You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

EPIC Alert 24.12

EPIC Alert logo

1. Supreme Court: Social Media Ban Violates First Amendment

The U.S. Supreme Court handed down a ruling last week in Packingham v. North Carolina, striking down a state law that barred people listed on a sex offender registry from accessing commercial websites that allow minors to register and communicate. The North Carolina ban covered major news sites such as the Washington Post and CNN.

"By prohibiting sex offenders from using those websites, North Carolina with one broad stroke bars access to what for many are the principal sources for knowing current events, checking ads for employment, speaking and listening in the modern public square, and otherwise exploring the vast realms of human thought and knowledge," the Court wrote. "[T]o foreclose access to social media altogether is to prevent the user from engaging in the legitimate exercise of First Amendment rights," the Court continued. "Even convicted criminals—and in some instances especially convicted criminals—might receive legitimate benefits from these means for access to the world of ideas, in particular if they seek to reform and to pursue lawful and rewarding lives."

EPIC filed an amicus brief in the case—joined by 30 technical experts and legal scholars—explaining that the state law violated the right to receive information, censored vast amounts of speech unrelated to protecting minors, and encouraged widespread government monitoring of all internet users.

"The First Amendment protects the right to receive information and ideas—never more so than in private," EPIC wrote. "By sharply limiting the speech that released offenders may access from a personal electronic device, [the North Carolina law] works a blatant violation of that fundamental freedom. Further, by promoting across-the-board surveillance of news and social media websites, the statute imperils the privacy and free expression of all internet users."

Justice Ginsburg quoted EPIC's brief at oral argument and the justices' written opinions noted policies and studies cited in EPIC's brief. EPIC frequently files amicus briefs on emerging privacy and civil liberties issues.

2. EPIC Pursues Release of Trump Tax Returns in IRS FOIA Case

EPIC filed a court brief Monday opposing an attempt by the Internal Revenue Service to dismiss EPIC's FOIA lawsuit for President Trump's tax returns.

EPIC filed the suit for the tax records on April 15 after the IRS refused to process EPIC's FOIA Request for the President's returns. According to EPIC, "There has never been a more compelling FOIA request presented to the IRS." In the request to the IRS, EPIC had explained that the IRS Commissioner may release tax returns to "correct misstatements of fact" and to ensure the "integrity and fairness" of the tax system.

The IRS responded by asking the court to dismiss the case, insisting that the agency did not have to process EPIC's request because the President's consent had not been obtained. As EPIC told the court on Monday, the IRS focused on the wrong law, ignoring a provision that gives EPIC a right to access the President's tax records without consent. EPIC explained that the agency's argument "is irrelevant to the processing of this particular FOIA request." EPIC will continue to press the IRS for release of the returns.

EPIC v. IRS is one of several FOIA suits EPIC is pursuing under the new EPIC Democracy and Cybersecurity Project focused on preserving democratic institutions. In EPIC v. ODNI, EPIC is seeking the release of the complete report on the scope of the attack. In EPIC v. FBI, EPIC has already obtained the Bureau's procedures for notifying organizations that are the target of a cyber attack.

3. EPIC Recommends National Safety Standard for "Self-Driving" Vehicles

In remarks to a joint workshop held by the Federal Trade Commission (FTC) and the National Highway Traffic Safety Administration (NHTSA), EPIC President Marc Rotenberg called for the establishment of national safety standards prior to the deployment of "self-driving" vehicles on the nation's highways.

In extensive comments for the FTC/NHTSA workshop, EPIC pointed to known vulnerabilities with Bluetooth communications, auto hacking, "level 3" control, malware and ransomware, auto repossession remote deactivation, and safety defects. EPIC urged the FTC and NHTSA to focus on "data protection, vehicle safety, consumer protection, and privacy." EPIC also said that the ability of states to develop safety standards must be maintained. EPIC warned that the failure to establish robust safety standards could be "catastrophic."

"Given the current vulnerabilities of networked communications, self-driving vehicles are simply unsafe at any speed," said Mr. Rotenberg.

