Lawfare Daily: The Privacy Law That's Supposed To Be Protecting Us Online Turns 40

[Intro]

Michael Dreeban: What the Court did after the Stored Communications Act with Fourth Amendment cases, as technology continued to leap forward and Congress did not do much, was kind of what I would describe as a sort of fourth amendment remodeling project.

Natalie Orpett: It's the Lawfare Podcast. I'm Natalie Orpett, executive editor of Lawfare. Today, we're bringing you something a little different, audio from our recent event, “Installing Updates to ECPA,” at which legendary Supreme Court advocate Michael Dreeban gave opening remarks.

Michael Dreeban: The Fourth Amendment principle from Katz is that which a person knowingly exposes to the public is not a subject of reasonable expectations of privacy or privacy expectations that society is prepared to recognize as reasonable, but what you protect as private in your home is—

Natalie Orpett: We held the event to mark the 40th anniversary of ECPA, the Electronic Communications Privacy Act. It built on our paper series in which experts from various disciplines reflected on the law, what's changed over the last 40 years, and how ECPA should be updated to meet today's realities. You can find those papers at our website, lawfaremedia.org.

But we wanted to share Michael's remarks here on the podcast. They're an excellent overview of where ECPA came from and how it evolved, how it relates to the Fourth Amendment, and where the law stands now.

[Main Episode]

Michael Dreeban: Thank you for inviting me to talk to you about the backdrop to ECPA, the guarantee that goes back to the 18th century. So when we talk about updating ECPA, which is 40 years old, I'm gonna take us back in time to how the Supreme Court seeks to update a guarantee that is more than two centuries old at this point and has a backdrop that is very different from modern technology.

I do wanna say at the outset that I will talk about some of the cases that I argued. Some of the people in the room helped me very much understand the technology around them. And I just wanna add a footnote to what Paul said about losing some in the Justice Department. We have an expression that the United States wins its point whenever justice is done in its nation's courts. So I'm gonna count them all as wins.

All right, so the work that the Fourth Amendment does here is not really something that falls into a basket of originalism. Justice Alito once said in an argument about how the First Amendment mapped onto video games when Justice Scalia was asking a lot of questions about the original meaning of the First Amendment, and Justice Alito said, well, what I think that Justice Scalia wants to know is, what did James Madison think about video games? Did he enjoy them?

Sadly, we never found out the answer to that question. But the Fourth Amendment, I think in many ways presents even a greater challenge. The framers lived in, obviously a completely physical world. Communication was face-to-face or through documents, they lived in houses, they did not have access to any of the electronic means of communication that have now produced the need for legislative action and constitutional adaptation.

So privacy and physical things went hand in hand. And the Fourth Amendment's text reflects that it protects the right of the people to be secure in their persons’ houses: papers and effects against unreasonable searches and seizures. It's not a freestanding guarantee against unreasonable action. It's not a textual guarantee against invasions of privacy by the government.

It reflects those things, but it does so through text that is centered on physical objects, and so you can have debates about some of those things, like the Open Fields doctrine says that the Fourth Amendment does not apply to physical protection of open fields. It does to houses in between them, you have the curtilage, the area around the house where the intimate activities of family life are supposed to go on, presumably if you have a high enough fence to give you some privacy.

But those sorts of disputes really pale in comparison to what privacy should attach to electronic and digital information. It scrambles all the assumptions that are underlying the Fourth Amendment in the first place in its relationship between privacy and physical things. Communications obviously takes place outside of physical presence.

Communications and information is embodied, not necessarily in what I would think of as a physical form, although I suppose zeros and ones on a silicon chip are physical in some sense, but being held remotely on a computer accessible electronically is very different from what the framers were familiar with, and so the Court has confronted challenges in how to update the Fourth Amendment so that it makes sense and serves some of its purposes in the modern era.

Now, this is not a new problem. So we're at 2026. The Court has a landmark case from 98 years ago, Olmsted versus United States, where it came face-to-face with wiretapping, and the Court concluded that wiretapping doesn't implicate any of the protections of the Fourth Amendment. Why? Well, at the most simplistic level, tapping a wire is not searching someone's person, maybe their house, their papers or their effects.

