Cloud Computing: Constitutional and Statutory Privacy Protections
Released: 2013-03-22T00:00:00

Introduction

Although it is difficult to provide a precise definition of "cloud computing," it is generally described as web-based services that allow users to access anything from e-mail to social media to banking to more complex programs like business computing. Traditionally, users would download software and manipulate data on their own computer, while in the cloud, this activity occurs over the Internet on a third-party computer. Many e-mail services like Gmail and Hotmail operate using cloud computing, as do music programs like Grooveshark and Pandora, and social media sites like Facebook and Twitter. Likewise, many smartphone applications employ cloud computing that permits users to store and access large amounts of data. Cloud storage is also on the rise, with an estimated 500 million users by year end, and 1.3 billion users by 2017. Cloud storage services like DropBox, Google Drive, and SkyDrive by Microsoft allow users to store their information on the computer of a third-party and access it from any platform with Internet access.

As cloud computing becomes integrated into our daily lives, a host of personal information (e.g., private communications, financial data, photographs, etc.) will be stored on a server owned by a third party. This raises privacy and security issues, including when and how government may access this information as part of a criminal or other type of investigation. This report first describes cloud computing and how it differs from traditional computing. It then describes how the Fourth Amendment and federal electronic privacy statutes apply to communications in the physical world, to Internet communications generally, and specifically to the cloud. Finally, this report surveys recent legislation and other various proposals designed to update the existing statutory framework.

Privacy for Communications in the Physical World

Because many traditional activities are increasingly being transferred online, it is vital to first understand what privacy protections apply in the physical world before turning to possible protections in the cloud. The Fourth Amendment and federal communication statutes provide the core privacy protections in the physical world.

The Fourth Amendment provides, in relevant part, that "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated[.]" The primary purpose of the Fourth Amendment is to ensure the privacy of the citizenry and to prevent arbitrary government intrusion into their lives. To determine if the Fourth Amendment applies in a given case, a court tests whether the government activities constitute a search . The modern formulation for determining whether certain conduct is a search under the Fourth Amendment derives from Justice Harlan's concurrence in Katz v. United States . This test asks "first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable.'" What is reasonable in a given case—the yardstick for all Fourth Amendment analyses—can depend greatly on the facts of the case. However, there are certain lines of cases that provide baseline rules for the protection of communications in the physical world.

The closest analog to an e-mail in the physical world is the postal letter. In 1878, the Supreme Court was asked to rule in Ex parte Jackson whether Congress had the constitutional authority to exclude certain obscene material from the U.S. postal system. In discussing the nature of protecting the postal system, the Court observed that

Letters and sealed packages of this kind in the mail are as fully guarded from examination and inspection, except as to their outward form and weight, as if they were retained by the parties forwarding them in their own domiciles. The constitutional guaranty of the right of the people to be secure in their papers against unreasonable searches and seizures extends to their papers, thus closed against inspection, wherever they may be. Whilst in the mail, they can only be opened and examined under like warrant, issued upon similar oath or affirmation, particularly describing the thing to be seized, as is required when papers are subjected to search in one's own household. No law of Congress can place in the hands of officials connected with the postal service any authority to invade the secrecy of letters and such sealed packages in the mail; and all regulations adopted as to mail matter of this kind must be in subordination to the great principle embodied in the fourth amendment of the Constitution.

The Court in Ex parte Jackson relied on a content/non-content distinction to find that the inside of the letter (the content) was protected, while the routing information on the outside (non-content) was not subject to similar Fourth Amendment restrictions.

Of more recent vintage, the Court observed in United States v. Jacobsen that "[l]etters and other sealed packages are in the general class of effects in which the public at large has a legitimate expectation of privacy; warrantless searches of such effects are presumptively unreasonable." The free flow of mail, however, is not absolute. In United States v. Leeuwen , the Court held that government officials may detain packages for a brief period of time without a warrant to confirm the suspicious nature of the package. Additionally, under federal regulations postal workers can record the outside, routing information on letters sent, a technique known as a mail cover, to gather evidence regarding the commission of a crime. These same regulations, however, prohibit postal employees from opening the mail, unless one of the limited exceptions applies.

