7.1.1 Was the Search or Seizure Conducted by a Government Entity or Government Agent?

The Fourth Amendment only restricts searches and seizures that are conducted by a government entity or by a government agent that is acting for the government. Like the other constitutional rights, the Fourth Amendment is subject to what is known as the state action doctrine: it only restricts the actions of the government, and not of a private party. For instance, the government likely would violate the First Amendment by prohibiting Internet service providers from allowing their users to promote certain politicians on their websites. However, if the Internet service provider chose to prohibit its users from posting that content on their websites, the users would not be able to challenge that prohibition as a violation of the First Amendment. That is because the Internet service provider, acting independently, is not a state actor.¹ The logic holds for the Fourth Amendment.

It is fairly simple to determine whether a government entity has conducted a search or seizure. In the United States, any federal, state, or local government agency or department is fully subject to the limits of the Fourth Amendment. For instance, if law enforcement officers obtain the email of a Los Angeles resident, they are subject to the Fourth Amendment regardless of whether they work for the Los Angeles Police Department, the California State Police, or the Federal Bureau of Investigation.

The more difficult question arises when a criminal defendant alleges that a government agent conducted a search. This is a particularly tricky task in cyber-related Fourth Amendment cases, since cyber infrastructure often is controlled by private companies that, at times, work with the government. In 1989, the United Supreme Court ruled that “[a]lthough the Fourth Amendment does not apply to a search or seizure, even an arbitrary one, effected by a private party on his own initiative, the Amendment protects against such intrusions if the private party acted as an instrument or agent of the Government.”²

The Supreme Court has not defined precisely what it means to be an “instrument or agent” of the government. Lower courts have confronted the issue, and although their definitions vary somewhat, they generally have held that courts should consider the following factors when determining whether a private party acted as a government agent in conducting a search:

• If the government instigated the private party's search of the individual.
• The degree to which the government participated in the search.
• The degree of control that the government exercised over the search.
• Whether the private party was motivated by its own business interests or by the government.³

The “government agent” issue arises frequently in government prosecutions for online child pornography crimes. This is because the government often gathers evidence through a system established by federal law, which involves the participation of Internet service providers, the government, and a nonprofit organization, the National Center for Missing and Exploited Children (NCMEC).

If online service providers (e.g., email services or Internet service providers) obtain actual knowledge that a customer appears to have violated federal child pornography laws, they are required by federal law to file a report with NCMEC.⁴ NCMEC then reviews the report, as well as the apparent child pornography content, and if it determines that the content is in fact child pornography, it provides information to local, state, or federal law enforcement agencies. The federal law also provides legal immunity to the online service providers for their fulfillment of this duty, so that they cannot be sued for filing a NCMEC report if a customer appears to be exchanging child pornography on their services.⁵

Online service providers are not required to take any affirmative steps to look for child pornography. They are only required to file reports if they discover it on their services. Many service providers, however, voluntarily use automated hash scanning in an attempt to prevent their use of services for illegal content. Often, the online services compare hash values of all user content with a NCMEC database of the hash values of known child pornography images.

When these automated searches lead to criminal prosecutions under federal child pornography laws, criminal defendants often challenge the admissibility of the evidence. They argue that the online service provider and NCMEC conducted a search of their private email or other online content, and that the warrantless search violated the Fourth Amendment. Courts typically have rejected such arguments, but occasionally have been open to hearing defendants' Fourth Amendment claims in such cases.

For instance, in United States v. Richardson,⁶ AOL used its image detection and filtering process (IDFP) to automatically scan hashes of customers' email content with NCMEC's database of hashes from known child pornography images. AOL detected a match for the email of its customer, Thomas McCoy Richardson, and filed a NCMEC report, as required by federal law. NCMEC provided the information to North Carolina state police, who investigated and eventually discovered dozens of child pornography images and videos on Richardson's computer, leading Richardson to admit to police that he viewed child pornography. Richardson was charged with federal child pornography crimes, and moved to suppress both the images and his statements, arguing that they were obtained due to a warrantless search of his AOL account. The gravamen of his argument was that AOL acted as a government agent when it scanned his account and reported the images to NCMEC, and therefore violated the Fourth Amendment by conducting the search without a warrant. The U.S. Court of Appeals for the Fourth Circuit concluded that AOL was not a government agent and therefore was not subject to the Fourth Amendment warrant requirement. First, the court reasoned, the government agents had absolutely no control over AOL's search, and noted that no government agent even asked AOL to conduct the search of Richardson's email.⁷ Relatedly, the court reasoned, Richardson presented no evidence that AOL conducted the search with the intent to help the government in a child pornography investigation. Richardson argued that the mandatory reporting requirement in federal law effectively transformed AOL into a government agent. The Fourth Circuit rejected this argument, reasoning that the law does not, in any way, obligate AOL to conduct the search in the first place. In fact, the statute explicitly states that providers are not obligated to conduct such searches.

