American Civil Liberties Union

Senator Charles Grassley got it right: officials at the Food and Drug Administration “have absolutely no business reading the private e-mails of their employees.”

On Sunday, the New York Times ran a lengthy story detailing how the FDA monitored the communications of its own scientists, including communications with members of Congress, lawyers and journalists. Those scientists had blown the whistle on what they believed were flawed internal procedures that led to the approval of unsafe medical imaging devices. The FDA engaged in a massive email monitoring campaign to read their communications—including their private, personal emails. The emails that the FDA collected included those of a former member of Senator Grassley’s staff, presumably because he had exchanged messages with one or more of the targeted FDA officials.

This tax season, when you visit the IRS’s website seeking tax information, can you be certain that no one else is monitoring which pages you browse?

Unfortunately, right now the answer to that question is “no.” Unlike Facebook, Twitter, Google Mail (Gmail), and virtually every bank and credit card company, the IRS, like most government agencies, does not use HTTPS for encryption and authentication on its website. If you try typing “mail.google.com” into your browser right now, you will see that the URL you end up at is actually “https://mail.google.com.” That “s” after the “http” may seem insignificant, but it means a lot. It signifies that Google is using Secure Sockets Layer encryption, or SSL, to both encrypt and authenticate its communications. When you visit google.com and you see “https” at the beginning of the address, it lets you know that your connection is secure, and that third parties – such as your internet service provider, employer, or university cannot monitor what you’re doing through the use of network interception technology.

I wrote recently about the U.S. government and companies lobbying against the EU’s attempt to strengthen their privacy laws, and our own efforts at the ACLU to advance high transnational privacy standards. Our efforts helped attract a round of press coverage of this unfolding drama (including stories in the New York Times and Washington Post). We’ve also written a letter along with other privacy groups to senior Obama Administration officials, asking for a meeting to discuss the issue.

Can using privacy-enhancing tools (such as Tor or a Virtual Private Network) actually expose you to warrantless surveillance by the National Security Agency? This week, the ACLU sent off four FOIA requests to federal agencies in order to try and answer this question.

To understand why we think that may be the case, we have to go back to the passage of the FISA Amendments Act (FAA) in 2008. That act was not a high-point for civil liberties or the rule of law. It included a provision giving immunity to the telecom companies that violated the law by assisting the NSA with its warrantless wiretapping program. Although the get-out-of-jail-free card given to the phone companies is the most well-known aspect to the FAA, there is much more to the law, and many other things that give privacy advocates reason to worry.