Right, but remember that NSL's are about metadata. Extending the 4th amendment to your Dropbox is an easier case than extending it to Google's metadata about what sites you visit and who you e-mail.

And as a practical matter, the legal status of online information needs to catch up not just in the police context. If Public Storage loses the contents of my locker due to their negligence, I can sue. Can I sue Google if they accidentally lose the contents of my gdrive? Can I insure the contents of my gdrive?

"Metadata" in this context is such a silly concept. It's another example of the hilarity that ensues when lawmakers attempt to use analogies to shoehorn digital concepts into the traditions of physical reality.

What's silly about it? The distinction is one that transcends "digital versus physical": information a third party collects about you versus information you yourself communicate. The relevant differences don't stop being relevant simply because everything is stored as bits instead of say paper records. If the government can ask a shopkeeper at a brick and mortar store what you bought there, it makes sense that it can ask a digital retailer what you bought there. That's not because we analogize from brick and mortar stores to digital retailers, but because in both cases we're dealing with information third parties have collected about you, based on your voluntary dealings with them.

Lawmakers use analogies because they're conceptually very powerful. Say you have two things: 1 and 2. 1 has characteristics X, Y, and Z, and 2 has characteristics X, U, and V. A rule applies to 1 because of characteristic X. Analogizing from 1 to 2 on the basis of the shared characteristic X is an intuitive (and logically valid!) way to argue that the rule should also apply to 2. Not because 1 and 2 are identical or even very similar, but because the animating force behind the rule is the shared characteristic X that is present in both 1 and 2.

It's silly because the specific examples you gave, which websites you visit and who you e-mail, are both deeply personal and speak to the innermost thoughts of a person. Attempting to trivialize the impact of their disclosure by calling them "metadata"[0] is detrimental to everyone but the police.

Physical-to-digital analogies are very dangerous in a lawmaking setting because lawmakers rarely understand the implications of applying a physical power they wield in the digital realm. Examples include the lobbyist-proposed law allowing IP owners to infiltrate others' computers and delete ostensibly stolen files, while simultaneously destroying the entire concept of digital security, and the DMCA making it illegal to recycle printer cartridges or switch cellular carriers.

[0] Yes, I know that is the technical term for data about data, but there are plenty of examples where technical terms and legal terms differ in definition, intent, and hidden implications.

> It's silly because the specific examples you gave, which websites you visit and who you e-mail, are both deeply personal and speak to the innermost thoughts of a person.

Except they're not personal at all, being visible to god knows how many intermediaries and being recorded in plain text for any sysadmin to see. Maybe we'd like to treat them as such, and legislate accordingly, but that's not their inherent nature.

I think the problem here isn't lawmakers not understanding the implications of digital technology, but technologists adhering to a romantic view of technology rather than a literal one. Forget the law, forget the philosophy, just look at the mechanics of the process. Reading a web page is not a private act. It involves plain text communications over public networks through intermediaries to a host that is free to and does record identifying information. Privacy is not a core tenant of the internet protocols, whether you're talking about TCP/IP, HTTP, or SMTP.

This is not an example of an impedance mismatch between a technical term and the same legal term. We don't treat mailing addresses the same and e-mail addresses the same because they both have "mail" in the name. We do it because both have the characteristic of being routing information visible to third parties outside the communication. The idea is that routing information can't be all that "deeply personal" if you voluntarily expose it to a bunch of people. It's irrelevant whether its digital versus physical, or whether you call it "metadata" or something else, or whether the "bunch of people" is the postal service or your e-mail hosting service.