Three U.S. senators on Thursday introduced legislation that would require the government for the first time to obtain a search warrant based on probable cause in order to access stored electronic communications such as email, Verizon said.
“Although it has been Verizon’s practice to require such a warrant,” Verizon general counsel Randal Milch wrote in a blog, “this bill would make that standard the law of the land.”
The Law Enforcement Access to Data Stored Abroad (LEADS) Act also would authorize the use of search warrants to obtain electronic data stored outside the United States but only where the person tied to the communications is a “United States person.”
In an effort to help prevent cloud providers such as Verizon and Microsoft from violating the privacy laws of foreign countries in order to comply with a warrant issued by an American judge, the legislation would carve out an exception. Upon a motion to a court and a judicial finding that a warrant would require the cloud provider to violate a foreign country’s laws, a judge would be required to vacate or modify the warrant.
The definition of U.S. person would extend to a U.S. citizen, U.S. corporation, or permanent resident alien, according to the Center for Democracy & Technology (CDT). Greg Nojeim, Senior Counsel and Director of the CTD’s Freedom, Security, and Technology Project, expressed concern over how the provision would be administered and whether other nations would reciprocate on such an approach.
The LEADS Act would amend the Electronic Communications Privacy Act (ECPA).
“The government’s position that ECPA warrants do apply abroad puts U.S. cloud providers in the position of having to break the privacy laws of foreign countries in which they do business in order to comply with U.S. law,” said Sen. Chris Coons, a Delaware Democrat who introduced the legislation, along with Sens. Orrin Hatch (R-Utah) and Dean Heller (R-Nevada). “This not only hurts our businesses’ competitiveness and costs American jobs, but it also invites reciprocal treatment by our international trading partners.”
Technology companies welcomed the bill, which would impose a greater burden on the government before it could access stored electronic communications in the United States and abroad.
“This bill proposes a more principled legal blueprint for balancing law enforcement needs with consumer privacy rights,” said Brad Smith, Microsoft’s general counsel, in a blog. “ It also creates an important model that will help advance the international conversation that is so critically needed.”
Under the ECPA, the government has the right to obtain communications in storage for more than 180 days only through a subpoena or order, a Verizon spokesman explained. Microsoft’s Smith said the legislation would require the government to obtain a search warrant from a neutral magistrate judge in order to access the contents of email or cloud storage located in the United States.
“Government agencies should have to get a warrant before reading our email,” Nojeim of the CDT said in a statement. “The Hatch-Coons-Heller bill includes that long-overdue reform.”
The senators introduced the bill after Microsoft challenged a decision by a judge who compelled the tech titan to produce a customer’s emails that were stored in Dublin, Ireland. Microsoft had received a search warrant that a federal magistrate judge had issued in late 2013, but didn’t believe the government had the right to compel the production of an email stored overseas.
Microsoft argued that the government’s interpretation of the ECPA would “authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations.”
In June, Verizon filed an amicus brief in support of Microsoft’s motion to vacate the search warrant. On July 31 in the U.S. District Court for the Southern District of New York, Chief Judge Loretta Preska ruled in favor of the U.S. Justice Department and against Redmond, Washington-based Microsoft. The software giant intends to file an appeal with the Second Circuit Court of Appeals.
Authorizing a U.S. search warrant to obtain data stored abroad “would create a dramatic conflict with foreign data protection laws,” Verizon argued in the amicus brief in support of Microsoft. Verizon has not received any demands for subscribers’ data stored in data centers outside the United States, according to its transparency report in connection with law enforcement requests for data.
AT&T also filed a brief in support of Microsoft.