Ma Bell's data, and yours

AT&T HAS NEVER COMMENTED PUBLICLY about a lawsuit filed in January accusing it of funneling data to the National Security Agency about its customers' Internet habits. It has, however, issued a new privacy policy to customers of its Internet services. Effective Friday, the company claims broader rights to collect and disclose information about users, not just to the government but to other third parties. AT&T's customers -- and with almost 50 million phone lines in service, the company has millions of them -- can't say they haven't been warned.

Company executives say the policy doesn't change anything, really, and that it assiduously protects customers' privacy. The driving force behind the change, they say, was SBC's acquisition of the old AT&T, which created the new AT&T. The company wanted a single, easier-to-understand policy to replace the separate ones used by SBC and AT&T.

Here's an example of new language that's admirably clear: "While your account information may be personal to you, these records constitute business records that are owned by AT&T." The new policy goes on to point out that the records may be disclosed to protect AT&T's business interests, to "safeguard others," to respond to court orders "or other legal process" or to prevent situations "involving potential threats to the physical safety of any person." Could that describe letting counter-terrorism agents monitor e-mail messages for suspicious keywords? Why, yes it could!

Oh, by the way, the policy tells customers right up front: "Before using your service(s), you must agree to this policy."

But AT&T can't change its customers' privacy rights just by declaring ownership over their Internet records. Federal law requires information about the timing or content of a person's e-mail transmissions and other online activity to be kept confidential. Unless users give their consent, those records cannot be disclosed without a court order.

By all means, AT&T should cooperate fully with law enforcement agencies and the NSA. But it should do so only when their requests follow the law. Otherwise, the safeguards that Congress and the courts have established against overzealous prosecution evaporate.