READY FOR REVIEW

The Stored Communications Act: The Ramifications of an Antique Privacy Law

-- By EdwardBontkowski - 26 Apr 2010

"Ways may some day be developed by which the Government, without removing papers from secret drawers, can reproduce them in court, and by which it will be enabled to expose to a jury the most intimate occurrences of the home."

--Justice Brandeis, Olmstead v. United States (dissent)

How the Stored Communication Act Works

In 1986, the Electronic Communications Privacy Act of 1986 (“ECPA”) was passed into law, touted by many at the time as providing significant protections for the privacy of online communication. One of the main components of the ECPA is the Stored Communications Act (“SCA”). The SCA addresses voluntary and compelled disclosure of “stored wire and electronic communications and transactional records” held by third-party internet service providers.

The SCA categorizes two types of online services—“electronic communication services” (“ECS”) and “remote computing services” (“RCS”). The difference between these two categories is somewhat subtle, but very determinative for a communication’s treatment under the statute (and also important in arguing why this statute is antiquated). Under the SCA an ECS is “…any service which provides to users thereof the ability to send or receive wire or electronic communications….” A RCS is defined as “…the provision to the public of computer storage or processing services by means of an electronic communications system." The SCA is a hyper-technical statute, but essentially it says that to compel disclosure from an ECS of an email that has been in storage for 180 days or less, the government must obtain a warrant (and thus must have probable cause). If the email has been in storage for more than 180 days, or the provider is a RCS, the government may obtain a search warrant, or, importantly, may get a subpoena or a “specific and articulable facts” court order to compel disclosure as long as notice is given to the person whose communications are being sought. Obviously, the subpoena and “specific and articulable facts” order require much less process than a search warrant and the notice requirement can be loopholed somewhat, and thus it is this area where privacy concerns are at their highest.

The Stored Communications Act: A 24-year-old Antique

To understand just how outdated the SCA really is, one must understand the communications technology that existed at the time and how these technological limitations guided the motivations behind the SCA. In 1986, email worked in a relatively simple and straightforward fashion (at least relative to today). Users would simply download email from their ISP’s server directly onto their home computers. Because of technological limitations, any email left on servers for more than 180 days was considered to be abandoned. Under Fourth Amendment abandonment doctrine, individuals lose protection over property they have abandoned. See United States v. Jones, 707 F.2d 1169, 1172 (10th Cir. 1983) (“When individuals voluntarily abandon property, they forfeit any expectation of privacy in it that they might have had.”) Some scholars have suggested that the SCA drafters attempted to reflect this abandonment doctrine in the SCA by incorporating this 180-day rule. Certainly, in the context of 1986 technology, this probably made a lot of sense. However, given the fact that 24 years is the technological equivalent of an eon, to continue to apply such an outdated law today is patently absurd. With today’s technology and the advent of “cloud computing,” the majority, if not all, of a user’s email is stored on Google’s, Yahoo!’s, etc. servers and not directly on their home computers.

The result is a law, initially designed to fill in the gaps that the Fourth Amendment could not reach (although below I contend the Fourth Amendment can, and should, reach those gaps), that essentially allows the government to obtain nearly all the emails of any person it wants without even needing a search warrant. The more society embraces advanced storage technologies, the more privacy it relinquishes—quite a perverse result. All but the most cynical can agree that such a result could not have possibly been the drafters’ intent.

Unsurprisingly, the government has recently attempted to push this outdated statute to its theoretical limits by claiming that opened emails that have been on Yahoo servers for less than 180 days do not require a warrant to be searched because they do not fall under the statutory definition of “electronic storage.”

How to Deal With the Stored Communications Act?

The question now is “what do we do with the SCA?” While various ideas have been tossed around concerning updating the language within the statute, changing definitions, etc, many question why we should even require the SCA anymore (or to begin with). At least with respect to stored email, it seems that the Fourth Amendment alone should require the government to obtain search warrants to compel disclosure. In Katz v. United States, the Court said Fourth Amendment protections apply where “a person [has] exhibited an actual (subjective) expectation of privacy…that society is prepared to recognize as [objectively] reasonable.” 389 U.S. 347, 360-61 (1967). At that time, society was prepared (as was the Supreme Court) to recognize as reasonable that telephone’s vital role as a communication medium necessitated Fourth Amendment protections. In applying the Fourth Amendment, the Supreme Court has continued to look at societal expectations, especially when scrutinizing new technologies. http://www.wired.com/images_blogs/threatlevel/2010/04/effetalbrief.pdf (citing Kyollo v. United States, 533 U.S. 27, 34 (2001) (recognizing that technological advances must not be allowed to erode society’s expectation in “that degree of privacy against government that existed when the Fourth Amendment was adopted”)).

It is clearly evident that in today’s society stored email plays as vital a role (and probably a more vital one) as the telephone did in 1967, and accordingly society’s expectations regarding the privacy of email are the same as they were for privacy of the telephone in 1967. Therefore, I believe it is time for courts to recognize that people have a reasonable expectation of privacy with respect to stored email.

This is a good capsule summary of the situation, with a peculiar set of conclusions. If, as you assert without anything better than the analogy with the telephone to support you, the Fourth Amendment itself should be the only legal standard for judging email searches, why isn't the rule the same one that attaches to other "important," "vital," or "critical" documents and information in the hands of unaffiliated third parties, namely that no warrant is necessary and the government can do what it needs or wants to do using subpoenas?

The statute was designed to provide more than the Fourth Amendment would provide, and it does so. People have responded to the blandishments of the world's largest intelligence service, however, and have decided to store all their personal communications forever on computers belonging to unaffiliated third parties who offer them "free" email services in return for being allowed to spy on their communications, and—oh so coincidentally—also rendering those communications easily subject to subpoena by government, which then begins eroding as much of the statute's remaining protections as they can.

A better solution is for everyone to have an extremely cheap, simple appliance that stores all their email in their homes and makes it accessible to them via their mobile devices everywhere. That email would then be reachable only by search warrant, both before delivery by any ECS storing and forwarding the mail for delivery, under ECPA, and at the residence, under the Fourth Amendment. The statute would do what it was intended to do, and everyone would be fine.

Of course, even without such an appliance, running a personal mail server is trivial for those with knowledge and even scant resources. And for everyone, without exception, Google Mail represents a loss of liberty that's far more expensive than the cost being saved by "free" service. But blaming ECPA for the peoples' bamboozlement and failure to protect their rights seems to me an odd outcome. I may well be wrong, but the arguments you would need to make in order to explain why aren't touched on here.

---

Hi Edward,

This is an area of particular interest to me. I share your general conclusion that the Fourth Amendment should not be the dead letter online that it is presently, and that if we could revive it that would be a preferable approach to new legislation. I wonder if you came across any particularly useful readings on the topic in your prep for this essay? I've encountered some (including for this course) but if you have a source in particular that you'd recommend I would be interested to hear it. Thanks.

-- BrianS - 04 May 2010

Brian,

I found Orin Kerr to be one of the foremost scholars on the SCA (and a lot of other technology law related things). He has several articles in various journals relating to the SCA. He also blogs on the Volokh Conspiracy website about this topic as well. His writing is quite excellent in my opinion.

-- EdwardBontkowski - 06 May 2010

Edward,

Great, thanks. I was able to pull several of Kerr's articles up online. I appreciate the suggestion.

-- BrianS - 06 May 2010

To restrict access to your paper simply delete the "#" on the next line:

# * Set ALLOWTOPICVIEW = TWikiAdminGroup, EdwardBontkowski