The Electronic Communications Privacy Act (ECPA) has a provision that requires electronic communications more than 180 days old be treated as abandoned and thus obtainable with a subpoena (and its lower burden of proof) or court order rather than a warrant.

The problem is, the ECPA was enacted in October 1986. Clearly, ECPA was written for an earlier technological era.

"It’s easy to see that (ECPA) came from a time when email was an inchoate technology, server space was limited, and the world wide web—let alone web- and cloud-based email and messaging services—didn’t yet exist," said Kyle Daly, senior reporter of Privacy & Data Security at Bloomberg Law.

Yet because the ECPA has not been updated, the law continues to impact companies existing in today’s tech world.

"This presents a significant problem for both users of email and cloud services and the service providers themselves, who want to protect the privacy of their users," said Matthew Starr, director of public advocacy for CompTIA.

In April, Microsoft filed a lawsuit  challenging the U.S. government's claims that it can block companies from telling their customers when their data has been examined by federal agents. The Justice Department says under the ECPA it is allowed to obtain electronic communications without a warrant in cases where the data could endanger an individual or an investigation and that it has no legal obligation to tell Microsoft customers when it seizes their email.

While the battle between the two parties carries on, the broader question of what should be done when advancements in technology outpace the laws intended to regulate them remains unanswered.

The bigger picture

Any business that deals with the flow of electronic communication—email providers, messaging platforms, and so on—has a stake in how easy it is for law enforcement and intelligence agencies to obtain their customers’ private communications, said Daly.

Therefore, this is an important issue for all businesses to watch. It also provides an evolving picture of how yesterday’s laws and today’s technologies can—or should—mesh.

"The idea that we need new laws to address 21st century technology is one that cuts across a wide swath of issues, not just privacy, and across both parties," said Daly. "In many cases, however, Congress is still proving slow to actually produce these new laws."

Pushing for reform

There are any number of arguments tech companies and civil liberties and privacy groups have made for how laws like ECPA affect them.

"The most common one is probably the idea that going after communications without a warrant raises Fourth Amendment concerns—that warrant requirements on electronic communications should be no looser than those for people’s physical property," said Daly.

"Reform of the ECPA is badly overdue because the law simply doesn’t jive with the realities of modern email," said Starr.

And there are efforts under way.

Microsoft, Google, Facebook and others have all come out in favor of updates to ECPA that would limit the government’s ability to compel them to hand over data without a warrant and would allow them to tell customers when their data’s been requested.

In 2010, the Sixth Circuit Court of Appeals ruled that, under the Fourth Amendment, law enforcement must use a warrant to acquire this content from providers, but it hasn’t stopped them from trying to get it through subpoenas, explained Starr.

"At this point, most large providers treat the Sixth Circuit decision as the law of the land, but smaller providers may not have the knowledge or resources to know how to comply," Starr said. "Further, given that this decision is only law in one of 11 judicial circuits, a conflicting decision from another circuit court could upend the law."

The latest effort to revamp the ECPA is the Email Privacy Act, which would update the law to require the government to get a warrant in order to obtain all emails and allow companies in most circumstances to let consumers know if the government’s asking for their emails. The bill passed the House on a 419-0 vote in April.

But the legislation stalled in the Senate as several senators tried to attach controversial amendments to it undercutting the warrant requirement.

"Right now, it’s hard to say if anything’s going to happen in terms of updating ECPA," said Daly