From time to time, there is bipartisan agreement in Washington. In what would be a great step forward for Americans’ digital privacy—and technology law—policy makers on both sides of the aisle are strongly in favor of updating a dated piece of legislation.
The Electronic Communications Privacy Act of 1986 (ECPA) was intended to prevent the government from conducting wire taps on transmissions of electronic data by computer. But at issue lately is the Stored Communications Act. The SCA, enacted as Title II of the ECPA also in 1986, specifically covers the disclosure of electronically stored communications and records by ISPs. The source of ire with this law is how it treats compelled disclosure of electronic communications, chiefly, the “180-day rule.” The law draws a line in the sand between electronic communications—i.e., e-mails, Facebook messages, etc.—that are older than 180 days and those that are newer than that. If e-mails are on a server for more than 180 days, it considers those e-mails abandoned, and thus accessible without a warrant.
Politico recently published an op-ed by unlikely allies Grover Norquist, founder of the conservative group Americans for Tax Reform, and Laura Murphy of the ACLU, which explained why the ECPA had such an absurd effect:
“In 1986, email service providers did not store emails for very long after they were sent and read. In 1986, it was practically inconceivable that a service provider would store email for more than 180 days. Therefore, ECPA treated older email almost as if it were abandoned property, allowing a government official to demand it from the service provider with a subpoena issued without a judge’s approval. Given the dial-up technology of 1986, documents were stored locally on hard drives or on ‘floppy’ disks. It seemed implausible that an individual or small business would ever have the bandwidth allowing instant access to photos and documents remotely stored on the sophisticated computers of service providers.”
In other words, 1986 legislators never envisioned cloud storage, web-based e-mail services like Gmail, or social networking. And as a result, Fourth Amendment protections were sidestepped.
The encouraging news is that policy makers everywhere are in support of fixing this problem and have been for a long time. Even the Department of Justice, responsible for enforcing federal laws, wants to reform ECPA. We previously discussed the attempts to reform the ECPA in November, but that particular measure fell through pretty quickly.
Now, legislators are trying again. As Slate reported, Sen. Patrick Leahy (D.-VT) and Sen. Mike Lee (R.-Utah) authored the proposed legislation in the Senate that would modernize the ECPA in several distinct ways. As proposed, the Electronic Communications Privacy Act Amendments Act of 2013 would modify multiple statutes in Chapter 121 of Title 18 of the U.S. Code, the codified provisions of the Stored Communications Act. Significantly, the proposed law would:
- Amend 18 U.S.C. § 2702(a)(3) to prohibit providers of electronic communication services from knowingly divulging the contents of communications previously covered by the 180-day rule to any governmental entities.
- Amend 18 U.S.C. § 2703 to: (1) eliminate the 180-day rule and require a warrant for access to electronic storage; and (2) require law enforcement agencies to provide a copy of the warrant and particularized notice within 10 days of obtaining the search warrant.
A similar bill is making its way through the House of Representatives, and that proposal also calls for a warrant standard and mandates that notice be given to users. The Digital Due Process Coalition, made up of tech behemoths like Adobe, Amazon, Facebook, and Google, also strongly supports reform.
Perhaps impatient with the legislature’s feet-dragging on reform, some courts have taken steps to correct the ECPA’s influence. The Sixth Circuit in United States v. Warshak first held that Americans have a reasonable expectation of privacy in the content of their e-mails that are stored electronically. The Court even went so far as to declare the Stored Communications Act unconstitutional.
With the courts, legislators, public policy leaders, technology companies, and privacy proponents all on board with ECPA reform, the question remains—when will it happen?