Consensus builds for requiring warrant for email searches

Republicans, Democrats and government officials agreed at a House hearing on Tuesday that police should need a warrant to obtain people's emails and other private online messages from third-party providers.

Rep. Jim SensenbrennerJames SensenbrennerRepublicans hammer Lynch for ceding Clinton decision to FBI GOP rips into Lynch, who refuses to discuss details in Clinton case For suburban women, addiction is a key election issue MORE (R-Wis.), the chairman of the Judiciary subcommittee on Crime, Terrorism, Homeland Security and Investigations, which was holding the hearing, said that only requiring a subpoena, instead of a warrant, to access emails is "outdated and probably unconstitutional."

"A probable cause standard should apply to the government’s ability to compel a communications provider to disclose a customer’s email message – no matter how old the message is," Rep. John Conyers (D-Mich.), the Judiciary Committee's ranking member, said.

Elana Tyrangiel, the acting assistant attorney general for the Justice Department's Office of Legal Policy, agreed that requiring a warrant has "considerable merit."

Greg Nojeim, a senior counsel for the Center for Democracy & Technology, a privacy advocacy group, said he was encouraged by the hearing.

"The committee hearing reflects a growing consensus around the idea that there should be a warrant for email content," he said in an interview.

Under the Electronic Communications Privacy Act (ECPA) of 1986, police only need a subpoena, issued without a judge's approval, to read emails that have been opened or that are more than 180 days old. 

When lawmakers passed ECPA more than 25 years ago, they failed to anticipate that email providers would offer massive online storage. They assumed that if a person hadn't downloaded and deleted an email within six months, it could be considered abandoned and wouldn't require strict privacy protections.

Traditionally, the courts have ruled that people have limited privacy rights over information they share with third-parties. Some police have argued that this means they only need a subpoena to compel email providers, Internet service companies and others to turn over their customers' sensitive content. 

Senate Judiciary Committee Chairman Patrick LeahyPatrick LeahyTop senators want details on probe of DNC breach The Hill's 12:30 Report NBA pulls All-Star Game from NC over bathroom law MORE (D-Vt.) and Sen. Mike LeeMike LeeObama signs opioid bill Thiel said to explain support for Trump in convention speech Convention erupts at Cruz snub MORE (R-Utah) introduced legislation on Tuesday that would require police to obtain a warrant to obtain private online messages, regardless of how old they are. 

Reps. Zoe Lofgren (D-Calif.), Ted PoeTed PoeOvernight Tech: Dem presses Facebook on gun sales | Praise for new librarian of Congress | Fourth Amendment Caucus to push privacy concerns Overnight Cybersecurity: Guccifer 2.0 releases more DNC docs; China hacked banking regulator Texas lawmaker announces leukemia diagnosis MORE (R-Texas) and Suzan DelBeneSuzan DelBeneOvernight Tech: First on The Hill – Key senators team up against robocalls | Social media giants back revenge porn bill | Facebook's diversity numbers Overnight Tech: Feds pressed to review social media in background checks Small businesses and the woman card MORE (D-Wash.) have introduced legislation in the House that would require a warrant to access mobile location data in addition to emails and other online messages.

"Everybody agrees the statute needs to be amended. The question is how," Orin Kerr, a George Washington University law professor who testified at the hearing, said in an interview.

Tyrangiel urged lawmakers to exempt civil regulatory investigations, which cover issues such as antitrust enforcement; environmental regulation and civil rights protection, from the warrant requirement. 

She explained that regulators investigate conduct that is unlawful, but not necessarily criminal. She argued that because regulators often do not have access to the warrant power, the requirement would impede critical government investigations. 

The bill introduced by Leahy and Lee on Tuesday would not exempt government regulators from the warrant requirement. They would still be allowed to subpoena companies directly for their records, just not the third-party email providers. 

Richard Littlehale, a special agent for the Tennessee Bureau of Investigation, did not object to expanding ECPA, but he urged lawmakers to include a provision requiring communications providers to comply with legal demands within a reasonable time.

"Responding to law enforcement legal demands costs service providers money and does not generate revenue however, and so there is little financial incentive to innovate or increase staffing levels," he said. "Therefore, a reasonable legal mandate for responsiveness may be the best solution to this problem."

Richard Salgado, Google's director of law enforcement and information security, said the lack of adequate privacy protections has been a "drag on the adoption" of email and other cloud services.

He said that Google believes the Fourth Amendment provides broader privacy protection than ECPA and that the company and other communications providers already refuse to turn over users' messages without a warrant.

Although Sensenbrenner said ECPA is outdated and needs to revised, he warned that striking the right balance between privacy protection and empowering law enforcement will be a "tough nut to crack" for Congress.

Judiciary Committee Chairman Bob GoodlatteBob GoodlatteCongress leaving for seven-week recess Bipartisan House group to work on police issues House conservatives 'committed' to impeaching IRS chief MORE (R-Va.) said updating ECPA will be one of his top priorities, but he stopped short of endorsing any particular proposal.