The ECPA Amendments Act would require law enforcement to get a warrant to access server-hosted information, no matter how old, and would require the government to notify an individual that his or her information was accessed within 10 days, with certain exceptions.
But law enforcement officials expressed opposition to some of the bill's proposed changes, arguing that its requirement for criminal warrants could leave civil litigators without access to important electronic information.
"The bill in its current form poses significant risk to the American public by impeding the ability of the SEC and other civil law enforcement agencies to investigate and uncover financial fraud and other unlawful conduct," said Andrew Ceresney, director of enforcement at the Securities and Exchange Commission.
Ceresney and Daniel Salsburg—chief counsel for technology, research, and investigation in the FTC's consumer protection branch—said the SEC and FTC are not looking for the authority to obtain data with just a subpoena, and instead proposed a system where they could obtain a court order for access to the data. Such a process would notify the individual being investigated and give him or her the chance to make a case in front of the judge before an order is granted or denied.
But despite their opposition to the proposed change to ECPA, neither the SEC nor the FTC has obtained emails through an administrative subpoena in the past five years, Ceresney and Salsburg said Wednesday.
Ceresney said the decision to avoid subpoenas was made "in deference" to ongoing conversations about ECPA reform. A 2010 federal court order also bound the government's hands by declaring ECPA unconstitutional—a decision the ECPA Amendments Act intends to codify into law—but Ceresney said the SEC does not interpret the court's decision as an impediment to using subpoenas to obtain data.
The civil law enforcement officials' comments about ECPA reform were met with immediate backlash from the tech community, which has come out in strong support of the changes.
"The FTC claims to be a champion of consumer privacy, yet the agency wants access to Americans’ data without a warrant," said Berin Szoka, president of TechFreedom, a technology think tank. "The Commission’s testimony today confirms long-standing rumors that it will only support ECPA reform if it gets a carve-out from the bill’s warrant requirement.
“This is the issue that has stalled ECPA reform for over five years, despite overwhelming bipartisan support,” Szoka added. “The FTC’s testimony is carefully crafted to sound reasonable, but the agency is simply helping to obstruct the major privacy reform of our generation."
Julie Brill, an FTC commissioner, released a statement Wednesday indicating she disagreed with Salsburg's testimony. "I am concerned that a judicial mechanism for civil law enforcement agencies to obtain content from ECPA providers could entrench authority that has the potential to lead to invasions of individuals’ privacy and, under some circumstances, may be unconstitutional in practice," Brill said.