EPIC has emerged as a leading advocate for strong privacy and security regulations for connected cars. EPIC routinely updates Congress on the privacy and security risks of self-driving cars and has urged Congress to set privacy and safety standards instead of allowing the industry to regulate itself. EPIC has participated in numerous NHTSA rule makings on auto safety, proposed stronger data protection standards for connected vehicles, and sided with consumers in a case concerning the risks of autonomous vehicles. EPIC has urged both Congress and NHTSA not to take any actions that would pre-empt states from issuing their own privacy and safety standards for connected cars. EPIC also filed a complaint with the Consumer Financial Protection Bureau over the use of starter interrupt devices, which allow auto-lenders to track and remotely disable vehicles.

4. Google Faces Record Fine for Monopolistic Search Practices

European antitrust officials have fined Google €2.4 billion for favoring its own comparison-shopping service in search results. The fine is the largest ever assessed by the EU against a single company.

Google is the dominant search engine in Europe, with more than 90% of the market in most European countries. Google also runs "Google Shopping," a comparison-shopping service that "retailers and manufacturers use . . . to connect with customers online, showcase their inventory, and drive both online and in-store sales." In 2008, Google began giving prominent placement to Google Shopping and demoting rival comparison-shopping services in search results. "As a result of Google's illegal practices, traffic to Google's comparison shopping service increased significantly, whilst rivals have suffered very substantial losses of traffic on a lasting basis," according to the EU press release.

"Google has abused its market dominance in search by promoting its own services and demoting its competitors," said European Commissioner Margrethe Vestager. "What Google has done is illegal under EU antitrust rules. It has denied other companies the chance to compete on the merits and to innovate. And most importantly, it has denied European consumers the benefits of competition, genuine choice, and innovation."

The €2.4 billion ($2.7 billion) fine is based on Google revenues from its comparison shopping service. Google has 90 days to give equal placement to rival shopping services or face penalties of up to 5% of its average daily worldwide turnover (about $12 million).

EPIC has urged government scrutiny of Google's anti-competitive practices for many years. In testimony before the Senate Judiciary Committee in 2007, EPIC warned that Google's growing dominance of online advertising would diminish user privacy and market competition. In a statement to the FTC in 2011, EPIC explained that Google altered the search rankings of YouTube after it acquired the company to preference Google's content over that of competitors and NGOs, including EPIC. In 2012, EPIC told the FTC that "Google's business practices raise concerns related to both competition and the implementation of the Commission's consent order." EPIC later sued the FTC for its failure to enforce the consent order.

5. EPIC Urges Senate Judiciary Committee To Restore PCLOB to Full Strength

In advance of a hearing on the Foreign Intelligence Surveillance Act, EPIC sent a statement to the Senate Judiciary Committee urging increased public reporting of the government's surveillance activities under section 702. EPIC contrasted the annual reports produced by the Administrative Office of the US Courts on the use of federal wiretap authority, which provides a basis to evaluate the effectiveness of wiretap authority, with the Attorney General's annual FISA report, which provides virtually no meaningful information about the use of FISA authority other than the applications made by the government to the Foreign Intelligence Surveillance Court. The FISA report contains no information about cost, purposes, effectiveness, or even the number of non-incriminating communications of US persons that are collected by the government. EPIC urged Congress to establish more robust public reporting requirements and oversight procedures for FISA.

EPIC also highlighted the need to restore the Privacy and Civil Liberties Board (PCLOB) to full strength. PCLOB, established by the Implementing Recommendations of the 9/11 Commission Act, currently has no Chair and only one out of its four Board members. EPIC argued that a full strength, independent PCLOB is critically necessary for oversight of government surveillance programs. As Judge Patricia Wald recently stated in remarks at the EPIC Champions of Freedom Dinner,

[A]n agency dedicated to protecting privacy and civil liberties inside the intelligence community with access to classified material is a uniquely valuable asset in the ever difficult search for the right balance between national security and democratic values. The need for that kind of insider watch only intensifies as our foes, foreign and domestic, accelerate their efforts to undermine both our national security and the essence of our democracy. Legitimate concerns in keeping the intel community's own integrity intact in no way detract from the parallel necessity of preserving statutory and constitutional rights of our citizens including their right to be reasonably informed of basic information on the fundamental structures of how the intelligent agencies operate, without disclosure of critical sources or methods.

