The Sixth Circuit ruled on Tuesday that criminal investigators must obtain a warrant to seize user data from cloud providers, voiding parts of the notorious Stored Communication Act. The SCA allowed investigators to demand providers turn over user data under certain circumstances (e.g., data stored more than 180 days) without obtaining a warrant supported by probable cause.
I have a very long piece analyzing the decision, published on CNET this evening. See “Search Warrants and Online Data: Getting Real.” (I also wrote extensively about digital search and seizure in “The Laws of Disruption.”) The opinion is from the erudite and highly-readable Judge Danny Boggs. The case is notable if for no other reason than its detailed and lurid description of the business model for Enzyte, a supplement that promises to, well, you know what it promises to do….
The SCA’s looser rules for search and seizure created real headaches for cloud providers and weird results for criminal defendants. Emails stored on a user’s home computer or on a service provider’s computer for less than 180 days get full Fourth Amendment protection. But after 180 days the same emails stored remotely lose some of their privacy under some circumstances. As the commercial Internet has evolved (the SCA was written in 1986), these provisions have become increasingly anomalous, random and worrisome, both to users and service providers. (As well as to a wide range of public interest groups.)
Why 180 days? I haven’t had a chance to check the legislative history, but my guess is that in 1986 data left on a service provider’s computer would have taken on the appearance of being abandoned.
Assuming the Sixth Circuit decision is upheld and embraced by other circuits, digital information will finally be covered by traditional Fourth Amendment protections regardless of age or location. Which means that the government’s ability to seize emails (Tuesday’s case applied only to emails, but other user data would likely get the same treatment) without a warrant that is based on probable cause will turn on whether or not the defendant had a “reasonable expectation of privacy” in the data. If the answer is yes, a warrant will be required.
(If the government seizes the data anyway, the evidence could be excluded as a penalty. The “exclusionary rule” was not invoked in the Warshak case, however, because the government acted on a good-faith belief that the SCA was Constitutional.)
Where does the “reasonable expectation of privacy” test come from? The Fourth Amendment protects against “unreasonable” searches and seizures, and, since the Katz decision in 1968, Fourth Amendment cases turn on an analysis of whether a criminal defendant’s expectation of privacy in whatever evidence is obtained was reasonable.
Katz involved an electronic listening device attached to the outside of a phone booth—an early form of electronic surveillance. Discussions about whether a phone conversation could be “searched” or “seized” got quickly metaphysical, so the U.S. Supreme Court decided that what the Fourth Amendment really protected was the privacy interest a defendant had in whatever evidence the government obtained. “Reasonable expectation of privacy” covered all the defendant’s “effects,” whether tangible or intangible.
Which means, importantly, that not all stored data would pass the test requiring a warrant. Only stored data that the user reasonably expects to be kept private by the service provider would require a warrant. Information of any kind that the defendant makes no effort to keep private—e.g., talking on a cell phone in a public place where anyone can hear—can be used as evidence without a warrant.
Here the Warshak court suggested that if the terms of service were explicit that user data would not be kept private, then users wouldn’t have a reasonable expectation of privacy that the Fourth Amendment protected. On the other hand, terms that reserved the service provider’s own right to audit or inspect user data did not defeat a reasonable expectation of privacy, as the government has long argued.
An interesting test case, not discussed in the opinion, would be Twitter. Could a criminal investigator demand copies of a defendant’s Tweets without a warrant, arguing that Tweets are by design public information? On the one hand, Twitter users can exclude followers they don’t want. But at the same time, allowed followers can retweet without the permission of the original poster. So, is there a reasonable expectation of privacy here?
There’s no answer to this simplified hypothetical (yet), but it is precisely the kind of analysis that courts perform when a defendant challenges the government’s acquisition of evidence without full Fourth Amendment process being followed.
To pick an instructive tangible evidence example, last month appellate Judge Richard Posner wrote a fascinating decision that shows the legal mind in its most subtle workings. In U.S. v. Simms, the defendant challenged the inclusion of evidence that stemmed from a warranted search of his home and vehicle. The probable cause that led to the warrant was the discovery in the defendant’s trash of marijuana cigarette butts. The defendant argued that the search leading to the warrant was a violation of the Fourth Amendment, since the trash can was behind a high fence on his property.
Courts have held that once trash is taken to the curb, the defendant has no “reasonable” expectation of privacy and therefore is deemed to consent to a police officer’s search of that trash. But trash cans behind a fence are generally protected by the Fourth Amendment, subject to several other exceptions.
Here Judge Posner noted that the defendant’s city had an ordinance that prohibited taking the trash to the curb during the winter, out of concern that cans would interfere with snow plowing. Instead, the “winter rules” require that trash collectors take the cans from the resident’s property, and that the residents leave a safe and unobstructed path to wherever the cans are stored. Since the winter rules were in effect, and the cans were left behind a fence but the gate was left open (perhaps stuck in the snow), and the police searched them on trash pickup day, the search did not violate the defendant’s reasonable expectation of privacy.
For better or worse, this is the kind of analysis judges must perform in the post-Katz era, when much of what we consider to be private is not memorialized in papers or other physical effects but which is likely to be intangible—the state of our blood chemistry, information stored in various data bases, heat given off and detectable by infrared scanners.
The good news is that the Warshak case is a big step in including digital information under that understanding of the Fourth Amendment. Search and seizure is evolving to catch up with the reality of our digital lives.
The Technology Liberation Front is the tech policy blog dedicated to keeping politicians' hands off the 'net and everything else related to technology.