« June 2020 | Main | August 2020 »

July 2020 Archives

July 2, 2020

EPIC, Coalition to Congress: Stop the Use of and Investment in Facial Recognition

Today, EPIC and a coalition privacy, civil liberties, and civil rights groups urged Congress to "take action to prevent the harms associated with face recognition and other invasive and discriminatory surveillance technologies." The Coalition called upon Congress to pass the Facial Recognition and Biometric Technology Moratorium Act of 2020, cease funding police use of invasive and discriminatory technologies, and ensure policing reform bills prevent the use of facial recognition on body cameras and dash cams. Last year, EPIC launched a campaign to Ban Face Surveillance and through the Public Voice coalition gathered the support of over 100 organizations and many leading experts across 30 plus countries. EPIC previously testified before the Massachusetts Legislature in support of a bill to establish a moratorium on the use of facial recognition by state agencies.

Supreme Court to Hear Congressional Mueller Report Case

The U.S. Supreme Court will hear a case this fall over a Congressional subpoena for the complete Mueller Report, the Court announced today. The Court will review a decision by the D.C. Circuit Court of Appeals, which ruled in March that the House Judiciary Committee was entitled to redacted grand jury material from the Report. EPIC is currently litigating a Freedom of Information Act lawsuit for disclosure of the complete Mueller Report. EPIC’s suit led to the disclosure of new material from the Report last month. Judge Reggie B. Walton is also conducting an “in camera” review of the complete Mueller Report following the court’s March 5 ruling in EPIC’s case. The court is expected to decide as early as next month whether more material must be released. EPIC's case—the first in the nation for the disclosure of the Mueller Report—is EPIC v. DOJ, No. 19-810.

Senate Judiciary Committee Approves EARN IT Act

The Senate Judiciary today unanimously approved the Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act of 2020 (S. 3398) by a vote of 22-0. In a statement to the Committee on a previous version of the EARN IT Act, EPIC supported both end-to-end encryption and reform to Section 230 of the Communications Decency Act. EPIC pointed out that actual end-to-end encryption "protects users, promotes commerce, and ensures cybersecurity." The Committee today adopted an amendment from Senator Patrick Leahy that clarified that companies that provide end-to-end encryption are not subject to liability because they cannot access user communications. In an amicus brief in Herrick v. Grindr, EPIC objected to a court decision that found "online platforms bear no responsibility for the harassment and abuse their systems enable."

July 6, 2020

EPIC Obtains Additional Records from AI Commission

EPIC, as part of the open government case EPIC v. AI Commission, has obtained more documents from the National Security Commission on Artificial Intelligence. Among the records is a report concerning best practices for advisory commissions that was delivered to the AI Commission in early 2019. Notably, the report contains no recommendations about transparency or public participation in the Commission’s work. A federal court recently ruled in EPIC’s case that the AI Commission is subject to the Federal Advisory Committee Act. Judge Trevor N. McFadden ordered the Commission to hold open meetings and regularly publish its records in the future. Judge McFadden previously ruled that the AI Commission is subject to the Freedom of Information Act, and the Commission began disclosing its prior records in January. The case is EPIC v. AI Commission, No. 19-2906 (D.D.C.).

Supreme Court Strikes Down Government Debt Exception, Preserves Rest of Anti-Robocall Law

The U.S. Supreme Court declared that the government debt exception to the Telephone Consumer Protect Act violates the First Amendment and severed the exception, preserving the law’s important privacy protections. The case, Barr v. American Association of Political Consultants, concerned a First Amendment challenge to the law that protects consumers from robocalls and the proper remedy when an exception to a statute violates the First Amendment. EPIC defended the TCPA in an amicus brief. EPIC said that the robocall ban is "constitutionally permissible and serves important governmental interests." EPIC explained that cell phone adoption has made "the harm caused by unwanted automated calls" greater than when the robocall ban was enacted in 1991. EPIC said that "without the autodialer ban, the assault of unwanted calls could make cell phones unusable." EPIC also argued that "a minor amendment to an otherwise constitutional law, passed decades after the original enactment, should not take down an act of Congress." EPIC frequently files amicus briefs on the TCPA, including in the related case, Gallion v. Charter Communications.

