A Senate committee today backed sweeping privacy protections requiring the government, for the first time, to get a probable-cause warrant to obtain e-mail and other content stored in the cloud.
The Senate Judiciary Committee approved the package on a voice vote after about 30 minutes of debate, and sent the measure to the Senate floor, where it faces an uncertain future.
The legislation, (.pdf) sponsored by Sen. Patrick Leahy (D-Vermont), the committee’s chair, and Michael S. Lee (R-Utah) nullifies a provision of federal law allowing the authorities to acquire a suspect’s e-mail or other stored content from an internet service provider without showing probable cause that a crime was committed if the content is 180 days or older.
Under the current law, the 1986 Electronic Communications Privacy Act, the government can obtain e-mail without a warrant as long as the data has been stored on a third-party server — the cloud — for 180 days or more. The government only needs to show, often via an administrative subpoena, that it has “reasonable grounds to believe” the information would be useful to an investigation.
Initially, ECPA provided privacy to users, but that privacy protection eroded as technology advanced and people began storing e-mail and documents on servers for longer periods, sometimes indefinitely. The act was adopted at a time when e-mail wasn’t stored on servers for a long time, but instead was held briefly on its way to the recipient’s inbox. E-mail more than 6 months old was assumed abandoned.