Stored Communications Act

The U.S. Supreme Court on Oct. 16, 2017, announced it had granted the government’s petition for certiorari in United States v. Microsoft and will hear a case this Term that could have lasting implications for how technology companies interact with the U.S government and governments overseas. At issue is a consequential Second Circuit decision from last year that held that warrants issued under the Stored Communications Act (SCA) do not reach emails and other user data stored overseas by a U.S. provider.

While no federal appellate court besides the Second Circuit has squarely addressed the issue, multiple district courts outside the Second Circuit have declined to follow the Second Circuit’s reasoning in similar fact patterns involving other technology giants. The result is that U.S. law enforcement has different authority to access foreign-stored user data depending on where in the United States a warrant application is made. Google, for example, has expended significant resources to develop new tools to determine the geographic location of its users’ data so as to be in accord with the Second Circuit’s approach. Yet the company currently faces a hearing on sanctions for its alleged willful noncompliance with law enforcement requests in the Ninth Circuit based on a district court ruling that parted ways with the Second Circuit.

Continue Reading SCOTUS to Resolve Lower-Court Dispute Over U.S. Warrants Seeking Foreign-Stored User Data

2015 11 30 DJV NAT 218Facebook’s four-year battle on behalf of its users, seeking to quash 381 warrants obtained by the New York County District Attorney’s Office, has come to a close. The decision of the New York Court of Appeals—which is New York’s highest court—leaves Facebook users exposed to wide-ranging and largely unchecked inquiries by New York criminal prosecutors into their Facebook accounts.

The story begins in July 2013, when the New York Supreme Court—which is the trial court in New York—issued 381 warrants arising out of the district attorney’s (DA) application for warrants under the Stored Communications Act (SCA). The DA was investigating an alleged Social Security Disability fraud scheme.

The DA’s request was extraordinarily broad. The warrants functionally amounted to a request for 381 users’ entire Facebook histories. The warrants compelled Facebook to produce not only any and all text, photos or videos a user had shared with his or her limited universe of friends, but also any private messages exchanged between the user and another individual (who could have been a spouse, doctor, religious figure or attorney) as well as information the user had chosen to no longer share with anyone, such as a previous email address, a deleted friend or a hidden post, and information the user had never intended to share with anyone, such as his or her searches and location.

The warrants also compelled Facebook to produce content shared by users who were not named in the 381 warrants, and may not even have known anyone named in the 381 warrants, but who had the misfortune of posting on the timelines of those users uploading photos of those users, or simply belonging to any one of the groups with which a named user was affiliated. At least several of the affected users were high school students who were highly unlikely to have been involved in a Social Security Disability fraud scheme. The issuing court also expressly prohibited Facebook from disclosing the existence or execution of the warrants.

While Facebook receives many such requests from law enforcement each year and often provides information in response, Facebook strongly objected to the wide-ranging requests in this case.

Facebook moved to quash the warrants on the ground that they were overly broad, but the New York Supreme Court denied the motion, finding that Facebook did not have standing to assert any privacy or Fourth Amendment rights on behalf of its users. Facebook also challenged the nondisclosure provisions of the warrants, but again the court sided with the DA, reasoning that disclosure of the warrants could jeopardize the DA’s ongoing investigation.

The intermediate appellate court dismissed Facebook’s appeal. The court explained that the orders from the lower court denying Facebook’s motion to quash were unappealable because, under New York law, there is no authority permitting review of interlocutory orders issued in criminal proceedings.

Facebook took the fight all the way to the New York Court of Appeals. Facebook argued that an order denying a motion to quash an SCA warrant should be treated like an appealable order denying a motion to quash a subpoena, rather than like an unappealable order denying a motion to quash a traditional warrant. While a traditional search warrant authorizes law enforcement officials to enter, search and seize property, an SCA warrant, like a subpoena, requires the target of the warrant to compile and turn over its own digital data.

On April 4, 2017, Facebook lost that fight when New York’s highest court ruled that it does not have authority to hear appeals from motions to quash search warrants issued under the SCA.

In a 5-1 decision, the Court of Appeals concluded that, despite the similarities between the manner of responding to SCA warrants and the manner of responding to subpoenas, an SCA warrant is a warrant, not a subpoena. As with traditional warrants, SCA warrants are only issued in criminal proceedings to a government entity that has supported its request for a warrant with probable cause. The court explained that the difference between execution of traditional warrants and SCA warrants is due to “the nature of the material sought”—it “ensures efficiency and minimizes intrusion” for a service provider to search and compile its own digital information rather than for law enforcement to conduct the search. Accordingly, the Court of Appeals found that the order denying Facebook’s motion to quash was not appealable.

Further, the Court of Appeals suggested that Facebook may not have had a right to bring a motion to quash in the first place. For purposes of this case, the Court of Appeals assumed, without deciding, that a motion to quash an SCA warrant was proper. However, the court noted that the SCA discusses warrants, subpoenas and court orders requiring disclosure of information separately, and only expressly provides for a motion to quash court orders.

