The Internet is becoming an ever-increasing factor in criminal defense and it is essential for public defenders and investigators to become well versed in the legal and technological issues surrounding this area of the law. Social media websites like Facebook and MySpace are often seen as virtual goldmines of exculpatory information in criminal cases. Unfortunately, most criminal defense attorneys don't realize that (by design) it's not often easy to obtain this information.
The federal law authorizing law enforcement to conduct electronic surveillance is known as the Electronic Communications Privacy Act (ECPA) of 1986. (1) It is comprised of three titles. Title I, commonly referred to as The Wiretap Act regulates the process by which government agents can intercept private communications and use information obtained by electronic eavesdropping. Title III deals with pen registers and trap and trace devices; electronic instruments capable of recording incoming and outgoing calls made on a phone line. (2) Title II, that section of ECPA relevant to this discussion, is the Stored Communications Act (SCA). (3) This is the law governing stored electronic communications and it was enacted to afford statutory privacy rights to users of electronic communications systems and to prevent unauthorized disclosure of stored electronic communications. “The SCA regulates how the government can obtain stored account information from network service providers such as ISPs.” (4)
At the time the Stored Communications Act was passed, the Internet was in its infancy. “Being online” was something you did at the supermarket while waiting to pay for groceries. Web sites were places where spiders lived. Google, Facebook, YouTube and Twitter were unheard of. Less than 30 years later, almost everyone uses electronic communications devices, surfs the web, shops online or posts their thoughts on a social media website. Today, people are more connected; not only to the Internet but also to one another.
In 1986, there was no World Wide Web. The focus of the SCA was to provide protections to users of the electronic communications services (5) or remote computing services (6), in existence at that time. These services were primarily electronic bulletin boards, email providers and data processing and storage services leased by small businesses. Since then, technology such as smart phones and GPS and computer applications like micro blogs and social media have not only transformed the way we communicate with one another but have also raised many privacy-related questions not easily answered by the language of the statute.
One of these questions is whether or not the SCA precludes private litigants from having access to the content of stored electronic communications. It’s clear that the SCA provides the government with ample tools to compel production of certain categories of content. These tools include subpoenas, court orders and search warrants. Regardless of the legal process used, the mandates of the SCA for disclosure of content are directed at law enforcement. “The statute establishes a complex scheme pursuant to which a governmental entity can, after fulfilling certain procedural and notice requirements, obtain information from an RCS provider via administrative subpoena or grand jury or trial subpoena. It permits a governmental entity to obtain information from an ECS provider only pursuant to criminal warrant…” (7)
(T)he term “governmental entity” means a department or agency of the United States or any State or political subdivision thereof.” (8) Even if the defendant is represented by a federal, state or local government agency known as the public defender’s office; social media websites focus on the defendant as a private party; not the attorney as an agent of the government. Marc J. Zwillinger and Christian S. Genetski, in their paper Criminal Discovery of Internet Communications under the Stored Communications Act: It's Not a Level Playing Field offer their analysis on this subject:
“The purpose and plain text of the SCA make clear that the exceptions for governmental entities apply only to Fourth Amendment government actors-investigative agencies and prosecuting attorneys-and not to criminal defendants, irrespective of whether they happen to be represented by a publicly funded criminal defender's office. First, the party seeking to compel production is not the defendant's lawyer; it is the defendant herself.” (9)
For the purposes of this discussion, I will focus on Facebook because, according to the Pew Internet Research Project this social media web site “is the dominant social networking platform in the number of users” (10) It’s safe to assume that other social media platforms are under the same constraints imposed by the SCA. Some may in fact have even stricter policies in regards to disclosure; depending on the language contained in their individual Terms of Service agreements.
