Updating an E-Mail Law From the Last Century

Senator Patrick Leahy said overhauling the law is his top priority this year

Steven Warshak, a Cincinnati businessman who built an empire selling male sexual enhancement drugs, was convicted of wire fraud several years ago, based in large part on his e-mail correspondence, which authorities had extracted via a subpoena under a 1986 law governing electronic privacy.

But a federal appeals court in Ohio later found that the government had violated Mr. Warshak’s constitutional right to privacy. The court said investigators should have convinced a judge that there was probable cause and obtained a search warrant, as though his messages had been stashed in a desk drawer. Although the court let the conviction stand, the case highlighted the conflicting legal rules that govern electronic privacy.

Congress is now set to clarify those rules, bringing that quarter-century-old law, the Electronic Communications Privacy Act, or E.C.P.A., in line with the Internet age.

On Thursday, the Senate Judiciary Committee unanimously passed a measure that would require the government to get a search warrant, issued by a judge, to gain access to personal e-mails and all other electronic content held by a third-party service provider. The bill still needs the approval of the full Senate.

The current statute requires a warrant for e-mails that are less than six months old. But it lets the authorities gain access to older communications — or bizarrely, e-mails that have already been opened — with just a subpoena and no judicial review.

The law governs the privacy of practically everything entrusted to the Internet — family photos stored with a Web service, journal entries kept online, company documents uploaded to the cloud, and the flurry of e-mails exchanged every day. The problem is that it was written when the cloud was just vapor in the sky.

Silicon Valley companies as well as advocacy groups from the political left and right have been lobbying for change for many years, and reform legislation seems to be gaining broad political support. Even the Justice Department appears to have approved one major change: requiring law enforcement to get a search warrant for all kinds of electronic content, no matter how long it has been in electronic storage or what exactly electronic storage means.

“Changing the law has become more of an imperative because of the growth of cloud computing, because everyone including members of Congress are storing sensitive info with third-party providers and they want it to be protected,” said Greg Nojeim, senior counsel at the Washington-based Center for Democracy and Technology, which is financed partly by Silicon Valley companies and which is part of a coalition pushing for reform. “The technology is advancing and people realize the law has to keep pace.”

Updating the bill could have a broader impact on civil cases as well, clarifying who can gain access to e-mails, photos and Facebook posts in corporate litigation and divorce court.

And it could lay out clearer rules for government agencies like the Internal Revenue Service to follow to gain access to private citizens’ e-mails. The agency told Congress recently that it seeks search warrants before reading taxpayer e-mails, though its written policy says otherwise, according to an information request filed by the American Civil Liberties Union.

Courts across the country, apparently baffled by how to apply the existing law, which applies to content held in “electronic storage,” have ruled in sometimes contradictory ways over the privacy of electronic material in both civil and criminal cases.

In one prominent case, Lee Jennings sued a relative of his wife who had broken into his Yahoo account and ferreted out e-mails describing an extramarital affair that were later used as incriminating evidence in divorce proceedings.

Mr. Jennings claimed a violation of his privacy under the electronic privacy act, but the highest court in his home state of South Carolina held that his e-mails, which sat on Yahoo’s servers, were not held in “electronic storage,” and therefore were not covered by the statute. A federal court in California years earlier had ruled differently in another case, interpreting “electronic storage” far more broadly.

Mr. Jennings’ lawyer, Neal K. Katyal, a former acting solicitor general in the Obama administration, asked the Supreme Court to reconcile the dueling interpretations. The court declined to hear the case this month, effectively leaving it to Congress to clarify the law.

Although the appeals court ruling in the Warshak criminal case is binding only in the Sixth Circuit, it has since become the default legal threshold for many Web companies.

Facebook says it turns over content created by users — pictures, posts, messages — only after it is served with a search warrant, though a subpoena suffices for basic subscriber information, including a user’s name and e-mail address.

Twitter, too, says “requests for contents of communication require a U.S. search warrant,” and informs users when it receives a request for information from a government agency.

Microsoft, which operates e-mail and cloud storage services, follows a similar practice, insisting on a search warrant for “content,” including documents, photos, e-mail and instant messages. With a subpoena, the company can divulge a user’s Internet Protocol record, though, which can be used to establish a person’s location.

“The law is so old it doesn’t account for how we have turned into a digital society,” said Bryan Schilling, a lawyer at Microsoft. He offered an offline analogy: “If somebody had a storage unit, law enforcement would be required to get a search warrant,” he said. “It’s the same thing now, as we store more and more of our content in the cloud, consumer or enterprise.”

The original sponsor of the 1986 law, Senator Patrick Leahy, Democrat of Vermont, has called its overhaul his top priority for the year. He and Senator Mike Lee, Republican of Utah, have introduced a measure requiring law enforcement to obtain a warrant for all electronic content, including e-mails, regardless of how old they are.

That overhaul is backed by an unlikely coalition. Amazon and Google, which offer cloud-based services to consumers and businesses, are lobbying for the change, along with start-ups like Evernote and Tumblr, which operate modern-day private diaries. They have joined with advocacy groups as diverse as the American Civil Liberties Union and Americans for Tax Reform.

The issue of e-mail privacy received the greatest attention last year, when Gen. David H. Petraeus, the former director of the C.I.A., resigned after an inquiry into his e-mail correspondence turned up evidence of an extramarital affair. He and his biographer, Paula Broadwell, had exchanged amorous correspondence in a “draft” folder of a shared Gmail account, apparently to elude detection.

Those draft messages, because they had not been transmitted across the Internet, could have been viewed by federal authorities with nothing more than a subpoena, according to current law.