What are you seizing when you seize a conversation? It just doesn't, to borrow a phrase, compute when you try to apply the 18th century terminology to what was at the time a relatively modern development. So in Olmsted, the Court said, no, we're not gonna apply the Fourth Amendment.

Justice Brandeis, you know, seized on the opportunity to write a very famous dissent in which he envisioned even further advances in technology that would completely erode privacy unless the Fourth Amendment was given some growing power to encompass the new forms of communication. Nearly four decades later in Katz versus United States in 1967, the Court made that leap and it concluded that putting on a microphone on the outside of a phone booth—

Some of you may remember phone booths, some of you may be wondering what I am talking about—And hearing the vibrations on the glass and translating them into oral information could constitute a search and bequeathed us the famous Katz test in the Justice Harlan's concurring opinion of what a person expects to be kept private, and society validates those expectations as reasonable.

So that evolved into a Fourth Amendment new stream of analysis. Instead of looking at physical things, we were looking at privacy expectations and legislatures. Interestingly, because this conference is largely about how legislators deal with privacy problems that the Constitution either doesn't deal with adequately or maybe doesn't deal with at all.

Had regulated wiretapping long before the Supreme Court got into the business. So there was a backdrop of state law about this, and there was a backdrop of federal law because Congress passed the Communications Act of 1934 after Olmsted said, not our problem. Congress did leap in with a much simpler, easier to understand.

You don't have to take advanced lessons in algebra to decode the Communications Act. It was a ban on the disclosure of wiretapping and conducting it without authorization. But in 1967, Katz kind of jumpstarted the process again, and it was coupled with a case called Burger versus New York, which addressed a New York statute that dealt with eavesdropping and regulated eavesdropping, but in a way that the Supreme Court said it did not come up to Fourth Amendment standards of particularity probable cause definition in time.

So how many of you have read Burger within say the last year? Paul? Yes. You're probably teaching it a handful of people out here. Josh. Really? We should be doing some more modern stuff over there, so gotta send you some new cases. There's this one called Carpenter.

Anyway Burger is fascinating. I do recommend that you reread it because it's a long time ago, but the Court is writing with this consciousness that technology is really moving fast and it's changing things, and it's changing them in ways that will undermine our expectations of privacy unless we do something about them.

And legislatures have been trying, it kind of records the frustration of legislatures about bugging and wiretapping and how they're not kind of getting it right, but they are trying. I found that to be really interesting when I went back and looked at it and it did stimulate congressional action.

So you get in 1968, Title III of the Omnibus Safe Streets Act, also known as the Wiretap Act, and Congress there regulated wiretapping and the acquisition of oral communications. So it covered the bugging side and it covered the wiretapping side, and that's 1968. It largely supplanted constitutional and Fourth Amendment analysis of wiretapping.

There's not really, I don't think, a big ticket Supreme Court case about wiretapping since Title III, because Title III actually imposes requirements that exceed the Fourth Amendment and they have held up over time. There are some questions at the margins about what a reasonable expectation of privacy is when you're outside and you're talking at a park bench, and you can't see anybody, but the department has somehow come up with a parabolic microphone and it's picking up your sounds. And I saw some cases like that when I was at the department, but for the most part, it's kind of mapped the area.

Now we fast forward 20 years to 1986 when Congress thought, oh man, we, you know, we gave our best shot in the Wiretap Act. I realized my math is a little off. Just forgive me for this. I'm a lawyer, not a mathematician. So it's, you go 1968 to 1986, and Congress steps in. And it's, if you go back and you read the legislative reports surrounding the Stored Communications Act, and again, I know Paul has, but maybe the rest of you have not recently.

It's kind of refreshing 'cause they are in plain English and they tell you what problems Congress was trying to solve. It was trying to solve problems that wiretapping just didn't address, and that you didn't have to confront until you had communication through email that went to a server somewhere and it was stored somewhere else.

And at that point, what can the government do? Can it just use a subpoena? It can for other business records or for other information and compel the provider to provide it. Is there an expectation of privacy in email and how does the government use tools that will allow it to get the information it needs?

And there was one final problem, which is, what are we gonna do to keep the providers from just getting all this private information and spilling it out into the world? So it was trying to solve those problems. At least that's my takeaway from reading the legislative reports.

