U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

97–726 PDF 2016

EMAIL PRIVACY ACT 

HEARING 

BEFORE THE

COMMITTEE ON THE JUDICIARY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

FIRST SESSION 

ON

H.R. 699 

DECEMBER 1, 2015 

Serial No. 114–53 

Printed for the use of the Committee on the Judiciary 

( 

Available via the World Wide Web: http://judiciary.house.gov 
(II) 

COMMITTEE ON THE JUDICIARY 

BOB GOODLATTE, Virginia, Chairman 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

LAMAR S. SMITH, Texas 

STEVE CHABOT, Ohio 

DARRELL E. ISSA, California 

J. RANDY FORBES, Virginia 

STEVE KING, Iowa 

TRENT FRANKS, Arizona 

LOUIE GOHMERT, Texas 

JIM JORDAN, Ohio 

TED POE, Texas 

JASON CHAFFETZ, Utah 

TOM MARINO, Pennsylvania 

TREY GOWDY, South Carolina 

RAU ́ L LABRADOR, Idaho 

BLAKE FARENTHOLD, Texas 

DOUG COLLINS, Georgia 

RON DeSANTIS, Florida 

MIMI WALTERS, California 

KEN BUCK, Colorado 

JOHN RATCLIFFE, Texas 

DAVE TROTT, Michigan 

MIKE BISHOP, Michigan 

JOHN CONYERS, JR., Michigan 

JERROLD NADLER, New York 

ZOE LOFGREN, California 

SHEILA JACKSON LEE, Texas 

STEVE COHEN, Tennessee 

HENRY C. ‘‘HANK’’ JOHNSON, JR., 

Georgia 

PEDRO R. PIERLUISI, Puerto Rico 

JUDY CHU, California 

TED DEUTCH, Florida 

LUIS V. GUTIERREZ, Illinois 

KAREN BASS, California 

CEDRIC RICHMOND, Louisiana 

SUZAN DelBENE, Washington 

HAKEEM JEFFRIES, New York 

DAVID N. CICILLINE, Rhode Island 

SCOTT PETERS, California 

SHELLEY HUSBAND, Chief of Staff & General Counsel 

PERRY APELBAUM, Minority Staff Director & Chief Counsel 
(III) 

C O N T E N T S 

DECEMBER 1, 2015 

Page 

THE BILL 

H.R. 699, the ‘‘Email Privacy Act’’ ......................................................................... 2 

OPENING STATEMENTS 

The Honorable Bob Goodlatte, a Representative in Congress from the State 

of Virginia, and Chairman, Committee on the Judiciary ................................. 1 

The Honorable John Conyers, Jr., a Representative in Congress from the 

State of Michigan, and Ranking Member, Committee on the Judiciary ......... 20 

WITNESSES 

Andrew Ceresney, Director, Division of Enforcement, United States Securities 

and Exchange Commission 

Oral Testimony ..................................................................................................... 23 

Prepared Statement ............................................................................................. 25 

Steven H. Cook, President, National Association of Assistant United States 

Attorneys 

Oral Testimony ..................................................................................................... 31 

Prepared Statement ............................................................................................. 33 

Richard Littlehale, Assistant Special Agent in Charge, Tennessee Bureau 

of Investigation 

Oral Testimony ..................................................................................................... 47 

Prepared Statement ............................................................................................. 49 

Chris Calabrese, Vice President, Policy, Center for Democracy and Technology 

Oral Testimony ..................................................................................................... 58 

Prepared Statement ............................................................................................. 60 

Richard Salgado, Director, Law Enforcement and Information Security, 

Google Inc. 

Oral Testimony ..................................................................................................... 75 

Prepared Statement ............................................................................................. 77 

Paul Rosenzweig, Visiting Fellow, The Heritage Foundation, Founder, Red 

Branch Consulting 

Oral Testimony ..................................................................................................... 89 

Prepared Statement ............................................................................................. 91 

LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING 

Prepared Statement of the Honorable Jared Polis, a Representative in Congress from the State of Colorado, submitted by the Honorable John Conyers, Jr., a Representative in Congress from the State of Michigan, and 

Ranking Member, Committee on the Judiciary ................................................. 102 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD

Prepared Statement of the Honorable Doug Collins, a Representative in Congress from the State of Georgia, and Member, Committee on the Judiciary .. 129 
Page

IV 

Prepared Statement of the Honorable Sheila Jackson Lee, a Representative 

in Congress from the State of Texas, and Member, Committee on the 

Judiciary ............................................................................................................... 131 

Prepared Statement of the Honorable Kevin Yoder, a Representative in Congress from the State of Kansas ........................................................................... 133 

Letter from the Honorable Brad R. Wenstrup, a Representative in Congress 

from the State of Ohio ......................................................................................... 136 

OFFICIAL HEARING RECORD 

UNPRINTED MATERIAL SUBMITTED FOR THE HEARING RECORD

Material submitted by the Honorable Bob Goodlatte, a Representative in Congress 

from the State of Virginia, and Chairman, Committee on the Judiciary. This material is available at the Committee and can also be accessed at: 

http://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=104232. 
(1) 

EMAIL PRIVACY ACT 

TUESDAY, DECEMBER 1, 2015 

HOUSE OF REPRESENTATIVES

COMMITTEE ON THE JUDICIARY

Washington, DC. 

The Committee met, pursuant to call, at 10:12 a.m., in room 

2141, Rayburn House Office Building, the Honorable Bob Goodlatte 

(Chairman of the Committee) presiding. 

Present: Representatives Goodlatte, Sensenbrenner, Chabot, Issa, 

King, Gohmert, Jordan, Poe, Chaffetz, Marino, Gowdy, Collins, 

DeSantis, Walters, Buck, Ratcliffe, Trott, Bishop, Conyers, Nadler, 

Lofgren, Jackson Lee, Johnson, Chu, DelBene, Jeffries, and Cicilline. 

Staff Present: (Majority) Shelley Husband, Chief of Staff & General Counsel; Branden Ritchie, Deputy Staff Director & Chief 

Counsel; Allison Halataei, Parliamentarian & General Counsel; 

Kelsey Williams, Clerk; Caroline Lynch, Chief Counsel, Subcommittee on Crime, Terrorism, Homeland Security, and Investigations; (Minority) Perry Apelbaum, Staff Director & Chief Counsel; 

Aaron Hiller, Chief Oversight Counsel; Joe Graupensperger, Chief 

Counsel, Subcommittee on Crime, Terrorism, Homeland Security, 

and Investigations; Tiffany Joslyn, Deputy Chief Counsel, Crime, 

Terrorism, Homeland Security, and Investigations; and Veronica 

Eligan, Professional Staff Member. 

Mr. GOODLATTE. Good morning. The Judiciary Committee will 

come to order, and without objection, the Chair is authorized to declare recesses of the Committee at any time. We welcome everyone 

to this morning’s legislative hearing on H.R. 699, the ‘‘Email Privacy Act,’’ and I’ll begin by recognizing myself for an opening statement. 

[The bill, H.R. 699, follows:] 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 

Mr. GOODLATTE. Today’s hearing examines H.R. 699, the ‘‘Email 

Privacy Act,’’ and the need to modernize the Electronic Communications Privacy Act, or ECPA. In enacting ECPA nearly 30 years 

ago, Congress declared that the law’s purpose was to achieve a fair 

balance between the privacy expectations of American citizens and 

the legitimate needs of law enforcement agencies. Reforming this 

decades old outdated law has been a priority for me as Chairman 

of this Committee, and I’ve been working with Members of Congress, advocacy groups, and law enforcement for years on many 

complicated nuances involved in updating this law. 

I am pleased to now hold this important hearing to examine the 

leading reform proposal in the House, H.R. 699, and to examine in 

more detail the nuances Congress must consider in updating this 

law. While technology has undoubtedly outpaced the law in the last 

three decades, the purpose of the law remains steadfast. I am confident that Congress will once again strike that balance and do so 

in a way that continues to promote the development and use of 

new technologies and services, and create a statutory framework 

that will modernize the law to reflect how people communicate 

with one another today and in the future. 

ECPA reform has broad sweeping implications. ECPA, and more 

specifically, the Stored Communications Act, governs Federal, 

State, and local government access to stored email, account records, 

and subscriber information from telephone, email, and other service providers. ECPA not only applies when law enforcement seeks 

information in a criminal investigation, but also in civil investigations and for public safety emergencies. 

H.R. 699, at its core, establishes for the first time, in Federal 

statute, a uniform warrant requirement for stored communications 

content in criminal investigations, regardless of the type of service 

provider, the age of an email, or whether the email has been 

opened. I support the core of H.R. 699, which would establish a 

standard that embodies the principles of the Fourth Amendment 

and reaffirms our commitment to protecting the privacy interests 

of the American people. 

However, our adherence to the Fourth Amendment should not 

end there. Congress can ensure that we are furthering the legitimate needs of law enforcement through ECPA reform by joining 

with the warrant requirement recognized exceptions and procedures designed to further the legitimate needs of law enforcement. 

One of the goals of this legislation is to treat searches in the virtual world and the physical world equally, so it makes sense that 

the exceptions to the warrant requirement and the procedures governing service of warrants should also be harmonized. 

It is well settled law that the government may conduct a search 

in the absence of a warrant in certain instances, including when 

the government determines that an emergency exists requiring the 

search, or when the government obtains the consent of the owner 

of the information. The Stored Communications Act, however, created a framework unique to the electronic world in which even in 

an emergency or with a consent of the customer, disclosure of email 

content or even noncontent records is voluntary at the discretion of 

the provider. It is also well established law that a search warrant 

must be served at the place where the search or seizure occurs. 
19 

For 3 decades, ECPA warrants have been executed with the provider because, as with any other third-party custodian, the information sought is stored with them. H.R. 699 would now require the 

government to also serve the warrant directly on the criminal suspect, a proposal which has raised serious public safety and operational concerns across the law enforcement community. 

Congress should also continue to ensure that civil investigative 

agencies are able to obtain electronic communication information 

for civil violations of Federal law. Courts have routinely held that 

subpoenas satisfy the reasonableness requirement of the Fourth 

Amendment. Unlike a warrant, which is issued without prior notice, and is executed often by force with an unannounced and unanticipated physical intrusion. A subpoena commences an adversarial 

process during which the person served with the subpoena may 

challenge it in court before complying with its demands. 

The Stored Communications Act currently authorizes the 

issuance of a subpoena directly to the provider, albeit with a requirement that the government notify the customer. But Congress 

can go further to ensure that ECPA satisfies the Fourth Amendment by requiring that any civil process authorized by the law 

begin with service of a subpoena directly on the customer. 

In this context, the customer is provided notice and the opportunity to contest the subpoena. Enforcement of the subpoena 

through a court order issued by a Federal judge that protects the 

rights and privileges of the customer, while ensuring that evidence 

of illegal activity is not insulated from investigators, would afford 

heightened protections beyond that which the courts have deemed 

necessary to comport with the Fourth Amendment. 

Congress has enacted laws that impose penalties for certain conduct, sometimes criminal penalties and sometimes civil. We have 

established Federal agencies to enforce these laws with the tools 

necessary to carry out that enforcement. Congress should ensure 

that, in its efforts to modernize ECPA, we do not eliminate access 

to evidence of violations of Federal law simply because Congress 

chose to make those violations punishable by civil penalties. 

I want to thank our distinguished witnesses for being here today, 

and I look forward to hearing from each of you on H.R. 699 and 

how to properly balance the privacy expectations of American citizens and the legitimate needs of law enforcement. And I look forward to working with all Members on both sides of the aisle to 

modernize the Electronic Communications Privacy Act. It is worth 

noting today that we also plan to hold a separate hearing in the 

future on the issue surrounding law enforcement access to information located on servers outside the U.S. As with the broader topic 

of ECPA reform, that is an issue with many nuances that we 

should carefully examine. 

I would now like to ask unanimous consent to enter the following 

items into the record: a statement dated December 1, 2015, from 

the Department of Justice; a letter from the Federal Bureau of Investigation Agents Association dated November 24, 2015; a letter 

from the National Association of Police Organizations dated November 30, 2015; a letter from the Association of Prosecuting Attorneys dated November 24, 2015; a letter from the Virginia Association of Commonwealth Attorneys dated July 10, 2015; a letter from 
20 

*Note: The material submitted by Mr. Goodlatte is not printed in this hearing record but is 

on file with the Committee. See also ‘‘For the Record Submission—Rep. Goodlatte’’ at: 

http://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=104232. 

the Technology Councils of North America dated November 30, 

2015; a statement from Americans for Tax Reform dated December 

1, 2015; and a coalition letter signed by Tech Freedom and other 

coalition members dated November 30, 2015.* 

Without objection, the items have been entered into the record. 

It’s now my pleasure to recognize the Ranking Member of the Judiciary Committee, the gentleman from Michigan, Mr. Conyers for 

his opening statement. 

Mr. CONYERS. Thank you, Chairman Goodlatte, Members of the 

Committee, and our honored witnesses here for the hearing, and 

those who are in 2141 to participate in the listening of this very 

important measure. 

H.R. 699, the ‘‘Email Privacy Act,’’ enjoys I’m pleased to say, the 

overwhelming bipartisan support in the House. As of this morning, 

the bill has earned 304 cosponsors; 191 Republicans, 113 Democrats; and 27 Members of the House Judiciary Committee. 

Now, what do all of these Members have in common? First of all, 

we agree that the Electronic Communications Privacy Act is outdated and provides unjustifiably inconsistent standards for government access to our stored communication. This statute continues to 

serve as one of the main guarantees of our digital privacy, but the 

law was designed in 1986, when few of us used email, and even 

fewer imagined a world in which we could so freely share information online. 

The consequences of applying a 30-year-old understanding of 

technology to modern communications are inconsistent, at best. For 

example, the law seems to apply different standards for government access to the same email at different points in its lifecycle, 

when it’s drafted, when it’s transmitted, when it’s opened by its recipient, and when it is archived in the cloud. We are not well 

served by a law whose application is unpredictable and that the 

courts have had great difficulty in interpreting. Because of the 

rapid pace of technological change, this situation will only get 

worse if we do not act. 

Secondly, the sponsors of this bill agree that the government 

should be obligated to show probable cause before it can require a 

provider to disclose the content in its customer’s mail, no matter 

how old the message is. This standard is consistent with the holding of the Sixth Circuit court in the Warshak case in 2010. That 

case motivated the Department of Justice to voluntarily adopt a 

warrants for email standard. It also effectively ended the unconstitutional use of subpoenas to compel third parties to produce content in civil enforcement actions. 

Current law requires the government to show probable cause and 

obtain a warrant only for email that has been in storage for 180 

days or less. But the government can use and subpoena for the 

same email if it’s stored for 1 day longer. This is no longer acceptable to most Americans. As the Sixth Circuit rightly observed, citizens have the same reasonable expectation of privacy in their email 

before and after the 180-day mark, and as the Department of Justice testified soon thereafter, there is no principal basis to treat 
21 

email less than 180 days old differently than email more than 180 

days old. 

Thirdly, the sponsors of H.R. 699 all agree that current law is 

not adequate to protect new forms of digital communication. Content is content. Our expectation of privacy does not diminish merely because Congress didn’t think of the medium when it last visited 

the statute. The law should protect electronic communications 

across the board, email, text messages, private messages of all 

sorts, and other forms of digital information stored in the cloud. 

Finally, the sponsors of this bill agree that we must act without 

delay. We have an obligation to provide clear standards to law enforcement with respect to emerging technologies. We should also 

recognize that American businesses cannot sustain these new technologies if consumers cannot trust them. 

As the Committee takes up this bill, we should ensure that it 

does not conflict with the basic notion that the government’s seizure of our email without a warrant violates the Fourth Amendment, but we should note that this principle has already taken hold 

across the Federal Government. The Department of Justice already 

uses warrants for email in criminal cases. The government stopped 

using lesser process in the civil context years ago. 

In short, Mr. Chairman and Members, this legislation accomplishes two vital tasks. It updates the statute for modern use, and 

it does so without any significant interruption to law enforcement. 

We should all come together on this bill as soon as possible, and 

I want to personally thank the witnesses for being with us today 

and for their testimony, and I urge my colleagues to give this 

measure their full support, and I thank the Chairman. 

Mr. GOODLATTE. Thank you, Mr. Conyers. And before we swear 

in the witnesses, I’d like to recognize the presence of the chief 

sponsor of the legislation, the gentleman from Wisconsin, Mr. 

Yoder. Thank you for being with us today. Kansas, Kansas, Kansas. The gentleman from Wisconsin says he’ll take you. 

We welcome our distinguished witnesses today, and if you would 

all please rise, I’ll begin by swearing you in. If you’d please raise 

your right hand. 

Do you and each of you swear that the testimony that you are 

about to give shall be the truth, the whole truth, and nothing but 

the truth, so help you God? 

Thank you very much. You may please be seated, and let the 

record reflect that the witnesses have responded in the affirmative. 

Mr. Andrew Ceresney is the director of the enforcement division 

at the United States Securities and Exchange Commission, where 

he has served since 2013. Prior to joining the SEC, Mr. Ceresney 

served as the assistant United States Attorney in the U.S. Attorneys Office for the Southern District of New York where he was a 

deputy chief appellate attorney and a member of the Securities and 

Commodities Fraud Task Force in the Major Crimes Unit. As a 

prosecutor, Mr. Ceresney handled numerous white-collar criminal 

investigations, trial and appeals, including matters related to securities fraud, mail and wire fraud, and money laundering. He is a 

graduate of Columbia College and Yale law school. 

