The Bill Our Privacy Desperately Needs in the Digital Age

Today Senators Mike Lee (R-UT) and Patrick Leahy (D-VT) introduced a sweeping, bipartisan measure to modernize our electronic communication privacy laws. Lee and Leahy have long been champions of reform, advancing measures such as the Email Privacy Act. The ECPA Modernization Act of 2017 goes well beyond that effort and proposes important updates to the Electronic Communications Privacy Act (ECPA) – a law Senator Leahy helped draft more than 30 years ago – to address the reality of communications in the modern digital age.

While ECPA was impressively forward-looking when it was passed, the rapid pace of technological change has made many of its provisions inadequate to protect the privacy of Americans. The most important, privacy-protective provisions that this [name of bill] would address are:

• Warrant requirement for communications stored in the cloud:  Law enforcement seeking to obtain communications content, such as emails, photos, or texts held by a third party, would first have to obtain a warrant. The actual text in the bill is the same as that of the Email Privacy Act, which was twice passed unanimouslyhere, here and here.
• Warrant requirement for location information: One unfortunate side effect of the mobile revolution is that we are not just carrying around a smartphone, but we are also carrying around a portable tracking device – one that routinely shares our location with 3rd parties. This bill would make it a requirement for law enforcement to obtain a warrant before accessing location information. As Justice Sotomayor wrote in United States v. Jones “Disclosed in [GPS] data . . . will be trips the indisputably private nature of which takes little imagination to conjure: trips to the psychiatrist, the plastic surgeon, the abortion clinic, the AIDS treatment center, the strip club, the criminal defense attorney, the by-the-hour motel, the union meeting, the mosque, synagogue or church, the gay bar and on and on.” Revealing this type of sensitive information to the government simply can’t be the price for enjoying the convenience of mobile technologies.
• New limits on metadata collection: Metadata is data our devices and web services generate about how we communicate. It is not the contents of communication, but information such as who we are calling or texting, our friends on social media and where we go online. This was not protected under ECPA, but with this bill, the government would have to specify why it needs particular types of data and be limited to gathering just that type of data. The bill also improves how specific types of phone records are collected (known as call detail records), making it so that the protections apply whether the collection happens in real time or after the records are stored by a provider.
• Notice of when a search occurs: This legislation would put an affirmative obligation on the government to tell people when they invade their privacy. In the physical world when the government enters your home with a search warrant, you know about it (most of the time). This lets you contest the constitutionality of the search and learn when your privacy was invaded. But currently in the online world, because our communications are held by 3rd party service providers, we don’t automatically learn about searches (unless providers tell us).
• Reform of gag rules: Sometimes the subject of an investigation can’t be informed that investigation is happening – it might cause the suspect to flee or tamper with evidence. In those cases, a provider is gagged from telling a customer about the search. Unfortunately, in recent years those rules have been abused and orders have been too frequently sealed, sometimes forever. For example, over a recent 18-month period, Microsoft received 5,624 requests from federal law enforcement. 2,576 were under seal. This section reforms those rules so that gags can only last for a set period before the subjects of investigation are automatically alerted.
• Suppression remedy: The Lee-Leahy bill would create a real remedy for illegal actions taken by the government in collecting electronic communications, mirroring existing protections found in federal wiretapping statutes. Under the Fourth Amendment, when the government collects information in violation of the law, a suspect has the right to go to a court and get that information thrown out or, in legal terminology, suppressed. This is a key protection which keeps the police honest by giving them a clear incentive to play by the rules. This remedy doesn’t exist in ECPA right now, meaning that if police conduct an illegal search under today’s law, the suspect has no recourse.

All of these updates reflect to real, fundamental updates that are necessary for citizens to enjoy their full Fourth Amendment rights regardless of what form of communications they use. Please reach out to your Senator and urge them to cosponsor the ECPA Modernization Act and join with Senator’s Lee and Leahy in building bipartisan support for comprehensive privacy reform.