And I think that the Stored Communications Act actually did a reasonable job of addressing the problems it was trying to address that didn't have the foresight to see how technology would go. And so, it may feel a little quaint reading these fantastic advances and like people are sending data offsite for data processing. ‘Wow, that's mind blowing.’ But that those were the problems they were trying to solve.

The Stored Communications Act was not, though, intended, I think, to cover everything, and it certainly did not end the development of Fourth Amendment law. What the Court did after the Stored Communications Act with Fourth Amendment cases as technology continued to leap forward and Congress did not do much, was kind of what I would describe as a sort of fourth amendment remodeling project.

I mean, the structure of the law was not particularly well-suited to solving even the problem of email, and the Court undertook a process of trying to update 18th century guarantees so that it did not become meaningless in the 20th, and now 21st centuries. And I'm gonna talk a little bit about what it did and where it fell short and why it fell short, which supports the idea of updating a legislative effort rather than just relying on constitutional considerations.

Now I wanna say at the outset that I may not be the best qualified person to sort of talk about this. I had a flip phone for a long time until I actually had a case about a smartphone and I said, okay, I guess I better go out and buy a smartphone and kinda like learn how to use it. I really did like that flip phone.

I looked for it this morning 'cause I was gonna bring it and show it to those of you who don't really remember them, but it was great, very lightweight. I also remember being in court in a day when Chief Justice Roberts asked an advocate, why would anyone carry two phones? And by that point I was sitting there, and I was working in two different components of DOJ, and I had my own phone and I said, right, why would anyone carry two? You should carry three. But I didn't say it.

So the Court itself is, I don't know how much ahead of me it really is. Elena Kagan once said in 2023 in an argument about the Communications Decency Act 230 and the internet, and she's puzzling over like, who should solve the problems of whether 230 shields this or that activity. And she said, you know, these are not the nine greatest experts on the internet, which might have been a little bit of an understatement, but I could identify with it.

Alright, so now we're gonna come to the cases that I did argue that are all well known to you. There's sort of four seminal cases over a period of years that mapped the intersection of the Fourth Amendment and different technological problems that were not anticipated either in the Stored Communications Act or let alone the Fourth Amendment itself. And they, I think, will help explain why the Fourth Amendment does some work, but not all the work that you might want.

So the four cases are Kylo in 2001, Jones in 2012, Riley in 2014, and then the pièce de résistance, Carpenter in 2018.

Kylo was about thermal imaging on the home. And how many of you own thermal imagers? Good. I've, you know, it's like, I'm really hoping that we kind, you know, get the numbers up, 'cause the Supreme Court address this device that can map the heat signatures of the outside of homes. It does not penetrate inside the home. We had very primitive thermal imaging in those days.

And the Court said you know, we're not gonna mess around with kind of the circularity of Katz. Justice Scalia wrote the opinion. He's not a big fan of Katz, but he said, we're going to update the Fourth Amendment. So if technology allows you to get information from the interior of a home that you otherwise could not have gotten without a physical search by a technology that is not in common use, it is a search under the Fourth Amendment.

And we could unpack all of those terms, but the point about the thermal imaging not being in common use, the more of you that go out and buy it, the better I will able be able to be to file a slightly out of time petition for rehearing, asking the Court to reconsider Kylo. So Kylo did not go well. They said that it was a search.

Next up and we had a little, you know, a gap here of about 12 years. We had Jones. Jones is the famous GPS case where officers attached GPS to the bottom of the car. And they tracked Mr. Jones, Antoine Jones, for 28 days as he went between his various safe houses and his home and his drug trafficking storage units. And it was all used to connect him to these activities and convict him.

And it went up primarily as an expectation of privacy case. It, because in I think fairness to reading the cases, the Court had said, Hey, since Katz, we really crossed a bridge. We're interested in privacy. We're not interested in trespass. There's literally Supreme Court's case said, trespass is neither necessary nor sufficient to constitute a search that was car. So we're all focused on privacy.

And the Supreme Court had two cases in which it said, driving around on the street is not a private activity. Anybody can observe it. So that was our basic thesis. When I went around to U.S. attorney's offices, as I sometimes did, to talk about the Supreme Court and kind of outlined the facts I got this universal reaction from people: Wow, that sounds creepy. And this was from the people in the government.

