Stored Communications Act
Encyclopedia
The Stored Communications Act (SCA) is a law that was enacted by the United States Congress
in 1986. It is not a stand-alone law but forms part of the Electronic Communications Privacy Act
; it is codified as 18 U.S.C. §§ 2701 to 2712. The SCA addresses voluntary and compelled disclosure of "stored wire and electronic communications and transactional records" held by third-party internet service providers (ISPs).
The Fourth Amendment to the U.S. Constitution protects the people's right "to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures…." However, when applied to information stored online, the Fourth Amendment's protections are potentially far weaker. In part, this is because the Fourth Amendment defines the "right to be secure" in spatial terms that do not directly apply to the "reasonable expectation of privacy" in an online context. In addition, society has not reached clear consensus over expectations of privacy in terms of more modern (and developing, future) forms of recorded and/or transmitted information.
Furthermore, users generally entrust the security of online information to a third party, an ISP. In many cases, Fourth Amendment doctrine has held that, in so doing, users relinquish any expectation of privacy. The "third party doctrine" holds "…that knowingly revealing information to a third party relinquishes Fourth Amendment protection in that information." While a search warrant
and probable cause
are required to search one’s home, under the third party doctrine only a subpoena and prior notice (a much lower hurdle than probable cause) are needed to compel an ISP to disclose the contents of an email or of files stored on a server.
The SCA creates Fourth Amendment-like privacy protection for email and other digital communications stored on the internet. It limits the ability of the government to compel an ISP to turn over content information and noncontent information (such as logs and “envelope” information from email). In addition, it limits the ability of commercial ISPs to reveal content information to nongovernment entities.
The SCA targets two types of online service, "electronic communication services" and "remote computing services." The statute defines an electronic communication service as "…any service which provides to users thereof the ability to send or receive wire or electronic communications." A remote computing service is defined as "the provision to the public of computer storage or processing services by means of an electronic communications system." Section 2703 of the SCA describes the conditions under which the government is able to compel an ISP to disclose "customer or subscriber" content and non-content information for each of these types of service:
• Electronic communication service. If an unopened email has been in storage for 180 days or less, the government must obtain a search warrant. There has been debate over the status of opened emails in storage for 180 days or less, which may fall in this category or the "remote computing service" category.
• Remote computing service. If a communication has been in storage for more than 180 days or is held “solely for the purpose of providing storage or computer processing services” the government can use a search warrant, or, alternatively, a subpoena or a “specific and articulable facts” court order (called a 2703(d) order) combined with prior notice to compel disclosure. Prior notice can be delayed for up to 90 days if it would jeopardize an investigation. Historically, opened or downloaded email held for 180 days or less has fallen in this category, on the grounds that it is held “solely for the purpose of storage.”
§ 2702 of the SCA describes conditions under which a public ISP can voluntarily disclose customer communications or records. In general, ISPs are forbidden to “divulge to any person or entity the contents of any communication which is carried or maintained on that service.” However, ISPs are allowed to share “non-content” information, such as log data and the name and email address of the recipient, with anyone other than a governmental entity. In addition, ISPs who do not offer services to the public, such as businesses and universities, can freely disclose content and non-content information.
(2010) the Sixth Circuit found that email users have a Fourth Amendment-protected reasonable expectation of privacy in the contents of their email accounts and that "to the extent that the SCA purports to permit the government to obtain such emails warrantlessly, the SCA is unconstitutional."
United States Congress
The United States Congress is the bicameral legislature of the federal government of the United States, consisting of the Senate and the House of Representatives. The Congress meets in the United States Capitol in Washington, D.C....
in 1986. It is not a stand-alone law but forms part of the Electronic Communications Privacy Act
Electronic Communications Privacy Act
The Electronic Communications Privacy Act is a United States law.- Overview :The “electronic communication” means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or...
; it is codified as 18 U.S.C. §§ 2701 to 2712. The SCA addresses voluntary and compelled disclosure of "stored wire and electronic communications and transactional records" held by third-party internet service providers (ISPs).
The Fourth Amendment to the U.S. Constitution protects the people's right "to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures…." However, when applied to information stored online, the Fourth Amendment's protections are potentially far weaker. In part, this is because the Fourth Amendment defines the "right to be secure" in spatial terms that do not directly apply to the "reasonable expectation of privacy" in an online context. In addition, society has not reached clear consensus over expectations of privacy in terms of more modern (and developing, future) forms of recorded and/or transmitted information.