Mr. Steven Cook is president of the National Association of Assistant U.S. Attorneys. He currently serves as the chief of staff of 
22 

the criminal division of the U.S. Attorney’s Office for the Eastern 

District of Tennessee. He has been an assistant U.S. Attorney for 

29 years. In this capacity, he has worked in the Organized Crime 

Drug Enforcement Task Force and the General Crimes Section 

where he handled white-collar crime, fraud, and public corruption. 

He also served as the deputy criminal chief in the narcotics and 

violent crime section. Prior to joining the U.S. Attorney’s Office, 

Mr. Cook was a police officer for 7 years in Knoxville, Tennessee. 

He earned a JD from the University of Tennessee. 

Mr. Richard Littlehale is the assistant special agent in charge at 

the Tennessee Bureau of Investigation. In addition to his duties as 

an investigative supervisor, Mr. Littlehale serves as an advisor and 

trainer in criminal law and procedure, as well as the Bureau’s chief 

firearms instructor. Mr. Littlehale is a frequent presenter to community organizations on ways to protect children online. He is active in engaging the legal community on better ways to protect children from victimization. Mr. Littlehale received a bachelor’s degree 

from Bowdoin College and JD from Vanderbilt University. 

Mr. Chris Calabrese is the vice president for policy at the Center 

for Democracy and Technology where he oversees the center’s policy portfolio. Before joining CDT, Chris served as legislative counsel at the American Civil Liberties Union legislative office where 

he led advocacy efforts relating to privacy, new technology, and 

identification systems. Prior to joining the ACLU, Chris served as 

legal counsel to the Massachusetts Senate majority leader. Chris is 

a graduate of Harvard University and holds a JD from the Georgetown University Law Center. 

Mr. Richard Salgado is the director of law enforcement and information security at Google. Mr. Salgado oversees Google’s global law 

enforcement and national security efforts and legal matters relating to data, security, and investigations. Previously, Mr. Salgado 

worked with Yahoo and also served as senior counsel in the computer crimes section of the U.S. Justice Department. As a prosecutor, he specialized in computer network crime, such as hacking, 

wiretaps, denial of service attacks, malicious code, and other technology driven privacy crimes. In 2005, he joined Stanford law 

school as a legal lecturer on computer crime, Internet business 

legal and policy issues, and modern surveillance law. He received 

his JD from Yale law school. 

Mr. Paul Rosenzweig is the founder of Red Branch Consulting, 

a homeland security consulting company and a senior advisor to 

the Chertoff Group. Mr. Rosenzweig formerly served as deputy assistant secretary for policy in the Department of Homeland Security. He is a distinguished visiting fellow at the Homeland Security 

Studies and Analysis Institute. He also serves as a lecturer in law 

at George Washington University and adjunct professor at the National Defense University, a senior editor of the Journal of National 

Security Law and Policy, and is a visiting fellow at the Heritage 

Foundation. He earned a bachelor’s degree from Haverford College, 

a master’s from Scripps Institution of Oceanography, and a JD 

from the University of Chicago law school. 

Your written statements will be entered into the record in their 

entirety, and we ask that each of you summarize your testimony 

in 5 minutes. To help you stay within that time, there’s a timing 
23 

light on your table. When the light switches from green to yellow, 

you have 1 minute to conclude your testimony. When the light 

turns red, that’s it, time’s up, and it signals that your time has expired. 

Mr. Ceresney, am I pronouncing your name correctly? 

Mr. CERESNEY. You are. 

Mr. GOODLATTE. Thank you very much, and you may begin. 

TESTIMONY OF ANDREW CERESNEY, DIRECTOR, DIVISION OF 

ENFORCEMENT, UNITED STATES SECURITIES AND EXCHANGE COMMISSION 

Mr. CERESNEY. Good morning, Chairman Goodlatte. Good morning, Chairman Goodlatte, Ranking Member Conyers, and Members 

of the Committee. Thank you for inviting me to testify today on behalf of the commission concerning Email Privacy Act, H.R. 699, 

pending before your Committee. 

The bill seeks to modernize portions of the Electronic Communications Privacy Act, ECPA, which became law in 1986. I share 

the goal of updating ECPA’s evidence collection procedures and privacy protections to account for the digital age, but H.R. 699, in its 

current form, poses significant risks to the American public by impeding the ability of the SEC and other civil law enforcement agencies to investigate and uncover financial fraud and other unlawful 

conduct. 

I firmly believe there are ways to update ECPA that offer stronger privacy protections and observe constitutional boundaries without frustrating the legitimate ends of civil law enforcement. 

The SEC’s tripartite mission is to protect investors, maintain 

fair, orderly, and efficient markets, and facilitate capital formation. 

The SEC’s division of enforcement furthers this mission by, among 

other things, investigating potential violations of the Federal securities laws, recommending that the commission bring cases against 

alleged fraudsters and other securities law wrongdoers, and litigating the SEC’s enforcement actions. 

A strong enforcement program is a critical piece of the commission’s efforts to protect investors from fraudulent schemes and promotes investor trust and confidence in the integrity of the Nation’s 

securities markets. 

Electronic communications often provide critical evidence in our 

investigations as email and other message content can establish 

timing, knowledge or relationships in certain cases, or awareness 

that certain statements to investors were false or misleading. 

When we conduct an investigation, we generally will seek emails 

and other electronic communications from the key actors through 

an administrative subpoena. 

In some cases the person whose emails are sought will respond 

to our request, but in other cases, the subpoena recipient may have 

erased email, tendered only some emails, asserted damaged hardware, or refused to respond. Unsurprisingly, individuals who violate the law are often reluctant to produce to the government evidence of their own misconduct. 

In still other cases, email account holders cannot be subpoenaed 

because they are beyond our jurisdiction. It is at this point in the 

investigation that we may, in some instances, need to seek infor-
24 

mation from an Internet service provider, also known as an ISP. 

The proposed amendment would require government entities to 

procure a criminal warrant when they seek the content of emails 

and other electronic communications from ISPs. 

Because the SEC and other civil law enforcement agencies cannot obtain criminal warrants, we would effectively not be able to 

gather evidence, including communications such as emails directly 

from an ISP, regardless of the circumstances, even in instances 

where a subscriber deleted his emails, related hardware was lost 

or damaged, or where the subscriber fled to another jurisdiction. 

Depriving the SEC of authority to obtain email content from an 

ISP would also incentivize subpoena recipients to be less forthcoming in responding to investigatory requests, because an individual who knows that the SEC lacks the authority to obtain his 

emails may thus feel free to destroy or not produce them. 

These are not abstract concerns for the SEC, or for the investors 

we are charged with protecting. Among the type of scams we investigate are Ponzi schemes and ‘‘pump and dump’’ market manipulation schemes, as well as insider trading activity. In these types of 

fraud, illegal acts are particularly likely to be communicated via 

personal accounts, and parties are more likely to be noncooperative 

in their document productions. 

Technology has evolved since ECPA’s passage, and there is no 

question that the law ought to evolve to take account of advances 

in technology and protect privacy interests, even when significant 

law enforcement interests are also implicated. But there are various ways to strike an appropriate balance between those interests 

as the Committee considers the best way to advance this important 

legislation. 

Any reform to ECPA can and should afford a party whose information is sought from an ISP in a civil investigation an opportunity to participate in judicial proceedings before the ISP is compelled to produce this information. Indeed, when seeking email content from ISPs in the past, the division has provided notice to 

email account holders in keeping with longstanding and just recently reaffirmed Supreme Court precedent. 

If the legislation were so structured, an individual would have 

the ability to raise with a court any privilege, relevancy, or other 

concerns before the communications are provided by an ISP, while 

civil law enforcement would still maintain a limited avenue to access existing electronic communications in appropriate circumstances from ISPs. Such a judicial proceeding would offer even 

greater protection to subscribers than a criminal warrant in which 

subscribers receive no opportunity to be heard before communications are provided. 

We look forward to discussing with the Committee ways to modernize ECPA without putting investors at risk, and impairing the 

SEC from enforcing the Federal securities laws. I’m happy to answer any questions you may have. 

[The prepared statement of Mr. Ceresney follows:] 
25 
26 
27 
28 
29 
30 
31 

Mr. GOODLATTE. Thank you. Mr. Cook, welcome. 

TESTIMONY OF STEVEN H. COOK, PRESIDENT, NATIONAL 

ASSOCIATION OF ASSISTANT UNITED STATES ATTORNEYS 

Mr. COOK. Chairman Goodlatte, Ranking Member Conyers, and 

Members of the Committee, first of all, thank you very much for 

giving me the opportunity to address you and to give you the perspective of career prosecutors with respect to H.R. 699. 

And let me get right to it. The importance of the Stored Communications Act or SCA, to the law enforcement community simply 

cannot be overstated. At issue are records of contact and communication by Internet and cell service providers. To understand the 

importance of these records to the law enforcement world, I’d ask 

you to pause and think for a minute about how these powerful resources are being used in the criminal world. 

Child predators troll the Internet 24/7 for children to lure them 

away from their parents and their homes. Purveyors of child pornography often, with graphic pictures of children, sometimes infants being sexually molested, sell those images electronically 

across the Internet. Terrorists boast of their horrific crimes posting 

pictures of those online, and international drug dealers, gangs, and 

others involved in organized crime communicate effectively with coconspirators through email and texts. 

When you realize how pervasive this technology is in the criminal world, you quickly realize that the evidence covered by the 

SCA, or the Stored Communications Act, is central to our ability 

to solve virtually every type of crime. And our ability to access this 

information covered by the SCA and to access it quickly, can literally mean the difference between life and death. It can mean the 

difference between recovering a child alive and returning her to her 

parents, instead of the child being a victim of a vicious predator determined to commit unspeakable crimes. 

And even beyond the critical role of stopping violent crimes in 

progress and rescuing victims, evidence covered by the Stored Communications Act is often central to the search for truth in our 

courts and our ability to bring those most dangerous in our community to justice. 

But here are the problems with ECPA, and both the opening 

statements by the Chair and Ranking Member recognize this, 

ECPA and the Stored Communications Act were enacted in 1986. 

That was before much of this technology was in use, before any of 

us had any idea of its capabilities. And to continue to use a statutory framework with definitions that were enacted before any of 

this technology was known is just simply not workable. It does not 

fit. 

That brings me back to H.R. 699. The primary goal of this bill 

seems to be to codify, correctly we would submit, Warshak and the 

extension of the Fourth Amendment protections to email in storage, and text in storage over 180 days. This is an issue on which 

we can all agree, but the bill goes farther. It goes much farther, 

and we respectfully submit, demonstrates a need for a comprehensive, not piecemeal reform. In my written testimony, I have addressed a number, but by far, not all of the concerns that we have. 
32 

I’d like to highlight two places where this bill creates or perpetuates limitations on law enforcement that far exceed those imposed, far exceed those imposed anywhere else in the law, burdens 

greater than those related to the search of a home, burdens greater 

than those related to the search of a body cavity. 

While the Email Privacy Act expands Fourth Amendment protections and imposes a warrant requirement to compel disclosure of 

stored email or text, the statute does not recognize any of the wellestablished exceptions to the warrant requirement that would be 

applicable in every other circumstance. I know of no other area of 

the law where this is the case. 

Second, the Email Privacy Act also imposes notice requirements 

unlike those found anywhere else in the law. The government has 

long been required to serve a copy of the search warrant on the 

person at the property being searched, and that requirement makes 

sense. It demonstrates to the homeowner or the business operator 

the authority for the search, and that homeowner or property 

owner is then free, in the usual course, to tell whoever they wish 

about it. 

But the government has never been required and the law has 

never required the government to reach out to third parties and notify them of the search. It’s not a discovery provision designed to 

alert those who are under criminal investigation of the ongoing investigation. And although there are specific, in fact, two-and-a-half 

pages of rules that would control when that can be extended, this 

simply is a rule that has never been imposed in any other context. 

In conclusion, I’d just like to say that criminals have, and we 

have seen that they have unlimited access to these modern and 

powerful resources, and they make full use of them. For us on the 

law enforcement side to do our job, access to this information is 

critical. Information covered by the SCA has to be accessible to us. 

That access, we respectfully recognize, of course, should be consistent with the privacy protections afforded by the Constitution, 

but Congress should not, as this bill proposes, impose new unprecedented and unwarranted limitations that will tie our hands in 

doing our jobs. Thank you. 

[The prepared statement of Mr. Cook follows:] 
33 
34 
35 
36 
37 
38 
39 
40 
41 
42 
43 
44 
45 
46 
47 

Mr. GOODLATTE. Thank you, Mr. Cook. 

Mr. Littlehale, welcome. 

TESTIMONY OF RICHARD LITTLEHALE, ASSISTANT SPECIAL 

AGENT IN CHARGE, TENNESSEE BUREAU OF INVESTIGATION 

Mr. LITTLEHALE. Chairman Goodlatte, Ranking Member Conyers, 

Members of the Committee, thank you for inviting me to testify. 

I’m a technical investigator in Tennessee, and I serve on the technology committee of the Association of State Criminal Investigative 

Agencies. As you know, State and local law enforcement agencies 

work the vast majority of criminal investigations in this country. 

Lawful access to electronic evidence is critical for us in those cases 

every day, and H.R. 699, in its current form, does not sufficiently 

protect that access. 

To give you some sense of the volume of potential electronic evidence in our cases, consider a stranger abduction of a 4-day-old infant in Nashville. Over the course of an intensive 4-day investigation, my unit processed and explored leads on hundreds of telephone numbers, social media accounts, computers, and mobile devices. At a time when every second counts, my fellow agents and 

I spend a significant amount of time simply trying to make contact 

with various providers to declare an emergency, calling and recalling to make sure that our process was received and expedited. We 

had to process hundreds of leads, any one of which could have been 

the key to finding the victim. 

Volume alone isn’t the only issue. We must also contend with a 

lack of structure governing responsiveness. In another Amber alert 

investigation, we received a lead that the creator of a posting on 

a social media platform may have information about the child’s location. When we contacted the provider, they noted that ECPA’s 

emergency provision is permissive rather than mandatory and demanded legal process before they turn over the records. 

We know H.R. 699 has a great deal of support, but we believe 

much of that support is based on only one part of the bill, creating 

a uniform probable cause standard for stored content. Advocates for 

ECPA reform argue that the contents of an email or document 

stored in the cloud should be subject to the same protections as a 

letter in your desk drawer at home. H.R. 699 would do that, but 

it goes farther to create an enhanced statutory framework of proof 

standards, notice requirements, and expand the definitions of covered records that you would give greater protection for records 

stored by third-party service providers than for that envelope in 

your desk. And it would do this without extending any of the tools 

that law enforcement can use to obtain evidence in the physical 

world after we demonstrate probable cause to a neutral magistrate 

and get a warrant, like law enforcement controlled warrant exceptions and warrant execution timelines. 

Bringing ECPA into balance should put the physical and digital 

worlds on the same plane, not favor digital evidence over physical 

evidence. H.R. 699 should be amended to reflect a more balanced 

approach that protects privacy and ensures that law enforcement 

can access the evidence it needs, and when we get a warrant, it 

should behave like a warrant not a subpoena with a higher proof 

requirement. 
48 

Demonstrating probable cause to a neutral magistrate should 

allow us to gather evidence with the same timeliness and effectiveness that we would expect in the real world. 

The notice provisions in the bill would require us to describe our 

case to targets of a criminal investigation, even as we’re pursuing 

leads. That endangers investigations. We also urge the Committee 

to carefully balance the need for notification against the resource 

burden it places on us. Time spent complying with arbitrary 

timelines means less time investigating crimes and could compromise sensitive information. 

I urge you to ensure that whatever standard of proof you decide 

is appropriate, you also ensure that law enforcement can access the 

evidence we need reliably and quickly. Speed is important in all investigations, and ECPA reform should impose structure on service 

providers’ response to legal demands. A requirement for automated 

exchange of legal process and records with service providers would 

help speed access to evidence, provide transparency, and authenticate law enforcement process. 

Warrants under EPCA should look like warrants everywhere 

else. That means that standard exceptions to the warrant requirement like exigency and consent should exist, and law enforcement 

should control whether or not they are invoked, just like we can do 

when executing warrants in the physical world. Everybody agrees 

that law enforcement should have rapid access to communications 

evidence in a life-threatening emergency, but that is not always the 

reality. 

Industry and privacy groups suggest that some law enforcement 

emergency declarations are unfounded, but those are unreviewed 

unilateral determinations. Isn’t law enforcement on the ground in 

the best position to assess the presence or absence of defensible exigency in a particular case? We already do it in other contexts all 

the time, and there is an existing body of case law in the courts 

to determine whether or not we are correct. 

In closing, I want to re-emphasize how important both aspects of 

ECPA are to our Nation’s criminal investigators. We agree that 

ECPA should be updated, but any effort to reform it should reflect 

its original balance between assuring law enforcement access to 

evidence through legal demands and protecting customer privacy. 