Like the contents of letters, the contents of a conversation—the words spoken either in person or through a device such as a cell phone or land-line phone—are generally protected under various constitutional and federal statutory provisions. In United States v. Katz , the Court held that the contents of an individual's conversation are protected under the Fourth Amendment, even when spoken in a public telephone booth. The Court remarked that an individual who makes a telephone call from a closed telephone booth "is surely entitled to assume that the words he utters into the mouthpiece will not be broadcast to the world. To read the Constitution more narrowly is to ignore the vital role that the public telephone has come to play in private communication." Congress augmented Katz in Title III of the Omnibus Crime Control and Safe Streets Act of 1968 as amended by the Electronic Communications Privacy Act of 1986 (ECPA), establishing significant restrictions on surreptitious interception of private communications. Commonly referred to as the Wiretap Act, Title III prohibits the intentional interception of telephone, face-to-face, and electronic communications using a mechanical or other device, unless one of several exceptions applies, such as consent of one of the parties to the conversation, or a judicially authorized warrant based upon probable cause.

Although accessing the contents of a telephone communication generally requires a probable cause warrant, access to telephone routing information, including the numbers dialed, requires lesser process. In Smith v. Maryland , the Court applied the third-party doctrine to the telephone numbers a person dials to place a call. The third-party doctrine provides that information a person voluntarily conveys to another person is generally not protected by the Fourth Amendment. The Court observed in Smith that when the defendant used his phone, he "voluntarily conveyed numerical information to the telephone company and 'exposed' that information to its equipment in the ordinary course of business. In so doing, [he] assumed the risk that the company would reveal to police the numbers he dialed." Seven years later, Congress included in ECPA a prohibition against the use of pen registers and trap and trace devices (which can record the incoming and outgoing telephone numbers from a certain customer), unless the government obtained a court order certifying that the information to be obtained is "relevant to an ongoing criminal investigation."

Another crucial form of communication in the modern world that is increasingly moving to the cloud is the transfer of business records. In United States v. Miller , the Court applied the third-party doctrine to hold that a bank customer has no legitimate expectation of privacy in banking documents such as checks and deposit slips transferred to a bank in the ordinary course of business. There, the Court observed that "[t]he depositor takes the risk, in revealing his affairs to another, that the information will be conveyed by that person to the government. … This Court has held repeatedly that the Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities, even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed." In reaction to Miller , Congress enacted the Right to Financial Privacy Act, creating a statutory protection for these financial documents.

Privacy for Communications on the Internet

Although the jurisprudence of Internet privacy is in its infancy, the current body of case law sheds light on how the Fourth Amendment and federal statutes apply to the cloud. When applying the Fourth Amendment, it appears that courts have not distinguished between traditional forms of Internet communication and cloud-based communication; the same rules apply to each. However, when applying the Stored Communications Act, cloud computing such as web-based e-mails or messaging through social network sites has not received the robust privacy protections accorded to traditional e-mail services.

Fourth Amendment

For the most part, courts have applied the Fourth Amendment to Internet communications by analogy to the physical world. Like the traditional cases, the outcomes of the Internet cases have hinged on whether the information sought by the government was considered "content" or "non-content." Generally, the courts have held that access to Internet communications that constitute the content of the communication is a search for which a warrant is required. By contrast, access to information that reveals only non-content information such as routing information—including an Internet Protocol address (IP address) or the to/from address in an e-mail—has been subjected to lesser legal process.

