```

[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]

                           EMAIL PRIVACY ACT

=======================================================================

                                HEARING

                               BEFORE THE

                       COMMITTEE ON THE JUDICIARY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             FIRST SESSION

                                   ON

                                H.R. 699

                               __________

                            DECEMBER 1, 2015

                               __________

                           Serial No. 114-53

                               __________

         Printed for the use of the Committee on the Judiciary

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

      Available via the World Wide Web: http://judiciary.house.gov
      
                                   ______

                         U.S. GOVERNMENT PUBLISHING OFFICE 

97-726 PDF                     WASHINGTON : 2016 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Publishing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
         DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
                          Washington, DC 20402-0001      
      
      
      
      
      
      
      
      
      
      
                       COMMITTEE ON THE JUDICIARY

                   BOB GOODLATTE, Virginia, Chairman
F. JAMES SENSENBRENNER, Jr.,         JOHN CONYERS, Jr., Michigan
    Wisconsin                        JERROLD NADLER, New York
LAMAR S. SMITH, Texas                ZOE LOFGREN, California
STEVE CHABOT, Ohio                   SHEILA JACKSON LEE, Texas
DARRELL E. ISSA, California          STEVE COHEN, Tennessee
J. RANDY FORBES, Virginia            HENRY C. ``HANK'' JOHNSON, Jr.,
STEVE KING, Iowa                       Georgia
TRENT FRANKS, Arizona                PEDRO R. PIERLUISI, Puerto Rico
LOUIE GOHMERT, Texas                 JUDY CHU, California
JIM JORDAN, Ohio                     TED DEUTCH, Florida
TED POE, Texas                       LUIS V. GUTIERREZ, Illinois
JASON CHAFFETZ, Utah                 KAREN BASS, California
TOM MARINO, Pennsylvania             CEDRIC RICHMOND, Louisiana
TREY GOWDY, South Carolina           SUZAN DelBENE, Washington
RAUL LABRADOR, Idaho                 HAKEEM JEFFRIES, New York
BLAKE FARENTHOLD, Texas              DAVID N. CICILLINE, Rhode Island
DOUG COLLINS, Georgia                SCOTT PETERS, California
RON DeSANTIS, Florida
MIMI WALTERS, California
KEN BUCK, Colorado
JOHN RATCLIFFE, Texas
DAVE TROTT, Michigan
MIKE BISHOP, Michigan

           Shelley Husband, Chief of Staff & General Counsel
        Perry Apelbaum, Minority Staff Director & Chief Counsel
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
        
                            C O N T E N T S

                              ----------                              

                            DECEMBER 1, 2015

                                                                   Page

                                THE BILL

H.R. 699, the ``Email Privacy Act''..............................     2

                           OPENING STATEMENTS

The Honorable Bob Goodlatte, a Representative in Congress from 
  the State of Virginia, and Chairman, Committee on the Judiciary     1
The Honorable John Conyers, Jr., a Representative in Congress 
  from the State of Michigan, and Ranking Member, Committee on 
  the Judiciary..................................................    20

                               WITNESSES

Andrew Ceresney, Director, Division of Enforcement, United States 
  Securities and Exchange Commission
  Oral Testimony.................................................    23
  Prepared Statement.............................................    25
Steven H. Cook, President, National Association of Assistant 
  United States Attorneys
  Oral Testimony.................................................    31
  Prepared Statement.............................................    33
Richard Littlehale, Assistant Special Agent in Charge, Tennessee 
  Bureau of Investigation
  Oral Testimony.................................................    47
  Prepared Statement.............................................    49
Chris Calabrese, Vice President, Policy, Center for Democracy and 
  Technology
  Oral Testimony.................................................    58
  Prepared Statement.............................................    60
Richard Salgado, Director, Law Enforcement and Information 
  Security, Google Inc.
  Oral Testimony.................................................    75
  Prepared Statement.............................................    77
Paul Rosenzweig, Visiting Fellow, The Heritage Foundation, 
  Founder, Red Branch Consulting
  Oral Testimony.................................................    89
  Prepared Statement.............................................    91

          LETTERS, STATEMENTS, ETC., SUBMITTED FOR THE HEARING

Prepared Statement of the Honorable Jared Polis, a Representative 
  in Congress from the State of Colorado, submitted by the 
  Honorable John Conyers, Jr., a Representative in Congress from 
  the State of Michigan, and Ranking Member, Committee on the 
  Judiciary......................................................   102

                                APPENDIX
               Material Submitted for the Hearing Record

Prepared Statement of the Honorable Doug Collins, a 
  Representative in Congress from the State of Georgia, and 
  Member, Committee on the Judiciary.............................   129
Prepared Statement of the Honorable Sheila Jackson Lee, a 
  Representative in Congress from the State of Texas, and Member, 
  Committee on the Judiciary.....................................   131
Prepared Statement of the Honorable Kevin Yoder, a Representative 
  in Congress from the State of Kansas...........................   133
Letter from the Honorable Brad R. Wenstrup, a Representative in 
  Congress from the State of Ohio..........................136
                       deg.OFFICIAL HEARING RECORD
          Unprinted Material Submitted for the Hearing Record

Material submitted by the Honorable Bob Goodlatte, a Representative in 
    Congress from the State of Virginia, and Chairman, Committee on the 
    Judiciary. This material is available at the Committee and can also 
    be accessed at:

    http://docs.house.gov/Committee/Calendar/
ByEvent.aspx?EventID=104232.

 
                           EMAIL PRIVACY ACT

                              ----------                              

                       TUESDAY, DECEMBER 1, 2015

                        House of Representatives

                       Committee on the Judiciary

                            Washington, DC.

    The Committee met, pursuant to call, at 10:12 a.m., in room 
2141, Rayburn House Office Building, the Honorable Bob 
Goodlatte (Chairman of the Committee) presiding.
    Present: Representatives Goodlatte, Sensenbrenner, Chabot, 
Issa, King, Gohmert, Jordan, Poe, Chaffetz, Marino, Gowdy, 
Collins, DeSantis, Walters, Buck, Ratcliffe, Trott, Bishop, 
Conyers, Nadler, Lofgren, Jackson Lee, Johnson, Chu, DelBene, 
Jeffries, and Cicilline.
    Staff Present: (Majority) Shelley Husband, Chief of Staff & 
General Counsel; Branden Ritchie, Deputy Staff Director & Chief 
Counsel; Allison Halataei, Parliamentarian & General Counsel; 
Kelsey Williams, Clerk; Caroline Lynch, Chief Counsel, 
Subcommittee on Crime, Terrorism, Homeland Security, and 
Investigations; (Minority) Perry Apelbaum, Staff Director & 
Chief Counsel; Aaron Hiller, Chief Oversight Counsel; Joe 
Graupensperger, Chief Counsel, Subcommittee on Crime, 
Terrorism, Homeland Security, and Investigations; Tiffany 
Joslyn, Deputy Chief Counsel, Crime, Terrorism, Homeland 
Security, and Investigations; and Veronica Eligan, Professional 
Staff Member.
    Mr. Goodlatte. Good morning. The Judiciary Committee will 
come to order, and without objection, the Chair is authorized 
to declare recesses of the Committee at any time. We welcome 
everyone to this morning's legislative hearing on H.R. 699, the 
``Email Privacy Act,'' and I'll begin by recognizing myself for 
an opening statement.
    [The bill, H.R. 699, follows:]
    
    
   [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT] 
    
    
    
                               __________
    Mr. Goodlatte. Today's hearing examines H.R. 699, the 
``Email Privacy Act,'' and the need to modernize the Electronic 
Communications Privacy Act, or ECPA. In enacting ECPA nearly 30 
years ago, Congress declared that the law's purpose was to 
achieve a fair balance between the privacy expectations of 
American citizens and the legitimate needs of law enforcement 
agencies. Reforming this decades old outdated law has been a 
priority for me as Chairman of this Committee, and I've been 
working with Members of Congress, advocacy groups, and law 
enforcement for years on many complicated nuances involved in 
updating this law.
    I am pleased to now hold this important hearing to examine 
the leading reform proposal in the House, H.R. 699, and to 
examine in more detail the nuances Congress must consider in 
updating this law. While technology has undoubtedly outpaced 
the law in the last three decades, the purpose of the law 
remains steadfast. I am confident that Congress will once again 
strike that balance and do so in a way that continues to 
promote the development and use of new technologies and 
services, and create a statutory framework that will modernize 
the law to reflect how people communicate with one another 
today and in the future.
    ECPA reform has broad sweeping implications. ECPA, and more 
specifically, the Stored Communications Act, governs Federal, 
State, and local government access to stored email, account 
records, and subscriber information from telephone, email, and 
other service providers. ECPA not only applies when law 
enforcement seeks information in a criminal investigation, but 
also in civil investigations and for public safety emergencies.
    H.R. 699, at its core, establishes for the first time, in 
Federal statute, a uniform warrant requirement for stored 
communications content in criminal investigations, regardless 
of the type of service provider, the age of an email, or 
whether the email has been opened. I support the core of H.R. 
699, which would establish a standard that embodies the 
principles of the Fourth Amendment and reaffirms our commitment 
to protecting the privacy interests of the American people.
    However, our adherence to the Fourth Amendment should not 
end there. Congress can ensure that we are furthering the 
legitimate needs of law enforcement through ECPA reform by 
joining with the warrant requirement recognized exceptions and 
procedures designed to further the legitimate needs of law 
enforcement. One of the goals of this legislation is to treat 
searches in the virtual world and the physical world equally, 
so it makes sense that the exceptions to the warrant 
requirement and the procedures governing service of warrants 
should also be harmonized.
    It is well settled law that the government may conduct a 
search in the absence of a warrant in certain instances, 
including when the government determines that an emergency 
exists requiring the search, or when the government obtains the 
consent of the owner of the information. The Stored 
Communications Act, however, created a framework unique to the 
electronic world in which even in an emergency or with a 
consent of the customer, disclosure of email content or even 
noncontent records is voluntary at the discretion of the 
provider. It is also well established law that a search warrant 
must be served at the place where the search or seizure occurs.
    For 3 decades, ECPA warrants have been executed with the 
provider because, as with any other third-party custodian, the 
information sought is stored with them. H.R. 699 would now 
require the government to also serve the warrant directly on 
the criminal suspect, a proposal which has raised serious 
public safety and operational concerns across the law 
enforcement community.
    Congress should also continue to ensure that civil 
investigative agencies are able to obtain electronic 
communication information for civil violations of Federal law. 
Courts have routinely held that subpoenas satisfy the 
reasonableness requirement of the Fourth Amendment. Unlike a 
warrant, which is issued without prior notice, and is executed 
often by force with an unannounced and unanticipated physical 
intrusion. A subpoena commences an adversarial process during 
which the person served with the subpoena may challenge it in 
court before complying with its demands.
    The Stored Communications Act currently authorizes the 
issuance of a subpoena directly to the provider, albeit with a 
requirement that the government notify the customer. But 
Congress can go further to ensure that ECPA satisfies the 
Fourth Amendment by requiring that any civil process authorized 
by the law begin with service of a subpoena directly on the 
customer.
    In this context, the customer is provided notice and the 
opportunity to contest the subpoena. Enforcement of the 
subpoena through a court order issued by a Federal judge that 
protects the rights and privileges of the customer, while 
ensuring that evidence of illegal activity is not insulated 
from investigators, would afford heightened protections beyond 
that which the courts have deemed necessary to comport with the 
Fourth Amendment.
    Congress has enacted laws that impose penalties for certain 
conduct, sometimes criminal penalties and sometimes civil. We 
have established Federal agencies to enforce these laws with 
the tools necessary to carry out that enforcement. Congress 
should ensure that, in its efforts to modernize ECPA, we do not 
eliminate access to evidence of violations of Federal law 
simply because Congress chose to make those violations 
punishable by civil penalties.
    I want to thank our distinguished witnesses for being here 
today, and I look forward to hearing from each of you on H.R. 
699 and how to properly balance the privacy expectations of 
American citizens and the legitimate needs of law enforcement. 
And I look forward to working with all Members on both sides of 
the aisle to modernize the Electronic Communications Privacy 
Act. It is worth noting today that we also plan to hold a 
separate hearing in the future on the issue surrounding law 
enforcement access to information located on servers outside 
the U.S. As with the broader topic of ECPA reform, that is an 
issue with many nuances that we should carefully examine.
    I would now like to ask unanimous consent to enter the 
following items into the record: a statement dated 
1 deg.December 1, 2015, from the Department of 
Justice; a 2 deg.letter from the Federal Bureau of 
Investigation Agents Association dated November 24, 2015; a 
3 deg.letter from the National Association of Police 
Organizations dated November 30, 2015; a 4 deg.letter 
from the Association of Prosecuting Attorneys dated November 
24, 2015; a 5 deg.letter from the Virginia Association 
of Commonwealth Attorneys dated July 10, 2015; a 
6 deg.letter from the Technology Councils of North 
America dated November 30, 2015; a 7 deg.statement 
from Americans for Tax Reform dated December 1, 2015; and a 
8 deg.coalition letter signed by Tech Freedom and 
other coalition members dated November 30, 2015.*
---------------------------------------------------------------------------
    *Note: The material submitted by Mr. Goodlatte is not printed in 
this hearing record but is on file with the Committee. See also ``For 
the Record Submission--Rep. Goodlatte'' at:

      http://docs.house.gov/Committee/Calendar/
      ByEvent.aspx?EventID=104232.
    Without objection, the items have been entered into the 
record.
    It's now my pleasure to recognize the Ranking Member of the 
Judiciary Committee, the gentleman from Michigan, Mr. Conyers 
for his opening statement.
    Mr. Conyers. Thank you, Chairman Goodlatte, Members of the 
Committee, and our honored witnesses here for the hearing, and 
those who are in 2141 to participate in the listening of this 
very important measure.
    H.R. 699, the ``Email Privacy Act,'' enjoys I'm pleased to 
say, the overwhelming bipartisan support in the House. As of 
this morning, the bill has earned 304 cosponsors; 191 
Republicans, 113 Democrats; and 27 Members of the House 
Judiciary Committee.
    Now, what do all of these Members have in common? First of 
all, we agree that the Electronic Communications Privacy Act is 
outdated and provides unjustifiably inconsistent standards for 
government access to our stored communication. This statute 
continues to serve as one of the main guarantees of our digital 
privacy, but the law was designed in 1986, when few of us used 
email, and even fewer imagined a world in which we could so 
freely share information online.
    The consequences of applying a 30-year-old understanding of 
technology to modern communications are inconsistent, at best. 
For example, the law seems to apply different standards for 
government access to the same email at different points in its 
lifecycle, when it's drafted, when it's transmitted, when it's 
opened by its recipient, and when it is archived in the cloud. 
We are not well served by a law whose application is 
unpredictable and that the courts have had great difficulty in 
interpreting. Because of the rapid pace of technological 
change, this situation will only get worse if we do not act.
    Secondly, the sponsors of this bill agree that the 
government should be obligated to show probable cause before it 
can require a provider to disclose the content in its 
customer's mail, no matter how old the message is. This 
standard is consistent with the holding of the Sixth Circuit 
court in the Warshak case in 2010. That case motivated the 
Department of Justice to voluntarily adopt a warrants for email 
standard. It also effectively ended the unconstitutional use of 
subpoenas to compel third parties to produce content in civil 
enforcement actions.
    Current law requires the government to show probable cause 
and obtain a warrant only for email that has been in storage 
for 180 days or less. But the government can use and subpoena 
for the same email if it's stored for 1 day longer. This is no 
longer acceptable to most Americans. As the Sixth Circuit 
rightly observed, citizens have the same reasonable expectation 
of privacy in their email before and after the 180-day mark, 
and as the Department of Justice testified soon thereafter, 
there is no principal basis to treat email less than 180 days 
old differently than email more than 180 days old.
    Thirdly, the sponsors of H.R. 699 all agree that current 
law is not adequate to protect new forms of digital 
communication. Content is content. Our expectation of privacy 
does not diminish merely because Congress didn't think of the 
medium when it last visited the statute. The law should protect 
electronic communications across the board, email, text 
messages, private messages of all sorts, and other forms of 
digital information stored in the cloud.
    Finally, the sponsors of this bill agree that we must act 
without delay. We have an obligation to provide clear standards 
to law enforcement with respect to emerging technologies. We 
should also recognize that American businesses cannot sustain 
these new technologies if consumers cannot trust them.
    As the Committee takes up this bill, we should ensure that 
it does not conflict with the basic notion that the 
government's seizure of our email without a warrant violates 
the Fourth Amendment, but we should note that this principle 
has already taken hold across the Federal Government. The 
Department of Justice already uses warrants for email in 
criminal cases. The government stopped using lesser process in 
the civil context years ago.
    In short, Mr. Chairman and Members, this legislation 
accomplishes two vital tasks. It updates the statute for modern 
use, and it does so without any significant interruption to law 
enforcement. We should all come together on this bill as soon 
as possible, and I want to personally thank the witnesses for 
being with us today and for their testimony, and I urge my 
colleagues to give this measure their full support, and I thank 
the Chairman.
    Mr. Goodlatte. Thank you, Mr. Conyers. And before we swear 
in the witnesses, I'd like to recognize the presence of the 
chief sponsor of the legislation, the gentleman from Wisconsin, 
Mr. Yoder. Thank you for being with us today. Kansas, Kansas, 
Kansas. The gentleman from Wisconsin says he'll take you.
