Cybertelecom Federal Internet Law & Policy An Educational Project

ECPA :: Non Content :: Subscriber Info

Congress passed the SCA in 1986 as part of the Electronic Communications Privacy Act. "The SCA was enacted because the advent of the Internet presented a host of potential privacy breaches that the Fourth Amendment does not address." Quon v. Arch Wireless Operating Co., 529 F.3d 892, 900 (9th Cir. 2008), rev'd on other grounds, 130 S. Ct. 2619 (2010) (citation omitted). To address these potential privacy breaches, the SCA "creates a set of Fourth Amendment-like privacy protections by statute, regulating the relationship between government investigators and service providers in possession of users' private information." Orin S. Kerr, A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It, 72 Geo. Wash. L. Rev. 1208, 1212 (2004). Specifically, the statute protects the privacy of electronic communications by (1) placing limits on the government's ability to compel network service providers to disclose information they posses about their customers and subscribers, 18 U.S.C. § 2703, and (2) restricting the ability of network service providers to voluntarily disclose information about their customers and subscribers to the government, 18 U.S.C. § 2702. Violation of these provisions may result in criminal or civil liability, unless one or both of the SCA's statutory immunity provisions applies. 18 U.S.C. §§ 2703(e), 2707(e).

[Sams, 9th Cir. 2013]. Beyond content in transmission and store content, there is non-content information including

basic subscriber information (phone number, address, name) and

transactional information (who called, when, how long).

The Supreme Court has rules that customers have no Fourth Amendment protection in transactional records. While there is not constitutional protection of this information, there is statutory protection; the Stored Communications Act covers it.

Basic Subscriber Information

Basic subscriber information includes

• (A) name;
• (B) address;
• (C) local and long distance telephone connection records, or records of session times and durations;
• (D) length of service (including start date) and types of service utilized;
• (E) telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address (temporarily assigned network addresses would include IP numbers); and
• (F) means and source of payment for such service (including any credit card or bank account number).

18 U.S.C. § 2703(c)(2). Subscribe information does not cover transactional records such as addressing information of the end machine with which the user interacted during a session (in other words, the email address of a particular email). Law enforcement officers are not required to provide notice to the subscriber. 18 U.S.C. § 2703(c)(3).

See also FCC Customer Privacy Network Information (CPNI)

From DOJ Search & Seizure manual:

"Common examples of "record[s] . . . pertaining to a subscriber" include transactional records, such as account logs that record account usage; cell-site data for cellular telephone calls; and email addresses of other individuals with whom the account holder has corresponded. See H.R. Rep. No. 103-827, at 10, 17, 31 (1994), reprinted in 1994 U.S.C.C.A.N. 3489, 3490, 3497, 3511. See also In re Application of United States, 509 F. Supp. 76, 80 (D. Mass. 2007) (historical cell-site information fall within scope of § 2703(c)(1)); United States v. Allen, 53 M.J. 402, 409 (C.A.A.F. 2000) (concluding that "a log identifying the date, time, user, and detailed internet address of sites accessed" by a user constituted "a record or other information pertaining to a subscriber or customer of such service" under the SCA); Hill v. MCI WorldCom Commc'ns, Inc., 120 F. Supp. 2d 1194, 1195-96 (S.D. Iowa 2000) (concluding that the "names, addresses, and phone numbers of parties . . . called" constituted "a record or other information pertaining to a subscriber or customer of such service," not contents, for a telephone account); Jessup-Morgan v. America Online, Inc., 20 F. Supp. 2d 1105, 1108 (E.D. Mich. 1998) (holding that a customer's identification information is a "record or other information pertaining to a subscriber" rather than contents). According to the legislative history of the 1994 amendments to § 2703(c), the purpose of separating the basic subscriber and session information from other non-content records was to distinguish basic subscriber and session information from more revealing transactional information that could contain a "person's entire on-line profile." H.R. Rep. No. 103-827, at 17, 31-32 (1994), reprinted in 1994 U.S.C.C.A.N. 3489, 3497, 3511-12." [Search & Seizure 2009 p 122]

Rule:

An ISP may disclose non-content information to anyone except the government. 18 U.S.C. § 2702(a)(3), (c)(5). [Jessup]

Exception: The government may obtain non-content information with

proper legal authority 18 U.S.C. § 2703(c).

a subpoena

a subpoena with prior notice

a 2703(d) order

a 2703(d) order with prior notice

a warrant

National Security Letter

consent of the subscriber. 18 U.S.C. § 2703(c)(1)(C). or

in the case ot Telemarking Fraud.

