This guest blog was written by ACLU of Massachusetts intern Max Bauer
In the mid-1980s, Senator Patrick Leahy decided it was time for Congress to update its privacy laws. The changing landscape of electronic communications technologies Americans used wasn’t reflected in our privacy law, and the Vermont senator set out to fix that.
As Senator Leahy described it at the time, the United States was in the midst of an "electronic revolution." His colleagues agreed, and in 1986 Congress passed Senator Leahy's bill, the Electronic Communications Privacy Act (ECPA). The antiquated laws which had only protected analog telephone calls were thereafter buttressed by a law which protected the growing stream of digital transmissions more and more Americans were relying on to communicate.
Decades later, ECPA is the antiquated law.
The Fourth Amendment to the Constitution requires a warrant based on probable to ensure the "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." But while the framers made absolutely clear the government could not simply enter one's house without a warrant, they did not foresee the exact problem of obtaining one's location from the global-positioning system (GPS) of a cell phone or reading one's email from an internet service provider server.
Congress, too, understandably couldn’t predict the future. Text messages have become as ubiquitous as phone calls. Anyone with a modern cell phone is constantly sending out location-revealing data. None of these things happened in 1986, when Senator Leahy’s ECPA was signed into law.
But even those technologies that existed in 1986, like email, have changed substantially in the intervening years. The privacy protections enshrined in ECPA simply do not suffice today.
ECPA says the government needs a warrant to compel disclosure of electronic communications stored in an electronic communications system for less than 180 days. However, less due process is required to obtain electronic communications, including emails, text messages and GPS location, stored for longer.
The average Gmail account now has about 18,000 messages, many of them older than 180 days. ECPA does not protect those older email messages from warrantless government snooping. Think about that for a second. Can you imagine deleting all emails older than 6 months to ensure you have some measurable degree of online privacy?
While most civil libertarians argue that all such warrantless disclosures under EPCA are unconstitutional, and while the Sixth Circuit agrees, the law in most of the country allows the government to acquire electronic data — which most users would expect to be private — with only a subpoena or court order. No probable cause — evidence to suggest that you are involved in criminal activity — is necessary.
As you can imagine, this isn’t an academic problem. Just this week the ACLU revealed that the IRS doesn’t think it needs a warrant to read some of our emails. The Washington state Supreme Court is set to hear two cases next month on electronic privacy: Do the police need a warrant to access our text messages? The question is far from settled law.
So what about hopes for reforming ECPA, to bring it into the 21st century to protect the ways we communicate now?
Senator Leahy is still in the Senate, and he recognizes that the law is due for a modernization. Last month, Senator Leahy, a Democrat, and Senator Mike Lee, a libertarian-leaning Republican, introduced a bill to update ECPA. From their press release announcing the proposed legislation:
“No one could have imagined just how the Internet and mobile technologies would transform how we communicate and exchange information today,” Leahy said of the original ECPA law, which he authored in 1986. “Privacy laws written in an analog era are no longer suited for privacy threats we face in a digital world. Three decades later, we must update this law to reflect new privacy concerns and new technological realities, so that our Federal privacy laws keep pace with American innovation and the changing mission of our law enforcement agencies.”
“When ECPA was enacted, email was primarily a means of communicating information, not storing it," said Senator Lee. "Today, we use our email accounts as digital filing cabinets, where we store many of the personal documents and sensitive information that the Fourth Amendment was meant to protect. This bill takes an essential step toward ensuring that the private life of Americans remains private.”
The effort to modernize ECPA has predictably garnered bipartisan support from civil liberties-minded senators, but the coalition for reform is much broader, including such diverse corporations and organizations as Americans for Tax Reform, Apple, AT&T, Dell, Ebay, Freedom Works, Google, Microsoft, Oracle, Reddit, and the US Chamber of Commerce.
After Congress held a hearing on the bill last month, Paul Rosenzweig, who served in the policy-making division of the Bush administration's Department of Homeland Security, called a warrant requirement for all stored electronic communications a "fundamentally good idea." Even the current Department of Justice, whose investigative work would be impaired by stronger electronic privacy protections, signed on to the general principle of requiring a warrant for compelling disclosure of email and similar electronic communications. The DOJ representative at the ECPA hearing said such an approach had "considerable merit, provided that Congress consider contingencies for certain, limited functions for which this may pose a problem."
It looks like the warrant requirement for content is likely to pass. That will be a major victory for civil liberties organizations and everyone in the US who wants to protect their electronic privacy in the digital age. But in the war over electronic privacy, content is just one battle. Often police departments and federal law enforcement aren’t interested so much in what we say anymore, but rather to whom we say it, and from where.
Unfortunately, on those questions, the Department of Justice is digging in its heels. Whereas the government has apparently come around on the question of warrants for content, it strenuously opposes a probable cause warrant standard for location tracking. We haven’t yet crossed the finish line on warrants for email (add your voice here), and achieving location privacy will be another, perhaps more difficult, long struggle.
The government says that it needs to be able to track us without warrants, but the sky didn’t fall before we all carried around little GPS trackers in our pockets. Take action now to urge your lawmakers to support strong location privacy legislation.