Level of
Authority

Legal Process

Covers

Potentially Applicable Federal Law

Lowest

Voluntary Disclosure / Consent [SSM]

Victim "may voluntarily disclose contents of internal emails relevant to the attack" [Tracking a Computer Hacker]

"Voluntary Disclosure by a provider whose services are available to the public is forbidden unless certain exceptions apply. These exceptions include disclosures 'incident to the rendition of the service or the protection of the rights of property of the provider of the service." [Tracking a Computer Hacker]

Access to everything

18 U.S.C. § 2802(b)

18 U.S.C. § 2702(b)(5)

Historical

Lowest

Retention Letter

Requires ISP "to preserve the records while a court order or other process is being obtained." [Tracking a Computer Hacker]

18 U.S.C. § 2703(f)

Subpoena [SSM Appendix E]

Unopened email older than 180 days

Subpoena

Basic subscriber information - "can be used to obtain basic subscriber info from an ISP, including 'the name, address, local and long distance telephone toll billing records, telephone number or other subscriber number or identity and length of service of a sub to or customer of such service and the type of service the sub or customer utilized." [Tracking a Computer Hacker]

18 U.S.C. § 2703(c)(1)(C)

Subpoena

"used to obtain opened emails [and files[SSM]], but only under certain conditions relating to notice to the subscriber. Notice may be delayed under Section 2705 for successive 90-day periods. Subpoenas may be issued for emails that have been opened, but a search warrant is generally needed for unopened emails." [Tracking a Computer Hacker]

18 U.S.C. § 2703(b)(1)(B)

Order to retain records Backups

§ 2703(d) Court Order

Transactional records - "for account logs and transactional records. Such orders are available if the agent can provide 'articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation." [Tracking a Computer Hacker]

18 U.S.C. § 2703(d)

§ 2073(d) Court Order

"Full contents of a subscriber's account (except for unopened email stored with an ISP for 180 days or less and voice-mail), of the order complies with a notice provision in the statute. Notice to the subscriber can be delayed for up to ninety days when notice would seriously jeopardize the investigation." [Tracking a Computer Hacker] 18 U.S.C. § 2705(a).

18 U.S.C. § 2703(b)(1)(B)(ii) and (b)(2)

Highest

Search Warrant [SSM Appendix F]

"can be used to obtain the full contents of an account [including unopened email [SSM]], except for voice-mail in electronic storage (which requires a Title III order). The ECPA does not require notification to the subscriber when the government obtains information from a provider using a search warrant." [Tracking a Computer Hacker]

Rule 41 of the Federal Rules of Criminal Procedure or state equivalent

Real Time

Lowest

Pen Register, Trap and Trace Orders

Real time traffic data interception ("collection of addressing information for wire and electronic communication")

18 U.S.C. § 3121-27

Highest

Title III Order

Real time content interception (actual content of communication), access to voice-mail in electronic storage.

18 U.S.C. § 2510-22, Wiretap Statute

Mechanisms to Compel Disclosure

Acquisition in real time

Historical information

Contents of Communications

Title III order or consent generally

Warrant (for unopened email) or consent

Subpoena with notice (for files, opened email) or consent; may delay notice

Other records (subscriber and transactional data)

Pen register / trap and trace order or consent

Subpoena (for basic subscriber info only) consent

18 U.S.C. § 2703(d) specific and articulable facts" court order (for all other non content records), consent