The government must identify itself to the ISP as “The Man.” In the McVeigh case, the government failed to identify itself to AOL as the government and failed to have either legal authority or consent of McVeigh.

Telemarketing Fraud: “One small category of information can be compelled under ECPA without a subpoena. When investigating telemarketing fraud, law enforcement may submit a written request to a service provider for the name, address, and place of business of a subscriber or customer engaged in telemarketing.” [USDOJ Search and Seizure Manual, Sec. III.D.] 18 U.S.C. § 2703(c)(1)(D).

Subpoena

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ, p 128 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)

"The SCA permits the government to compel disclosure of the basic subscriber and session information listed in 18 U.S.C. § 2703(c)(2) using a subpoena.

Agents can also use a subpoena to obtain information that is outside the scope of the SCA. The hypothetical email exchange between Jane and Joe discussed in Section C of this chapter provides a useful example: Good Company provided neither "remote computing service" nor "electronic communication service" with respect to the opened email on Good Company's server. Accordingly, § 2703 does not impose any requirements on its disclosure, and investigators can issue a subpoena compelling Good Company to divulge the communication just as they would if the SCA did not exist. Similarly, information relating or belonging to a person who is neither a "customer" nor a "subscriber" is not protected by the SCA and may be obtained using a subpoena according to the same rationale. Cf. Organizacion JD Ltda. v. United States Dep't of Justice, 124 F.3d 354, 359-61 (2d Cir. 1997) (discussing the scope of the word "customer" as used in the SCA).

The legal threshold for issuing a subpoena is low. See United States v. Morton Salt Co., 338 U.S. 632, 642-43 (1950). Investigators may obtain disclosure pursuant to § 2703(c)(2) using any federal or state grand jury or trial subpoena or an administrative subpoena authorized by a federal or state statute. See 18 U.S.C. § 2703(c)(2). For example, subpoenas authorized by the Inspector General Act may be used. See 5 U.S.C. app. 3 § 6(a)(4). Of course, evidence obtained in response to a federal grand jury subpoena must be protected from disclosure pursuant to Fed. R. Crim. P. 6(e). At least one court has held that a pre-trial discovery subpoena issued in a civil case pursuant to Fed. R. Civ. P. 45 is inadequate. See FTC v. Netscape Commc'ns Corp., 196 F.R.D. 559, 561 (N.D. Cal. 2000) (holding that civil discovery subpoena did not fall within the meaning of "trial subpoena").

BicycleLobby Incident 2014

Stop us if you've heard this one before. How many Daily News reporters does it take to not fact-check a story? — Bicycle Lobby (@BicycleLobby) July 22, 2014

To be fair, we don't reveal we're a parody account until the second line of our profile. pic.twitter.com/fnS8um2tgO — Bicycle Lobby (@BicycleLobby) July 22, 2014

Earlier today we hoisted two white flags to signal our complete surrender of the Brooklyn Bridge bicycle path to pedestrians. — Bicycle Lobby (@BicycleLobby) July 22, 2014