Now, that was not a particularly good sign. And when I got up to argue the case in the Supreme Court, I was about 20 seconds into whatever my shtick was. And the chief justice said, are you saying that you could just attach GPS devices to all of our cars? And I tried to be my absolute sweetest and said, ‘you mean the members of this Court? Like, no, we would never do that.’ He said, yes. You know, like, what's your answer there? And so, I was consistent with the principle and consequently lost five votes on the privacy aspect of the case.

But I also achieved something that is really rare in Supreme Court advocacy. I lost five votes on another theory as well. Remember, there's only nine justices losing five votes on two different theories—that's an art form. And the other theory was property. Justice Scalia resurrected the property theory under the Fourth Amendment that a technical trespass for the purpose of getting information of an item that's protected by the Fourth Amendment—house, person, effect—that constitutes a search as well.

And the interesting thing about that one was, you know, our argument was like the underside of a car is not like the place where, I mean, how many of you regard the underside of your car as where you’re gonna put your most private sacred possessions? I didn't think very many hands went up.

Although I will say that when I went to the FBI to prepare for this, and I had this whole team of technological people sitting around a conference room and I said, where actually do you put these devices? And it was quite amazing. They all sat back like this, like synchronized swimmers. They, and they said, that's confidential information on need to know basis and you don't. So to remedy this gap in my knowledge, I went on the internet and watched a video about where they already saw. Just say. So that was Jones.

Then came along Riley, and Riley was the Search Incident to Arrest doctrine. When you arrest somebody, you can search their person in the area inside their wingspan and you can pull items out of the, their pockets, wallets, other containers, and it's categorical. You just get to do that as a search. Well, what about if you have a phone, on your body at that time, and our argument was the Search Incident to Arrest doctrine, treated the phone as a container of information, and the Categorical Search into Arrest doctrine covered that.

This went over almost as badly as Jones. I lost 10 votes. Here, I lost, I, I unified the Court. Court unanimously said, no, we're not gonna extend the Search Incident to Arrest doctrine to this. And it gave the chief justice the chance to say that the government's argument is like comparing a horseback ride to a trip to the moon. They are both modes of transportation, but they're kind of different qualitatively.

So I gave him that chance. I wasn't sort of, you know, setting him up for that one. But he did walk into it and he took that one. So that was Riley—and then we had four years off until Carpenter. And Carpenter is the most complicated and maybe consequential of the four cases.

This is cell site information. And we relied there on the Third-Party doctrine that when you give information to a third person, your expectation of privacy in it is mostly gone. I'm gonna leave aside like, you know, attorney client communications and other things where there might be some preexisting legal privacy protection. And you—providers use cell side information for their own business purposes.

They collect it for their own business purposes and you cannot use a cell phone without knowing that it's connecting to a tower. Otherwise, like how are you getting a voice on it? So we relied on the Third-Party doctrine and again the chief justice pushed back and said, yeah, you know, I've heard about that Third-Party doctrine, but that was bank records and kind of dialed telephone numbers, you know, in, in Smith and Miller, we're not gonna extend that doctrine to cover cell site location information, which gives you this very cheap portrait of where you have gone revealing the privacies of life.

So, I lost that one, but I did make progress. Carpenter was five four. So there were five dissenting justices who really pushed in many different doctrinal directions to object to the majority. But you know, five votes gets you there. So with those cases, we kind of had the Court really walking through the different terms of the Fourth Amendment.

Kylo is about houses. Riley is about the person. Jones is about effects—your car. And Carpenter is kind of your virtual papers. So I sort of thought maybe the Court is just done. You know, they've taken care of all four items in the Fourth Amendment. What is there to do? But no, the Court is going to confront yet another aspect of the Fourth Amendment later this term.

Let me say though a few things about why the Supreme Court's decisions, even though each one of them vindicated privacy rights and each one of them sought to update the Fourth Amendment and say it's not irrelevant. And we've got this, 40 years of Congress not stepping in and doing anything to protect privacy that has now slipped through the Stored Communications Acts cracks.

