March 2016: You’ve Got Mail … and a Warrant for Its Disclosure

Washington Watch | March 2016
By Bruce Moyer

A fierce election year debate is erupting over how and when email and other electronic data revealing evidence of a crime should be made available to law enforcement authorities and what the countervailing expectations of privacy should be. The debate is forming on two substantive fronts in Congress.

The first front involves a broad, bipartisan effort to modernize a 30-year old law governing the privacy of relatively standard forms of electronic communications, including email, text messages, and other content. The second involves a much newer technology tool—encryption—and the legal cul-de-sac that enforcement authorities face when a search warrant for the content on a locked device is unable to impregnate the device. Both debates have broad implications for law and legal practice.

This column takes a closer look at the first debate over email privacy; next month we will look at encryption and the thorny questions it raises. Both debates dramatize the ongoing need for law to catch up with technology and the struggle that imbalance creates on Capitol Hill.

Modernizing the ECPA
The last time Congress updated email privacy laws was in 1986, when it established the Electronic Communications Privacy Act (ECPA) to protect wire, oral, and electronic communications when those communications are being made, are in transit, and when they are stored on computers. Email, telephone conversations, and data stored electronically are covered by the Act, which reflects a general approach of greater privacy protection for materials that embody greater privacy interests. Some information can be obtained by the government from Internet service providers with a subpoena; other information requires a special court order; and still other information requires a search warrant. In addition, some types of legal process require notice to the subscriber, while other types do not.

These distinctions and their motivations, made by the Congressional drafters some 30 years ago, have been outpaced by technology. For example, the ECPA permits the government to access emails without a warrant if they are stored by the service provider for more than 180 days, but it requires the government to secure a court-imposed warrant for emails stored for less than 180 days. This outdated distinction has motivated Congress to try to modernize the ECPA.

The Email Privacy Act
Congressional support for the modernization legislation called the Email Privacy Act has grown since its introduction several years ago. More than 300 House members today are co-sponsors of the measure, a number greater than any other bill pending in the House of Representatives and a reflection of the breadth of bipartisan support for privacy protection. Introduced in the House by Rep. Kevin Yoder (R-Kan.) and in the Senate by Patrick Leahy (R-Vt.), the Email Privacy Act (H.R. 699 and S. 356) would change the framework for law enforcement access to email (and texts and other electronic content) housed with Internet service providers, like Google and Yahoo, and bring the statute in line with the Sixth Circuit’s opinion in United States v. Warshak, 631 F.3d 266 (6th Cir. 2010), which requires the government to obtain a warrant to access emails, regardless of their age.

DOJ and SEC Concerns
The broad and unprecedented notice and disclosure obligations imposed on the government by the bill, however, have prompted the Department of Justice (DOJ) to raise concerns and request the addition of law enforcement-related exceptions to the warrant requirement, exceptions akin to those applicable to physical searches. These concerns have caught the attention of House Judiciary Committee Chairman Robert W. Goodlatte (R-Va.) and triggered the delay of his panel’s markup of the bill, notwithstanding its massive support by his colleagues.

In addition, federal civil enforcement agencies, like the Securities and Exchange Commission (SEC), have pointed to the bill’s negative impact upon access to electronic evidence involving parties under investigation. The SEC currently tries to obtain email and other evidence through its subpoena power, but is not always successful in that pursuit. The agency does not have the authority to obtain warrants because it is a civil agency, but under the Email Privacy Act, the agency would be required to obtain a warrant to access emails directly from an Internet service provider. The SEC prefers the use of special court orders, a move opposed by the bill’s supporters.

The foregoing problems prompted the bill’s supporters to tuck language into the massive congressional spending bill approved in December 2015 that would require government agencies funded under the Financial Services title of the spending measure (like the SEC, along with the Federal Trade Commission and the Internal Revenue Service—but not DOJ) to obtain a warrant when seeking emails from Internet service providers. Given the low likelihood that the Email Privacy Act will pass the Congress in an election year, privacy advocates regard the new language as an incremental victory in the ongoing application of Fourth Amendment protections in the digital era.
Bruce Moyer is government relations counsel for the FBA. © 2016 Bruce Moyer. All rights reserved.


Connect With Us...