The balance proposed by H.R. 699 goes too far in extending all 

the burdens of the traditional search warrant scheme to a much 

broader range of records without any of the common law exceptions, while requiring us to give unprecedented notice to investigative targets just because the evidence we’re seeking is electronic. 

Thank you for having me here today, and I look forward to your 

questions. 

[The prepared statement of Mr. Littlehale follows:] 
49 
50 
51 
52 
53 
54 
55 
56 
57 
58 

Mr. GOODLATTE. Thank you. 

Mr. Calabrese, I think maybe I have your pronunciation correct 

now. Is that right? 

Mr. CALABRESE. You actual were right the first time. It’s 

Calabrese, but I’ll take it however you give it. Thank you. 

Mr. GOODLATTE. Thank you. I’m on a losing streak here, but go 

ahead. 

TESTIMONY OF CHRIS CALABRESE, VICE PRESIDENT, 

POLICY, CENTER FOR DEMOCRACY AND TECHNOLOGY 

Mr. CALABRESE. Well, thank you, Mr. Chairman, for having me 

testify. That’s the thing we appreciate the most. 

Ranking Member Conyers, Members of the Committee, thank 

you for the opportunity to testify on behalf of the Center for Democracy and Technology. CDT is a nonpartisan advocacy organization dedicated to protecting privacy, free speech, and innovation online. We applaud the Committee for holding a hearing on the Electronic Communications Privacy Act, ECPA, and urge the Committee to speedily approve H.R. 699, the ‘‘Email Privacy Act.’’ 

When ECPA was passed in 1986, it relied on balancing three policy pillars: Individual privacy, the legitimate needs of law enforcement, and support for innovation. Changes in technology have 

eroded this balance. The reliance on trusted third parties for longterm storage of our communications have left those communications with limited statutory protections. This void has created legal 

uncertainty for cloud computing, one of the major business innovations of the 21st Century and one at which U.S. companies excel. 

At the same time, information accessible to the government has 

increased dramatically from emails and text messages to social networking posts and photos. Most if not all, of this information would 

not have been available in 1986. The technology has changed but 

the law has not, creating a major loophole for Americans’ privacy 

protections. 

In the face of this outdated statute, courts have acted, recognizing in cases like U.S. v. Warshak that people have a reasonable 

expectation of privacy in email and invalidating key parts of ECPA. 

But that patchwork is not enough on its own. It continues to lag 

behind technological change and harms smaller businesses that 

lack an army of lawyers. It also creates uncertainty around new 

technologies that rely on the use and storage of the contents of 

communications. 

Reform efforts face a concerted assault from civil agencies that 

seek to gain new powers and blow a huge privacy loophole in the 

bill. Agencies have blocked reform in spite of the fact that the SEC 

has confessed to never subpoenaing an ISP post-Warshak. No less 

than FBI Director Comey told this Committee that in regard to 

ECPA, a change wouldn’t have any effect on our practices. 

In fact, new civil agency powers would harm the privacy of ordinary citizens. Imagine if the IRS had had these powers back from 

2010 to 2012 when they were improperly investigating the tax status of Tea Party organizations. During that investigation, the IRS 

sent lengthy time-consuming questionnaires seeking information on 

what members were reading, their Facebook posts, donor lists, and 

copies of the materials they were disseminating. While the IRS’ 
59 

targeting of conservative groups was limited to these lengthy questionnaires, their subpoena authority is extremely broad and likely 

could have been used here. 

If the IRS had had the power that the SEC proposal recommends 

be granted to all Federal agencies, they would have been able to 

go beyond gathering information directly from the target of the investigation. The IRS would have been able to go to court and enforce an order allowing them to go directly to the ISP and seek the 

subject’s email. While under the SEC proposal, the subject in the 

investigation would have been able to contest that order in court, 

civil standards are very low, and it’s clear that the IRS had a very 

expansive idea of the information they could seek. This type of 

agency overreach is exactly why we can’t grant agencies unjustified 

new authorities. 

Support for privacy reform is deep and abiding. More than 100 

tech companies, trade associations, and public interest groups have 

signed onto ECPA reform principles. Signatories include nearly the 

entire tech industry, span the political spectrum, and represent privacy rights, consumer interests, and free market values. 

The Email Privacy Act has more than 300 cosponsors, including 

a majority of Republicans and Democrats. Post-Warshak, a warrant 

for content has become the status quo. Nonetheless, it is critical for 

the Committee to approve H.R. 699 in order to cure a constitutional defect in ECPA, protect individual privacy, and assure that 

new technologies continue to enjoy robust constitutional protections. Thank you. 

[The prepared statement of Mr. Calabrese follows:] 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 

Mr. GOODLATTE. Thank you, Mr. Calabrese. 

And Mr. Salgado, welcome. 

TESTIMONY OF RICHARD SALGADO, DIRECTOR, LAW 

ENFORCEMENT AND INFORMATION SECURITY, GOOGLE INC. 

Mr. SALGADO. Chairman Goodlatte, Ranking Member Conyers, 

and Members of the Committee, thank you for the opportunity to 

appear before you today. My name is Richard Salgado. As director—— 

Mr. GOODLATTE. Mr. Salgado, would you pull your microphone a 

little closer to you. 

Mr. SALGADO. Sure. Thank you. My name is Richard Salgado. I’m 

director for law enforcement and information security for Google. I 

oversee the company’s compliance with government requests for 

users’ data, including requests made under the Electronic Communications Privacy Act of 1986, otherwise known as ECPA. 

In the past, I have worked on ECPA issues as a senior counsel 

in the computer crime and intellectual property section in the U.S. 

Department of Justice. Google strongly supports H.R. 699, the 

‘‘Email Privacy Act,’’ which currently has 304 cosponsors, more 

than any other bill currently pending in Congress. It’s undeniable 

and it’s unsurprising that there is strong interest in aligning ECPA 

with the Fourth Amendment and users’ reasonable expectation of 

privacy. 

The original disclosure rules set out in ECPA back in 1986 were 

foresighted given the state of technology back then. In 2015, however, those rules no longer make sense. Users expect, as they 

should, that the documents they store online have the same Fourth 

Amendment protections as they do when the government wants to 

enter the home to seize the documents stored in a desk drawer. 

There is no compelling policy or legal rationale for there to be different rules. 

In 2010, the Sixth Circuit opined in United States v. Warshak 

that EPCA violates the Fourth Amendment to the extent it does 

not require law enforcement to obtain a warrant for email content. 

In doing so, the Sixth Circuit effectively struck down ECPA’s 180- 

day rule and the distinction between opened and unopened emails 

as irreconcilable with the protections afforded by the Fourth 

Amendment. 

Warshak is effectively the law of the land today. It’s observed by 

governmental entities and companies like Google and others. In 

many ways, H.R. 699 is a modest codification of the status quo and 

implementation of the Sixth Circuit’s conclusions in Warshak. 

Two important developments have occurred since I last testified 

before the House Judiciary Committee in support of updating 

ECPA back in March of 2013, both of which have a significant 

bearing on efforts to update the statute. 

First, the Supreme Court issued a landmark decision in Riley 

versus California where it unanimously held that, generally, officers must obtain a warrant before searching the contents of a cell 

phone seized incident to arrest. 

Chief Justice Roberts noted that a regime with various exceptions and carve outs would ‘‘contravene our general preference to 

provide clear guidance to law enforcement through categorical 
76 

rules.’’ To reinforce the constitutional imperative for clear rules in 

this area, Chief Justice Roberts concluded his opinion with unambiguous direction to law enforcement. He wrote, ‘‘The fact that 

technology allows an individual to carry such information in his 

hand does not make the information any less worthy of the protection for which the Founders fought. Our answer to the question of 

what police must do before searching a cell phone seized incident 

to arrest is accordingly simple, get a warrant.’’ 

Notably, this Committee is being asked by some today to jettison 

precisely the type of categorical rules that the Supreme Court held 

were imperative in Riley. Doing so would undermine the user’s reasonable expectations of privacy and encroach on core privacy protections afforded by the Fourth Amendment. We urge the Committee to reject such pleas. 

Second, many States have enacted bright-line rules to bring their 

State versions of ECPA in line with the Fourth Amendment. Hawaii, Texas, and Maine have all done this. In addition, earlier this 

year, the California legislature overwhelmingly approved landmark 

legislation to update California’s version of ECPA, referred to as 

Cal-EPCA. Not only does Cal-EPCA require the government to obtain a warrant before it can compel third-party service providers to 

disclose content, but it also extends the warrant requirement to 

communications metadata and data seized that’s stored on electronic devices. 

States are appropriately recognizing that the Fourth Amendment 

protections ought to extend to the sensitive data that’s stored in 

the cloud. H.R. 699 represents an overdue update to ECPA that 

would ensure electronic communications content is treated in a 

manner commensurate with other papers and effects that are protected by the Fourth Amendment. It’s long past time for Congress 

to pass a clean version of H.R. 699. 

Thank you for your time and consideration, and I’d be happy to 

answer any questions you may have. 

[The prepared statement of Mr. Salgado follows:] 
77 
78 
79 
80 
81 
82 
83 
84 
85 
86 
87 
88 
89 

Mr. GOODLATTE. Thank you, Mr. Salgado. 

Mr. Rosenzweig, welcome. 

TESTIMONY OF PAUL ROSENZWEIG, VISITING FELLOW, THE 

HERITAGE FOUNDATION, FOUNDER, RED BRANCH CONSULTING 

Mr. ROSENZWEIG. Thank you very much, Mr. Chairman, Ranking 

Member Conyers. I appreciate very much the opportunity to come 

before you today to testify about the Email Privacy Act and the underlying principles of balancing privacy and law enforcement needs 

that are inherent here. 

As you know, I am a former prosecutor, having spent 12 years 

in various roles throughout government. I then became a deputy 

assistant secretary for the Department of Homeland Security with 

significant responsibility for our counterterrorism efforts, and today 

I operate a small consulting company, and I serve as a visiting fellow at the Heritage Foundation. From this perspective, I am 

pleased to acknowledge that everybody on this panel agrees that a 

warrant requirement for content of email is an appropriate response to changing technology. 

It seems to me almost beyond belief that notwithstanding the 

uniform agreement of that principle, we have been unable to work 

out the details of how to implement that as a matter of statutory 

law. To my mind, that principle has its roots not in our agreement 

here, but rather in the longstanding understanding of the privacy 

of one’s personal papers and effects that goes back to the very 

foundings of this Nation. 

The most famous case of which was the Wilkes versus Wood 

case. Wilkes was a protestor, much like some of the people in 

America today, whose papers and effects were the subject of a general warrant. That search by the Crown at that time was one of 

the most salient effects that drove the Revolutionary movement. 

Likewise, the Writs of Assistance case, which James Otis famously 

lost, unfortunately, in Massachusetts, was what John Adams said 

was the spark that lit the flame of the Revolution. 

Today, email are our private papers. The ISPs that transmit my 

email to you are the equivalent, functional equivalent of the post 

office, and the cloud storage system that I use to store that information is the functional equivalent of the file cabinet in my office. 

There is no ground that I can see that is consistent with what the 

Framers understood our personal privacy and papers to be to exclude that information from the full protection of the warrant. 

And I would add that our history of Fourth Amendment understanding has followed the development of technology by consistently applying that same principle. When the Supreme Court was 

faced with the idea of telephones in the Katz case back in the 

1960’s, they saw that those types of personal communications 

ought to be subject to the exact same sorts of constitutional protections. This notwithstanding the fact that of course telephones were 

unknown to the Founders, and over the dissent of Justice Black 

who said, you know, history says there are no telephones, if it’s not 

in the Fourth Amendment, it shouldn’t be in the Fourth Amendment. 
90 

Likewise, as Mr. Salgado has said, we’ve recently come to understand that the cell phones in our pockets are not just telephones. 

They are now mini-computers that contain the stuff and substance 

of everything that we know and understand, so, too, I would submit, with the content of our email communications and our stored 

data in cloud service providers, whether it’s Google, or Microsoft, 

or Yahoo, or Dropbox, this is where we store our data today. 

So what’s the debate? What’s left? All that I hear that is left is 

the application of exceptions that are carve outs and restrictions on 

this general warrant requirement. And to some degree, that has an 

intellectual appeal to it, doesn’t it, because we’ve had exceptions to 

the Fourth Amendment for awhile, but I doubt that that’s really 

what the advocates for the exceptions are suggesting, because I certainly have not heard any of them suggest that we should adopt 

as well the Fourth Amendment suppression rules for when evidence is wrongfully collected in violation of these exception requirements. 

The truth is that we’ve had no—when ECPA was first passed in 

the 1980’s, no exception for an emergency at all. The current statute was added in 2001, post 9/11 at the suggestions of the Department of Justice. So it’s kind of passing strange that we would see 

that exception and expansion of it held out now as a reason to oppose the fundamental changes that are necessary in light of technology. 

I would submit to you that the time is ripe for change and the 

principle is clear. In the normal law enforcement context, police, 

FBI, and law enforcement officers should have no more access to 

stored email than they do to our stored private letters. I would 

urge this Committee to give the bill before you plenary consideration in a markup and move it to the floor for consideration where 

these issues can be hashed out. And with that, I thank you very 

much. I look forward to answering your questions. 

[The prepared statement of Mr. Rosenzweig follows:] 
91 
92 
93 
94 
95 
96 
97 
98 
99 
100 

Mr. GOODLATTE. Thank you. And we’ll now proceed under the 5- 

minute rule with questioning of the witnesses, and I’ll begin by recognizing myself. 

Mr. Salgado, if Congress were to issue a subpoena to Google for 

the contents of a customer’s emails, would that subpoena violate 

the Fourth Amendment? 

Mr. SALGADO. That’s a question I would have to look into as to 

how the Fourth Amendment applies to Congress, so I’ve not done 

enough research to be able to answer that with much confidence. 

I would say that the changes we’re talking about today to ECPA 

would not in any way affect the investigative powers of Congress. 

Mr. GOODLATTE. I think it’s a very important question, however, 

because if you can’t answer that question from me right now, answer this question. What’s the constitutional distinction between 

congressional and executive subpoenas? 

Mr. SALGADO. Again, I’d probably have to investigate that. The 

Fourth Amendment is what the Fourth Amendment is, so if there 

is a restriction there that’s based on the Constitution, that exists 

regardless of what we do with ECPA. 

Mr. GOODLATTE. If the subpoena issued to Google for the contents of a customer’s emails, the customer might be a government 

employee who is acting outside of the government’s servers and 

email system and is storing data on Google’s cloud, what ability 

would the Congress have to conduct oversight if your finding is 

that it violates the Fourth Amendment? 

Mr. SALGADO. I don’t know that it would, but I do note that Congress would have all the authority it does now to direct the subpoena to the user to get the information directly from the user. 

Mr. GOODLATTE. We would very much appreciate your taking 

some time to think about the answer to that question because it’s 

a very important question with regard to how we address this. Because there either is not a violation, in which case the question 

arises what’s the constitutional distinction between congressional 

and executive subpoenas, or there is a constitutional violation, in 

which case the Congress’ ability to conduct proper oversight of the 

executive branch is a very significant one. 

Mr. SALGADO. I’d be happy to answer the question. I don’t think 

it touches on the question of this particular step, this particular 

bill, but I’d be very happy to look into that for you. 

Mr. GOODLATTE. Thank you. 

Mr. Ceresney, critics of a civil mechanism cite to the fact the 

SEC has not sought to serve a subpoena on a commercial provider 

in the 5 years since the Sixth Circuit’s decision in U.S. v. Warshak. 

You’ve heard some of those criticisms right here on this panel 

today. 

They say it’s not really a problem that needs to be solved because 

of that fact. Is this true? And if so, why hasn’t your agency sought 

to challenge the warrant only policy adopted by many providers following Warshak? 

Mr. CERESNEY. So Congressman, the decision was made at the 

time. I wasn’t at the SEC at the time, but after Warshak, a decision was made in excess of caution not to issue subpoenas to ISPs 

without consent of the subscriber. And since I’ve been at the SEC, 
101 

we have held off on doing that in deference to the discussions have 

have been ongoing in Congress about amending ECPA. 

At the same time, we have never felt like Warshak precluded us 

from obtaining email under the Constitution pursuant to a subpoena with notice to the subscriber. Warshak dealt with a grand 

jury subpoena with no notice to a subscriber, and it did not undermine a long line of case law that exists, that holds that where a 

subscriber or the party you’re seeking email from or seeking material from has precompliance review before a court that that satisfies the Fourth Amendment. It is true that we have not done it, 

but I can tell you there are cases ongoing which—— 

Mr. GOODLATTE. I know that you haven’t done it. I want to know 

why. 

Mr. CERESNEY. Right. And that is because in an excess of caution 

at the time and in deference to these discussions, you know, in deference to the discussions that have been ongoing before Congress 

about the decision of what to do to reform ECPA. From our perspective, there are ongoing investigations that would definitely 

benefit from ISP subpoenas where we have not obtained email from 

a subscriber that we do know exists, but we’re not able to obtain 

it because we have not been issuing subpoenas to ISPs. 

Mr. GOODLATTE. So how has that affected your ability to conduct 

investigations? 