Why should we not rely on the Supreme Court to really map this area and do that much of a, the work that we need done? One is timing. There's a delay factor in between a search, a prosecution, a motion to suppress, a grant of certiorari. All four of these cases that I talked about are on motions to suppress. So is Chatrie, the geofencing case. And there's a lag time. The average is about seven to eight years before it gets to the Court, and by the time it gets to the Court, the Court is talking about a past technology. That's one reason.

The second is a sort of narrow case, specific focus. The Court may be announcing broad principles and unleashing like ‘what is the Third-Party doctrine?’ But it doesn't give you all of the answers. So in Carpenter, for example, this one, I think they must have been chuckling when they wrote, but they said, Carpenter is our holding is narrow. It's like, yeah, really? Then why are we writing 45-page guidance memos trying to explain what's going on in the rest of the world?

They reserved tower dumps, which is a cell tower, and you get all the numbers of the phones that connected to the cell tower during the time of a crime. They reserved security cameras. They reserved other business records that incidentally reveal location. Like what exactly is that mean? And they reserve foreign affairs and national security, so you're not going to get a comprehensive resolution of the problems that prompt Fourth Amendment and privacy concerns based on advancing technology.

And then the third factor is limits in Fourth Amendment law itself. And I'll just mention three. One is the Fourth Amendment principle from Katz is that which a person knowingly exposes to the public is not a subject of reasonable expectations of privacy or privacy expectations that society is prepared to recognize as reasonable. But what you protect as private in your home is.

So you have that dichotomy between the private sector, the public sector, and the Court has to draw boundaries. And the Third-Party doctrine illustrates how those may not necessarily map onto our own expectations of privacy. Most people don't think that our communications with banks or using credit cards are exposed to the public or that dialed phone numbers of who you call are not private. But the Court held that both of them are subject to the Party doctrine and therefore don't get fourth Fourth Amendment.

Second factor related maybe is the Fourth Amendment only covers government action, not private searches. So when you give information to a private provider, they are not limited by the Fourth Amendment in what they can do with it. And that's an enormous gap in a world of apps and ISPs that collect vast amounts of information.

I know we're all clicking like crazy on every website now, you know, thanks to probably European privacy laws, but I don't think we're doing necessarily a great job of keeping information out of the hands of these providers. They're not regulated by the Fourth Amendment. And you know, related to that, it's like who is doing the search?

Like under the Stored Communications Act? We put a 2703(d) order—I can say that in this group, without fear that anybody's gonna go, what? —on a provider, it's a disclosure order. It's not a search in the sense that, you know, Josh is gonna go down to Microsoft and kick the computer operators off the keyboard and find the stuff himself, or fly out to Ireland, as in the Microsoft case, and just sees it.

It's a disclosure order. That means Microsoft has to go and find the information. Is Microsoft an agent of the government at that point, or is Microsoft a private party who's been required to disclose information and just has to gather it from its own resources and so it's not governed by the Fourth Amendment in that activity? The government has a position on that. The defense bar has a position on that, and the Supreme Court has not squarely confronted it in modern times. So that's an issue.

And then I think that the, another big one is can the government just buy data from data brokers. And this has produced a draft law, the Fourth Amendment is Not for Sale Act. So, very, that's kind of like truth in labeling. But it hasn't passed. So right now, that is not regulated, I don't think by the Fourth Amendment.

And then finally doctrinal limitations. I mean, Katz has been accused of circularity for years. It's like, are the expectations protected because the Court says so, or because society thinks so? And there's the famous hypothetical about the president announces, this would've been a hypothetical a few years ago, but I'll just say it. You know, the president announces everything that you consider private, we can now just come and get, so you have no realistic expectation of privacy. So is Katz normative or Katz descriptive?

And then on top of that, we've got the deciders on that issue or the nine justices. Ultimately, do they really represent, you know, are they good proxies for what society thinks of privacy or maybe anything else? And that's on the privacy problem.

What about the property prong that Jones has now brought into play and has kind of, you know, got some adherence? You know, Justice Gorsuch loves it and, you know, maybe it's making a comeback. Will it supplant Katz? Will it join Katz? And on its own it is just tough. Like what are you supposed to be looking at? 18th century tort law, modern 21st century tort law, statutes and you know, it's great to say we have a property theory of the fourth Amendment, but without knowing what your sources of property law are and then what the content of it is, it's like any other kind of original list or, you know, excavation project. It's not gonna be clear what the boundaries of that are.