In 2007, the Ninth Circuit Court of Appeals held in Forrester v. United States that the government's access to the "non-content" information transferred as part of an Internet communication—such as the to/from address line in an e-mail—did not constitute a search under the Fourth Amendment. In that case, several defendants were allegedly manufacturing ecstasy in violation of federal drug laws. During its investigation, the government sought to intercept defendant Dennis Alba's Internet and e-mail activity. The government received a court order to install a "mirror port" at Alba's Internet service provider, which enabled the government to learn the to/from addresses of his e-mails, the IP addresses of the websites he visited, and the total volume of information sent to or from his account. At trial, Alba claimed that this evidence was obtained in violation of his Fourth Amendment right to be free from unreasonable searches and seizures. In denying Alba's claim, the Ninth Circuit relied on two lines of Fourth Amendment cases. First, the court analogized this routing information to the telephone numbers dialed in the third-party case, Smith v. Maryland . Like the defendant in Smith who should have expected the numbers he dialed would be revealed to the carrier that would place his call, "e-mail and internet users have no expectation of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit because they should know that this information is provided to and used by the service provider for the specific purpose of directing and routing of information." Second, the panel likened the addressing information of electronic communications to the outside address information on physical mail, which is generally not protected under the Fourth Amendment. Because e-mails contain similar addressing information, the court concluded that they are not entitled to Fourth Amendment safeguards.

Like Forrester , the Third Circuit Court of Appeals in United States v. Christie held that individuals do not have a reasonable expectation of privacy in their IP addresses. This case originated when the FBI acquired the IP addresses of computer users who were accessing child pornography websites. The FBI then requested the names of the users linked to these IP addresses from their ISP. Again, applying the third-party doctrine, the court held that "no reasonable expectation of privacy exists in an IP address, because that information is also conveyed to and, indeed, from third parties, including ISPs. IP addresses are not merely passively conveyed through third party equipment, but rather are voluntarily turned over in order to direct the third party's servers."

Although the panel in Forrester concluded that outside address information that is visible to a third-party carrier is not subject to Fourth Amendment protection, it commented in passing that "the contents may deserve Fourth Amendment protection" and that certain surveillance techniques may "breach the line between mere addressing and more content-rich information."

In 2010, the Sixth Circuit Court of Appeals in United States v. Warshak recognized this difference between content and non-content information, holding that the content of e-mail communications is protected under the Fourth Amendment. There, Warshak was being investigated for a scheme to defraud customers of his company. The government sought and obtained permission from Warshak's ISP to preserve the contents of Warshak's e-mails, and eventually the government was permitted access to approximately 27,000 e-mails. Warshak then moved to suppress this access as forbidden under the Fourth Amendment absent a warrant. The Sixth Circuit held that the contents of the e-mails were protected under the Fourth Amendment. Like the Ninth Circuit decision, the ruling in Warshak compared e-mails to physical mail, observing that "[g]iven the fundamental similarities between e-mail and traditional forms of communication, it would defy common sense to afford e-mails lesser Fourth Amendment protection." The panel noted the importance of e-mail as an "indispensable part" of modern society. The panel held that "if government agents compel an ISP to surrender the contents of a subscriber's e-mails, those agents have thereby conducted a Fourth Amendment search, which necessitates compliance with the warrant requirement absent some exception."

Thus, while slim, this body of case law applying the Fourth Amendment to Internet communications seems to establish several rules. First, for government officials to access the contents of e-mails or other electronic communications, they must obtain a warrant based upon probable cause absent a warrant exception. Second, if the government seeks non-content information such as subscriber information, the to/from line on an e-mail, or the IP addresses of websites visited, a subpoena will generally suffice. Additionally, it does not appear that these courts consider the nature of the e-mail service provided, whether cloud-based or the traditional client-based e-mail, as part of their Fourth Amendment analysis. It would seem that these same rules apply to both types of services.

Stored Communications Act (SCA)

In the early 1980s, Congress voiced concern that electronic communications were not accorded the same privacy as analogous communications in the physical world. The Senate Judiciary Committee observed in 1986 that "[p]rivacy cannot be left to depend solely on physical protection, or it will gradually erode as technology advances." Likewise, the House Judiciary Committee noted other problems with unclear legal standards relating to access to electronic communications. The House Committee feared that unclear legal standards would discourage potential customers from using this new technology. The House Committee was also concerned that police officers who were conducting investigations may face liability or that evidence obtained may not be admissible in a criminal prosecution. In light of these concerns, Congress overhauled federal communication privacy laws in 1986 as part of the Electronic Communications Privacy Act of 1986 (ECPA). The Stored Communications Act (SCA), enacted as Title II of ECPA, was designed to regulate the access and dissemination of electronic communications stored on computers. The SCA has two core components: (1) the procedures the government must follow to compel disclosure of stored communications; and (2) the situations in which a service provider may voluntarily share a customer's communications.

