The Electronic Communications Privacy Act (ECPA) and the Stored Wire Electronic Communications Act (SWECA) are often combined and referred to as the Electronic Communications Privacy Act of 1986. The ECPA updated the Federal Wiretap Act of 1968, which was written in the context of interception of conversations using “hard” telephone lines.
The update was necessary to keep up with the development of computer and other digital and electronic communications. The USA-PATRIOT Act and other federal enactments have since clarified and updated the ECPA, introducing less stringent restrictions on law enforcement access to stored communications in certain cases.
What is the ECPA?
The Electronic Communications Privacy Act (ECPA) consists of three parts:
- Title III – Outlaws the unauthorized interception of wire, oral, or electronic communications. Establishes a judicial supervised procedure to permit such interceptions for law enforcement purposes.
- Stored Communications Act – Focuses on the privacy of, and government access to, stored electronic communications.
- Additional provisions – Creates a procedure for governmental installation and use of pen registers, as well as trap-and-trace devices. Outlaws such installation or use, except for law enforcement and foreign intelligence investigations.
The following sections of this article explore the ECPA in greater detail.
Title III: Prohibitions
This section states that it is a federal crime to engage in wiretapping or electronic eavesdropping; to possess wiretapping or electronic eavesdropping equipment; to use or disclose information obtained through illegal wiretapping or electronic eavesdropping; or to disclose information secured through court-ordered wiretapping or electronic eavesdropping, in order to obstruct justice.
This prohibition applies to “any employee, or agent of the United States or any State or political subdivision thereof, and any individual, partnership, association, joint stock company, trust, or corporation.”
Interception, use or disclosure in violation of Title III is generally punishable by imprisonment for not more than five years and/or a fine of not more than $250,000 for individuals and not more than $500,000 for organizations.
Stored Communications Act (SCA)
The SCA bans surreptitious access to communications at rest, although it does so beyond the confines which apply to interception. The SCA includes two sets of proscriptions: a general prohibition and a second applicable only to certain communications providers.
Breaches of the unauthorized access prohibitions expose offenders to potential criminal, civil and administrative sanctions. Violations committed for malicious, mercenary, tortious or criminal purposes are punishable by imprisonment for not more than five years, and/or a fine of not more than $250,000.
Pen Registers & Trap-and-Trace Devices
A trap-and-trace device identifies the source of incoming calls, while a pen register indicates the numbers called from a particular instrument. They do not allow users to overhear the contents of a phone conversation or to otherwise capture the content of a communication and were not considered interceptions under Title III prior to the enactment of the ECPA.
Title III wiretap provisions apply when pen registers and trap-and-trace devices are able to capture wire communication content. The USA-PATRIOT Act enlarged the coverage to include sender/addressee information relating to email and other forms of electronic communications.
Federal government attorneys and state and local police officers may apply for a court order authorizing the installation and use of a pen register and/or a trap-and-trace device upon certification that the information it will provide is relevant to a pending criminal investigation.
The use or installation of pen registers or trap-and-trace devices by anyone other than the telephone company, service provider, or those acting under judicial authority is a federal crime, punishable by imprisonment for not more than a year and/or a fine of not more than $100,000 (or $200,000 for an organization).
Adjustments to the ECPA
Over the years, Congress has adjusted the components of ECPA and FISA. It has done so sometimes in the interests of greater privacy, sometimes in the interest of more effective law enforcement or foreign intelligence gathering, often with the objective of combining those interests. Some important enactments include:
- The USA-PATRIOT Act
- The Intelligence Authorization Act for Fiscal Year 2002
- The 21st Century Department of Justice Appropriations Authorization Act
- The Department of Homeland Security Act
- The USA-PATRIOT Improvement and Reauthorization Act
- The Foreign Intelligence Surveillance Act of 1978 Amendments Act of 2008 (or 2008 FISA Amendments Act)
This article takes a closer look at the Electronic Communications Privacy Act of 1986, which consists of three main parts: 1) Title III; 2) the Stored Communications Act; and 3) Additional provisions regarding pen registers and trap-and-trace devices.
CIPP Exam Preparation
In preparation for the Certified Information Privacy Professional/United States (CIPP/US) exam, a privacy professional should be comfortable with topics related to this post, including:
- Electronic Communications Privacy Act of 1986 (III.A.b.ii.)