US House unanimously passes Email Privacy Act

library
crime | hacking | security

The US House of Representatives on Wednesday unanimously passed the Email Privacy Act: a bill that will require investigators to get a warrant before they can force technology companies to hand over customers’ email or other electronic communications, no matter how old the communications.

The bill’s fate in the Senate is unclear, though support is clearly strong on its way to the upper chamber: The House’s 419-0 vote comes on top of likewise unanimous support in the House Judiciary Committee earlier this month.

If passed by the Senate, the act will close a loophole in the Electronic Communications Privacy Act (ECPA) of 1986.

That law allowed law enforcement to use a subpoena, rather than a warrant, to get email that’s older than 180 days.

Supporters of the Email Privacy Act say that the ECPA is outdated, given that it was written before the rise of the internet and low-cost data storage.

House Judiciary Committee Chairman Bob Goodlatte, a Republican from Virginia:

In 1986, mail was sent through the US Postal Service, a search engine was called a library, tweets were the sounds made by birds in the trees, and clouds were found only in the sky. In 1986, computer storage was finite and expensive.

It was unheard of that a commercial product would allow users to send and receive communications around the world for free and store those communications for years.

In separate news, Microsoft also took aim at the government’s use of the ECPA earlier this month when it sued the government over gag orders used to silence companies when law enforcement demanded tech company customers’ data.

The company said that the government’s use of gag orders to pry into its customers’ email has gotten “routine.” Moreover, most of those orders last forever, having no termination date.

The Electronic Frontier Foundation (EFF), which is one of a coalition that’s been pushing for overhaul of the ECPA for the past six years, noted that the Email Privacy Act is a compromise.

What it’s still missing, according to the EFF:

A requirement that the government notify users when it seeks their online data from service providers: “a vital safeguard ensuring users can obtain legal counsel to fight for their rights.”
A requirement that the government obtain a warrant when demanding a person’s geolocation data, and suppression of that data in court if the government fails to do so.

Even so, the EFF is applauding the House’s passage of the bill and is urging the Senate to pass it without amendments that could weaken the legislation.