"Electronic Storage" versus "Storage"

This post is about a recent federal district court opinion parsing certain of the elements of the Electronic Communications Privacy Act (ECPA). As Wikipedia notes, ECPA was adopted in 1986 “to extend government restrictions on wire taps from telephone calls to include transmissions of electronic data by computer.”

As Wikipedia also notes, ECPA goes further than the Wiretap Act (pr Title III), which is the 1968 statutory scheme adopted to restrict the conditions under which law enforcement can intercept the contents of telephone calls. Title III is only concerned with capturing the contents of a communication “in flight,” i.e., in the process of being transmitted, but ECPA includes provisions that also protect the contents of stored communications. As I noted in an earlier post, electronic communications – unlike the contents of a phone call – can be acquired both “in flight” (during transmission) and while they are being stored online.

The case we’re concerned with parsed the two kinds of storage ECPA addresses. The case is U.S. v. Weaver, 636 F.Supp.2d 769 (U.S. District Court for the Southern District of Illinois 2009). The issue it addresses arose when, in the course of pursuing a child pornography charge against Justin Weaver, the Department of Justice sought the contents of emails

it believes Weaver sent or received at a Microsoft/MSN Hotmail account. The Government submitted a trial subpoena for the records to the Clerk of Court on May 15, 2009, and the Clerk issued the subpoena the same day. On May 19, 2009, the Government executed the subpoena by faxing it to Microsoft/MSN (Microsoft), which accepts such service. The subpoena stated that the Government sought to compel production of `the contents of electronic communications (not in”‘electronic storage” as defined by 18 U.S. Code § 2510(17)’ and specified that the `[c]ontents of communications not in “electronic storage’ include the contents of previously opened or sent email.” Motion, Exhibit 1, Subpoena. . . . Microsoft produced some of the information requested, but it failed to produce the content of previously accessed, viewed, or downloaded emails that had been stored for fewer than 181 days. The Government now has moved to compel production of the contents of these emails. . . .

Microsoft asked the Government to include a letter with the Government's Motion. Microsoft's associate general counsel wrote this letter to the Government explaining that it objected to the Government's subpoena to the extent that it requested material that the Ninth Circuit Court of Appeals has held requires a warrant. Motion, Exhibit 2, Letter. Microsoft asserts that because its headquarters are located within the Ninth Circuit, it must comply with Ninth Circuit precedent. The Government disagrees . . .and has asked the Court to compel Microsoft to produce the materials it requested.

U.S. v. Weaver, supra. The federal judge explained that the issue presented “is whether a court can compel an Internet Service Provider (ISP, such as Microsoft, to comply with a trial subpoena and produce the contents of a subscriber’s opened emails which are less than 181 days old.” U.S. v. Weaver, supra.

The court began its analysis by explaining that under 18 U.S. Code § 2703(a), a law enforcement agency can

require the disclosure by a provider of electronic communication service of the contents of a[n] . . . electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant issued . . . by a court with jurisdiction over the offense under investigation. . . .

So if an electronic communication has been in storage for 180 days (or 179, or 178, and so on), the government must use a search warrant to compel the ISP to provide it. If the communication has been in storage for “more than one hundred and eighty days”, the government can use a trial subpoena to obtain it. 18 U.S. Code § 2703(a). The primary difference between the two is that a warrant requires probable cause while a subpoena does not. And there is one more complication: Under 18 U.S. Code § 2703(b), the government can use a trial subpoena to obtain the contents of an electronic communication that is “held or maintained on a [remote computing] service . . . . solely for the purpose of proving storage or computer processing services” to the subscriber to or customer of that service.

Therefore, “for emails less than 181 days old, the question of whether a warrant is necessary turns on whether the emails are `in electronic storage’ [§ 2703(a)] or are `held or maintained . . . solely for the purpose of providing storage or computer processing services to [the] subscriber or customer [§ 2703(b)].’” U.S. v. Weaver, supra. This meant that if the emails the Justice Department sought were in electronic storage, “Microsoft need not produce them without a warrant,” but if they were “held or maintained solely to provide the customer storage or computer processing services, Microsoft must comply with the Government’s subpoena.” U.S. v. Weaver, supra.

As the Weaver judge noted, the resolution of this issue “turn[ed] on the difference between `electronic storage’ and `storage.’” U.S. v. Weaver, supra. The part of ECPA that deals with stored electronic communications doesn’t define these terms, instead, it refers back to Title III, the Wiretap Act, for definitions. 18 U.S. Code § 2711(1).