Court Demands Answers From Justice Department in EPIC Mueller Report Case

A federal court, as part of an open government lawsuit brought by EPIC, has ordered the Department of Justice to answer a series of questions concerning the DOJ’s redactions to the Mueller Report. Judge Reggie B. Walton recently announced that he could not “assess the merits of certain redactions without further representations from the Department” and ordered the DOJ to attend an “ex parte” (one-on-one) hearing on July 20. Under today’s order, the DOJ is also required to file written answers by July 14. Both Judge Walton’s questions and the DOJ’s responses will be sealed from the public, the court stated. EPIC's case—the first in the nation for the disclosure of the Mueller Report—is EPIC v. DOJ, No. 19-810.

Following Order in EPIC Case, AI Commission Announces First Public Meeting

The National Security Commission on Artificial Intelligence will hold its first public plenary meeting on July 20, the Commission said today. The announcement comes after a ruling in EPIC v. AI Commission that the Commission is subject to the transparency requirements of the Federal Advisory Committee Act. Judge Trevor N. McFadden ordered the Commission to hold open meetings and regularly publish its records in the future. Judge McFadden previously ruled that the AI Commission is subject to the Freedom of Information Act, and the Commission began disclosing its past records in January. Registration for the Commission’s July 20 meeting will open July 8. The case is EPIC v. AI Commission, No. 19-2906 (D.D.C.).

July 7, 2020

Federal Court Rejects Challenge to Maine Broadband Privacy Law

A federal court has rejected a challenge from internet services providers to Maine’s broadband privacy law. Enacted last year, the law prohibits broadband providers from using, disclosing, or selling consumers’ personal data without express consent. The ISPs had argued that the Maine law conflicted with Congress’s 2017 overturning of broadband privacy rules issued by the Federal Communications Commission and the FCC’s 2018 disclaimer of regulatory authority over broadband providers. But the ISPs’ “attempt to manufacture a conflict in this case is unavailing,” Judge Lance E. Walker wrote. The court also refused to hold that the Maine law violates the First Amendment or is unconstitutionally vague. EPIC has long advocated for comprehensive privacy legislation that would protect states’ ability to enact stronger privacy laws.

July 9, 2020

Supreme Court Rejects Trump's Bid to Shield Tax Returns

The U.S. Supreme Court ruled Thursday that a New York grand jury can obtain President Trump’s tax returns from the President’s accounting firm. In its decision from Trump v. Vance, the Court rejected the President's attempt to block the grand jury's subpoena. "Two hundred years ago, a great jurist of our Court established that no citizen, not even the President, is categorically above the common duty to produce evidence when called upon in a criminal proceeding," the Court wrote. "We reaffirm that principle today and hold that the President is neither absolutely immune from state criminal subpoenas seeking his private papers nor entitled to a heightened standard of need." EPIC filed an amicus brief in the case supporting disclosure. EPIC explained that President Trump broke with 40 years of precedent by concealing his tax records, even as he sought to collect sensitive voter and citizenship data from the public. "This is inverted liberty: privacy for the President and compelled disclosure of personal data for the public," EPIC argued. "That is antithetical to the structure and practice of modern democracies which safeguard the privacy of citizens and impose transparency obligations on political leaders, most notably the President." EPIC previously sought public release of President Trump's tax returns in EPIC v. IRS, arguing that disclosure was necessary to correct numerous factual misstatements made by the President. In EPIC v. IRS II, EPIC is seeking "offers-in-compromise" and related tax records of President Trump and his businesses.

Coalition Amicus Brief: Civil Litigants Must Be Able to Challenge FISA Surveillance

EPIC has joined a group of organizations across the political spectrum—EFF, Americans for Prosperity, the Brennan Center, FreedomWorks, and TechFreedom—to urge a federal appeals court to revive a challenge to an NSA surveillance program. A lower court judge in the case, Wikimedia v. NSA, found that Wikimedia could not demonstrate that its communications had actually been intercepted under the Upstream surveillance program—and that further litigation was barred for national security reasons. The amicus brief argues that “it is critical that those directly affected by mass foreign intelligence surveillance be able to obtain judicial review” because “FISA is broken.” EPIC has participated as amicus in several previous cases challenging FISA surveillance, including Smith v. Obama and Clapper v. Amnesty International. EPIC also brought the first challenge to the NSA telephone records surveillance program, In re EPIC, in the U.S. Supreme Court.