Facebook won’t disclose content when served with a subpoena from a non-governmental entity. Here is the relevant portion of text from the first page of a Facebook’s response and objection to a subpoena attempting to compel content from a subscriber’s page. The subpoena was signed by a federal defender as an officer of the court:
“We are responding to the subpoena you directed to Facebook, Inc. issued on behalf of a private, non-governmental party… Federal law specifically prohibits service providers such as Facebook from disclosing the contents of a user’s account, (for example, messages, Wall posts, photos, etc.) in response to legal process issued on behalf of private parties.” (11) In other words, a subpoena issued by a public defender as an officer of the court or by the court clerk does not qualify as process issued by a “governmental entity” in order to compel disclosure under 18 U.S.C. § 2703(b)(1)(B). The position taken by Facebook is that criminal defendants and civil litigants are equal in status and therefore not entitled to compel production of content under the Stored Communications Act.
In contrast, Facebook has made it relatively easy for the government to request assistance in obtaining content by providing online access to its law enforcement support team.
“Request Secure Access to the Law Enforcement Online Request System
We disclose account records solely in accordance with our terms of service and applicable law.
If you are a law enforcement agent who is authorized to gather evidence in connection with an official investigation, you may request records from Facebook through this system.
I am an authorized law enforcement agent and this is an official request.” (12)
“Warning: Requests to Facebook through this system may be made only by governmental entities authorized to obtain evidence in connection with official legal proceedings pursuant to Title 18, United States Code, Sections 2703 and 2711. Unauthorized requests will be subject to prosecution. By requesting access you are acknowledging that you are a government official making a request in official capacity. For further information please review the Law Enforcement Guidelines.” (13) “Law Enforcement Guidelines” is a link that leads to another page described below.
Presumably, by checking the box verifying status as a law enforcement agent, Facebook will provide whatever content it is permitted to disclose but note the “Big Caveat” threatening prosecution if you aren’t a government official investigating criminal activity or prosecuting criminals on behalf of the government. It seems Facebook is referencing a definition found in Title I under 18 U.S.C. §2510 (7): “Investigative or law enforcement officer” means any officer of the United States or of a State or political subdivision thereof, who is empowered by law to conduct investigations of or to make arrests for offenses enumerated in this chapter, and any attorney authorized by law to prosecute or participate in the prosecution of such offenses.”
By Clicking on the “Law Enforcement Guidelines” link, the user is taken to a page entitled “Information for Law Enforcement Authorities” which discusses domestic and international service of process requirements, account preservation, emergency requests, child safety matters, account holder notification, cost reimbursement and other topics relevant to requests for user content by the police. (14)
Significantly, at the top of the “Information for Law Enforcement Authorities” page, Facebook explains that records requests basically fall into one of two categories; law enforcement and everyone else: “These operational guidelines are for law enforcement officials seeking records from Facebook. For private party requests, including requests from civil litigants and criminal defendants, visit: facebook.com/help/?page=1057.” (15)
Page 1057, entitled “Law Enforcement & Third Party Matters” is laid out in a Frequently Asked Questions (FAQ) format that provides little guidance to ordinary persons attempting to compel Facebook to produce records. Consistent with its distinction between law enforcement and non-law enforcement this FAQ page only provides “Information on Civil Subpoenas” which reads in pertinent part, “Federal law…prohibits Facebook from disclosing the contents of an account to any non-governmental entity pursuant to a subpoena or court order.” (16)
Facebook has the sophistication to recognize demands for content that it deems unreasonable or unlawful and the deep pockets to pursue litigation against improper disclosure demands. (17) This may not be the case with smaller electronic communications services. Should one of these minor players produce content in violation of the SCA, the “individual or entity responsible” for issuing the subpoena may also be held liable for civil damages, sanctions and attorney’s fees. (18)
Facebook generally accepts subpoenas served by facsimile for non-content information (19) provided it bears the attorney’s signature and indictment or docket number. This is contrary to the directions listed on the FAQ page described above. Here Facebook only mentions “civil subpoenas” and requires personal service on Facebook’s registered agent. Additionally, the FAQ specifies the subpoena must either have issued from court in California or that an out of state subpoena be authenticated by the clerk of the court. (20) Parties seeking basic subscriber information… (Non-content) must specifically identify the account by providing the email address, Facebook user ID (UID) and vanity URL (if any). (21)
Although having the ability to make Facebook produce records relating to basic subscriber information can be beneficial in a defense investigation several problems still exist. The first is that Facebook does not verify the accuracy of subscriber information. Anyone can open an account with a fictitious name and disposable email address. Second, Facebook charges a processing fee which can cost hundreds of dollars. Third, Facebook will notify the subscriber that a subpoena has been issued for information about the account in order to give the subscriber a chance to object to the subpoena.
