In a rare win for privacy, the House of Representatives voted unanimously today to close a loophole in an existing law that allows the government to access emails stored in the cloud without a warrant. The vote sets up a fight in the Senate that may presage other battles over the proper limits on surveillance to come later in the year.
The new legislation reforms a thirty-year-old statute called the Electronic Communications Privacy Act (ECPA). Under ECPA, if an email has been stored for at least 180 days, the government can access that message with no more than a subpoena or court order. That means, if for some reason the FBI wanted to read the email you sent your mother on her birthday in August, they could do so without probable cause.
The “180-day rule” is a relic. ECPA passed in 1986, three years before Tim Berners-Lee invented the World Wide Web. Email was done in terminals at big research universities. The first commercial email services, MCI Mail (’88) and Compuserve (’89), were still years away. Electronic storage was prohibitively expensive. Email providers rarely held on to messages for more than a few months. Emails over 180 days old, to the extent they existed, were considered “abandoned property.” Congress didn’t contemplate a future in which our email inboxes stretched back years. Today, people store hundreds of thousands of emails in the cloud, amounting to an intimately detailed portrait of a person’s life and thoughts. And under ECPA, the vast majority of them are fair game.