Texas Is the First State to Ban Warrantless Email Surveillance

Texas, which has been a privacy leader of late, is now the first state in the union to ban state and local law enforcement from warrantless surveillance of private emails. The bill signed last week by Gov. Rick Perry is a big step beyond federal law, which allows authorities to collect many emails with only a subpoena.

HB 2268 went into effect immediately, and is a big step forward for Texans' privacy rights. But it only affects state and local authorities, while federal authorities are still allowed the egregious loopholes built into the outdated Electronic Communications Privacy Act of 1986, otherwise known as ECPA. ECPA was written to provide guidance to law enforcement with regards to emerging electronic communications, but in the modern era it's sorely in need of an update.

ECPA currently allows federal authorities to compel email hosts to hand over emails with a subpoena, which is a far less stringent legal requirement than a warrant signed by a judge, in two specific circumstances: If email in remote storage is unopened and more than 180 days old, or if it's in remote storage and has been opened.

As the Electronic Privacy Information Center explains, this is because in the early days of email, most people downloaded their messages locally from a host, which wouldn't keep messages on its server for long. Thus, it was thought emails left on remote storage were essentially abandoned materials, which don't require a warrant to acquire.

Obviously, in a world in which Gmail offers you 15 gigabytes of cloud storage, our emails now stay on servers forever. That means ECPA now has far more power than it was ever intended to, and the precedent it's set is a big reason why the FBI and DoJ think they deserve access to Americans' emails with little legal oversight. (The NSA debacle, with its secret laws and secret courts, is a totally different conversation.)

HB 2268 still offers law enforcement some access to customer data with subpoenas. According to the text of the bill, subpoenas are enough to compel service providers to hand over customer identitify information, and providers can also be forced to make backup copies of data. But as the text reads on page 7, this data is "only electronic customer data that is information revealing the identity of customers of the applicable service or information about a customer’s use of the applicable service," so the actual contents of emails are now protected.

Congress has long hinted at trying to update ECPA, but (partly due to the crowing of law enforcement, which doesn't want to give up easy access to electronic communication) it's yet to happen. At least Texas, which also recently banned the warrantless collection of cell phone location data, is taking privacy rights into its own hands.

@derektmead