In similar Fourth Amendment challenges in child pornography cases, other courts reached similar conclusions in cases in which the defendants have claimed that Internet service providers were government agents. Courts routinely hold that service providers have legitimate business interests – independent of the government – to automatically scan content and keep their services free of child pornography.⁸

A more difficult question arises when child pornography defendants argue not only that the online service providers acted as government agents, but that NCMEC also is a government agent. That is a tougher call, because NCMEC receives federal government funding and operates for the primary purpose of protecting children from exploitation. In United States v. Keith,⁹ David Keith sought to suppress evidence collected in a search of his home and computer. The warrant for the search was supported, in part, by evidence of child pornography detected by AOL via its automated scanning of customer email accounts and included in a NCMEC report, which was used by state police in an investigation that eventually led to federal child pornography charges. Unlike other defendants, who only argued that their ISP acted as a government agent, Keith argued that both AOL and NCMEC were government agents and therefore subject to the Fourth Amendment. The federal court swiftly dismissed Keith's claim that AOL was a government agent, concluding that “AOL is motivated by its own wholly private interests in seeking to detect and deter the transmission of child pornography through its network facilities.”¹⁰ However, the court agreed with Keith's argument that NCMEC was a government agent. The court noted that the statute authorizing the NCMEC reporting program refers to the program as a “partnership” between NCMEC and the government, and that its examination of the files provided by AOL was “conducted for the sole purpose of assisting the prosecution of child pornography crimes.”¹¹ Although AOL acted as a private party in scanning the content, the court reasoned, NCMEC was a government agent when it expanded on the search. However, the court did not suppress the evidence collected in the search of his home because warrant also relied on evidence of child pornography provided by Staples employees who incidentally discovered child pornography images while repairing Keith's laptop.

The Keith opinion quickly set off alarms in the community of law enforcement, advocacy groups, and technology companies that seek to prevent the use of online services to distribute child pornography. For now, the Keith opinion is an outlier, but it serves as an important reminder that if private entities work too closely with the government on cybercrime issues, they could be subject to the Fourth Amendment warrant requirement.

7.1.2 Did the Search or Seizure Intrude Upon an Individual's Privacy Interests?

If a government entity or government agency conducted a search or seizure, the Fourth Amendment applies only if the search or seizure invaded the individual's privacy interests. In other words, did the individual have a reasonable expectation of privacy?

For electronic surveillance, the answer to this question traces back to a 1967 United States Supreme Court case, Katz v. United States.¹² FBI agents, acting without a search warrant, installed a wiretap on a public payphone and heard the defendant discussing his illegal wagering operations. The defendant argued that his conviction was invalid because the FBI needed a warrant to conduct the surveillance. Until this decision, courts generally had focused on the physical characteristics of a search when determining whether the government invaded a constitutionally protected interest. In this case, the government argued that the defendant had no reasonable expectation of privacy because the defendant made the phone call from a public phone booth that was partly glass, so that he could be seen by passersby while he was making the call. However, the Court found this argument unpersuasive, reasoning that “what he sought to exclude when he entered the booth was not the intruding eye – it was the uninvited ear.”¹³ The government also argued that the Fourth Amendment did not apply to the wiretap because the FBI did not physically penetrate the phone booth. The Court rejected this argument as well, concluding that “the Fourth Amendment protects people—and not simply ‘areas'—against unreasonable searches and seizures,” and that “the reach of that Amendment cannot turn upon the presence or absence of a physical intrusion into any given enclosure.”¹⁴ The Court reversed the defendant's conviction, concluding that the Fourth Amendment did, in fact, apply to electronic surveillance:

The Government's activities in electronically listening to and recording the petitioner's words violated the privacy upon which he justifiably relied while using the telephone booth and thus constituted a “search and seizure” within the meaning of the Fourth Amendment. The fact that the electronic device employed to achieve that end did not happen to penetrate the wall of the booth can have no constitutional significance.¹⁵

The conclusion in the Katz case is among the most significant developments in Fourth Amendment history because it took the Fourth Amendment out of the exclusively physical realm, and recognized that individuals could have a reasonable expectation of privacy in information. Katz set the groundwork for the modern Fourth Amendment disputes involving government surveillance of telephones, email, and other electronic communications.

It is important to note that the Supreme Court in Katz did not conclude that individuals automatically have a reasonable expectation of privacy in all electronic communications. In an oft-cited concurrence in Katz, Justice Harlan articulated a two-prong test to determine whether a reasonable expectation of privacy exists for Fourth Amendment purposes:

1. whether the individual “exhibited an actual (subjective) expectation of privacy,”¹⁶ and
2. whether that subjective expectation of privacy is “one that society is prepared to recognize as ‘reasonable.’”¹⁷

In other words, under this two-pronged test, the Fourth Amendment only protects an individual if that individual actually expected privacy and that expectation is reasonable. In Katz, the Court concluded that the defendant expected that his phone conversation would be private, and that objectively, this expectation was reasonable.