The Court of Appeals did express some sympathy for Facebook’s concerns regarding the privacy of its users. At the outset, the court stated that “[t]his case undoubtedly implicates novel and important substantive issues regarding the constitutional rights of privacy and freedom from unreasonable search and seizures,” and that it was “tempting for the court to address those issues.” The court also noted that “Facebook’s concerns, as a third party, about overbroad SCA warrants may not be baseless.”

Notwithstanding its expressed concerns, and over a strenuous dissent from Judge Wilson, the New York Court of Appeals has provided criminal prosecutors wide-ranging investigative powers without providing Internet service providers an ability to obtain appellate review. With New York’s high court having spoken, the online industry’s focus is likely to shift toward a legislative fix that will promote users’ privacy interests and limit overreaching SCA warrants.

*        *       *

For other Socially Aware posts addressing user data and the Stored Communications Act, please see the following: Google Ordered to Comply with Warrant for Foreign-Stored User Data; Second Circuit: Email Stored Outside the U.S. Might Be Beyond Government’s Reach; and We’ve Come for Your Tweets: Twitter to Appeal Denial of Its Motion To Quash District Attorney’s Subpoena.

 

GettyImages-520390753-600pxThe U.S. Department of Justice (DOJ) recently secured a notable victory against Google in a dispute over the enforceability of a U.S. search warrant seeking access to foreign-stored account data.

The April 19 ruling—from Magistrate Judge Beeler in the U.S. District Court for the Northern District of California—is the latest sign that DOJ is continuing to rely on the Stored Communication Act (SCA) to seek overseas account data even after the Department’s high profile defeat in the Second Circuit’s ruling in the Microsoft case.

And the opinion suggests that DOJ’s litigation strategy may be working.

The dispute arose after DOJ obtained a search warrant last year under the SCA directing Google to provide information related to specified Google user accounts. Google withheld some of the requested information and challenged the request. Google explained that it relies on algorithms to move user data around the world automatically to aid in network efficiency. Invoking the Second Circuit’s Microsoft ruling, which rejected DOJ’s efforts to obtain content stored on Microsoft servers in Ireland, Google argued that some of the requested data was stored exclusively overseas and therefore beyond the purview of an SCA warrant. Continue Reading Court Orders Google to Turn Over Foreign-Stored Data

Gradient and transparent effect used.

In a major development for cloud and other data storage providers, and further complicating the legal landscape for the cross-border handling of data, a Federal Magistrate Judge in the Eastern District of Pennsylvania ruled for the Department of Justice and ordered Google, Inc., to comply with two search warrants for foreign-stored user data. The order was issued on February 3, 2017 pursuant to the Stored Communications Act, (SCA), and the reasoning of the Court rested heavily on the court’s statutory analysis of the SCA. The ruling is a marked departure from a recent, high-profile Second Circuit decision holding that Microsoft could refuse to comply with a similar court order for user data stored overseas.

The SCA regulates how service providers like Google and Microsoft who store user data can disclose user information. The Magistrate Judge issued two warrants under the SCA for emails sent from Google users in the United States to recipients in the United States. Google refused to fully comply, invoking Microsoft, and the Government moved to compel. In its briefing, Google argued that the SCA can only reach data stored in the United States and that, because Google constantly shuffles “shards” of incomplete user data between its servers across the world, Google could never know for certain what information is stored domestically and what is stored overseas. Therefore, Google argued, the data sought under the warrants was beyond the reach of the SCA. Continue Reading Google Ordered to Comply with Warrant for Foreign-Stored User Data

Abstract futuristic blurred background with envelope symbols (fast mail and modern communication concept)

As a result of the Second Circuit’s recent opinion in Microsoft v. United States, the U.S. government likely can no longer use warrants issued pursuant to the Stored Communications Act (“SCA”) to compel U.S.-based companies to produce communications, such as emails, that are stored in a physical location outside of the United States—at least for now. Instead, the government will likely need to rely on Mutual Legal Assistance Treaties, which provide a framework for states to, among other things, provide assistance to one another to obtain and execute search warrants in their respective jurisdictions.

Nevertheless, it is likely that the U.S. government will seek an alternative, which could include appealing the case to the Second Circuit en banc or pursuing legislation in Congress to amend and update the SCA in light of new digital realities.

Background on the SCA and the Microsoft Dispute

The SCA, which limits service providers’ disclosure of the user data they store, provides that a service provider may disclose to the government certain information, such as the stored contents of a customer’s emails, only if the government first obtains a warrant requiring the disclosure. Microsoft v. United States arose out of Microsoft’s dispute over the scope of one such warrant, which sought information about an email account that Microsoft determined was hosted in Dublin.

Microsoft moved to quash the warrant with respect to the actual emails in the account on the grounds that the SCA does not authorize a search and seizure outside of the territory of the United States, which is where the emails were stored.

Continue Reading Second Circuit: Email Stored Outside the U.S. Might Be Beyond Government’s Reach