Mr. CERESNEY. I think it has affected our ability to conduct investigations. We issue subpoenas to individuals all the time for 

their email, and all the time there is instances where those individuals either don’t produce—— 

Mr. GOODLATTE. And before Warshak, you would then issue a 

subpoena to a third-party holder of those emails. Is that correct? 

Mr. CERESNEY. That’s correct. 

Mr. GOODLATTE. And since then, you haven’t felt the need to attempt to do that, and have the courts clarify this issue, which now 

the Congress is being asked to clarify? 

Mr. CERESNEY. We have felt the need, Congressman, but we 

have, in deference to these ongoing discussions in Congress about 

reforming ECPA, determined not to do that. But we certainly have 

identified cases where it would have been helpful to do that to our 

efforts. 

Mr. GOODLATTE. All right. Let me ask one more question to Mr. 

Littlehale. In addition to serving the warrant on the customer, H.R. 

699 also requires law enforcement to provide notice to the customer 

of the nature of the law enforcement inquiry with reasonable specificity. 

Is law enforcement required to provide such information to a person when they serve a search warrant on their home? What is the 

harm if law enforcement is required to inform the subject of investigation of the nature of the law enforcement inquiry with reasonable specificity? 

Mr. LITTLEHALE. Mr. Chairman, in traditional search warrant 

practice on the premises to be to served—— 

Mr. GOODLATTE. Turn your microphone on, please. 

Mr. LITTLEHALE. Sorry, Mr. Chairman. In traditional search warrant practice, the requirement is simply that law enforcement leave 
102 

a copy of the warrant and an inventory of items seized on the 

premises to be searched. 

And in the analogy to a service provider, an entity that is in possession of evidence, we serve a copy of the warrant on them, and 

we give them notice of the fact that we’re requiring them to 

produce the records. 

H.R. 699 imposes an additional set of requirements that we actually discuss something about the nature of our investigation that 

goes beyond what’s required in traditional search warrant practice. 

Mr. GOODLATTE. Thank you very much. The gentleman from 

Michigan, Mr. Conyers is recognized for 5 minutes. 

Mr. CONYERS. Thank you, Mr. Chairman. Before I begin my 

questioning, I’d like to ask unanimous consent to introduce a statement from the gentleman from Colorado, Mr. Jared Polis, into the 

record. He’s the lead Democratic Member on this bill, and his views 

are worth consideration by the Committee. Can I get a unanimous 

consent request approved? 

Mr. GOODLATTE. Without objection, it will be made a part of the 

record. 

[The information referred to follows:] 

Prepared Statement of the Honorable Jared Polis, 

a Representative in Congress from the State of Colorado 

Chairman Goodlatte, Ranking Member Conyers, and Members of the Committee: 

Thank you for convening this important hearing on H.R. 699, the Email Privacy 

Act. The Email Privacy Act is the most cosponsored bill in Congress awaiting floor 

action, and the problem it addresses is one of the most pressing constitutional concerns of our modern age: How can we stop the advancement of technology from eroding our fundamental right to privacy? 

In the broadest possible terms, the obvious answer is that we need to update our 

laws. Many of the laws governing the use of the technology Americans most frequently use today were written long before any of that technology existed or was 

even conceived of. Congress simply cannot purport to protect Americans’ constitutional rights while leaving the federal government to enforce laws designed for a 

world that doesn’t exist anymore. 

Today, the law governing many of our online privacy rights is the Electronic Communications Privacy Act (ECPA) of 1986. In 1986, for the vast majority of Americans, ‘‘electronic communications’’ meant a phone call placed from a landline. In 

1986, Apple had just released the Macintosh Plus—a cutting-edge personal computer that provided users with an entire megabyte of memory. Today, iPhone 6 

users walk around with 16,000 times that amount in their pockets. In 1986, the 

‘‘World Wide Web’’ was years away from taking off. Today, that term is already a 

relic of the past. 

As a result of Congress’s failure to keep up with the pace of technology, every 

American’s email can be subject to warrantless searches thanks to a 29-year-old 

legal loophole. Under ECPA, the government has the ability to search through any 

digital communications stored on a third-party server—such as your emails and instant messages—without a warrant, as long as they are more than 180 days old. 

In 1986, this loophole may have seemed reasonable because individuals simply 

didn’t leave their emails stored on a server for months at a time. That kind of digital storage space just didn’t exist, so authorities considered emails not deleted after 

six months to be abandoned. In 2015, however, consumers routinely store emails 

digitally for months or even years at a time. 

Most Americans have no idea that a law written 29 years ago allows the government to open their old emails without probable cause. And when they find out, 

they’re shocked—because that reality is simply impossible to square with the basic 

liberties guaranteed in our Constitution. It simply makes no sense that our homes, 

cars, and mailboxes are protected from unwarranted government searches but the 

government can sift through our email inboxes with impunity. 

Congress has the power to change that. The Email Privacy Act has 304 cosponsors 

in the House—a bipartisan, veto-proof supermajority of Members of this body—and 

far-reaching support across all sectors of the economy and across the political spec-
103 

trum, from groups like the Heritage Foundation and the American Civil Liberties 

Union to tech startups, Fortune 500 companies, and Chambers of Commerce. 

There are some federal officials calling for special carve-outs and lower burdens 

of evidence in order to access Americans’ old emails. I urge the committee to resist 

these efforts to undermine the bill for several reasons. 

First, the sheer volume of support for this bill suggests that Americans and their 

representatives in Congress overwhelmingly support the legislation as written and 

do not believe electronic correspondence should be subject to a lower standard of evidence than physical documents when it comes to government searches. 

Second, the authors of ECPA clearly did not anticipate a future in which Americans have access to nearly unlimited storage space that allows us to store our 

emails on the cloud in perpetuity. In asking for a special carve-out from warrant 

requirements, these federal agencies are asking for broad new search authorities 

that go far beyond the intent of the 1986 legislation and that would significantly 

undercut the intended reforms of the Email Privacy Act. 

Third, the federal officials asking for these broad new authorities have not put 

forward compelling evidence that the 180-days loophole has served a legitimate lawenforcement purpose. 

And finally, it is impossible to square a lower standard of evidence for emails 

older than 180 days with the Constitution’s 4th amendment protections against unreasonable search and seizure. There is simply no constitutional basis for exempting 

digital correspondence from our privacy laws, and there is no compelling safety or 

crime-prevention reason for doing so either. 

The 180-days loophole is a longstanding problem with a simple, bipartisan, broadly popular, noncontroversial solution at the ready. With 304 cosponsors in the 

House, the Email Privacy Act is the most-cosponsored bill of the 114th Congress not 

to receive a floor vote. I urge the Committee to favorably report H.R. 699 so that 

it can finally get a vote on the House floor, where I am confident it would pass with 

overwhelming bipartisan support. 

Thank you. 

Mr. CONYERS. All right. Thank you. Let me begin my questions 

with Chris Calabrese. I’m trying to find out why this bill is so popular from your point of view. The Email Privacy Act, 304 sponsors, 

privacy advocates, civil libertarians support it, former prosecutors, 

Fortune 500 companies, and small businesses across the country. 

More than 100,000 Americans have signed a petition urging the 

White House to support this measure. How come? 

Mr. CALABRESE. Well, I think that Americans believe very 

strongly in the values that underpin this Nation, the fundamental 

idea of privacy and a balance between what government can do and 

having rules around how they can do it. All this bill does is the 

very modest step of bringing our privacy protections into the 21st 

Century, and everybody agrees with that. 

A recent poll in the Washington Post said that 86 percent of 

Americans supported reform. This panel is unified in saying that 

we need a warrant for email. Now, we have some minor issues 

around the edges, but honestly, I believe that this is a bill that 

would pass Congress or pass the House of Representatives by 300 

or 400 votes. 

It is that popular. It is that common sense. I think we simply 

need a markup. We can work out some of these issues around the 

edges, and the American people can get the privacy protections 

that they want and they need. Thank you. 

Mr. CONYERS. Thank you. And also in your testimony you mention that the bill faces a concerted assault from civil agencies that 

seek to use statutory changes as a tool to gain new powers. Some 

argue the powers are already on the books. Why do you refer to the 

SEC’s proposal as a request for new powers? 
104 

Mr. CALABRESE. I think that if you don’t use an authority for 5 

years and there is a questionable legal standard about whether you 

can use it at all, it’s new authority. That’s simply put. It simply 

can’t be that you have this existing authority and you say it’s incredibly valuable but you’ve held off on using it for 5 years. Either 

what you’re doing in your investigations aren’t important, which 

we all know is not true, or you don’t think you have this authority, 

and to me, there are really no other options, and I think that this 

is new authority. 

Mr. CONYERS. Thank you. 

Mr. Rosenzweig, the government often conducts parallel criminal 

and civil investigations to the same target. What would be the 

practical consequences if we adopted a warrant standard for email 

in criminal investigations and some lesser standard for those in 

civil investigations? 

Mr. ROSENZWEIG. There’d be the risk that the exception would 

swallow the rule. I spent much of my early career prosecuting environmental criminal cases, a regulatory area where the civil regulatory authorities had civil and administrative powers for securing 

evidence. There was a set of procedures, parallel proceedings procedures, that were internal to the executive branch that governed the 

circumstances under which those civilly collected evidence could be 

transferred to the criminal prosecution side for use in a criminal 

case. Those rules were simply rules of grace at the discretion of the 

executive branch. They were not statutorily mandated and they 

were not expressed in any constitutional limit. 

There would be at least some risk that in an effort to evade the 

warrant requirement that was created by reform of ECPA, criminal 

authorities would solicit the securing of that evidence through civil 

process under a lesser standard. I do not mean to ascribe ill motivation to anybody in any part of this process. But, nonetheless, the 

interstitial pressures are very real. 

Mr. CONYERS. Let me squeeze in one final question here. The 

Sixth Circuit in Warshak held that, to the extent that the Stored 

Communications Act permits the use of subpoenas to compel the 

production of email, the statute is unconstitutional. Given that 

holding, is the mechanism proposed by the SEC also unconstitutional? Anybody want to try that in addition to you? 

Mr. ROSENZWEIG. I think it likely is. It hasn’t been tested in 

court. There is a history of restricting civil authorities for constitutionally protected material. There’s also, frankly, some law that 

points to things called administrative searches that might be seen 

as a validation of the SEC’s position. If I were to judge it, I would 

probably say—come down against it, but nobody makes a lot of 

money predicting the Supreme Court. 

Mr. CONYERS. Could it withstand the Fourth Amendment challenge in the courts, do you think? 

Mr. ROSENZWEIG. I would say no. 

Mr. CONYERS. All right. Thank you so much. 

Thank you, Mr. Chairman. 

Mr. GOODLATTE. Thank you, Mr. Conyers. 

The Chair now recognizes the gentleman from Wisconsin, Mr. 

Sensenbrenner, for 5 minutes. 

Mr. SENSENBRENNER. Thank you, Mr. Chairman. 
105 

In the Warshak case in 2010, the Sixth Circuit ruled the content 

of America’s emails is protected by the Fourth Amendment. I agree 

with that holding. Since that decision, the SEC has been unable to 

subpoena email content from service providers. 

Now, Mr. Ceresney, I’ve read your testimony and listened to it. 

Did you write it in 2009? 

Mr. CERESNEY. No. I wrote it—— 

Mr. SENSENBRENNER. Okay, well, thank you very much. 

Now, if the SEC cannot currently subpoena email content from 

service providers, is it truthful to testify that if H.R. 699 becomes 

law the SEC will be denied the ability to obtain evidence? 

Mr. CERESNEY. I don’t agree that we’re not able to do it currently. We have refrained from doing it in deference to Congress’ 

ongoing discussions about it. 

Mr. SENSENBRENNER. Okay. Well, I guess you kind of ignored the 

Warshak decision on that. 

Now, even under ECPA as it was written almost 30 years ago, 

the SEC could only subpoena email content after it was older than 

180 days. Aren’t you asking this Committee to expand a legal authority that was found unconstitutional in a more limited form? 

Mr. CERESNEY. We are not. I think—— 

Mr. SENSENBRENNER. Well, then, why aren’t you? Because you 

would like to be able to issue subpoenas on email content that’s 

less than 180 days old. 

Mr. CERESNEY. We would defer. If Congress decided that—— 

Mr. SENSENBRENNER. No. No. No. No. No. No. No. You know, the 

thing is, is that I think the court has decided and you’re not happy 

with the court decision. What your testimony says is that you’d like 

to expand something that’s already been held unconstitutional. 

Mr. CERESNEY. I disagree. Warshak was—— 

Mr. SENSENBRENNER. Well, I disagree with you. 

Now, let me ask the whole panel, just to ask yes or no. If Congress gives civil agencies the authority to subpoena email content 

to service providers, would that law be constitutional? I think Mr. 

Ceresney has already said yes. 

Mr. CERESNEY. Yes. 

Mr. SENSENBRENNER. Can I get a yes-or-no answer from the 

other five panelists? 

Mr. COOK. I’d love an opportunity to explain the—— 

Mr. SENSENBRENNER. No. I’m limited on time. 

Mr. COOK. I understand, sir. 

Mr. SENSENBRENNER. Yes or no please. 

Mr. COOK. My answer is yes, it would be constitutional. 

Mr. SENSENBRENNER. Mr. Littlehale? 

Mr. LITTLEHALE. Yes, it would be. 

Mr. SENSENBRENNER. Mr. Calabrese? 

Mr. CALABRESE. I believe no, it would not be. 

Mr. SENSENBRENNER. Mr. Salgado? 

Mr. SALGADO. I believe no, it would not be. 

Mr. SENSENBRENNER. Okay. Mr. Rosenzweig? 

Mr. ROSENZWEIG. No. That’s what Warshak said. 

Mr. SENSENBRENNER. Uh-huh. 

Now, I think we’ve heard from Mr. Ceresney. Messrs. Cook and 

Littlehale, since you believe the law would be constitutional, how 
106 

do you square that position with the Sixth Circuit court’s holding 

in Warshak? 

Mr. COOK. Well, I think the critical distinction is the one that the 

SEC has already drawn, and that is that the subpoena at issue 

there was a grand jury subpoena, one issued with no notice to anybody. The Fourth Amendment to the United States Constitution, as 

we all know, has never imposed a warrant requirement without 

any exceptions or without any other way to meet the reasonableness clause. 

Mr. SENSENBRENNER. Okay. Mr. Littlehale? 

Mr. LITTLEHALE. Congressman, I believe that the due process 

provided by the SEC proposal offers a significant amount of protection, the same sort of protection contemplated by the Fourth 

Amendment, and I believe that the courts would view that as sufficient protection. 

Mr. SENSENBRENNER. Well, you know, the issue is, is that a subpoena—there can’t be a motion to quash a subpoena until it’s 

served. So even if there’s an immediate motion to quash a subpoena, isn’t there the risk of a constitutional violation here? 

Mr. CERESNEY. Congressman, there isn’t. That’s because our subpoenas are not self-executing. If we want to enforce our subpoena, 

we need to go to a court and compel production. 

Mr. SENSENBRENNER. Okay. Well, except that Warshak seems to 

indicate the opposite. Well, you know, the thing is, is that here 

we’re having to balance the fact that apparently the position of law 

enforcement is that they want to expand what is currently the law. 

And the position of those who are privacy advocates say the law 

is the law and codify it. 

I think this is a slam dunk for Congress to make a determination, because we already have something that everybody seems to 

think is okay, you know, except a few people that would like to expand the dragnet. 

With that, I’ll yield back. 

Mr. GOODLATTE. The Chair thanks the gentleman and recognizes 

the gentlewoman from California, Ms. Lofgren, for 5 minutes. 

Ms. LOFGREN. Thank you, Mr. Chairman. And I’m glad that 

we’re having this hearing today. As had been mentioned at the beginning of the hearing, over 300 Members of Congress are sponsoring the legislation. So it hasn’t been a close call for most of us. 

There is a competing—not a competing bill, a bill that encompasses the provisions in this bill, but also goes to geolocation. And 

I’m wondering, Mr. Cook, the DOJ recently enacted a policy requiring a warrant before deploying a cell site simulator, like a Stingray, to locate a suspect using their cell phone. Does your association support that policy? 

Mr. COOK. The answer to that, of course, is yes. The use of a 

Stingray or Triggerfish, cell site simulator, under certain circumstances would trigger Fourth Amendment protections. That is 

to say that either a warrant or one of the exceptions. And there are 

many occasions when law enforcement uses a Stingray and it does 

so under the emergency aid or exigent circumstances exception. 

Ms. LOFGREN. If you support this absent the exigent circumstance exception, which we’re not arguing against, would you 

consider that a warrant for any means of obtaining real-time 
107 

geolocation information should also be favorably supported by your 

group? 

Mr. COOK. I’m not sure I understand. 

Ms. LOFGREN. For example, you don’t need a Stingray to actually 

identify where a person is with a cell phone. But the identification 

issue is the same. So wouldn’t that logic extend to that? 

Mr. COOK. Well, when law enforcement seeks prospective tracking of a suspect, as was the case in Jones, an ongoing tracking, 

then the Fourth Amendment is implicated. And I think Jones resolved that for us. 

Ms. LOFGREN. I think it did as well. Shouldn’t that same logic 

apply also to historical location information? 