For electronic surveillance, among the biggest obstacles to finding a reasonable expectation of privacy is the third-party doctrine. Under this doctrine, individuals do not have a Fourth Amendment reasonable expectation of privacy in information once they have disclosed that information to an outside party. For instance, if John tells Jane a secret, and then Jane voluntarily provides that secret information to the police, John cannot claim that the police violated his Fourth Amendment rights by obtaining the information without a warrant. Of course, in the context of electronic surveillance, the third-party doctrine often is more difficult to parse.

The third-party doctrine, in the electronic surveillance realm, emerged in a 1979 United States Supreme Court case, Smith v. Maryland.¹⁸ In that case, the telephone company, at the request of the police, installed a pen register at its offices to document the numbers that were called by a robbery suspect. The police did not obtain a warrant for the pen register. Based on the information collected through the pen register, the police obtained a warrant to search the defendant's home, and he eventually was convicted of robbery. The United States Supreme Court distinguished this case from Katz, because the pen registers only obtain lists of phone numbers, and not the contents of the communications. This distinction is crucial, the Court reasoned, because people understand that they are voluntarily conveying the phone number that they are calling to the phone company. Therefore, under the first prong of Justice Harlan's Katz test, they should not have an actual expectation that the phone number is private:

All telephone users realize that they must “convey” phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are completed. All subscribers realize, moreover, that the phone company has facilities for making permanent records of the numbers they dial, for they see a list of their long-distance (toll) calls on their monthly bills.¹⁹

Moreover, the Court reasoned, even if individuals had a subjective expectation that the phone numbers that they dialed would remain private, such an expectation would be objectively unreasonable:

When he used his phone, petitioner voluntarily conveyed numerical information to the telephone company and “exposed” that information to its equipment in the ordinary course of business. In so doing, petitioner assumed the risk that the company would reveal to police the numbers he dialed. The switching equipment that processed those numbers is merely the modern counterpart of the operator who, in an earlier day, personally completed calls for the subscriber.²⁰

Smith v. Maryland is perhaps the most significant limit on the Fourth Amendment rights created by Katz. It has been used by advocates of the National Security Agency to justify its bulk metadata collection program – though the United States Supreme Court has not yet ruled on that issue. Under the doctrinal rule of Smith v. Maryland, NSA's program of collecting certain noncontent information of email and phone calls should similarly be exempt from Fourth Amendment scrutiny (and therefore not subject to a warrant requirement). But NSA critics argue that the Supreme Court, in 1979, did not anticipate the bulk collection of millions of sets of metadata when it decided Smith v. Maryland.

A more difficult issue arises when individuals use an intermediary to communicate electronic information, such as email. Does the protective rule of Katz apply? Or does Smith's third-party doctrine prevent the application of the Fourth Amendment to government attempts to obtain stored email?

The United States Supreme Court has not addressed the issue directly. However, in 2010, the U.S. Court of Appeals for the Sixth Circuit addressed the issue in United States v. Warshak.²¹ In that case, the government obtained thousands of emails from the ISP of a corporate executive, to help bring a fraud case against the executive. The government had not obtained a search warrant for the emails; instead, it used a simple subpoena, and the defendant did not receive notice until more than a year after the email was disclosed. The Sixth Circuit held that although the Stored Communications Act (discussed below) did not require a warrant for the emails at issue, the Fourth Amendment did. The Court reasoned that the government must obtain a warrant to obtain paper mail delivered via the postal service, and “[g]iven the fundamental similarities between email and traditional forms of communication, it would defy common sense to afford emails lesser Fourth Amendment protection.”²² Due to the Warshak decision, law enforcement in the Sixth Circuit – Kentucky, Michigan, Ohio, and Tennessee – is required under the Fourth Amendment to obtain warrants before compelling the disclosure of emails, regardless of the length of time it has been stored. But Warshak is not binding in other parts of the United States. Since Warshak, federal prosecutors and law enforcement have been more likely to seek warrants for all emails, but they maintain that they are not required to do so.²³

Other newer forms of surveillance technologies demonstrate the difficulty of applying the third-party doctrine. A number of courts have been asked to suppress evidence that law enforcement obtained via the warrantless collection of cell site information. Such information may enable law enforcement to pinpoint a suspect's location at a particular time, often providing probable cause for an arrest or a warrant to search a residence. At issue in these cases is whether the individual had a reasonable expectation of privacy in the cell site information. In recent years, courts have overwhelmingly held that, under the third-party doctrine, the Fourth Amendment does not require warrants for such searches. The U.S. Court of Appeals for the Sixth Circuit – which issued the Warshak opinion protecting email content from warrantless searches – declined to extend Fourth Amendment protections to cell site data.²⁴ As with the call logs in Smith, the Court reasoned, cell site data does not reveal information about content and therefore is not subject to the Fourth Amendment:

Instead the records include routing information, which the wireless providers gathered in the ordinary course of business. Carriers necessarily track their customers' phones across different cell-site sectors to connect and maintain their customers' calls. And carriers keep records of these data to find weak spots in their network and to determine whether roaming charges apply, among other purposes. Thus, the cell-site data – like mailing addresses, phone numbers, and IP addresses – are information that facilitate personal communications, rather than part of the content of those communications themselves. The government's collection of business records containing these data therefore is not a search.²⁵

