California’s Cyber Security Policy Is Now the Strongest in the U.S.

November 18, 2015

6:00 pm

Technology solves a lot of problems, but it can also help contribute to new ones. Cyber attacks are on the rise and they don’t appear to be letting up. One of the dilemmas that the digital age has created is the conundrum concerning the extent to which digital content can be considered private. Fortunately, this issue of digital privacy is beginning to be addressed. California, the United Steates's largest state in terms of population, has implemented a sweeping law protecting digital privacy rights.

The law, signed by Governor Jerry Brown, is called the California Electronic Communications Privacy Act (CalECPA). (This is not to be confused with the similarly named federal law of 1986.) The CalECPA bars any California state law enforcement agency or other investigative body from forcing a business or individual to unwillingly submit any metadata or digital communications – including text messages and chat, email, cloud-stored documents, or any manner of discovering devices on a network – without first obtaining a warrant.

The legislation likewise requires a warrant in order to track the location of electronic devices like cell phones, or to search them. The law, which easily passed California's legislature, is said to be the most wide-reaching and comprehensive digital privacy law yet in the United States. There are more types of cyber attacks today than there were five years ago; DDoS attacks, SQL injections, and spear phishing schemes have increased rapidly in recent years, this legislation is hoped to pave the way for similar bills across the U.S.

To clarify, it is not as if no other states have made any progress towards enacting digital privacy through legislation. For example, nine other states in the United States have protection from warrants for GPS location tracking, while five other states have warrant protection for content. However, according to Wired, California is the first state to enact a fully comprehensive law protecting content, location data, metadata, and device searches. The legislation is veritably modern.

The legislation was first written by state senators Mark Leno and Joel Anderson, both Democrats. Their intention in introducing it was quite simple: they wanted to provide digital data with the same sorts of protection that traditional, non-digital communication has. Earlier this year, Leno pointed out a double standard in the law, “For what logical reason should a handwritten letter stored in a desk drawer enjoy more protection from warrantless government surveillance than an email sent to a colleague or a text message to a loved one?” Leno also alluded to a difference in what the Constitution promises versus what the law had protected against.

Despite being introduced by two Democrats, the law enjoyed bipartisan support. Furthermore, many organizations championed it, including the American Civil Liberties Union (ACLU) and the Electronic Frontier Foundation. It was also popular amongst tech companies like Google, Facebook, Apple, Twitter, Dropbox, and LinkedIn, all of whom have their headquarters within California.

Just to clarify the scope of the law, it only applies to law enforcement entities within California. Thus, law enforcement agencies within other states would be governed by the laws within their own jurisdiction. This unfortunate fact has prompted activists to advocate the importance of getting similar comprehensive laws passed in other states.

Beyond its effect upon individuals and organizations, this law shows how individual states can be more innovative and forward-thinking than the federal government. While California is more progressive than most states, the state is proving that other states can perhaps govern themselves better than if Washington stepped in.

Speaking of Washington, activists have been pressing for revisions to the Electronic Communications Privacy Act of 1986 by Congress to offer protections nationwide. Currently, an amendment has 300 co-sponsors. The current ECPA only offers protection to content that is 180 days or newer, while a revision would likely get rid of any time limit for warrant protection.

Beyond being progressive, California has long led in the area, largely because of the fact that its state constitution has long outpaced the federal constitution's Fourth Amendment. It will be interesting to see the domino effect resulting from this new legislation.

Did you like this article?

Get more delivered to your inbox just like it!

Sorry about that. Try these articles instead!

Alex Espenson is a recently retired business owner turned consultant, with a passion for entrepreneurism and marketing. When he isn't writing or consulting, you can usually find him out on the river with his fly rod, or hiking in the hills near his home in Boulder Colorado.