The U.S. government isn’t allowed to wiretap American citizens without a warrant from a judge. But there are plenty of legal ways for law enforcement, from the local sheriff to the FBI, to snoop on the digital trails you create every day. Authorities can often obtain your emails and texts by going to Google or AT&T with a simple subpoena. Usually you won’t even be notified.The Senate last week took a step toward updating privacy protection for emails, but it’s likely the issue will be kicked to the next Congress. Meantime, here’s how police can track you without a warrant now:

Phone Records:





Who you called, when you called.

How They Can Get It





What The Law Says

Police can get phone records without a warrant thanks toSmith v. Maryland, a Supreme Court ruling in 1979, which found that the Constitution’s Fourth Amendment protection against unreasonable search and seizure doesn’t apply to a list of phone numbers. The New York Times reported last week that the New York’s police department “has quietly amassed a trove” of call records by routinely issuing subpoenas for them from phones that had been reported stolen. According to The Times, the records “could conceivably be used for any investigative purpose.”

Location Data: Your phone is a tracker. How They Get It Many cell phone carriers provide authorities with a phone’s location and may charge a fee for doing so. Cell towers track where your phone is at any moment; so can the GPS features in some smartphones. The major cell carriers, including Verizon and AT&T, responded to at least 1.3 million law enforcement requests for cell phone locations, text messages and other data in 2011. Internet service providers can also provide location data that tracks users via their computer’s IP address — a unique number assigned to each computer. What The Law Says: Many courts have ruled that police don’t need a warrant from a judge to get cell phone location data. They only have to show that, under the federal Electronic Communications Privacy Act (EPCA), the data contains “specific and articulable facts” related to an investigation — again, a lesser standard than probable cause.Delaware, Maryland and Oklahoma have proposed laws that would require police to obtain a warrant for location data; Gov. Jerry Brown of California, a Democrat, vetoed a similar bill in September. Last week, the Senate Judiciary Committee approved a bill championed by Sen. Patrick Leahy, D-Vt., to update the ECPA, but it would not change how location data is treated.

IP ADDRESSES: What computers you used. How They Get It: Google, Yahoo, Microsoft and other webmail providers accumulate massive amounts of data about our digital wanderings. A warrant is needed for access to some emails (see below), but not for the IP addresses of the computers used to log into your mail account or surf the Web. According to the American Civil Liberties Union, those records are kept for at least a year. What The Law Says: Police can thank U.S. v. Forrester, a case involving two men trying to set up a drug lab in California, for the ease of access. In the 2007 case, the government successfully argued that tracking IP addresses was no different than installing a device to track every telephone number dialed by a given phone (which is legal). Police only need a court to sign off on a subpoena certifying that the data they’re after is relevant to an investigation — the same standard as for cell phone records.

EMAILS: Messages you sent months ago. How They Get It: There’s a double standard when it comes to email, one of the most requested types of data. A warrant is needed to get recent emails, but law enforcement can obtain older ones with only a subpoena. Google says it received7,969 requests for data — including emails sent through its Gmail service — from U.S. law enforcement in the first half of 2012 alone. Other email providers have not made similar statistics available. What The Law Says: This is another area where the ECPA comes into play. The law gives greater protection to recent messages than older ones, using a 180-day cutoff. Only a subpoena is required for emails older than that; otherwise, a warrant is necessary. The Leahy bill would require a warrant to get all emails regardless of age.

EMAIL DRAFTS: Drafts are different. How They Get It: Communicating through draft emails, à la David Petreaus and Paula Broadwell, seems sneaky. But drafts are actually easier for investigators to get than recently sent emails because the law treats them differently. What The Law Says: The ECPA distinguishes between communications — emails, texts, etc. — and stored electronic data. Draft emails fall into the latter, which get less protection under the law. Authorities needs only a subpoena for them. The Leahy bill would change that by requiring a warrant to obtain them.

TEXT MESSAGES: As with emails, so with texts. How They Get It: Investigators need only a subpoena, not a warrant, to get text messages more than 180 days old from a cell provider — the same standard as emails. Many carriers charge authorities a fee to provide texts and other information. For texts, Sprint charges $30, for example, while Verizon charges $50. What The Law Says: The ECPA also applies to text messages, according to Hanni Fakhoury, a lawyer with the Electronic Frontier Foundation, which is why the rules are similar to those governing emails. But the ECPA doesn’t apply when it comes to actually reading texts on someone’s phone rather than getting them from a carrier. State courts havesplit on the issue. Ohio’s Supreme Court has ruled thatpolice need a warrant to view the contents of cell phones of people who’ve been arrested, including texts. But the California Supreme Court has said no warrant is needed. The U.S. Supreme Court in 2010 declined to clear up the matter.

CLOUD DATA: Documents, photos, and other stuff stored online. How They Get It: Authorities typically need only a subpoena to get data from Google Drive, Dropbox, SkyDrive, and other services that allow users to store data on their servers, or “in the cloud,” as it’s known. What The Law Says: The law treats cloud data the same as draft emails — authorities don’t need a warrant to get it. But files that you’ve shared with others — say, a collaboration using Google Docs — might require a warrant under the ECPA if it’s considered “communication” rather than stored data. “That’s a very hard rule to apply,” says Greg Nojeim, a senior counsel with the Center for Democracy & Technology. “It actually makes no sense for the way we communicate today.”