The US Justice Department says it's now willing to consider getting search warrants to access almost all types of user emails, a stark change from its previous arguments that it could use a less-strict subpoena for reading emails that users had already opened or that were older than 180 days. "We agree [...] that there is no principled basis to treat email less than 180 days old differently than email more than 180 days old," said Justice Department attorney Elana Tyrangiel in her testimony before House lawmakers today, later adding that her agency would also support changing federal laws to treat opened and unopened emails the same way, too.
The move comes after privacy advocates and companies including Google have spent the past several years urging Congress to reform the current law, the Electronic Communications Privacy Act of 1986 (ECPA), to require search warrants for all emails. Google also testified in the same hearing as the Justice Department this morning, saying that ECPA "fails" to protect user privacy, and that the inconsistencies in how courts have applied the law across the US have made it difficult for it and other cloud-based companies to respond to legal requests appropriately.
"There is no principled basis to treat email less than 180 days old differently than email more than 180 days old."
Although the Justice Department has shifted its stance in support of requiring search warrants for most email, it still wants Congress to carve out exceptions for using subpoenas to get access to email in two cases: investigations into corporate emails, and as an avenue for lawyers in civil cases, who aren't able to request criminal search warrants. "Efforts to update ECPA can account for these considerations," Tyrangiel read from her prepared testimony.
Some House lawmakers introduced a bill to revise ECPA earlier this month, which doesn't include all of the Justice Department's requests, but could be revised to incorporate them. ECPA reform is far from assured — a Senate reform bill failed last year. But with the Justice Department coming around to a position similar to that of Google and privacy advocates, it seems this may finally be the year the 27-year-old ECPA gets a more privacy-friendly refresh.