    We welcome our distinguished witnesses today, and if you 
would all please rise, I'll begin by swearing you in. If you'd 
please raise your right hand.
    Do you and each of you swear that the testimony that you 
are about to give shall be the truth, the whole truth, and 
nothing but the truth, so help you God?
    Thank you very much. You may please be seated, and let the 
record reflect that the witnesses have responded in the 
affirmative.
    Mr. Andrew Ceresney is the director of the enforcement 
division at the United States Securities and Exchange 
Commission, where he has served since 2013. Prior to joining 
the SEC, Mr. Ceresney served as the assistant United States 
Attorney in the U.S. Attorneys Office for the Southern District 
of New York where he was a deputy chief appellate attorney and 
a member of the Securities and Commodities Fraud Task Force in 
the Major Crimes Unit. As a prosecutor, Mr. Ceresney handled 
numerous white-collar criminal investigations, trial and 
appeals, including matters related to securities fraud, mail 
and wire fraud, and money laundering. He is a graduate of 
Columbia College and Yale law school.
    Mr. Steven Cook is president of the National Association of 
Assistant U.S. Attorneys. He currently serves as the chief of 
staff of the criminal division of the U.S. Attorney's Office 
for the Eastern District of Tennessee. He has been an assistant 
U.S. Attorney for 29 years. In this capacity, he has worked in 
the Organized Crime Drug Enforcement Task Force and the General 
Crimes Section where he handled white-collar crime, fraud, and 
public corruption. He also served as the deputy criminal chief 
in the narcotics and violent crime section. Prior to joining 
the U.S. Attorney's Office, Mr. Cook was a police officer for 7 
years in Knoxville, Tennessee. He earned a JD from the 
University of Tennessee.
    Mr. Richard Littlehale is the assistant special agent in 
charge at the Tennessee Bureau of Investigation. In addition to 
his duties as an investigative supervisor, Mr. Littlehale 
serves as an advisor and trainer in criminal law and procedure, 
as well as the Bureau's chief firearms instructor. Mr. 
Littlehale is a frequent presenter to community organizations 
on ways to protect children online. He is active in engaging 
the legal community on better ways to protect children from 
victimization. Mr. Littlehale received a bachelor's degree from 
Bowdoin College and JD from Vanderbilt University.
    Mr. Chris Calabrese is the vice president for policy at the 
Center for Democracy and Technology where he oversees the 
center's policy portfolio. Before joining CDT, Chris served as 
legislative counsel at the American Civil Liberties Union 
legislative office where he led advocacy efforts relating to 
privacy, new technology, and identification systems. Prior to 
joining the ACLU, Chris served as legal counsel to the 
Massachusetts Senate majority leader. Chris is a graduate of 
Harvard University and holds a JD from the Georgetown 
University Law Center.
    Mr. Richard Salgado is the director of law enforcement and 
information security at Google. Mr. Salgado oversees Google's 
global law enforcement and national security efforts and legal 
matters relating to data, security, and investigations. 
Previously, Mr. Salgado worked with Yahoo and also served as 
senior counsel in the computer crimes section of the U.S. 
Justice Department. As a prosecutor, he specialized in computer 
network crime, such as hacking, wiretaps, denial of service 
attacks, malicious code, and other technology driven privacy 
crimes. In 2005, he joined Stanford law school as a legal 
lecturer on computer crime, Internet business legal and policy 
issues, and modern surveillance law. He received his JD from 
Yale law school.
    Mr. Paul Rosenzweig is the founder of Red Branch 
Consulting, a homeland security consulting company and a senior 
advisor to the Chertoff Group. Mr. Rosenzweig formerly served 
as deputy assistant secretary for policy in the Department of 
Homeland Security. He is a distinguished visiting fellow at the 
Homeland Security Studies and Analysis Institute. He also 
serves as a lecturer in law at George Washington University and 
adjunct professor at the National Defense University, a senior 
editor of the Journal of National Security Law and Policy, and 
is a visiting fellow at the Heritage Foundation. He earned a 
bachelor's degree from Haverford College, a master's from 
Scripps Institution of Oceanography, and a JD from the 
University of Chicago law school.
    Your written statements will be entered into the record in 
their entirety, and we ask that each of you summarize your 
testimony in 5 minutes. To help you stay within that time, 
there's a timing light on your table. When the light switches 
from green to yellow, you have 1 minute to conclude your 
testimony. When the light turns red, that's it, time's up, and 
it signals that your time has expired.
    Mr. Ceresney, am I pronouncing your name correctly?
    Mr. Ceresney. You are.
    Mr. Goodlatte. Thank you very much, and you may begin.

      TESTIMONY OF ANDREW CERESNEY, DIRECTOR, DIVISION OF 
 ENFORCEMENT, UNITED STATES SECURITIES AND EXCHANGE COMMISSION

    Mr. Ceresney. Good morning, Chairman Goodlatte. Good 
morning, Chairman Goodlatte, Ranking Member Conyers, and 
Members of the Committee. Thank you for inviting me to testify 
today on behalf of the commission concerning Email Privacy Act, 
H.R. 699, pending before your Committee.
    The bill seeks to modernize portions of the Electronic 
Communications Privacy Act, ECPA, which became law in 1986. I 
share the goal of updating ECPA's evidence collection 
procedures and privacy protections to account for the digital 
age, but H.R. 699, in its current form, poses significant risks 
to the American public by impeding the ability of the SEC and 
other civil law enforcement agencies to investigate and uncover 
financial fraud and other unlawful conduct.
    I firmly believe there are ways to update ECPA that offer 
stronger privacy protections and observe constitutional 
boundaries without frustrating the legitimate ends of civil law 
enforcement.
    The SEC's tripartite mission is to protect investors, 
maintain fair, orderly, and efficient markets, and facilitate 
capital formation. The SEC's division of enforcement furthers 
this mission by, among other things, investigating potential 
violations of the Federal securities laws, recommending that 
the commission bring cases against alleged fraudsters and other 
securities law wrongdoers, and litigating the SEC's enforcement 
actions.
    A strong enforcement program is a critical piece of the 
commission's efforts to protect investors from fraudulent 
schemes and promotes investor trust and confidence in the 
integrity of the Nation's securities markets.
    Electronic communications often provide critical evidence 
in our investigations as email and other message content can 
establish timing, knowledge or relationships in certain cases, 
or awareness that certain statements to investors were false or 
misleading. When we conduct an investigation, we generally will 
seek emails and other electronic communications from the key 
actors through an administrative subpoena.
    In some cases the person whose emails are sought will 
respond to our request, but in other cases, the subpoena 
recipient may have erased email, tendered only some emails, 
asserted damaged hardware, or refused to respond. 
Unsurprisingly, individuals who violate the law are often 
reluctant to produce to the government evidence of their own 
misconduct.
    In still other cases, email account holders cannot be 
subpoenaed because they are beyond our jurisdiction. It is at 
this point in the investigation that we may, in some instances, 
need to seek information from an Internet service provider, 
also known as an ISP. The proposed amendment would require 
government entities to procure a criminal warrant when they 
seek the content of emails and other electronic communications 
from ISPs.
    Because the SEC and other civil law enforcement agencies 
cannot obtain criminal warrants, we would effectively not be 
able to gather evidence, including communications such as 
emails directly from an ISP, regardless of the circumstances, 
even in instances where a subscriber deleted his emails, 
related hardware was lost or damaged, or where the subscriber 
fled to another jurisdiction. Depriving the SEC of authority to 
obtain email content from an ISP would also incentivize 
subpoena recipients to be less forthcoming in responding to 
investigatory requests, because an individual who knows that 
the SEC lacks the authority to obtain his emails may thus feel 
free to destroy or not produce them.
    These are not abstract concerns for the SEC, or for the 
investors we are charged with protecting. Among the type of 
scams we investigate are Ponzi schemes and ``pump and dump'' 
market manipulation schemes, as well as insider trading 
activity. In these types of fraud, illegal acts are 
particularly likely to be communicated via personal accounts, 
and parties are more likely to be noncooperative in their 
document productions.
    Technology has evolved since ECPA's passage, and there is 
no question that the law ought to evolve to take account of 
advances in technology and protect privacy interests, even when 
significant law enforcement interests are also implicated. But 
there are various ways to strike an appropriate balance between 
those interests as the Committee considers the best way to 
advance this important legislation.
    Any reform to ECPA can and should afford a party whose 
information is sought from an ISP in a civil investigation an 
opportunity to participate in judicial proceedings before the 
ISP is compelled to produce this information. Indeed, when 
seeking email content from ISPs in the past, the division has 
provided notice to email account holders in keeping with 
longstanding and just recently reaffirmed Supreme Court 
precedent.
    If the legislation were so structured, an individual would 
have the ability to raise with a court any privilege, 
relevancy, or other concerns before the communications are 
provided by an ISP, while civil law enforcement would still 
maintain a limited avenue to access existing electronic 
communications in appropriate circumstances from ISPs. Such a 
judicial proceeding would offer even greater protection to 
subscribers than a criminal warrant in which subscribers 
receive no opportunity to be heard before communications are 
provided.
    We look forward to discussing with the Committee ways to 
modernize ECPA without putting investors at risk, and impairing 
the SEC from enforcing the Federal securities laws. I'm happy 
to answer any questions you may have.
    [The prepared statement of Mr. Ceresney follows:]
    
    
   [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT] 
    
    
    
                               __________
                               
    Mr. Goodlatte. Thank you. Mr. Cook, welcome.

TESTIMONY OF STEVEN H. COOK, PRESIDENT, NATIONAL ASSOCIATION OF 
               ASSISTANT UNITED STATES ATTORNEYS

    Mr. Cook. Chairman Goodlatte, Ranking Member Conyers, and 
Members of the Committee, first of all, thank you very much for 
giving me the opportunity to address you and to give you the 
perspective of career prosecutors with respect to H.R. 699.
    And let me get right to it. The importance of the Stored 
Communications Act or SCA, to the law enforcement community 
simply cannot be overstated. At issue are records of contact 
and communication by Internet and cell service providers. To 
understand the importance of these records to the law 
enforcement world, I'd ask you to pause and think for a minute 
about how these powerful resources are being used in the 
criminal world.
    Child predators troll the Internet 24/7 for children to 
lure them away from their parents and their homes. Purveyors of 
child pornography often, with graphic pictures of children, 
sometimes infants being sexually molested, sell those images 
electronically across the Internet. Terrorists boast of their 
horrific crimes posting pictures of those online, and 
international drug dealers, gangs, and others involved in 
organized crime communicate effectively with coconspirators 
through email and texts.
    When you realize how pervasive this technology is in the 
criminal world, you quickly realize that the evidence covered 
by the SCA, or the Stored Communications Act, is central to our 
ability to solve virtually every type of crime. And our ability 
to access this information covered by the SCA and to access it 
quickly, can literally mean the difference between life and 
death. It can mean the difference between recovering a child 
alive and returning her to her parents, instead of the child 
being a victim of a vicious predator determined to commit 
unspeakable crimes.
    And even beyond the critical role of stopping violent 
crimes in progress and rescuing victims, evidence covered by 
the Stored Communications Act is often central to the search 
for truth in our courts and our ability to bring those most 
dangerous in our community to justice.
    But here are the problems with ECPA, and both the opening 
statements by the Chair and Ranking Member recognize this, ECPA 
and the Stored Communications Act were enacted in 1986. That 
was before much of this technology was in use, before any of us 
had any idea of its capabilities. And to continue to use a 
statutory framework with definitions that were enacted before 
any of this technology was known is just simply not workable. 
It does not fit.
    That brings me back to H.R. 699. The primary goal of this 
bill seems to be to codify, correctly we would submit, Warshak 
and the extension of the Fourth Amendment protections to email 
in storage, and text in storage over 180 days. This is an issue 
on which we can all agree, but the bill goes farther. It goes 
much farther, and we respectfully submit, demonstrates a need 
for a comprehensive, not piecemeal reform. In my written 
testimony, I have addressed a number, but by far, not all of 
the concerns that we have.
    I'd like to highlight two places where this bill creates or 
perpetuates limitations on law enforcement that far exceed 
those imposed, far exceed those imposed anywhere else in the 
law, burdens greater than those related to the search of a 
home, burdens greater than those related to the search of a 
body cavity.
    While the Email Privacy Act expands Fourth Amendment 
protections and imposes a warrant requirement to compel 
disclosure of stored email or text, the statute does not 
recognize any of the well-established exceptions to the warrant 
requirement that would be applicable in every other 
circumstance. I know of no other area of the law where this is 
the case.
    Second, the Email Privacy Act also imposes notice 
requirements unlike those found anywhere else in the law. The 
government has long been required to serve a copy of the search 
warrant on the person at the property being searched, and that 
requirement makes sense. It demonstrates to the homeowner or 
the business operator the authority for the search, and that 
homeowner or property owner is then free, in the usual course, 
to tell whoever they wish about it.
    But the government has never been required and the law has 
never required the government to reach out to third parties and 
notify them of the search. It's not a discovery provision 
designed to alert those who are under criminal investigation of 
the ongoing investigation. And although there are specific, in 
fact, two-and-a-half pages of rules that would control when 
that can be extended, this simply is a rule that has never been 
imposed in any other context.
    In conclusion, I'd just like to say that criminals have, 
and we have seen that they have unlimited access to these 
modern and powerful resources, and they make full use of them. 
For us on the law enforcement side to do our job, access to 
this information is critical. Information covered by the SCA 
has to be accessible to us.
    That access, we respectfully recognize, of course, should 
be consistent with the privacy protections afforded by the 
Constitution, but Congress should not, as this bill proposes, 
impose new unprecedented and unwarranted limitations that will 
tie our hands in doing our jobs. Thank you.
    [The prepared statement of Mr. Cook follows:]
    
    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    
      
                               __________
                               
    Mr. Goodlatte. Thank you, Mr. Cook.
    Mr. Littlehale, welcome.

  TESTIMONY OF RICHARD LITTLEHALE, ASSISTANT SPECIAL AGENT IN 
           CHARGE, TENNESSEE BUREAU OF INVESTIGATION

    Mr. Littlehale. Chairman Goodlatte, Ranking Member Conyers, 
Members of the Committee, thank you for inviting me to testify. 
I'm a technical investigator in Tennessee, and I serve on the 
technology committee of the Association of State Criminal 
Investigative Agencies. As you know, State and local law 
enforcement agencies work the vast majority of criminal 
investigations in this country. Lawful access to electronic 
evidence is critical for us in those cases every day, and H.R. 
699, in its current form, does not sufficiently protect that 
access.
    To give you some sense of the volume of potential 
electronic evidence in our cases, consider a stranger abduction 
of a 4-day-old infant in Nashville. Over the course of an 
intensive 4-day investigation, my unit processed and explored 
leads on hundreds of telephone numbers, social media accounts, 
computers, and mobile devices. At a time when every second 
counts, my fellow agents and I spend a significant amount of 
time simply trying to make contact with various providers to 
declare an emergency, calling and recalling to make sure that 
our process was received and expedited. We had to process 
hundreds of leads, any one of which could have been the key to 
finding the victim.
    Volume alone isn't the only issue. We must also contend 
with a lack of structure governing responsiveness. In another 
Amber alert investigation, we received a lead that the creator 
of a posting on a social media platform may have information 
about the child's location. When we contacted the provider, 
they noted that ECPA's emergency provision is permissive rather 
than mandatory and demanded legal process before they turn over 
the records.
    We know H.R. 699 has a great deal of support, but we 
believe much of that support is based on only one part of the 
bill, creating a uniform probable cause standard for stored 
content. Advocates for ECPA reform argue that the contents of 
an email or document stored in the cloud should be subject to 
the same protections as a letter in your desk drawer at home. 
H.R. 699 would do that, but it goes farther to create an 
enhanced statutory framework of proof standards, notice 
requirements, and expand the definitions of covered records 
that you would give greater protection for records stored by 
third-party service providers than for that envelope in your 
desk. And it would do this without extending any of the tools 
that law enforcement can use to obtain evidence in the physical 
world after we demonstrate probable cause to a neutral 
magistrate and get a warrant, like law enforcement controlled 
warrant exceptions and warrant execution timelines.
    Bringing ECPA into balance should put the physical and 
digital worlds on the same plane, not favor digital evidence 
over physical evidence. H.R. 699 should be amended to reflect a 
more balanced approach that protects privacy and ensures that 
law enforcement can access the evidence it needs, and when we 
get a warrant, it should behave like a warrant not a subpoena 
with a higher proof requirement.
    Demonstrating probable cause to a neutral magistrate should 
allow us to gather evidence with the same timeliness and 
effectiveness that we would expect in the real world.
    The notice provisions in the bill would require us to 
describe our case to targets of a criminal investigation, even 
as we're pursuing leads. That endangers investigations. We also 
urge the Committee to carefully balance the need for 
notification against the resource burden it places on us. Time 
spent complying with arbitrary timelines means less time 
investigating crimes and could compromise sensitive 
information.
    I urge you to ensure that whatever standard of proof you 
decide is appropriate, you also ensure that law enforcement can 
access the evidence we need reliably and quickly. Speed is 
important in all investigations, and ECPA reform should impose 
structure on service providers' response to legal demands. A 
requirement for automated exchange of legal process and records 
with service providers would help speed access to evidence, 
provide transparency, and authenticate law enforcement process.
