Warrant for Email Bill Seen as Likely This Year, But Full ECPA Update Remains ‘Multi-Year Effort’

The courts have been slowly progressing on electronic communications privacy expectations for years, Center for Democracy & Technology Vice President-Public Policy Jim Dempsey told us. But Congress has yet to budge. It must, said lawmakers, industry voices and privacy advocates, if there’s to be an unambiguous electronic communications privacy policy. The courts alone can’t set a clear standard, they said.

The court cases have, however, changed “the dynamic legislatively,” Dempsey said. Most recently, the Supreme Court unanimously ruled police must obtain a warrant to search the information on a cellphone (CD June 26 p9). The ruling “hinted to” a broader “warrant for content requirement,” said Google Senior Privacy Policy Counsel David Lieber at a July 7 New America Foundation event. Before that, the 11th U.S. Circuit Court of Appeals ruled police need a warrant to acquire cellphone location data from service providers (CD June 13 p9). The ruling “cuts through all the statutory debate, all the fine parsing of the technology and just says there is a privacy interest here that is constitutional,” Dempsey told us. “That’s what this case is remarkable for.” Google and Microsoft officials said they have been using a 2010 6th U.S. Circuit Court of Appeals decision to require a warrant for law enforcement requests for electronic content (CD July 10 p8).

"While the court’s been a leader, there’s a problem that we still have in that it’s not a comprehensive solution,” said Microsoft attorney Nate Jones at a Tuesday Cato Institute event. “It does leave a lot of gaps where we don’t know what the law is.” And if these lower court issues came before the Supreme Court, “I don’t know how they would rule,” said Rep. Ted Poe, R-Texas, at the same event. “We can debate that issue theoretically forever."

That’s why congressional action is needed, observers said. Focus has centered on the Yoder-Polis bill, the Email Privacy Act. It’s the “lowest-hanging fruit on the surveillance tree,” said Google’s Lieber. Currently, there’s no warrant requirement to access emails older than six months stored in a third-party cloud or remote database. Changing that is the first realistic ECPA update, observers said. “This one is such a glaring, obvious flaw in need of change,” Polis told us.

As of Friday, the bill had 224 co-sponsors -- more than half of the House -- but had not been put on the House Judiciary Committee’s calendar. “Our priority is to work with the Judiciary Committee to find an acceptable path forward,” Yoder told us. “We've had conversations with the chairman [Rep. Bob Goodlatte, R-Va.] and his staff and believe that he is favorable to solving what he sees as a major problem with an arcane law.” Polis added: “I haven’t heard any opposition from him.” A House Judiciary Committee aide told us “ECPA reform is a top priority for Chairman Goodlatte.” The aide said Goodlatte is “working aggressively with House and Senate Judiciary Committee Republicans and Democrats as well as outside groups -- including privacy advocates, industry and law enforcement -- to identify ECPA reform priorities,” which include the Email Privacy Act.

Yoder and Polis won’t necessarily wait for Goodlatte, though. “We're looking at all avenues right now,” Yoder told us. “We would seek to bring this forward as a suspension,” said Polis. Under suspension rules, the bill could be brought straight to a House floor vote with a two-thirds vote, they said. “That’s the easiest route,” Polis told us. Two-thirds of the House is 291 members, a near-30 percent increase over the bill’s current co-sponsor tally. “At some point the committee leadership and House leadership are going to have to move this,” said New America Foundation’s Open Technology Institute Policy Director Kevin Bankston, who supports the bill. “The tide is unstoppable.” Poe was equally bold: “This is actually something I think will pass. It will pass the House, it will pass the Senate.” And it will likely do so this session, Yoder said.

Next Steps

Then the more muddled ECPA update slog begins, observers said. “There are certainly a number of areas that are in the gray area,” Google’s Lieber said. Congress will need to consider what counts as content, he said. For instance, do search results and photos count? he asked. “It’s unclear exactly when those issues might be taken up,” he said.

And while Yoder’s and Polis’s bill addresses email, it doesn’t address all methods and technologies used to exchange information, Poe said. Social media messages and secure intra-company portals are just two examples that will need to be tackled, he acknowledged. “We have to address all those issues as well,” Poe said.

There’s also the issue of what the government should do with emails improperly obtained, Poe said. Previously, if the government obtained evidence without a warrant, it was simply excluded from a case, Poe said. But in a digital age, even if evidence is excluded from a case, the government can easily retain the evidence in a database. “As we move forward on ECPA, there has to be some other remedy besides exclusion as to what we do with that information,” Poe said. “Certainly, I think we ought to eliminate that information if it’s unlawfully obtained. But we need to have that debate and that discussion.” Unlike many of the other issues slated for an ambiguous next round of ECPA updates, how to handle excluded data is a debate that could occur during committee work on the Email Privacy Act, Poe said. “We need to add that into legislation before it gets out of our committee,” he said. “I don’t know what the exact answer should be."

Geolocation

Geolocation is another multifaceted issue the courts have been grappling with, Dempsey told us. What are the different standards for real-time location data and historical location data? Does it matter if data is collected from cell towers or GPS? What are the privacy expectations for short-term versus long-term access to location data? These are all questions that the courts have started ruling on, but that are gridlocking Congress, Dempsey said.

It’s not for lack of legislative proposals. Rep. Jason Chaffetz, R-Utah, sponsored the Geolocation Privacy and Surveillance Act (HR-1312), which would require warrants for remote surveillance of users’ locations through their mobile devices (http://1.usa.gov/1pJXygS). Sen. Ron Wyden, D-Ore., sponsored the companion Senate bill (S-639). Poe -- with Democratic Reps. Zoe Lofgren of California and Suzan DelBene of Washington -- sponsored a similar House bill, the Online Communications and Geolocation Protection Act (HR-983) (http://1.usa.gov/1wbuQTx). None of the bills has moved since Spring 2013. “Bills were not moving just because of the complexity of the issue,” Dempsey told us. Although cases like the 11th Circuit ruling on cellphone location data partly answered some of those questions, “I cannot say” the ruling makes legislation “more likely,” Dempsey said.

Yoder identified geolocation as perhaps the next step. “Geolocation has been talked about as the next frontier,” Yoder told us. Both Yoder and Polis said unexpected conundrums will continue to arise, though. “I would advocate for looking at where we are today with technology and trying to find the appropriate balance,” Polis said. “The sooner the better.”