• District Attorney of the County of New York subpoena, with gag order, to Twitter
• NYC DA subpoenas Twitter over Parody @BicycleLobby account, Politico (Aug. 8, 2014) ("The Manhattan DA is asking for account information, contact information, IP addresses, email accounts, telephone numbers and all IP logs associated with the account, according to the document.". "The account — which satirizes the “power” of the bicycle lobby with over the top, tongue-in-cheek pronouncements — recently took credit for an incident where white flags were raised on the Brooklyn Bridge by unknown vandals in place of the usual American flags placed on the bridge.")
• Inquiry Seeks Twitter User in Brooklyn Bridge Flag Case New York Times AUG. 8, 2014 Continue reading the main storyShare This Page Share Tweet Email More ("“He’s claimed credit for the moon landing, for the faking of President Obama’s birth certificate, for the crash of the New York Times website,” Mr. Vaccaro said. “It should be transparently clear to anyone that this was a joke.”")
• Alissa Walker, NYC District Attorney Seriously Subpoenas Parody Bike Twitter Account GIZMODO Aug. 9, 2014 ("@BicycleLobby is quite (quite) obviously a parody account. They even say so in their Twitter bio, right after calling themselves "An all-powerful enterprise." The Twitter account itself was started in response to a comical comment made by anti-bike activist and Wall Street Journal editorial board member Dorothy Rabinowitz.")
• Erik Wemple, NY Daily News, Associated Press fall for parody group on Brooklyn Bridge flag story, Washington Post July 22, 2014 ("The current version (of the New York Daily News) of the story now reads, “A parody group, the Bicycle Lobby, joked that it hung the white flags to signal surrender of the bridge’s bicycle path to pedestrians.” Joked indeed: Have a look at the Bicycle Lobby’s Twitter feed; there’s nothing even slightly serious about it")
• Mysterious white flags appear atop Brooklyn Bridge, CNBC Jul 22, 2014 ("A parody Twitter account called @BicycleLobby joked on Tuesday that it hoisted the flags to signal "surrender of the Brooklyn Bridge bicycle path to pedestrians." ")
• See Aaron Mackey, Seth Schoen, Cindy Cohn, Unreliable Informant: IP Addresses, Digital Tips, and Police Raids, EFF Sept 2016 (offering best practices recommendations, like verifying your information before doing stuff like issuing subpoenas to OBVIOUS parody accounts)

Subpoena with Prior Notice to the Subscriber or Customer

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ, p 128 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)

Agents who obtain a subpoena and either give prior notice to the subscriber or comply with the delayed notice provisions of § 2705(a) may obtain:

1) everything that can be obtained using a subpoena without notice;

2) "the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days." 18 U.S.C. § 2703(a); and

3) "the contents of any wire or electronic communication" held by a provider of remote computing service "on behalf of . . . a subscriber or customer of such remote computing service."

18 U.S.C. § 2703(b)(1)(B)(i), § 2703(b)(2).

Outside the Ninth Circuit (which is now governed by Theofel), this third category will include opened and sent email. Agents outside of the Ninth Circuit can therefore obtain such email (and other stored electronic or wire communications in "electronic storage" more than 180 days) using a subpoena, provided they comply with the SCA's notice provisions. However, in light of Theofel, some service providers may be reluctant to produce opened or sent email less than 181 days old without a warrant. Prosecutors moving to compel compliance with a subpoena for such email should contact CCIPS [] for assistance. In the Ninth Circuit, agents can continue to subpoena communications that have been in "electronic storage" over 180 days.

Delayed Notice: The notice provisions can be satisfied by giving the customer or subscriber "prior notice" of the disclosure. See 18 U.S.C. § 2703(b)(1)(B). However, 18 U.S.C. § 2705(a)(1)(B) permits notice to be delayed for ninety days "upon the execution of a written certification of a supervisory official that there is reason to believe that notification of the existence of the subpoena may have an adverse result." 18 U.S.C. § 2705(a)(1)(B). Both "supervisory official" and "adverse result" are specifically defined terms for the purpose of delaying notice. See 18 U.S.C. § 2705(a)(2) (defining "adverse result"); 18 U.S.C. § 2705(a)(6) (defining "supervisory official"). This provision of the SCA provides a permissible way for the government to delay notice to the customer or subscriber when notice would jeopardize a pending investigation or endanger the life or physical safety of an individual. The government may extend the delay of notice for additional 90-day periods through additional certifications that meet the "adverse result" standard of section 2705(b). See 18 U.S.C. § 2705(a)(4). Upon expiration of the delayed notice period, the statute requires the government to send a copy of the request or process along with a letter explaining the delayed notice to the customer or subscriber. See 18 U.S.C. § 2705(a)(5).

