Today was the first hearing in what many of us hope will be a successful update to the archaic Electronic Communications and Privacy Act in this year's Congress. The law, written in 1986, allows the government to argue that private online messages older than 180 days are not protected by the Fourth Amendment and that the government can access the messages without a warrant. EFF, along with the Digital Due Process coalition has been pushing for the past few years to update the law. Shortly after the hearing in the House, Senators Leahy and Lee introduced final language to reform ECPA in the Senate. With Rep. Lofgren's language, there is now language to update ECPA in both houses of Congress. Help us update ECPA by telling your Congressmen to support reform.
In the hearing, the Department of Justice (DOJ) finally conceded that users have a reasonable expectation of privacy in email older than 180 days. Of course, users have known this for years. But up until now, ECPA has allowed the DOJ to argue otherwise. The argument was stopped, but only in the Sixth Circuit, after the court ruled in US v. Warshak that the 180 day rule, as written, is unconstitutional. Now, after years of legal battles—in which we are a lively member—the DOJ has finally conceded an important impediment to ECPA reform.
Despite agreeing that users have a reasonable expectation of privacy in emails older than 180 days, the DOJ was adamant that federal civil agencies must have a new exception to ECPA to bypass any warrant requirements in civil cases. This exception defeats the principles behind why we're fighting to reform ECPA. And it's just another way for DOJ to ignore fundamental constitutional rights.
The hearing also witnessed some surprise testimony by Richard Littlehale, a Tennessee state investigator who works for what is essentially Tennessee's state-equivalent of the FBI. Littlehale was adamant about ensuring a mandatory data retention requirement in any update to ECPA. Since 2011, Subcommittee Chairman Sensenbrenner has been adamently opposed to a data retention bill. Unfortunately, Littlehale's testimony was littered with erroneous conflations. For starters, ECPA reform is about clarifying—and ensuring—the protections already granted to users by the Constitution. Data retention requirements have no place in such reforms.
On the other side of the Capitol, in the Senate, we're excited to see the introduction of language by Senators Leahy and Lee to reform ECPA. The bills in the House and Senate follow up on the legislative success of last Congress, where the Senate Judiciary Committee voted in favor of ECPA reform. These actions are encouraging signs that ECPA reform will move forward in Congress.
We're glad to see ECPA reform robustly moving. And with your help, Congress is taking notice of the courts and of users' opinions. The House hearing was only a first step. With bills in both houses of Congress the future of ECPA reform is bright. Users should be guaranteed the same rights in their virtual lives as they are in their physical lives. We look forward to a Senate hearing on ECPA reform and eventually a vote in Congress to update the sorely outdated privacy law.
