Right, and it seems to me that, in the course of your investigation here and in your questions, you ought to be reaching out.... It would be better—and I appreciate Mr. Green's motion—and you're better placed, actually, to reach out to these other organizations and ask those very same questions and then revert back to us. We could oversee your work because we have powers that you don't, but you have the time and inclination to do the detailed work of asking the questions.
In the course of asking those questions, it would be good to know how many times it's been used absent judicial or other authorization pursuant to existing due processes for investigations and—this is getting to my previous inquiry—two, whether there are instances where they're searching government devices pursuant to an internal investigation like harassment. That's another category where I think it makes a lot of sense to me that it would be used.
Now you get to the subsequent concerns around scope of search, and you will want to inquire as to scope of search. If there are concerns about scope of search, I would again ask you to revert back to us. It would be good to know if this is being used in other instances, any concerning instances, that don't involve investigations that on the face of it seem reasonable.
My last question.... You'll get back to us on a number of uses. On scope of search, as you look to privacy impact assessments and working with these agencies on privacy impact assessments, it would probably be good.... Let's take the concern that Mr. Barrett raised about the difference between a government device and the cloud—fair point. Now, your point back—rightly—is that one has a reasonable expectation in one's privacy, and one has different expectations of privacy in different material. One protects that reasonable expectation of privacy with the bounds of necessity and proportionality.
I would be very interested to know if departments, in the course of their investigations, have gone beyond the bounds of necessity and proportionality. Are they searching the cloud unnecessarily in the course of harassment investigations? Are they searching in health info? I mean, it's a theoretical concern of this committee. Did it actually happen?
If, based upon your investigation, you could come back to this committee with real concerns identified, it would be appreciated.