Privacy bill adds safeguards to individuals' old e-mails and texts

The Email Privacy Act would replace the current Electronic Communications Privacy Act, a nearly 30-year-old e-mail privacy law that requires probable cause warrants only for searches of e-mails and text messages that are less than 180 days old.

Congress could soon vote on a bill that seeks to fundamentally reform the manner in which government can access the private communications of individuals stored by Internet service providers.

The Email Privacy Act would create a uniform warrant requirement for law enforcement and government agencies seeking access to e-mail, text messages, photos, and other private content stored in the cloud by Internet providers. The House Judiciary Committee held a hearing on the bill Tuesday and is expected to mark it up soon to accommodate changes sought by some stakeholders.

The bill seeks to replace the current Electronic Communications Privacy Act (ECPA), a nearly 30-year-old federal e-mail privacy law that requires probable cause warrants only for searches of e-mails and text messages that are less than 180 days old. As written, ECPA permits government agencies to use administrative subpoenas, which are easier to obtain than a warrant, to compel disclosure of e-mails that are older than 180 days.

Critics of the current legislation have often pointed to the provision as an example of just how outdated and archaic ECPA has become in an era when individuals store vast and increasing amounts of highly personal data online. Also of concern is ECPA’s lack of clarity on critical issues like government access to location tracking data on mobile devices and metadata like whom an individual communicates with via e-mail, phone, and other means.

"The Fourth Amendment requires warrants based on probable cause to access individual personal effects," says Sophia Cope, a staff attorney at the Electronic Frontier Foundation, one of the many groups pushing for ECPA reform. "We believe that standard needs to be applied to content stored in the cloud."

The Senate is considering a proposal similar to the Email Privacy Act bill called the ECPA Amendments Act. Both bills enjoy broad bipartisan support in Congress. More than 300 House of Representatives members, for instance, have signed up as cosponsors to the House bill. The proposed statutes also have the enthusiastic backing of civil liberties organizations, technology vendors, and numerous trade groups.

But some law enforcement officials and civilian regulatory agencies, most notably the US Securities and Exchange Commission (SEC), want provisions for warrantless access to be built into any e-mail privacy law that Congress enacts to replace ECPA.

Law enforcement officials claim that a blanket warrant requirement for all content searches would seriously hamper their ability to pursue investigations in situations where speed is critical. In testimony before the House Judiciary Committee this week, Steven Cook, president of the National Association of United States Attorneys, said the Email Privacy Act’s failure to incorporate exemptions to the search warrant requirement is problematic.

Such exceptions are available to law enforcement in the physical context and need to be available in the digital realm, as well, Mr. Cook said.

"The Act, however, glaringly fails to recognize any of the longstanding and deeply rooted exceptions to the warrant requirement," he said in written testimony. "Put another way, the Email Privacy Act provides greater protection to e-mail communications than any other item or place. That simply does not make good sense."

A warrant-only requirement would also make it impossible for civilian agencies like the SEC to get access to email and other stored content, said Andrew Ceresney, director at the SEC’s division of enforcement.

"Because the SEC and other civil law enforcement agencies cannot obtain criminal warrants, we would effectively not be able to gather evidence," stored by Internet service providers on individuals who might be the subject of an investigation, Mr. Ceresney said. Without modifications, the Email Privacy Act would essentially deny SEC the ability to obtain critical evidence, he said in his testimony to committee members.

Like Cook, Ceresney, too, said he believes the bill as proposed would afford greater protections to stored content than available for paper materials.

Republican Bob Goodlatte of Va., chairman of the Judiciary Committee, acknowledged such concerns in his opening statement and signaled that he may be willing to add provisions that provide exceptions to the warrant requirement.

"It is well-settled law that the government may conduct a search in the absence of a warrant in certain instances," including emergencies in the physical world, Rep. Goodlatte said. There's no reason why such an exception should not be available for online searches as well, he said.

"Courts have also routinely ruled that subpoenas meet Fourth Amendment requirements," Goodlatte said in voicing support for the position taken by the SEC and other civil law enforcement agencies.

It’s unclear if Goodlatte’s support for changes in the Email Privacy Act will end up being reflected in the final version of the bill. If that happens, it would be a major blow to organizations like the EFF, which want a clean reform of ECPA without any special carve outs for law enforcement and civilian agencies.

This is the third year in a row that Congress has considered ECPA reform bills. On the two provisions occasions, provisions like those being sought by the SEC derailed the effort. 

"The Fourth Amendment doesn’t distinguish between criminal and civil investigations," says Cope. "We believe that any kind of government access should be limited by the legal standard of probable cause. If that means certain agencies can’t go to ISPs [Internet service providers] we are comfortable with that."