READY FOR REVIEW

The Stored Communications Act: The Ramifications of an Antique Privacy Law

-- By EdwardBontkowski - 26 Apr 2010

"Ways may some day be developed by which the Government, without removing papers from secret drawers, can reproduce them in court, and by which it will be enabled to expose to a jury the most intimate occurrences of the home."

--Justice Brandeis, Olmstead v. United States (dissent)

How the Stored Communication Act Works

In 1986, the Electronic Communications Privacy Act of 1986 (“ECPA”) was passed into law, touted by many at the time as providing significant protections for the privacy of online communication. One of the main components of the ECPA is the Stored Communications Act (“SCA”). The SCA addresses voluntary and compelled disclosure of “stored wire and electronic communications and transactional records” held by third-party internet service providers.

The SCA categorizes two types of online services—“electronic communication services” (“ECS”) and “remote computing services” (“RCS”). The difference between these two categories is somewhat subtle, but very determinative for a communication’s treatment under the statute (and also important in arguing why this statute is antiquated). Under the SCA an ECS is “…any service which provides to users thereof the ability to send or receive wire or electronic communications….” A RCS is defined as “…the provision to the public of computer storage or processing services by means of an electronic communications system." The SCA is a hyper-technical statute, but essentially it says that to compel disclosure from an ECS of an email that has been in storage for 180 days or less, the government must obtain a warrant (and thus must have probable cause). If the email has been in storage for more than 180 days, or the provider is a RCS, the government may obtain a search warrant, or, importantly, may get a subpoena or a “specific and articulable facts” court order to compel disclosure as long as notice is given to the person whose communications are being sought. Obviously, the subpoena and “specific and articulable facts” order require much less process than a search warrant and the notice requirement can be loopholed somewhat, and thus it is this area where privacy concerns are at their highest.

The Stored Communications Act: A 24-year-old Antique

To understand just how outdated the SCA really is, one must understand the communications technology that existed at the time and how these technological limitations guided the motivations behind the SCA. In 1986, email worked in a relatively simple and straightforward fashion (at least relative to today). Users would simply download email from their ISP’s server directly onto their home computers. Because of technological limitations, any email left on servers for more than 180 days was considered to be abandoned. Under Fourth Amendment abandonment doctrine, individuals lose protection over property they have abandoned. See United States v. Jones, 707 F.2d 1169, 1172 (10th Cir. 1983) (“When individuals voluntarily abandon property, they forfeit any expectation of privacy in it that they might have had.”) Some scholars have suggested that the SCA drafters attempted to reflect this abandonment doctrine in the SCA by incorporating this 180-day rule. Certainly, in the context of 1986 technology, this probably made a lot of sense. However, given the fact that 24 years is the technological equivalent of an eon, to continue to apply such an outdated law today is patently absurd. With today’s technology and the advent of “cloud computing,” the majority, if not all, of a user’s email is stored on Google’s, Yahoo!’s, etc. servers and not directly on their home computers.

The result is a law, initially designed to fill in the gaps that the Fourth Amendment could not reach (although below I contend the Fourth Amendment can, and should, reach those gaps), that essentially allows the government to obtain nearly all the emails of any person it wants without even needing a search warrant. The more society embraces advanced storage technologies, the more privacy it relinquishes—quite a perverse result. All but the most cynical can agree that such a result could not have possibly been the drafters’ intent.

Unsurprisingly, the government has recently attempted to push this outdated statute to its theoretical limits by claiming that opened emails that have been on Yahoo servers for less than 180 days do not require a warrant to be searched because they do not fall under the statutory definition of “electronic storage.”

How to Deal With the Stored Communications Act?

The question now is “what do we do with the SCA?” While various ideas have been tossed around concerning updating the language within the statute, changing definitions, etc, many question why we should even require the SCA anymore (or to begin with). At least with respect to stored email, it seems that the Fourth Amendment alone should require the government to obtain search warrants to compel disclosure. In Katz v. United States, the Court said Fourth Amendment protections apply where “a person [has] exhibited an actual (subjective) expectation of privacy…that society is prepared to recognize as [objectively] reasonable.” 389 U.S. 347, 360-61 (1967). At that time, society was prepared (as was the Supreme Court) to recognize as reasonable that telephone’s vital role as a communication medium necessitated Fourth Amendment protections. In applying the Fourth Amendment, the Supreme Court has continued to look at societal expectations, especially when scrutinizing new technologies. http://www.wired.com/images_blogs/threatlevel/2010/04/effetalbrief.pdf (citing Kyollo v. United States, 533 U.S. 27, 34 (2001) (recognizing that technological advances must not be allowed to erode society’s expectation in “that degree of privacy against government that existed when the Fourth Amendment was adopted”)).

