have since rallied around efforts to put new limits and boost transparency around government surveillance. During a hearing on the topic last year, Lieu and other lawmakers raised concerns about agencies accessing data through cloud providers, including metadata.
But it's still unclear whether lawmakers will be able to notch major legislative wins.
European concerns about U.S. agencies snooping on private citizens' data have also loomed over efforts to strike a new deal around transatlantic data flows.
In 2020, the European Union's top court struck down a crucial pact with the United States known as Privacy Shield that enables businesses to transfer personal data between the two continents, citing concerns there aren't adequate safeguards to protect E.U. citizens from U.S. surveillance.
Last month, the Biden administration said it reached a tentative deal with European leaders, but it remains unclear whether a finalized agreement could withstand another court challenge without congressional action.