Sec. 2703(d) Orders

"Agents who obtain a court order under 18 U.S.C. § 2703(d) may obtain:

1) anything that can be obtained using a subpoena without notice; and

2) all "record[s] or other information pertaining to a subscriber to or customer of such service (not including the contents of communications [held by providers of electronic communications service and remote computing service])." 18 U.S.C. § 2703(c)(1)." [Search & Seizure 2009 p 130]

Burden of Proof: A law enforcement officer may apply for a Sec. 2703(d) Order with

specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation.

18 U.S.C. § 2703(d). [Search & Seizure Manual App. B] [Search & Seizure 2009 p 130] This is not a difficult standard [Maryland] however merely alleging that the facts exist, without setting them forth, is insufficient. [Kennedy] Having set forth those facts, the Court is not to do an independent investigation of them. [United States] [Fregoso] [Perrine] [Search & Seizure Manual Sec. IV.C.2.] [Search & Seizure 2009 p 130]

Issuing Authority: The Sec. 2703(d) Order may be “issued by any federal magistrate, district court or equivalent state court judge. See 18 U.S.C. § 2703(d), 2711(3).” [Search & Seizure 2009 p 130]

“A court issuing an order pursuant to this section, on a motion made promptly by the service provider, may quash or modify such order, if the order or records requested are unusually voluminous in nature or compliance with such order otherwise would cause an undue burden on such provider.” 18 U.S.C. § 2703(d).

Geographic Scope: Sec. 2703(d) Orders issued by federal courts are effective nationwide; Orders issued by states courts are effective only within that state. 18 U.S.C. § 2703(d); 2711(3); 18 U.S.C. § 3127(2) (defining "court of competent jurisdiction").

2703(d) Order with Prior Notice to the Subscriber or Customer

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ, p 132 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)

Agents who obtain a court order under 18 U.S.C. § 2703(d), and either give prior notice to the subscriber or else comply with the delayed notice provisions of § 2705(a), may obtain:

1) everything that can be obtained using a § 2703(d) court order without notice;

2) "the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days," 18 U.S.C. § 2703(a); and

3) "the contents of any wire or electronic communication" held by a provider of remote computing service "on behalf of . . . a subscriber or customer of such remote computing service." 18 U.S.C. § 2703(b)(1)(B)(ii), § 2703(b)(2).

As a practical matter, except in the Ninth Circuit, this means that the government can use a 2703(d) order that complies with the prior notice provisions of § 2703(b)(1)(B) to obtain the full contents of a subscriber's account except unopened email and voicemail that have been in the account for 180 days or less. In the Ninth Circuit, which is governed by Theofel, agents can continue to use 2703(d) orders to obtain communications in "electronic storage" over 180 days. Following Theofel, some providers have resisted producing email content less than 181 days old in response to a 2703(d) order, even when the 2703(d) order is issued by a court outside the Ninth Circuit.

As an alternative to giving prior notice, law enforcement can obtain an order delaying notice for up to ninety days when notice would seriously jeopardize the investigation. See 18 U.S.C. § 2705(a). In such cases, prosecutors generally will obtain this order by including an appropriate request in the 2703(d) application and proposed order; sample language appears in Appendix B. Prosecutors may also apply to the court for extensions of the delay. See 18 U.S.C. § 2705(a)(4). The legal standards for obtaining a court order delaying notice mirror the standards for certified delayed notice by a supervisory official. See Section D.2., supra. The applicant must satisfy the court that "there is reason to believe that notification of the existence of the court order may . . . endanger[] the life or physical safety of an individual; [lead to] flight from prosecution; [lead to] destruction of or tampering with evidence; [lead to] intimidation of potential witnesses; or . . . otherwise seriously jeopardiz[e] an investigation or unduly delay[] a trial." 18 U.S.C. §§ 2705(a)(1)(A), 2705(a)(2). The applicant must satisfy this standard anew in every application for an extension of the delayed notice.

Search Warrant

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ, p 133 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)

Agents who obtain a search warrant under § 2703 may obtain:

1) everything that can be obtained using a § 2703(d) court order with notice; and

2) "the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less." 18 U.S.C. § 2703(a).

In other words, agents can obtain any content or non-content information pertaining to an account by obtaining a search warrant "issued using the procedures described in" Fed. R. Crim. P. 41. 18 U.S.C. § 2703(a).

Search warrants issued under § 2703 have several noteworthy procedural features.

