Last year the ACLU issued a freedom of information (FoI) request to the IRS requesting “records regarding the government’s access to the contents of individuals’ private electronic communications.” A simple request for the IRS position on this – do you access individuals’ emails without a warrant? – would not have indicated incidences of internal breaches of that policy; so ACLU sought ‘policies, procedures and practices,’ ‘violations’ of those, relevant ‘court opinions’ and more – and has now a received 247 page response that it has made public.
But the situation is no more clear than it was before. “So does the IRS always get a warrant?” asks the ACLU in a blog post yesterday. “Unfortunately, while the documents we have obtained do not answer this question point blank, they suggest otherwise.” Which is precisely why the organization issued the FoI in the first place.
The traditional approach under the Electronic Communications Privacy Act (ECPA), now widely considered outdated is that email older than 180 days, or has been opened, does not require a warrant. The IRS position, however, has historically been that a warrant is never required by the IRS because individuals have no expectation of privacy in their emails.
However, the Fourth Amendment protects against unreasonable searches by the government. In 2010 the Sixth Circuit Court of Appeals decided (US Vs Warshak) that the Fourth Amendment includes emails, and that the government must obtain a probable cause warrant before accessing stored private emails regardless of their age. But of course this technically only applied within the Sixth Circuit.
ACLU was seeking to determine whether the ruling had changed IRS policy, and whether it now seeks a warrant everywhere. “The key question our FOIA request seeks to answer,” says ACLU, “is whether the IRS’s policy changed after Warshak, which should have put the agency on notice that the Fourth Amendment does in fact protect the contents of emails.” So, does the IRS now seek a warrant to search emails?
There’s no clear answer on this for emails stored for less than 180 days, but ACLU suspects that it does not seek a warrant unless the ISP refuses to hand over the emails. For older emails – the Warshak ruling states that all emails are protected by the Fourth Amendment – ACLU points out that, “The current version of the Internal Revenue Manual, available on the IRS website, continues to explain that no warrant is required for emails that are stored by an ISP for more than 180 days.” The concern is that, in practice, it still doesn’t automatically seek a warrant for newer emails either.