On Friday, March 11, the District Court for the Eastern District of Virginia issued a ruling in a case involving access to Twitter user data as part of the government’s investigation of the Wikileaks/Bradley Manning case. While the Wikileaks investigation is newsworthy in its own right, it is also generating some interesting court rulings on infrequently litigated Electronic Communications Privacy Act (“ECPA”) provisions.
Petitioners in this case were American Jacob Appelbaum, Dutch citizen Rop Gonggrijp and Icelandic citizen and Parliament member Birgitta Jonsdottir. In December of 2010, the federal government had obtained an ex parte order under 18 USC 2703(d) (a “D-Order”) for subscriber names, contact information, connection records, IP addresses, payment information, records of account use and correspondence related to the Petitioners’ Twitter accounts. After Twitter successfully petitioned the Court to unseal the orders (though not the applications), the company notified the Petitioners, who filed a challenge seeking to have the D-Order vacated.
The Court’s first order of business was to rule that Petitioners lacked standing to challenge D-Orders seeking the production of non-content information under the Stored Communications Act (“SCA”). Specifically, the Court relied on Section 2704(b)(1)(A) of the SCA, which addresses customer challenges to subpoenas and orders issued under the SCA, and which states that a petitioner seeking to vacate such an order must file an affidavit “stating that the applicant is a customer or subscriber to the service from which the contents of electronic communications maintained for him have been sought” (emphasis added). In one of the first, if not the first, opinions interpreting this provision, the Court read the provision to mean that subscribers for whom the government seeks only non-content or records information lack standing to challenge that request. The Court further noted that petitioners offered no support for their general claim to standing under due process, and remarked that only targets of content disclosures might have a viable constitutional challenge.
The Court’s reliance on Section 2704 to find no standing is interesting. Although Section 2704(b)(1) is titled “Customer Challenges,” that sub-section is contained within the broader Section 2704, which is entitled “Backup Preservation” and addresses a particular type of government request under the SCA. Specifically, 2704(a)(1) allows the government to compel a service provider to create a backup copy of the contents of the electronic communications sought pursuant to Section 2703(b)(2) in order to preserve those communications, and requires notice to the subscriber subject to that request under (a)(2). Subdivision (b), which the Court relied on, then allows a subscriber who has received notice under subdivision 2704(a)(2) to challenge the order by filing an affidavit. Thus, on its face, the procedure for customer challenges under 2704(b) appears to address specifically government requests that providers create back-ups of content sought under 2704(a)(1). As such, the fact that the standing provision refers to content requests is not surprising.
In the absence of any other provision in the SCA addressing subscriber standing to challenge law enforcement process, however, the Court here applied 2704(b)(1)(A) more broadly as a general limitation on a subscriber’s standing to challenge any order or subpoena under the SCA that does not seek to compel disclosure of the contents of communications as opposed to mere non-content records. Section 2704(b)(1) does not on its face apply this broadly.
The Court’s ruling does track the subscriber notice provisions in section 2703 of the SCA, however. Section 2703(d) Orders generally require notice to individuals whose content is sought (unless law enforcement seeks to delay notice under section 2705), but specifically alleviate any notice requirement where only non-content records or information are sought. See Section 2703(c)(3). The question is whether the Court was right to find that in instances where a subscriber is not specifically entitled to notice under the SCA, that subscriber also lacks standing to challenge an Order about which he or she becomes aware (as here through the actions of Twitter). In this case, the Court answered that question yes. The Court appeared disinclined to address broader standing issues in light of petitioners’ apparent failure to provide sufficient authority.
Notwithstanding its ruling on standing, the Court also reached, and rejected, the merits of the SCA challenge. The D-Order application was sealed and the Court ordered that it remain sealed so that law enforcement may investigate without the details of the investigation being released to the public in a manner that compromises the investigation. Without the application, the Petitioners were left to claim that no set of facts would justify the scope of the D-Order, arguing that data related to extensive irrelevant, innocent communications would be swept within its scope. The Court, which had access to the underlying Application, rejected this claim and found that the D-Order was justified without providing any details on the public record.
A recent Third Circuit case called In re Application of the United States for an Order Directing a Provider of Elec. Commc’n Serv. to Disclose Records to Gov’t (in which I was involved) held that Courts have the discretion under the SCA to require that law enforcement make a probable cause showing, higher than the demonstration of “specific and articulable facts” required by the SCA before issuing a D-Order. The Court, without discussing the merits of the Third Circuit case, declined to exercise that discretion.
The Court also considered and rejected First and Fourth Amendment challenges to the D-Order. After expressing skepticism that Petitioners Gonggrijp and Jonsdottir, as non-citizens, enjoyed U.S. Constitutional rights, the Court held that the data sought did not implicate First Amendment associational freedoms and that non-content information was not protected by the Fourth Amendment. Specifically regarding IP addresses, the Court rejected the idea that an IP address shows location with precision, or provides insight into a home’s interior or a user’s private movements. Rather, the Court held that because the IP address is assigned by a service provider and then voluntarily through the Twitter terms of service conveyed to Twitter, the user has no Fourth Amendment interest in that data. In issuing this ruling, the Court pointed both to Supreme Court precedent that dialed telephone numbers were not protected, as well as to rulings in several Circuit Courts that extended that reasoning to IP addresses.
In sum, this opinion contains a novel and interesting analysis of standing to challenge orders for non-content information under the SCA. The remainder of the opinion adheres to non-controversial existing legal precedent under the SCA in a very interesting investigation. Because the Court declined to unseal the applications, the public is unlikely to have more information about this branch of the Wikileaks investigation and the underlying grounds for the D-Order application unless and until indictments are issued and renewed petitions to unseal the record are considered.