There is a growing movement to reconsider the third-party doctrine because it makes little sense in the cyber age. Notably, in United States v. Jones,²⁶ the United States Supreme Court reversed the conviction of a criminal defendant because the evidence used against him was obtained via the warrantless installation of a GPS tracking device on his car. The majority opinion focused on the physical intrusion caused by the government's installation of the device on his property. Perhaps even more notable than the majority opinion was Justice Sotomayor's concurrence, in which she suggested that the Court should reconsider the third-party doctrine altogether:

This approach is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers … [W]hatever the societal expectations, they can attain constitutionally protected status only if our Fourth Amendment jurisprudence ceases to treat secrecy as a prerequisite for privacy. I would not assume that all information voluntarily disclosed to some member of the public for a limited purpose is, for that reason alone, disentitled to Fourth Amendment protection.²⁷

Justice Sotomayor's concurrence was noteworthy because, if it eventually is adopted by the majority, it would undercut decades of Fourth Amendment jurisprudence and expose a wide range of information to Fourth Amendment protection, even if it was disclosed to third parties.

7.1.3 Did the Government have a Warrant?

If a government entity or government agent has conducted a search that invades a protected interest (i.e., where the individual had a reasonable expectation of privacy), the government typically must have a warrant supported by probable cause in order to comply with the Fourth Amendment. A warrant must be issued by a “neutral magistrate,” who in some cases may be a judge, but also may be a magistrate whose primary job is to determine whether law enforcement has presented probable cause that the search will yield evidence that a crime has or will be committed. Typically, the neutral magistrate bases the probable cause determination on an affidavit that law enforcement submits along with the search warrant request.

The United States Supreme Court has stated that the purpose of a warrant is to assure the citizen “that the intrusion is authorized by law, and that it is narrowly limited in its objectives and scope.”²⁸ The “detached scrutiny” of a neutral magistrate “ensures an objective determination whether an intrusion is justified in any given case,” the Court has stated.²⁹

Generally, if a neutral magistrate issues a search warrant, it is very difficult for a defendant to later seek to suppress evidence gathered from the search on Fourth Amendment grounds. In United States v. Leon,³⁰ a criminal defendant in a drug case sought to suppress evidence that was collected under a search warrant that he claimed to not be supported by probable cause. The United States Supreme Court declined to suppress the evidence, even though the warrant was not supported by probable cause. Because the police conducted the search in good faith pursuant to a warrant that they believed to be valid, the Court concluded that it should not suppress the evidence gathered by the search. The “good-faith” exception makes it incredibly difficult to challenge a magistrate's probable cause determination, absent extreme recklessness or deceptive behavior by law enforcement.

One barrier to the use of warrants, however, is the “particularity” requirement. If a magistrate judge issues a warrant, the warrant must satisfy the Fourth Amendment's explicit requirement for particularity, describing the place to be searched as well as the persons or things to be seized.³¹ This does not necessarily mean that the warrant describe the precise evidence that law enforcement expects to collect.³² In determining whether a warrant satisfied the particularity requirement, courts consider “(1) whether probable cause exists to seize all items of a particular type described in the warrant; (2) whether the warrant sets out objective standards by which executing officers can differentiate items subject to seizure from those which are not; and (3) whether the government was able to describe the items more particularly in light of the information available to it at the time the warrant was issued.”³³

Courts have recognized the difficulty of applying the particularity requirement to cyber searches, and generally are deferential to law enforcement and magistrates. For instance, in United States v. Adjani,³⁴ the U.S. Court of Appeals for the Ninth Circuit refused to suppress evidence collected under a warrant that allowed the search and seizure of, among other things, “[a]ny computer equipment and storage device capable of being used to commit, further, or store evidence of the offense listed above.”³⁵ The defendants argued that rather than allowing a “wholesale search” of their email, the warrant should have specified search terms. The court sympathized with this argument, but ultimately concluded that to “require such a pinpointed computer search, restricting the search to an email program or to specific search terms, would likely have failed to cast a sufficiently wide net to capture the evidence sought.”³⁶ The court reasoned that computer files “are easy to disguise or rename,” and therefore an overly limited search warrant would prevent law enforcement from collecting evidence.³⁷ Although search warrants for email and other electronic evidence must have some particularity, courts recognize that law enforcement needs some leeway to conduct legitimate searches of the vast amounts of electronic data.

7.1.4 If the Government did not have a Warrant, did an Exception to the Warrant Requirement Apply?

If the government entity or a government agent conducts a warrantless search or seizure that invades a protected interest, the government must demonstrate that an exception to the warrant requirement applies. If the government does convince the court that an exception applies, the evidence collected as a result of the search will be suppressed.