PCLOB has important unfinished work that cannot be completed until the Board is restored to quorum status. In 2014, PCLOB announced that that it would issue a public report examining surveillance conducted under Executive Order 12333 and the implications for privacy and civil liberties. More recently, the board announced an anticipated publication date of the report scheduled for the end of 2016. In her remarks at the EPIC dinner, Judge Wald noted that before she left PCLOB in January 2017 there had been "dozens of drafts of a proposed 12333 report circulated to the Board". EPIC recently filed a FOIA request with PCLOB for the complete EO 1233 report. That request is still pending.

EPIC Book Review: "The Fourth Amendment in an Age of Surveillance"

The Fourth Amendment in an Age of Surveillance, by David Gray

Professor David Gray has put together an intriguing look at the state of the Fourth Amendment in an age of ever increasing surveillance technologies. The Fourth Amendment in an Age of Surveillance highlights many of these emerging technologies, their capability for mass surveillance, and the lack of Fourth Amendment protection. Professor Gray concludes that the Fourth Amendment requires "a revolution."

Technologies such as drones and cell site simulators have ushered in an "age of surveillance," according to Professor Gray. Professor Gray explains the development of Fourth Amendment law during the twentieth century. Professor Gray explains how legal doctrines such as the third-party doctrine and the public observation doctrine undermine the ability to reign in the surveillance excesses of current technologies.

As Age of Surveillance explains, the lack of ability of the Fourth Amendment to limit the surveillance capabilities of modern technology has not gone unnoticed. Justices of the Supreme Court, Professor Gray explains, have acknowledged the impact of surveillance surveillance, but have not adjusted Fourth Amendment doctrine to address the challene.

Not to be deterred, the Age of Surveillance explores some of the most influential proposals to address these challenges—providing both the pros and cons of these proposals. Professor Gray then puts forward his own proposal. He suggests that courts go back to the concept of a "search," deviating from the "reasonable expectation of privacy" analysis to arrive at constitutional remedies for the most invasive of modern surveillance technologies.

The Age of Surveillance is for anyone with an interest in privacy—from scholars to concerned citizens. Professor Gray does an excellent job of highlighting the current state of affairs while providing historical context for how we got to where we are. He provides a guiding light on how we might address the challenges to our Fourth Amendment rights in an age of surveillance and reminds us all why we should care: "We should care, we must care, because the prospect of life in a surveillance state is anathema to our constitutional character."

—Jeramie D. Scott

News in Brief

EPIC's Rotenberg Elected to CSISAC Steering Committee

EPIC President Marc Rotenberg was elected by members of the Civil Society Information Society Advisory Committee to a two-year term on the CSISAC Steering Committee. CSISC is "the voice of Civil Society at the OECD" on the future of the digital economy. CSISAC facilitates the exchange of information between the OECD and civil society. CSISAC follows the Seoul Declaration set out at the OECD Ministerial in South Korea in 2008. CSISAC recently hosted a forum, "Toward an Inclusive, Equitable, and Sustainable Digital Economy," in conjunction with the 2016 OECD Ministerial conference in Mexico.

FTC Updates Guidance on Children's Privacy Law, Includes Connected Toys

The Federal Trade Commission has updated its guidance for businesses on complying with the Children's Online Privacy Protection Act. The new guidance clarifies that connected toys, Internet of Things devices, and other products intended for children must comply with the Act. "When companies surreptitiously collect and share children's information, the risk of harm is very real," FTC acting Chair Maureen Ohlhausen recently wrote. An EPIC-led coalition filed a complaint with the FTC in 2016 alleging that Internet-connected dolls violate U.S. privacy law. EPIC's complaint spurred a congressional investigation and toy stores across Europe have removed Cayla from their shelves. The FTC acknowledged EPIC's complaint but has yet to act on it.

