Close email loophole


Ever since former National Security Agency contractor Edward Snowden dropped classified documents into the public’s view, the country has re-engaged in a vigorous debate about some — but not all — of the authorizations the U.S. government claims to eavesdrop on electronic communications.

But there is at least one loophole written into law that makes Americans vulnerable to unnecessary intrusions, is much more unsettling than a lot of the Snowden material — and isn’t getting much attention.

Though the PRISM and phone metadata programs that Mr. Snowden detailed were secret, at least a court must scrutinize them. A section of law that hasn’t come up for discussion in the past few weeks, though, is arguably less protective, giving law enforcement at all levels relatively unfettered access to stored email, documents in the “cloud,” and other personal material.

That law, the Electronic Communications Privacy Act, is old. Technology has far surpassed the vision of the lawmakers who wrote and passed it in 1986. Almost no one used email then, the online cloud didn’t really exist, and storing personal information for long periods of time with a third party such as Google didn’t seem to make any sense.

So, the law says, if users keep email on a third-party server for more than 180 days, they’ve abandoned the material. Law enforcement can look at it — armed merely with a subpoena, not a warrant from a judge.

Americans now store years’ worth of email online, compose everything from documents to love letters on cloud-based word processors, and keep all sorts of other files on hard drives owned by communications companies and located far from their homes.

Not just metadata are vulnerable here. Also at risk are the full contents of every stored email and every cloud-based document. Journalists, among many others, use these tools, which is why the Newspaper Association of America is part of the Digital Due Process Coalition, a group lobbying to change the law.

For years, Sen. Patrick J. Leahy (D., Vt.), the chairman of the Judiciary Committee, has been trying to do that. Though his updates would keep multiple exceptions for law enforcement, his reforms would require government investigators to obtain a search warrant when they want to obtain email content of any vintage from third-party companies. This would meet Americans’ legitimate expectations of privacy. It also would moot the legally murky question of whether searches conducted under the old law are constitutional.

Unlike some of the tougher issues the country is confronting after the NSA leaks, this one is easy. Congress should finally act on Mr. Leahy’s bill — soon.

— Washington Post