ECPA: Law Enforcement:
Subscriber Info

Basic Subscriber Information

The government can compel disclosure of subscriber records with a warrant, a 2703(d) court order, consent of the subscriber, or a subpoena. 18 U.S.C. § 2703(c). Basic subscriber information includes

"According to the legislative history of the 1994 amendments to § 2703(c), the purpose of separating the basic subscriber information from other non-content records was to distinguish basic subscriber information from more revealing transactional information that could contain a "person's entire on-line profile." H.R. Rep. No. 103-827 (1994), reprinted in 1994 U.S.C.C.A.N. 3489, 3497, 3511." USDOJ Search & Seizure Manual.

(A) name;

(B) address;

(C) local and long distance telephone connection records, or records of session times and durations;

(D) length of service (including start date) and types of service utilized;

(E) telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address (temporarily assigned network addresses would include IP numbers); and

(F) means and source of payment for such service (including any credit card or bank account number).

18 U.S.C. § 2703(c)(2). Subscribe information does not cover transactional records such as addressing information of the end machine with which the user interacted during a session (in other words, the email address of a particular email). Law enforcement officers are not required to provide notice to the subscriber. 18 U.S.C. § 2703(c)(3).

See also FCC Customer Privacy Network Information (CPNI)

Exception Telemarketing Fraud: “One small category of information can be compelled under ECPA without a subpoena. When investigating telemarketing fraud, law enforcement may submit a written request to a service provider for the name, address, and place of business of a subscriber or customer engaged in telemarketing.” [USDOJ Search and Seizure Manual, Sec. III.D.] 18 U.S.C. § 2703(c)(1)(D).

See also SPAM

Sec. 2703(d) Orders

A law enforcement officer may apply for a Sec. 2703(d) Order with

specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation.

According to the House Report: "This section imposes an intermediate standard to protect on-line transactional records. It is a standard higher than a subpoena, but not a probable cause warrant. The intent of raising the standard for access to transactional data is to guard against "fishing expeditions" by law enforcement. Under the intermediate standard, the court must find, based on law enforcement's showing of facts, that there are specific and articulable grounds to believe that the records are relevant and material to an ongoing criminal investigation." H.R. Rep. No. 102-827, at 31 (1994), reprinted in 1994 U.S.C.C.A.N. 3489, 3511."

18 U.S.C. § 2703(d). [Search & Seizure Manual App. B] This is not a difficult standard [Maryland] however merely alleging that the facts exist, without setting them forth, is insufficient. [Kennedy] Having set forth those facts, the Court is not to do an independent investigation of them. [United States] [Fregoso] [Search & Seizure Manual Sec. IV.C.2.] The Sec. 2703(d) Order may be “issued by any federal magistrate, district court or equivalent state court judge. See 18 U.S.C. § 2703(d), 2711(3).”

“A court issuing an order pursuant to this section, on a motion made promptly by the service provider, may quash or modify such order, if the order or records requested are unusually voluminous in nature or compliance with such order otherwise would cause an undue burden on such provider.” 18 U.S.C. § 2703(d).

Geographic Scope: Sec. 2703(d) Orders issued by federal courts are effective nationwide; Orders issued by states courts are effective only within that state. 18 U.S.C. § 2703(d); 2711(3).

Preservation of Evidence

Normally service providers have no ongoing obligation to retain records. Many networks do not retain records as unnecessary or costly. Of course, for Dick Tracy’s hot on the trail of cyber-Prunefrace, the impermanent nature of the trail creates a bit of a problem. As a result, there are times that law enforcement officers, without a court order and without actually receiving the data, may request that data be preserved. According to 18 U.S.C. § 2703(f)

A provider of wire or electronic communication service or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.

Data must be preserved for 90 days (which can be extended for an additional 90 days). These requests do not apply prospectively (translation: the official can ask the service provider to retain records that it already has, but it cannot request the service provider retain records that it does not yet have). The form of the request is not specified and could come in the form of a telephone call, email, fax, or whatever. [Search & Seizure Manual App. C ] In order to actually receive the material, the government must still comply with the appropriate legal process.

See also Record Keeping.

Gag Rule: Where disclosure of the existence of the search or the seizure might cause a problem, the law enforcement officials can receive a court order requiring that the service provider not let loose lips sink the ship. According to 18 U.S.C. § 2705(b):

A governmental entity acting under section 2703, when it is not required to notify the subscriber or customer under section 2703(b)(1), or to the extent that it may delay such notice pursuant to subsection (a) of this section, may apply to a court for an order commanding a provider of electronic communications service or remote computing service to whom a warrant, subpoena, or court order is directed, for such period as the court deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order. The court shall enter such an order if it determines that there is reason to believe that notification of the existence of the warrant, subpoena, or court order will result in--

(1) endangering the life or physical safety of an individual;

(2) flight from prosecution;

(3) destruction of or tampering with evidence;

(4) intimidation of potential witnesses; or

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.

Last Updated: Jan 2004