Mr. COOK. That’s a great question. And of course, as I can tell 

from your questioning, you’re fully familiar with the court struggling with that issue, the fourth and the fifth circuit and other 

courts divided on that. And so part of the division I think is driven 

by an understanding of the technology. The technology with respect 

to some location information is that it’s just not as specific as GPS 

tracking. And with respect to that, the courts have recognized that 

there’s—— 

Ms. LOFGREN. If I can, I don’t want to run out of time. Assuming 

that the technology issues are resolved, and it’s not the U.S. Attorneys Association’s job to do that, logically shouldn’t the Fourth 

Amendment apply to historical records as well as prospective 

records? 

Mr. COOK. The other longstanding doctrine, of course, that touches on that is the one that the courts have pointed to, and that is 

the Smith and Miller third-party records doctrine. 

Ms. LOFGREN. Right, which has also been not favorably received 

recently by the Congress. 

Let me turn to you, Mr. Salgado, because we have approached 

this whole issue from the point of the Fourth Amendment and the 

Constitution and the right to privacy and the like. But it also has 

an impact on American business. The most important technology 

companies in the world are located in the United States. I would 

like, can you comment on the impact, if any, on American business 

for a perception in other countries that privacy is not secure if you 

use an American product? 

Mr. SALGADO. Thank you, yes. I certainly can easily burn up the 

rest of your time with an answer to that question. It is a significant 

impact on American industry that there’s a perception outside of 

the United States—Europe, it’s no secret, certainly holds this perception—that data held by U.S. companies is somehow there for 

the taking for U.S. Government. 

This bill, the Email Privacy Act, is a good step toward getting rid 

of that misperception, making sure our statutes reflect the true 

protections that the Fourth Amendment offers. 

Ms. LOFGREN. Now, if I can, and you may not have the answer 

to this, but certainly this is not an issue just for Google, but for 

Facebook and all the ISPs, and Microsoft has a big case in Ireland 

right now, and the like. Has anybody added up the dollars at risk 

to the U.S. economy on this privacy issue? 
108 

Mr. SALGADO. You know, that may have been done. I’d need to 

get back to you with that, it’s not on the tip of my tongue, to be 

able to answer. 

Ms. LOFGREN. Okay. That’s fair enough. I would like to just mention that the Chief Justice’s conclusion in Riley versus California 

is, ‘‘Our answer to the question of what police must do before 

searching a cell phone seized incident to arrest is accordingly simple, get a warrant.’’ 

How does that decision apply to the legislation that we’re considering today, in your judgment? 

Mr. SALGADO. I think it illustrates the point that the Supreme 

Court wants us to have bright rules so that the law enforcement 

officer in the field knows what to do. And when we’re talking about 

the Fourth Amendment and our right to privacy, we’re not messing 

around with gray areas, that we recognize the significance of this 

right to Americans, we recognize the significance of the privacy interest, we have clear rules, and the rules should be to default to 

a warrant. 

Ms. LOFGREN. Thank you very much. My time has expired, Mr. 

Chairman. 

Mr. COLLINS [presiding]. The gentlelady’s time has expired. 

The Chair now recognizes the gentleman from Iowa, Mr. King. 

Mr. KING. Thank you, Mr. Chairman. 

I thank the witnesses for your testimony. 

First, it was mentioned that there’s a general agreement among 

the panel, I believe, and others, that except for a few people who 

would like to expand the dragnet. I would ask Mr. Cook and Mr. 

Littlehale, is there anything in this bill that expands the dragnet? 

Mr. Cook? 

Mr. COOK. Well, I’m troubled by the characterization. 

Mr. KING. Well, let me define dragnet so that you don’t have to. 

And that would be is there anything in this bill that expands your 

ability to do investigations that maybe makes innocent citizens 

more vulnerable? 

Mr. COOK. No, sir. I think that the bill is narrow, in fact, expansively limits in a couple of unprecedented ways law enforcement’s 

ability to do their job. 

Mr. KING. That’s my understanding of it as well. Mr. Littlehale? 

Mr. LITTLEHALE. Yes, Congressman, I share that concern. 

Mr. KING. And you would share the characterization with Mr. 

Cook as well? 

Mr. LITTLEHALE. I believe that the bill imposes additional limitations on traditional search warrant practice. And even if the standard of proof governing an additional category of records as contemplated in the bill is given, we will have less authority with respect to those records than we would with records in the physical 

world, yes. 

Mr. KING. I thank both gentlemen. I turn to Mr. Salgado. In 

thinking about this from a Google perspective, when I or a citizen 

sign up for an email account, there’s a long agreement that’s there 

that I have to confess I have not studied that or have my attorney 

look that over, but I say, okay I agree. And I sign up for my email. 

And I’m glad to have the service. And it works really good. Am I 

in that waiving some protection to privacy in that agreement? 
109 

Mr. SALGADO. Well, not with regard to what we’re talking about 

here. The agreements certainly talk about how we use the information and where we might be needing to disclose it in order to provide the service. So it’s meant to describe to you, and those who 

are interested in knowing these things, what’s happening. But with 

regard to this bill and the Fourth Amendment, we will honor 

search warrants that are served on us in valid legal process. 

Mr. KING. Will you honor subpoenas? 

Mr. SALGADO. We honor subpoenas but not for content. So we 

will honor subpoenas for what the statute says we honor subpoenas 

for. And it’s our preference to let users know when we get these 

requests, unless we are informed by gag order, for example, that 

we’re not able to. So we will honor all of those rules that Congress 

has set in place and that the Fourth Amendment has established. 

We also will honor requests to preserve information while law enforcement goes through the effort of getting a search warrant 

which may take a period of time. 

Mr. KING. Are you aware of any ISPs that have a different policy 

than you’re describing here with Google’s? 

Mr. SALGADO. There may be slight differences in how the product 

works or the policies are slightly different. But, no, generally I 

think the sort of pattern I’m describing is one that certainly the 

larger companies here operate under. 

Mr. KING. Then practice is pretty close to the mirror of the act 

we’re discussing, the legislation we’re discussing? 

Mr. SALGADO. Yes, sir. I think that’s right. I’m not aware of providers who are producing content on anything less than a search 

warrant at this point. 

Mr. KING. So I would burn more time on that but I appreciate 

your response. And I would like to turn to Mr. Rosenzweig because 

I believe that you gave the clearest definition of modern electronics 

versus the postal service from that constitutional—the Founders’ 

era. This is still the constitutional era. And I would put it this way, 

ISP equals post office, emails equal your filing cabinet. Is that an 

accurate description of yours? 

Mr. ROSENZWEIG. ISPs equal the post office, yes. That would be 

my summary or stored email equals letters in my file, right. 

Mr. KING. Okay. Yes. Stored emails. And could I have the right 

to, if I had an ISP provider that said we want to waive, will you 

waive your authority, will I waive my constitutional protections 

and hand that data over to an ISP provider, I could do that willingly, couldn’t I, under the constitution and current law? 

Mr. ROSENZWEIG. Oh, you could consent to anything. Provided 

your consent is voluntary and not coerced, you could. You don’t, if 

the police come to your door and say can I get the letters in your 

file cabinet, you don’t have to require a warrant. You could say 

sure, come on in. 

Mr. KING. You’re familiar with California v. Greenwood? 

Mr. ROSENZWEIG. Yes. 

Mr. KING. And so the distinction here between Warshak and 

California v. Greenwood, which is essentially if you take your garbage out to the curb, it’s not protected by any Fourth Amendment 

right. If I delete my emails, and they’re within the custody of an 
110 

ISP, and I’ve waived my right to privacy, that would be open access 

then to the investigators? 

Mr. ROSENZWEIG. I would say no. But I would have to think 

about that. My sense is that when I delete the email, I’m intending 

not to throw it to the curb as garbage, but rather to eradicate its 

existence altogether. If I’m aware of the fact that a copy is kept, 

maybe. But I don’t think I’m aware. 

Mr. KING. So it’s actually, we’re getting where we need to go with 

this panel, I think is the distinction between Greenwood and 

Warshak on what those emails consist of, are they garbage or 

aren’t they, are they access to an investigator by subpoena or by 

a warrant or aren’t they. So I appreciate the panel. This has been 

clarifying testimony today. And I thank the Chairman. And I yield 

back the balance of my time. 

Mr. COLLINS. At this time, the gentlelady from Washington 

State, Ms. DelBene, is recognized. 

Ms. DELBENE. Thank you, Mr. Chair. And I just want to thank 

the Chair for holding this hearing and to all of you for taking the 

time to be here with us today. Mr. Ceresney, do you dispute the 

continued availability of preservation orders and court interference 

to enforce administrative subpoenas of targets of SEC investigations should the Email Privacy Act pass? 

Mr. CERESNEY. So if the question is whether preservation requirements should be contained in the statute and the ability to obtain from the subscriber, should that also be required. 

Ms. DELBENE. Do you think if the Email Privacy Act passes, do 

you think that you’re going to continue to have the availability of 

preservation orders and court interference to enforce administrative subpoenas? 

Mr. CERESNEY. I believe that that is still something that one 

could obtain under the proposed statute. But what that wouldn’t 

allow us to do is to then obtain those emails from ISPs when the 

individual doesn’t provide them to us. 

Ms. DELBENE. So you’ve argued in your testimony that one problem with the Email Privacy Act would be that it leads targets of 

investigations to delete emails, thereby destroying evidence. So are 

you telling this Committee that the Email Privacy Act would be to 

blame if you don’t take the commonsense step of issuing a preservation order on an ISP from day one of an investigation. Is there 

any reason whatsoever that you wouldn’t take that step, that very 

simple step, which can be done directly by the SEC without a 

judge’s involvement? 

Mr. CERESNEY. We would certainly take that step. The problem 

is the preservation doesn’t then allow us to then obtain the email 

from the ISP. So certainly we would do that, we would try to preserve the email and make sure that it’s available. But then the 

next step, that is obtaining it from the ISP, that would not be 

available to us. 

Ms. DELBENE. So your comment that this would lead people to 

delete emails doesn’t really hold water. If you have a preservation 

order, the information is going to be saved there. 

Mr. CERESNEY. But if the person deleted the email and then we 

subpoenaed the person, they wouldn’t have it. The only person, the 
111 

only entity that would have possession, custody, and control of the 

email would be the ISP and we wouldn’t have an avenue—— 

Ms. DELBENE. If you have a preservation order, then the ISP is 

going to preserve that information. 

Mr. CERESNEY. Yes. But if they preserve it and we can’t obtain 

it—— 

Ms. DELBENE. I don’t know about you, but I use email to keep 

in touch with my family, my husband, my friends back home in 

Washington State, all across the country. And I’m sure pretty much 

everyone in this room and this building would tell a similar story. 

As email has gone mobile, it’s virtually indistinguishable from a 

phone call or a text message and, no doubt, contains very important details of people’s personal lives and stored in the cloud by 

companies like Mr. Salgado’s, and we would all hope to be kept 

safe from intruders or prying eyes. 

I find it highly disturbing in your testimony today that seems to 

suggest that the SEC views email service providers more like a witness or an informant that you would be able to tap directly for information as opposed to the digital home of intimate communications. So let me ask you this: If the SEC wants a box of documents 

sitting in a target’s home, can you use an administrative subpoena 

to bring a locksmith to their home to open the door, walk in, and 

take documents? 

Mr. CERESNEY. We cannot. What we—— 

Ms. DELBENE. Then please explain to us why you think we 

should give you the ability to do exactly that with a digital equivalent. How that could possibly comport with simple expectations of 

privacy and due process and without a shred of meaningful evidence from you so far or anyone else that the lack of this authority 

will have any impact on your ability to carry out investigations 

whatsoever? 

Mr. CERESNEY. We view the ISP as a third-party storage provider, much like an Iron Mountain provider would be for hard copy 

documents that are kept in a storage facility. And if in the circumstance where hard copy documents are kept in a storage facility, we could go to that storage facility with notice to the person 

who uses that storage facility and try to obtain those documents 

via subpoena. And that I think is the analogy that we would draw 

that would be appropriate in these circumstances. 

And from our perspective, we do have instances in the past when 

we did issue ISP subpoenas where we could show that we obtained 

significant evidence in investigations for that purpose. As to the 

last number of years when we haven’t used it, we don’t know what 

we have lost. But it’s certainly our investigations—— 

Ms. DELBENE. I want to get your view, Mr. Calabrese, on this 

in terms of the role of that third-party provider being the home of 

people’s personal communications. 

Mr. CALABRESE. Well, it’s clearly our digital home. I mean, you 

would find much more sensitive information about me in the cloud 

than you honestly would in my house at this point. If you wanted 

physical documents, they are much more sensitive in my house. 

The thing I would also like to point out that we haven’t really 

touched upon here is that the standard for accessing information 

in the civil context is very low. It’s mere relevance. It’s not a high 
112 

standard of probable cause. Also the number of things that a predicate—a civil agency has, sort of simply mis-filling out your taxes, 

for example, are much greater than the criminal predicates for a 

warrant. So we’re talking about a much lower standard, much 

greater number of ways that we can access information. That 

means that we’re potentially opening up the cloud to much greater 

invasion by civil agencies even than we would by criminal agencies. 

And I think that’s exactly backwards. 

Ms. DELBENE. And, Mr. Ceresney, if you give me just a couple 

more seconds, Mr. Chair, you talked about cases. Can you give me 

the specific names of those cases? 

Mr. CERESNEY. We have a number of cases. And we would be 

happy to provide it to your staff. It includes an accounting fraud 

case where an email indicated that somebody was using earnings 

management, an insider trading case where an email contained a 

tip, a microcap fraud case where the emails showed control of corporation. And just one last thing to answer Mr. Calabrese’s point, 

we would be fine if Congress established a probable cause standard 

as the standard that we would have to meet. Whatever standard 

Congress would like to establish for us to have to meet, we are fine 

meeting that standard. What we need is some mechanism in instances where an individual does not produce to us email, and has 

deleted it, or otherwise destroyed it—— 

Ms. DELBENE. And I think we’ve already discussed that right 

now. Post-Warshak, you have never used that authority. So my 

time has expired. And I just want to yield back. 

Mr. COLLINS. The gentlelady’s time has expired. At this time, the 

gentleman from Texas, Mr. Gohmert, is recognized. 

Mr. GOHMERT. Thank you, Mr. Chairman. Thank you to the witnesses for being here. For anyone that can answer, if someone deletes an email that he or she has already sent out, would the ISP 

be able to retrieve that at some point? 

Mr. SALGADO. I would be happy to try to answer that. It may 

vary from company to company. In most cases, I think it’s fair to 

say that there would be some short period of time between the 

point of deletion and when the system purges the content that has 

been deleted. So there would be some period of time. That time period may vary from provider to provider. 

Mr. GOHMERT. Couldn’t it be retrieved from the person to whom 

it was sent? 

Mr. SALGADO. It certainly could. So there may be many communicants involved in it. 

Mr. GOHMERT. Right. The issue there, and I’m not one of the cosponsors at this time, even though I am one of the persons proudest of the work that Kevin Yoder has done in getting this bill to 

this point. I think it’s fabulous. I think it’s important. My concern 

has been, is that we have left a provision at page 10, for example, 

that allows the governmental entity to apply for a court order so 

that they can still not inform the individual. And that’s fine to my 

mind if there’s a question of endangering the life or physical safety 

of an individual, like a child that was talked about, flight from 

prosecution. As a former judge, I’ve signed all kinds of felony warrants. But I made sure that there was probable cause. And I made 
113 

sure there was particularity in the description in the affidavit, as 

well as in my warrant. 

And I felt very comfortable in 2005 and 2006 when the Bush administration was ensuring us we would never use the national security letters for anything unless there was someone who actually 

had contact with an international terrorist or terrorist organization, those type of things. And then we find out in I think in July 

of 2007, the IG said there were potentially thousands of abuses 

where there was basically no case, they just sent them out. And I’m 

surprised to hear this from me, but in the New York Times, there’s 

a good article by Carla Monyhan talking about Nicholas Merrill, 

how he fought to disclose the contents of the NSL. And then we 

also, with the disclosures of Snowden, yes, he committed an act of 

treason, but he also exposed lies by the last Administration and 

this Administration. 

When I saw the order, the affidavit and order regarding 

Verizon’s disclosures of all of their metadata, I realized we were 

lied to by both Administrations about what was being sought. We 

were told that, look, you don’t have to worry, there’s a FISA court, 

a confirmed judicial nominee that’s a Federal judge, they’ll protect 

the Constitution. There was no particularity at all, just give us everything on everybody you got. And the judge just signed, oh, okay, 

you want everything? Here’s everything. I couldn’t believe it. 

And so I’m not as comfortable with providing the exception that 

I’m sure was demanded by governmental entities. And I’m wondering if an excuse of destruction of, or tampering with evidence 

or intimidation of potential witnesses, enough to get an order saying we can avoid informing whoever sent the email or whoever 

should have possession of the email, we don’t have to inform them 

if we’re concerned they might delete the emails. Really? Well, that 

would always be a concern. So you could always, always, always 

get some judge somewhere that would sign off on that order. I 

know that now after seeing the disclosures by Snowden. So I’m not 

comfortable that this is really going to be that helpful because of 

that massive gaping hole. 

