Legislation that would enhance privacy protections for digitally-stored communications contains a critical flaw, one lawmaker claimed, citing disclosures made by Edward Snowden.
During a House Judiciary Committee hearing Tuesday, Rep. Louie Gohmert (R-Texas) warned that the Email Privacy Act–an update of privacy law that requires government agencies to obtain a warrant before accessing an individual’s records in the cloud–has a “massive gaping hole” that would permit cyber investigations to continue in the dark.
Gohmert, a former district judge, pointed to a provision within the legislation that would allow government agencies to request that the subject of an investigation not be notified for between 90 and 180 days later or even longer. He cited one criterion for delayed notification–law enforcement’s fear of “destruction of or tampering with evidence”–as being particularly porous.
“Really? Well, that would always be a concern,” Gohmert said.
“You could always, always, always get some judge somewhere that would sign off on that order—I know that now after seeing the disclosure by Snowden,” he added.
That Gohmert himself is a former judge might cause his usual critics pause when assessing his Tuesday remarks on the judiciary. The Texas Republican is routinely mocked by moderates and liberals for commentary that often includes bizarre theories on homosexuality and military dictatorships.
Unlike in much of that discourse, the Texas Republican also referred to widely-cited evidence; in this case, parts of Snowden’s publicly disclosed dossier that showed the federal government stretches and bends legal provisions on privacy that were intended to be narrow.
“When I saw the order regarding Verizon’s disclosure of all of their metadata, I realized we were lied to by both administrations about what was being sought,” Gohmert said. “So I’m not as comfortable with providing the exception that I’m sure was demanded by governmental agencies.”
Under current law—the thirty-year-old Electronic Communications Privacy Act (ECPA)—civil enforcement agencies need only a subpoena to obtain a users’ private emails stored for more than 180 days on third party servers.
The legislation under review Tuesday by the House Judiciary Committee would up that surveillance threshold to a probable cause warrant. It was introduced by Rep. Kevin Yoder (R-Kansas), and has more than three hundred cosponsors from both major parties.
Civil law enforcement agencies like the Securities and Exchange Commission (SEC) and the Federal Trade Commission (FTC) are opposed to the legislation, claiming it will take a critical investigatory tool away since they don’t have authority to issue warrants.
A 2010 US Court of Appeals ruling in US v. Warshak, however, has already blocked agencies’ warrantless access to emails stored on a third party server—a case often referenced by ECPA reformers as evidence that the law must be updated.
Reformers testifying before the judiciary committee also seemed to validate Gohmert’s concerns. Chris Calabrese, from the pro-reform Center for Democracy and Technology, had some measured criticism about exemptions discussed by the lawmaker.
“Although these exceptions are important to protect investigations in extraordinary circumstance, notice must be the norm in law enforcement investigations,” Calabrese said in prepared opening remarks. “Without knowledge of an investigation, a defendant is hamstrung in asserting their constitutional rights and accountability is greatly reduced.”
Another witness on hand, Paul Rosenzweig, a Visiting Fellow at the pro-Email Privacy Act Heritage Foundation, also sympathized with Gohmert.
“I share your concerns about the delayed notifications provisions—especially the destruction of evidence portion of it,” Rosenzweig said, in response to the lawmaker’s remarks. He argued, however, that rules for delaying notification go deeper than ECPA reform and are actually rooted in common law. “To some degree you’re arguing with something that preexisted 9/11 and preexisted ECPA,” Rosenzweig said.