The courts have articulated a number of exceptions to the warrant requirement. Among the most commonly cited exceptions are:

• the individual provided consent for the search;³⁸
• the evidence is in plain view (i.e., from the street, the police could see marijuana plants in the defendant's yard);³⁹
• police have probable cause to search an automobile (a recognition that given the mobility of cars, it is difficult to obtain a warrant before searching them);⁴⁰
• exigent circumstances;⁴¹
• programmatic searches and special needs unrelated to routine law enforcement purposes (i.e., drunk driving checkpoints, border searches, searches of students' lockers in schools, searches of parolees, and searches at large public gatherings to reduce the risk of terrorism);⁴² and
• searches incident to a lawful arrest, if the search is necessary to prevent the destruction of evidence or detainees escape, or harm to the police officer.⁴³

In 2014, the United States Supreme Court issued its opinion in Riley v. California.⁴⁴ The decision, involving the search incident to lawful arrest exception, has had a significant impact on cyber-related searches. When David Leon Riley was lawfully arrested for firearms possession, the police seized his smartphone, searched the text messages on the phone, and found messages that indicated that Riley was associated with a street gang. Riley was convicted for various gang-related offenses, and sought to overturn his conviction, arguing that the police conducted a warrantless search of his phone. The Court agreed with Riley and reversed his conviction, concluding that the search incident to lawful arrest exception did not apply to cell phones. The exception applies when there is a concern that the arrestee will harm officers or destroy evidence; the Court reasoned that neither concern is present in the case of a cell phone. The police could seize the cell phone, and obtain a warrant to search it. There was no danger that the data would be destroyed. Particularly notable about the majority opinion, written by Chief Justice Roberts, was the strong language that the Court used to caution law enforcement against warrantless searches of data:

Our cases have recognized that the Fourth Amendment was the founding generation's response to the reviled “general warrants” and “writs of assistance” of the colonial era, which allowed British officers to rummage through homes in an unrestrained search for evidence of criminal activity. Opposition to such searches was in fact one of the driving forces behind the Revolution itself. In 1761, the patriot James Otis delivered a speech in Boston denouncing the use of writs of assistance. A young John Adams was there, and he would later write that “[e]very man of a crowded audience appeared to me to go away, as I did, ready to take arms against writs of assistance.” According to Adams, Otis's speech was “the first scene of the first act of opposition to the arbitrary claims of Great Britain. Then and there the child Independence was born.”

Modern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold for many Americans “the privacies of life,” The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought. Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple — get a warrant.⁴⁵

The Riley opinion likely will have impacts that reach far beyond cases involving searches incident to lawful arrests. It is perhaps the Supreme Court's strongest statement, since Katz, in opposition to the government's warrantless searches of criminal suspects' information. Riley is a clear indication that the Supreme Court believes that the Fourth Amendment applies just as much to electronic information as it does to physical objects. Although the case involved a relatively narrow issue related to the search of an arrestee, it likely will have a large impact on a wide range of future cyber-related Fourth Amendment cases.

7.1.5 Was the Search or Seizure Reasonable under the Totality of the Circumstances?

The Fourth Amendment protects individuals against “unreasonable” searches and seizures. If the government obtains a warrant, it is generally presumed to be reasonable.⁴⁶ If, however, a warrantless search is conducted under an exception to the warrant requirement, the government still must demonstrate that the search was “reasonable” and therefore did not violate the Fourth Amendment.⁴⁷

To assess reasonableness of a search, courts conduct a “totality of the circumstances” analysis of the search, in which they evaluate “on the one hand, the degree to which it intrudes upon an individual's privacy and, on the other, the degree to which it is needed for the promotion of legitimate governmental interests.”⁴⁸

Courts have great leeway in determining the weight that they will accord to these often-competing values. A recent application, relevant to cyber searches, arose in the case of Jamshid Muhtorov, a legal permanent resident of the United States who was charged with providing material support to a designated terrorist organization. The government notified Muhtorov that it planned to use evidence that it collected under Section 702 of the FISA Amendments Act of 2008, a program (colloquially known as “PRISM”) that allows federal intelligence agencies to conduct electronic surveillance of targets who are believed to be located outside of the United States and are not United States citizens. Although Muhtorov was located within the United States, the target of the surveillance apparently was not believed to be in the United States, and therefore the communications were collected under Section 702 (the contents of the communications was classified and not included in the court opinion). Muhtorov asked the court to suppress the evidence collected under Section 702, arguing that it violated his Fourth Amendment rights.

A Colorado federal judge denied Muhtorov's motion to suppress. After concluding that foreign intelligence gathering falls within the “special needs” exception to the warrant requirement (a conclusion reached by many other federal courts, but never addressed directly by the United States Supreme Court), the Colorado judge concluded that under the totality of the circumstances, the search was reasonable. The judge concluded both that Section 702, on its face, is constitutional, and that it was constitutionally applied to Muhtorov. Key to the judge's ruling was an extensive set of “minimization procedures” that the government uses to weed out information that is not related to foreign intelligence and to reduce the likelihood of searches being conducted of people who are either U.S. citizens or located in the United States. “I conclude on the record before me that a proper and supported application was filed, and that the targeting and minimization procedures forwarded were tailored to the government's legitimate foreign intelligence purposes and took into account the privacy interests of individuals whose communications would be incidentally acquired,” the judge wrote.⁴⁹

Ultimately, unless the Supreme Court has explicitly found a specific government practice to be reasonable or unreasonable, courts have a great deal of leeway under the totality of the circumstances framework. Whether the government's needs outweigh the individual's privacy interests ultimately is a value judgment that likely will vary by court and judge. Accordingly, it often is difficult to predict, with certainty, whether a government search or seizure comports with the Fourth Amendment. This is particularly true with cyber searches, which often involve novel factual issues that have not yet been addressed by other courts.

