The most relevant Supreme Court ruling on location tracking, US v. Jones, left the issue opaque. The Justice Department’s current practice is to subject historical cell phone location data to the same low bar of “relevance” as other online content, says Susan Freiwald, a privacy-law expert and professor at the University of San Francisco School of Law—although, she adds, courts do usually require a warrant for real-time location tracking.

Requiring warrants would stop fishing expeditions but not specific searches for information. In a criminal case concerning a leak to the media, for instance, it wouldn’t be hard for the government to demonstrate probable cause. “So all this energy about probable cause may not really change the lives of journalists that much,” says Paul Ohm. “If you look at the celebrated stories of the last couple years, they’re not dragnets; they are targeted searches about things that are at the heart of what journalism is about.”

See, for instance, James Rosen, of Fox News, whom the Department of Justice named a possible criminal “co-conspirator” for his role in publishing sensitive national security information. After Rosen published a story about North Korea’s plans for a nuclear bomb test, the FBI got a warrant for Rosen’s Gmail account to identify his anonymous source. The ECPA reforms currently on the table in Congress wouldn’t have prevented that.

The weaknesses in ECPA have led some reporters’ rights advocates to focus on passing a federal shield law with features that counter some of the act’s more troublesome provisions. The Newspaper Association of America, for instance, is lobbying to add a stronger advance-notice requirement to the proposed shield law currently under consideration in Congress. This would pre-empt ECPA if the target of the search were a journalist, so he or she would be able to challenge the request in court.

There are notice requirements built into ECPA, but they are relatively weak: A warrant for content can be served to a service provider without notifying the account holder; and while a subpoena for content requires notice, that notice can be delayed. Take, again, the AP phone-records scandal. In his June speech to the National Press Club, AP CEO Gary Pruitt emphasized what a difference advance notice could have made. The Justice Department had seized the records of 20 individual and general office phone lines, sweeping up thousands of calls by more than 100 AP staffers—at least some of whom, presumably, were working on other stories with sources who expected their identities to be protected. “Had the DOJ come to us in advance, we could have helped them narrow the scope of the subpoena,” Pruitt said in his speech. “If AP and the DOJ did not agree, then a court could decide which was right.”

Government and law-enforcement agencies making requests under ECPA often take advantage of various exemptions in the law to waive advance notice, seal the requests, or attach “gag orders”—all of which keep the real targets of their investigations in the dark. That suggests a more fundamental problem for reporters: Even the best-written laws can be bent or broken. So while meaningful improvements to ECPA are likely to pass Congress, the burden remains on journalists to become literate in all the ways they can protect their sources and themselves.


More in Feature

Cold comfort

Read More »

Lauren Kirchner is a freelance writer covering digital security for CJR. Find her on Twitter at @lkirchner