Electronic Communications Privacy Act of 1986 (ECPA), 18 U.S.C. § 2510-22.

Background. ECPA amended Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (the “Wiretap Act”) by extending government restrictions on wiretaps beyond telephone calls to apply to electronic data transmissions. “The PATRIOT Act also clarified and updated ECPA in light of modern technologies, and in several respects it eased restrictions on law enforcement access to stored communications.” U.S. Dept. of Justice, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, § III.A.

General Provisions. The ECPA, as amended, protects wire, oral, and electronic communications while those communications are being made, are in transit, and when they are stored on computers. The Act applies to email, telephone conversations, and data stored electronically. ECPA has three titles:

Title I of the ECPA, which is often referred to as the Wiretap Act, prohibits the intentional actual or attempted interception, use, disclosure, or “procure[ment] [of] any other person to intercept or endeavor to intercept any wire, oral, or electronic communication.” Title I provides exceptions for operators and service providers for uses “in the normal course of his employment while engaged in any activity which is a necessary incident to the rendition of his service” and for “persons authorized by law to intercept wire, oral, or electronic communications or to conduct electronic surveillance, as defined in section 101 of the Foreign Intelligence Surveillance Act (FISA) of 1978.” 18 U.S.C. § 2511. It provides procedures for Federal, State, and other government officers to obtain judicial authorization for intercepting such communications, and regulates the use and disclosure of information obtained through authorized wiretapping. 18 U.S.C. §2516-8. A judge may issue a warrant authorizing interception of communications for up to 30 days upon a showing of probable cause that the interception will reveal evidence that an individual is committing, has committed, or is about to commit a “particular offense” listed in §2516. 18 U.S.C. §2518. Title I also prohibits the use of illegally obtained communications as evidence. 18 U.S.C. §2515.

Title II of the ECPA, which is called the Stored Communications Act (SCA), protects the privacy of the contents of files stored by service providers and of records held about the subscriber by service providers, such as subscriber name, billing records, or IP addresses. 18 U.S.C. §§ 2701-12.
 

Title III of the ECPA , which is called the Pen Register and Trap and Trace Statute, requires government entities to obtain a warrant before collecting real-time information, such as dialing, routing, and addressing information related to communications. Real-time collection of this information is usually done using a pen register or trap and trace device.
 

Amendments. The ECPA was significantly amended by the Communications Assistance to Law Enforcement Act (CALEA), the USA PATRIOT Act in 2001, the USA PATRIOT reauthorization acts in 2006, and the FISA Amendments Act of 2008.
 

Civil Rights and Civil Liberties. “Because ECPA is an unusually complicated statute, it is helpful when approaching the statute to understand the intent of its drafters. The structure of ECPA reflects a series of classifications that indicate the drafters’ judgments about what kinds of information implicate greater or lesser privacy interests.

• For example, the drafters saw greater privacy interests in stored e-mails than in subscriber account information.
• Similarly, the drafters believed that computing services available 'to the public' required more strict regulation than services not available to the public. (Perhaps this judgment reflects the view that providers available to the public are not likely to have close relationships with their customers, and therefore might have less incentive to protect their customers’ privacy.)
• To protect the array of privacy interests identified by its drafters, ECPA offers varying degrees of legal protection depending on the perceived importance of the privacy interest involved.
• Some information can be obtained from providers with a mere subpoena; other information requires a special court order; and still other information requires a search warrant.
• In general, the greater the privacy interest, the greater the privacy protection.”