Title II: Stored Communications Act

ECPA Title I: The Wiretap Act deals with communications that are in transit (which can be intercepted); the Stored Communications Act deals with communications that have been received and are in storage. The two frequently get confused and it all gets muddled quickly. The relationship of Wiretap Act to the Stored Communications Act has been described as "complex, often convoluted." [Councilman 80 1st Cir. 2005] [Smith 1055 9th Cir. 1998]

The Wiretap Act and the Stored Communications Act are not mutually exclusive remedies. [Councilman 82 1st Cir. 2005 " In general, if two statutes cover the same conduct, the government may charge a violation of either."] [Herring 788 n. 4 11th Cir. 1993 ("The overlapping coverage of the Wiretap Act and the Communications Act [of 1934] presents no problem. In such a case, the prosecution has the right to select the statute under which the indictment will be brought.")

What exactly are “stored communications”? Does this refer to the store and forward nature of the Internet? Does email that has received a subscriber’s system but is not opened fall under this? What about after the email has been opened? Generally, if its an interception, it will fall under ECPA; but if it is Stored Communications, it falls under the Stored Communications Act and the rules below.

“Stored communications” is defined at 18 U.S.C. § 2510(17).

(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and
(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.

"Transient electronic storage that is intrinsic to the communication process for such communications" is "electronic communications," not stored communications. [Councilman 2005][Blumofe 21 ] [Hall 503 n. 1]

• An email
  • in transit accross the network is an email during transmission. [Councilman 79 1st 2005]

  • in termporary storage on an email server awaiting download by a subscriber is a “stored communication.” [Councilman Slip 31 2005 ("The first category, which is relevant here, refers to temporary storage, such as when a message sits in an e-mail user's mailbox after transmission but before the user has retrieved the message from the mail server.")] [Fraser 113 3rd Cir. 2003] [Steve Jackson 461]

  • left on a public email service provider service means the service is now a Remote Computer Service. "The role of LocalISP has changed from a transmitter of Joe's email to a storage facility for a file stored remotely for Jane by a provider of RCS." [Search Seizure 2009 p 126]
    • Webmail that remains on the service provider computer might be stored. [Fischer]

    • Email left on a private network email server (like a company email server) - the private email server is neither a remote computer service nor an electronic communications service (not a public service). [Search Seizure 2009 p 126]
  • Download and stored on recipients computer - recipient is not an RCS or an ECS and thus Stored Communications Act does not apply. Access to files on an individual's computer is governed by 4th Amendment. [Fraser]
• Voice mail can be stored communication – but this provision sunsets December 31, 2005. [Smith] [Councilman 2005]
• A cookie is not “stored communications.” [Doubleclick 511-12] [Chance] [Intuit] But See [Kerr p. 8 n 44 (2004) (stating that these courts applied SCA to cookies)]

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ (2009)

Unfortunately, as a result of the Ninth Circuit's decision in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004), there is now a split between two interpretations of "electronic storage"-a traditional narrow interpretation and an expansive interpretation supplied by the Ninth Circuit. Both interpretations are discussed below. As a practical matter, federal law enforcement within the Ninth Circuit is bound by the Ninth Circuit's decision in Theofel, but law enforcement elsewhere may continue to apply the traditional interpretation of "electronic storage."

As traditionally understood, "electronic storage" refers only to temporary storage made in the course of transmission by a service provider and to backups of such intermediate communications made by the service provider to ensure system integrity. It does not include post-transmission storage of communications. For example, email that has been received by a recipient's service provider but has not yet been accessed by the recipient is in "electronic storage." See Steve Jackson Games, Inc. v. United States Secret Service, 36 F.3d 457, 461 (5th Cir. 1994). At that stage, the communication is stored as a temporary and intermediate measure pending the recipient's retrieval of the communication from the service provider. Once the recipient retrieves the email, however, the communication reaches its final destination. If the recipient chooses to retain a copy of the accessed communication, the copy will not be in "temporary, intermediate storage" and is not stored incident to transmission. See Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 114 (3d Cir. 2004) (stating that email in post-transmission storage was not in "temporary, intermediate storage"). By the same reasoning, if the sender of an email maintains a copy of the sent email, the copy will not be in "electronic storage." Messages posted to an electronic "bulletin board" or similar service are also not in "electronic storage" because the website on which they are posted is the final destination for the information. See Snow v. DirecTV, Inc., 2005 WL 1226158, at *3 (M.D. Fla. May 9, 2005), adopted by 2005 WL 1266435 (M.D. Fla. May 27, 2005), aff'd on other grounds, 450 F.3d 1314 (11th Cir. 2006).