Furthermore, users generally entrust the security of online information to a third party, an ISP. In many cases, Fourth Amendment doctrine has held that, in so doing, users relinquish any expectation of privacy. The "third party doctrine" holds "…that knowingly revealing information to a third party relinquishes Fourth Amendment protection in that information." While a search warrant
Search warrant
A search warrant is a court order issued by a Magistrate, judge or Supreme Court Official that authorizes law enforcement officers to conduct a search of a person or location for evidence of a crime and to confiscate evidence if it is found....
and probable cause
Probable cause
In United States criminal law, probable cause is the standard by which an officer or agent of the law has the grounds to make an arrest, to conduct a personal or property search, or to obtain a warrant for arrest, etc. when criminal charges are being considered. It is also used to refer to the...
are required to search one’s home, under the third party doctrine only a subpoena and prior notice (a much lower hurdle than probable cause) are needed to compel an ISP to disclose the contents of an email or of files stored on a server.
The SCA creates Fourth Amendment-like privacy protection for email and other digital communications stored on the internet. It limits the ability of the government to compel an ISP to turn over content information and noncontent information (such as logs and “envelope” information from email). In addition, it limits the ability of commercial ISPs to reveal content information to nongovernment entities.
Overview
Section 2701 of the SCA provides criminal penalties for anyone who "intentionally accesses without authorization a facility through which an electronic communication service is provided or… intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorize access to a wire or electronic communication while it is in electronic storage in such system."The SCA targets two types of online service, "electronic communication services" and "remote computing services." The statute defines an electronic communication service as "…any service which provides to users thereof the ability to send or receive wire or electronic communications." A remote computing service is defined as "the provision to the public of computer storage or processing services by means of an electronic communications system." Section 2703 of the SCA describes the conditions under which the government is able to compel an ISP to disclose "customer or subscriber" content and non-content information for each of these types of service:
• Electronic communication service. If an unopened email has been in storage for 180 days or less, the government must obtain a search warrant. There has been debate over the status of opened emails in storage for 180 days or less, which may fall in this category or the "remote computing service" category.
• Remote computing service. If a communication has been in storage for more than 180 days or is held “solely for the purpose of providing storage or computer processing services” the government can use a search warrant, or, alternatively, a subpoena or a “specific and articulable facts” court order (called a 2703(d) order) combined with prior notice to compel disclosure. Prior notice can be delayed for up to 90 days if it would jeopardize an investigation. Historically, opened or downloaded email held for 180 days or less has fallen in this category, on the grounds that it is held “solely for the purpose of storage.”
§ 2702 of the SCA describes conditions under which a public ISP can voluntarily disclose customer communications or records. In general, ISPs are forbidden to “divulge to any person or entity the contents of any communication which is carried or maintained on that service.” However, ISPs are allowed to share “non-content” information, such as log data and the name and email address of the recipient, with anyone other than a governmental entity. In addition, ISPs who do not offer services to the public, such as businesses and universities, can freely disclose content and non-content information.
Constitutionality of Compelled Government Disclosure
With respect to the government’s ability to compel disclosure, the most significant distinction made by the SCA is between communications held in electronic communications services, which require a search warrant and probable cause, and those in remote computing services, which require only a subpoena or court order, with prior notice. This lower level of protection is essentially the same as would be provided by the Fourth Amendment—or potentially less, since notice can be delayed indefinitely in 90-day increments. Orin Kerr argues that, “the SCA was passed to bolster the weak Fourth Amendment privacy protections that applied to the Internet. Incorporating those weak Fourth Amendment principles into statutory law makes little sense.” In Warshak v U.S. (2007) this point of view found fleeting support from a panel of the Sixth Circuit, which ruled that a reasonable expectation of privacy extends to emails that would otherwise fall under the SCA’s lower level of protection: “Where the third party is not expected to access the e-mails in the normal course of business, however, the party maintains a reasonable expectation of privacy, and subpoenaing the entity with mere custody over the documents is insufficient to trump the Fourth Amendment warrant requirement.” Subsequently, the Sixth Circuit en banc vacated the panel's ruling and remanded for dismissal of the constitutional claim, reasoning that, because the Court had "no idea whether the government will conduct an ex parte search of Warshak’s e-mail account in the future and plenty of reason to doubt that it will," the matter was not ripe for adjudication. Zwillinger and Sommer observed that this decision erected a barrier to "prospective" challenges by individuals with reason to believe they will be targets of surveillance. While Warshak's civil case ended without a resolution to this issue, his criminal case provided another opportunity. In United States v. WarshakUnited States v. Warshak
United States v. Warshak is a criminal case decided by the United States Court of Appeals for the Sixth Circuit holding that government agents violated the defendant's Fourth Amendment rights by compelling his Internet Service Provider to turn over his emails without first obtaining a search...
(2010) the Sixth Circuit found that email users have a Fourth Amendment-protected reasonable expectation of privacy in the contents of their email accounts and that "to the extent that the SCA purports to permit the government to obtain such emails warrantlessly, the SCA is unconstitutional."