The U.S. House of Representatives is moving forward with updating the three-decade-old Electronic Communications Privacy Act (ECPA). The new bill, called the Email Privacy Act (H.R.) 699, should require a judicial warrant for any digital data request for electronic private communications from the government.
The EPA has already gathered almost three quarters of the members of the House as co-sponsors for the bill, which shows strong support in the House for privacy reform. Rep. Bob Goodlatte, who is the Chair of the House Judiciary Committee, scheduled a committee meeting on Wednesday to move the bill forward.
When the bill was last discussed, it contained some strong features such as having the government notify the users of a service when the company holding their communications received a warrant, but also some less desirable provisions such as exceptions for law enforcement to request data during "emergencies."
The problem with such provisions is that they eventually tend to get abused for situations that are nothing like an emergency, and it would be up to the companies to fight the government in court when they think the warrant isn't appropriate.
In a new amendment proposed by Goodlatte, called the Manager's Substitute Amendment, there wouldn't be anymore “carveouts” for law enforcement in emergency situations. However, the amendment seems to have made a “compromise,” and also eliminates the warrant notice from the government. The good news is that companies would still be allowed to notify their users about the warrant if they want to.
It still makes little sense that digital privacy isn’t as protected as real-world privacy is by U.S. laws simply because it’s easier for law enforcement to not offer those protections. When law enforcement wants to search your house, you are automatically notified that they want to do it because you see them coming to your house.
However, in the digital world, it seems okay for the government not to do that because it’s not asking for the data directly from you, but from the entity holding your information--the same entity that you have entrusted to keep your data safe from any unauthorized party.
The EFF and other organizations decided that although they don’t like this change in the EPA, the elimination of the emergency request exception is a net benefit for users of online communications services. The coalition containing tens of organizations and companies sent the Committee a letter in which they show their support for the Manager's Substitute Amendment:
"We, the undersigned civil society organizations, companies and trade associations, write to express our support for the Manager’s Substitute Amendment to the Email Privacy Act (H.R. 699). As amended, the Act updates the Electronic Communications Privacy Act (ECPA), the law that sets standards for government access to private internet communications, to reflect internet users’ reasonable expectations of privacy with respect to emails, texts, notes, photos, and other sensitive information stored in 'the cloud,'" said the group in an open letter to the House Judiciary Committee.
The EFF also supports Rep. Zoe Lofgren’s Online Communication and Geolocation Protection Act (H.R. 656) and Rep. Jason Chaffetz's GPS Act amendments, which would require a warrant for geolocation data, and it would also give courts permission to throw out evidence obtained through illegal means in a criminal case.
The EPA also eliminates the 180-rule from the old ECPA law that allowed the government to obtain emails that were more than 180 days old. It would also reject the DoJ’s interpretation of the law that allows it to request any email that has been “opened” without a warrant.
The bill should pass through the House Committee today, after which time it’s expected to receive a vote on the House floor, in the next few months.
Lucian Armasu is a Contributing Writer for Tom's Hardware. You can follow him at @lucian_armasu.
