Reporter Zach Whittaker noticed that on December 29, Amazon quietly posted its year-end transparency report, providing the public with basic information about government demands for its users information during the first six months of 2017. The report confirms that law enforcement continues to rely heavily on subpoenas to demand users’ private information from internet and communications companies, skirting judicial oversight and a showing of probable cause. 

During the first six months of 2017, Amazon received 1.936 government demands for user information, 84% of which were subpoenas. Only 12% of the demands were probable cause warrants, the gold standard of privacy protection guaranteed by the Fourth Amendment. The remainder were other court orders, likely including 2703(d) orders, which do not require probable cause but must be signed by a magistrate judge. 

Many subpoenas, including what are called “administrative subpoenas,” do not require any judicial oversight or probable cause, and are issued independent of grand jury investigations or litigation. In Massachusetts, state prosecutors have the power to demand all manner of communications, banking, and even location information from companies without judicial oversight or even a suspicion that the target of the surveillance is involved with criminal activity. Our state’s administrative subpoena statute allows the Attorney General and District Attorneys to issue these demands for records when they merely have “reasonable grounds to believe” the records “are relevant and material to an ongoing criminal investigation.” That means prosecutors can demand your records even if they don’t suspect you of a crime. The power enables fishing expeditions, and has been used in at least one case to demand the records of a government critic. (That investigation, undoubtedly like countless others involving these warrantless subpoena demands, never led to a criminal charge.) 

On January 1, 2016, a landmark privacy law took effect in California. The California Electronic Communications Privacy Act, or CalECPA, modernizes for that state’s residents a federal privacy law (ECPA) that hasn’t been updated since 1986—before the modern internet existed. CalECPA requires judicial oversight over law enforcement demands for the type of information Massachusetts prosecutors, and prosecutors in other states, can get simply by signing a piece of paper.

As these new numbers from Amazon show, those prosecutors continue to rely heavily on the warrantless surveillance power. States including Massachusetts should follow California’s lead and pass comprehensive, 21st century privacy law to protect our electronic information. Massachusetts bill S.943, sponsored by Senator Karen Spilka, would do just that.