It is clearly evident that in today’s society stored email plays as vital a role (and probably a more vital one) as the telephone did in 1967, and accordingly society’s expectations regarding the privacy of email are the same as they were for privacy of the telephone in 1967. Therefore, I believe it is time for courts to recognize that people have a reasonable expectation of privacy with respect to stored email.

This is a good capsule summary of the situation, with a peculiar set of conclusions. If, as you assert without anything better than the analogy with the telephone to support you, the Fourth Amendment itself should be the only legal standard for judging email searches, why isn't the rule the same one that attaches to other "important," "vital," or "critical" documents and information in the hands of unaffiliated third parties, namely that no warrant is necessary and the government can do what it needs or wants to do using subpoenas?

The statute was designed to provide more than the Fourth Amendment would provide, and it does so. People have responded to the blandishments of the world's largest intelligence service, however, and have decided to store all their personal communications forever on computers belonging to unaffiliated third parties who offer them "free" email services in return for being allowed to spy on their communications, and—oh so coincidentally—also rendering those communications easily subject to subpoena by government, which then begins eroding as much of the statute's remaining protections as they can.

A better solution is for everyone to have an extremely cheap, simple appliance that stores all their email in their homes and makes it accessible to them via their mobile devices everywhere. That email would then be reachable only by search warrant, both before delivery by any ECS storing and forwarding the mail for delivery, under ECPA, and at the residence, under the Fourth Amendment. The statute would do what it was intended to do, and everyone would be fine.

Of course, even without such an appliance, running a personal mail server is trivial for those with knowledge and even scant resources. And for everyone, without exception, Google Mail represents a loss of liberty that's far more expensive than the cost being saved by "free" service. But blaming ECPA for the peoples' bamboozlement and failure to protect their rights seems to me an odd outcome. I may well be wrong, but the arguments you would need to make in order to explain why aren't touched on here.

---

Hi Edward,

This is an area of particular interest to me. I share your general conclusion that the Fourth Amendment should not be the dead letter online that it is presently, and that if we could revive it that would be a preferable approach to new legislation. I wonder if you came across any particularly useful readings on the topic in your prep for this essay? I've encountered some (including for this course) but if you have a source in particular that you'd recommend I would be interested to hear it. Thanks.

-- BrianS - 04 May 2010

Brian,

I found Orin Kerr to be one of the foremost scholars on the SCA (and a lot of other technology law related things). He has several articles in various journals relating to the SCA. He also blogs on the Volokh Conspiracy website about this topic as well. His writing is quite excellent in my opinion.

-- EdwardBontkowski - 06 May 2010

Edward,

Great, thanks. I was able to pull several of Kerr's articles up online. I appreciate the suggestion.

-- BrianS - 06 May 2010

Professor Moglen,

Thank you very much for you comments. I am going to respond to them here if you will allow for it.

I entirely agree that there are far superior methods to ensure safety of stored email. After taking both your Law and the Internet Society class and this class, I am now familiar with the types of devices you have suggested people use (such as the one you described) in order to ensure their privacy. I agree that such devices would be superior methods to ensure privacy. However, I was trying address the most generally cognizable situation (and it is a sad situation) that most users of the internet currently find themselves in and analyze the law within that context. As much as I'd like to believe that society at large would adopt such devices as you have suggested en masse, I don't believe such a thing would occur in the near future. Given this, I've tried to point out what I believe are the shoratcomings in the SCA given what I feel is the most realistic trajectory of the internet within the next 5 years.

I will concede that resting my assertion on the simply analogy to the telephone was a bit simplistic, but due to word constraints I tried to give as fundamental an analogy as possible. There are many more nuances to the assertion, which I regrettably had to leave out.

-- EdwardBontkowski - 12 Oct 2010

Edward, that's not a response to my comments: that's a defense. To say that you had stronger arguments but left them out due to space constraints is not a way of improving your paper; it's just an effort to deflect criticism using weak exculpatory rhetoric. Nor have you responded to the point I consider to be most important: the statute you discuss is meant to exceed the levels of Fourth Amendment protection available when communications are stored by a third party. Relegating the people to Fourth Amendment protection deprives them rather than expanding their sphere of rights.

Your comment about private mail servers is not to the purpose either. Obviously one can usefully judge the plausibility of a technical expansion of peoples' rights, but in order to make a judgment such as the one you express above (which comes to "your technical solution is impracticable or unlikely, so I'm going to discuss a legal solution"), you have to judge the practicability and political likelihood of the legal fix, and compare the two. I'm not an idiot, and if I thought the technical solutions available for increasing peoples' freedom in this area were less accessible, as practicable social change starting from where we really are now, I wouldn't recommend them. There are many sound reasons for disagreeing with my conclusions, of course, but you have to encounter the issues, not assume them away.

I do think you can make this essay much stronger. But the way we make writing stronger isn't by successfully litigating against the editor.

To restrict access to your paper simply delete the "#" on the next line:

# * Set ALLOWTOPICVIEW = TWikiAdminGroup, EdwardBontkowski