On page 11, it says that basically the provider would have the 

burden of notifying the government at the end of the exclusionary 

notice time. The provider has the burden of notifying the government. The government, okay, my time is about up, so I’m going to 

notify the subject of the warrant, so that the government can get, 

there should be no burden on the provider to do that. If the government wants to keep that secret, the government should try to extend it. But I’m not sure that it wouldn’t be extended automatically 

in virtually every case. 

Mr. Rosenzweig, you say that we should not—we’ve always protected a man’s documents and we shouldn’t change that because 

it’s in a cloud. I would agree. But the ISPs require we check a box 

that says these documents aren’t yours anymore, they’re mine. And 

I’m wondering if maybe we should have some legislation that tells 

ISPs, you know what, these documents, they really are the property of the person that created them, not the one who holds or provided the safe to put them in. 

Mr. COLLINS. The gentleman’s time has expired. But the witness 

may answer. 
114 

Mr. GOHMERT. Anybody care to respond? 

Mr. ROSENZWEIG. I share, I would respond by saying I share your 

concern about the delayed notification provisions, especially the destruction of evidence portion of it. I think that other portions, you 

know, a risk of physical injury and harm, those are very good. I 

would point out that 2705 was added in the immediate aftermath 

of 9/11 as a codification of a longstanding common law that had developed in the courts of appeals that had adopted these various 

rules for when they would delay notification. 

So to some degree, you’re arguing with something that preexisted 

9/11, preexisted ECPA, preexisted—and destruction of evidence has 

traditionally been one of those possibilities. That may be something 

that should change. As for control of one’s own personal data in the 

cloud, I think that there are many service providers who offer different degrees of control over your information. And so I generally 

tend to be comfortable with the idea that there’s competition in the 

marketplace and that if that’s something that matters to you, there 

are service providers who will promise that they take no interest 

and will not process, will not examine your data. They may be 

more costly in other ways than service providers who provide you. 

So I’m kind of a free-marketist on that one. 

Mr. GOHMERT. Okay. Thank you very much. 

Mr. COLLINS. The gentleman’s time has expired. The Chair now 

recognizes the gentleman, Mr. Cicilline. 

Mr. CICILLINE. Thank you, Mr. Chairman. And thank you to our 

witnesses for sharing your expertise and your diverse perspectives 

with us today. I believe that all of us assembled here, both those 

of us on the Committee and our assembled panel of witnesses, recognize that technology often evolves much faster than the law. 

This, in part, is a testament to the rapid pace of American innovation. But it also presents a gap that must be addressed. And the 

Email Privacy Act represents an important step forward to closing 

this gap and preserving privacy protections for Americans. And it’s 

no surprise to me that it’s broadly supported by the American people. 

I want to begin with you, Mr. Ceresney. In your written testimony, you state if the bill becomes law without modification, the 

SEC and other civil law enforcement agencies would be denied the 

ability to obtain critical evidence from ISPs. This phrasing suggests 

to me that you are engaged in some activity today that would be 

blocked by this legislation. 

And so, my first question is, does the SEC currently use subpoenas to obtain the content of communications from Internet service providers? 

Mr. CERESNEY. We do not where we don’t have consent of the 

providers. 

Mr. CICILLINE. And why not? 

Mr. CERESNEY. As I’ve said earlier, it’s because in an excess of 

caution and in deference to the discussions that have been ongoing 

in Congress for a number of years about ECPA reform, we determined to hold off on using that. But it does not mean we do not 

believe we have the authority under the statute and that it is constitutional to use it. 

Mr. CICILLINE. But you do not currently use it? 
115 

Mr. CERESNEY. We do not without consent of the subscribers. 

Mr. CICILLINE. Your written testimony also acknowledges that 

the SEC ‘‘often conducts investigations in parallel with criminal authorities.’’ If the FBI needs a warrant to obtain my email, but the 

SEC can obtain my email with something less than probable cause, 

what prevents the SEC from helping the government to avoid a 

warrant requirement by sharing my email contents with the FBI? 

Mr. CERESNEY. So the first point is whatever standard Congress 

establishes we’re willing to abide by, even if it’s probably cause. 

But, second, when we issue subpoenas—— 

Mr. CICILLINE. Let me just, so if the standard is probable cause, 

then your objection is not with the standard, but who makes the 

determination of probable cause? Because a probable cause finding 

with a judicial determination is a warrant. 

Mr. CERESNEY. No, what we’re seeking is authority to achieve a 

court order with notice to the subscriber, which provides additional 

protections to a warrant. A warrant is ex parte, and the subscriber 

doesn’t have an ability to object. What we’re seeking is an authority to obtain an order from a court with notice to the subscriber. 

And the subscriber would have the ability to object and provide 

whatever objections they have, whether they be relevance, whether 

they be privilege, whatever other objections. That provides additional protections beyond those with the warrant, which is ex 

parte. 

But to answer your question about the criminal authorities, any 

subpoena or other orders we’d seek would be in advance of our investigation. They would not be at the behest of criminal authorities. We do not issue subpoenas or otherwise seek evidence at the 

behest of the criminal authorities. We do it to advance our own investigation. 

Mr. CICILLINE. Mr. Calabrese, did you want to try that? 

Mr. CALABRESE. Yeah, I mean, I think the question that we 

haven’t heard an answer to yet is probable cause of what. Probable 

cause of a crime in the criminal context is very clear. We know 

what crimes are. And they’re interpreted very tightly. Violations of 

civil law are much broader. I mean, if I fill out my tax form incorrectly or I state that this was a business expense when maybe it 

was a vacation, you can say oh, I have probable cause to believe 

that by going through my emails, I’m going to find that he was on 

vacation, not on a business trip. So what we really are talking 

about, no matter what the standard is, it’s a much broader access 

to Americans’ content of their communications. 

Mr. CICILLINE. And with respect to that, current law provides 

that the government must show probable cause to obtain the content in an email that has been stored by a provider for 180 days, 

but can use a lesser process for an email that has been stored for 

181 days. Is there consensus that this 180-day rule is inconsistent 

with how we use emails today? Should it be eliminated? And in addition to that, Mr. Calabrese, in your written testimony you give 

a good list of the digital content we all store online, emails, text 

messages, photographs, music, passwords, calendars, and other 

forms of social networking. 
116 

Do these forms of media merit protection under the Fourth 

Amendment? And is current law adequate to protect any privacy 

interests in this information? 

Mr. CALABRESE. Well, I certainly think that the court in Warshak 

believed that the Fourth Amendment should extend to all these 

types of contents of communication. My worry is that we don’t 

know what the next new technology is going to look like. We don’t 

know what the next way that we’re going to keep our communications private and confidential is. And so we shouldn’t be waiting. 

And ECPA doesn’t have a suppression remedy. So these actual determinations don’t come up that often. We shouldn’t be waiting for 

5 or 10 or 15 years for a court to find a strange case that allows 

them to say we have a reasonable expectation of privacy in communications. We all seem to agree that the content of communications 

should be protected by the warrant unless Congress says otherwise. 

Mr. CICILLINE. Thank you. I yield back. 

Mr. COLLINS. The gentleman’s time has expired. The Chair recognizes the gentleman from Texas, Mr. Poe. 

Mr. POE. I thank the Chairman. I thank all of you all for being 

here. As my friend Mr. Gohmert was, I used to be a criminal court 

judge in Texas for 22 years, felony cases, 20,000 cases or more. All 

that time, constantly I had law enforcement officers come to me 

with a request for me to sign a search warrant based upon their 

affidavits. And I signed a lot. And some I did not sign because of 

the basics of the Fourth Amendment. 

The Fourth Amendment makes us different than every other 

country on Earth because of our history. It’s uniquely United 

States history, goes back to the British who wanted general warrants to kick in doors of warehouses in Boston to see if the American colonists were storing demon rum they hadn’t paid taxes on 

yet. To me, a general warrant is the same as a court order. So we 

have specific warrants. And like I said, I signed a lot of them. 

It makes no sense to me that the right of privacy is protected for 

6 months but it’s not protected more than 6 months. I send a letter, 

snail mail. And I put that in an envelope. And I send it off to one 

of my grandkids somewhere. It floats around in America from post 

office to post office and who else knows where until it gets to 

grandson. It’s protected. Generally it’s protected. It’s a form of communication. 

When we use emails or store in the cloud, it’s a form of communication wherever the cloud may be. So I think it’s Congress’ responsibility to determine what the expectation of privacy is. It’s 

not, God bless them, Federal judges’ responsibility. It’s Congress’ 

responsibility to say this is an expectation of privacy for Americans. And when we enter the digital age, I don’t buy the argument, 

well, we’re in the digital age, you got to give up some of your constitutional rights so we can have government investigate things. 

Whether it’s civil investigation, whether it’s criminal investigation, I don’t buy it. Because the Fourth Amendment gets in the 

way of that. I think it is one of the most important rights that we 

have. So it’s our duty to set up a standard. Over 300 Members have 

signed on to Mr. Yoder’s bill. It hasn’t come up for a vote. Ms. 

Lofgren and I filed a similar bill in 2013. We want to get a vote 

on, I want to get a vote on Mr. Yoder’s bill. Three hundred and four 
117 

Members of Congress agreeing on something? Really? And I think 

most Members, Republicans and Democrats, see the importance of 

the privacy. 

Mr. Calabrese, let me start with you. I have a lot of questions. 

And I know I have only 5 minutes. The Warshak case, the SEC lost 

the Warshak case. They did not appeal that, did they? 

Mr. CALABRESE. No, the case was not appealed. 

Mr. POE. It was not appealed. The SEC, the way I get it, the 

SEC wants a carve-out for civil investigations. The way I see this 

legislation, it’s to protect us from the SEC and the IRS and the 

EPA. Because without this legislation, they could keep doing what 

they’re doing. Would you like to comment on that, weigh in on 

that? Civil agencies snooping around in email. And I’m using the 

word snoop, that’s my word. 

Mr. CALABRESE. We’ve already seen agency overreach. We saw it 

in this Tea Party investigation. There was no question there was 

improper investigation that was searching for a much broader category of information about people than anyone I think here is comfortable with. The idea of looking at what people are reading, looking at their donor lists as part of a civil investigation into someone’s tax status is wrong. And it disturbs me that if someone can 

have a high—a relevant standard that is so low that we might 

bring those kind of investigations into play, I think that’s a problem. And I think that that’s why we need to limit this very powerful authority to warrants that are supervised by judges under probable cause. 

Mr. CERESNEY. Judge, may I respond? 

Mr. POE. Not yet. You can respond in writing because I have the 

same question for all six of you. The basis of a search warrant also 

requires there be notice. Under the current law, let’s use the SEC 

or let’s use the IRS, I like to use them better, they can do their 

investigation, their snooping, and the person being investigated 

doesn’t know about it. Is that correct, Mr. Calabrese? 

Mr. CALABRESE. It depends on the circumstances. Sometimes notice is delayed. 

Mr. POE. Notice is delayed. 

Mr. CALABRESE. Sometimes notice is delayed. Sometimes they do 

know about it. 

Mr. POE. But would you agree that it’s part of our fundamental 

fairness under the Fourth Amendment that there is a search warrant, the search warrant is executed, and that there is a return to 

the judge of what was seized or not seized, and, eventually, 

whoever’s house was searched or property was searched, they get 

notice of the results of the search warrant? 

Mr. CALABRESE. This is one of the most—— 

Mr. COLLINS. The gentleman’s time has expired. But the witness 

can answer. 

Mr. CALABRESE. This is one of the most invasive things that the 

U.S. Government or any government can do to its citizens, it can 

investigate them, make them the subject of law enforcement scrutiny. So, yes, absent some compelling reason not to notify them, I 

think they absolutely deserve to know that they are the subject of 

government scrutiny. 
118 

Mr. POE. I ask unanimous consent to submit questions for the 

record, Mr. Chairman. 

Mr. COLLINS. You have unanimous consent to submit as many as 

you like, Judge. 

Mr. POE. And we should get the southern rule. If we’re from the 

south, we should be able to talk longer than just 5 minutes. 

Mr. COLLINS. Well, we just are better expressing ourselves in our 

eloquence and slow southern execution. 

Mr. POE. Thank you, Mr. Chairman. 

Mr. COLLINS. With that, the Chair recognizes the gentlelady from 

Texas, Ms. Sheila Jackson Lee. 

Ms. JACKSON LEE. I thank you so very much, Mr. Chairman. And 

I thank the witnesses. I want to engage in a give and take with 

Mr. Calabrese, Mr. Salgado, and Mr. Rosenzweig if I might. But let 

me just ask a pointed question to Mr. Cook. Let me thank all of 

you for your service. And acknowledge that the Warshak case, Mr. 

Ceresney, I will not attribute your win or loss, I will just take the 

case as a Sixth Circuit case. 

I just want to ask, since that case, the Warshak case, Mr. Cook, 

do you know whether or not the Department of Justice has used 

anything less than a warrant based on probable cause to compel a 

third-party provider to produce the contents of a communications? 

You all adhere to that? 

Mr. COOK. Yes. 

Ms. JACKSON LEE. All right. That’s good. Let me move on then. 

Mr. COOK. That was easy. Thank you. 

Ms. JACKSON LEE. Thank you. To say that I come to this with 

a sense of trust of government not to sense that government is unworthy and consistently trying to undermine its citizens. But I am 

an adherent to the Fourth Amendment and its value and its value 

with the Founding Fathers. So let me engage the three of you. One, 

I’m going to go to you, Mr. Rosenzweig, to make it clear that issues 

dealing with terrorism and any elements thereof are specifically, 

pointedly, and appropriately excluded under this legislation. Are 

you comfortable with that? 

Mr. ROSENZWEIG. Very much so. Indeed, that’s part of the ground 

for at least my personal view that this legislation is appropriate. 

Given the post-9/11 changes that have empowered our national security apparatus to protect us in ways that I think are appropriate, 

it’s important to exclude from the coverage of this bill those issues. 

And I think that’s something we can agree on. And the construction provision that is in section 6, I guess it is, of the bill is perfectly appropriate to that end. 

Ms. JACKSON LEE. I think it is important to make note of that. 

I’m on Homeland Security as well. America is obviously on alert. 

But we’ve always said since 9/11 that we would not allow fear to 

instruct and guide our interpretation of the Constitution. I want to 

go to Mr. Salgado. 

Mr. Calabrese, there was a law professor at Yale Law School 

with the same name. Do you have any—— 

Mr. CALABRESE. Sadly, I don’t. 

Ms. JACKSON LEE. I had his class. So you’ll be favored by your 

very name. But let me engage both of you in the question of the 

value and the sanctity of the Fourth Amendment and whether or 
119 

not in this interpretation of this bill, which I understand so many 

of us are on the bill, but 100,000 petitions were sent to the White 

House to support it, whether it is obstructionist in terms of preventing law enforcement from doing their job. Can you all just engage? Maybe Mr. Calabrese will start and Mr. Salgado will finish. 

Mr. CALABRESE. Sure. I don’t believe that it is obstructionist. You 

know, we’re codifying what amounts to existing practice and existing protections under the Fourth Amendment. We’re also saying 

that you should have notice when someone does a search of your 

most private electronic home. And to be clear, unlike a physical 

warrant where you get that notice immediately, we’re actually delaying notice for 10 days here so that law enforcement has got a 

head start. 

Ms. JACKSON LEE. Absolutely. 

Mr. CALABRESE. And then we’re allowing a gag provision which 

says that you, in important circumstances, you’ll never get that notice. I think these are all pretty basic protections for anyone. And, 

honestly, if there are issues around the edges, I’m not sure that 

there are, but if there are, I think that’s why we have markups, 

so that we can bring these issues forward, we can take votes on 

whether there’s anything here that we should be concerned about, 

and then we can get this bill to the floor. 

Ms. JACKSON LEE. Thank you. Mr. Salgado, let me say that I too 

served as a judge and did a lot of PC warrants for police officers. 

And I think this should be a comfort. I had a responsibility to the 

police officer but also to the citizens, to be able to inquire what the 

basis of this warrant was. And that layer was placed in my hands. 

I think the American people place their protection in our collective hands. What do you think? What is your perspective on that? 

And maybe, Mr. Ceresney, you might want to answer that you are 

not hindered by the present Sixth Circuit interpretation. But go 

ahead, Mr. Salgado. 

Mr. SALGADO. Yeah, I agree with that completely. The role of the 

neutral and detached magistrate in American jurisprudence is a 

significant one. It’s something that really sets America apart from 

a lot of countries, and gives us a layer of protection to make sure 

that well-meaning but perhaps poor judgment in some cases is 

overridden by the cooler judgment of a magistrate who doesn’t have 

a particular interest in a case. It’s significant for Fourth Amendment, it’s no accident that that is the standard for valid warrants. 

Ms. JACKSON LEE. Quickly. Thank you. Mr. Ceresney, do you 

want to comment on that as Mr. Yoder sits in the room on pins and 

needles wondering how we’re going to treat his bill? 

Mr. COLLINS. The gentlelady’s time has expired. But the gentleman can answer. 

Ms. JACKSON LEE. Thank you, Mr. Chairman. 

Mr. CERESNEY. I couldn’t agree more that it is important to have 

a role for a judge in this situation to provide objective views on the 

matter. And that’s why the order that we are proposing would be 

before a judge with notice to the subscriber. And the subscriber 

would be able to bring before that judge whatever objections they 

have to our seeking the email. 

