As CIA Chief Scandal Looms, Lawmakers Consider Tightening E-Mail Privacy

• By David Kravets
• 11.15.12
• 6:50 PM

• 
  

Then-CIA Director David Petraeus visited the McConnell Center in 2010. Photo: McConnell Center/Flickr

Recent intrusions by the FBI into e-mail correspondence between former CIA Director David Petraeus and his mistress and biographer, Paula Broadwell, have raised a lot of questions and concerns about the government’s ability to access private e-mails.
The current law covering access to e-mail gives the government the right to snoop without a court order on email that’s older than 180 days, but requires a court order for missives that are newer than this, a fact that privacy activists have been trying to change for years.
Now they might finally be getting closer to that wish.
The Senate Judiciary Committee announced Thursday that it will be voting Nov. 29 on whether to advance legislation that would require authorities to obtain a probable-cause warrant to get access to all e-mail and other content stored in the cloud, just as a warrant is required to search a car or house.
Sen. Patrick Leahy (D-Vermont), chairman of the Judiciary Committee, proposed the sweeping digital privacy protections in September after first failing to push them through last year. The proposal would amend the 1986 Electronic Communications Privacy Act and “bring our privacy laws into the digital age.”
The announcement comes two days after Google released stats showing an alarming rise in the number of U.S. government demands for data about Gmail users and other Google account holders. Google didn’t say how many times authorities used a warrant to make the requests.
It’s also not known precisely what legal authorities were used to obtain access to e-mail accounts used by Broadwell, Petraeus and others involved.
The investigation into the extramarital affair between the two, which led to the CIA director’s resignation last week, is ongoing, and the FBI won’t say whether it obtained a probable-cause warrant signed by a judge to peek at e-mail exchanged between the two. Conflicting news reports say they did and did not use a warrant. The issue is important, because authorities apparently had no reason to believe a crime had been committed at the time they sought access to the accounts.
The career of the former CIA director and former Afghanistan war commander came unhinged after a woman in Florida named Jill Kelley received harassing e-mails from an anonymous sender and reported them to an FBI friend.
Authorities say the location data connected to the e-mails and the e-mail account from which they were sent helped them identify the sender as Petraeus’ biographer — Broadwell. Armed with this information, they were reportedly able to obtain a warrant to search other e-mail accounts Broadwell used, which led to discovery of the affair.
It’s not the first time that Leahy has tried to strengthen privacy protection for e-mail. Last year, he never even got a hearing for the same proposal introduced in the committee that he heads. But this time he’s trying to attach it to a legislative package about video-rental privacy and Netflix that already has momentum.
Leahy’s package (.pdf) would nullify the provision of ECPA that allows the government to acquire a suspect’s e-mail or other stored content from an internet service provider without showing probable cause that a crime was committed, as long as the content has been stored on a third-party server for 180 days or more. Currently, to acquire such data, the government only needs to show, often via an administrative subpoena, that it has “reasonable grounds to believe” the information would be useful in an investigation.
When enacted two decades ago, ECPA provided much more privacy than it does today. The act was adopted at a time when e-mail wasn’t stored on servers for a long time, but instead was held there briefly on its way to a recipient’s inbox. E-mail more than six months old was assumed abandoned.
As technology advanced, more and more people began storing e-mail on cloud servers indefinitely. And Congress has so far been unwilling to change course, despite the Fourth Amendment implications as data storage in the cloud has grown.
Leahy’s measure simply requires authorities to get a probable-cause warrant from a judge to access electronic information. His package has a greater chance of passing this time because the measure is being included in a proposal to amend the Video Privacy Protection Act — which concerns the ability of Netflix customers to more easily display their video preferences and interests on Facebook and other sites and has broad support from legislators.