The IRS and ECPA Loopholes

The IRS may be bypassing Fourth Amendment warrant requirements for accessing e-mails that have been stored for longer than 180 days. The government agency claims to have the authority to access these e-mails without a probable cause warrant because ECPA only requires such a warrant before obtaining e-mails that have been in electronic storage for less than 180 days. In response to this perceived violation of civil liberties, the ACLU has been criticizing the IRS for its lack of transparency on this issue and for skirting around Constitutional protections.

We know that e-mails are protected from unreasonable searches and seizures because SCOTUS found as much in United States v. Warshak. The Court found that the government needs to obtain a probable cause warrant before gaining access to an individual's stored e-mails. The IRS has not been clear, however, whether they are following Warshak on a national basis or only in a limited geographical area. In an e-mail exchange between an IRS employee from the IRS Criminal Tax Division asked Special Counsel whether Warshak would impact warrant procedures at all. Counsel's response was "I have not heard anything related to this opinion. We have always taken the position that a warrant is necessary when retrieving e-mails that are less than 18- days old." Later internal communications from 2011 indicate that some within the IRS believe it unwise to seek such older e-mails without a warrant but that the Warshak opinion technically only applies in the Sixth Circuit.

18 USC 2703(a), which is a section of ECPA labeled "Required disclosure of customer communications or records: Contents of Wire of Electronic Communications in Electronic Storage", states a government entity may require an electronic communication service to disclosure contents of electronic communication that is in storage in an electronic communications system for 180 days or less. The IRS has used this guideline to justify obtaining e-mails stored longer than 180 days without first getting a probable cause warrant. 

Is there really reason to think that e-mails that have been stored for longer than 180 days are less worthy of privacy protection? Certainly such communication is not less worthy of Constitutional protection as Warshak states, but why should ECPA fail to provide additional protection to such communication? Why should the potentially very personal information contained in old e-mails be subject to seizure by the government without  requiring a probable cause showing in order to do so? 

There are two steps that should be taken to remedy this missing link in existing privacy law. First, the IRS must be transparent about their existing warrant obtaining procedures. The ACLU has been at the forefront in calling for transparency in this area, and this is commendable. The American people should know how easily their government can access personal communications without probable cause, and the IRS owes it to them to make this information public. Second, Congress needs to update ECPA to modernize it. ECPA has written in the 1986, and technology has improved by leaps and bounds since then. In March, new legislation was proposed in Congress that would update ECPA by getting rid of the 180-days clause. This legislation would make sure that the government obtains a search warrant to access all e-mails (even old ones) and also that the government notifies the individual of such disclosure within 10 days. There should be a vote within the year.This legislation has so far received wide support and is a necessary step to ensuring adequate privacy for all of us.