The Electronic Communications Privacy Act (ECPA), the law that sets the standards by which authorities can access electronic communications and data, turns 25 years old this week. Yet many of the electronic technologies it covers — technologies we use day in and day out — are much younger. Just think: ECPA took effect a decade before the World Wide Web took off, before most people used email, before there were smartphones and mobile-location technologies, before there was social media or cloud computing.
These technologies have raced ahead while the law has lagged behind. And not surprisingly, courts have interpreted ECPA inconsistently through the years, creating a confusing and uncertain environment for both service providers and law enforcement agencies.
The Digital Due Process (DDP) coalition, of which BSA is a member, has catalogued some egregious examples:
A single email is subject to multiple different legal standards in its lifecycle, from the moment it is being typed to the moment it is opened by the recipient to the time it is stored with the email service provider. To take another example, a document stored on a desktop computer is protected by the warrant requirement of the Fourth Amendment, but the ECPA says that the same document stored with a service provider may not be subject to the warrant requirement.
Most concerning, under ECPA the government can force service providers to turn over private communications and track their customers’ movements without a warrant from a judge.
As we mark the silver anniversary of ECPA, consensus about the need for reform is starting to gel in Washington. For example, Sen. Patrick Leahy (D-Vt.) introduced legislation this summer that would require law enforcement to obtain a search warrant to access personal communications and current location data from mobile devices. This week, Sen. Mark Kirk (R-Ill.) signed on as a co-sponsor to another bill introduced by Sen. Ron Wyden (D-Ore.) — and Reps. Jason Chaffetz (R-Utah) and Bob Goodlatte (R-Va.) in the House. It would require a warrant to obtain location data generated by a cellphone or other mobile device or by a covert law enforcement tracking device.
We must update ECPA to clarify its standards while preserving the tools needed to protect the public — making it relevant to both today’s technology landscape and the technology innovations of tomorrow.