Supreme Court to Decide Scope of Robocall Ban

Just days after upholding the federal robocall ban against a First Amendment challenge, the U.S. Supreme Court has agreed to decide the scope of the ban in a new case, Duguid v. Facebook. Following the D.C. Circuit’s invalidation of the FCC’s definition of an “autodialer”—the technology companies use to automatically dial vast numbers of consumers— federal appeals courts have split on how to interpret the term. Telemarketers argue that an autodialer must generate random or sequential numbers, while consumers and consumer groups like EPIC maintain that the law bans systems that automatically call numbers from lists. In Gadelhak v. AT&T, EPIC argued that adopting the telemarketers’ autodialer definition “would undermine the law's effectiveness by inviting easy circumvention and rendering the restriction obsolete.” EPIC routinely files amicus briefs in cases on the Telephone Consumer Protection Act.

July 8, 2020

EPIC Hosts Panel on Algorithmic Risk Assessments

On Wednesday, EPIC hosted Liberty At Risk, an event focused on pre-trial algorithmic risk assessment tools. EPIC was joined by Sean Hill, Visiting Assistant Professor at Ohio State University Moritz College of Law, Vincent Southerland, Executive Director at the NYU Law Center for Race, Inequality and the Law, and Megan Stevenson, Associate Professor at University of Virginia School of Law. The panelists discussed how the use of these tools further encode systemic biases, and offered guidance for advocates navigating bail reform and the use of these tools. A video of the panel is available here. EPIC maintains a resource tracking the use of Criminal Justice algorithms.

July 13, 2020

D.C. Circuit Reverses District Court Ruling on Unsealing Electronic Surveillance Records

Last week, the D.C. Circuit reversed a lower court decision and ruled that electronic surveillance records in closed federal investigations are subject to public access. Investigative journalist Jason Leopold and the Reporters Committee for Freedom of the Press litigated for years to unseal electronic surveillance records that allow law enforcement to collect different types of electronic information for surveillance, including metadata about a telephone subscriber's activity or cell site location information. The lower court incorrectly determined that administrative burden to providing public access to these seal records was enough to justify the interminable sealing of these records. But the D.C. Circuit reversed the lower court's decision stating "although administrative burden is relevant to how and when documents are released, it does not justify precluding release forever...Production may be time-consuming, but time-consuming is not the same thing as impossible." The D.C. Circuit noted that providing public access to judicial records like the electronic surveillance records at issue "is a fundamental element of the rule of law" and "is the duty and responsibility of the Judicial Branch." EPIC is currently litigating a case against the Department of Justice seeking the public release of information about the agency's collection of cell site location information through "§ 2703(d) orders" and warrants. The case is EPIC v. DOJ, No. 18-1814 (D.D.C.)

July 16, 2020

BREAKING: Top Court in Europe Invalidates EU-U.S. Privacy Shield, Citing Lack of Privacy Safeguards and Overbroad U.S. Surveillance Laws

Today the European Court of Justice issued a decision in Irish Data Protection Commissioner v. Facebook & Schrems, a case concerning transfers of personal data by Facebook between the EU and the United States. Specifically, the court considered the validity of transfers made from companies in the EU to companies in the U.S. pursuant to standard contracts or to the EU-U.S. Privacy Shield agreement, both of which had been authorized by the European Commission. But the court held that the Privacy Shield was invalid and that transfers could not be made under the contracts where personal data is not adequately protected. Because U.S. surveillance law authorizes the mass processing of personal data transferred from abroad, under Section 702 of FISA, it "cannot ensure a level of protection essentially equivalent to that guaranteed by the Charter." EPIC participated as an amicus curiae in the case and argued that U.S. surveillance law does not provide an equivalent level of protection because it does not provide adequate protections or remedies for non-U.S. persons abroad. EPIC was represented in this case by the Free Legal Advice Centres (FLAC) and by barristers Grainne Gilmore and Colm O’Dwyer, SC. [PRESS RELEASE]

