It is conducted by the Electronic Communications Privacy Act (ECPA) and the Patriot Act, but the ECPA originally set up protections (such as a warrant requirement) to protect email, those protections have been weakened in many instances by the Patriot Act. It reduce their status as a protected communication in 180 days, then the email can be access by simple subpoena.