Consensus builds for requiring warrant for email searches

Republicans, Democrats and government officials agreed at a House hearing on Tuesday that police should need a warrant to obtain people’s emails and other private online messages from third-party providers.

Rep. Jim Sensenbrenner (R-Wis.), the chairman of the Judiciary subcommittee on Crime, Terrorism, Homeland Security and Investigations, which was holding the hearing, said that only requiring a subpoena, instead of a warrant, to access emails is “outdated and probably unconstitutional.”

{mosads}”A probable cause standard should apply to the government’s ability to compel a communications provider to disclose a customer’s email message – no matter how old the message is,” Rep. John Conyers (D-Mich.), the Judiciary Committee’s ranking member, said.

Elana Tyrangiel, the acting assistant attorney general for the Justice Department’s Office of Legal Policy, agreed that requiring a warrant has “considerable merit.”

Greg Nojeim, a senior counsel for the Center for Democracy & Technology, a privacy advocacy group, said he was encouraged by the hearing.

“The committee hearing reflects a growing consensus around the idea that there should be a warrant for email content,” he said in an interview.

Under the Electronic Communications Privacy Act (ECPA) of 1986, police only need a subpoena, issued without a judge’s approval, to read emails that have been opened or that are more than 180 days old. 

When lawmakers passed ECPA more than 25 years ago, they failed to anticipate that email providers would offer massive online storage. They assumed that if a person hadn’t downloaded and deleted an email within six months, it could be considered abandoned and wouldn’t require strict privacy protections.

Traditionally, the courts have ruled that people have limited privacy rights over information they share with third-parties. Some police have argued that this means they only need a subpoena to compel email providers, Internet service companies and others to turn over their customers’ sensitive content. 

Senate Judiciary Committee Chairman Patrick Leahy (D-Vt.) and Sen. Mike Lee (R-Utah) introduced legislation on Tuesday that would require police to obtain a warrant to obtain private online messages, regardless of how old they are. 

Reps. Zoe Lofgren (D-Calif.), Ted Poe (R-Texas) and Suzan DelBene (D-Wash.) have introduced legislation in the House that would require a warrant to access mobile location data in addition to emails and other online messages.

“Everybody agrees the statute needs to be amended. The question is how,” Orin Kerr, a George Washington University law professor who testified at the hearing, said in an interview.

Tyrangiel urged lawmakers to exempt civil regulatory investigations, which cover issues such as antitrust enforcement; environmental regulation and civil rights protection, from the warrant requirement. 

She explained that regulators investigate conduct that is unlawful, but not necessarily criminal. She argued that because regulators often do not have access to the warrant power, the requirement would impede critical government investigations. 

The bill introduced by Leahy and Lee on Tuesday would not exempt government regulators from the warrant requirement. They would still be allowed to subpoena companies directly for their records, just not the third-party email providers. 

Richard Littlehale, a special agent for the Tennessee Bureau of Investigation, did not object to expanding ECPA, but he urged lawmakers to include a provision requiring communications providers to comply with legal demands within a reasonable time.

“Responding to law enforcement legal demands costs service providers money and does not generate revenue however, and so there is little financial incentive to innovate or increase staffing levels,” he said. “Therefore, a reasonable legal mandate for responsiveness may be the best solution to this problem.”

Richard Salgado, Google’s director of law enforcement and information security, said the lack of adequate privacy protections has been a “drag on the adoption” of email and other cloud services.

He said that Google believes the Fourth Amendment provides broader privacy protection than ECPA and that the company and other communications providers already refuse to turn over users’ messages without a warrant.

Although Sensenbrenner said ECPA is outdated and needs to revised, he warned that striking the right balance between privacy protection and empowering law enforcement will be a “tough nut to crack” for Congress.

Judiciary Committee Chairman Bob Goodlatte (R-Va.) said updating ECPA will be one of his top priorities, but he stopped short of endorsing any particular proposal.