Federal Appeals Court Sounds Alarm Over Predictive Policing

Judges on a federal appeals court took aim yesterday at predictive policing, the practice of using algorithmic analysis to predict crime and direct law enforcement resources. The Fourth Circuit ruled that Richmond police violated the Fourth Amendment when they stopped and searched the defendant, Billy Curry, simply because he was walking near the scene of a shooting. In a dissent, Judge J. Harvie Wilkinson called the court’s decision a “gut-punch to predictive policing.” But others on the court responded to highlight the dangers and failings of the practice. Chief Judge Roger Gregory questioned whether predictive policing is "a high-tech version of racial profiling.” Judge James A. Wynn highlighted the “devastating effects of over-policing on minority communities” and explained that predictive policing “results in the citizens of those communities being accorded fewer constitutional protections than citizens of other communities.” Judge Stephanie D. Thacker warned that “any computer program or algorithm is only as good as the data that goes into it” and that predictive policing “has been shown to be, at best, of questionable, effectiveness, and at worst, deeply flawed and infused with racial bias.” EPIC has long highlighted the risks of algorithms in the criminal justice system and recently obtained a 2014 Justice Department report detailing the dangers of predictive policing.

July 20, 2020

AI Commission Holds First Public Meeting

The National Security Commission on Artificial Intelligence held its first public meeting on Monday. A recording is available here, and materials for the meeting can be found here. Public access to the meeting is the result of a recent court ruling in EPIC v. AI Commission that the Commission is subject to the transparency requirements of the Federal Advisory Committee Act. Judge Trevor N. McFadden ordered the Commission to hold open meetings and regularly publish its records in the future. Judge McFadden previously ruled that the AI Commission is subject to the Freedom of Information Act, and the Commission has disclosed thousands of pages of records to EPIC since January. The case is EPIC v. AI Commission, No. 19-2906 (D.D.C.).

July 21, 2020

EPIC Files Application to the International Criminal Court on Location Data Privacy

EPIC has filed a request to submit an amicus brief in the International Criminal Court concerning the recognition of an international right to privacy in cell site location information (“CSLI”). Investigators in the case, The Prosecutor v. Yekatom & Ngaïssona, obtained two years of defendant Yekatom’s cell location data from a telecommunications company in the Central African Republic without prior judicial authorization. EPIC wrote that “there is increased recognition in the international community that cell phone metadata, and CSLI in particular, can reveal sensitive personal information by allowing investigators to track an individual’s movements over time and infer their habits, social associations, and even political and religious beliefs.” Should the ICC grant EPIC’s application, EPIC will file a full amicus briefs arguing that the international right to privacy includes privacy in cell location data. EPIC filed an amicus brief in Carpenter v. United States, in which the U.S. Supreme Court determined that law enforcement could not obtain historical cell location data without a warrant. EPIC has also participated as amicus curiae in cases involving the right to privacy under international law, including most recently Irish Data Protection Commissioner v. Facebook & Schrems, in which the top European court invalidated the EU-US Privacy Shield.

EPIC Amicus: To Protect Privacy, California Must Preserve All-Party Consent for Call Recording

EPIC, the Consumer Federation of California, and Consumer Action have filed an amicus brief urging the California Supreme Court to preserve its long-standing rule requiring all parties to consent to the recording of a call. Consumers in the case, Smith v. LoanMe, sued the online lender for surreptitiously recording customer calls in violation of the California Invasion of Privacy Act. A lower court dismissed the case because it interpreted the law as only applying to third-party eavesdroppers, not parties to the call. The California Supreme Court is reviewing the decision. The amicus brief argues that “recording a call poses unique threats to privacy because a permanent record of the private communication can be made surreptitiously without the consent, or even knowledge, of the caller.” The brief also explains that “the need to preserve California’s all-party consent law is more urgent now than ever before” because COVID-19 has forced millions of Californians “to conduct their personal and business lives remotely, relying on voice and video calls to complete their work, to pursue their education, to preserve their relationships, and to maintain basic human connections.” EPIC routinely files amicus briefs in cases implicating consumer privacy.

