Time to Update the Electronic Communications Privacy Act?
As discussed in the chapter, the Electronic Communications Privacy Act (ECPA) deals with three main issues: (1) the protection of communications while in transfer from sender to receiver; (2) the protection of communications held in electronic storage; and (3) the prohibition of devices from recording dialing, routing, addressing, and signaling information without a search warrant. The ECPA makes it a crime to intercept or obtain electronic communications unless otherwise provided for under law or an exception to ECPA.
While the ECPA provides many important and useful protections, much of today's communications technology was not even available when the act was enacted more than 30 years ago—ubiquitous personal computers, the Internet and the World Wide Web, mobile computing and communications devices, social networks, and cloud computing. Nor was email used as widely as it is now so emails were sent and received with little thought about the need to preserve them nor did people ever consider that emails might be saved on servers somewhere and be subject to a search warrant.
Under 18 U.S.C. § 2703(d) of the ECPA, law enforcement can obtain a court order—called a 2703(d) order—to compel a computer service provider (e.g., a cloud computing service provider, social network operator, or email service provider) to disclose detailed records about a customer's or subscriber's use of services, such as account activity logs that reflect what Internet protocol (IP) addresses the subscriber visited over time, the addresses of others from and to whom the subscriber exchanged email, and contact lists. The ECPA also provides for gag orders, which direct the recipient of a 2703(d) order to refrain from disclosing the existence of the order or the investigation. This means that a computer service provider served with such an order cannot inform its customers that their emails are being searched. The government has issued hundreds of thousands of such NSLs accompanied by gag orders.
As part of a drug investigation, in December 2013, the federal government applied for a search warrant under a 2703(d) order to obtain the contents of emails and other details from a user account hosted by Microsoft. While the noncontent data were stored in the United States, the contents of the emails were stored on one of Microsoft's servers located in Dublin, Ireland. Microsoft refused to turn the emails over to the government, arguing that email stored on computer servers in another country cannot be obtained through a warrant issued by a U.S. court because the reach of such a warrant does not extend beyond the United States. This position was supported by several other technology companies, including rivals of Microsoft. After a two-year battle, a U.S. appeals court panel ruled in Microsoft's favor. If this ruling had gone against Microsoft, U.S. law enforcement would have been given jurisdiction to access digital content stored by U.S. companies, no matter where in the world it was stored. Such approval could have jeopardized the future of international cloud computing as well as other computer services.
In a separate, but related case, in April 2016, Microsoft sued the U.S. government for the right to inform its customers when a federal agency is examining its customers' emails. Over a period of 18 months ending in March 2016, Microsoft received more than 5, XXXXXXXXXXd) orders, nearly half of which barred Microsoft from informing its customers that the government was seeking their data through warrants, subpoenas, and other requests. Microsoft asserted that these gag orders violated its First Amendment right to inform its customers about the search of their files. In addition, Microsoft charged that law enforcement use of gag orders "flouts" Fourth Amendment requirements that the government provides notice to people when their property is being searched or seized. In the suit, Microsoft argued that "people do not give up their rights when they move their private information to the cloud," Microsoft further argued that the federal government "has exploited the transition to cloud computing as a means of expanding its power to conduct secret investigations." Over two dozen technology and media organizations filed briefs in support of Microsoft in this case, including Apple, Amazon, Fox News, Google, National Public Radio, the Washington Post, and Yahoo.
Critical Thinking Questions
1. Do you believe that it is time to consider changes to the ECPA to bring it more in line with the Bill of Rights, or do you believe that concerns about terrorism and crime justify efforts to revise the Bill of Rights?
2. Congress proposed legislation in both 2013 and 2015 to revise the ECPA; however, the changes never made it through the legislative process. Do the research and write a brief summary explaining why no action was taken.
3. Why do you think media organizations would support Microsoft in its suits against the United States over the provisions of the ECPA?