The Wiretap Act does not define “storage,” but it defines “electronic storage” as

(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and

(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication. . . .

18 U.S. Code § 2510(17). The judge in this case found that because the emails at issue here “have been opened, they are not in temporary, intermediate storage incidental to electronic transmission.” U.S. v. Weaver, supra. She concluded, therefore, that the issue to be resolved was “whether the emails are in storage `for purposes of backup protection,’ in which case they are in `electronic storage’ and protected by the warrant requirement” of 18 U.S. Code § 2703(a). U.S. v. Weaver, supra.

Microsoft, as noted above, relied on a decision from the U.S. Court of Appeals for the Ninth Circuit, which held emails stored on an ISP’s server were “stored for backup protection and thus were in electronic storage.” U.S. v. Weaver, supra (citing Theofel v. Farey-Jones, 359 F.3d 1066 (Ninth Circuit 2004)). According to the Ninth Circuit, an

obvious purpose for storing a message on an ISP's server after delivery is to provide a second copy of the message in the event the user needs to download it again -- if, for example, the message is accidentally erased from the user's own computer. The ISP copy of the message functions as a `backup’ for the user. . . . [N]othing in the [Wiretap] Act requires that the backup protection be for the benefit of the ISP rather than the user. Storage under these circumstances thus literally falls within the statutory definition.

Theofel v. Farey-Jones, supra. The Ninth Circuit held that “once a user receives an email, any version on the ISP's server is a copy that is being stored for backup until the user's version `expire[s] in the normal course.’” U.S. v. Weaver, supra (quoting Theofel v. Farey-Jones, supra). The Weaver judge found that the Ninth Circuit’s reasoning relied on

the assumption that users download emails from an ISP's server to their own computers. That is how many email systems work, but a Hotmail account is `web-based’ and `remote.’ . . . Hotmail users can access their email over the web from any computer, and they do not automatically download their messages to their own computers as non-web-based email service users do. . . . [I[f Hotmail users save a message, they generally leave it on the Hotmail server and return to Hotmail . . . to access it. . . .

U.S. v. Weaver, supra. The judge then explained that the distinction between

web-based email and other email systems makes Theofel largely inapplicable here. As the Ninth Circuit acknowledged . . ., `A remote computing service might be the only place a user stores his messages; in that case, the messages are not stored for backup purposes.’ . . . Users of web-based email systems . . . default to saving their messages only on the remote system. . . . [U]nless a Hotmail user varies from default use, the remote computing service is the only place he or she stores messages, and Microsoft is not storing that user's opened messages for backup purposes. Instead, Microsoft is maintaining the messages `solely for the purpose of providing storage or computer processing services to such subscriber or customer.’ 18 U.S. Code § 2703(b)(2).

U.S. v. Weaver, supra. The judge also noted that another ECPA provision – 18 U.S. Code § 2702(a)(2) – lets an entity offering remote computing service “divulge to any entity the contents of any communication maintained on the service” under the same conditions that allow the government to use a trial subpoena to obtain the contents of an electronic communication. U.S. v. Weaver, supra. She also found this relevant to the issue raised by the motion to compel:

Thus, if the Stored Communications Act drafters intended emails a user leaves on an email service for re-access at a later date to be covered by section 2701(a)(2), they also must have intended them to be covered by the Government's trial subpoena power. Any other reading fails to reconcile these two sections of the statute.

U.S. v. Weaver, supra. The Weaver judge therefore held that “opened emails stored by Microsoft for Hotmail users are not in electronic storage, and the Government can obtain copies of such emails using a trial subpoena.” U.S. v. Weaver, supra. So she granted the government’s motion to compel Microsoft’s compliance with the trial subpoena.

Two comments in closing: One is that I suspect this opinion is the kind of thing that makes people hate lawyers because it sounds like parsing the number of legal angels who can dance on the top of a lawbook (or, unnecessarily technical and complex). The other comment is that I tend to agree with the first. I think ECPA desperately needs to be redone. It was adopted in 1986, and although it’s been tinkered with repeatedly, it still tends to reflect the state of computing back then . . . when what passed as the Internet was very, very primitive. If Congress revised ECPA, it would eliminate the need for the often tortuous reasoning in cases like this . . . but, of course, Congress does have a few other things to deal with.