    Warrants under EPCA should look like warrants everywhere 
else. That means that standard exceptions to the warrant 
requirement like exigency and consent should exist, and law 
enforcement should control whether or not they are invoked, 
just like we can do when executing warrants in the physical 
world. Everybody agrees that law enforcement should have rapid 
access to communications evidence in a life-threatening 
emergency, but that is not always the reality.
    Industry and privacy groups suggest that some law 
enforcement emergency declarations are unfounded, but those are 
unreviewed unilateral determinations. Isn't law enforcement on 
the ground in the best position to assess the presence or 
absence of defensible exigency in a particular case? We already 
do it in other contexts all the time, and there is an existing 
body of case law in the courts to determine whether or not we 
are correct.
    In closing, I want to re-emphasize how important both 
aspects of ECPA are to our Nation's criminal investigators. We 
agree that ECPA should be updated, but any effort to reform it 
should reflect its original balance between assuring law 
enforcement access to evidence through legal demands and 
protecting customer privacy.
    The balance proposed by H.R. 699 goes too far in extending 
all the burdens of the traditional search warrant scheme to a 
much broader range of records without any of the common law 
exceptions, while requiring us to give unprecedented notice to 
investigative targets just because the evidence we're seeking 
is electronic.
    Thank you for having me here today, and I look forward to 
your questions.
    [The prepared statement of Mr. Littlehale follows:]
    
    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    
    
    
                               __________
                               
                               
    Mr. Goodlatte. Thank you.
    Mr. Calabrese, I think maybe I have your pronunciation 
correct now. Is that right?
    Mr. Calabrese. You actual were right the first time. It's 
Calabrese, but I'll take it however you give it. Thank you.
    Mr. Goodlatte. Thank you. I'm on a losing streak here, but 
go ahead.

         TESTIMONY OF CHRIS CALABRESE, VICE PRESIDENT, 
          POLICY, CENTER FOR DEMOCRACY AND TECHNOLOGY

    Mr. Calabrese. Well, thank you, Mr. Chairman, for having me 
testify. That's the thing we appreciate the most.
    Ranking Member Conyers, Members of the Committee, thank you 
for the opportunity to testify on behalf of the Center for 
Democracy and Technology. CDT is a nonpartisan advocacy 
organization dedicated to protecting privacy, free speech, and 
innovation online. We applaud the Committee for holding a 
hearing on the Electronic Communications Privacy Act, ECPA, and 
urge the Committee to speedily approve H.R. 699, the ``Email 
Privacy Act.''
    When ECPA was passed in 1986, it relied on balancing three 
policy pillars: Individual privacy, the legitimate needs of law 
enforcement, and support for innovation. Changes in technology 
have eroded this balance. The reliance on trusted third parties 
for long-term storage of our communications have left those 
communications with limited statutory protections. This void 
has created legal uncertainty for cloud computing, one of the 
major business innovations of the 21st Century and one at which 
U.S. companies excel.
    At the same time, information accessible to the government 
has increased dramatically from emails and text messages to 
social networking posts and photos. Most if not all, of this 
information would not have been available in 1986. The 
technology has changed but the law has not, creating a major 
loophole for Americans' privacy protections.
    In the face of this outdated statute, courts have acted, 
recognizing in cases like U.S. v. Warshak that people have a 
reasonable expectation of privacy in email and invalidating key 
parts of ECPA. But that patchwork is not enough on its own. It 
continues to lag behind technological change and harms smaller 
businesses that lack an army of lawyers. It also creates 
uncertainty around new technologies that rely on the use and 
storage of the contents of communications.
    Reform efforts face a concerted assault from civil agencies 
that seek to gain new powers and blow a huge privacy loophole 
in the bill. Agencies have blocked reform in spite of the fact 
that the SEC has confessed to never subpoenaing an ISP post-
Warshak. No less than FBI Director Comey told this Committee 
that in regard to ECPA, a change wouldn't have any effect on 
our practices.
    In fact, new civil agency powers would harm the privacy of 
ordinary citizens. Imagine if the IRS had had these powers back 
from 2010 to 2012 when they were improperly investigating the 
tax status of Tea Party organizations. During that 
investigation, the IRS sent lengthy time-consuming 
questionnaires seeking information on what members were 
reading, their Facebook posts, donor lists, and copies of the 
materials they were disseminating. While the IRS' targeting of 
conservative groups was limited to these lengthy 
questionnaires, their subpoena authority is extremely broad and 
likely could have been used here.
    If the IRS had had the power that the SEC proposal 
recommends be granted to all Federal agencies, they would have 
been able to go beyond gathering information directly from the 
target of the investigation. The IRS would have been able to go 
to court and enforce an order allowing them to go directly to 
the ISP and seek the subject's email. While under the SEC 
proposal, the subject in the investigation would have been able 
to contest that order in court, civil standards are very low, 
and it's clear that the IRS had a very expansive idea of the 
information they could seek. This type of agency overreach is 
exactly why we can't grant agencies unjustified new 
authorities.
    Support for privacy reform is deep and abiding. More than 
100 tech companies, trade associations, and public interest 
groups have signed onto ECPA reform principles. Signatories 
include nearly the entire tech industry, span the political 
spectrum, and represent privacy rights, consumer interests, and 
free market values.
    The Email Privacy Act has more than 300 cosponsors, 
including a majority of Republicans and Democrats. Post-
Warshak, a warrant for content has become the status quo. 
Nonetheless, it is critical for the Committee to approve H.R. 
699 in order to cure a constitutional defect in ECPA, protect 
individual privacy, and assure that new technologies continue 
to enjoy robust constitutional protections. Thank you.
    [The prepared statement of Mr. Calabrese follows:]
    
    
    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    
    
                               __________
                               
                               
                               
    Mr. Goodlatte. Thank you, Mr. Calabrese.
    And Mr. Salgado, welcome.

  TESTIMONY OF RICHARD SALGADO, DIRECTOR, LAW ENFORCEMENT AND 
               INFORMATION SECURITY, GOOGLE INC.

    Mr. Salgado. Chairman Goodlatte, Ranking Member Conyers, 
and Members of the Committee, thank you for the opportunity to 
appear before you today. My name is Richard Salgado. As 
director----
    Mr. Goodlatte. Mr. Salgado, would you pull your microphone 
a little closer to you.
    Mr. Salgado. Sure. Thank you. My name is Richard Salgado. 
I'm director for law enforcement and information security for 
Google. I oversee the company's compliance with government 
requests for users' data, including requests made under the 
Electronic Communications Privacy Act of 1986, otherwise known 
as ECPA.
    In the past, I have worked on ECPA issues as a senior 
counsel in the computer crime and intellectual property section 
in the U.S. Department of Justice. Google strongly supports 
H.R. 699, the ``Email Privacy Act,'' which currently has 304 
cosponsors, more than any other bill currently pending in 
Congress. It's undeniable and it's unsurprising that there is 
strong interest in aligning ECPA with the Fourth Amendment and 
users' reasonable expectation of privacy.
    The original disclosure rules set out in ECPA back in 1986 
were foresighted given the state of technology back then. In 
2015, however, those rules no longer make sense. Users expect, 
as they should, that the documents they store online have the 
same Fourth Amendment protections as they do when the 
government wants to enter the home to seize the documents 
stored in a desk drawer. There is no compelling policy or legal 
rationale for there to be different rules.
    In 2010, the Sixth Circuit opined in United States v. 
Warshak that EPCA violates the Fourth Amendment to the extent 
it does not require law enforcement to obtain a warrant for 
email content. In doing so, the Sixth Circuit effectively 
struck down ECPA's 180-day rule and the distinction between 
opened and unopened emails as irreconcilable with the 
protections afforded by the Fourth Amendment.
    Warshak is effectively the law of the land today. It's 
observed by governmental entities and companies like Google and 
others. In many ways, H.R. 699 is a modest codification of the 
status quo and implementation of the Sixth Circuit's 
conclusions in Warshak.
    Two important developments have occurred since I last 
testified before the House Judiciary Committee in support of 
updating ECPA back in March of 2013, both of which have a 
significant bearing on efforts to update the statute.
    First, the Supreme Court issued a landmark decision in 
Riley versus California where it unanimously held that, 
generally, officers must obtain a warrant before searching the 
contents of a cell phone seized incident to arrest.
    Chief Justice Roberts noted that a regime with various 
exceptions and carve outs would ``contravene our general 
preference to provide clear guidance to law enforcement through 
categorical rules.'' To reinforce the constitutional imperative 
for clear rules in this area, Chief Justice Roberts concluded 
his opinion with unambiguous direction to law enforcement. He 
wrote, ``The fact that technology allows an individual to carry 
such information in his hand does not make the information any 
less worthy of the protection for which the Founders fought. 
Our answer to the question of what police must do before 
searching a cell phone seized incident to arrest is accordingly 
simple, get a warrant.''
    Notably, this Committee is being asked by some today to 
jettison precisely the type of categorical rules that the 
Supreme Court held were imperative in Riley. Doing so would 
undermine the user's reasonable expectations of privacy and 
encroach on core privacy protections afforded by the Fourth 
Amendment. We urge the Committee to reject such pleas.
    Second, many States have enacted bright-line rules to bring 
their State versions of ECPA in line with the Fourth Amendment. 
Hawaii, Texas, and Maine have all done this. In addition, 
earlier this year, the California legislature overwhelmingly 
approved landmark legislation to update California's version of 
ECPA, referred to as Cal-EPCA. Not only does Cal-EPCA require 
the government to obtain a warrant before it can compel third-
party service providers to disclose content, but it also 
extends the warrant requirement to communications metadata and 
data seized that's stored on electronic devices.
    States are appropriately recognizing that the Fourth 
Amendment protections ought to extend to the sensitive data 
that's stored in the cloud. H.R. 699 represents an overdue 
update to ECPA that would ensure electronic communications 
content is treated in a manner commensurate with other papers 
and effects that are protected by the Fourth Amendment. It's 
long past time for Congress to pass a clean version of H.R. 
699.
    Thank you for your time and consideration, and I'd be happy 
to answer any questions you may have.
    [The prepared statement of Mr. Salgado follows:]
    
    
    
    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
    
    
    
    
                               __________
                               
                               
                               
                               
    Mr. Goodlatte. Thank you, Mr. Salgado.
    Mr. Rosenzweig, welcome.

  TESTIMONY OF PAUL ROSENZWEIG, VISITING FELLOW, THE HERITAGE 
           FOUNDATION, FOUNDER, RED BRANCH CONSULTING

    Mr. Rosenzweig. Thank you very much, Mr. Chairman, Ranking 
Member Conyers. I appreciate very much the opportunity to come 
before you today to testify about the Email Privacy Act and the 
underlying principles of balancing privacy and law enforcement 
needs that are inherent here.
    As you know, I am a former prosecutor, having spent 12 
years in various roles throughout government. I then became a 
deputy assistant secretary for the Department of Homeland 
Security with significant responsibility for our 
counterterrorism efforts, and today I operate a small 
consulting company, and I serve as a visiting fellow at the 
Heritage Foundation. From this perspective, I am pleased to 
acknowledge that everybody on this panel agrees that a warrant 
requirement for content of email is an appropriate response to 
changing technology.
    It seems to me almost beyond belief that notwithstanding 
the uniform agreement of that principle, we have been unable to 
work out the details of how to implement that as a matter of 
statutory law. To my mind, that principle has its roots not in 
our agreement here, but rather in the longstanding 
understanding of the privacy of one's personal papers and 
effects that goes back to the very foundings of this Nation.
    The most famous case of which was the Wilkes versus Wood 
case. Wilkes was a protestor, much like some of the people in 
America today, whose papers and effects were the subject of a 
general warrant. That search by the Crown at that time was one 
of the most salient effects that drove the Revolutionary 
movement. Likewise, the Writs of Assistance case, which James 
Otis famously lost, unfortunately, in Massachusetts, was what 
John Adams said was the spark that lit the flame of the 
Revolution.
    Today, email are our private papers. The ISPs that transmit 
my email to you are the equivalent, functional equivalent of 
the post office, and the cloud storage system that I use to 
store that information is the functional equivalent of the file 
cabinet in my office. There is no ground that I can see that is 
consistent with what the Framers understood our personal 
privacy and papers to be to exclude that information from the 
full protection of the warrant.
    And I would add that our history of Fourth Amendment 
understanding has followed the development of technology by 
consistently applying that same principle. When the Supreme 
Court was faced with the idea of telephones in the Katz case 
back in the 1960's, they saw that those types of personal 
communications ought to be subject to the exact same sorts of 
constitutional protections. This notwithstanding the fact that 
of course telephones were unknown to the Founders, and over the 
dissent of Justice Black who said, you know, history says there 
are no telephones, if it's not in the Fourth Amendment, it 
shouldn't be in the Fourth Amendment.
    Likewise, as Mr. Salgado has said, we've recently come to 
understand that the cell phones in our pockets are not just 
telephones. They are now mini-computers that contain the stuff 
and substance of everything that we know and understand, so, 
too, I would submit, with the content of our email 
communications and our stored data in cloud service providers, 
whether it's Google, or Microsoft, or Yahoo, or Dropbox, this 
is where we store our data today.
    So what's the debate? What's left? All that I hear that is 
left is the application of exceptions that are carve outs and 
restrictions on this general warrant requirement. And to some 
degree, that has an intellectual appeal to it, doesn't it, 
because we've had exceptions to the Fourth Amendment for 
awhile, but I doubt that that's really what the advocates for 
the exceptions are suggesting, because I certainly have not 
heard any of them suggest that we should adopt as well the 
Fourth Amendment suppression rules for when evidence is 
wrongfully collected in violation of these exception 
requirements.
    The truth is that we've had no--when ECPA was first passed 
in the 1980's, no exception for an emergency at all. The 
current statute was added in 2001, post 9/11 at the suggestions 
of the Department of Justice. So it's kind of passing strange 
that we would see that exception and expansion of it held out 
now as a reason to oppose the fundamental changes that are 
necessary in light of technology.
    I would submit to you that the time is ripe for change and 
the principle is clear. In the normal law enforcement context, 
police, FBI, and law enforcement officers should have no more 
access to stored email than they do to our stored private 
letters. I would urge this Committee to give the bill before 
you plenary consideration in a markup and move it to the floor 
for consideration where these issues can be hashed out. And 
with that, I thank you very much. I look forward to answering 
your questions.
    [The prepared statement of Mr. Rosenzweig follows:]
    
    
  [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]  
    
     
                               __________
                               
                               
                               
                               
    Mr. Goodlatte. Thank you. And we'll now proceed under the 
5-minute rule with questioning of the witnesses, and I'll begin 
by recognizing myself.
    Mr. Salgado, if Congress were to issue a subpoena to Google 
for the contents of a customer's emails, would that subpoena 
violate the Fourth Amendment?
    Mr. Salgado. That's a question I would have to look into as 
to how the Fourth Amendment applies to Congress, so I've not 
done enough research to be able to answer that with much 
confidence. I would say that the changes we're talking about 
today to ECPA would not in any way affect the investigative 
powers of Congress.
    Mr. Goodlatte. I think it's a very important question, 
however, because if you can't answer that question from me 
right now, answer this question. What's the constitutional 
distinction between congressional and executive subpoenas?
    Mr. Salgado. Again, I'd probably have to investigate that. 
The Fourth Amendment is what the Fourth Amendment is, so if 
there is a restriction there that's based on the Constitution, 
that exists regardless of what we do with ECPA.
    Mr. Goodlatte. If the subpoena issued to Google for the 
contents of a customer's emails, the customer might be a 
government employee who is acting outside of the government's 
servers and email system and is storing data on Google's cloud, 
what ability would the Congress have to conduct oversight if 
your finding is that it violates the Fourth Amendment?
    Mr. Salgado. I don't know that it would, but I do note that 
Congress would have all the authority it does now to direct the 
subpoena to the user to get the information directly from the 
user.
    Mr. Goodlatte. We would very much appreciate your taking 
some time to think about the answer to that question because 
it's a very important question with regard to how we address 
this. Because there either is not a violation, in which case 
the question arises what's the constitutional distinction 
between congressional and executive subpoenas, or there is a 
constitutional violation, in which case the Congress' ability 
to conduct proper oversight of the executive branch is a very 
significant one.
    Mr. Salgado. I'd be happy to answer the question. I don't 
think it touches on the question of this particular step, this 
particular bill, but I'd be very happy to look into that for 
you.
    Mr. Goodlatte. Thank you.
    Mr. Ceresney, critics of a civil mechanism cite to the fact 
the SEC has not sought to serve a subpoena on a commercial 
provider in the 5 years since the Sixth Circuit's decision in 
U.S. v. Warshak. You've heard some of those criticisms right 
here on this panel today.
    They say it's not really a problem that needs to be solved 
because of that fact. Is this true? And if so, why hasn't your 
agency sought to challenge the warrant only policy adopted by 
many providers following Warshak?
    Mr. Ceresney. So Congressman, the decision was made at the 
time. I wasn't at the SEC at the time, but after Warshak, a 
decision was made in excess of caution not to issue subpoenas 
to ISPs without consent of the subscriber. And since I've been 
at the SEC, we have held off on doing that in deference to the 
discussions have have been ongoing in Congress about amending 
ECPA.
