Occasionally, a mainstream press story gets enough attention to shine a brighter light on the privacy issues that we at ZwillGen deal with every day. This happened when General Wesley Clark’s cell phone records were obtained, which led to a Congressional Investigation and an eventual overhaul of the FCC’s CPNI rules – the rules requiring telephone providers to protect call detail records from disclosure to unauthorized third parties. The same thing is now happening as a result of the Petraeus-Broadwell-Allen-Kelly investigation. Rather than just clients asking me about what legal process the government needs to use to obtain the content of emails they maintain, I’m getting these questions from friends, neighbors, in-laws, and reporters. Here’s a short primer on the subject:
For the government to obtain the content of emails, the Stored Communications Act (the law we deal with every day), 18 U.S.C. 2701, et seq., requires the government to use a search warrant, which represents a judge’s finding that there is probable cause that a crime has been committed, and that the evidence of the crime will be found in the records that are being sought. The SCA only requires that the government use this process if the emails have been in “electronic storage” for 180 days or less. If the emails are older than that, the SCA allows the government to proceed by a subpoena, or a court order, provided that the government gives the subject prior notice, or meets the statutory requirements to delay such notice for 90 days. The U.S. Constitution, however, may not allow this lesser process even though it is set forth in the SCA. Recent court decisions have suggested that despite the 180—day provisions of the SCA, the Fourth Amendment to the Constitution may require the government to use a warrant for all stored email, and most major email providers now require a warrant as well. See United States v. Warshak, 631 F.3d 266 (6th Cir. 2010)
Does that mean that the government used search warrants in the Petraeus-Broadwell-Allen-Kelly investigation? Not necessarily. If the emails were sent through the government’s email systems, and resided on government servers, the FBI could have obtained the email with no legal process whatsoever because most government employees provide advance consent to have all emails sent or received by them on government systems to be monitored and/or disclosed. And even if government systems were not used, with the consent of the subscriber, the government can also obtain emails from commercial providers if the email subscriber provides his or her consent, as a high-ranking official in the government would be asked to do as part of any internal probe of their conduct.
Congress is currently debating a law that would amend the SCA to require a search warrant for all stored content on provider systems – not just emails, but documents, pictures, and other stored files. It is quite likely that this investigation will bring additional focus to this reform effort.
Tomorrow I will post further on the way in which the government can get real-time surveillance of all emails sent and received, including access to draft emails that have never actually been “sent.”