WHAT IS THE SOLUTION?
In spite of the many roadblocks laid out by the Stored Communications Act that prevent private citizens from obtaining content from cyber domains such as social media websites it is still possible to get some useful information without wasting time or violating the law. First of all, the defense attorney should determine if voluntary disclosure is possible. This may include getting written authorization to access a client’s social media page to monitor wall posts, comments and other communications. If voluntary disclosure or permission is out of the question, anything on a person’s social media page that is public can be used in an investigation. Public wall posts, tweets or rants can be documented and used to bolster a client’s defense. Public social media pages should be scrutinized and mined for clues. Information in possession of a disinterested third party who can be persuaded or compelled to turn it over is also fair game. A court order will probably produce the desired content but beware. Some US Attorneys believe that compliance with any process issued on behalf of a civilian that results in disclosure of content will expose the requestor to civil liabilities under the SCA. As a last resort the state may be convinced to assist the defense obtain exculpatory content by issuing grand jury subpoenas and requesting court orders or search warrants “in the interest of justice”.
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
END NOTES
1. 18 U.S.C. §2510 (1-22)
2. 18 U.S.C. §3121 (1-27)
3. 18 U.S.C. §2701 (1 -12)
4. Office of Legal Education, US Department of Justice, Searching and Seizing Computers and obtaining Evidence in Criminal Investigations, p. 116 (2009) (available at http://www.justice.gov/criminal/cybercrime/docs/ssmanual2009.pdf)
5. 18 U.S.C. § 2510(15) "Electronic communication services" permit users to send or receive wire or electronic communications
6. 18 U.S.C.S. § 2711(2) “Remote computing services" provide computer storage or processing services to customers, and are designed for longer-term storage
7. Buckley H. CRISPIN, an individual, Plaintiff, v. CHRISTIAN AUDIGIER, INC., et. al., Defendants
717 F.Supp.2d 965 (2010)
8. 18 U.S.C. §2711 (4)
9. 97 J. Crim. L. & Criminology 569 (2006-2007) at p. 594
10. Pew Internet Research Project http://www.pewinternet.org/2013/12/30/social-media-update-2013/
11. Facebook response and objection to subpoena, dated July 18, 2011
12. Law Enforcement Online requests: https://www.facebook.com/records/x/login/
14. ibid.
15. Facebook Help facebook.com/help/?page=1057
17. The District Court in New Jersey recently determined the SCA applied to Facebook. The court said: “First, Facebook wall posts are electronic communications... Second, Facebook wall posts are transmitted via an electronic communication service... Third, Facebook wall posts are in electronic storage. Fourth, Facebook wall posts that are configured to be private are, by definition, not accessible to the general public…”DEBORAH EHLING, Plaintiff, v. MONMOUTH-OCEAN HOSPITAL SERVICE CORP., et al., Defendants Civ. No. 2:11-cv-03305 (WJM) USDC DNJ, August 20, 2013
18. 18 U.S.C. § 2703; Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2003)
19. § 2703(c)(2) Non-content information includes the subscriber’s name, address, local and long distance connection records, records of session times and durations, length of service, types of service, the telephone or instrument number, subscriber identification number, dynamic Internet Protocol address and the means and source by which the subscriber pays for the service. This can include credit card or bank account numbers.
