Thirty years ago, a law designed to balance the privacy expectations of American citizens and the needs of law enforcement agencies put limits on electronic searches. Called the Electronic Communication Privacy Act (ECPA), it was written when few Americans had access to computers let alone mobile phones and email. Since it was was passed in 1986, a new era of connectivity has flourished, producing vast troves of digital records. Failing to envision our world of digitized communication, many believe the law is long overdue for an update.
With virtually unlimited storage and international reach, email has emerged as a legal battleground. Should law enforcement be required to obtain a search warrant to read your digital correspondence? Congress, with Silicon Valley’s eager nod, seems to think so.
ECPA was drafted well before the explosion of the web, and before a vasty array of giant internet companies began collecting our intimate details. For the tech industry, privacy advocates, and over 300 members of Congress, the rush of tech’s advancement has far outpaced the law. With growing bipartisan support, a bill in the House of Representatives, the Email Privacy Act, would update the ECPA and bring novel forms digital communication under the protection of the Fourth Amendment.
“Reforming this decades-old outdated law has been a priority for me as chairman,” said Rep. Robert Goodlatte, a Virginia Republican, who leads the House Judiciary Committee, in a hearing Monday.
“We agree that ECPA is outdated and provides unjustifiably inconsistent standards for government access to our stored communication,” said ranking member John Conyers, a Democrat from Michigan. “Because of the rapid pace of technological change, this situation will only get worse if we do not act.”
With 304 co-sponsors in Congress, the proposal — which would require law enforcement to show probable cause before compelling internet service providers to disclose a consumer’s email correspondence — is also widely supported by Silicon Valley.
“Users expect, as they should, that the documents they store online have the same Fourth Amendment protections as they do when the government wants to enter the home to seize documents stored in a desk drawer,” said Richard Salgado, Google’s director of law enforcement and information security. “There is no compelling policy or legal rationale for there to be different rules.”
Google is joined by a broad coalition of tech companies that have lobbied for an overhaul of the ECPA, including Microsoft, Apple, Facebook, and Yahoo.
While Salgado represented the interests of his company and the tech industry consensus, he faced off against three other expert witnesses called to highlight the concerns of law enforcement and regulatory agencies. They fear that an update to the law may hinder their ability to gather crucial evidence and apprehend criminals and terrorists.
The director of enforcement for the Securities and Exchange Commission, Andrew J. Ceresney, told the Judiciary Committee that the Email Privacy Act “poses significant risks to the American public.” The proposal, he said, would impede the “ability of the SEC and other civil law enforcement agencies to investigate and uncover financial fraud and other unlawful conduct.” Ceresney wants to alter the bill to allow exemptions and looser restrictions for certain government agencies.
Steven Cook, representing the National Association of Assistant U.S. Attorneys, and Richard Littlehale, a top official with the Tennessee Bureau of Investigation, both cited crimes involving small children — abduction and sexual assault — in defense of legal exemptions that would allow agents to read a person’s email without a warrant in emergency crime solving.
While lawmakers appeared sympathetic to the arguments put forth by Salgado, Cook, and Littlehale, they also challenged some of their reasoning. “The Fourth Amendment makes us different than any other country on earth,” said Rep. Ted Poe, a Republican from Texas. “I don’t buy the argument ‘Well, we’re in the digital age, you gotta give up some of your constitutional rights so we can have government investigate things.’”
Jim Sensenbrenner, a Republican from Wisconsin, characterized the laments of law enforcement as an attempt to claim additional powers beyond the limits of current law. “I think this is a slam-dunk for Congress to make a determination,” he said. “We already have something that everybody seems to think is OK except for a few people who would like to expand the dragnet.”
While the debate on ECPA focused on constitutional questions and the right to privacy, Google’s Salgado noted possible economic implications for the tech sector as well. “There’s a perception outside of the United States — in Europe it’s no secret — that data held by U.S. companies is somehow there for the taking by the U.S. government,” he said. “This bill, the Email Privacy Act, is a good step in getting rid of that misperception.”
One major controversy fueling the attitudes Salgado mentioned is a recent decision by the European Union’s highest court, which invalidated a long-standing trade agreement with the United State, known as Safe Harbor. The court found that American surveillance operations involving U.S. tech companies violated the privacy rights of EU citizens. As the tech industry clamors for a new agreement between the U.S. and the EU, European officials expect a deal to be struck by early next year.
Before Congress schedules a vote on the Email Privacy Act, the Judiciary Committee will mark up the bill’s language, possibly addressing the concerns of law enforcement officials. Rep. Goodlatte said he will hold another hearing to discuss similar issues in the realm of cloud computing, where international boundaries complicate the law and pose new challenges to American companies doing business abroad. A federal appeals court is currently grappling with a cloud computing case involving Microsoft and a search warrant for emails stored in Ireland. It’s unclear if Congress will act in time to resolve the legal uncertainty surrounding the Microsoft case and domestic email.