The Stored Communications Act (SCA), codified at 18 U.S.C. Chapter 121 §§ 2701–2713), is a United States law that addresses voluntary and compelled disclosure of "stored wire and electronic communications and transactional records" held by third-party Internet service providers (ISPs). It was enacted as Title II of the Electronic Communications Privacy Act of 1986 (ECPA).
The SCA creates Fourth Amendment-like privacy protection for email and other digital communications stored on the Internet. It limits the government's ability to compel an ISP to turn over content information and non-content information (such as logs and "envelope" information from email). It also limits the ability of commercial ISPs to reveal content information to non-government entities.
Context The Fourth Amendment to the U.S. Constitution protects the people's right "to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." When applied to information stored online, however, the Fourth Amendment's protections are potentially far weaker. In part, this is because the Fourth Amendment defines the "right to be secure" in spatial terms that do not directly apply to the "reasonable expectation of privacy" in an online context. The Fourth Amendment has been stressed as a right that protects people and not places, which leaves the interpretation of the amendment's language broad in scope. In addition, society has not reached clear consensus over expectations of privacy in terms of more modern (and developing, future) forms of recorded and/or transmitted information.
Furthermore, users generally entrust the security of online information to a third party, an ISP. In many cases, Fourth Amendment doctrine has held that in doing so, users relinquish any expectation of privacy. The third-party doctrine holds "that knowingly revealing information to a third party relinquishes Fourth Amendment protection in that information."Kerr, Orin S., "The Case for the Third-Party Doctrine", Michigan L. Rev., Vol. 107, 2009; GWU Legal Studies Research Paper No. 421. While a search warrant and probable cause are required to search one's home, under the third-party doctrine only the exception of consent (a much lower hurdle than probable cause) are needed to subject an ISP to disclose the contents of an email or of files stored on a server.Kerr, Orin S., "A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It", George Washington L. Rev. (2004). Available at .
As per request by the House Committee on the Judiciary, Subcommittee on Courts, Civil Liberties, and the Administration of Justice, as well as the Senate Committee on Governmental Affairs asking the Office of Technology Assessment (OTA) to create a report about protections surrounding electronic communications, it was found that individuals were at risk. This risk identified current protections for electronic mail as being "weak, ambiguous, or nonexistent."Orin S. Kerr, "A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It," 72 GEO. WASH. L. REV. 1208, 1211–12 (2004). 6 For further discussion of statutory protections afforded to private messages and wall posts, see infra Part II.B.1–2. The report concluded that "[t]he existing statutory framework and judicial interpretations thereof do not adequately cover new and emerging electronic surveillance technologies."For a defense of this doctrine, see Orin S. Kerr, "The Case for the Third-Party Doctrine," 107 MICH. L. REv. 561 (2009). OFFICE OF TECHNOLOGY ASSESSMENT, OTA-CIT-293, FEDERAL GOVERNMENT INFORMATION TECHNOLOGY: ELECTRONIC SURVEILLANCE AND CIVIL LIBERTIES (1985) Congress acknowledged that traditional Fourth Amendment protections were lacking. As a result, the Electronic Communications Privacy Act was enacted in 1986 as an update to the Federal Wiretap Act of 1968, which addressed protections on telephone (land) line privacies. The provisions are distributed into three titles, with Title II being the Stored Communications Act.
Overview Section 2701 (18 U.S.C. § 2701) of the SCA provides criminal penalties for anyone who "intentionally accesses without authorization a facility through which an electronic communication service is provided or … intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished ... ."
Section 2702 (18 U.S.C. § 2702) of the SCA targets two types of online service, "electronic communication services" and "remote computing services." The statute defines an electronic communication service as "any service which provides to users thereof the ability to send or receive wire or electronic communications." A remote computing service is defined as "the provision to the public of computer storage or processing services by means of an electronic communications system." This section also describes conditions under which a public ISP can voluntarily disclose customer communications or records. In general, ISPs are forbidden to "divulge to any person or entity the contents of any communication which is carried or maintained on that service." However, ISPs are allowed to share "non-content" information, such as log data and the name and email address of the recipient, with anyone other than a governmental entity. In addition, ISPs that do not offer services to the public, such as businesses and universities, can freely disclose content and non-content information. An ISP can disclose the contents of a subscriber's communications authorized by that subscriber.18 U.S.C. § 2701(c)(2)
Section 2703 (18 U.S.C. § 2703) of the SCA describes the conditions under which the government is able to compel an ISP to disclose "customer or subscriber" content and non-content information for each of these types of service:
Electronic communication service. If a "wire or electronic communication" has been in electronic storage for 180 days or less, the government must obtain a search warrant. There has been debate over the status of opened emails in storage for 180 days or less, which may fall in this category or the "remote computing service" category. Remote computing service. If a "wire or electronic communication" has been in electronic storage for more than 180 days or is held "solely for the purpose of providing storage or computer processing services" the government can use a search warrant, or, alternatively, an administrative subpoena or a "specific and articulable facts" court order (called a §2703(d) order) combined with prior notice to compel disclosure. Prior notice can be delayed for up to 90 days if it would jeopardize an investigation. Historically, opened or downloaded email held for 180 days or less has fallen in this category, on the grounds that it is held "solely for the purpose of storage." This section also addresses the requirements for a court order for disclosure. It also addresses that no cause of action shall lie in any court against the provider under this chapter.
Section 2704 (18 U.S.C. § 2704) of the SCA describes backup preservation such that an entity operating under 2703(b)(2) may ask for a backup copy of the electronic communications in order to preserve the communications. This backup may be included in the subpoena or court order requirement requested from the ISP.
Section 2705(b) () also provides for gag orders, which direct the recipient of a 2703(d) order to refrain from disclosing the existence of the order or investigation.In Re: Application of the United States of America for an Order Pursuant to 18 U.S.C. Section 2703(d) of January 25, 2013, p. 4, from the Wikileaks-related Twitter subpoenas The court will be able to delay the notification for ninety days if it determines that there is a reason that the court order could have adverse results.
Section 2706 (18 U.S.C. § 2706) of SCA addresses cost reimbursement such that a government entity obtaining communications and records under 2702,2703, or 2704 of the title should pay the party providing the information for incurred costs. The amount should be mutually agreed upon. This requirement is exempt when section (a) does not apply to the records held by the communications carrier.
Section 2707 (18 U.S.C. § 2707) of SCA describes cause of civil action under this title, reliefs in a civil action, damages assessed in a civil action, administrative discipline, defence, limitation, and improper disclosure.
Section 2708 (18 U.S.C. § 2708) of SCA states that the remedies and sanctions are the only judicial remedies and sanctions for violations of the chapter that are not constitutional violations.
Section 2709 ()Is in regards to counterintelligence access to telephone toll and transactional records. Subsection (a) says that a wire or electronic communication service should comply with any request for information, records, electronic communications made by the Federal Bureau of Investigation Director with required certification (b).
Section 2710 (18 U.S.C. § 2710) of SCA describes wrongful disclosure of videotape or sale records and resulting civil action in district court in the event of a violation under this section.
Section 2711 (18 U.S.C. § 2711) of SCA provides definitions for the chapter. The terms defined are those in section 2510 of the title, "remote computing service," "court of competent jurisdiction," and "government entity."
Section 2712 (18 U.S.C. § 2712) of SCA discusses civil actions against the United States. Any party who has claims violation of the chapter or chapter 119 of the title may take action against U.S. District Court to recover money damages.
Constitutionality of compelled government disclosure