Leahy-Sununu Offer Bill To Defend E-Mail Privacy

. . . Bipartisan Legislation Would Close Loophole In Court Decision
Allowing Internet Service Providers To Snoop

(WASHINGTON, Thursday, April 28) – Sens. Patrick Leahy (D-Vt.) and John Sununu (R-N.H.) joined forces Thursday to strengthen privacy protections of electronic mail in the wake of a court ruling that opened the door for Internet Service Providers to snoop in their customers’ communications.

As two of the leading privacy advocates in the U.S. Senate, Leahy and Sununu sponsored the E-Mail Privacy Act to stave off the privacy erosions generated by a recent ruling of the First Circuit Court of Appeals in the United States v. Councilman case. Last year, the court, in a 2-1 ruling by a panel of the court that is being appealed to the full court, found it permissible for an Internet Service Provider (ISP), without permission, to systematically intercept, copy and read its customers’ incoming emails for corporate gain as the messages were being transmitted.

The court based its ruling on its interpretation of the 1986 Electronic Communications Privacy Act (ECPA), a law which Leahy wrote and sponsored.

“In what was clearly a strained reading of the law (ECPA), the court condoned an unacceptable privacy intrusion,” said Leahy, who is the ranking Democratic member of the Senate Judiciary Committee. “I know firsthand that we wrote and enacted that law with one purpose in mind – to ensure that Americans could enjoy the same amount of privacy in their online communication as they do in the offline world. Our bill would restate and underscore Congress’s intent and restore the law to its full purpose.”

This decision has serious ramifications beyond allowing ISPs to snoop among their customers’ e-mails, Leahy said. It would also allow the government to conduct searches without complying with the wiretap procedures that to date have been a standard part of investigative practice.

Last year, as the chief author of ECPA, Leahy took the rare step of offering a friend-of-the-court brief supporting the Department of Justice’s appeal of the 3-judge panel’s decision, and objected to the decision’s weakening of the privacy protections he pushed to enact almost 20 years ago. In 1986 Congress passed ECPA to update the Wiretap Act. Leahy noted that the law was a careful, bipartisan and long-planned effort to bring privacy protection into the information age. The full court has not yet issued a decision on the panel’s ruling.

“More and more individuals, businesses, and governmental organizations use electronic communications in their day-to-day operations making privacy issues more critical than ever before,” said Sununu. “As we have seen so many times before, technology is outpacing current law, and advances in communications are making old distinctions irrelevant. By clarifying federal law so that all e-mail communications – no matter where they are in transit – are subject to the Federal Wiretap Act, the ‘Leahy-Sununu E-Mail Privacy Act of 2005’ restores the previous expectations of consumer privacy for e-mail.”

The E-mail Privacy Act sponsored by Leahy and Sununu offers a straightforward solution to prevent the erosion of privacy protections and clarifies that the wiretap laws apply to all interceptions, Leahy explained. The bill would amend ECPA to clarify that the definition of “intercept” is broad enough to include actions that are functionally equivalent to an interception.

Below is Leahy’s statement on the introduction of the bill.

# # # # #

Statement of Senator Patrick Leahy
On The Introduction Of The “E-mail Privacy Act”
And The Protection Of Online Privacy
April 28, 2005

Mr. LEAHY. Mr. President, I introduce today the Leahy-Sununu E-mail Privacy Act to ensure that last year’s decision by the First Circuit Court of Appeals in a case called United States v. Councilman does not undermine the online privacy that Americans expect and cherish. Senator Sununu has been a leader on privacy issues, and I appreciate and welcome his support.

In a strained reading of the Electronic Communications Privacy Act (ECPA), the majority in this case effectively concluded that it was permissible for an Internet Service Provider to systematically intercept, copy and read its customers’ incoming e-mails for corporate gain. This outcome is an unacceptable privacy intrusion that is inconsistent with Congressional intent and the commonly-held understanding of the protections provided by ECPA, and requires swift Congressional response. I offer the E-mail Privacy Act as a simple, straightforward way to prevent the erosion of the privacy protection Congress granted to e-mail and ensure that this outcome is not repeated.

In 1986 Congress passed ECPA to update the Wiretap Act so that Americans could enjoy the same amount of privacy in their online communications as they do in the offline world. ECPA was a careful, bipartisan and long-planned effort to protect electronic communications in two forms – from real-time monitoring or interception as they were being delivered, and from searches when they were stored in record systems. We recognized these as different functions and set rules for each based on the relevant privacy expectations and threats to privacy implicated by the different forms of surveillance.

The Councilman decision upset this careful distinction. Functionally, the ISP was intercepting e-mails as they were being delivered, yet the majority concluded that the relevant rules were those pertaining to stored communications, which exempt ISPs. Specifically, the majority rejected the argument put forth by the Justice Department that an intercept occurs – and the Wiretap Act applies – when an e-mail is acquired contemporaneously with its transmission, regardless of whether the transmission may be in electronic storage for a nanosecond at the time of acquisition. This majority’s conclusion fails to consider the nature of electronic communications systems and belies the reality that such searches are functionally an interception.

The implications of this decision are broad. While many ISPs are responsible online citizens, this does not change the fact that this decision essentially licenses ISPs to snoop. Even more worrisome is that this decision creates the opportunity for they type of Big Brother invasions that understandably make Americans cringe. For practical reasons, law enforcement often installs surveillance devices at these nanosecond storage points, but before doing so, they have obtained the appropriate legal permission to intercept e-mails – a Title III order. Under the majority’s interpretation in the Councilman decision, law enforcement would no longer need to obtain a Title III order to conduct such searches, but rather could follow the less rigorous procedures for stored communications. For example, under the rules for stored communication, if law enforcement were to get the consent of a university-operated ISP, such searches could be performed without the knowledge of users. This is Carnivore unleashed if you will, and is simply not the outcome that Congress intended or the American people expect. Searches that occur in nanosecond storage points during the transmission process are in their function “interceptions” and should be treated as such and subject to the wiretap laws.

The E-mail Privacy Act is a simple approach to prevent the erosion of privacy protections and clarifies that the wiretap laws apply to e-mail interceptions like those at issue in the Councilman case. In essence, the Act would amend ECPA to clarify that the definition of intercept is not a narrow, rigid concept, but is broad enough to include actions that are functionally equivalent to an interception. Importantly, these careful and slight changes would simply restore the status quo prior to the Councilman decision without disturbing other areas of ECPA and without raising controversial concerns that may be difficult to resolve in the few remaining days of this term.

This is an important issue to the American people, and fortunately the E-mail Privacy Act provides a straightforward approach that we can all get behind. Again, I thank Senator Sununu for his support on this important legislation. I am sure he would join me in urging our colleagues to make e-mail privacy a top priority and support the E-mail Privacy Act.

# # # # #