EPIC v. ODNI: Intelligence Agency Opposes Release of Report on Russian Hacking

In a motion filed in EPIC v. ODNI, the government contends that it is not obligated to review a critical government report for even partial release under the Freedom of Information Act. EPIC filed the lawsuit for the release of the complete report on the Russian interference with the 2016 election after the ODNI published a limited, declassified version. "The ODNI should release the complete report to EPIC so that the public and the Congress can understand the full extent of the Russian interference with the 2016 Presidential election," EPIC President Marc Rotenberg told POLITICO. "It is already clear that government secrecy is frustrating meaningful oversight. The FBI, for example, will not even identify the states that were targeted by Russia." EPIC will challenge the agency's response as the litigation continues in federal district court in Washington, DC. EPIC v. ODNI is one of several FOIA suites EPIC is pursuing under the new EPIC Democracy and Cybersecurity Project focused on preserving democratic institutions. In EPIC v. IRS, EPIC seeks release of President Trump's Tax records. In EPIC v. FBI, EPIC has already obtained the Bureau's procedures for notifying organizations that are the target of a cyber attack.

TSA Proposal to Inspect Books at US Airports Raises First Amendment Concerns

The TSA is considering a requirement to remove books from carry-on luggage for inspection during security screenings. The procedure raises concerns that individuals may be singled out for their religious and political beliefs, implicating core First Amendment values. In 2015 a college student won a $25,000 settlement after he was detained by the TSA for carrying Arabic flash cards. EPIC has pursued litigation against invasive airport screening techniques. In EPIC v. DHS, EPIC successfully sued to require the Department of Homeland Security to obtain public comment on the use of body scanners in U.S. airports. The litigation also led to the removal the backscatter x-ray devices from airports. EPIC recently filed a FOIA request to determine why US travelers returning to the United States are subject to biometric identification. In numerous cases, including a recent case before the US Supreme Court, EPIC has argued for the freedom to without government surveillance.

Supreme Court Won't Review Ruling on Secretive Sentencing Algorithms

The Supreme Court has declined to review the ruling of a state court that upheld the use of a secret algorithm to determine a criminal sentence. The petitioner Loomis argued that he was not able to assess the fairness or accuracy of the legal judgement, and that the secret "risk assessment" algorithm therefore violated fundamental Due Process right. EPIC has pursued several related cases to establish the principle of algorithmic transparency in the United States. In EPIC v. DHS, EPIC obtained documents about secret behavioral algorithms that purportedly determine an individual's likelihood of committing a crime. In a series of state FOI cases, EPIC obtained records from state agencies about the use of propriety DNA analysis tools to determine guilt or innocence. EPIC is currently litigating EPIC v. CBP before the DC Circuit Court of Appeals, a case concerning the secret scoring of airline passengers by the federal government.

Google to End Email Content Scanning

After a decade of controversy, Google announced that it will stop scanning the content of all Gmail. Google stopped scanning e-mails for education in 2014 after a lawsuit charged that it violated wiretap laws. Google faced similar allegations in many other cases in the United States and around the world. EPIC warned about Google's e-mail scanning practices back in 2005 and filed a complaint with the FTC in 2009 over the privacy risks in Google's insecure cloud computing services, including Gmail. In 2014, EPIC led a successful campaign to stop Google from scanning student emails for commercial advertising. Last year, EPIC filed a friend-of-the-court brief in a Massachusetts case, again objecting to Google's Gmail scanning. EPIC explained in 2005 that Google's email service undermined online privacy and prevented the adoption of important security methods, such as end-to-end encryption.

EPIC Urges Senate Intelligence to Ask FBI about Agency Response to Russia Attack

In advance of the hearing on Russian Interference with the 2016 U.S. Election, EPIC has sent a statement to the Senate Intelligence Committee. EPIC urged the Committee to ask the FBI witness whether the FBI Victim Notification procedures were followed once the FBI became aware of the Russian cyberattack on the DNC and the RNC. In a Freedom of Information Act lawsuit EPIC v. FBI, EPIC obtained the FBI notification procedures that would have applied during the 2016 Presidential election. The documents indicate that the FBI Cyber Division is to "notify and disseminate meaningful information to victims and the CND [Computer Network Defense] community." The obvious question at this point, said EPIC, is whether the FBI followed the required procedures for Victim Notification once the Bureau became aware of this attack. In a related FOIA case, EPIC v. ODNI, EPIC is seeking the public release of the complete report of the intelligence community on the Russian interference with the 2016 election. EPIC sent a similar letter to the House Intelligence Committee.