Furthermore, the "backup" component of the definition of "electronic storage" refers to copies made by an ISP to ensure system integrity. As one district court explained, the backup component "protects the communication in the event the system crashes before transmission is complete. The phrase 'for purposes of backup protection of such communication' in the statutory definition makes clear that messages that are in post-transmission storage, after transmission is complete, are not covered by part (B) of the definition of 'electronic storage.'" Fraser v. Nationwide Mut. Ins. Co., 135 F. Supp. 2d 623, 636 (E.D. Pa. 2001), aff'd in part on other grounds 352 F.3d 107, 114 (3d Cir. 2004) (affirming the SCA portion of the district court's ruling on other grounds); see also United States v. Weaver, 2009 WL 2163478, at *4 (C.D. Ill. July 15, 2009) (interpreting "electronic storage" to exclude previously sent email stored by web-based email service provider); In re Doubleclick Inc. Privacy Litigation, 154 F. Supp. 2d 497, 511-13 (S.D.N.Y. 2001) (emphasizing that "electronic storage" should have a narrow interpretation based on statutory language and legislative intent and holding that cookies fall outside of the definition of "electronic storage" because of their "long-term residence on plaintiffs' hard drives"); H.R. Rep. No. 99-647, at 65 (1986) (noting congressional intent that opened email left on a provider's system be covered by provisions of the SCA relating to remote computing services, rather than provisions relating to communications in "electronic storage").

This narrow interpretation of "electronic storage" was rejected by the Ninth Circuit in Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004), in which the court held that email messages were in "electronic storage" regardless of whether they had been previously accessed, because it concluded that retrieved email fell within the backup portion of the definition of "electronic storage." Id. at 1075-77. Although the Ninth Circuit did not dispute that previously accessed email was not in temporary, intermediate storage within the meaning of § 2510(17)(A), it insisted that a previously accessed email message fell within the scope of the "backup" portion of the definition of "electronic storage," because such a message "functions as a 'backup' for the user." Id. at 1075. However, CCIPS has consistently argued that the Ninth Circuit's broad interpretation of the "backup" portion of the definition of "electronic storage" should be rejected. There is no way for a service provider to determine whether a previously opened email on its servers is a backup for a copy of the email stored by a user on his computer, as the service provider simply cannot know whether the underlying email remains stored on the user's computer. Essentially, the Ninth Circuit's reasoning in Theofel confuses "backup protection" with ordinary storage of a file.

Although prosecutors within the Ninth Circuit are bound by Theofel, law enforcement elsewhere may continue to apply the traditional narrow interpretation of "electronic storage," even when the data sought is within the Ninth Circuit. Recent lower court decisions addressing the scope of "electronic storage" have split between the traditional interpretation and the Theofel approach. Compare United States v. Weaver, 2009 WL 2163478, at *4 (C.D. Ill. July 15, 2009) (rejecting Theofel), and Bansal v. Russ, 513 F. Supp. 2d 264, 276 (E.D. Pa. 2007) (holding that access to opened email in account held by non-public service provider did not violate the SCA), with Bailey v. Bailey, 2008 WL 324156, at *6 (E.D. Mich. Feb. 6, 2008) (endorsing Theofel), and Cardinal Health 414, Inc. v. Adams, 482 F. Supp. 2d 967, 976 n.2 (M.D. Tenn. 2008) (same). Prosecutors confronted with Theofel-related issues should consult CCIPS [] for further assistance.

Rule by Exception:

Exceptions

Like ECPA, the SCA is a rule governed by exceptions.

