A Senate committee on Thursday delayed until after the November elections whether to approve sweeping digital privacy protections requiring the government, for the first time, to get a probable-cause warrant to obtain e-mail and other content stored in the cloud.
The move by the Senate Judiciary Committee to table considering the first meaningful rewrite of the 1986 Electronic Communications Privacy Act comes as law enforcement urged the committee to evaluate how crime fighting would be impacted under what would be the biggest advance to digital privacy following the act's original adoption during the President Ronald Reagan administration.
Lawmakers are expected to recess at week's end until after the elections.
"Any effort to revise ECPA should involve detailed and careful consideration of the consequences of proposed changes on the ability of law enforcement investigators to conduct their work efficiently and effectively on behalf of American citizens," the six different police groups wrote (.pdf) the committee. They include the National District Attorneys' Association, National Narcotic Officers' Associations' Coalition, National Sheriffs' Association, the Major County Sheriffs' Association, Major Cities Chiefs of Police Association and Association of State Criminal Investigative Agencies.
The package the Judiciary Committee was considering sending to the Senate floor Thursday nullifies a provision of the Electronic Communications Privacy Act that allows the government to acquire a suspect's e-mail or other stored content from an internet service provider without showing probable cause that a crime was committed -- as long as the content has been stored on a third-party server for 180 days or more. Currently, the government only needs to show, often via an administrative subpoena, that it has "reasonable grounds to believe" the information would be useful in an investigation.
When enacted almost three decades ago, ECPA provided real privacy. But not as technology advanced and people began storing e-mail and documents on servers indefinitely. And Congress has so far been unwilling to change course, despite Fourth Amendment privacy concerns.
The act was adopted at a time when e-mail wasn't stored on servers for a long time, but instead was held there briefly on its way to the recipient's inbox. E-mail more than six months old was assumed abandoned. And personal cloud storage didn't really exist in 1986.
The measure was floated by Sen. Patrick Leahy (D-Vermont) and the chairman of the Senate Judiciary Committee. A similar proposal Leahy floated last year never even got a hearing, and died for lack of legislative support.
"I drafted these privacy updates in careful consultation with representative from the privacy, civil liberties, technology and law enforcement communities. I did so mindful of the fact that we must update these privacy laws in a way that does not inadvertently undermine law enforcement's ability to keep us safe," Leahy said, before vacating a yes-or-no vote. "Others have come to the discussion only recently. I am and will be working to consider all legitimate concerns."
Chris Calabrese, the legislative counsel for the American Civil Liberties Union, which is lobbying for the measure, said "this isn't surprising with something this complicated."
"I don't think it's a step backwards," he added.
Leahy, the sponsor of the original Reagan-era law, has attached his digital-privacy reform as an amendment (.pdf) to a legislative package concerning video-rental privacy and Netflix that already has momentum.
The Video Privacy Protection Act prohibits Netflix customers from allowing their Facebook streams to automatically update so their friends know what movies they are watching. Spotify and other online music streaming customers, however, can consent to the automatic publication on Facebook of the songs they're listening to.
The reason for the disparity is that the Video Privacy Protection Act outlaws the disclosure of video rentals unless the consumer gives consent, on a rental-by-rental basis. Congress adopted the measure in 1988 after failed Supreme Court nominee Robert Bork's video rental history was published by the Washington City Paper during confirmation hearings.
The House passed a measure last year limiting the act's reach to allow Facebookers to consent to having their timelines automatically updated with whatever they're watching on Netflix -- legislation Netflix and Facebook have been lobbying for heavily.
For digital rights groups, the tradeoff in loosening one privacy protection while strengthening another makes them uneasy.
"Senator Leahy's language significantly rewrites the VPPA and breaks down its core privacy protections. The proposed language allows for one-time advance consent -- blanket sharing for any and all videos a user watches without any nuance as to who the user is sharing the information with or what exactly the user is giving up control over," the Electronic Frontier Foundation warned Wednesday.
That said, the pro-privacy aspect of Leahy's measure simply requires the authorities to get a probable-cause warrant from a judge to access electronic information stored in the cloud, just like a warrant would be needed to search a house or somebody's papers and affects or a hard drive.