Consensus builds for requiring warrant for email searches

Republicans, Democrats and government officials agreed at a House hearing on Tuesday that police should need a warrant to obtain people's emails and other private online messages from third-party providers.

Rep. Jim SensenbrennerFrank (Jim) James SensenbrennerDoug Collins to run for House Judiciary chair Lawmakers renew call for end to 'black budget' secrecy 2018: Time for Congress to listen — or face the consequences MORE (R-Wis.), the chairman of the Judiciary subcommittee on Crime, Terrorism, Homeland Security and Investigations, which was holding the hearing, said that only requiring a subpoena, instead of a warrant, to access emails is "outdated and probably unconstitutional."

"A probable cause standard should apply to the government’s ability to compel a communications provider to disclose a customer’s email message – no matter how old the message is," Rep. John Conyers (D-Mich.), the Judiciary Committee's ranking member, said.

Elana Tyrangiel, the acting assistant attorney general for the Justice Department's Office of Legal Policy, agreed that requiring a warrant has "considerable merit."

Greg Nojeim, a senior counsel for the Center for Democracy & Technology, a privacy advocacy group, said he was encouraged by the hearing.

"The committee hearing reflects a growing consensus around the idea that there should be a warrant for email content," he said in an interview.

Under the Electronic Communications Privacy Act (ECPA) of 1986, police only need a subpoena, issued without a judge's approval, to read emails that have been opened or that are more than 180 days old. 

When lawmakers passed ECPA more than 25 years ago, they failed to anticipate that email providers would offer massive online storage. They assumed that if a person hadn't downloaded and deleted an email within six months, it could be considered abandoned and wouldn't require strict privacy protections.

Traditionally, the courts have ruled that people have limited privacy rights over information they share with third-parties. Some police have argued that this means they only need a subpoena to compel email providers, Internet service companies and others to turn over their customers' sensitive content. 

Senate Judiciary Committee Chairman Patrick LeahyPatrick Joseph LeahyTop Senate Dems demand report from Trump on UK nerve agent attack The Hill's 12:30 Report McCabe oversaw criminal probe into Sessions over testimony on Russian contacts: report MORE (D-Vt.) and Sen. Mike LeeMichael (Mike) Shumway LeeConservatives balk over funding bill ahead of shutdown  Overnight Defense: Senate sides with Trump on military role in Yemen | Dem vets push for new war authorization on Iraq anniversary | General says time isn't 'right' for space corps Senate sides with Trump on providing Saudi military support MORE (R-Utah) introduced legislation on Tuesday that would require police to obtain a warrant to obtain private online messages, regardless of how old they are. 

Reps. Zoe Lofgren (D-Calif.), Ted PoeLloyd (Ted) Theodore PoeDoug Collins to run for House Judiciary chair Perry cites competition from Russia, China to defend nuclear talks with Saudis Water has experienced a decade of bipartisan success MORE (R-Texas) and Suzan DelBeneSuzan Kay DelBeneHouse panel begins evaluation of expired tax breaks A new NAFTA for the digital age Dem seeks to curb tax breaks for employee buyouts over sexual misconduct MORE (D-Wash.) have introduced legislation in the House that would require a warrant to access mobile location data in addition to emails and other online messages.

"Everybody agrees the statute needs to be amended. The question is how," Orin Kerr, a George Washington University law professor who testified at the hearing, said in an interview.

Tyrangiel urged lawmakers to exempt civil regulatory investigations, which cover issues such as antitrust enforcement; environmental regulation and civil rights protection, from the warrant requirement. 

She explained that regulators investigate conduct that is unlawful, but not necessarily criminal. She argued that because regulators often do not have access to the warrant power, the requirement would impede critical government investigations. 

The bill introduced by Leahy and Lee on Tuesday would not exempt government regulators from the warrant requirement. They would still be allowed to subpoena companies directly for their records, just not the third-party email providers. 

Richard Littlehale, a special agent for the Tennessee Bureau of Investigation, did not object to expanding ECPA, but he urged lawmakers to include a provision requiring communications providers to comply with legal demands within a reasonable time.

"Responding to law enforcement legal demands costs service providers money and does not generate revenue however, and so there is little financial incentive to innovate or increase staffing levels," he said. "Therefore, a reasonable legal mandate for responsiveness may be the best solution to this problem."

Richard Salgado, Google's director of law enforcement and information security, said the lack of adequate privacy protections has been a "drag on the adoption" of email and other cloud services.

He said that Google believes the Fourth Amendment provides broader privacy protection than ECPA and that the company and other communications providers already refuse to turn over users' messages without a warrant.

Although Sensenbrenner said ECPA is outdated and needs to revised, he warned that striking the right balance between privacy protection and empowering law enforcement will be a "tough nut to crack" for Congress.

Judiciary Committee Chairman Bob GoodlatteRobert (Bob) William GoodlatteDoug Collins to run for House Judiciary chair House Judiciary chair subpoenas DOJ for FBI documents House Judiciary chair to subpoena for FBI documents MORE (R-Va.) said updating ECPA will be one of his top priorities, but he stopped short of endorsing any particular proposal.