• Consent
• As necessarily incident to the rendition of service
• The protection of the rights of property or service
• To the National Center for Missing and Exploited Children. See CPPA
• Emergencies
• Law Enforcment:

Like ECPA, the big exceptions deal with when The Man can get access to Stored Communications.

• For electronic communications that has been stored, but not opened, for less than 181 days, the government must first obtain a warrant to obtain those messages. 18 U.S.C. § 2703(a).
• If the electronic communications has been opened (or for other stored files), the government may send the ISP a subpoena with notice to the subscriber in advance of the search. 18 U.S.C. § 2703(a) & (b).
• If the electronic communications is held by a remote communications service provider on behalf of a subscriber or customer of the remote computing service, the law enforcement official may obtain access to the stored communications
  • Without notice to the subscriber with a court issued warrant; 18 U.S.C. § 2703(b)(1)(A).
  • With notice to the subscriber with a subpoena or a 2703(d) court order. 18 U.S.C. § 2703(b)(1)(B).

See also 18 U.S.C. § 2704 Backup Preservation for 18 U.S.C. § 2703(b)(2) electronic communications disclosure. But see the Federal Records Acts, requiring certain government email to be stored at the National Archives and made publicly available.

Compare Warshak (6th Cir) (requiring warrant for access to email)

Notice: Generally notice must be given to the subscriber or customer whose communication is being intercepted. 18 U.S.C. § 2703(b)(1). In certain situations, such as endangerment to life or public safety, risk of flight from persecution, destruction of or tampering with evidence, or intimidation of witnesses, the government can delay notice to the subscriber for 90 days. 18 U.S.C. § 2705(a). Delayed notice is permitted where there is "execution of a written certification of a supervisory official that there is reason to believe that notification of the existence of the subpoena may have an adverse result." 18 U.S.C. § 2705(a). [Villegas] At the end of the delayed period, notice must be provided to the individual. 18 U.S.C. § 2705(a)(5).

Sec. 2703(d) Order: An officer may seek to obtain information using a higher Section 2703(d) order. In this situation, an officer generally with have authority to obtain information to the same degree as a subpoena. If the officer seeks delayed notice, the legal standard is similar. The difference is that the representation is made to a court as opposed to a supervisory official. 18 U.S.C. § 2705(a)(1)(A), 18 U.S.C. § 2705(a)(2). [Compare Warshak (6th Cir) (requiring warrant for access to email)]

Geographic Scope: Previously, a search warrant could only compel the disclosure of content within the district of the issuing court. As the Internet constitutes the death of distance and geographic distinctions, legal authority only good locally was a bit of a problem, obligating law enforcement officers to apply again and again in different jurisdictions to get after the same email. The Patriot Act rectified this problem for law enforcement officers by making search warrants nationwide in reach. In other words, the authority of a federal court in Massachusetts is valid for an ISP in Arizona. 18 U.S.C. § 2703(a); 2711(3). This provision sunsets on December 31, 2005.

Punishment

And what do we have as a parting gift for our contestants, Johnny? It's up to 5 years in the slammer and forking over a fine. See also ECPA Punishment and Recovery.

18 USC § 2701(b) Punishment.- The punishment for an offense under subsection (a) of this section is-

(1) if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain, or in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State-

(A) a fine under this title or imprisonment for not more than 5 years, or both, in the case of a first offense under this subparagraph; and

(B) a fine under this title or imprisonment for not more than 10 years, or both, for any subsequent offense under this subparagraph; and

(2) in any other case-

(A) a fine under this title or imprisonment for not more than 1 year or both, in the case of a first offense under this paragraph; and

(B) a fine under this title or imprisonment for not more than 5 years, or both, in the case of an offense under this subparagraph that occurs after a conviction of another offense under this section.

Parties aggreived by violations of either ECPA or SCA are afforded a private right of action pursuant to 18 USC § 2707

Papers

• Orin S. Kerr, A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It, 72 GEO. WASH. L. REV. 1208, 1220 (2004).

<< Emergencies << Previous | Next >> Trap & Trace >>