    At the same time, we have never felt like Warshak precluded 
us from obtaining email under the Constitution pursuant to a 
subpoena with notice to the subscriber. Warshak dealt with a 
grand jury subpoena with no notice to a subscriber, and it did 
not undermine a long line of case law that exists, that holds 
that where a subscriber or the party you're seeking email from 
or seeking material from has precompliance review before a 
court that that satisfies the Fourth Amendment. It is true that 
we have not done it, but I can tell you there are cases ongoing 
which----
    Mr. Goodlatte. I know that you haven't done it. I want to 
know why.
    Mr. Ceresney. Right. And that is because in an excess of 
caution at the time and in deference to these discussions, you 
know, in deference to the discussions that have been ongoing 
before Congress about the decision of what to do to reform 
ECPA. From our perspective, there are ongoing investigations 
that would definitely benefit from ISP subpoenas where we have 
not obtained email from a subscriber that we do know exists, 
but we're not able to obtain it because we have not been 
issuing subpoenas to ISPs.
    Mr. Goodlatte. So how has that affected your ability to 
conduct investigations?
    Mr. Ceresney. I think it has affected our ability to 
conduct investigations. We issue subpoenas to individuals all 
the time for their email, and all the time there is instances 
where those individuals either don't produce----
    Mr. Goodlatte. And before Warshak, you would then issue a 
subpoena to a third-party holder of those emails. Is that 
correct?
    Mr. Ceresney. That's correct.
    Mr. Goodlatte. And since then, you haven't felt the need to 
attempt to do that, and have the courts clarify this issue, 
which now the Congress is being asked to clarify?
    Mr. Ceresney. We have felt the need, Congressman, but we 
have, in deference to these ongoing discussions in Congress 
about reforming ECPA, determined not to do that. But we 
certainly have identified cases where it would have been 
helpful to do that to our efforts.
    Mr. Goodlatte. All right. Let me ask one more question to 
Mr. Littlehale. In addition to serving the warrant on the 
customer, H.R. 699 also requires law enforcement to provide 
notice to the customer of the nature of the law enforcement 
inquiry with reasonable specificity.
    Is law enforcement required to provide such information to 
a person when they serve a search warrant on their home? What 
is the harm if law enforcement is required to inform the 
subject of investigation of the nature of the law enforcement 
inquiry with reasonable specificity?
    Mr. Littlehale. Mr. Chairman, in traditional search warrant 
practice on the premises to be to served----
    Mr. Goodlatte. Turn your microphone on, please.
    Mr. Littlehale. Sorry, Mr. Chairman. In traditional search 
warrant practice, the requirement is simply that law 
enforcement leave a copy of the warrant and an inventory of 
items seized on the premises to be searched.
    And in the analogy to a service provider, an entity that is 
in possession of evidence, we serve a copy of the warrant on 
them, and we give them notice of the fact that we're requiring 
them to produce the records.
    H.R. 699 imposes an additional set of requirements that we 
actually discuss something about the nature of our 
investigation that goes beyond what's required in traditional 
search warrant practice.
    Mr. Goodlatte. Thank you very much. The gentleman from 
Michigan, Mr. Conyers is recognized for 5 minutes.
    Mr. Conyers. Thank you, Mr. Chairman. Before I begin my 
questioning, I'd like to ask unanimous consent to introduce a 
statement from the gentleman from Colorado, Mr. Jared Polis, 
into the record. He's the lead Democratic Member on this bill, 
and his views are worth consideration by the Committee. Can I 
get a unanimous consent request approved?
    Mr. Goodlatte. Without objection, it will be made a part of 
the record.
    [The information referred to follows:]
           Prepared Statement of the Honorable Jared Polis, 
        a Representative in Congress from the State of Colorado
    Chairman Goodlatte, Ranking Member Conyers, and Members of the 
Committee:
    Thank you for convening this important hearing on H.R. 699, the 
Email Privacy Act. The Email Privacy Act is the most cosponsored bill 
in Congress awaiting floor action, and the problem it addresses is one 
of the most pressing constitutional concerns of our modern age: How can 
we stop the advancement of technology from eroding our fundamental 
right to privacy?
    In the broadest possible terms, the obvious answer is that we need 
to update our laws. Many of the laws governing the use of the 
technology Americans most frequently use today were written long before 
any of that technology existed or was even conceived of. Congress 
simply cannot purport to protect Americans' constitutional rights while 
leaving the federal government to enforce laws designed for a world 
that doesn't exist anymore.
    Today, the law governing many of our online privacy rights is the 
Electronic Communications Privacy Act (ECPA) of 1986. In 1986, for the 
vast majority of Americans, ``electronic communications'' meant a phone 
call placed from a landline. In 1986, Apple had just released the 
Macintosh Plus--a cutting-edge personal computer that provided users 
with an entire megabyte of memory. Today, iPhone 6 users walk around 
with 16,000 times that amount in their pockets. In 1986, the ``World 
Wide Web'' was years away from taking off. Today, that term is already 
a relic of the past.
    As a result of Congress's failure to keep up with the pace of 
technology, every American's email can be subject to warrantless 
searches thanks to a 29-year-old legal loophole. Under ECPA, the 
government has the ability to search through any digital communications 
stored on a third-party server--such as your emails and instant 
messages--without a warrant, as long as they are more than 180 days 
old. In 1986, this loophole may have seemed reasonable because 
individuals simply didn't leave their emails stored on a server for 
months at a time. That kind of digital storage space just didn't exist, 
so authorities considered emails not deleted after six months to be 
abandoned. In 2015, however, consumers routinely store emails digitally 
for months or even years at a time.
    Most Americans have no idea that a law written 29 years ago allows 
the government to open their old emails without probable cause. And 
when they find out, they're shocked--because that reality is simply 
impossible to square with the basic liberties guaranteed in our 
Constitution. It simply makes no sense that our homes, cars, and 
mailboxes are protected from unwarranted government searches but the 
government can sift through our email inboxes with impunity.
    Congress has the power to change that. The Email Privacy Act has 
304 cosponsors in the House--a bipartisan, veto-proof supermajority of 
Members of this body--and far-reaching support across all sectors of 
the economy and across the political spectrum, from groups like the 
Heritage Foundation and the American Civil Liberties Union to tech 
startups, Fortune 500 companies, and Chambers of Commerce.
    There are some federal officials calling for special carve-outs and 
lower burdens of evidence in order to access Americans' old emails. I 
urge the committee to resist these efforts to undermine the bill for 
several reasons.
    First, the sheer volume of support for this bill suggests that 
Americans and their representatives in Congress overwhelmingly support 
the legislation as written and do not believe electronic correspondence 
should be subject to a lower standard of evidence than physical 
documents when it comes to government searches.
    Second, the authors of ECPA clearly did not anticipate a future in 
which Americans have access to nearly unlimited storage space that 
allows us to store our emails on the cloud in perpetuity. In asking for 
a special carve-out from warrant requirements, these federal agencies 
are asking for broad new search authorities that go far beyond the 
intent of the 1986 legislation and that would significantly undercut 
the intended reforms of the Email Privacy Act.
    Third, the federal officials asking for these broad new authorities 
have not put forward compelling evidence that the 180-days loophole has 
served a legitimate law-enforcement purpose.
    And finally, it is impossible to square a lower standard of 
evidence for emails older than 180 days with the Constitution's 4th 
amendment protections against unreasonable search and seizure. There is 
simply no constitutional basis for exempting digital correspondence 
from our privacy laws, and there is no compelling safety or crime-
prevention reason for doing so either.
    The 180-days loophole is a longstanding problem with a simple, 
bipartisan, broadly popular, noncontroversial solution at the ready. 
With 304 cosponsors in the House, the Email Privacy Act is the most-
cosponsored bill of the 114th Congress not to receive a floor vote. I 
urge the Committee to favorably report H.R. 699 so that it can finally 
get a vote on the House floor, where I am confident it would pass with 
overwhelming bipartisan support.
    Thank you.
                               __________

    Mr. Conyers. All right. Thank you. Let me begin my 
questions with Chris Calabrese. I'm trying to find out why this 
bill is so popular from your point of view. The Email Privacy 
Act, 304 sponsors, privacy advocates, civil libertarians 
support it, former prosecutors, Fortune 500 companies, and 
small businesses across the country. More than 100,000 
Americans have signed a petition urging the White House to 
support this measure. How come?
    Mr. Calabrese. Well, I think that Americans believe very 
strongly in the values that underpin this Nation, the 
fundamental idea of privacy and a balance between what 
government can do and having rules around how they can do it. 
All this bill does is the very modest step of bringing our 
privacy protections into the 21st Century, and everybody agrees 
with that.
    A recent poll in the Washington Post said that 86 percent 
of Americans supported reform. This panel is unified in saying 
that we need a warrant for email. Now, we have some minor 
issues around the edges, but honestly, I believe that this is a 
bill that would pass Congress or pass the House of 
Representatives by 300 or 400 votes.
    It is that popular. It is that common sense. I think we 
simply need a markup. We can work out some of these issues 
around the edges, and the American people can get the privacy 
protections that they want and they need. Thank you.
    Mr. Conyers. Thank you. And also in your testimony you 
mention that the bill faces a concerted assault from civil 
agencies that seek to use statutory changes as a tool to gain 
new powers. Some argue the powers are already on the books. Why 
do you refer to the SEC's proposal as a request for new powers?
    Mr. Calabrese. I think that if you don't use an authority 
for 5 years and there is a questionable legal standard about 
whether you can use it at all, it's new authority. That's 
simply put. It simply can't be that you have this existing 
authority and you say it's incredibly valuable but you've held 
off on using it for 5 years. Either what you're doing in your 
investigations aren't important, which we all know is not true, 
or you don't think you have this authority, and to me, there 
are really no other options, and I think that this is new 
authority.
    Mr. Conyers. Thank you.
    Mr. Rosenzweig, the government often conducts parallel 
criminal and civil investigations to the same target. What 
would be the practical consequences if we adopted a warrant 
standard for email in criminal investigations and some lesser 
standard for those in civil investigations?
    Mr. Rosenzweig. There'd be the risk that the exception 
would swallow the rule. I spent much of my early career 
prosecuting environmental criminal cases, a regulatory area 
where the civil regulatory authorities had civil and 
administrative powers for securing evidence. There was a set of 
procedures, parallel proceedings procedures, that were internal 
to the executive branch that governed the circumstances under 
which those civilly collected evidence could be transferred to 
the criminal prosecution side for use in a criminal case. Those 
rules were simply rules of grace at the discretion of the 
executive branch. They were not statutorily mandated and they 
were not expressed in any constitutional limit.
    There would be at least some risk that in an effort to 
evade the warrant requirement that was created by reform of 
ECPA, criminal authorities would solicit the securing of that 
evidence through civil process under a lesser standard. I do 
not mean to ascribe ill motivation to anybody in any part of 
this process. But, nonetheless, the interstitial pressures are 
very real.
    Mr. Conyers. Let me squeeze in one final question here. The 
Sixth Circuit in Warshak held that, to the extent that the 
Stored Communications Act permits the use of subpoenas to 
compel the production of email, the statute is 
unconstitutional. Given that holding, is the mechanism proposed 
by the SEC also unconstitutional? Anybody want to try that in 
addition to you?
    Mr. Rosenzweig. I think it likely is. It hasn't been tested 
in court. There is a history of restricting civil authorities 
for constitutionally protected material. There's also, frankly, 
some law that points to things called administrative searches 
that might be seen as a validation of the SEC's position. If I 
were to judge it, I would probably say--come down against it, 
but nobody makes a lot of money predicting the Supreme Court.
    Mr. Conyers. Could it withstand the Fourth Amendment 
challenge in the courts, do you think?
    Mr. Rosenzweig. I would say no.
    Mr. Conyers. All right. Thank you so much.
    Thank you, Mr. Chairman.
    Mr. Goodlatte. Thank you, Mr. Conyers.
    The Chair now recognizes the gentleman from Wisconsin, Mr. 
Sensenbrenner, for 5 minutes.
    Mr. Sensenbrenner. Thank you, Mr. Chairman.
    In the Warshak case in 2010, the Sixth Circuit ruled the 
content of America's emails is protected by the Fourth 
Amendment. I agree with that holding. Since that decision, the 
SEC has been unable to subpoena email content from service 
providers.
    Now, Mr. Ceresney, I've read your testimony and listened to 
it. Did you write it in 2009?
    Mr. Ceresney. No. I wrote it----
    Mr. Sensenbrenner. Okay, well, thank you very much.
    Now, if the SEC cannot currently subpoena email content 
from service providers, is it truthful to testify that if H.R. 
699 becomes law the SEC will be denied the ability to obtain 
evidence?
    Mr. Ceresney. I don't agree that we're not able to do it 
currently. We have refrained from doing it in deference to 
Congress' ongoing discussions about it.
    Mr. Sensenbrenner. Okay. Well, I guess you kind of ignored 
the Warshak decision on that.
    Now, even under ECPA as it was written almost 30 years ago, 
the SEC could only subpoena email content after it was older 
than 180 days. Aren't you asking this Committee to expand a 
legal authority that was found unconstitutional in a more 
limited form?
    Mr. Ceresney. We are not. I think----
    Mr. Sensenbrenner. Well, then, why aren't you? Because you 
would like to be able to issue subpoenas on email content 
that's less than 180 days old.
    Mr. Ceresney. We would defer. If Congress decided that----
    Mr. Sensenbrenner. No. No. No. No. No. No. No. You know, 
the thing is, is that I think the court has decided and you're 
not happy with the court decision. What your testimony says is 
that you'd like to expand something that's already been held 
unconstitutional.
    Mr. Ceresney. I disagree. Warshak was----
    Mr. Sensenbrenner. Well, I disagree with you.
    Now, let me ask the whole panel, just to ask yes or no. If 
Congress gives civil agencies the authority to subpoena email 
content to service providers, would that law be constitutional? 
I think Mr. Ceresney has already said yes.
    Mr. Ceresney. Yes.
    Mr. Sensenbrenner. Can I get a yes-or-no answer from the 
other five panelists?
    Mr. Cook. I'd love an opportunity to explain the----
    Mr. Sensenbrenner. No. I'm limited on time.
    Mr. Cook. I understand, sir.
    Mr. Sensenbrenner. Yes or no please.
    Mr. Cook. My answer is yes, it would be constitutional.
    Mr. Sensenbrenner. Mr. Littlehale?
    Mr. Littlehale. Yes, it would be.
    Mr. Sensenbrenner. Mr. Calabrese?
    Mr. Calabrese. I believe no, it would not be.
    Mr. Sensenbrenner. Mr. Salgado?
    Mr. Salgado. I believe no, it would not be.
    Mr. Sensenbrenner. Okay. Mr. Rosenzweig?
    Mr. Rosenzweig. No. That's what Warshak said.
    Mr. Sensenbrenner. Uh-huh.
    Now, I think we've heard from Mr. Ceresney. Messrs. Cook 
and Littlehale, since you believe the law would be 
constitutional, how do you square that position with the Sixth 
Circuit court's holding in Warshak?
    Mr. Cook. Well, I think the critical distinction is the one 
that the SEC has already drawn, and that is that the subpoena 
at issue there was a grand jury subpoena, one issued with no 
notice to anybody. The Fourth Amendment to the United States 
Constitution, as we all know, has never imposed a warrant 
requirement without any exceptions or without any other way to 
meet the reasonableness clause.
    Mr. Sensenbrenner. Okay. Mr. Littlehale?
    Mr. Littlehale. Congressman, I believe that the due process 
provided by the SEC proposal offers a significant amount of 
protection, the same sort of protection contemplated by the 
Fourth Amendment, and I believe that the courts would view that 
as sufficient protection.
    Mr. Sensenbrenner. Well, you know, the issue is, is that a 
subpoena--there can't be a motion to quash a subpoena until 
it's served. So even if there's an immediate motion to quash a 
subpoena, isn't there the risk of a constitutional violation 
here?
    Mr. Ceresney. Congressman, there isn't. That's because our 
subpoenas are not self-executing. If we want to enforce our 
subpoena, we need to go to a court and compel production.
    Mr. Sensenbrenner. Okay. Well, except that Warshak seems to 
indicate the opposite. Well, you know, the thing is, is that 
here we're having to balance the fact that apparently the 
position of law enforcement is that they want to expand what is 
currently the law. And the position of those who are privacy 
advocates say the law is the law and codify it.
    I think this is a slam dunk for Congress to make a 
determination, because we already have something that everybody 
seems to think is okay, you know, except a few people that 
would like to expand the dragnet.
    With that, I'll yield back.
    Mr. Goodlatte. The Chair thanks the gentleman and 
recognizes the gentlewoman from California, Ms. Lofgren, for 5 
minutes.
    Ms. Lofgren. Thank you, Mr. Chairman. And I'm glad that 
we're having this hearing today. As had been mentioned at the 
beginning of the hearing, over 300 Members of Congress are 
sponsoring the legislation. So it hasn't been a close call for 
most of us.
    There is a competing--not a competing bill, a bill that 
encompasses the provisions in this bill, but also goes to 
geolocation. And I'm wondering, Mr. Cook, the DOJ recently 
enacted a policy requiring a warrant before deploying a cell 
site simulator, like a Stingray, to locate a suspect using 
their cell phone. Does your association support that policy?
    Mr. Cook. The answer to that, of course, is yes. The use of 
a Stingray or Triggerfish, cell site simulator, under certain 
circumstances would trigger Fourth Amendment protections. That 
is to say that either a warrant or one of the exceptions. And 
there are many occasions when law enforcement uses a Stingray 
and it does so under the emergency aid or exigent circumstances 
exception.