EPIC Obtains Records on White House COVID-19 Response, Location Data Tracking

EPIC has obtained hundreds of pages of records (1, 2, 3, 4) from the Office of Science and Technology Policy about the White House’s response to the COVID-19 pandemic and proposals to use location data for public health surveillance. The documents were produced in response to an EPIC Freedom of Information Act request. The records show that a tech sector task force closely aligned with the White House sought to aggregate “non-clinical location data” for “disease surveillance,” including cell phone location data, Uber trip data, and Google search data. OSTP described the location tracking proposals as “certainly interesting” and sought to “establish a portal/clearinghouse” for such submissions, but also told the tech sector task force that it was “not engaged in any activities relating to location data.” In one example from March, the executive director of the National Fusion Center Association proposed an “automate[d] contact tracing and notification” system to the White House. Fusion Centers are centralized systems that pool and analyze intelligence from federal, state, local, and private sector entities. EPIC has laid out numerous recommendations concerning privacy and the pandemic and has called on Congress to establish privacy safeguards for digital contact tracing.

July 22, 2020

EPIC Releases Report on Pretrial Risk Assessments

EPIC has released a report on Pretrial Risk Assessments. The report, Liberty at Risk: Pre-trial Risk Assessment Tools in the U.S., provides an overview of Risk Assessment Tools that practitioners and scholars can use to understand the nature of these systems, understand the broader context in which they are used, and help focus their evaluations of the fairness of these systems. EPIC hosted a panel on the topic on July 8, available to watch here. EPIC advocates for Algorithmic Transparency and maintains a resource on Algorithms in the Criminal Justice System.

July 23, 2020

White House Tells EPIC to Delete COVID-19 Records, EPIC Declines

In an unusual development, the White House directed EPIC this week to delete a set of records that EPIC recently obtained from the Office of Science & Technology Policy—a request which EPIC declined. On Tuesday, EPIC published hundreds of records about the White House’s response to the COVID-19 pandemic and proposals to use location data for public health surveillance (1, 2, 3, 4). Hours later, a White House attorney sent EPIC a letter “order[ing]” EPIC “to immediately cease using and disclosing" one set of records and to “destroy all electronics copies.” The letter stated that OSTP had "inadvertently and erroneously" provided EPIC with an unredacted copy of the records. Although EPIC voluntarily decided to redact personal contact information contained in the documents, EPIC informed the OSTP that it would still make the records available to the public. Under the Freedom of Information Act, a federal agency is not entitled to “claw back” a record that it discloses to a requester. EPIC has filed numerous FOIA requests concerning the federal government’s COVID-19 response and has compiled a resource page about privacy and the pandemic.

DOJ Says It Will Release More of Mueller Report in EPIC Case

The Department of Justice, as part of the open government case EPIC v. DOJ, has announced in a court filing that it will disclose additional material from the Mueller Report. The DOJ said it had "determined that certain information in the Report now could be released without harming government interests or pending matters." However, the DOJ asserted that it would not publish the additional material until "after the Court has issued its ruling on the redactions" to the Report. Judge Reggie B. Walton is currently conducting an "in camera" review of the complete Mueller Report to determine which passages must still be released. The court recently posed a series of questions to the DOJ about its redactions to the Report, and the DOJ responded to the court this week. Both filings are sealed from the public, but a heavily redacted version of the DOJ’s response shows that Judge Walton questioned every legal basis asserted by the DOJ to withhold material in the Report. EPIC’s case previously forced the DOJ to disclose additional material from the Mueller Report concerning Roger Stone. The case is EPIC v. DOJ , No. 19-810.

July 27, 2020

EPIC to Congress: Reform Section 230

In a statement to the Senate Commerce Committee, EPIC supported reforms to Section 230 of the Communications Decency Act. The Committee is considering the bipartisan Platform Accountability and Consumer Trasparency (PACT) Act, which requires online platforms to give notice of their content moderation policies and to make a complaint system available, and sets deadlines by which platforms must process complaints. EPIC urged the Committee to expand the Act's provisions on injunctive relief, which currently only requires platforms to take down content if ordered by a court to do so in limited types of cases. "When a court finds that content has been posted illegally or in violation of an individual’s rights, there should be a legal mechanism to order online platforms to remove that content," EPIC said. "The bill should be amended to make clear that platforms must comply with court orders to remove content deemed unlawful regardless of the type of legal claim involved." In an amicus brief in Herrick v. Grindr, EPIC objected to a court decision that found "online platforms bear no responsibility for the harassment and abuse their systems enable."