7.2.1 Stored Communications Act

Data that is stored on a computer, server, or the cloud – such as email and files – may be covered by the Stored Communications Act (SCA). As the U.S. Court of Appeals for the Ninth Circuit observed, the SCA “reflects Congress's judgment that users have a legitimate interest in the confidentiality of communications in electronic storage at a communications facility.”⁵¹

The SCA, passed in 1986, covers three general categories: (1) access to stored communications;⁵² (2) voluntary disclosure of stored communications by service providers;⁵³ and (3) law enforcement agency's attempts to compel service providers to disclose stored communications.⁵⁴

The first category can be seen as a supplement to the Computer Fraud and Abuse Act, which is described in Chapter 5. Indeed, criminal charges against computer hackers often are brought under both the SCA and CFAA. The second category involves the restrictions placed on a service provider's ability to disclose its users' information. In many ways, this is analogous to a privacy law. The third category limits the government's ability to require service providers to provide users' information. This section will consider each of these SCA categories in turn.

Before examining each of these three categories, it is important to understand the scope of the SCA's applicability. The SCA applies to two types of services: electronic communications services (ECS) and remote computing services (RCS). The definitions of these services are important, because the SCA imposes different requirements depending on whether a service is classified as an ECS or RCS. In many cases, a service provider may be both an ECS and an RCS.⁵⁵

The SCA defines ECS as “any service which provides to users thereof the ability to send or receive wire or electronic communications,”⁵⁶ which are the “transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce.”⁵⁷ Many courts have held that unopened emails stored on servers or the cloud fall within the definition of ECS.⁵⁸ Similarly, a secured website that is used to communicate has been held to be an ECS.⁵⁹ Moreover, courts have held that Internet access, provided by Internet service providers, are an ECS,⁶⁰ as are cell phone service providers.⁶¹

The SCA defines RCS as “the provision to the public of computer storage or processing services by means of an electronic communications system,” which it defines as “(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.”⁶² Keep in mind that Congress passed the SCA in 1986 – long before the modern era of cloud computing. When passing the SCA, the Senate issued a report in which it provided the following explanation of its reasons for explicitly covering RCS:

In the age of rapid computerization, a basic choice has faced the users of computer technology. That is, whether to process data inhouse on the user's own computer or on someone else's equipment. Over the years, remote computer service companies have developed to provide sophisticated and convenient computing services to subscribers and customers from remote facilities. Today businesses of all sizes — hospitals, banks and many others — use remote computing services for computer processing. This processing can be done with the customer or subscriber using the facilities of the remote computing service in essentially a time-sharing arrangement, or it can be accomplished by the service provider on the basis of information supplied by the subscriber or customer. Data is most often transmitted between these services and their customers by means of electronic communications.⁶³

Although information technology habits have changed since 1986, the Senate's general explanation of the use of “remote facilities” continues to apply to the definition of RCS. Services such as cloud computing and data centers – in which data is stored remotely for long-term use – fall under the definition of RCS. In some cases, it may not be entirely clear whether a service is an ECS or RCS.⁶⁴ For instance, email that is opened and then stored for many years – as is common practice – has been argued to be both RCS or ECS. The confusion largely is due to the fact that the SCA was enacted in 1986, a time when remote storage was limited, and it therefore was inconceivable to remotely store opened email for a long period of time. But the distinction between RCS and ECS is vital. As we will see, the designation may play an important role in determining the privacy protections that the SCA affords to a service's users.

7.2.2 Wiretap Act

As its name suggests, the Stored Communications Act restricts the disclosure and procurement of communications that are stored on a medium (e.g., a server). In contrast, the Wiretap Act¹⁰¹ restricts the ability for the government and private parties to intercept communications as they are in transit.

The Wiretap Act was passed as Title III of the Omnibus Crime Control and Safe Streets Act of 1968 in response to the United States Supreme Court's ruling in Katz v. United States¹⁰² that the Fourth Amendment restricts the government's use of wiretaps to eavesdrop on telephone calls.¹⁰³

The Wiretap Act contains a broad, general prohibition on the intentional interception, procurement, and use of electronic, wire, or oral communications.¹⁰⁴ The statute also prohibits the intentional interception or disclosure of the contents of unlawfully intercepted communications.¹⁰⁵ As the U.S. Court of Appeals for the Eleventh Circuit accurately summarized, a typical claim of a Wiretap Act violation consists of a demonstration that the defendant “(1) intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication (5) using a device.”¹⁰⁶ The Wiretap Act uses the same definition of “contents” as the SCA: “any information concerning the substance, purport, or meaning of that communication.”¹⁰⁷ Courts generally have broadly interpreted this definition to include personally identifiable information such as names and birthdates.¹⁰⁸ However, data automatically generated about the call, such as the call time and duration, is not considered “content” that is covered by the Wiretap Act.¹⁰⁹

Violations of the Wiretap Act carry criminal fines and prison time of up to five years. The statute also allows the victims of Wiretap Act violations to file civil lawsuits for damages and equitable relief.¹¹⁰

The Wiretap Act's broad prohibitions contain a number of exceptions.