Scope of the SCA

The SCA covers providers of two types of public services: an "electronic communication service," or ECS, and a "remote computing service," or RCS. An ECS provider is any service which allows its customers to "send or receive wire or electronic communications." An ECS provider is prohibited from "knowingly divulg[ing] to any person or entity the contents of a communication while in electronic storage by that service[,]" subject to certain exceptions. "Electronic storage" is in turn defined as information that is stored (1) incidental to the transmission of that communication, or (2) for backup purposes. An RCS provider is defined as "the provision to the public of computer storage or processing services by means of an electronic communications system[.]" An RCS is prohibited, also subject to certain exceptions, from "knowingly divulg[ing] to any person or entity the contents of any communication which is carried or maintained on that service."

Required Disclosure of Communications

Section 2703 of the SCA sets forth the procedures the government must follow to gain access to electronic communications, such as e-mails, from an ECS or RCS provider. Section 2703 is tiered—the more content-rich the information sought, the higher the level of evidentiary proof the government must proffer.

At the highest level, Section 2703(a) requires the government to obtain a warrant if it seeks access to the content of a communication from an ECS provider that has been in "electronic storage" for 180 days or less. The same procedure is available for communications stored for more than 180 days from an ECS provider or from an RCS provider (no matter how long the communication is stored with it), but there are two other alternatives. If the government provides notice to the customer, it can access these older communications with a subpoena or a court order under Section 2703(d). These Section 2703(d) orders require the applicant to prove "specific and articulable facts, showing that there are reasonable grounds to believe that the contents of a[n] ... electronic communication ... are relevant and material to an ongoing criminal investigation."

In addition to the content of communications, the SCA permits access to non-content information with a warrant, but the government may use a subpoena or a Section 2703(d) order without having to provide the customer notice. To access subscriber information, including the customer's name, address, phone number, length of service, and means of payment (including bank account numbers), the government may follow the more stringent requirements for obtaining a warrant or a Section 2703(d) order, but can also use an administrative subpoena, which requires no prior authorization by a judicial officer.

Voluntary Disclosure of Communications

Section 2702 establishes when a service provider may voluntarily disclose the content of communications and customer information to another entity. This section applies only to service providers to the "public"; thus, nonpublic providers can turn over these documents without any process required. For public providers, the contents of a communication may not be divulged unless one of the eight exceptions in Section 2702(b) applies, which include consent of one of the parties to the communication; as a necessary incident to the rendition of services; in connection with a missing child; inadvertently obtained and pertains to the commission of a crime; or if there is imminent risk of death or serious physical injury to any person. A public provider may release customers' records or other non-content information if it meets one of the six exceptions provided in Section 2702(c), which include consent of the subscriber; as a necessary incident to the rendition of services; and in connection with a missing child.

Application of the SCA

E-mails

It is clear from the text of the SCA that government access to the content of unopened e-mails stored for 180 days or less by an electronic communication service requires a warrant. It is also clear that opened or unopened e-mails stored for more than 180 days may be accessed with a subpoena or a Section 2703(d) order, so long as the government provides notice to the subscriber. However, there is a split in the courts as to whether an opened e-mail stored 180 days or less is in "electronic storage" under the SCA. The practical result of this definitional breakdown is that police must get a warrant if the communication is in electronic storage, but need only use a subpoena if not. One of the substantial points of departure is how these divided courts view the difference between traditional forms of e-mail such as client-based services and web-based e-mails that rely on cloud technology.