    Ms. Lofgren. If you support this absent the exigent 
circumstance exception, which we're not arguing against, would 
you consider that a warrant for any means of obtaining real-
time geolocation information should also be favorably supported 
by your group?
    Mr. Cook. I'm not sure I understand.
    Ms. Lofgren. For example, you don't need a Stingray to 
actually identify where a person is with a cell phone. But the 
identification issue is the same. So wouldn't that logic extend 
to that?
    Mr. Cook. Well, when law enforcement seeks prospective 
tracking of a suspect, as was the case in Jones, an ongoing 
tracking, then the Fourth Amendment is implicated. And I think 
Jones resolved that for us.
    Ms. Lofgren. I think it did as well. Shouldn't that same 
logic apply also to historical location information?
    Mr. Cook. That's a great question. And of course, as I can 
tell from your questioning, you're fully familiar with the 
court struggling with that issue, the fourth and the fifth 
circuit and other courts divided on that. And so part of the 
division I think is driven by an understanding of the 
technology. The technology with respect to some location 
information is that it's just not as specific as GPS tracking. 
And with respect to that, the courts have recognized that 
there's----
    Ms. Lofgren. If I can, I don't want to run out of time. 
Assuming that the technology issues are resolved, and it's not 
the U.S. Attorneys Association's job to do that, logically 
shouldn't the Fourth Amendment apply to historical records as 
well as prospective records?
    Mr. Cook. The other longstanding doctrine, of course, that 
touches on that is the one that the courts have pointed to, and 
that is the Smith and Miller third-party records doctrine.
    Ms. Lofgren. Right, which has also been not favorably 
received recently by the Congress.
    Let me turn to you, Mr. Salgado, because we have approached 
this whole issue from the point of the Fourth Amendment and the 
Constitution and the right to privacy and the like. But it also 
has an impact on American business. The most important 
technology companies in the world are located in the United 
States. I would like, can you comment on the impact, if any, on 
American business for a perception in other countries that 
privacy is not secure if you use an American product?
    Mr. Salgado. Thank you, yes. I certainly can easily burn up 
the rest of your time with an answer to that question. It is a 
significant impact on American industry that there's a 
perception outside of the United States--Europe, it's no 
secret, certainly holds this perception--that data held by U.S. 
companies is somehow there for the taking for U.S. Government.
    This bill, the Email Privacy Act, is a good step toward 
getting rid of that misperception, making sure our statutes 
reflect the true protections that the Fourth Amendment offers.
    Ms. Lofgren. Now, if I can, and you may not have the answer 
to this, but certainly this is not an issue just for Google, 
but for Facebook and all the ISPs, and Microsoft has a big case 
in Ireland right now, and the like. Has anybody added up the 
dollars at risk to the U.S. economy on this privacy issue?
    Mr. Salgado. You know, that may have been done. I'd need to 
get back to you with that, it's not on the tip of my tongue, to 
be able to answer.
    Ms. Lofgren. Okay. That's fair enough. I would like to just 
mention that the Chief Justice's conclusion in Riley versus 
California is, ``Our answer to the question of what police must 
do before searching a cell phone seized incident to arrest is 
accordingly simple, get a warrant.''
    How does that decision apply to the legislation that we're 
considering today, in your judgment?
    Mr. Salgado. I think it illustrates the point that the 
Supreme Court wants us to have bright rules so that the law 
enforcement officer in the field knows what to do. And when 
we're talking about the Fourth Amendment and our right to 
privacy, we're not messing around with gray areas, that we 
recognize the significance of this right to Americans, we 
recognize the significance of the privacy interest, we have 
clear rules, and the rules should be to default to a warrant.
    Ms. Lofgren. Thank you very much. My time has expired, Mr. 
Chairman.
    Mr. Collins [presiding]. The gentlelady's time has expired.
    The Chair now recognizes the gentleman from Iowa, Mr. King.
    Mr. King. Thank you, Mr. Chairman.
    I thank the witnesses for your testimony.
    First, it was mentioned that there's a general agreement 
among the panel, I believe, and others, that except for a few 
people who would like to expand the dragnet. I would ask Mr. 
Cook and Mr. Littlehale, is there anything in this bill that 
expands the dragnet?
    Mr. Cook?
    Mr. Cook. Well, I'm troubled by the characterization.
    Mr. King. Well, let me define dragnet so that you don't 
have to. And that would be is there anything in this bill that 
expands your ability to do investigations that maybe makes 
innocent citizens more vulnerable?
    Mr. Cook. No, sir. I think that the bill is narrow, in 
fact, expansively limits in a couple of unprecedented ways law 
enforcement's ability to do their job.
    Mr. King. That's my understanding of it as well. Mr. 
Littlehale?
    Mr. Littlehale. Yes, Congressman, I share that concern.
    Mr. King. And you would share the characterization with Mr. 
Cook as well?
    Mr. Littlehale. I believe that the bill imposes additional 
limitations on traditional search warrant practice. And even if 
the standard of proof governing an additional category of 
records as contemplated in the bill is given, we will have less 
authority with respect to those records than we would with 
records in the physical world, yes.
    Mr. King. I thank both gentlemen. I turn to Mr. Salgado. In 
thinking about this from a Google perspective, when I or a 
citizen sign up for an email account, there's a long agreement 
that's there that I have to confess I have not studied that or 
have my attorney look that over, but I say, okay I agree. And I 
sign up for my email. And I'm glad to have the service. And it 
works really good. Am I in that waiving some protection to 
privacy in that agreement?
    Mr. Salgado. Well, not with regard to what we're talking 
about here. The agreements certainly talk about how we use the 
information and where we might be needing to disclose it in 
order to provide the service. So it's meant to describe to you, 
and those who are interested in knowing these things, what's 
happening. But with regard to this bill and the Fourth 
Amendment, we will honor search warrants that are served on us 
in valid legal process.
    Mr. King. Will you honor subpoenas?
    Mr. Salgado. We honor subpoenas but not for content. So we 
will honor subpoenas for what the statute says we honor 
subpoenas for. And it's our preference to let users know when 
we get these requests, unless we are informed by gag order, for 
example, that we're not able to. So we will honor all of those 
rules that Congress has set in place and that the Fourth 
Amendment has established. We also will honor requests to 
preserve information while law enforcement goes through the 
effort of getting a search warrant which may take a period of 
time.
    Mr. King. Are you aware of any ISPs that have a different 
policy than you're describing here with Google's?
    Mr. Salgado. There may be slight differences in how the 
product works or the policies are slightly different. But, no, 
generally I think the sort of pattern I'm describing is one 
that certainly the larger companies here operate under.
    Mr. King. Then practice is pretty close to the mirror of 
the act we're discussing, the legislation we're discussing?
    Mr. Salgado. Yes, sir. I think that's right. I'm not aware 
of providers who are producing content on anything less than a 
search warrant at this point.
    Mr. King. So I would burn more time on that but I 
appreciate your response. And I would like to turn to Mr. 
Rosenzweig because I believe that you gave the clearest 
definition of modern electronics versus the postal service from 
that constitutional--the Founders' era. This is still the 
constitutional era. And I would put it this way, ISP equals 
post office, emails equal your filing cabinet. Is that an 
accurate description of yours?
    Mr. Rosenzweig. ISPs equal the post office, yes. That would 
be my summary or stored email equals letters in my file, right.
    Mr. King. Okay. Yes. Stored emails. And could I have the 
right to, if I had an ISP provider that said we want to waive, 
will you waive your authority, will I waive my constitutional 
protections and hand that data over to an ISP provider, I could 
do that willingly, couldn't I, under the constitution and 
current law?
    Mr. Rosenzweig. Oh, you could consent to anything. Provided 
your consent is voluntary and not coerced, you could. You 
don't, if the police come to your door and say can I get the 
letters in your file cabinet, you don't have to require a 
warrant. You could say sure, come on in.
    Mr. King. You're familiar with California v. Greenwood?
    Mr. Rosenzweig. Yes.
    Mr. King. And so the distinction here between Warshak and 
California v. Greenwood, which is essentially if you take your 
garbage out to the curb, it's not protected by any Fourth 
Amendment right. If I delete my emails, and they're within the 
custody of an ISP, and I've waived my right to privacy, that 
would be open access then to the investigators?
    Mr. Rosenzweig. I would say no. But I would have to think 
about that. My sense is that when I delete the email, I'm 
intending not to throw it to the curb as garbage, but rather to 
eradicate its existence altogether. If I'm aware of the fact 
that a copy is kept, maybe. But I don't think I'm aware.
    Mr. King. So it's actually, we're getting where we need to 
go with this panel, I think is the distinction between 
Greenwood and Warshak on what those emails consist of, are they 
garbage or aren't they, are they access to an investigator by 
subpoena or by a warrant or aren't they. So I appreciate the 
panel. This has been clarifying testimony today. And I thank 
the Chairman. And I yield back the balance of my time.
    Mr. Collins. At this time, the gentlelady from Washington 
State, Ms. DelBene, is recognized.
    Ms. DelBene. Thank you, Mr. Chair. And I just want to thank 
the Chair for holding this hearing and to all of you for taking 
the time to be here with us today. Mr. Ceresney, do you dispute 
the continued availability of preservation orders and court 
interference to enforce administrative subpoenas of targets of 
SEC investigations should the Email Privacy Act pass?
    Mr. Ceresney. So if the question is whether preservation 
requirements should be contained in the statute and the ability 
to obtain from the subscriber, should that also be required.
    Ms. DelBene. Do you think if the Email Privacy Act passes, 
do you think that you're going to continue to have the 
availability of preservation orders and court interference to 
enforce administrative subpoenas?
    Mr. Ceresney. I believe that that is still something that 
one could obtain under the proposed statute. But what that 
wouldn't allow us to do is to then obtain those emails from 
ISPs when the individual doesn't provide them to us.
    Ms. DelBene. So you've argued in your testimony that one 
problem with the Email Privacy Act would be that it leads 
targets of investigations to delete emails, thereby destroying 
evidence. So are you telling this Committee that the Email 
Privacy Act would be to blame if you don't take the commonsense 
step of issuing a preservation order on an ISP from day one of 
an investigation. Is there any reason whatsoever that you 
wouldn't take that step, that very simple step, which can be 
done directly by the SEC without a judge's involvement?
    Mr. Ceresney. We would certainly take that step. The 
problem is the preservation doesn't then allow us to then 
obtain the email from the ISP. So certainly we would do that, 
we would try to preserve the email and make sure that it's 
available. But then the next step, that is obtaining it from 
the ISP, that would not be available to us.
    Ms. DelBene. So your comment that this would lead people to 
delete emails doesn't really hold water. If you have a 
preservation order, the information is going to be saved there.
    Mr. Ceresney. But if the person deleted the email and then 
we subpoenaed the person, they wouldn't have it. The only 
person, the only entity that would have possession, custody, 
and control of the email would be the ISP and we wouldn't have 
an avenue----
    Ms. DelBene. If you have a preservation order, then the ISP 
is going to preserve that information.
    Mr. Ceresney. Yes. But if they preserve it and we can't 
obtain it----
    Ms. DelBene. I don't know about you, but I use email to 
keep in touch with my family, my husband, my friends back home 
in Washington State, all across the country. And I'm sure 
pretty much everyone in this room and this building would tell 
a similar story. As email has gone mobile, it's virtually 
indistinguishable from a phone call or a text message and, no 
doubt, contains very important details of people's personal 
lives and stored in the cloud by companies like Mr. Salgado's, 
and we would all hope to be kept safe from intruders or prying 
eyes.
    I find it highly disturbing in your testimony today that 
seems to suggest that the SEC views email service providers 
more like a witness or an informant that you would be able to 
tap directly for information as opposed to the digital home of 
intimate communications. So let me ask you this: If the SEC 
wants a box of documents sitting in a target's home, can you 
use an administrative subpoena to bring a locksmith to their 
home to open the door, walk in, and take documents?
    Mr. Ceresney. We cannot. What we----
    Ms. DelBene. Then please explain to us why you think we 
should give you the ability to do exactly that with a digital 
equivalent. How that could possibly comport with simple 
expectations of privacy and due process and without a shred of 
meaningful evidence from you so far or anyone else that the 
lack of this authority will have any impact on your ability to 
carry out investigations whatsoever?
    Mr. Ceresney. We view the ISP as a third-party storage 
provider, much like an Iron Mountain provider would be for hard 
copy documents that are kept in a storage facility. And if in 
the circumstance where hard copy documents are kept in a 
storage facility, we could go to that storage facility with 
notice to the person who uses that storage facility and try to 
obtain those documents via subpoena. And that I think is the 
analogy that we would draw that would be appropriate in these 
circumstances.
    And from our perspective, we do have instances in the past 
when we did issue ISP subpoenas where we could show that we 
obtained significant evidence in investigations for that 
purpose. As to the last number of years when we haven't used 
it, we don't know what we have lost. But it's certainly our 
investigations----
    Ms. DelBene. I want to get your view, Mr. Calabrese, on 
this in terms of the role of that third-party provider being 
the home of people's personal communications.
    Mr. Calabrese. Well, it's clearly our digital home. I mean, 
you would find much more sensitive information about me in the 
cloud than you honestly would in my house at this point. If you 
wanted physical documents, they are much more sensitive in my 
house. The thing I would also like to point out that we haven't 
really touched upon here is that the standard for accessing 
information in the civil context is very low. It's mere 
relevance. It's not a high standard of probable cause. Also the 
number of things that a predicate--a civil agency has, sort of 
simply mis-filling out your taxes, for example, are much 
greater than the criminal predicates for a warrant. So we're 
talking about a much lower standard, much greater number of 
ways that we can access information. That means that we're 
potentially opening up the cloud to much greater invasion by 
civil agencies even than we would by criminal agencies. And I 
think that's exactly backwards.
    Ms. DelBene. And, Mr. Ceresney, if you give me just a 
couple more seconds, Mr. Chair, you talked about cases. Can you 
give me the specific names of those cases?
    Mr. Ceresney. We have a number of cases. And we would be 
happy to provide it to your staff. It includes an accounting 
fraud case where an email indicated that somebody was using 
earnings management, an insider trading case where an email 
contained a tip, a microcap fraud case where the emails showed 
control of corporation. And just one last thing to answer Mr. 
Calabrese's point, we would be fine if Congress established a 
probable cause standard as the standard that we would have to 
meet. Whatever standard Congress would like to establish for us 
to have to meet, we are fine meeting that standard. What we 
need is some mechanism in instances where an individual does 
not produce to us email, and has deleted it, or otherwise 
destroyed it----
    Ms. DelBene. And I think we've already discussed that right 
now. Post-Warshak, you have never used that authority. So my 
time has expired. And I just want to yield back.
    Mr. Collins. The gentlelady's time has expired. At this 
time, the gentleman from Texas, Mr. Gohmert, is recognized.
    Mr. Gohmert. Thank you, Mr. Chairman. Thank you to the 
witnesses for being here. For anyone that can answer, if 
someone deletes an email that he or she has already sent out, 
would the ISP be able to retrieve that at some point?
    Mr. Salgado. I would be happy to try to answer that. It may 
vary from company to company. In most cases, I think it's fair 
to say that there would be some short period of time between 
the point of deletion and when the system purges the content 
that has been deleted. So there would be some period of time. 
That time period may vary from provider to provider.
    Mr. Gohmert. Couldn't it be retrieved from the person to 
whom it was sent?
    Mr. Salgado. It certainly could. So there may be many 
communicants involved in it.
    Mr. Gohmert. Right. The issue there, and I'm not one of the 
co-sponsors at this time, even though I am one of the persons 
proudest of the work that Kevin Yoder has done in getting this 
bill to this point. I think it's fabulous. I think it's 
important. My concern has been, is that we have left a 
provision at page 10, for example, that allows the governmental 
entity to apply for a court order so that they can still not 
inform the individual. And that's fine to my mind if there's a 
question of endangering the life or physical safety of an 
individual, like a child that was talked about, flight from 
prosecution. As a former judge, I've signed all kinds of felony 
warrants. But I made sure that there was probable cause. And I 
made sure there was particularity in the description in the 
affidavit, as well as in my warrant.
    And I felt very comfortable in 2005 and 2006 when the Bush 
administration was ensuring us we would never use the national 
security letters for anything unless there was someone who 
actually had contact with an international terrorist or 
terrorist organization, those type of things. And then we find 
out in I think in July of 2007, the IG said there were 
potentially thousands of abuses where there was basically no 
case, they just sent them out. And I'm surprised to hear this 
from me, but in the New York Times, there's a good article by 
Carla Monyhan talking about Nicholas Merrill, how he fought to 
disclose the contents of the NSL. And then we also, with the 
disclosures of Snowden, yes, he committed an act of treason, 
but he also exposed lies by the last Administration and this 
Administration.
    When I saw the order, the affidavit and order regarding 
Verizon's disclosures of all of their metadata, I realized we 
were lied to by both Administrations about what was being 
sought. We were told that, look, you don't have to worry, 
there's a FISA court, a confirmed judicial nominee that's a 
Federal judge, they'll protect the Constitution. There was no 
particularity at all, just give us everything on everybody you 
got. And the judge just signed, oh, okay, you want everything? 
Here's everything. I couldn't believe it.
    And so I'm not as comfortable with providing the exception 
that I'm sure was demanded by governmental entities. And I'm 
wondering if an excuse of destruction of, or tampering with 
evidence or intimidation of potential witnesses, enough to get 
an order saying we can avoid informing whoever sent the email 
or whoever should have possession of the email, we don't have 
to inform them if we're concerned they might delete the emails. 