First, the Wiretap Act does not prohibit an employee of a communications provider from intercepting, disclosing, or using communications for any activity “which is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service.”¹¹¹ As one court noted, this exception “has been repeatedly interpreted by Courts to authorize telephone companies to intercept and monitor calls placed over their facilities in order to combat fraud and theft of service.”¹¹² Similarly, this exception enables employers to monitor employee email accounts without facing Wiretap Act charges.¹¹³

Second, communications providers may provide information to the government as authorized by the Foreign Intelligence Surveillance Act, which sets the framework for collection of foreign intelligence information from U.S. infrastructure.¹¹⁴

Third, a law enforcement officer who is party to a communication is not subject to the Wiretap Act's prohibitions.¹¹⁵ Relatedly, the Wiretap Act does not restrict law enforcement if at least one party to the communication has provided consent.¹¹⁶ In other words, if one of the parties to a phone conversation or email exchange is an undercover officer, or a private party acting on behalf of law enforcement, then the Wiretap Act would not restrict the government's interception of that phone call.

Fourth, a private individual may intercept a communication if that individual is a party to the communication, or if the person is party to the communication, or if one of the parties provided consent.¹¹⁷ However, this exception does not apply if the interception is conducted to commit a criminal or tortious act that violates a state or federal law. For instance, some states have imposed “two-party consent” laws that require consent from all parties to a communication before wiretapping is permitted.¹¹⁸

The most significant exception to the Wiretap Act, for government purposes, allows law enforcement to seek a court order for the interception of wire, oral, or electronic communications.¹¹⁹ Under this exception, law enforcement must fulfill a number of requirements before obtaining an order that allows them to intercept communications.

Applications for wiretap orders must contain the identity of the officer seeking the information, a “full and complete statement of the facts,” including:

(i) details as to the particular offense that has been, is being, or is about to be committed, (ii) [when possible] a particular description of the nature and location of the facilities from which or the place where the communication is to be intercepted, (iii) a particular description of the type of communications sought to be intercepted, (iv) the identity of the person, if known, committing the offense and whose communications are to be intercepted.¹²⁰

The application also must describe whether other investigative procedures have been attempted, the period of time for which interception has been attempted, and a statement concerning previous applications for wiretaps.¹²¹

After reviewing the application, the judge may grant the order only after finding that there is probable cause to believe that the target of the wiretap is committing, has committed, or soon will commit a particular serious criminal offense and that there is probable cause to believe that communications concerning the offense will be obtained via the wiretap.¹²² The court also must find that normal investigative procedures that do not require a wiretap either have failed or reasonably appear unlikely to result in information about the offense.¹²³ The court also generally must find that there is probable cause to believe that the Internet connection or other communications facility that is being wiretapped is being used by the target of the investigation.¹²⁴

In short, before a court will grant a wiretap order, it must determine that probable cause exists for three different elements: (1) that the target has committed, is committing, or soon will commit a crime; (2) that the wiretap will lead to information about this crime; and (3) that the target will use the communications facilities specified in the wiretap application. This is a relatively high standard to meet. As one court held, probable cause for a wiretap application requires a “reasonable and common sense” evaluation of all of the facts:

Under this standard, the question that must be decided in issuing a warrant is whether there is probable cause to believe that evidence of a crime will be uncovered. Obviously, certainty is not required at this stage, and the exact quantum of support required has frequently been described as “a fair probability,” but more than a “mere suspicion,” that such evidence will be discovered. Facts can amount to a fair probability without being proof beyond a reasonable doubt or even a prima facie showing.¹²⁵

In other words, although a court need not be certain that the wiretap will uncover evidence of a crime, law enforcement must make a substantial showing in order to obtain a wiretap order.

A wiretap order may be authorized for no longer than thirty days.¹²⁶ If law enforcement needs an extension, then it must seek an extension of up to thirty days. As one federal appeals court stated, the Wiretap Act intends law enforcement “to adopt minimization techniques to reduce to a practical minimum the interception of conversations unrelated to the criminal activity under investigation.”¹²⁷

Although the Wiretap Act traditionally applied to the interception of phone calls, it also limits the ability of private parties and law enforcement to intercept electronic communications while in transit. Accordingly, the Wiretap Act applies not only to phone calls, but to email messages, instant messages, text messages, and other communications that are intercepted while in transit.¹²⁸

The Cybersecurity Act of 2015, discussed above, has the potential to significantly enhance the ability of private entities to monitor systems and networks for cybersecurity threats. As discussed above, the Cybersecurity Act allows organizations to monitor their systems and networks – and the systems and networks of others who have provided consent – for “cybersecurity purposes,” which is intended to protect systems from a cybersecurity threat or security vulnerability.

