Reform to Require Warrant for Private Online Messages Up for Vote, but Down on Privacy

Mark M. Jaycox
EFF

Currently, the Department of Justice argues it can read your private electronic messages, like emails and private Facebook messages, older than 180 days without a warrant due to an archaic distinction in the outdated Electronic Privacy and Communications Act (ECPA). Senator Leahy wants to change this and has scheduled a markup hearing next week. Months ago, he offered language clarifying that the government must obtain a warrant for all private messages; however, recently released bill language keeps the 180-day requirement for civil regulatory agencies like the FTC, SEC, and others.

Even before the recent controversy over the newest language, we voiced our complaints about Leahy’s bill because it was tied to eviscerating the Video Privacy Protection Act (VPPA) and was threatened by Senator Grassley’s proposed changes. If passed, the full bill will go to the entire Senate for a vote. These newest changes strike at the core of ECPA reform. We heartily support updating these outdated laws to better protect individual privacy, but updating ECPA should not come at such costs.

The VPPA provides the strongest protections for privacy under any federal law. It requires users’ “informed, written consent…given at the time the disclosure is sought” when a video service provider wants to disclose a user’s request or purchase of any video. It also specifies that this information may only be disclosed to law enforcement with a warrant, court order, or grand jury subpoena, and insists on “probable cause to believe that the records or other information sought are relevant to a legitimate law enforcement inquiry” before a court order for disclosure may be issued.

Leahy’s changes to the VPPA allow for one-time advance consent—blanket sharing for any and all videos a user watches without any nuance as to with whom the user is sharing the information or over what exactly the user is giving up control. Some users may like to share the movies they watch with their friends, but the bill allows for companies to share these movies with predatory marketers like online behavioral advertising firms and data brokers.

The VPPA may not be the only casualty from Senator Leahy’s ECPA reform bill. The newest proposed changes would carve out a major exception to the warrant requirement. Leahy has stated he will not propose the recently released bill language, but the language is based off of amendments that Senator Grassley plans to offer. Under these changes, certain administrative agencies would be able to obtain emails without a search warrant, making compliance complex and burdensome for businesses. We are particularly uneasy with the proposed changes on ECPA reform because courts increasingly agree that the Fourth Amendment requires a warrant before the government—whether law enforcement or administrative agencies—can access all of our digital communications.

Right now, we’re seeing a growing acceptance of the notion that the Fourth Amendment protects all emails from warrantless government searches. In one example of this, Senators and Representatives alike are pushing for change.

This year, Representatives Nadler and Lofgren introduced separate bills that require the government to obtain a warrant before reading private electronic messages, while Representatives

Markey and Chaffetz also introduced separate bills—the latter with twenty-six co-sponsors—that mandate law enforcement apply for a warrant before obtaining users’ locations through their electronic devices.

With the addition of Senator Leahy’s original language, many Member of Congress are clear: it’s time to update a law that is at issue with both the Fourth Amendment and users’ reasonable expectation of privacy.

While Congress is proposing bills to update ECPA, courts have already ruled on the issue. In 2010, the Sixth Circuit Court of Appeals held in US v. Warshak that users have the same reasonable expectation of privacy in their stored email as they do in their phone calls and postal mail, and that the government must have a search warrant before it can secretly seize and search emails stored by email service providers. It even noted that to the extent ECPA stated otherwise, ECPA was unconstitutional.

This rationale is taking hold elsewhere. In Kansas, a federal magistrate judge relied heavily on Warshak in ruling that users had a reasonable expectation of privacy in their emails, and therefore the government must apply for a search warrant limited to the relevant aspects of the alleged crime. And in Minnesota, a federal district court judge ruled that a student’s Facebook messages limited to her friends were also covered by the Fourth Amendment. The courts have been clear in all of these cases: despite ECPA, the Fourth Amendment mandates the government obtain a warrant before reading users’ private electronic messages.

EFF is working with a number of coalitions—including the Digital Due Process Coalition and Vanishingrights.com—to continue to push for ECPA reform in order to not only clarify that the government must obtain a warrant to read private electronic messages, but also to mandate a warrant before the government accesses location information from your electronic devices. But EFF thinks tying ECPA reform (and an incomplete reform at that) to gutting the VPPA is the wrong way forward. Instead, the Senate should present a clean bill that clarifies users don’t have to give away some freedoms to gain others.

If you haven’t done so already, you should sign our petition urging Congress to protect our privacy by updating ECPA. Not only will the Senate reinforce existing Fourth Amendment protections by doing so, but they will also ensure strong privacy law like the VPPA aren’t needlessly compromised.

For the latest updates on privacy, electronic surveillance, and digital rights issues, please visit the Electronic Frontier Foundation