Really? Well, that would always be a concern. So you could 
always, always, always get some judge somewhere that would sign 
off on that order. I know that now after seeing the disclosures 
by Snowden. So I'm not comfortable that this is really going to 
be that helpful because of that massive gaping hole.
    On page 11, it says that basically the provider would have 
the burden of notifying the government at the end of the 
exclusionary notice time. The provider has the burden of 
notifying the government. The government, okay, my time is 
about up, so I'm going to notify the subject of the warrant, so 
that the government can get, there should be no burden on the 
provider to do that. If the government wants to keep that 
secret, the government should try to extend it. But I'm not 
sure that it wouldn't be extended automatically in virtually 
every case.
    Mr. Rosenzweig, you say that we should not--we've always 
protected a man's documents and we shouldn't change that 
because it's in a cloud. I would agree. But the ISPs require we 
check a box that says these documents aren't yours anymore, 
they're mine. And I'm wondering if maybe we should have some 
legislation that tells ISPs, you know what, these documents, 
they really are the property of the person that created them, 
not the one who holds or provided the safe to put them in.
    Mr. Collins. The gentleman's time has expired. But the 
witness may answer.
    Mr. Gohmert. Anybody care to respond?
    Mr. Rosenzweig. I share, I would respond by saying I share 
your concern about the delayed notification provisions, 
especially the destruction of evidence portion of it. I think 
that other portions, you know, a risk of physical injury and 
harm, those are very good. I would point out that 2705 was 
added in the immediate aftermath of 9/11 as a codification of a 
longstanding common law that had developed in the courts of 
appeals that had adopted these various rules for when they 
would delay notification.
    So to some degree, you're arguing with something that 
preexisted 9/11, preexisted ECPA, preexisted--and destruction 
of evidence has traditionally been one of those possibilities. 
That may be something that should change. As for control of 
one's own personal data in the cloud, I think that there are 
many service providers who offer different degrees of control 
over your information. And so I generally tend to be 
comfortable with the idea that there's competition in the 
marketplace and that if that's something that matters to you, 
there are service providers who will promise that they take no 
interest and will not process, will not examine your data. They 
may be more costly in other ways than service providers who 
provide you. So I'm kind of a free-marketist on that one.
    Mr. Gohmert. Okay. Thank you very much.
    Mr. Collins. The gentleman's time has expired. The Chair 
now recognizes the gentleman, Mr. Cicilline.
    Mr. Cicilline. Thank you, Mr. Chairman. And thank you to 
our witnesses for sharing your expertise and your diverse 
perspectives with us today. I believe that all of us assembled 
here, both those of us on the Committee and our assembled panel 
of witnesses, recognize that technology often evolves much 
faster than the law. This, in part, is a testament to the rapid 
pace of American innovation. But it also presents a gap that 
must be addressed. And the Email Privacy Act represents an 
important step forward to closing this gap and preserving 
privacy protections for Americans. And it's no surprise to me 
that it's broadly supported by the American people.
    I want to begin with you, Mr. Ceresney. In your written 
testimony, you state if the bill becomes law without 
modification, the SEC and other civil law enforcement agencies 
would be denied the ability to obtain critical evidence from 
ISPs. This phrasing suggests to me that you are engaged in some 
activity today that would be blocked by this legislation.
    And so, my first question is, does the SEC currently use 
subpoenas to obtain the content of communications from Internet 
service providers?
    Mr. Ceresney. We do not where we don't have consent of the 
providers.
    Mr. Cicilline. And why not?
    Mr. Ceresney. As I've said earlier, it's because in an 
excess of caution and in deference to the discussions that have 
been ongoing in Congress for a number of years about ECPA 
reform, we determined to hold off on using that. But it does 
not mean we do not believe we have the authority under the 
statute and that it is constitutional to use it.
    Mr. Cicilline. But you do not currently use it?
    Mr. Ceresney. We do not without consent of the subscribers.
    Mr. Cicilline. Your written testimony also acknowledges 
that the SEC ``often conducts investigations in parallel with 
criminal authorities.'' If the FBI needs a warrant to obtain my 
email, but the SEC can obtain my email with something less than 
probable cause, what prevents the SEC from helping the 
government to avoid a warrant requirement by sharing my email 
contents with the FBI?
    Mr. Ceresney. So the first point is whatever standard 
Congress establishes we're willing to abide by, even if it's 
probably cause. But, second, when we issue subpoenas----
    Mr. Cicilline. Let me just, so if the standard is probable 
cause, then your objection is not with the standard, but who 
makes the determination of probable cause? Because a probable 
cause finding with a judicial determination is a warrant.
    Mr. Ceresney. No, what we're seeking is authority to 
achieve a court order with notice to the subscriber, which 
provides additional protections to a warrant. A warrant is ex 
parte, and the subscriber doesn't have an ability to object. 
What we're seeking is an authority to obtain an order from a 
court with notice to the subscriber. And the subscriber would 
have the ability to object and provide whatever objections they 
have, whether they be relevance, whether they be privilege, 
whatever other objections. That provides additional protections 
beyond those with the warrant, which is ex parte.
    But to answer your question about the criminal authorities, 
any subpoena or other orders we'd seek would be in advance of 
our investigation. They would not be at the behest of criminal 
authorities. We do not issue subpoenas or otherwise seek 
evidence at the behest of the criminal authorities. We do it to 
advance our own investigation.
    Mr. Cicilline. Mr. Calabrese, did you want to try that?
    Mr. Calabrese. Yeah, I mean, I think the question that we 
haven't heard an answer to yet is probable cause of what. 
Probable cause of a crime in the criminal context is very 
clear. We know what crimes are. And they're interpreted very 
tightly. Violations of civil law are much broader. I mean, if I 
fill out my tax form incorrectly or I state that this was a 
business expense when maybe it was a vacation, you can say oh, 
I have probable cause to believe that by going through my 
emails, I'm going to find that he was on vacation, not on a 
business trip. So what we really are talking about, no matter 
what the standard is, it's a much broader access to Americans' 
content of their communications.
    Mr. Cicilline. And with respect to that, current law 
provides that the government must show probable cause to obtain 
the content in an email that has been stored by a provider for 
180 days, but can use a lesser process for an email that has 
been stored for 181 days. Is there consensus that this 180-day 
rule is inconsistent with how we use emails today? Should it be 
eliminated? And in addition to that, Mr. Calabrese, in your 
written testimony you give a good list of the digital content 
we all store online, emails, text messages, photographs, music, 
passwords, calendars, and other forms of social networking.
    Do these forms of media merit protection under the Fourth 
Amendment? And is current law adequate to protect any privacy 
interests in this information?
    Mr. Calabrese. Well, I certainly think that the court in 
Warshak believed that the Fourth Amendment should extend to all 
these types of contents of communication. My worry is that we 
don't know what the next new technology is going to look like. 
We don't know what the next way that we're going to keep our 
communications private and confidential is. And so we shouldn't 
be waiting. And ECPA doesn't have a suppression remedy. So 
these actual determinations don't come up that often. We 
shouldn't be waiting for 5 or 10 or 15 years for a court to 
find a strange case that allows them to say we have a 
reasonable expectation of privacy in communications. We all 
seem to agree that the content of communications should be 
protected by the warrant unless Congress says otherwise.
    Mr. Cicilline. Thank you. I yield back.
    Mr. Collins. The gentleman's time has expired. The Chair 
recognizes the gentleman from Texas, Mr. Poe.
    Mr. Poe. I thank the Chairman. I thank all of you all for 
being here. As my friend Mr. Gohmert was, I used to be a 
criminal court judge in Texas for 22 years, felony cases, 
20,000 cases or more. All that time, constantly I had law 
enforcement officers come to me with a request for me to sign a 
search warrant based upon their affidavits. And I signed a lot. 
And some I did not sign because of the basics of the Fourth 
Amendment.
    The Fourth Amendment makes us different than every other 
country on Earth because of our history. It's uniquely United 
States history, goes back to the British who wanted general 
warrants to kick in doors of warehouses in Boston to see if the 
American colonists were storing demon rum they hadn't paid 
taxes on yet. To me, a general warrant is the same as a court 
order. So we have specific warrants. And like I said, I signed 
a lot of them.
    It makes no sense to me that the right of privacy is 
protected for 6 months but it's not protected more than 6 
months. I send a letter, snail mail. And I put that in an 
envelope. And I send it off to one of my grandkids somewhere. 
It floats around in America from post office to post office and 
who else knows where until it gets to grandson. It's protected. 
Generally it's protected. It's a form of communication.
    When we use emails or store in the cloud, it's a form of 
communication wherever the cloud may be. So I think it's 
Congress' responsibility to determine what the expectation of 
privacy is. It's not, God bless them, Federal judges' 
responsibility. It's Congress' responsibility to say this is an 
expectation of privacy for Americans. And when we enter the 
digital age, I don't buy the argument, well, we're in the 
digital age, you got to give up some of your constitutional 
rights so we can have government investigate things.
    Whether it's civil investigation, whether it's criminal 
investigation, I don't buy it. Because the Fourth Amendment 
gets in the way of that. I think it is one of the most 
important rights that we have. So it's our duty to set up a 
standard. Over 300 Members have signed on to Mr. Yoder's bill. 
It hasn't come up for a vote. Ms. Lofgren and I filed a similar 
bill in 2013. We want to get a vote on, I want to get a vote on 
Mr. Yoder's bill. Three hundred and four Members of Congress 
agreeing on something? Really? And I think most Members, 
Republicans and Democrats, see the importance of the privacy.
    Mr. Calabrese, let me start with you. I have a lot of 
questions. And I know I have only 5 minutes. The Warshak case, 
the SEC lost the Warshak case. They did not appeal that, did 
they?
    Mr. Calabrese. No, the case was not appealed.
    Mr. Poe. It was not appealed. The SEC, the way I get it, 
the SEC wants a carve-out for civil investigations. The way I 
see this legislation, it's to protect us from the SEC and the 
IRS and the EPA. Because without this legislation, they could 
keep doing what they're doing. Would you like to comment on 
that, weigh in on that? Civil agencies snooping around in 
email. And I'm using the word snoop, that's my word.
    Mr. Calabrese. We've already seen agency overreach. We saw 
it in this Tea Party investigation. There was no question there 
was improper investigation that was searching for a much 
broader category of information about people than anyone I 
think here is comfortable with. The idea of looking at what 
people are reading, looking at their donor lists as part of a 
civil investigation into someone's tax status is wrong. And it 
disturbs me that if someone can have a high--a relevant 
standard that is so low that we might bring those kind of 
investigations into play, I think that's a problem. And I think 
that that's why we need to limit this very powerful authority 
to warrants that are supervised by judges under probable cause.
    Mr. Ceresney. Judge, may I respond?
    Mr. Poe. Not yet. You can respond in writing because I have 
the same question for all six of you. The basis of a search 
warrant also requires there be notice. Under the current law, 
let's use the SEC or let's use the IRS, I like to use them 
better, they can do their investigation, their snooping, and 
the person being investigated doesn't know about it. Is that 
correct, Mr. Calabrese?
    Mr. Calabrese. It depends on the circumstances. Sometimes 
notice is delayed.
    Mr. Poe. Notice is delayed.
    Mr. Calabrese. Sometimes notice is delayed. Sometimes they 
do know about it.
    Mr. Poe. But would you agree that it's part of our 
fundamental fairness under the Fourth Amendment that there is a 
search warrant, the search warrant is executed, and that there 
is a return to the judge of what was seized or not seized, and, 
eventually, whoever's house was searched or property was 
searched, they get notice of the results of the search warrant?
    Mr. Calabrese. This is one of the most----
    Mr. Collins. The gentleman's time has expired. But the 
witness can answer.
    Mr. Calabrese. This is one of the most invasive things that 
the U.S. Government or any government can do to its citizens, 
it can investigate them, make them the subject of law 
enforcement scrutiny. So, yes, absent some compelling reason 
not to notify them, I think they absolutely deserve to know 
that they are the subject of government scrutiny.
    Mr. Poe. I ask unanimous consent to submit questions for 
the record, Mr. Chairman.
    Mr. Collins. You have unanimous consent to submit as many 
as you like, Judge.
    Mr. Poe. And we should get the southern rule. If we're from 
the south, we should be able to talk longer than just 5 
minutes.
    Mr. Collins. Well, we just are better expressing ourselves 
in our eloquence and slow southern execution.
    Mr. Poe. Thank you, Mr. Chairman.
    Mr. Collins. With that, the Chair recognizes the gentlelady 
from Texas, Ms. Sheila Jackson Lee.
    Ms. Jackson Lee. I thank you so very much, Mr. Chairman. 
And I thank the witnesses. I want to engage in a give and take 
with Mr. Calabrese, Mr. Salgado, and Mr. Rosenzweig if I might. 
But let me just ask a pointed question to Mr. Cook. Let me 
thank all of you for your service. And acknowledge that the 
Warshak case, Mr. Ceresney, I will not attribute your win or 
loss, I will just take the case as a Sixth Circuit case.
    I just want to ask, since that case, the Warshak case, Mr. 
Cook, do you know whether or not the Department of Justice has 
used anything less than a warrant based on probable cause to 
compel a third-party provider to produce the contents of a 
communications? You all adhere to that?
    Mr. Cook. Yes.
    Ms. Jackson Lee. All right. That's good. Let me move on 
then.
    Mr. Cook. That was easy. Thank you.
    Ms. Jackson Lee. Thank you. To say that I come to this with 
a sense of trust of government not to sense that government is 
unworthy and consistently trying to undermine its citizens. But 
I am an adherent to the Fourth Amendment and its value and its 
value with the Founding Fathers. So let me engage the three of 
you. One, I'm going to go to you, Mr. Rosenzweig, to make it 
clear that issues dealing with terrorism and any elements 
thereof are specifically, pointedly, and appropriately excluded 
under this legislation. Are you comfortable with that?
    Mr. Rosenzweig. Very much so. Indeed, that's part of the 
ground for at least my personal view that this legislation is 
appropriate. Given the post-9/11 changes that have empowered 
our national security apparatus to protect us in ways that I 
think are appropriate, it's important to exclude from the 
coverage of this bill those issues. And I think that's 
something we can agree on. And the construction provision that 
is in section 6, I guess it is, of the bill is perfectly 
appropriate to that end.
    Ms. Jackson Lee. I think it is important to make note of 
that. I'm on Homeland Security as well. America is obviously on 
alert. But we've always said since 9/11 that we would not allow 
fear to instruct and guide our interpretation of the 
Constitution. I want to go to Mr. Salgado.
    Mr. Calabrese, there was a law professor at Yale Law School 
with the same name. Do you have any----
    Mr. Calabrese. Sadly, I don't.
    Ms. Jackson Lee. I had his class. So you'll be favored by 
your very name. But let me engage both of you in the question 
of the value and the sanctity of the Fourth Amendment and 
whether or not in this interpretation of this bill, which I 
understand so many of us are on the bill, but 100,000 petitions 
were sent to the White House to support it, whether it is 
obstructionist in terms of preventing law enforcement from 
doing their job. Can you all just engage? Maybe Mr. Calabrese 
will start and Mr. Salgado will finish.
    Mr. Calabrese. Sure. I don't believe that it is 
obstructionist. You know, we're codifying what amounts to 
existing practice and existing protections under the Fourth 
Amendment. We're also saying that you should have notice when 
someone does a search of your most private electronic home. And 
to be clear, unlike a physical warrant where you get that 
notice immediately, we're actually delaying notice for 10 days 
here so that law enforcement has got a head start.
    Ms. Jackson Lee. Absolutely.
    Mr. Calabrese. And then we're allowing a gag provision 
which says that you, in important circumstances, you'll never 
get that notice. I think these are all pretty basic protections 
for anyone. And, honestly, if there are issues around the 
edges, I'm not sure that there are, but if there are, I think 
that's why we have markups, so that we can bring these issues 
forward, we can take votes on whether there's anything here 
that we should be concerned about, and then we can get this 
bill to the floor.
    Ms. Jackson Lee. Thank you. Mr. Salgado, let me say that I 
too served as a judge and did a lot of PC warrants for police 
officers. And I think this should be a comfort. I had a 
responsibility to the police officer but also to the citizens, 
to be able to inquire what the basis of this warrant was. And 
that layer was placed in my hands.
    I think the American people place their protection in our 
collective hands. What do you think? What is your perspective 
on that? And maybe, Mr. Ceresney, you might want to answer that 
you are not hindered by the present Sixth Circuit 
interpretation. But go ahead, Mr. Salgado.
    Mr. Salgado. Yeah, I agree with that completely. The role 
of the neutral and detached magistrate in American 
jurisprudence is a significant one. It's something that really 
sets America apart from a lot of countries, and gives us a 
layer of protection to make sure that well-meaning but perhaps 
poor judgment in some cases is overridden by the cooler 
judgment of a magistrate who doesn't have a particular interest 
in a case. It's significant for Fourth Amendment, it's no 
accident that that is the standard for valid warrants.
    Ms. Jackson Lee. Quickly. Thank you. Mr. Ceresney, do you 
want to comment on that as Mr. Yoder sits in the room on pins 
and needles wondering how we're going to treat his bill?
    Mr. Collins. The gentlelady's time has expired. But the 
gentleman can answer.
    Ms. Jackson Lee. Thank you, Mr. Chairman.