July 28, 2020

EPIC to Congress: Create a U.S. Data Protection Agency

In advance of a hearing on "Online Platforms and Market Power, Part 6: Examining the Dominance of Amazon, Apple, Facebook, and Google," where the CEOs of Amazon, Apple, Facebook, and Google will testify, EPIC told the House Judiciary Subcommittee on Antitrust that the U.S. needs a Data Protection Agency. EPIC told lawmakers that merger review must consider data protection. "The United States stands virtually alone in its unwillingness to address privacy as an increasingly important dimension of competition in the digital marketplace," EPIC said. EPIC pointed to the Facebook-WhatsApp deal and the failure of the FTC to protect the personal data of WhatsApp users after the merger. EPIC noted that if the FTC approves Google's acquisition of Fitbit, it will be the 230th firm that Google/Alphabet has acquired "with little action from U.S. antitrust regulators." EPIC also urged the Subcommittee to hold a hearing on H.R. 4978, the Online Privacy Act. EPIC's recent report, Grading on a Curve: Privacy Legislation in the 116th Congress, sets out the key elements of a modern privacy law, including federal baseline legislation and the creation of a Data Protection Agency.

Transatlantic Consumer Groups: No New Data Transfer Agreement Until Privacy Protections Improved

The Transatlantic Consumer Dialogue (TACD), a coalition of US and European consumer groups, urged EU Commissioner for Justice Didier Reynders and U.S. Secretary of Commerce Wilbur Ross to stop negotiations for a new data transfer agreement following the invalidation of the EU-U.S. Privacy Shield. In Data Protection Commissioner v. Facebook & Max Schrems, the European Court of Justice (CJEU) found the Privacy Shield, which permitted companies to freely transfer users' personal data, illegally infringed EU residents' data protection and privacy rights. In its letter, TACD claims the CJEU's decision is "crystal clear," and that any future data transfer deal will not be valid until the U.S. enacts comprehensive federal privacy legislation. EPIC participated as an amicus curiae in the Schrems case, arguing that U.S. surveillance law does not provide adequate privacy protections or remedies for non-U.S. persons abroad.

July 30, 2020

NIST Study Finds Masks Undermine Face Recognition Accuracy

A study conducted by the National Institute of Standards and Technology showed that face masks undermine the accuracy of facial recognition algorithms. The NIST study tested digitally applied masks of various shapes on 89 commercial algorithms. The result were error rates between 5% and 50%. The algorithms tested were all created pre-Covid-19. NIST plans to test facial algorithms developed with face masks in mind later this summer. A previous NIST study released at the end of last year found that false positives are up to 100 times more likely for Asian and African American faces when compared to White faces. EPIC has previously launched a Ban Face Surveillance campaign and called for a facial recognition moratorium across the globe, as well as suspension across the federal government and in U.S. schools.

July 31, 2020

Lawmakers Request FTC Privacy Investigation Into Adtech Industry

A bipartisan group of lawmakers led by Senators Ron Wyden [D-Ore.] and BIll Cassidy [R-La.] today called on the Federal Trade Commission to investigate the online ad economy. Wyden, Cassidy and other members asked the FTC to investigate how personal data, including the tracking of individuals at places of worship and protests, collected from Americans’ phones to deliver advertisements is being obtained by data brokers and sold without the knowledge or consent of users. The lawmakers urged the FTC to open a 6(b) investigation into the matter. Earlier this year, consumer groups called on the FTC to use its 6(b) authority to conduct a study on companies collecting data on children. No action has been taken on that request. In addition to Sens. Wyden and Cassidy, the letter is signed by Sens. Maria Cantwell, D-Wash., Sherrod Brown, D-Ohio, Elizabeth Warren, D-Mass., and Edward Markey, D-Mass. Reps. Anna Eshoo, D-Calif, Zoe Lofgren, D-Calif., Yvette D. Clarke, D-N.Y., and Ro Khanna, D-Calif., signed as well. EPIC has filed many detailed complaints with the FTC regarding consumer privacy and has called for the creation of a U.S. Data Protection Agency due to the FTC's lack of action on privacy issues.

About July 2020

This page contains all entries posted to epic.org in July 2020. They are listed from oldest to newest.

June 2020 is the previous archive.

August 2020 is the next archive.

Many more can be found on the main index page or by looking through the archives.