And that is actually the remedy that we are seeking in this case. 

We would try to obtain that email from the subscriber. If we 
120 

couldn’t, then we would go before a judge and try to obtain the 

order. And the judge would be the objective factfinder to determine 

whether we’ve met the standard. 

Ms. JACKSON LEE. Mr. Chairman, I like this bill. But I’m willing 

to listen to the gentlemen. But I like our bill before us. And I look 

forward to it going to markup. I yield back. 

Mr. COLLINS. Thank you. The gentlelady’s time has expired. The 

Chair now recognizes the gentleman from Pennsylvania, Mr. 

Marino. 

Mr. MARINO. Thank you, Chairman. Good afternoon, gentlemen. 

My question here is going to be directed to Mr. Rosenzweig and Mr. 

Salgado in that order. Please speak to the trends of users moving 

to encrypted services, often hosted overseas in order to seek privacy, and how this might make us less safe than if we had a clear 

framework in place. Do you understand my question? 

Mr. ROSENZWEIG. I do understand your question. I think to begin 

the answer, obviously, the encryption discussion is slightly different than the one we’re having now about the lawful access to 

content. What I would say about the encryption discussion is that 

it is essentially a reflection of the exact same impulse, which is 

that people are seeing increasingly the lack of privacy in their personal effects and papers in their—I like the idea of a digital home, 

their electronic home. And to the extent that this Congress does 

not take steps to protect that privacy by law, encryption is essentially citizens engaging in self help and protecting themselves with 

their own capabilities. 

I would say that, from my perspective, encryption is an idea. It’s 

a mathematical proof. It’s not suppressible. So if we do not regularize access through things like the proposal before you that will 

provide comfort to citizens, they’re going to engage even more, I 

think, in self help. 

Mr. MARINO. Thank you. Mr. Salgado? 

Mr. SALGADO. I agree completely with that statement. And I 

think to the point in your question about the movement of users 

to services overseas, I think that’s a natural consequence of the 

misimpression that U.S. Government has such easy access to the 

data providers. And it’s not true. And this bill will help make it 

clear. And it will help prevent the fleeing of users to other services 

based on this misperception. 

Mr. MARINO. Thank you. Mr. Cook and Mr. Littlehale, I have 18 

years of law enforcement behind me, prosecution, State and Federal level. And as far as I’m concerned, what I’ve seen here since 

I’ve been in Congress, and this is only my third term, the less Federal Government in my life, the better. 

Basically what NSA has done, what the IRS, and there are many 

more that we could get into, the overreaching and what I think is 

criminality that has taken place in these agencies. But being a law 

enforcement guy, and I’ve prosecuted many child abuse cases and 

pornography cases, if the two of you can quickly tell me what the 

obstacle is to you and how we can fix that. Because I know in some 

investigations that I had, I didn’t want the person who was looking 

at and transferring and uploading and downloading child pornography to know at this point of my investigation that he was the 

target or she was the target. Could you please respond? 
121 

Mr. COOK. Yes, sir. And I’m concerned that we’ve lost sight of 

that issue and the exigent or emergency aid exception issue, so if 

I could just begin with that. The concern that we have is many of 

these investigations, whether it’s child pornography or any other 

type of investigation, many fraud investigations involve dozens, 

sometimes hundreds or thousands sometimes in child pornography 

cases of targets. For us to get the content and then have to let the 

target of the investigation know is a new discovery requirement 

that puts the targets, whether it’s terrorism or otherwise, on notice 

that we’re looking at them. It’s unprecedented, I’ve said that, unprecedented in our law. 

Mr. MARINO. What is the change that we can make? And Mr. 

Littlehale, you go, and then collectively tell me what the changes 

are that you would like to see. 

Mr. LITTLEHALE. Thank you, Congressman. If all we were interested in is extending and leveling the playing field for the 180-day 

rule and content, this bill would be a page long. The notice provisions that you’re talking about, along with the additional protections that the bill provides, are one of the great reasons that we’re 

concerned about it. While I certainly think that we would like to 

have a conversation, I think those are a little bit more than issues 

around the edges. 

I mean, the body of our concern about the bill is that when we 

get a warrant, we want it to mean something. That’s true on the 

earlier point with respect to encryption. You know, if I serve a 

search warrant on somebody, I want to have access to that evidence. And in many instances now, I don’t. Well, I want to find 

that evidence in other places. And if it’s denied to me because of 

delays or because of burdensome notice provisions, those slow me 

down. They make me less effective as an investigator. And I believe 

that this Committee should undertake a robust review of what this 

bill is going to do to the—— 

Mr. MARINO. My time has run out. Would the two of you please 

put in writing and get it to me what you think could be a remedy 

for this, and anyone else who wants to address that as well. 

Listen, I am just as much a Fourth Amendment advocate as I am 

putting these people behind bars. And I wish I—no one should 

have to look at the photos of the kids that I’ve looked at and you’ve 

seen over the years and question as to why we need to have some 

delay before letting that person know that they’re going to be arrested. I yield back. Thank you. 

Mr. COLLINS. The gentleman’s time has expired. The Chair now 

recognizes the gentleman from New York, Mr. Jeffries. 

Mr. JEFFRIES. I thank the distinguished Chair. And I thank the 

witnesses for your presence here today. 

I want to follow up on that discussion from my good friend from 

the great State of—the Commonwealth of Pennsylvania. Mr. Cook, 

I know you’ve expressed concerns as it relates to the notice requirement. And I think in your testimony you refer to the provisions as 

a red alert tool that could notify an individual that he or she is 

under investigation. Is that right? 

Mr. COOK. That is correct. 

Mr. JEFFRIES. And if you could just kind of walk me through a 

series of responses as it relates to the particular concern that 
122 

you’ve got with the notice provision. Because it’s my understanding 

that section 4 permits up to 10 days of delayed notice. Is that 

right? 

Mr. COOK. That’s correct. 

Mr. JEFFRIES. And is it your view that the 10 days is inadequate? 

Mr. COOK. So I think it’s important for me to point out that in 

our discussions already, we have drawn parallels with the Fourth 

Amendment as it applies in other contexts. And everybody seems 

in agreement that that’s the goal, is to make the bill parallel 

Fourth Amendment protections. 

But this bill does more than that. And here’s why. For example, 

if you have terrorists working out of an apartment, a third-party’s 

apartment, and there is evidence in that apartment, we get a 

search warrant, search that apartment, there’s no obligation for us 

to tell the terrorists that we’ve gotten evidence out of that apartment that can be used against them. 

Mr. JEFFRIES. Right. But this bill doesn’t necessarily impose that 

obligation. It’s a default provision, but there are steps that the government can take under exigent circumstances. I wouldn’t think 

that it would be sound public policy to create a law that simply applies in the instance of the terrorist context where this is a country 

of 300-plus million people that values their privacy rights, so there 

has got to be an appropriate balance between the legitimate ability 

of law enforcement to help keep us safe and to prosecute wrongdoers to the full extent of the law, and the civil rights and civil liberties of American citizens. Is that correct? 

Mr. COOK. As an email user, I could not agree more, but I think 

that the Fourth Amendment has already reached that balance because in the analogy that I’ve given you, when we search that 

third-party’s home or service provider, that homeowner or service 

provider is within their rights to contact whomever they want to 

notify them. 

There has never been an obligation for the government to figure 

out who the evidence is going to be used against and to notify 

them. That’s why I say this is unique in the law, and I’ve never 

seen it before. 

Mr. JEFFRIES. Now, as it relates to sort of the 10 days delay, if 

the government concludes that additional delay is warranted, this 

bill, correct, provides for a court to make that determination that 

the notice can be delayed indefinitely. Is that right? 

Mr. COOK. Not indefinitely. There’s a 180-day limitation, and 

then there’s a recurring obligation to reach back to the court. 

Mr. JEFFRIES. Right, but after that 180-day period expires, the 

government can go back to the court and request another 180-day 

delay. Is that correct? 

Mr. COOK. That is correct. There are narrow limitations on it. 

For example, one of the limitations is that if we can show that 

there would be harm to another individual, but there are many 

times when the harm could be to a community rather than an individual, and I wish I could report to you that all judges are reasonable and will always, in the right circumstances, limit that new 

constant—or this new statutory notice rule, but the truth is that 

that just isn’t how it works, and expanding these obligations on the 

government will come with great risk in serious cases. 
123 

Mr. JEFFRIES. But there are times that an Article III judge can 

reasonably, or a magistrate that’s not an Article III judge, but an 

Article III judge or magistrate could reasonably disagree with the 

government as it relates to privacy protections and potential overreach. Is that correct? 

Mr. COOK. Of course. Of course it is, and there are times when 

that will—that this agreement will result in notification to—under 

this newly created rule, to targets of criminal investigations and 

alert them to allow them to flee or otherwise destroy evidence or 

otherwise engage in bad behavior. 

Mr. JEFFRIES. Mr. Calabrese, could you speak to the adequacy of 

this notice requirement in your view? 

Mr. CALABRESE. I believe it’s a very strong notice requirement 

and constitutionally appropriate with a very strong delay procedure. One of the things I’m struggling with a little bit is, we’re 

talking about a circumstance where I am going before the judge 

and getting a search warrant. At that same time, I may get a delay 

of that search warrant, so we’re not talking about some kind of separate process where I’ve got to go through an additional burden. 

When I get the warrant, I can also make the case that I must 

delay notice. That can happen for 180 days. Before a provider or 

anyone else, you know, notifies the subject, they have to tell the 

government that they are going to do that, giving the government 

an ability to go back to the court and say, you know what, the reasons for our delay have not ended and we need to expand it. I 

mean, I think it’s a very reasonable, very balanced approach that 

supports a fundamental constitutional value, one of notice that’s 

embedded in the Fourth Amendment. 

Mr. JEFFRIES. Thank you. I yield back. 

Mr. COLLINS. The gentleman’s time has expired. At this time, the 

Chair recognizes the gentleman from Texas, Mr. Ratcliffe. 

Mr. RATCLIFFE. Thank you, Mr. Chairman. As a former U.S. attorney, I always appreciate and listen to concerns expressed by law 

enforcement whenever Congress proposes changes to a law that 

may impact your ability to do your job because you’re the folks that 

are working so hard to keep us safe, and I want to certainly make 

sure you have the tools and resources and capability necessary to 

do that effectively. 

That being said, I also strongly believe that in an increasingly 

connected, complex, digital society, our laws have to be modernized 

to make sure they reflect the current technological landscape. As 

our technology is evolving, this extremely personal information is 

being stored on our computers, on our smartphones, on our Fitbits, 

where we travel, what we eat, what we read, where we shop, who 

we communicate with, all highly personal information, and so we’ve 

got to make sure we’ve got robust protections in place for that. 

I certainly don’t believe that the Fourth Amendment protections 

that we all hold so dear and the needs of law enforcement are mutually exclusive. And I appreciate all the witnesses being here 

today to have a thoughtful discussion about that. 

Mr. Ceresney, I want to start with you because, from my perspective, it seems like that the SEC has been the most vocal civilian 

agency in expressing concerns about modifying ECPA, but the SEC 

doesn’t appear to have served a subpoena on a commercial provider 
124 

in 5 years since the Warshak decision. And despite that, the SEC’s 

annual report last year, 2014, touted a record year, cutting edge 

enforcement actions, more cases than ever before, a number of first 

ever cases that span the securities industry. 

And I know that Chairman White has testified that the SEC isn’t 

issuing subpoenas to third-party service providers for content. So 

given the record number of cases, enforcement actions, and first 

ever cases brought by the SEC, all done without encroaching on 

Fourth Amendment rights of Americans, why is the SEC asking 

Congress to give it the authority to get content on something less 

than a warrant? 

Mr. CERESNEY. Well, we certainly have been successful, we 

think, in enforcing the securities laws, but that does not mean that 

there aren’t cases that we would benefit tremendously from emails 

that we would be able to obtain from ISPs. And I guess the point 

that I would assert is that the Fourth Amendment is not violated 

by what we are proposing, which would be an order before a judge, 

which a judge could issue, with notice to the subscriber after the 

subscriber has the opportunity to raise whatever objections they 

have under a standard that Congress would establish. And from 

our perspective, that does comply with the Fourth Amendment, and 

it also balances privacy protections because you would have an objective factfinder reviewing the situation and determining whether 

it’s appropriate for us to obtain emails in that circumstance. 

And I can tell you that there are ongoing investigations now, 

which we have refrained from seeking those emails from ISPs, 

which would definitely benefit from such emails. 

Mr. RATCLIFFE. When you say what you are proposing, I mean, 

how have you been proposing it? 

Mr. CERESNEY. We’ve had ongoing discussions with Members of 

Congress about these issues for the last couple of years. 

Mr. RATCLIFFE. Okay. Well, because, you know, from my perspective, it seems like you’ve been altering your behavior for the last 

few years in response to this opinion rather than coming to a committee of jurisdiction, at least from my perspective. I know that 

when FBI has a problem, they come and let us know what it is and 

how we can fix it. 

Mr. CERESNEY. We’ve been having ongoing discussions with the 

staff of both Judiciary Senate and House Judiciary throughout this 

period, certainly since I’ve been at the SEC, which is over—— 

Mr. RATCLIFFE. That’s fair enough. Thanks for that. 

Mr. Salgado, in your testimony, paraphrasing here a little bit, 

but essentially you seem to be saying that H.R. 699 is really just 

a codification of the status quo under Warshak. Is that right? 

Mr. SALGADO. That’s accurate, yes. 

Mr. RATCLIFFE. Okay. You don’t think that H.R. 699 goes beyond 

the holding in Warshak? 

Mr. SALGADO. I don’t think it does. I’m happy to hear suggestions, but my review of Warshak and the bill suggests that they’re 

very consistent. 

Mr. RATCLIFFE. Mr. Calabrese, you agree with that? 

Mr. CALABRESE. I do. 

Mr. RATCLIFFE. Mr. Rosenzweig. 
125 

Mr. ROSENZWEIG. I think I do. I haven’t done—I haven’t checked 

precisely, though. 

Mr. RATCLIFFE. Okay. I’m going to yield. My time is about to expire, so I’m going to yield back the balance of my time. Thank you 

all for being here. 

Mr. COLLINS. The gentleman yields back. Now the Chair recognizes himself for questions. 

Mr. Salgado, there has been an issue, and we brought this up 

here in this emergency issue of provisions, emergency disclosure 

mechanisms, and Mr. Littlehale, actually, in his written testimony, 

that the primary emergency disclosure mechanism currently in law 

are voluntary. He also mentions that companies are often—and 

this is his words—unable or unwilling to respond to law enforcement’s lawful demands in a timely manner. 

Now, I think we all would agree true emergencies are there, and 

as a son of a Georgia State trooper, there’s not going to be anybody 

that would deny the need from a law enforcement perspective. 

However, it seems to be implying that there’s something missing 

here. So we did a little bit of research in our office and with others, 

and based on the concerns we saw, that publishing Google’s transparency report, based on that report, which we have looked at, it 

says Google received 171 emergency disclosure requests and provided at least some data in response to 80 percent of emergency 

disclosure requests. 

One, I think, for most people to understand it, we’ve looked into 

it, but I’d like to hear your answer. To better understand that, can 

you explain why Google responded to only 80 percent of these requests, break down those numbers for us, and why couldn’t the response rate be 100 percent, given what has been heard from Mr. 

Littlehale here. 

Mr. SALGADO. Sure. I’d be happy to. I think the statistic you’re 

referring to is in our transparency report. 

Mr. COLLINS. Yes. 

Mr. SALGADO. We’ve been publishing that number for a while 

here so that policymakers and others can get an idea of what this 

work is like. The number is actually relatively low, 171 compared 

to the type of legal process we get. 

The 80 percent represents lots of different situations where the 

emergency doesn’t justify the disclosure. Often, the case is that the 

identifier that’s given to us in the emergency request doesn’t actually go back to any real account. So there are some services out 

there where you can create an account using a Google or any email 

address, and it’s not verified that there is such an address. They 

may use that account to threaten a school shooting or engage in 

other some violent activity. 

The authorities quite legitimately will come to Google and ask us 

for information about this account that was used to create the account that made the threat. We look in our system, and there is 

no such account, so the response back is we have no data to 

produce in response to this otherwise legitimate emergency request. That gets counted as a nondisclosure, and that adds into the 

20 percent where there was not a disclosure. There was no responsive data. 
126 

That’s probably the most common situation in that 20 percent. 

There may be other situations where the request is coming in and 

the emergency is over, that the investigation is now actually about 

a historical crime, there is no ongoing threat of loss of life or serious physical injury, which means it’s inappropriate to be using that 

authority to get the information. 

And we are able to, at that point, say this doesn’t look like an 

ongoing emergency, we can preserve the information, and when you 

come back to us with the legal process, we can promptly disclose. 

Mr. COLLINS. Okay. And just real quickly, but you went on with 

your answer long enough to bring up a question. Are you making 

that determination if the emergency situation is still ongoing? 

Mr. SALGADO. That’s right. The statute—— 

Mr. COLLINS. Not the law enforcement agency offering? 

Mr. SALGADO. The statute says that we are allowed to disclose 

if we have a good faith belief that there’s an emergency. 