    Mr. Ceresney. I couldn't agree more that it is important to 
have a role for a judge in this situation to provide objective 
views on the matter. And that's why the order that we are 
proposing would be before a judge with notice to the 
subscriber. And the subscriber would be able to bring before 
that judge whatever objections they have to our seeking the 
email.
    And that is actually the remedy that we are seeking in this 
case. We would try to obtain that email from the subscriber. If 
we couldn't, then we would go before a judge and try to obtain 
the order. And the judge would be the objective factfinder to 
determine whether we've met the standard.
    Ms. Jackson Lee. Mr. Chairman, I like this bill. But I'm 
willing to listen to the gentlemen. But I like our bill before 
us. And I look forward to it going to markup. I yield back.
    Mr. Collins. Thank you. The gentlelady's time has expired. 
The Chair now recognizes the gentleman from Pennsylvania, Mr. 
Marino.
    Mr. Marino. Thank you, Chairman. Good afternoon, gentlemen. 
My question here is going to be directed to Mr. Rosenzweig and 
Mr. Salgado in that order. Please speak to the trends of users 
moving to encrypted services, often hosted overseas in order to 
seek privacy, and how this might make us less safe than if we 
had a clear framework in place. Do you understand my question?
    Mr. Rosenzweig. I do understand your question. I think to 
begin the answer, obviously, the encryption discussion is 
slightly different than the one we're having now about the 
lawful access to content. What I would say about the encryption 
discussion is that it is essentially a reflection of the exact 
same impulse, which is that people are seeing increasingly the 
lack of privacy in their personal effects and papers in their--
I like the idea of a digital home, their electronic home. And 
to the extent that this Congress does not take steps to protect 
that privacy by law, encryption is essentially citizens 
engaging in self help and protecting themselves with their own 
capabilities.
    I would say that, from my perspective, encryption is an 
idea. It's a mathematical proof. It's not suppressible. So if 
we do not regularize access through things like the proposal 
before you that will provide comfort to citizens, they're going 
to engage even more, I think, in self help.
    Mr. Marino. Thank you. Mr. Salgado?
    Mr. Salgado. I agree completely with that statement. And I 
think to the point in your question about the movement of users 
to services overseas, I think that's a natural consequence of 
the misimpression that U.S. Government has such easy access to 
the data providers. And it's not true. And this bill will help 
make it clear. And it will help prevent the fleeing of users to 
other services based on this misperception.
    Mr. Marino. Thank you. Mr. Cook and Mr. Littlehale, I have 
18 years of law enforcement behind me, prosecution, State and 
Federal level. And as far as I'm concerned, what I've seen here 
since I've been in Congress, and this is only my third term, 
the less Federal Government in my life, the better.
    Basically what NSA has done, what the IRS, and there are 
many more that we could get into, the overreaching and what I 
think is criminality that has taken place in these agencies. 
But being a law enforcement guy, and I've prosecuted many child 
abuse cases and pornography cases, if the two of you can 
quickly tell me what the obstacle is to you and how we can fix 
that. Because I know in some investigations that I had, I 
didn't want the person who was looking at and transferring and 
uploading and downloading child pornography to know at this 
point of my investigation that he was the target or she was the 
target. Could you please respond?
    Mr. Cook. Yes, sir. And I'm concerned that we've lost sight 
of that issue and the exigent or emergency aid exception issue, 
so if I could just begin with that. The concern that we have is 
many of these investigations, whether it's child pornography or 
any other type of investigation, many fraud investigations 
involve dozens, sometimes hundreds or thousands sometimes in 
child pornography cases of targets. For us to get the content 
and then have to let the target of the investigation know is a 
new discovery requirement that puts the targets, whether it's 
terrorism or otherwise, on notice that we're looking at them. 
It's unprecedented, I've said that, unprecedented in our law.
    Mr. Marino. What is the change that we can make? And Mr. 
Littlehale, you go, and then collectively tell me what the 
changes are that you would like to see.
    Mr. Littlehale. Thank you, Congressman. If all we were 
interested in is extending and leveling the playing field for 
the 180-day rule and content, this bill would be a page long. 
The notice provisions that you're talking about, along with the 
additional protections that the bill provides, are one of the 
great reasons that we're concerned about it. While I certainly 
think that we would like to have a conversation, I think those 
are a little bit more than issues around the edges.
    I mean, the body of our concern about the bill is that when 
we get a warrant, we want it to mean something. That's true on 
the earlier point with respect to encryption. You know, if I 
serve a search warrant on somebody, I want to have access to 
that evidence. And in many instances now, I don't. Well, I want 
to find that evidence in other places. And if it's denied to me 
because of delays or because of burdensome notice provisions, 
those slow me down. They make me less effective as an 
investigator. And I believe that this Committee should 
undertake a robust review of what this bill is going to do to 
the----
    Mr. Marino. My time has run out. Would the two of you 
please put in writing and get it to me what you think could be 
a remedy for this, and anyone else who wants to address that as 
well.
    Listen, I am just as much a Fourth Amendment advocate as I 
am putting these people behind bars. And I wish I--no one 
should have to look at the photos of the kids that I've looked 
at and you've seen over the years and question as to why we 
need to have some delay before letting that person know that 
they're going to be arrested. I yield back. Thank you.
    Mr. Collins. The gentleman's time has expired. The Chair 
now recognizes the gentleman from New York, Mr. Jeffries.
    Mr. Jeffries. I thank the distinguished Chair. And I thank 
the witnesses for your presence here today.
    I want to follow up on that discussion from my good friend 
from the great State of--the Commonwealth of Pennsylvania. Mr. 
Cook, I know you've expressed concerns as it relates to the 
notice requirement. And I think in your testimony you refer to 
the provisions as a red alert tool that could notify an 
individual that he or she is under investigation. Is that 
right?
    Mr. Cook. That is correct.
    Mr. Jeffries. And if you could just kind of walk me through 
a series of responses as it relates to the particular concern 
that you've got with the notice provision. Because it's my 
understanding that section 4 permits up to 10 days of delayed 
notice. Is that right?
    Mr. Cook. That's correct.
    Mr. Jeffries. And is it your view that the 10 days is 
inadequate?
    Mr. Cook. So I think it's important for me to point out 
that in our discussions already, we have drawn parallels with 
the Fourth Amendment as it applies in other contexts. And 
everybody seems in agreement that that's the goal, is to make 
the bill parallel Fourth Amendment protections.
    But this bill does more than that. And here's why. For 
example, if you have terrorists working out of an apartment, a 
third-party's apartment, and there is evidence in that 
apartment, we get a search warrant, search that apartment, 
there's no obligation for us to tell the terrorists that we've 
gotten evidence out of that apartment that can be used against 
them.
    Mr. Jeffries. Right. But this bill doesn't necessarily 
impose that obligation. It's a default provision, but there are 
steps that the government can take under exigent circumstances. 
I wouldn't think that it would be sound public policy to create 
a law that simply applies in the instance of the terrorist 
context where this is a country of 300-plus million people that 
values their privacy rights, so there has got to be an 
appropriate balance between the legitimate ability of law 
enforcement to help keep us safe and to prosecute wrongdoers to 
the full extent of the law, and the civil rights and civil 
liberties of American citizens. Is that correct?
    Mr. Cook. As an email user, I could not agree more, but I 
think that the Fourth Amendment has already reached that 
balance because in the analogy that I've given you, when we 
search that third-party's home or service provider, that 
homeowner or service provider is within their rights to contact 
whomever they want to notify them.
    There has never been an obligation for the government to 
figure out who the evidence is going to be used against and to 
notify them. That's why I say this is unique in the law, and 
I've never seen it before.
    Mr. Jeffries. Now, as it relates to sort of the 10 days 
delay, if the government concludes that additional delay is 
warranted, this bill, correct, provides for a court to make 
that determination that the notice can be delayed indefinitely. 
Is that right?
    Mr. Cook. Not indefinitely. There's a 180-day limitation, 
and then there's a recurring obligation to reach back to the 
court.
    Mr. Jeffries. Right, but after that 180-day period expires, 
the government can go back to the court and request another 
180-day delay. Is that correct?
    Mr. Cook. That is correct. There are narrow limitations on 
it. For example, one of the limitations is that if we can show 
that there would be harm to another individual, but there are 
many times when the harm could be to a community rather than an 
individual, and I wish I could report to you that all judges 
are reasonable and will always, in the right circumstances, 
limit that new constant--or this new statutory notice rule, but 
the truth is that that just isn't how it works, and expanding 
these obligations on the government will come with great risk 
in serious cases.
    Mr. Jeffries. But there are times that an Article III judge 
can reasonably, or a magistrate that's not an Article III 
judge, but an Article III judge or magistrate could reasonably 
disagree with the government as it relates to privacy 
protections and potential overreach. Is that correct?
    Mr. Cook. Of course. Of course it is, and there are times 
when that will--that this agreement will result in notification 
to--under this newly created rule, to targets of criminal 
investigations and alert them to allow them to flee or 
otherwise destroy evidence or otherwise engage in bad behavior.
    Mr. Jeffries. Mr. Calabrese, could you speak to the 
adequacy of this notice requirement in your view?
    Mr. Calabrese. I believe it's a very strong notice 
requirement and constitutionally appropriate with a very strong 
delay procedure. One of the things I'm struggling with a little 
bit is, we're talking about a circumstance where I am going 
before the judge and getting a search warrant. At that same 
time, I may get a delay of that search warrant, so we're not 
talking about some kind of separate process where I've got to 
go through an additional burden.
    When I get the warrant, I can also make the case that I 
must delay notice. That can happen for 180 days. Before a 
provider or anyone else, you know, notifies the subject, they 
have to tell the government that they are going to do that, 
giving the government an ability to go back to the court and 
say, you know what, the reasons for our delay have not ended 
and we need to expand it. I mean, I think it's a very 
reasonable, very balanced approach that supports a fundamental 
constitutional value, one of notice that's embedded in the 
Fourth Amendment.
    Mr. Jeffries. Thank you. I yield back.
    Mr. Collins. The gentleman's time has expired. At this 
time, the Chair recognizes the gentleman from Texas, Mr. 
Ratcliffe.
    Mr. Ratcliffe. Thank you, Mr. Chairman. As a former U.S. 
attorney, I always appreciate and listen to concerns expressed 
by law enforcement whenever Congress proposes changes to a law 
that may impact your ability to do your job because you're the 
folks that are working so hard to keep us safe, and I want to 
certainly make sure you have the tools and resources and 
capability necessary to do that effectively.
    That being said, I also strongly believe that in an 
increasingly connected, complex, digital society, our laws have 
to be modernized to make sure they reflect the current 
technological landscape. As our technology is evolving, this 
extremely personal information is being stored on our 
computers, on our smartphones, on our Fitbits, where we travel, 
what we eat, what we read, where we shop, who we communicate 
with, all highly personal information, and so we've got to make 
sure we've got robust protections in place for that.
    I certainly don't believe that the Fourth Amendment 
protections that we all hold so dear and the needs of law 
enforcement are mutually exclusive. And I appreciate all the 
witnesses being here today to have a thoughtful discussion 
about that.
    Mr. Ceresney, I want to start with you because, from my 
perspective, it seems like that the SEC has been the most vocal 
civilian agency in expressing concerns about modifying ECPA, 
but the SEC doesn't appear to have served a subpoena on a 
commercial provider in 5 years since the Warshak decision. And 
despite that, the SEC's annual report last year, 2014, touted a 
record year, cutting edge enforcement actions, more cases than 
ever before, a number of first ever cases that span the 
securities industry.
    And I know that Chairman White has testified that the SEC 
isn't issuing subpoenas to third-party service providers for 
content. So given the record number of cases, enforcement 
actions, and first ever cases brought by the SEC, all done 
without encroaching on Fourth Amendment rights of Americans, 
why is the SEC asking Congress to give it the authority to get 
content on something less than a warrant?
    Mr. Ceresney. Well, we certainly have been successful, we 
think, in enforcing the securities laws, but that does not mean 
that there aren't cases that we would benefit tremendously from 
emails that we would be able to obtain from ISPs. And I guess 
the point that I would assert is that the Fourth Amendment is 
not violated by what we are proposing, which would be an order 
before a judge, which a judge could issue, with notice to the 
subscriber after the subscriber has the opportunity to raise 
whatever objections they have under a standard that Congress 
would establish. And from our perspective, that does comply 
with the Fourth Amendment, and it also balances privacy 
protections because you would have an objective factfinder 
reviewing the situation and determining whether it's 
appropriate for us to obtain emails in that circumstance.
    And I can tell you that there are ongoing investigations 
now, which we have refrained from seeking those emails from 
ISPs, which would definitely benefit from such emails.
    Mr. Ratcliffe. When you say what you are proposing, I mean, 
how have you been proposing it?
    Mr. Ceresney. We've had ongoing discussions with Members of 
Congress about these issues for the last couple of years.
    Mr. Ratcliffe. Okay. Well, because, you know, from my 
perspective, it seems like you've been altering your behavior 
for the last few years in response to this opinion rather than 
coming to a committee of jurisdiction, at least from my 
perspective. I know that when FBI has a problem, they come and 
let us know what it is and how we can fix it.
    Mr. Ceresney. We've been having ongoing discussions with 
the staff of both Judiciary Senate and House Judiciary 
throughout this period, certainly since I've been at the SEC, 
which is over----
    Mr. Ratcliffe. That's fair enough. Thanks for that.
    Mr. Salgado, in your testimony, paraphrasing here a little 
bit, but essentially you seem to be saying that H.R. 699 is 
really just a codification of the status quo under Warshak. Is 
that right?
    Mr. Salgado. That's accurate, yes.
    Mr. Ratcliffe. Okay. You don't think that H.R. 699 goes 
beyond the holding in Warshak?
    Mr. Salgado. I don't think it does. I'm happy to hear 
suggestions, but my review of Warshak and the bill suggests 
that they're very consistent.
    Mr. Ratcliffe. Mr. Calabrese, you agree with that?
    Mr. Calabrese. I do.
    Mr. Ratcliffe. Mr. Rosenzweig.
    Mr. Rosenzweig. I think I do. I haven't done--I haven't 
checked precisely, though.
    Mr. Ratcliffe. Okay. I'm going to yield. My time is about 
to expire, so I'm going to yield back the balance of my time. 
Thank you all for being here.
    Mr. Collins. The gentleman yields back. Now the Chair 
recognizes himself for questions.
    Mr. Salgado, there has been an issue, and we brought this 
up here in this emergency issue of provisions, emergency 
disclosure mechanisms, and Mr. Littlehale, actually, in his 
written testimony, that the primary emergency disclosure 
mechanism currently in law are voluntary. He also mentions that 
companies are often--and this is his words--unable or unwilling 
to respond to law enforcement's lawful demands in a timely 
manner.
    Now, I think we all would agree true emergencies are there, 
and as a son of a Georgia State trooper, there's not going to 
be anybody that would deny the need from a law enforcement 
perspective. However, it seems to be implying that there's 
something missing here. So we did a little bit of research in 
our office and with others, and based on the concerns we saw, 
that publishing Google's transparency report, based on that 
report, which we have looked at, it says Google received 171 
emergency disclosure requests and provided at least some data 
in response to 80 percent of emergency disclosure requests.
    One, I think, for most people to understand it, we've 
looked into it, but I'd like to hear your answer. To better 
understand that, can you explain why Google responded to only 
80 percent of these requests, break down those numbers for us, 
and why couldn't the response rate be 100 percent, given what 
has been heard from Mr. Littlehale here.
    Mr. Salgado. Sure. I'd be happy to. I think the statistic 
you're referring to is in our transparency report.
    Mr. Collins. Yes.
    Mr. Salgado. We've been publishing that number for a while 
here so that policymakers and others can get an idea of what 
this work is like. The number is actually relatively low, 171 
compared to the type of legal process we get.
    The 80 percent represents lots of different situations 
where the emergency doesn't justify the disclosure. Often, the 
case is that the identifier that's given to us in the emergency 
request doesn't actually go back to any real account. So there 
are some services out there where you can create an account 
using a Google or any email address, and it's not verified that 
there is such an address. They may use that account to threaten 
a school shooting or engage in other some violent activity.
    The authorities quite legitimately will come to Google and 
ask us for information about this account that was used to 
create the account that made the threat. We look in our system, 
and there is no such account, so the response back is we have 
no data to produce in response to this otherwise legitimate 
emergency request. That gets counted as a nondisclosure, and 
that adds into the 20 percent where there was not a disclosure. 
There was no responsive data.
    That's probably the most common situation in that 20 
percent. There may be other situations where the request is 
coming in and the emergency is over, that the investigation is 
now actually about a historical crime, there is no ongoing 
threat of loss of life or serious physical injury, which means 
it's inappropriate to be using that authority to get the 
information.
    And we are able to, at that point, say this doesn't look 
like an ongoing emergency, we can preserve the information, and 
when you come back to us with the legal process, we can 
promptly disclose.
    Mr. Collins. Okay. And just real quickly, but you went on 
with your answer long enough to bring up a question. Are you 
making that determination if the emergency situation is still 
ongoing?
    Mr. Salgado. That's right. The statute----
    Mr. Collins. Not the law enforcement agency offering?
    Mr. Salgado. The statute says that we are allowed to 
disclose if we have a good faith belief that there's an 
emergency.
    Mr. Collins. Okay. Mr. Littlehale, when you testified 
before House Judiciary Committee in 2013 about the emergency 
disclosure issue, you said that some providers make a decision 
never to provide records in the absence of legal process, no 
matter the circumstance.
