The Pyramidal Structure Governing Access of User Data by Law Enforcement Agencies

C. The Stored Communications Act

As the government has acknowledged in this litigation, “[t]he SCA was enacted to extend to electronic records privacy protections analogous to those provided by the Fourth Amendment.” Gov’t Br. at 29 (citing S. Comm. on Judiciary, Electronic Communications Privacy Act of 1986, S. Rep. No. 99‐541, at 5 (1986)). The SCA provides privacy protection for users of two types of electronic services—electronic communication services (“ECS”) and remote computing services (“RCS”)—then probably more distinguishable than now.[13] See Orin S. Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208, 1213–14 (2004).  An ECS generally operated by providing the user access to a central computer system through which to send electronic messages over telephone lines. S. Rep. No. 99‐541, at 8.  If the intended recipient also subscribed to the service, the provider temporarily stored the message in the recipient’s electronic “mail box” until the recipient “call[ed] the company to retrieve its mail.” Id. If the intended recipient was not a subscriber, the service provider could print the communication on paper and complete delivery by postal service or courier. Id.; U.S. Congress, Office of Technology Assessment, OTA‐CIT‐293, Federal Government Information Technology: Electronic Surveillance and Civil Liberties 47–48 (1985).[14] An RCS generally operated either by providing customers with access to computer processing facilities in a “time‐sharing arrangement,” or by directly processing data that a customer transmitted electronically to the provider by means of electronic communications, and transmitting back the requested results of particular operations.  S. Rep. No. 99‐541, at 10–11.  We will refer to Microsoft and other providers of ECS and RCS jointly as “service providers,” except where the distinction makes a difference.

As to both services, the Act imposes general obligations of non‐disclosure on service providers and creates several exceptions to those obligations.  Thus, its initial provision, § 2701, prohibits unauthorized third parties from, among other things, obtaining or altering electronic communications stored by an ECS, and imposes criminal penalties for its violation.  Section 2702 restricts the circumstances in which service providers may disclose information associated with and contents of stored communications to listed exceptions, such as with the consent of the originator or upon notice to the intended recipient, or pursuant to § 2703.  Section 2703 then establishes conditions under which the government may require a service provider to disclose the contents of stored communications and related obligations to notify a customer whose material has been accessed. Section 2707 authorizes civil actions by entities aggrieved by violations of the Act, and makes “good faith reliance” on a court warrant or order “a complete defense.”  18 U.S.C. § 2707(e).[15]

Regarding governmental access in particular, § 2703 sets up a pyramidal structure governing conditions under which service providers must disclose stored communications to the government.  Basic subscriber and transactional information can be obtained simply with an administrative subpoena.[16] 18 U.S.C. § 2703(c)(2). Other non‐content records can be obtained by a court order (a “§ 2703(d) order”), which may be issued only upon a statement of “specific and articulable facts showing . . . reasonable grounds to believe that the contents or records . . . are relevant and material to an ongoing criminal investigation.”  § 2703(c)(2), (d).  The government may also obtain some user content with an administrative subpoena or a § 2703(d) order, but only if notice is provided to the service provider’s subscriber or customer. § 2703(b)(1)(B).  To obtain “priority stored communications” (our phrase), as described below, the Act generally requires that the government first secure a warrant that has been issued “using the procedures described in the Federal Rules of Criminal Procedure,” or using State warrant procedures, both of which require a showing of probable cause. [17] Priority stored communications fall into two categories: For electronic communications stored recently (that is, for less than 180 days) by an ECS, the government must obtain a warrant.  § 2703(a).  For older electronic communications and those held by an RCS, a warrant is also required, unless the Government is willing to provide notice to the subscriber or customer.  § 2703(b)(1)(A).

As noted, § 2703 calls for those warrants issued under its purview by federal courts to be “issued using the procedures described in the Federal Rules of Criminal Procedure.” Rule 41 of the Federal Rules of Criminal Procedure, entitled “Search and Seizure,” addresses federal warrants.  It directs “the magistrate judge or a judge of a state court of record” to issue the warrant to “an officer authorized to execute it.” Rule 41(e)(1).  And insofar as territorial reach is concerned, Rule 41(b) describes the extent of the power of various authorities (primarily United States magistrate judges) to issue warrants with respect to persons or property located within a particular federal judicial district.  It also allows magistrate judges to issue warrants that may be executed outside of the issuing district, but within another district of the United States.  Fed. R. Crim. P. 41(b)(2), (b)(3).  Rule 41(b)(5) generally restricts the geographical reach of a warrant’s execution, if not in another federal district, to “a United States territory,  possession, or commonwealth,” and various diplomatic or consular missions of the United States or diplomatic residences of the United States located in a foreign state.

[13] See 18 U.S.C. § 2510(15) (in ECPA Title I, defining “electronic communications service” as “any service which provides to users thereof the ability to send or receive wire or electronic communications”); § 2711(2) (in ECPA Title II, the SCA, defining “remote computing service” as “the provision to the public of computer storage or processing services by means of an electronic communications system”).

[14] For example, in 1984, Federal Express entered the e‐mail market with a service that provided for two‐hour delivery of facsimile copies of e‐mail messages up to five pages in length.  U.S. Congress, Office of Technology Assessment, Electronic Surveillance and Civil Liberties, at 47.

[15] Other provisions of the Act address, among other things, preservation of backup data (§ 2704); delaying notice to a customer whose information has been accessed (§ 2705); cost reimbursement for assembling data demanded under the Act (§ 2706); and exclusivity of remedies that the Act provides to a person aggrieved by its violation (§ 2708).

[16] An “administrative subpoena” is “a subpoena issued by an administrative agency to compel an individual to provide information to the agency.”  Administrative subpoena, Black’s Law Dictionary (10th ed. 2014). To obtain such a subpoena, the government need not demonstrate probable cause.  See EEOC v. United Parcel Serv., Inc., 587 F.3d 136, 139‐40 (2d Cir. 2009).

[17] Thus, § 2703, “Required disclosure of customer communications or records,” provides in part as follows:

(a) Contents of wire or electronic communications in electronic storage.―A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction.    A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communication system for more than one hundred and eighty days by the means available under subsection (b) of this section.

(b) Contents of wire or electronic communications in a remote computing service.—(1) A governmental entity may require a provider of remote computing service to disclose the contents of any wire or electronic communication to which this paragraph is made applicable by paragraph (2) of this subsection—

(A) without required notice to the subscriber or customer, if the governmental entity obtains a warrant issued using the procedures described in the Federal Rules of Criminal Procedure (or, in the case of a State court, issued using State warrant procedures) by a court of competent jurisdiction; or

(B) with prior notice from the governmental entity to the subscriber or customer if the governmental entity—

(i) uses an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena; or

(ii) obtains a court order for such disclosure under subsection (d) of this section; except that delayed notice may be given pursuant to section 2705 of this title. . . .

(g) Presence of officer not required.‐‐Notwithstanding section 3105 of this title, the presence of an officer shall not be required for service or execution of a search warrant issued in accordance with this chapter requiring disclosure by a provider of electronic communications service or remote computing service of the contents of communications or records or other information pertaining to a subscriber to or customer of such service.