A Senate proposal touted as protecting Americans' e-mail privacy has been quietly rewritten, giving government agencies more surveillance power than they possess under current law.
CNET has learned that Patrick Leahy, the influential Democratic chairman of the Senate Judiciary committee, has dramatically reshaped his legislation in response to law enforcement concerns. A vote on his bill, which now authorizes warrantless access to Americans' e-mail, is scheduled for next week.
Leahy's rewritten bill would allow more than 22 agencies -- including the Securities and Exchange Commission and the Federal Communications Commission -- to access Americans' e-mail, Google Docs files, Facebook wall posts, and Twitter direct messages without a search warrant. It also would give the FBI and Homeland Security more authority, in some circumstances, to gain full access to Internet accounts without notifying either the owner or a judge. (CNET obtained the revised draft from a source involved in the negotiations with Leahy.)
Revised bill highlights
Grants warrantless access to Americans' electronic correspondence to over 22 federal agencies. Only a subpoena is required, not a search warrant signed by a judge based on probable cause.
Permits state and local law enforcement to warrantlessly access Americans' correspondence stored on systems not offered "to the public," including university networks.
Authorizes any law enforcement agency to access accounts without a warrant -- or subsequent court review -- if they claim "emergency" situations exist.
Says providers "shall notify" law enforcement in advance of any plans to tell their customers that they've been the target of a warrant, order, or subpoena.
Delays notification of customers whose accounts have been accessed from 3 days to "10 business days." This notification can be postponed by up to 360 days.
CNET News Politics and Law Leahy scuttles his warrantless e-mail surveillance bill
Leahy scuttles his warrantless e-mail surveillance bill
After public criticism of proposal that lets government agencies warrantlessly access Americans' e-mail, Sen. Patrick Leahy says he will "not support" such an idea at next week's vote.
by Declan McCullagh November 20, 2012 12:35 PM PST
Sen. Patrick Leahy won't support warrantless e-mail access, although an aide said only broad exceptions were off the table.
(Credit: U.S. Senate)
Sen. Patrick Leahy has abandoned his controversial proposal that would grant government agencies more surveillance power -- including warrantless access to Americans' e-mail accounts -- than they possess under current law.
The Vermont Democrat said today on Twitter that he would "not support such an exception" for warrantless access. The remarks came a few hours after a CNET article was published this morning that disclosed the existence of the measure.
A vote on the proposal in the Senate Judiciary committee, which Leahy chairs, is scheduled for next Thursday. The amendments were due to be glued onto a substitute (PDF) to H.R. 2471, which the House of Representatives already has approved.
Leahy's about-face comes in response to a deluge of criticism today, including the American Civil Liberties Union saying that warrants should be required, and the conservative group FreedomWorks launching a petition to Congress -- with more than 2,300 messages sent so far -- titled: "Tell Congress: Stay Out of My Email!"
A spokesman for the senator did not respond to questions today from CNET asking for clarification of what Leahy would support next week. (We'll update this article if we receive a response.)
A Democratic aide to the Judiciary committee did, however, tell CNET this afternoon that Leahy does not support broad exceptions for warrantless searches of e-mail content.
A note from Leahy's Twitter account added: "Technology has created vacuum in privacy protection. Sen. Leahy believes that needs to be fixed, and #ECPA needs privacy updates." That's a reference to the 1986 Electronic Communications Privacy Act, which currently does not require that police always obtain a warrant for the contents of e-mail and other communications.
This revised position will come as a relief to privacy advocates and business lobbyists, who have been scrambling since last week to figure out how to respond to Leahy's revamped legislation. Some portions would have imposed new restrictions on law enforcement, while others would lessen existing ones, making the overall bill unpalatable to many groups.
The Center for Democracy and Technology, which is coordinating an industry coalition pressing for surveillance reforms, said today that: "We wouldn't support the rewrite described in CNET." (Members of the coalition include Apple, Amazon.com, Americans for Tax Reform, AT&T, the Center for Democracy and Technology, eBay, Google, Facebook, IBM, Intel, Microsoft, TechFreedom, and Twitter.)
Tech deals and apps for Black Friday
E-mail bill raises privacy concerns
Pew study: Parents of teens online worry about ads, strangers
Senate bill rewrite lets feds read your e-mail without warrants
Judge OKs $22.5M fine against Google for Safari tracking
Leahy's proposal would have allowed over 22 agencies -- including the Securities and Exchange Commission and the Federal Communications Commission -- to access Americans' e-mail, Google Docs files, Facebook wall posts, and Twitter direct messages without a search warrant. It also would have given the FBI and Homeland Security more authority, in some circumstances, to gain full access to Internet accounts without notifying either the owner or a judge.