Geographic Reach: First, although most search warrants obtained under Rule 41 are limited to "a search of property . . . within the district" of the authorizing magistrate judge, search warrants under § 2703 may be issued by a federal "court with jurisdiction over the offense under investigation," even for records held in another district. See United States v. Berkos, 543 F.3d 392, 396-98 (7th Cir. 2008); In re Search of Yahoo, Inc., 2007 WL 1539971, at *6 (D. Ariz. May 21, 2007); In Re Search Warrant, 2005 WL 3844032, at *5-6 (M.D. Fla. 2006) ("Congress intended 'jurisdiction' to mean something akin to territorial jurisdiction"). State courts may also issue warrants under § 2703, but the statute does not give these warrants effect outside the limits of the courts' territorial jurisdiction.

Second, obtaining a search warrant obviates the need to give notice to the subscriber. See 18 U.S.C. § 2703(b)(1)(A); Fed. R. Crim. P. 41(f )(1)(C).

Third, investigators ordinarily do not themselves search through the provider's computers in search of the materials described in the warrant. Instead, investigators serve the warrant on the provider as they would a subpoena, and the provider produces the material specified in the warrant. See 18 U.S.C. § 2703(g) (stating that the presence of an officer is not required for service or execution of a § 2703 warrant); United States v. Bach, 310 F.3d 1063, 1068 (8th Cir. 2002) (finding search of email by ISP without presence of law enforcement did not violate Fourth Amendment).

Fourth, a two-step process is often used to obtain the content of communications under a § 2703 warrant. First, the warrant directs the service provider to produce all email from within the specified account or accounts. Second, the warrant authorizes law enforcement to review the information produced to identify and copy information that falls within the scope of the particularized "items to be seized" under the warrant.

Otherwise, as a practical matter, § 2703 search warrants are obtained much like Rule 41 search warrants. As with a typical Rule 41 warrant, investigators must draft an affidavit and a proposed warrant that complies with Rule 41.

Preservation of Evidence

Normally service providers have no ongoing obligation to retain records. Many networks do not retain records as unnecessary or costly. Of course, for Dick Tracy’s hot on the trail of cyber-Prunefrace, the impermanent nature of the trail creates a bit of a problem. As a result, there are times that law enforcement officers, without a court order and without actually receiving the data, may request that data be preserved. According to 18 U.S.C. § 2703(f)

A provider of wire or electronic communication service or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.

Data must be preserved for 90 days (which can be extended for an additional 90 days). These requests do not apply prospectively (translation: the official can ask the service provider to retain records that it already has, but it cannot request the service provider retain records that it does not yet have). The form of the request is not specified and could come in the form of a telephone call, email, fax, or whatever. [Search & Seizure Manual App. C ] In order to actually receive the material, the government must still comply with the appropriate legal process.

See also Record Keeping.

Gag Rule:

Where disclosure of the existence of the search or the seizure might cause a problem, the law enforcement officials can receive a court order requiring that the service provider not let loose lips sink the ship. According to 18 U.S.C. § 2705 (b):

A governmental entity acting under section 2703, when it is not required to notify the subscriber or customer under section 2703(b)(1), or to the extent that it may delay such notice pursuant to subsection (a) of this section, may apply to a court for an order commanding a provider of electronic communications service or remote computing service to whom a warrant, subpoena, or court order is directed, for such period as the court deems appropriate, not to notify any other person of the existence of the warrant, subpoena, or court order. The court shall enter such an order if it determines that there is reason to believe that notification of the existence of the warrant, subpoena, or court order will result in--

(1) endangering the life or physical safety of an individual;

(2) flight from prosecution;

(3) destruction of or tampering with evidence;

(4) intimidation of potential witnesses; or

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ p 141 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)

This language permits agents to apply for a court order directing network service providers not to disclose the existence of legal process whenever the government itself has no legal duty to notify the customer or subscriber of the process. If the relevant process is a 2703(d) order or 2703 warrant, agents can simply include appropriate language in the application and proposed order or warrant. If agents instead seek to compel the disclosure of information using a subpoena, they must apply separately for this order.

Section 2703(d) Order, Example

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ, p 220 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)

Subpoena, Example

Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ, p 220 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)