EPIC Urges Congress to Examine FBI's Biometric Identification Program

EPIC sent a statement to the House Appropriations Committee in advance of a hearing on the FBI's budget. EPIC urged the Committee to examine the FBI's Next Generation Identification program. EPIC explained that the program "raises far-reaching privacy issues that implicate the rights of Americans all across the country." The FBI biometric database is one of the largest in the world, but the Bureau proposed to exempt the database from Privacy Act protections. EPIC and others supported strong safeguards for the program. In an early FOIA case against the FBI, EPIC obtained documents which revealed high error levels in the biometric database. EPIC has recently filed a FOIA lawsuit against the FBI for information about the agency's plans to transfer biometric data to the Department of Defense.

EPIC Recommendations for Tech Week Meeting: Protect U.S. Consumers

In advance of a White House / OSTP meeting on "emerging technologies," EPIC sent a statement to the Office of Science and Technology Policy. EPIC urged the Administration to focus on consumer protection and to address the numerous privacy and security risks related to the "Internet of Broken Things." EPIC recommended Privacy Enhancing Technologies, data minimization, and security measures for Internet-connected devices. EPIC also urged the Administration to issue regulations on drone privacy as mandated by Congress and to establish minimum safety standards for connected cars. EPIC warned that "the unregulated collection of personal data and the growth of the Internet of Things has led to staggering increases in identity theft, security breaches, and financial fraud in the United States."

EPIC Urges Swift Action on FCC Data Retention Mandate

In a statement to the Senate Committee on Appropriations, EPIC asked Congress to obtain assurances from the FCC Chair to repeal the FCC regulation that requires telephone companies to keep customer's phone records for 18 months. EPIC warned that the regulation "places at risk the privacy of users of network services." Two years ago, EPIC, joined by consumer privacy organizations, technical experts, and legal scholars, submitted a formal petition to the FCC, calling for the repeal of the data retention ruie. The FCC recently docketed the petition and accepted public comments on the matter. All of the commentators favored the EPIC petition to end the mandate. The next step will be for the FCC to begin a Rulemaking to Repeal 47 C.F.R.§42.6 ("Retention of Telephone Records").

EU Parliament Releases Draft Report on ePrivacy Directive

The European Parliament's Committee on Civil Liberties, Justice, and Home Affairs has released a draft report on regulations for privacy and electronic communications. The draft contains several proposals to strengthen online privacy, including end-to-end encryption in all electronic communications and a ban on encryption backdoors. Protecting the privacy of communications is "an essential condition for the respect of other related fundamental rights and freedoms," according to the report. EPIC has urged the FCC to follow developments with the ePrivacy Directive and has recommended the use of end-to-end encryption in applications including commercial e-mail and connected cars.

EPIC Seeks "Long Standing" DOJ Policy for Withholding Communications from Congress

EPIC has filed an urgent Freedom of Information Act request for the "long standing" DOJ policy for withholding from Congress communications between the Attorney General and the President. On June 13, 2017 Attorney General Sessions testified before the Senate Select Committee on Intelligence regarding the Russian interference in the 2016 Presidential election. The Attorney General refused to answer many questions, citing a "long standing" DOJ practice not to share "communications" between the AG and the President or "comment on [such] conversations" for "confidential reasons." EPIC has filed a formal FOIA request with the Department of Justice seeking public release of the DOJ policy, described by the Attorney General.

News Report: FTC to Act on EPIC's Uber Complaint

According to news reports, the Federal Trade Commission is pursuing EPIC's privacy complaint regarding Uber. In 2015, EPIC filed a complaint with the FTC, charging that Uber's plan to track users and gather contact details was an unlawful and deceptive trade practice. EPIC cited Uber's history of misusing customer data as one of many reasons the Commission should act. EPIC has previously pursued successful FTC complaints concerning Google, Facebook, WhatsApp, and Snapchat. Complaints by the FTC typically lead to settlements following a change in business practices. EPIC has also recommended comprehensive privacy legislation for Uber.

EPIC in the News

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security