Warrants Should Be Required For Email Access

Last week, I attended the International Association of Privacy Professional’s Washington DC conference and I was impressed with the topics that were discussed.  The keynotes by journalist Glenn Greenwald and Harvard Professor Michael Sandel were top notch and so were all of the sessions that I attended. 

One panel that I found interesting was titled, “Search Warrants vs. Privacy Laws: Can They Live Together”.  The session was moderated by Professor Peter Swire of Georgia Tech and included Bruce Brown, the Executive Director of the Reporter’s Committee for Freedom of the Press; Nuala O’Connor, President of the Center for Democracy and Technology; and Andrew Pincus a partner at the international law firm of Mayer Brown. 

At first glance, this topic sounds boring and highly legalistic.  However, the issues that were discussed affects everyone who utilizes email, has a cloud based storage account, or other digital based service.  One of the questions discussed during the panel was should a warrant be required for an Internet Service Provider (ISP) to turn over an email or other digital content to law enforcement?  The answer to this question is important because under the Electronic Communications Privacy Act (ECPA) which was enacted in 1986, the government may read any email without a warrant that is more than 180 days old.     

ECPA was written approximately 8 years before The Today Show and other national media outlets started to cover the Internet or the “Information Superhighway”.  The way we communicate has drastically changed in the past 30 years.  For example, instead of sending traditional U.S. postal service mail many people send emails and utilize messaging apps and other digital technologies because these platforms are generally less expensive and faster.  Since our old school traditional paper correspondence is protected from the government absent a warrant shouldn’t our digital communications have the same protections?

Last year, in Riley v. U.S. the Supreme Court ruled 9-0 that we have an expectation of privacy in the Digital Age and that the police are generally required to obtain a warrant to search a personal digital device.  This case built upon the 2012 U.S. v. Jones case that ruled a warrant was required to place a GPS tracker onto a car.  Following the reasoning in both of these Supreme Court cases, a California federal district court ruled last week that police need a warrant to obtain access to one’s cell phone location or GPS data. 

These recent cases have signaled that we still have an expectation of privacy despite new forms of digital communications and surveillance techniques. Unfortunately, an ongoing matter that has major privacy and public policy implications has not followed the Supreme Court’s lead in recognizing the importance of establishing clear digital privacy rights. 

In Microsoft v. U.S., the company is arguing that the government must obtain a warrant or other court order in the host country of where a digital communication is located even though the company may have the capability of providing access to the document from the United States.  On page 36 of 73 in the U.S. response [that was filed on 3/9/15] to Microsoft's argument that the government must obtain a warrant to obtain access to an email it states, [b]ecause the emails sought in this investigation are now more than 180 days old the plain language of the SCA [Stored Communications Act of ECPA] would authorize the government to use a subpoena to compel disclosure of everything it sought pursuant to the Warrant."  

The government's argument is disconcerting; however, so far the courts have ruled that a warrant is not needed for emails older than 180 days.  The government's interpretation of the SCA that emails older than 180 days do not need a warrant to be turned over demonstrates that more education is needed about these issues. 

In general, the government is required to obtain a warrant or have exigent circumstances (i.e. occurs when people are in imminent danger, when evidence may be destroyed, or when a suspect is on the run) to be able to gain entrance into your tangible property (i.e. your home, or car, etc..) so it should be required to obtain a warrant to gain access to your digital property (i.e. your email account, cloud storage, etc...).   

As a hedge against the courts continuing to follow an outdated and unconstitutional law (the SCA), its time to support a long overdue legislative fix to the situation.  The bipartisan Law Enforcement Access to Data Stored Abroad  Act (LEADS Act) follows a common sense philosophy that by properly balancing law enforcement’s need to obtain access to digital data with our privacy.  The Act would update the SCA of ECPA to account for the changes in technology that have occurred during the past 30 years and how we communicate with each other. 

In general, it takes time before the law catches up with the capabilities of technology.  This is true across many industries.  However, we must not forget that we still have an expectation of privacy in the Digital Age and now is the time to stand up for that right.  If it becomes law, the LEADS Act will signal to the rest of the world that the U.S. is serious about taking a leadership role in protecting the privacy rights of Internet users not just here but also around the globe.

Copyright 2015 by Shear Law, LLC All rights reserved.