That was an abrupt departure from Leahy's earlier approach, which required police to obtain a search warrant backed by probable cause before they could read the contents of e-mail or other communications. He boasted last year that his bill "provides enhanced privacy protections for American consumers by... requiring that the government obtain a search warrant."
One person participating in Capitol Hill meetings on this topic told CNET that Justice Department officials have expressed their displeasure about Leahy's original bill. The department is on record as opposing any such requirement: James Baker, the associate deputy attorney general, has publicly warned that requiring a warrant to obtain stored e-mail could have an "adverse impact" on criminal investigations.
Leahy, a former prosecutor, has a mixed record on privacy. He criticized the FBI's efforts to require Internet providers to build in backdoors for law enforcement access, and introduced a bill in the 1990s protecting Americans' right to use whatever encryption products they wanted.
But he also authored the 1994 Communications Assistance for Law Enforcement Act, which is still looming over Web companies, and the reviled Protect IP Act. An article in The New Republic concluded Leahy's work on the Patriot Act "appears to have made the bill less protective of civil liberties." Leahy had introduced significant portions of the Patriot Act under the name Enhancement of Privacy and Public Safety in Cyberspace Act (PDF) a year earlier.
Here's more reaction to Leahy's proposed changes:
Executives at DataFoundry, a provider of data center services in Austin, Tex., said the proposed changes were an unacceptable breach of Fourth Amendment protections against unreasonable search and seizure.
Ronald Yokubaitis, co-CEO of Data Foundry, said giving the government near-unchecked authority to search consumer information stored in the cloud would destroy confidence in cloud-based services and encourage more businesses to move overseas, where protections are greater.
"If this language comes in, we are opposed to the bill," Yokubaitis said. "It will kill cloud computing."
Several members of the coalition contacted by CNET today reiterated support for the September version of Leahy's amendment, which included a warrant provision. An Intel spokeswoman forwarded a letter in support of the earlier version of the legislation, adding: "Our position of support for the warrant requirement is unchanged."
Kim Hart, a spokeswoman for Neustar, also endorsed the September version of the measure.
"As a member of the Digital Due Process coalition, we supported Senator Leahy's original legislation," she said in an e-mail. "We have not yet had the opportunity fully to consider revisions to the legislation, though our experience has been that Senator Leahy addresses these difficult issues in a thoughtful and balanced way."
"CNET has it wrong," an aide tweeted from Leahy's account. "Sen. Leahy does NOT support an #ECPA exception to search warrant requirement [for] civil enforcement [for agencies] like FTC, SEC."
A Judiciary Committee aide confirmed to The Hill that Leahy "does not support broad carve-outs for warrantless email searches.".....
The aide said it is possible that CNET was referring to a draft of the bill circulated by other lawmakers or interest groups, but that Leahy would not support any similar proposal.
"Ideas from many sources always circulate [before] a markup [for discussion], but Sen. Leahy does NOT support such an exception for #ECPA search warrants," Leahy's account tweeted.
The account tweeted that "the whole point of the Leahy reforms is [to] require search warrants [for government] to access email stored with [third] party service providers."
Chris Calabrese, a legislative counsel for the American Civil Liberties Union (ACLU) who has been following the issue, said he had seen the draft bill cited by CNET, but he said he was never under the impression that Leahy supported it.
"There was a lot of language floating around," Calabrese said. He added that the ACLU would not support any proposal that includes broad exceptions for civil enforcement.
"That undercuts the whole purpose of the bill," he said.
Calabrese noted that the proposal cited by CNET is similar to amendments proposed by Sen. Chuck Grassley (R-Iowa), the Judiciary Committee's top Republican.
The rumors about warrant exceptions being added to ECPA are incorrect. Many have come forward with ideas for discussion before markup resumes on my bill to strengthen privacy protections under ECPA. As normally happens in the legislative process, these ideas are being circulated for discussion. One of them, having to do with a warrant exception, is one that I have not supported and do not support. The whole thrust of my bill is to remedy the erosion of the public’s privacy rights under the rapid advances of technology that we have seen since ECPA was first enacted thirty years ago. In particular, my proposal would require search warrants for government access to email stored by third-party service providers – something that of course was not contemplated three decades ago.