AMERICA comes top of the charts in all-time Olympic medals, places named for George Washington, incarceration, obesity and, we learned yesterday, another metric of which it has no cause to be proud: number of times law-enforcement agencies asked Google to relinquish data on private citizens. Google updated its transparency report this week with figures from the last half of 2012. Those figures show that American law-enforcement agencies made 8,438 requests for user data, which is more than the number of requests made by the next four nosiest countries (India, France, Germany and Britain) combined. In fact, since Google began releasing statistics on user-information requests four years ago, America has come top of the charts in every six-month period save one: from July through December 2009 Brazil edged it out by 73 requests. Since then America's requests have more than doubled, and the total number of requests has risen from 12,539 to 21,389.

That is not surprising. For one thing, America's population is far larger than that of France, Germany and Britain, and it has more internet users than India. And the amount of data available online has grown. But perhaps more importantly, nobody leaves a rich vein untapped. Google does not just receive a lot of requests from American courts, lawyers and police; it also grants most of them. The total percentage of requests granted may have declined slightly—from 94% in July to December 2010 to 88% two years later—but total numbers have risen. Perhaps most worryingly, 68% of requests, more than two in every three, came in the form of a subpoena, while only 22% came through search warrants. Judges have to grant warrants based on probable cause, but subpoenas, as Google's legal director explains, "are the easiest to get because they typically don't involve judges." We have written about this before: the laws governing online surveillance in America can fairly be called archaic. They not only allow but practically encourage law-enforcement agencies to go data-fishing. Can such actions ensnare those who have neither committed nor been suspected of committing any crimes? Ask David Petraeus.

That's the bad news. The good news is, first, that Google actually releases this data. Most online companies and service providers don't (Twitter is another laudable exception), and they should. In 2011 mobile-phone and internet-service providers received 1.3m requests for data from law enforcement—and that just includes the nine providers who responded to a request from Ed Markey, a Democratic congressman from Massachusetts who co-chairs the Bipartisan Congressional Privacy Caucus. Sprint gets 1,500 requests a day, which means it tops Google's six-month totals every week. And 1.3m requests does not mean 1.3m people: cell-tower dumps reveal all subscribers in the location of a certain mobile-phone tower at a certain time. If government feels that restaurant patrons have the right to know whether chefs are washing their hands before cooking, surely mobile-phone and internet-service patrons have the right to know on what basis their providers will surrender putatively private data to the government.

The other bit of good news is that Google actually seems to be standing up for its users. Chris Gaither, a Google spokesman, toldArs Technica that it requires a warrant to surrender Gmail content. Registration information is held to a lesser standard. This is more or less consistent with current telecommunication-surveillance law, which requires stricter burdens of proof to listen in on telephone conversations than it does for information on what numbers a phone communicates with (a pen/trap tap). Whether it is consistent with the law as it should be is another question. User-data information allows the government not only to see who you call and who calls you, but also—thanks to tower dumps—where you are at any given time, who your friends are, who their friends are, what websites you visit, where you shop online and so forth. One could well argue that the relevant parts of our online and mobile lives are not what we deliberately reveal in our communication, but what is revealed about us as a matter of digital course. Congress passed the Electronic Communications Privacy Act (ECPA) in 1986. It is long past time for ECPA 2.0.