Consider a large Internet service provider that constantly confronts malware that slows down its systems and threatens the online security of its customers. The Cybersecurity Act of 2015 enables the ISP to monitor the email and other communications of its users, to the extent that this monitoring is conducted exclusively for “cybersecurity purposes.” Because the law was recently passed, we do not yet have clear guidance from courts as to how they will interpret the phrases “cybersecurity purpose,” “cybersecurity threat,” and “security vulnerability.” Even if courts do adopt a broad interpretation of the phrase, companies must ensure that all scanning is conducted for that purpose, and that cybersecurity is not merely a pretext for another reason for monitoring.

7.2.3 Pen Register Act

As described in Section 7.1, the United States Supreme Court has held that the Fourth Amendment does not restrict the government's use of pen registers to obtain noncontent information, such as logs of telephone numbers and other metadata. In response to this ruling, Congress in 1986 passed Chapter 206 of ECPA, known as the Pen Register Act.

The Pen Register Act restricts the collection of noncontent communications data by the government and private parties. The statute applies to “pen registers,” which it defines as devices or processes that record “dialing, routing, addressing, or signaling information” of a wire or electronic communication.¹²⁹ It also applies to “trap and trace devices,” which record the metadata of incoming communications.¹³⁰

The Pen Register Act does not apply to the contents of communications – those are regulated under the Stored Communications Act and Wiretap Act. In 2001, as part of the PATRIOT Act, Congress amended the Pen Register Act to clarify that it applies to the metadata of electronic communications, such as email. However, the subject line of emails is typically considered to be content, and therefore is not covered by the Pen Register Act.

The Pen Register Act imposes a general prohibition¹³¹ on the use of pen register and trap and trace devices, with a few key exceptions:

• if the pen register or trap and trace device is related to the “operation, maintenance, and testing” of a communications service;¹³²
• if the pen register or trap and trace device is related to the protection of the communications providers or their users to keep the service fee of abuse or unlawful service use;¹³³
• if the user has consented;¹³⁴ or
• if the government has obtained a court order under Section 3123 of the Pen Register Act.¹³⁵

Section 3123 does not require the government to demonstrate probable cause that a crime has occurred or will occur. Instead, law enforcement must satisfy the more lenient requirement of demonstrating that “information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation.”¹³⁶

A Section 3123 order must specify the identity of the person to whom a telephone line or facility is leased, the identity of the person who is the subject of the investigation, the attributes of the communications to which the order applies, and a statement of the offense to which the information likely to be obtained by the device relates.¹³⁷ The orders may not exceed sixty days and may be extended by new court order for up to sixty days.¹³⁸ Communications providers are prohibited from disclosing the existence of a pen register or trap and trace order unless directed by the issuing court.¹³⁹

7.2.4 National Security Letters

Among the most controversial aspects of the 2001 USA PATRIOT Act, passed after the September 11, 2001, terrorist attacks, was an expansion of the government's ability to issue national security letters. National security letters are administrative subpoenas that allow the government to secretly obtain certain information relevant to national security investigations. It has since been amended modestly to address some concerns of privacy advocates.

The National Security Letter provision of the Stored Communications Act¹⁴⁰ allows the Federal Bureau of Investigation to provide a wire or electronic communication service provider with a name, phone number, or account number and request the associated name, address, length of service, and local and long-distance toll billing records of that person or account. Rather than obtain court approval, an FBI official need only certify in writing that “the name, address, length of service, and toll billing records sought are relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities.”¹⁴¹ If the request does not include local and long-distance toll billing records, the FBI need only certify that the information sought is relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities. The national security letter may not be issued solely due to an individual's First Amendment protected activities (e.g., organizing a lawful protest).¹⁴²

The National Security Letter statute prohibits communications service providers from revealing the existence of a national security letter to any person, provided that the FBI certifies that the absence of a disclosure prohibition would result in a danger to U.S. national security, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person.¹⁴³ If a communications provider receives such a nondisclosure order, it is permitted to disclose the existence of the national security letter to people to whom disclosure is necessary for compliance, an attorney to receive legal advice, or others approved by the FBI.¹⁴⁴ Individuals to whom the providers have disclosed the existence of a national security letter also are bound by the gag order.¹⁴⁵

In 2006 and 2015, Congress amended the National Security Letter statute to allow for a limited form of judicial review.¹⁴⁶ If a service provider receives a nondisclosure order associated with a national security letter, it may notify the government that it wishes to have a court review the order, or filed a petition for review in federal court. Within thirty days of receiving notification, the government must ask a federal court for an order prohibiting disclosure.¹⁴⁷ The application must include a certification from a senior Justice Department or FBI official explaining why an absence of a prohibition on disclosure may result in a danger to U.S. national security, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person.¹⁴⁸ The federal court will approve the nondisclosure order only if it agrees with the government's allegations in its application.¹⁴⁹