The 31 year old Electronic Communications Privacy Act (ECPA) could soon be updated, an event well overdue given the extent to which the electronic communications have changed over its lifetime.
Under the ECPA, as it currently stands, there are there two possible outcomes when determining whether law enforcement agencies require a warrant to search data (such as emails or social media posts) stored on a third parties’ servers or in the cloud:
- If the data has been stored for less than 180 days, then a probable cause criminal warrant is required.
- If the data has been stored for longer than 180 days then only a subpoena is required. Subpoenas are usually issued by a Court clerk or sometimes even lawyers, and are not something that a Judge needs to approve in advance.
In the evening on Monday February 6, the US House of Representatives unanimously approved the Email Privacy Act (EPA). The Act will amend the ECPA and require that law enforcement agencies get a court ordered warrant to search data that has been stored for more than 180 days, bringing “old” and “new” data into line with one another.
Given Trump’s nominees… the stakes for privacy have never been higher. It’s crucial Congress act on ECPA reform so that Americans can feel safe in their 4th amendment rights.
Robyn Greene, policy counsel at the New America Foundation’s Open Technology Institute
One of the key motivations for the change is due to the fact that the costs of computer storage space have dropped drastically since 1986. At the same time, storage capacity has increased exponentially. This means that while in 1986 service providers were not expected to keep electronic data for extended periods of time (due to the cost) the norm nowadays is for such data to be kept indefinitely.
For example, services such as Dropbox and Gmail allow a large amount of data (a lifetime of emails, for example) to be stored online either at no cost to the user, or for a very low monthly fee. Facebook and Youtube allow users to upload essentially unlimited amounts of high definition video, all of which must be stored on servers somewhere and does not get deleted.
The amount of data and information that members of the public are now making available online, whether by their posts to internet forums like Reddit, via email, or on Facebook or Instagram, has never been greater or more personal. And with that, concerns about who has access to that information and how are paramount.
If the government wants to read your emails, then they should be required to obtain a warrant just like they would need in order to read your letters, search your hard drive or listen in on your phone calls. Technology has made incredible advances over the years, but the privacy laws for digital communications just haven’t kept pace. Right now, the rules governing how and when the government can access a person’s emails, photos, documents and other online communications are outdated and do not provide for the same Fourth Amendment protections given to on-paper or in-person communications.
Representative Darrell Issa (R-Calif.)
Critics of the change, on the other hand, say that it will become tougher for law enforcement agencies to swiftly and efficiently carry out their investigations. However given that this change simply aligns to two types of data (either older than 180 days or not) we think that’s a pretty weak argument.
Ensure you stay tuned to SafeMonk for further updates on the progress of the EPA as it now heads to the Senate.