Congress weighs legislation that would update email privacy laws

SAN FRANCISCO -- Sen. Patrick Leahy (D-Vt.) and Sen. Mike Lee (R-Utah) introduced legislation Tuesday that would give stronger privacy protection to emails.

The Electronic Communications Privacy Act Amendments Act of 2013 would require the government to obtain a search warrant before secretly gaining access to email and other electronic communications stored by companies such as Google, Facebook and Microsoft. It also would require the government to notify an individual whose email has been accessed and provide that individual with a copy of the search warrant.

The bill would update the 1986 Electronic Communications Privacy Act (ECPA), which was written before the Web was born and long before Americans started sending, receiving and storing so much of their personal communications and documents online.

Alarmed by the growing intrusion into Americans’ private lives, Leahy, chairman of the Senate Judiciary Committee and the law’s original author, is trying to change the law so that the government will have to prove probable cause before rifling through personal communications.

“When I led the effort to write ECPA 27 years ago, email was a novelty. No one could have imagined the way the Internet and mobile technologies would transform how we communicate and exchange information today. Three decades later, we must update this law to reflect the realities of our time, so that our federal privacy laws keep pace with American innovation and the changing mission of our law enforcement agencies,” Leahy said.

Privacy watchdogs for years have warned that the antiquated federal statute — and conflicting interpretations of the statute from different courts — have not kept up with how people today use the Web, giving more legal rights to letters and documents stored in your filing cabinet than to emails and other electronic communication.

“Sen. Leahy and Sen. Lee filed bipartisan legislation today that shows there is an emerging understanding that ECPA was always intended to provide 4th Amendment protections. The technology eroded the standard over the years because the technology changed,” said Chris Calabrese, ACLU legislative counsel. “We hope we are beginning to get consensus.”

Law enforcement has in the past expressed concern over amending the law, saying the requirement to obtain a warrant could slow investigations.

But on Tuesday a Justice Department official testified Tuesday before a subcommittee of the House Judiciary Committee that there was no reason to treat email less than 180 days old any differently than email more than 180 days old.

Elana Tyrangiel, acting assistant attorney general in charge of Justice Department’s Office of Legal Policy, said the agency agreed that the law “failed to keep up with the development of technology.”

“The harder question is how to update those outdated rules and the statute in light of new and changing technologies while maintaining protections for privacy and adequately providing for public safety and other law enforcement imperatives,” she said.

She argued that Congress should not require government agencies to obtain a warrant for email searches in civil investigations.

Digital privacy was thrust into the national spotlight after CIA Director David Petraeus resigned over an extramarital affair with his biographer, Paula Broadwell. Privacy watchdogs asked: If the director of the CIA cannot keep the FBI from secretly rummaging through his private Gmail account, what protections do ordinary citizens have?

Technology companies including Google, Microsoft and AT&T; are lobbying Congress to require search warrants. Google and other email providers require a search warrant before handing over users’ emails to law enforcement

“ECPA worked well for many years, and much of it remains vibrant and relevant,” Richard Salgado, Google’s legal director of law enforcement and information security, testified before the House Judiciary Committee on Tuesday. “In significant places, however, a large gap has grown between the technological assumptions made in ECPA and the reality of how the Internet works today. This leaves us, in some circumstances, with complex and baffling rules that are both difficult to explain to users and difficult to apply.”

Now privacy watchdogs are looking to update digital privacy laws in another way: by protecting geolocation data. They want law enforcement to get a warrant before being permitted to access location data on mobile phones.

“From our point of view, we would like to get this piece done and then move on to the next piece,” Calabrese said.

ALSO:

Senate panel OKs update to communications privacy law

Google stepping up fight to limit government access to emails

Petraeus case triggers concerns about Americans’ online privacy