So those are reasons why I don't think that the Fourth Amendment is gonna really solve all the problems. Email is really a great case in point. I think most people, and I'm sure that the justices think that email is private, but I know from having conversations with people in DOJ over many years, like, well, how private is it when Google is scanning it to direct ads to you and it's scanning it to ferret out contraband? Is it really something as to which you have an expectation of privacy? Now, I personally was not willing to go up and make those arguments to the Supreme Court 'cause I'd already had enough. I didn't wanna add to my kind of list of ‘wins.’

But it's a—it is a hard problem. And the Stored Communications Act kind of tried to solve that one inadequately, I think, or is email a form of property? Is it like a digital letter? And so we should use the sort of Kylo formulation that says like, well, you know, we'll just translate letter into communication.

Just not a bad form of constitutional analysis. You know, it's like, it's pretty typical to do that with language, but it's just not clear exactly how it would work. So enter statutes. And you have the Stored Communications Act—this group is far better than I am to talk about the ways in which it's adequate or inadequate.

But Congress drew a line, the 180-day line, and the distinction between electronic communications providers and remote communications storage. That does not make a lot of sense, and it makes the least sense of all probably for email. If you accept as the Sixth Circuit held in United States versus Warshak, and as DOJ came to accept that there is a privacy expectation of email, why does it change in 180 days? I mean, it's just not magic.

So it drew lines, but you know, it, it needs some updating. And I think that's probably what, you know, people will talk about at this conference. And I promise Stephanie, that I would mention one other anomaly that you might know about and be on your mind, or maybe you don't think it's an anomaly, but the question of extraterritoriality, the Stored Communications Act, applies here to domestic activities, it does not pass the Supreme Court's test for an intended extraterritorial application.

And so I confronted in the Microsoft case where Microsoft is here, Redmond, Washington, but it's storing the stuff off in Ireland. And Microsoft said, well, you're conducting an extraterritorial search when you put a disclosure on order on us. I don't agree with that, although the Court did not ultimately resolve that question.

But the way that the Stored Communications Act is written, and if it is territorial, it doesn't prevent an Irish subsidiary of Microsoft from disclosing your treasured secret hallowed emails that are stored over in Ireland, 'cause 2702 also has a domestic focus. So I don't think it applied and. My opponent didn't think that it applied either, Microsoft, in the Microsoft argument. So it's a, the extraterritoriality issue I think is a big one.

I guess I'll close by saying the Supreme Court will continue to be a player in this area. It's taken Chatrie, the geofencing case that will be argued in April. It implicates lots and lots of interesting issues that will have many interesting implications that may influence the way legislation is written, but it's just a great example of, again, the Supreme Court looking at a criminal case through a motion to suppress that comes up years later after.

Google actually changed from keeping all of its location history on servers that are offloaded. It now puts it on your phone, which would make a very different Fourth Amendment analysis. Although the question of why it should make a very different Fourth Amendment analysis is something that the Court will have to confront.

So I think we can still expect the Court to be setting kind of big, bold boundaries around certain aspects of privacy, but it is not going to be able to address the more fine-grained, granular, detailed questions that can comprehensively be addressed in a statute. I hope that the work that comes out of this group leads to, you know, the Stored Communications Act of 2026, or as Paul was saying, when Congress decides to legislate maybe 2032, 2040, and then there'll be another conference in maybe 20 years to try to update that one.

But thank you very much.

[Outro]

Natalie Orpett: The Lawfare Podcast is produced by the Lawfare Institute. If you want to support the show and listen ad-free, you can become a Lawfare material supporter at lawfaremedia.org/support. Supporters also get access to special events and other bonus content we don't share anywhere else. If you enjoy the podcast, please rate and review us wherever you listen. It really does help.

And be sure to check out our other shows, including Rational Security, Allies, The Aftermath, and Escalation, our latest Lawfare Presents podcast series about the war in Ukraine. You can also find all of our written work at lawfaremedia.org.

The podcast is edited by Jen Patja. Our theme song is from ALIBI Music.

As always, thank you for listening.