Should email and other personal electronic data be protected by the Fourth Amendment in the same way that a written letter or other personal effects are protected? This and other questions like it were debated today before the House Judiciary Committee.
The hearing comes as HR 699, the Email Privacy Act, approaches a House vote. The bill, proposed by Rep. Kevin Yoder, R-Kan., with 304 co-sponsors, would reform the Electronic Communications Privacy Act (ECPA) of 1986.
Witnesses at the hearing all agreed that ECPA needs some updating to match the technological advances made since 1986, but differences emerged over how.
Representatives of various government agencies testified in favor of certain privacy loopholes in the older law. Under the ECPA, agencies like the Securities and Exchange Commission (SEC) are able to require an Internet service provider or cloud provider to release email, location data, and other metadata on an individual with a subpoena, rather than a warrant.
Unlike a subpoena, a warrant is limited to specific information, requires probable cause and a judge’s approval. The new Email Privacy Act would also require giving notice to data owners whose information is being seized. The older law does not require giving notice to owners of email that is stored on the cloud.
The proposal to protect email content with a warrant is what the framers of the Bill of Rights intended, said cybersecurity expert Paul Rosenzweig, principal of Red Branch Consulting. “I think, frankly, the Founding Fathers would be shocked to learn that this question is even in dispute.”
Andrew Ceresney, director of the Securities and Exchange Commission’s (SEC) division of enforcement, said the proposed law will impede investigations.
Steven Cook, president of the board of directors of the National Association of Assistant United States Attorneys, said some measures included in the old law are critical to the apprehension of terrorists, child molesters, carjackers, drug traffickers, kidnappers, and murderers. “It would be no exaggeration to say that lives often hang in the balance,” he said.
Google’s Director of Law Enforcement and Information Security Richard Salgado said the proposed law meets email users’ “reasonable expectations of privacy” and codifies recent court decisions in favor of privacy.
Google is a member of the Digital Due Process (DDP) Coalition, a group of more than 100 organizations, trade associations, and corporations supporting the proposed bill.
“The diverse array of organizations, trade associations, and corporations that comprise the Digital Due Process Coalition is a testament to the breadth of support for updating ECPA in the Internet era,” Salgado said.