Mr. COLLINS. Okay. Mr. Littlehale, when you testified before 

House Judiciary Committee in 2013 about the emergency disclosure issue, you said that some providers make a decision never to 

provide records in the absence of legal process, no matter the circumstance. 

Can you identify the service providers that have a policy of categorically rejecting emergency requests in the absence of compulsory legal process? If not, why? 

Mr. LITTLEHALE. Congressman, as I stated in response to the 

question at the time, I have made the decision not to identify, in 

the examples that I give, specific providers because I don’t want to 

highlight a vulnerability in a public forum. There may come a time 

when we do have to disclose that. 

Mr. COLLINS. Well, I tell you what. I would like to request you 

can submit that in a nonpublic forum, but I’m really concerned 

here that we’re making a categorical statement without categorical 

proof. 

Mr. LITTLEHALE. Well, I can certainly say anecdotally that the 

agents—— 

Mr. COLLINS. No, I want to know—you made a direct statement. 

Mr. LITTLEHALE [continuing]. That I work with have been told 

that by providers. 

Mr. COLLINS. Mr. Littlehale, you made a direct statement. It 

wasn’t anecdotally. I didn’t start off by saying, ‘‘Anecdotally, providers make a decision never.’’ You said in your testimony, providers make a decision never to provide records in the absence of 

legal process, no matter the circumstance, and that’s a very direct 

statement against the business practices of Internet providers. 

Is it true? Is it not true? Do you have evidence? Or do you not 

have evidence? 

Mr. LITTLEHALE. I have been told that by providers, yes. 

Mr. COLLINS. But you don’t have evidence. You made a statement that is not grounded, except anything and anecdotally. 

Mr. LITTLEHALE. Well, I’d say I would suggest that I do have evidence. I have been told that by providers. 

Mr. COLLINS. Well, I was told that there was a Santa Claus, but 

I found out real quickly there wasn’t. I mean, I’m trying to figure 

out—— 
127 

Mr. LITTLEHALE. Congressman, I would suggest that that’s evidence. If you choose not to believe me, then I suppose I can’t help 

you with that, but I have been told and agents that work for me 

have been told that in some cases. 

Mr. COLLINS. I’ll just let that one sit. 

Mr. Ceresney, during an exchange with Senator Leahy in a Senate hearing on this topic, you said that with regard to phone calls, 

you’re not seeking authority, the criminal—authority that criminal 

authorities have that civil agencies do not, but in seeking to get access to emails without a warrant, you’re essentially seeking something more than the authority, the criminal authorities have. Isn’t 

that contradictory? 

Mr. CERESNEY. I don’t think we’re seeking more authority than 

the criminal authorities have. 

Mr. COLLINS. So what are you seeking? 

Mr. CERESNEY. I’m sorry? 

Mr. COLLINS. Then what are you seeking? I’ll give you a chance 

to clarify that. 

Mr. CERESNEY. Sure. What we’re seeking is the ability to obtain 

emails after we try to obtain them from an individual subscriber 

by going to a court and obtaining a court order with notice to the 

subscriber and allowing the subscriber to raise whatever objections 

they have before the court. 

Mr. COLLINS. Well, I think it’s—and like I said, it’s interesting 

that some of the testimony that’s been given here, and I think, you 

know, it’s very concerning from some issues of anecdotal evidence 

and real evidence and discussion, especially on the SEC side, when 

you’re, you know, giving the—you know, your own report saying 

you’re doing more than you’ve ever done here, yet without this, by 

choice or decision, however you’re wanting to do it. 

Mr. Calabrese, one last question for you, as my time is now over. 

But in dissent from the FTC request of civil agency carve out, FTC 

Commissioner Brill wrote, ‘‘I am not convinced that this authority 

is necessary to maintain the commission’s effectiveness as a law 

enforcement agency now or in cases that we can presently foresee. 

On the other hand, I am concerned that the judicial mechanism for 

civil law enforcement agencies to obtain content from ECPA providers could entrench authority that have potential to lead invasions of individual privacy, and under some circumstances, may be 

unconstitutional in practice.’’ 

Could you speak very briefly. Do you agree or disagree with his 

concern? 

Mr. CALABRESE. I do worry that we will create an unconstitutional or incredibly reckless carve out for civil agencies. And my 

hope is that we continue to push H.R. 699 forward as is to a markup and we can vote and get it to the floor. Thank you. 

Mr. COLLINS. Well, I appreciate it. In looking around and seeing 

how it’s just me and the distinguished Ranking Member, this concludes today’s hearing. I’d like to thank all the witnesses for attending. Without objection, all Members have 5 legislative days to 

submit additional written questions for the witnesses or additional 

materials for the record. 

And with that, this hearing is adjourned. 

[Whereupon, at 12:28 p.m., the Committee was adjourned.] 

(129) 

A P P E N D I X 

MATERIAL SUBMITTED FOR THE HEARING RECORD

Prepared Statement of the Honorable Doug Collins, a Representative in 

Congress from the State of Georgia, and Member, Committee on the Judiciary 

Mr. Chairman, thank you for holding today’s hearing on H.R. 699, the Email Privacy Act. I appreciate the chance to discuss this important legislation and hear from 

the witnesses. I hope that today’s hearing is just the first step towards Committee 

mark-up and consideration of H.R. 699. 

H.R. 699 was introduced by my friend from Kansas, Rep. Kevin Yoder. I am a 

cosponsor and strong supporter of the Email Privacy Act. If enacted, the bill would 

update the Electronic Communications Privacy Act to better reflect advances in 

technology and to ensure that Americans’ electronic communications are protected 

from unwarranted government intrusion. 

As of today this legislation has 305 cosponsors, earning it the distinction of being 

the most supported piece of legislation in the House that has not yet received consideration on the House Floor. Twenty-eight of these cosponsors serve on the House 

Judiciary Committee. The majority of each party has cosponsored the legislation. It 

is not often that you see this type of overwhelming bipartisan support for legislation, but the numbers speak for themselves that this issue is one that deserves and 

demands consideration. 

I understand that certain Members may have concerns with specific provisions of 

the legislation. While I support the legislation in its current form, I think the best 

way to address these concerns is through a markup of the legislation, where amendments can be discussed and democratically considered. No one is served by this legislation languishing in legislative limbo. 

Law enforcement needs clarity. Internet service providers need laws that accurately reflect their technological advances. And most importantly, the American people need and deserve privacy protections guaranteed to them by the Fourth Amendment of the United States Constitution. 

It is past time that our digital privacy laws were updated to reflect today’s technology and communications climate. The Electronic Communications Privacy Act 

(ECPA) was written in 1986, and intended to balance the interests of preserving 

citizens’ privacy rights while protecting legitimate law enforcement needs. While the 

principles behind the law are still critically important and it remains a hallmark 

of privacy protections for communications, in practice many parts of the law simply 

have not kept up with the world as it is today. ECPA—and in particular the Stored 

Communications Act (SCA) provision of the law—must be amended to reflect the realities of the digital era in which we live. 

The Email Privacy Act takes critical steps to update ECPA so that Americans’ 

Fourth Amendment rights are better protected and so that citizens’ can communicate on the internet free from unwarranted government snooping. 

The bill eliminates the outdated ‘‘180 day’’ standard from current law. Current 

law under ECPA does not require law enforcement to obtain a warrant to access 

the content of emails or other forms of online communication—such as documents 

stored on a cloud service—if they are more than 180 days old. For messages over 
130 

1 United States v. Warshak, 631 F.3d 266 (6th Cir. 2010). 

180 days old, only a subpoena—rather than a warrant—is required for access. While 

this distinction may have made sense when storage space on personal computers 

was extremely limited and emails were still a fledging and rarely used form of communication, it certainly does make sense today. Americans deserve the same strong 

Fourth Amendment protections whether their emails are a day old or several 

months old. The Email Privacy Act addresses this issue by instituting a requirement 

that law enforcement obtains a search warrant before accessing the content of 

Americans’ private emails and online communications. 

H.R. 699 would essentially codify a decision issued by the Sixth Circuit Court of 

Appeals in 2010 in United States v. Warshak while clarifying additional privacy protections. In Warshak the Court held that the government’s accessing of 27,000 

emails directly from a suspect’s internet service provider (ISP) with a subpoena and 

an ex parte order was unlawful under the Fourth Amendment. Specifically, the 

Sixth Circuit said that subscribers have ‘‘a reasonable expectation of privacy in the 

contents of emails ‘that are stored with, or sent or received through, a commercial 

ISP’’’ and ‘‘to the extent that the SCA purports to permit the government to obtain 

such emails warrantlessly, the SCA is unconstitutional.’’ 1

In light of Warshak and the Email Privacy Act, the Securities and Exchange Commission (SEC) and other civil agencies have sought exemptions from the warrant 

requirement, arguing instead that it should be allowed to retain subpoena powers. 

The SEC maintains that subpoena authority is critical for their investigations, but 

that statement has been called in question by SEC Chair Mary Jo White’s admission that the SEC has not used subpoena authority post-Warshak. 

The Federal Trade Commission (FTC) has made similar claims that it should be 

subject to a warrant exemption when seeking content from ISPs. However, Commissioner Brill went so far as to file a dissent to the FTC’s request for a carve out. 

Commissioner Brill stated, ‘‘I am not convinced that this authority is necessary to 

maintain the Commission’s effectiveness as a law enforcement agency now or in 

cases that we can presently foresee. On the other hand, I am concerned that a judicial mechanism for civil law enforcement agencies to obtain content from ECPA providers could entrench authority that have the potential to lead to invasions of individuals’ privacy and, under some circumstances, maybe unconstitutional in practice.’’ 

I share Commissioner Brill’s concerns. Absent much more compelling evidence 

from civil investigative agencies, I do not believe that these agencies should be allowed to pry into Americans’ personal lives based solely on subpoena authority. This 

kind of change could fundamentally harm the important steps taken in H.R. 699 

to better protect Americans’ rights to have their online communications protected. 

Let me make clear that I believe it is critical law enforcement has the tools they 

need to prevent and fight crime. My father was a Georgia State Trooper, so I was 

instilled with respect and admiration for our men and women in uniform from a 

young age. I believe that in true emergencies, law enforcement needs to be able to 

access information quickly. I believe there are potentially legitimate reasons that 

law enforcement would seek the content of an individual’s online communication. 

However, I do not believe that we should create so many carve-outs and exceptions 

to the law that the purpose of the legislation is lost. We must carefully balance the 

needs of law enforcement with the rights of Americans. 

The Email Privacy Act updates ECPA to restore that balance and bring our privacy laws into today’s world. I look forward to hearing from our witnesses, and I 

hope that today is a step closer towards passage of H.R. 699. 

Thank you Mr. Chairman, I yield back. 

f 
131 

Prepared Statement of the Honorable Sheila Jackson Lee, a Representative 

in Congress from the State of Texas, and Member, Committee on the Judiciary 

Thank you, Mr. Chairman. Let me extend my thanks to you and Ranking Member 

Conyers for working together in a spirit of bipartisanship to convene this important 

hearing on H.R. 699, the ‘‘Email Privacy Act.’’ 

The Fourth Amendment to the United States Constitution states: 

• ‘‘The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and 

no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons 

or things to be seized.’’ 

The Fourth Amendment originally enforced the notion that ‘‘each man’s home is 

his castle’’, secure from unreasonable searches and seizures of property by the government. 

The authors of the Constitution had good cause to work to establish protections 

against government overreach, which they themselves experienced. 

In our history we can understand the seriousness with which the Founding Fathers viewed government authority to search private citizens’ correspondence or 

communications. 

The British authorities used writs of assistance, a form of general warrant, which 

permitted house-to-house searches. 

These orders generally failed to allege any illegal activity and were not approved 

by a judge. 

John Adams credited these practices as being ‘‘the spark in which originated the 

American Revolution.’’ 

As a direct result the founders of this nation drafted the Fourth Amendment to 

the Constitution of the United States. 

However, beginning with the 1967, Supreme Court decision in Katz v. United 

States (establishing the ‘‘reasonable expectation of privacy’’ test) held that what a 

person knowingly exposes to the public, even in a home or office, is not subject to 

Fourth Amendment protection. 

This holding began the move to establish what has become known as the Third 

Party Doctrine—such that the Fourth Amendment does not prohibit the obtaining 

of information revealed to a third party and conveyed to him by Government authorities, even if the information is revealed on the assumption that it will be used 

only for a limited purpose and the confidence placed in the third part will not be 

betrayed. 

The Third Party Doctrine was expanded in two key Supreme Court decisions in 

mid- to late 1970s: U.S. v. Miller, 425 U.S. 435 (1976) (holding that one does not 

have a constitutionally protected privacy interest in personal records held by a 

bank), and Smith v. Maryland, 442 U.S. 735 (1979) (holding that the installation 

and use of the pen register was not a ‘‘search’’ and thus no warrant was required). 

These integral cases came before the Internet and long before the use of Cloud 

based computing services, but their impact are still felt today. 

The Modern Communication Age 

In possibly the first survey of its kind, in 1983, the polling firm Louis Harris & 

Associates asked U.S. adults if they had a personal computer at home and, if so, 

if they used it to transmit information over telephone lines. 

Just 10% of adults surveyed said they had a home computer and, of those, 14% 

said they used a modem to send and receive information. 

The resulting estimate was that 1.4% of U.S. adults used the internet in 1983. 

In 2014, the Pew Center for American life found that eight in ten U.S. adults 

(81%) say they use laptop and desktop computers. 

Further, 90% of adults in the United States own a smartphone, providing them 

with instant access to email services. 

While the 1986 enactment of the Electronic Communications Privacy Act (ECPA) 

(which sought to govern how law enforcement agencies and private parties may access electronic communications, was meant to be forward looking as technologies 

began to rapidly advance), and various lower court decisions such as the 2010 Sixth 

Circuit case U.S. v. Warshak, 631 F.3d 266 (6th Cir. 2010), (which held that subscribers have a reasonable expectation of privacy in the content of electronic communications and that the government must obtain a warrant to access email stored by 

a third party), have attempted to clarify and govern electronic storage on third party 

servers, constitutional and legislative privacy safeguards for electronic communica-
132 

tions and other forms of developing digital media are wholly inadequate for modern 

times. 

The advent of Cloud Commuting services has only further broadened the question 

of third parties and communications due to the storage of not only emails, but digital photos, video, audio, electronic books, music preferences, political views, religious beliefs or the lack thereof. 

Smart devices in use by tens of millions of Americans allow for the collection, and 

retention of much more information—and that retention is outside of the control of 

the email user. 

The use of email as a primary means of communication is not limited to individuals, but obviously extends to businesses. 

The number of worldwide email accounts continues to grow from over 4.1 billion 

accounts in 2014 to over 5.2 billion accounts by the end of 2018. 

The total number of worldwide email users, including both business and consumer 

users, is also increasing from over 2.5 billion in 2014 to over 2.8 billion in 2018. 

Email remains the most pervasive form of communication in the business world, 

while other technologies such as social networking, instant messaging (IM), mobile 

IM, and others are also taking hold, email remains the most ubiquitous form of 

business communication. 

H.R. 699 a Step in the Right Direction 

H.R. 699, The Email Privacy Act will amend the 29-year-old Electronic Communications Privacy Act to prevent the government from accessing private electronic 

communications without a warrant. 

Specifically, the Email Privacy Act will prohibit a provider of remote computing 

service or electronic communication service (including email communications) to the 

public from knowingly divulging to a governmental entity the contents of any communication that is in electronic storage or otherwise maintained by the provider, 

subject to exceptions. 

H.R. 699 will revise provisions under which the government may require a provider to disclose the contents of such communications. 

The bill further clarifies the Electronic Communication Privacy Act of 1986 by 

eliminating the different requirements applicable under current law such how communications would be treated if they are: 

o stored for fewer than, or more than, 180 days by an electronic communication 

service; or 

o held by an electronic communication service as opposed to a remote computing 

service. 

Importantly, this bill requires the government to obtain a warrant from a court 

before requiring providers to disclose the content of such communications regardless 

of how long the communication has been held in electronic storage by an electronic 

communication service, or whether the information is sought from an electronic 

communication service or a remote computing service. 

FBI Director Comey, has testified that the current practice of the FBI is to obtain 

a warrant for e-mail communications, and that this bill would not change their current practices. 

Moreover, this bill would not change any of the existing exceptions in the Electronic Communication Privacy Act that allow emergency requests for assistance to 

be processed in a timely manner. 

The bill does require a law enforcement agency, within 10 days after receiving the 

contents of a customer’s communication, or a governmental entity, within 3 days, 

to provide a customer whose communications were disclosed by the provider a copy 

of the warrant and a notice that such information was requested by, and supplied 

to, the government entity. 

It further allows the government to request delays of such notifications. 

H.R. 699 is an important measure that directs the Comptroller General to report 

to Congress regarding disclosures of customer communications and records under 

provisions: (1) as in effect before the enactment of this Act, and (2) as amended by 

this Act. 

The Constitution of the United States is alive and well in the 21st Century, and 

this bill through overwhelming bipartisan support is making strides to make sure 

that citizens are secure in their digital records and effects. 

Again, thank you for holding this important hearing and I look forward to the testimony of our distinguished panel of witnesses. 

Thank you. I yield back the remainder of my time. 

f 
133 
134 
135 

f 
136 

Æ