5 Lessons From the AP Spying Case and Other Leak InvestigationsCindy Cohn Trevor Timm But there are several other important lessons that this scandal can teach us besides how important free and uninhibited newsgathering is to the publics right to know. 1. Weak Privacy Laws That Doomed AP Affect Everyone The AP detailed in its letter to the Justice Department how its privacy was grossly invaded even though the government accessed only the call records of its reporters and not the content of their conversations. We completely agree. Unfortunately, this isnt just a problem in the AP investigation. Law enforcement agencies routinely demand and receive this information about ordinary Americans over long periods of time without any court involvement whatsoever, much less a full warrant. For example, according to information released by the phone companies to Rep. Ed Markey, Sprint alone received a staggering 500,000 subpoenas for call records data last year. The DOJs decision to dive into these call records shows the growing need to update our privacy laws to eliminate the outmoded Third Party Doctrinewhich holds that anything you give to a service provider, or that a service provider collects as part of providing you a servicecan retain no reasonable expectation of privacy. In an era where email is stored by our providers, cellphone companies keep records that track our location and cloud services hold our documents, its long past time to bring our interpretation of the Fourth Amendment and statutory electronic privacy laws in compliance with the 21st Century. 2. Phone Companies May Give Up Your Information Without Telling You As the New York Times reported, the AP is still examining if and when any telephone companies tried to push back on the overbroad requests for its call records. But at least two of the journalists personal cellphone records were provided to the government by Verizon Wireless without any attempt to obtain permission to tell them so the reporters could ask a court to quash the subpoena, the Times said. And it also seems clear that the AP itself wasnt given notice before their phone company turned over the records. In EFFs 2013 Who Has Your Back report, which tracks several ways in which communications companies can help protect user privacy, we give a star for promising to notify users about government demands for data whenever whenever the company is not legally prevented from doing so. Notably, Verizon does not have such a notification policy and did not receive a star. In fact, Verizon was the only company to receive zero stars. This isnt a small problem or just a problem for journalists. Verizon received 260,000 similar subpoenas for call records last year. The government requests this information with regularity, and given the phone companies control the data, communications company policies are all that stand between you and governmental overreach. Users should demand that their communications companies notify them when the government comes seeking information, unless they are legally barred by a court order. 3. Government often Overstates National Security Claims, Overclassifies Information Weve written many times about the many ways national security has been invokedand exaggeratedin order to cover up government embarrassment or wrongdoing, or to assert powers that would normally not be granted under the Constitution. The government routinely overclassifies information that should never be secret, according to reports commissioned by the White House itself. The most glaring example for EFF is our lawsuit over the NSA warrantless wiretapping program, where the government wont admit or deny that the program even exists, citing the danger to national security, despite thousands of pages of public evidence. The government has argued the same thing in cases about torture and the CIA drone program where, many times, the same information that they claim is secret is on the front pages of the nations newspapers. In the APs case, while Attorney General Holder says this leak put lives at risk, John Brennansaid the opposite around the time of the story (Brennan said the plot was never a threat to the U.S. public or air safety, reported Reuters). The AP also held its story for six days until the CIA told them it was safe to publish and the White House had a news conference planned the day after the story to announce the successful counterterrorism operation. As the late Supreme Court Justice Huge Black once said, The word security is a broad, vague generality whose contours should not be invoked to abrogate the fundamental law embodied in the First Amendment. 4. Theres Not Much Recourse For Prosecutorial Misconduct In this case, just like the case of Aaron Swartz, there has been widespread criticism that the Justice Department has abused its authority and aggressively pursued parties in an unprofessional manner. As we detailed last week, it seems the Justice Department didnt follow its own guidelines when issuing subpoenas about[?] the reporters, or at least went to the very edge of its own guidelines. Just like in the Swartz case, the specific prosecutor has a history of over-aggressiveprosecutions (even being accused of overzealous prosecution by Eric Holder himself when he was in private practice). Yet when Congress asked Holder at a hearing about the allegations, just like in the Swartz case, he did not admit to any wrongdoing, and was able to deflect questions about his departments handling of the case. Unfortunately, there is not much recourse for meaningful remedy for the public in these situations, and this case is just the latest example. 5. Journalists Need to be Pro-Active in Protecting Their Digital Security In an age where warrantless surveillance is skyrocketing and governments potentially have access to an astonishing amount of information, journalists must learn to proactively protect both themselves and their sources. The Committee to Protect Journalists Journalist Security Guide is an excellent place to start. It addresses concerns faced by journalists working inside the United States and internationally. Wired published an op-ed last week about the care one needs to take from the sources end if one wishes to send information to the press undetected. Much of the advice is applicable to reporters talking to sources as well. Additionally, the New Yorker has just released a promisingbut un-testedanonymous leak submission system, coded by Aaron Swartz before he tragically died in January. In certain circumstances physical mail remains the safest option. Overall, the final lesson is that journalists, and sources, need to take security seriously. Trusting that the government wont come after you because youre engaged in journalism, serving the public interest, or helping reveal wrongdoing is plainly not sufficient. 