Facebook and the Stored Communications Act: What’s protected? (part 2)

September 13, 2011

Facebook Magnifying glassThis is the third part in a series on the current state of federal cyberlaw and privacy protections.

Click here for the post on the court ruling requiring a warrant for cell-phone location data.

Click here for the post on the SCA’s protections against civil discovery orders.

Last week’s post discussed 1986’s Stored Communications Act (SCA) and the protections it gives to personal information stored electronically.

Specifically, it explained that the SCA prevents a Facebook or other social media entity from releasing an individual’s information to third-parties, even in response to a civil subpoena.

Unfortunately, these protections are far more limited in a criminal scenario.

In such a case, the question isn’t whether the information may be released, but whether a subpoena or a warrant is required to obtain such information.

In making this determination, the question of whether a specific communication falls into the Electronic Communication Service (ECS) or Remote Computing Service (RCS) category is fundamental (contrary to civil law situations).

The difference between the two can effectively be a matter of whether the government is able to acquire the information at all, since one may require only a subpoena and another may require a warrant.

The requirements that the government needs to meet to obtain a subpoena and a warrant are vastly different in most circumstances.

A subpoena under Federal Rules of Criminal Procedure Rule 17 (along with U.S. v. Nixon’s interpretation thereof) requires that the government show that the requested information is evidentiary, relevant, necessary for the case, and made in good faith.

The SCA also provides another subpoena-like mechanism in the form of a special court order, only requiring the government to show that “there are reasonable grounds to believe that [the information] sought [is] relevant and material to an ongoing criminal investigation.”

While they may sound daunting, neither of these standards is remotely difficult to meet in most situations.

A warrant, conversely, requires a showing of probable cause.

As mentioned in an earlier post, the standard is markedly higher, and obtaining a warrant is procedurally more burdensome; taken together, these two factors can completely hinder a criminal case.

Whether a warrant or subpoena is required is determinative on whether the sought after information falls into the ECS or RCS category.

Facebook badgeThe distinctions between ECS and RCS aren’t always clear, though, and there are instances where ECS information can be obtained by subpoena.

For example, to compel a provider of ECS to disclose contents of communications in its possession, the government must obtain a search warrant.

In most cases, this means unopened email, but it has been recently extended to apply to unread user messages and wall postings on social networking sites such as Facebook.

If the unopened email is older than 180 days, though, then only a subpoena is required.

At that point, the communication is considered as being held in “storage,” which the SCA extends lesser protections to.

RCS communications fit into this category as well.

So how does law enforcement know whether a communication is unread?

The SCA allows the government to obtain “basic subscriber” information – such as the user’s last login date and time – with only a subpoena.

Most of the time, though, law enforcement just skips right to the search warrant, mostly for efficiency’s sake.

While probable cause is normally a relatively high standard, with the amount of personal data people voluntarily disclose on Facebook, it doesn’t take much to convince a judge that there’s probable cause the sought-after evidence is there.

This highlights a major weakness of the SCA.

The law’s authors – indeed, the Founding Fathers – never contemplated the advent of social media.

One’s Facebook page is, in pre-Internet terms, an exhaustive personal diary that details a user’s thoughts, movements, activities, relationships, and more.

While this “diary” is generally not publicly available, knowledge of the diary’s existence generally is.

If they were around today, would the Founding Fathers have extended additional protections to an individual’s electronic information against state intrusion?

Probably, but the question is purely academic.

The relevant question is whether Congress or the courts are going to recognize the special nature of social media in relation to the Fourth Amendment and actually do something about it.