As has been the case over the last year, more of my work is over at the Inside Out Security blog. I just finished up a piece about the Stored Communications Act or SCA. It’s always been interesting (horrifying) to see how lawyers interpret technology. I learned after researching this ancient law and some of the court cases surrounding it that “term of art” is another way for lawmakers and attorneys to say we don’t know what the hell we’re talking about.
If you don’t know: the SCA is our circa-1980s law that’s the only protection we have against government snooping and data brokers mining our data content. At the time, the lawyer types writing this statute had some real conceptual issues with email and data storage technology — they were almost mutually exclusive — and so email was only “stored” on a temporary basis. And then that’s when legal analysts start referring to storage being a term of art and … Zzzzzzzzz.
Unfortunately, the relevant parts of the law that talks about the cloud, or as its referred to, remote computing services (RCS), had a major exception.
As a practical matter, the weasel language in many terms of service agreements puts cloud storage providers outside of the RCS. The problem is that once you sign a ToS that gives Google or some of the usual suspects access to your data for non-IT reasons — most notably advertising — the SCA no longer applies.
Since those providers with the right loophole words are no longer considered RCS under the SCA, they can do anything they want with your data, including sharing it with third-parties.
Yes, I know that many ToS agreements have language saying they won’t give sell or give access to third-parties. But if they do, then you can only sue on a breach of contract basis, and then try to prove you suffered damages — not so easy. The SCA give you far greater protections, allowing both criminal and civil actions.
If you’re as interested as I am in the SCA and it’s major shortcomings, here are a few readable, which is amazing for legal writing, papers on this topic:
- Free at What Cost? Cloud Computing Privacy Under the Stored Communications Act
- Cloud Cover: Privacy Protections and the Stored Communications Act in the Age of Cloud Computing
- Cloudy Privacy Protections: Why the Stored Communications Act Fails to Protect the Privacy of Communications Stored in the Cloud