A Senate committee stalled legislation Thursday to reform a 30-year-old law granting the government warrantless access to Americans’ six-month-old emails, one month after the House unanimously passed similar legislation.
Sponsors of the Electronic Communications Privacy Act (ECPA) Amendments Act on the Senate Judiciary Committee agreed to hold the bill over to address concerns and potential amendments posed by their colleagues.
“There’s broad bipartisan consensus that ECPA needs to be updated,” Senate Judiciary Committee Chairman Chuck Grassley said during a hearing originally slated to mark up the bill Thursday. “I don’t think there’s anyone who disagrees with that.”
Committee members do, however, disagree on a number of potential amendments to the bill filed shortly before markup. Authors Republican Sen. Mike Lee of Utah and Vermont Sen. Patrick Leahy, the committee’s ranking Democrat, agreed to the delay.
Of the nine amendments offed up by Republicans (Democrats offered none to expedite passage), the most controversial include one put forth by Texas Republican Sen. John Cornyn to expand the FBI’s use of National Security Letters (NSLs) to subpoena communications transaction records.
Those records, which would be obtainable without prior judicial approval, would include names, physical addresses, email addresses, phone numbers, account numbers, login histories, service lengths, types of services, means and sources of payment for service (including any card or bank account information), local and long distance billing information, IP addresses, online session times and other detailed network information, but not the content of the communications themselves.
“This is, according to Director Comey of the FBI, the FBI’s number one legislative priority,” Cornyn said, adding the Obama administration also supports the change.
A second amendment by Cornyn would allow the government to obtain emails if it gets the consent of the sender or receiver, while another from Alabama Republican Sen. Jeff Sessions would give the government the power to order companies to hand over emails in the event of a national emergency without obtaining prior judicial approval.
Utah Republican Sen. Orrin Hatch pitched an amendment to limit the U.S. government’s access to emails stored on the servers of American companies located overseas — the subject of a lawsuit with Microsoft that’s highlighted the call for ECPA reform since 2014.
“The legislation before us does not touch upon perhaps the most significant and difficult privacy issue we now face — how to safeguard electronic communications on an international basis,” Hatch said. “Currently, the federal government takes the position that it can compel a technology company to turn over data located anywhere in the world belonging to a citizen of any country, so long as the data can be accessed by a company subject to U.S. jurisdiction.”
The amendment mimics legislation authored by Hatch and others to establish a framework for the U.S. government to request such data from the foreign government in question.
South Carolina Republican Lindsey Graham’s amendment also copies a bill the senator previously submitted to the upper chamber to give the Justice Department additional authority to prosecute hackers for usurping large networks of computers to deploy botnet armies in denial-of-service and other hacks, frequently used to take down a network by overloading it with traffic.
Privacy advocates, many of whom spent the last five years lobbying for ECPA reform, oppose the amendments in favor of a clean bill that mimics the House-passed legislation, with the exception of an amendment from Nevada Republican Sen. Jeff Flake to ease the gag requirements on companies in receipt of a warrant, and give courts the power to decide if companies should be granted more leniency to disclose warrants.
“We urge the Senate Judiciary Committee to pass a ‘clean’ bill without any further amendments that would weaken the privacy protections in the legislation,” the Electronic Frontier Foundation said in a statement Wednesday.
The House voted 419-0 in April to unanimously pass reforms to ECPA, originally enacted in 1986 under the Reagan administration.
