Senate Judiciary Committee chairman Patrick Leahy (D-Vermont) proposed sweeping digital privacy protections Tuesday that would require the government, for the first time, to get a probable-cause warrant to obtain e-mail and other content stored in the cloud.

Leahy’s proposal (.pdf) would nullify a provision of the 1986 Electronic Communications Privacy Act that allows the government to acquire a suspect’s e-mail or other stored content from an internet service provider without showing probable cause that a crime was committed, as long as the content has been stored on a third-party server for 180 days or more. The government had only needed to show that it has “reasonable grounds to believe” the information would be useful in an investigation.

The act was adopted at a time when e-mail wasn’t stored on servers for a long time, but instead was held there briefly on its way to the recipient’s inbox. E-mail more than 6 months old was assumed abandoned.

“Since the Electronic Communications Privacy Act was first enacted in 1986, ECPA has been one of our nation’s premier privacy laws,” Leahy said in a statement. “But, today, this law is significantly outdated (.pdf) and outpaced by rapid changes in technology and the changing mission of our law enforcement agencies after Sept. 11. Updating this law to reflect the realities of our time is essential to ensuring that our federal privacy laws keep pace with new technologies and the new threats to our security.”

Civil rights groups applauded the proposal, but cautioned that it was not a complete victory for online privacy.

“We think this is the beginning of the discussion. This is a very positive step,” Chris Calabrese, legal counsel for the American Civil Liberties Union, said by telephone.

In today’s reality, e-mail and other personal content can and is being stored on servers forever. A consortium of businesses, including Google and Microsoft, has asked Congress to update the law and require probable cause to obtain content stored in the cloud, regardless of its age.

But the Leahy bill, which has not been sent to committee for review, is a give-and-take of sorts when it comes to other forms of electronic privacy.

It would require the government to get a probable-cause warrant to obtain real-time cellphone location data going forward. However, it would still not require authorities to get a warrant to obtain past cellphone location data of a suspect.

And the measure would also expand, or at least clarify, the information the government may obtain with so-called National Security Letters. They allow the FBI, without a court order, to obtain telecommunication, financial and credit records relevant to a government investigation. The Leahy bill adds “electronic communication identifiable information” and strikes “electronic communication transactional records.”

“It is not appropriate for the government to be able to get detailed information on everybody who you communicated with,” Kevin Bankston, a privacy lawyer with the Electronic Frontier Foundation, said by telephone.

That said, the bill is “a great leap forward,” Bankston said.

“Essentially, the message of the bill,” he said, “is, come back with a warrant.”

Photo: Sen Patrick Leahy (Senate.gov)

See Also: