Senate OKs Bill That Would Outlaw Warrantless Email Searches
(CNET) – A U.S. Senate panel on Thursday approved a landmark privacy bill that would curb law enforcement's warrantless access to the contents of e-mail, private Facebook posts, and other data that Americans store in the cloud.
The voice vote was a victory for a coalition of technology firms including Apple, Google, Facebook, and Twitter, which had urged Congress to update a 1986 law to reflect changes in technology -- and preserve the same privacy rights that Americans enjoy if their files are printed out and stored in a cabinet at home.
"We have to update our digital privacy laws if we want to keep up with rapid changes in technology," said Sen. Patrick Leahy, the Vermont Democrat who's the chairman of the Senate Judiciary Committee.
The panel approved the measure despite objections from law enforcement groups, which had sent a letter to the committee yesterday that was cited by Sen. Chuck Grassley, an Iowa Republican. Grassley offered an amendment that they had suggested, which failed to be adopted, that would have weakened privacy protections in "emergency" circumstances.
Senators are "abdicating our duty if we do not examine the concerns raised by federal and state law enforcement," Grassley warned. They have raised "important questions and ones we should be prepared to address" in an open process, he said, not through "concerns that were raised in the media in the draft of the legislation that was leaked last week."
That's a reference to a CNET article that disclosed Leahy had reshaped his legislation in response to law enforcement concerns to grant more than 22 federal agencies -- including the Securities and Exchange Commission and the Federal Trade Commission -- warrantless access to the contents of Americans' e-mail and other private communications.
In response to a public outcry critical of that warrantless access proposal, including a petition that garnered nearly 8,000 signatures, Leahy abandoned it and did not offer it for a vote today.
Leahy glued his privacy amendments onto a Netflix-backed proposal to amend the 24-year-old Video Privacy Protection Act by giving customers the option of Facebook integration. The combined bill now goes to the Senate floor for a vote, which is unlikely to take place this year. (Even if it does, the incoming head of the House Judiciary Committee, Bob Goodlatte, has signaled he wants to take more time to review it.)
The proposal to update the 1986 Electronic Communications Privacy Act, or ECPA, would require federal, state, and local police to obtain a search warrant from a judge based on the traditional standard of probable cause before accessing files stored in the cloud, including e-mail, which echoes a 2010 ruling from a federal appeals court.
Complicating the situation is that the Justice Department has opposed requiring search warrants for e-mail. James Baker, the associate deputy attorney general, warned Congress that requiring a warrant to obtain stored e-mail could have an "adverse impact" on criminal investigations.
Yesterday's letter signed by the National Sheriffs' Association, the National District Attorneys' Association, and other law enforcement groups says:
"Online child exploitation investigations are particularly vulnerable to a change in the standard of proof... Not only do those provisions (in current law) leave the judgment of what constitutes an emergency in the hands of a provider, it is voluntary. A service provider is not required to disclose, even if it acknowledges that an emergency exists.
"We believe that the "emergency" provision in current law (18 USC 2702(b)(8)) needs to be revisited. It puts the decision about whether a situation is an 'emergency' in the hands of the provider instead of in the hands of the law enforcement experts who are on top of the situation. This has led to situations where response to legitimate law enforcement requests has been delayed or not forthcoming at all. The proposal currently before the committee does not address this issue.
"We appreciate the changes made from the original proposal that lengthen the notification and delayed notice time periods, but we continue to have concerns about the notice provision in general. The proposed notice provisions would create unnecessary risks to investigations and undue burdens on law enforcement agencies given the potentially large number of cases in which delays would need to be sought and renewed."
The legislation approved by the Judiciary Committee today isn't a complete win for the coalition, which includes the American Civil Liberties Union and Electronic Frontier Foundation and some conservative and libertarian groups.
One new section of the measure says providers "shall notify" law enforcement in advance of any plans to tell their customers that they've been the target of a warrant, order, or subpoena. Another allows police to delay that notification for two 180-day periods -- up from two 90-day periods in the original bill.