    Can you identify the service providers that have a policy 
of categorically rejecting emergency requests in the absence of 
compulsory legal process? If not, why?
    Mr. Littlehale. Congressman, as I stated in response to the 
question at the time, I have made the decision not to identify, 
in the examples that I give, specific providers because I don't 
want to highlight a vulnerability in a public forum. There may 
come a time when we do have to disclose that.
    Mr. Collins. Well, I tell you what. I would like to request 
you can submit that in a nonpublic forum, but I'm really 
concerned here that we're making a categorical statement 
without categorical proof.
    Mr. Littlehale. Well, I can certainly say anecdotally that 
the agents----
    Mr. Collins. No, I want to know--you made a direct 
statement.
    Mr. Littlehale [continuing]. That I work with have been 
told that by providers.
    Mr. Collins. Mr. Littlehale, you made a direct statement. 
It wasn't anecdotally. I didn't start off by saying, 
``Anecdotally, providers make a decision never.'' You said in 
your testimony, providers make a decision never to provide 
records in the absence of legal process, no matter the 
circumstance, and that's a very direct statement against the 
business practices of Internet providers.
    Is it true? Is it not true? Do you have evidence? Or do you 
not have evidence?
    Mr. Littlehale. I have been told that by providers, yes.
    Mr. Collins. But you don't have evidence. You made a 
statement that is not grounded, except anything and 
anecdotally.
    Mr. Littlehale. Well, I'd say I would suggest that I do 
have evidence. I have been told that by providers.
    Mr. Collins. Well, I was told that there was a Santa Claus, 
but I found out real quickly there wasn't. I mean, I'm trying 
to figure out----
    Mr. Littlehale. Congressman, I would suggest that that's 
evidence. If you choose not to believe me, then I suppose I 
can't help you with that, but I have been told and agents that 
work for me have been told that in some cases.
    Mr. Collins. I'll just let that one sit.
    Mr. Ceresney, during an exchange with Senator Leahy in a 
Senate hearing on this topic, you said that with regard to 
phone calls, you're not seeking authority, the criminal--
authority that criminal authorities have that civil agencies do 
not, but in seeking to get access to emails without a warrant, 
you're essentially seeking something more than the authority, 
the criminal authorities have. Isn't that contradictory?
    Mr. Ceresney. I don't think we're seeking more authority 
than the criminal authorities have.
    Mr. Collins. So what are you seeking?
    Mr. Ceresney. I'm sorry?
    Mr. Collins. Then what are you seeking? I'll give you a 
chance to clarify that.
    Mr. Ceresney. Sure. What we're seeking is the ability to 
obtain emails after we try to obtain them from an individual 
subscriber by going to a court and obtaining a court order with 
notice to the subscriber and allowing the subscriber to raise 
whatever objections they have before the court.
    Mr. Collins. Well, I think it's--and like I said, it's 
interesting that some of the testimony that's been given here, 
and I think, you know, it's very concerning from some issues of 
anecdotal evidence and real evidence and discussion, especially 
on the SEC side, when you're, you know, giving the--you know, 
your own report saying you're doing more than you've ever done 
here, yet without this, by choice or decision, however you're 
wanting to do it.
    Mr. Calabrese, one last question for you, as my time is now 
over. But in dissent from the FTC request of civil agency carve 
out, FTC Commissioner Brill wrote, ``I am not convinced that 
this authority is necessary to maintain the commission's 
effectiveness as a law enforcement agency now or in cases that 
we can presently foresee. On the other hand, I am concerned 
that the judicial mechanism for civil law enforcement agencies 
to obtain content from ECPA providers could entrench authority 
that have potential to lead invasions of individual privacy, 
and under some circumstances, may be unconstitutional in 
practice.''
    Could you speak very briefly. Do you agree or disagree with 
his concern?
    Mr. Calabrese. I do worry that we will create an 
unconstitutional or incredibly reckless carve out for civil 
agencies. And my hope is that we continue to push H.R. 699 
forward as is to a markup and we can vote and get it to the 
floor. Thank you.
    Mr. Collins. Well, I appreciate it. In looking around and 
seeing how it's just me and the distinguished Ranking Member, 
this concludes today's hearing. I'd like to thank all the 
witnesses for attending. Without objection, all Members have 5 
legislative days to submit additional written questions for the 
witnesses or additional materials for the record.
    And with that, this hearing is adjourned.
    [Whereupon, at 12:28 p.m., the Committee was adjourned.]

                            A P P E N D I X

                              ----------                              

               Material Submitted for the Hearing Record

 Prepared Statement of the Honorable Doug Collins, a Representative in 
   Congress from the State of Georgia, and Member, Committee on the 
                               Judiciary
    Mr. Chairman, thank you for holding today's hearing on H.R. 699, 
the Email Privacy Act. I appreciate the chance to discuss this 
important legislation and hear from the witnesses. I hope that today's 
hearing is just the first step towards Committee mark-up and 
consideration of H.R. 699.
    H.R. 699 was introduced by my friend from Kansas, Rep. Kevin Yoder. 
I am a cosponsor and strong supporter of the Email Privacy Act. If 
enacted, the bill would update the Electronic Communications Privacy 
Act to better reflect advances in technology and to ensure that 
Americans' electronic communications are protected from unwarranted 
government intrusion.
    As of today this legislation has 305 cosponsors, earning it the 
distinction of being the most supported piece of legislation in the 
House that has not yet received consideration on the House Floor. 
Twenty-eight of these cosponsors serve on the House Judiciary 
Committee. The majority of each party has cosponsored the legislation. 
It is not often that you see this type of overwhelming bipartisan 
support for legislation, but the numbers speak for themselves that this 
issue is one that deserves and demands consideration.
    I understand that certain Members may have concerns with specific 
provisions of the legislation. While I support the legislation in its 
current form, I think the best way to address these concerns is through 
a markup of the legislation, where amendments can be discussed and 
democratically considered. No one is served by this legislation 
languishing in legislative limbo.
    Law enforcement needs clarity. Internet service providers need laws 
that accurately reflect their technological advances. And most 
importantly, the American people need and deserve privacy protections 
guaranteed to them by the Fourth Amendment of the United States 
Constitution.
    It is past time that our digital privacy laws were updated to 
reflect today's technology and communications climate. The Electronic 
Communications Privacy Act (ECPA) was written in 1986, and intended to 
balance the interests of preserving citizens' privacy rights while 
protecting legitimate law enforcement needs. While the principles 
behind the law are still critically important and it remains a hallmark 
of privacy protections for communications, in practice many parts of 
the law simply have not kept up with the world as it is today. ECPA--
and in particular the Stored Communications Act (SCA) provision of the 
law--must be amended to reflect the realities of the digital era in 
which we live.
    The Email Privacy Act takes critical steps to update ECPA so that 
Americans' Fourth Amendment rights are better protected and so that 
citizens' can communicate on the internet free from unwarranted 
government snooping.
    The bill eliminates the outdated ``180 day'' standard from current 
law. Current law under ECPA does not require law enforcement to obtain 
a warrant to access the content of emails or other forms of online 
communication--such as documents stored on a cloud service--if they are 
more than 180 days old. For messages over 180 days old, only a 
subpoena--rather than a warrant--is required for access. While this 
distinction may have made sense when storage space on personal 
computers was extremely limited and emails were still a fledging and 
rarely used form of communication, it certainly does make sense today. 
Americans deserve the same strong Fourth Amendment protections whether 
their emails are a day old or several months old. The Email Privacy Act 
addresses this issue by instituting a requirement that law enforcement 
obtains a search warrant before accessing the content of Americans' 
private emails and online communications.
    H.R. 699 would essentially codify a decision issued by the Sixth 
Circuit Court of Appeals in 2010 in United States v. Warshak while 
clarifying additional privacy protections. In Warshak the Court held 
that the government's accessing of 27,000 emails directly from a 
suspect's internet service provider (ISP) with a subpoena and an ex 
parte order was unlawful under the Fourth Amendment. Specifically, the 
Sixth Circuit said that subscribers have ``a reasonable expectation of 
privacy in the contents of emails `that are stored with, or sent or 
received through, a commercial ISP''' and ``to the extent that the SCA 
purports to permit the government to obtain such emails warrantlessly, 
the SCA is unconstitutional.'' \1\
---------------------------------------------------------------------------
    \1\ United States v. Warshak, 631 F.3d 266 (6th Cir. 2010).
---------------------------------------------------------------------------
    In light of Warshak and the Email Privacy Act, the Securities and 
Exchange Commission (SEC) and other civil agencies have sought 
exemptions from the warrant requirement, arguing instead that it should 
be allowed to retain subpoena powers. The SEC maintains that subpoena 
authority is critical for their investigations, but that statement has 
been called in question by SEC Chair Mary Jo White's admission that the 
SEC has not used subpoena authority post-Warshak.
    The Federal Trade Commission (FTC) has made similar claims that it 
should be subject to a warrant exemption when seeking content from 
ISPs. However, Commissioner Brill went so far as to file a dissent to 
the FTC's request for a carve out. Commissioner Brill stated, ``I am 
not convinced that this authority is necessary to maintain the 
Commission's effectiveness as a law enforcement agency now or in cases 
that we can presently foresee. On the other hand, I am concerned that a 
judicial mechanism for civil law enforcement agencies to obtain content 
from ECPA providers could entrench authority that have the potential to 
lead to invasions of individuals' privacy and, under some 
circumstances, maybe unconstitutional in practice.''
    I share Commissioner Brill's concerns. Absent much more compelling 
evidence from civil investigative agencies, I do not believe that these 
agencies should be allowed to pry into Americans' personal lives based 
solely on subpoena authority. This kind of change could fundamentally 
harm the important steps taken in H.R. 699 to better protect Americans' 
rights to have their online communications protected.
    Let me make clear that I believe it is critical law enforcement has 
the tools they need to prevent and fight crime. My father was a Georgia 
State Trooper, so I was instilled with respect and admiration for our 
men and women in uniform from a young age. I believe that in true 
emergencies, law enforcement needs to be able to access information 
quickly. I believe there are potentially legitimate reasons that law 
enforcement would seek the content of an individual's online 
communication. However, I do not believe that we should create so many 
carve-outs and exceptions to the law that the purpose of the 
legislation is lost. We must carefully balance the needs of law 
enforcement with the rights of Americans.
    The Email Privacy Act updates ECPA to restore that balance and 
bring our privacy laws into today's world. I look forward to hearing 
from our witnesses, and I hope that today is a step closer towards 
passage of H.R. 699.
    Thank you Mr. Chairman, I yield back.

                                

       Prepared Statement of the Honorable Sheila Jackson Lee, a 
    Representative in Congress from the State of Texas, and Member, 
                       Committee on the Judiciary
    Thank you, Mr. Chairman. Let me extend my thanks to you and Ranking 
Member Conyers for working together in a spirit of bipartisanship to 
convene this important hearing on H.R. 699, the ``Email Privacy Act.''
    The Fourth Amendment to the United States Constitution states:

          ``The right of the people to be secure in their 
        persons, houses, papers, and effects, against unreasonable 
        searches and seizures, shall not be violated, and no warrants 
        shall issue, but upon probable cause, supported by oath or 
        affirmation, and particularly describing the place to be 
        searched, and the persons or things to be seized.''

    The Fourth Amendment originally enforced the notion that ``each 
man's home is his castle'', secure from unreasonable searches and 
seizures of property by the government.
    The authors of the Constitution had good cause to work to establish 
protections against government overreach, which they themselves 
experienced.
    In our history we can understand the seriousness with which the 
Founding Fathers viewed government authority to search private 
citizens' correspondence or communications.
    The British authorities used writs of assistance, a form of general 
warrant, which permitted house-to-house searches.
    These orders generally failed to allege any illegal activity and 
were not approved by a judge.
    John Adams credited these practices as being ``the spark in which 
originated the American Revolution.''
    As a direct result the founders of this nation drafted the Fourth 
Amendment to the Constitution of the United States.
    However, beginning with the 1967, Supreme Court decision in Katz v. 
United States (establishing the ``reasonable expectation of privacy'' 
test) held that what a person knowingly exposes to the public, even in 
a home or office, is not subject to Fourth Amendment protection.
    This holding began the move to establish what has become known as 
the Third Party Doctrine--such that the Fourth Amendment does not 
prohibit the obtaining of information revealed to a third party and 
conveyed to him by Government authorities, even if the information is 
revealed on the assumption that it will be used only for a limited 
purpose and the confidence placed in the third part will not be 
betrayed.
    The Third Party Doctrine was expanded in two key Supreme Court 
decisions in mid- to late 1970s: U.S. v. Miller, 425 U.S. 435 (1976) 
(holding that one does not have a constitutionally protected privacy 
interest in personal records held by a bank), and Smith v. Maryland, 
442 U.S. 735 (1979) (holding that the installation and use of the pen 
register was not a ``search'' and thus no warrant was required).
    These integral cases came before the Internet and long before the 
use of Cloud based computing services, but their impact are still felt 
today.
The Modern Communication Age
    In possibly the first survey of its kind, in 1983, the polling firm 
Louis Harris & Associates asked U.S. adults if they had a personal 
computer at home and, if so, if they used it to transmit information 
over telephone lines.
    Just 10% of adults surveyed said they had a home computer and, of 
those, 14% said they used a modem to send and receive information.
    The resulting estimate was that 1.4% of U.S. adults used the 
internet in 1983.
    In 2014, the Pew Center for American life found that eight in ten 
U.S. adults (81%) say they use laptop and desktop computers.
    Further, 90% of adults in the United States own a smartphone, 
providing them with instant access to email services.
    While the 1986 enactment of the Electronic Communications Privacy 
Act (ECPA) (which sought to govern how law enforcement agencies and 
private parties may access electronic communications, was meant to be 
forward looking as technologies began to rapidly advance), and various 
lower court decisions such as the 2010 Sixth Circuit case U.S. v. 
Warshak, 631 F.3d 266 (6th Cir. 2010), (which held that subscribers 
have a reasonable expectation of privacy in the content of electronic 
communications and that the government must obtain a warrant to access 
email stored by a third party), have attempted to clarify and govern 
electronic storage on third party servers, constitutional and 
legislative privacy safeguards for electronic communications and other 
forms of developing digital media are wholly inadequate for modern 
times.
    The advent of Cloud Commuting services has only further broadened 
the question of third parties and communications due to the storage of 
not only emails, but digital photos, video, audio, electronic books, 
music preferences, political views, religious beliefs or the lack 
thereof.
    Smart devices in use by tens of millions of Americans allow for the 
collection, and retention of much more information--and that retention 
is outside of the control of the email user.
    The use of email as a primary means of communication is not limited 
to individuals, but obviously extends to businesses.
    The number of worldwide email accounts continues to grow from over 
4.1 billion accounts in 2014 to over 5.2 billion accounts by the end of 
2018.
    The total number of worldwide email users, including both business 
and consumer users, is also increasing from over 2.5 billion in 2014 to 
over 2.8 billion in 2018.
    Email remains the most pervasive form of communication in the 
business world, while other technologies such as social networking, 
instant messaging (IM), mobile IM, and others are also taking hold, 
email remains the most ubiquitous form of business communication.
H.R. 699 a Step in the Right Direction
    H.R. 699, The Email Privacy Act will amend the 29-year-old 
Electronic Communications Privacy Act to prevent the government from 
accessing private electronic communications without a warrant.
    Specifically, the Email Privacy Act will prohibit a provider of 
remote computing service or electronic communication service (including 
email communications) to the public from knowingly divulging to a 
governmental entity the contents of any communication that is in 
electronic storage or otherwise maintained by the provider, subject to 
exceptions.
    H.R. 699 will revise provisions under which the government may 
require a provider to disclose the contents of such communications.
    The bill further clarifies the Electronic Communication Privacy Act 
of 1986 by eliminating the different requirements applicable under 
current law such how communications would be treated if they are:
    o stored for fewer than, or more than, 180 days by an electronic 
communication service; or
    o held by an electronic communication service as opposed to a 
remote computing service.
    Importantly, this bill requires the government to obtain a warrant 
from a court before requiring providers to disclose the content of such 
communications regardless of how long the communication has been held 
in electronic storage by an electronic communication service, or 
whether the information is sought from an electronic communication 
service or a remote computing service.
    FBI Director Comey, has testified that the current practice of the 
FBI is to obtain a warrant for e-mail communications, and that this 
bill would not change their current practices.
    Moreover, this bill would not change any of the existing exceptions 
in the Electronic Communication Privacy Act that allow emergency 
requests for assistance to be processed in a timely manner.
    The bill does require a law enforcement agency, within 10 days 
after receiving the contents of a customer's communication, or a 
governmental entity, within 3 days, to provide a customer whose 
communications were disclosed by the provider a copy of the warrant and 
a notice that such information was requested by, and supplied to, the 
government entity.
    It further allows the government to request delays of such 
notifications.
    H.R. 699 is an important measure that directs the Comptroller 
General to report to Congress regarding disclosures of customer 
communications and records under provisions: (1) as in effect before 
the enactment of this Act, and (2) as amended by this Act.
    The Constitution of the United States is alive and well in the 21st 
Century, and this bill through overwhelming bipartisan support is 
making strides to make sure that citizens are secure in their digital 
records and effects.
    Again, thank you for holding this important hearing and I look 
forward to the testimony of our distinguished panel of witnesses.
    Thank you. I yield back the remainder of my time.
    
    
 [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]   
    
 

                                 [all]
```