The year was 1986. The New York Mets won the World Series against the Boston Red Sox, a series that included a still infamous error by the Boston first baseman. In football, Jim McMahon led the Chicago Bears to a Superbowl win, and the still-forgettable song and video “The Superbowl Shuffle.” A startup technology company called Quantum Computer Services Inc. was a year old and featured an online service called Q-Link that worked with the Commodore 64. Five years later, in 1991, the company would change their name to America Online Inc., also known as AOL. Back to the Future played in theaters; the second installment of that franchise featured Marty McFly traveling to the faraway future year 2015 to save his kids from peril. And in 1986, the Electronic Communications Privacy Act (ECPA) was passed by Congress and signed into law by President Reagan. Technology has advanced tremendously since 1986, however, the primary law that regulates disclosure of contents of computer communications and stored data is still the law of the land.

Few would have predicted in 1986 that e-mail would primarily replace paper-based mail as the primary means of communication, and that people would send business transactional and financial documents over e-mail. Fewer still might have predicted that cellular telephone technology would advance to the point that everyone would carry one at all times and they would be far more powerful than microcomputers of the day, or that a phone could be used as a tracker to determine its exact location. It should be no surprise, then, that many people believe the current safeguards against disclosure offered by the 1986 laws fall short in the current environment.

Calls for updates to the existing law are advanced by privacy experts, technology companies, and even the Department of Justice. Elana Tyrangiel, Acting Assistant Attorney General for the Office of Legal Policy, provided testimony to the House Judiciary Committee’s Subcommittee on Crime, Terrorism, Homeland Security, and Investigations, stating:

Acknowledging that the so-called “180-day rule” and other distinctions in the SCA [a provision within ECPA] no longer make sense is an important first step, the harder question is how to update those outdated rules and the statute in light of new and changing technologies while maintaining protections for privacy and adequately providing for public safety and other law enforcement imperatives.¹

Points for Improvement

Several deficiencies in the current law are frequently discussed as imperatives for change. Discussions of shortfalls and priorities for modernization of the 1986 Act frequently include:

• Treat all content consistently. Remove the distinction between content under 180 days old (which requires a search warrant) and content opened and over 180 days old (which requires a subpoena to be released). In an age where computer storage rates have dropped to the point of immateriality, and virtually unlimited storage space is available through cloud computing solutions, the difference between the ageing of content should be removed.

• Develop a suppression remedy. The suppression of evidence remedy under the Wiretap Act (Title III of the Omnibus Crime Control and Safe Streets Act of 1968) is provided pursuant to 18 U.S.C. §2515:

  “Whenever any wire or oral communication has been intercepted, no part of the contents of such communication and no evidence derived therefrom may be received in evidence in any trial, hearing, or other proceeding in or before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision thereof if the disclosure of that information would be in violation of this chapter.”² [italics for emphasis added by authors]

  Federal circuits have found that suppression of evidence is an unavailable remedy for violations of ECPA and interceptions of “electronic communications”³ and that the ECPA only provides a civil remedy for a violation of §2703.⁴

  Many people believe the same rules should apply for electronic and nonelectronic information: If evidence is illegally obtained, it should not be used against an individual in court.

• Determine required protection of location data. Smartphones can currently be used as personal tracking devices through (1) internal GPS data; (2) their connections to cell towers; and (3) portable tracking devices such as the StingRay (see Chapter 8). The treatment of such data was not considered in 1986 and is not covered by the Act. Courts have developed varying implementations of the safeguards over such data, but differ as to the degree of protection afforded such data. Refinements to the law should specifically address the procedures and authorizations required to access location data and connection information.
• Develop reporting mechanisms for discovery requests. Current laws define reporting requirements for wiretap orders, but do not specify reporting requirements for other types of surveillance requests.
• Define civil procedures for data access. The current law speaks to data release to a government agency, and offers no guidance for civil litigants to access cloud-stored data of opposing parties. Additionally, the current law specifies that the orders of any federal judge may authorize disclosure, but is silent on the powers of state-level judges outside of their jurisdiction.

Congressional Action

Congress has advanced several bills in recent years to amend the law. However, they have not advanced beyond the committee stage as of this writing.

On August 2, 2012, HR 6339 was introduced to the U.S. House of Representatives. The Electronic Communications Privacy Act Modernization Act of 2012 was referred to committee and was not advanced. The bill included proposals to require a search warrant for the production of any data:

Section 2703(a) of title 18, United States Code, is amended to read as follows:

(a) Contents of Wire or Electronic Communications:

(1) A governmental entity may require the disclosure by a provider of electronic communication service or remote computing service of the contents of a wire or electronic communication that is stored, held, or maintained by that service only pursuant to:

1. a warrant complying with the Federal Rules of Criminal Procedure and issued by a court with jurisdiction over the offense under investigation or equivalent State warrant; or
2. a court under title I or title VII of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq. and 1881 et seq.).

(2) Unless delayed notice is ordered under section 2705, not later than three days after a governmental entity receives contents of a communication under this subsection, the governmental entity shall notify the subscriber or customer concerned of the matters required in notices under, and by the means described in, paragraphs (4) and (5) of section 2705(a).⁵

HR 6339 contained provisions to require reporting related to the use of mobile tracking devices, and enhanced reporting of activities related to warrants compelling disclosure, including disclosure of cell tower data. Additionally, the bill included amendments to make suppression remedies the same for intercepted wire, oral, and electronic communications.

On March 20, 2013, S. 607: Electronic Communications Privacy Act Amendments Act of 2013 was introduced in the U.S. Senate. The bill included language nearly identical to HR 6339, and was referred to committee on May 7, 2013. It has not yet advanced out of the committee as of this writing.

Given the bourgeoning amounts of data in electronic storage and transmitted via e-mail, and the ongoing introduction of smartphones with feature sets unthinkable even a few years ago, Congress will eventually need to act to update the ECPA. There is currently a groundswell of awareness in the United States of electronic privacy issues, and while this focus may not be directly caused by weaknesses in the ECPA, it certainly would serve to provide political force supporting amendment of the law.