The Government Cannot Force E-mail Companies to Copy and Save Your Account ‘Just in Case’

Paper letters have a final resting stop — whomever they are addressed to. From a practical standpoint, and a legal one, that feature of regular mail made understanding and applying privacy protections relatively straightforward. But as our communication technologies have changed, courts have struggled to grant a similar degree of privacy protection to communications in the modern era.

Digital communications present new problems. For example, your email does not live in your letterbox but in an online repository operated by a private company. And as digital communications like email and social media become more ubiquitous in society, investigators increasingly rely on them as important sources of evidence.

Making sure that email gets proper Fourth Amendment protection is one of the ACLU’s priorities. So on Tuesday, we filed a friend-of-the-court brief in the Ninth Circuit Court of Appeals that calls attention to a little-known statute that appears to be giving law enforcement an unconstitutional loophole to exploit in its pursuit of digital evidence. The case involves the warrantless use of law enforcement preservation demands to force email providers to copy and keep an individual’s private communications for up to half a year — without ever asking a judge or meeting a standard of suspicion.

The Fourth Amendment protects our rights in our belongings from arbitrary police power. Before law enforcement can seize our “papers” and “effects,” it must obtain a warrant from a neutral magistrate. In this case, law enforcement unilaterally issued a preservation demand and then took nine months to follow up with a warrant seeking the preserved emails. This prolonged, warrantless seizure is typical of a growing nationwide practice: one where investigators regularly issue secret demands to preserve individuals’ private account data just in case they decide to return with a court order later.

This case highlights how the government has been exploiting an under-examined section of the Stored Communications Act that creates a gaping loophole to Fourth Amendment protections. Section 2703(f) allows the government to force email providers and social media companies to create and store copies of user accounts for a statutory period of 90 to 180 days — without a warrant or just cause.

Unlike the postal service, which merely transmits mail from one address to another, email and social media providers create instant, exact copies of all transmitted messages. Section 2703(f) takes advantage of the stored nature of digital communications by requiring providers to actively copy and store communications and other account data, interfering with the owner’s privacy and property rights and creating a database of private information kept just in case law enforcement decides to come back with a warrant later.

The ostensible purpose of section 2703(f) is to assure investigators that relevant criminal evidence will not be destroyed before they have time to get a warrant. Depending on the facts of a given case, this is a legitimate concern. To address this concern, the SCA states that a “provider . . . shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.” This language appears to mean that every section 2703(f) preservation demand should be, at the very least, tied to the government’s ongoing effort to obtain a warrant to seize and search account information.

This is not the case in practice.

Section 2703(f) permits warrantless seizure of private account data as it allows investigators to force providers to freeze copies of entire accounts wholesale, without describing what specific information is relevant to their investigation. Providers regularly receive tens to hundreds of thousands of 2703(f) demands without ever seeing a warrant.

In the second half of 2018, Facebook received 57,000 preservation demands but only about 34,000 forms of legal process to seize and search account information. Even when the government follows up with a warrant, it often takes much longer than 90 days to do so. Investigators regularly use the statute to force providers to copy and preserve tens or hundreds of thousands of private online accounts just in case a need for the information arises later in the course of an investigation.

The Fourth Amendment accounts for the problem Congress apparently tried to solve with section 2703(f) — that the government might need to access accounts before a user or provider is able to delete incriminating information therein. There is an exception to the warrant requirement of the Fourth Amendment in exigent circumstances. Under this exception, a warrantless seizure can be justified if there is both probable cause and a reasonable likelihood that the evidence will be destroyed while the government is busy applying for a warrant.

But this justification simply does not hold up under section 2703(f). The statute doesn’t require probable cause or any factual basis for the preservation demand. When law enforcement takes longer than 90 days to get a warrant, the claim of exigency does not hold up. It especially does not hold up when law enforcement never returns with a warrant at all.

The Fourth Amendment balances our rights in our communications online and the goals of efficient law enforcement. When it comes to section 2703(f) of the SCA, however, the government undermines that balance by avoiding the requirements of the Fourth Amendment altogether. To seize and search our digital accounts outside an exigent circumstance, whether it takes nine hours or 90 days, the government must get a warrant first.