In Theofel v. Farey-Jones before the Ninth Circuit Court of Appeals, the defendant Farey-Jones subpoenaed the plaintiffs' ISP provider NetGate for access to "[a]ll copies of e-mails sent or received by anyone" within the plaintiff's company. NetGate provided some, but not all of the e-mails. The plaintiffs sued Farey-Jones under, among other statutes, Section 2701 of the Stored Communications Act, for unlawful access to their e-mail communications. The crux of this issue was whether the e-mails were in "electronic storage" under the SCA. Again, "electronic storage" is defined as "(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.... " If they were in electronic storage, the subpoena used would be insufficient to access the e-mails. The court held that these e-mails were for backup purposes under subsection (B), and observed:

An obvious purpose for storing a message on an ISP's server after delivery is to provide a second copy of the message in the event that the user needs to download it again-if, for example, the message is accidentally erased from the user's own computer. The ISP copy of the message functions as a "backup" for the user. Notably, nothing in the Act requires that the backup protection be for the benefit of the ISP rather than the user. Storage under these circumstances thus literally falls within the statutory definition.

The Ninth Circuit concluded that "where the underlying message has expired in the normal course, any copy is no longer performing any backup function." Theofel 's holding appears to apply when the user downloads a message on his computer and the ISP keeps a copy of the e-mail for "backup protection." However, it is uncertain whether a future court would apply this rule to cloud computing where the only copy of the message is left on the service provider's computer. In passing, the Ninth Circuit noted that "[a] remote computing service might be the only place a user stores his messages; in that case, the messages are not stored for backup purposes." The court seems to be stating that this rule would not apply to some e-mail providers—possibly cloud providers. One observer has suggested that this dicta in Theofel evidences that e-mails stored in the cloud would not be stored for backup purposes, and thus, would not be subject to the more stringent warrant requirement.

The District Court for the Central District of Illinois picked up on this distinction in United States v. Weaver, where it had to apply the SCA to a cloud-based e-mail system. There, the government sought e-mails from Justin Weaver's Microsoft Hotmail account as part of its child pornography investigation. The government executed a subpoena to Microsoft seeking any opened or sent e-mail from Weaver's account. Microsoft produced some e-mails to the government, but failed to produce e-mails that had already been opened and those that had been stored for fewer than 181 days. The court had to determine whether these e-mails were in "electronic storage" under Section 2703(a), as defined in Section 2510(17), or "storage" under Section 2703(b)(2). If they were in "electronic storage" then the government should have produced a warrant to access them; if they were not, the subpoena would suffice.

Noting that the e-mails sought by the government were those already opened, the court concluded that they were not in "temporary, intermediate storage" under subsection (A) of Section 2510(17). Turning to subsection (B), the court had to determine if they were being stored for "backup protection." Reviewing the nature of web-based e-mail, which relies on cloud technology, the court observed that "Hotmail users can access their e-mail over the web from any computer, and they do not automatically download their messages to their own computers as non-web-based e-mail service users do. Instead, if Hotmail users save a message, they generally leave it on the Hotmail server and return to Hotmail via the web to access it on subsequent occasions." The court went to say that the result may differ if the "users opt to connect an e-mail program, such as Microsoft Outlook" to their e-mail accounts and download messages to their own computers. However, the court concluded that if someone uses a pure cloud-based e-mail system, those e-mails cannot be stored for "backup purposes" under subsection (B) as they would be the only copy of the e-mails. Once the user opened the e-mail and left it on the Hotmail account, Microsoft was "maintaining the messages 'solely for the purpose of providing storage or computer processing services to such subscriber or customer.'" This made Microsoft an RCS, rather than an ECS provider. Thus, the e-mails were subject only to the subpoena requirement.

Social Networking

In Crispin v. Christian Audigier, Inc. , the United States District Court for the Central District of California was asked whether messages sent through private messaging services or through posting on user-created profile pages on social networking sites Facebook and MySpace are covered under the SCA. Crispin arose as part of discovery requests in private litigation, when defendant Christian Audigier served subpoenas on Facebook and MySpace for access to communications between the plaintiff and a third party. The plaintiff moved to quash the subpoenas, arguing that Facebook and MySpace were prohibited from disclosing the communication under Section 2702(a)(1) of the SCA.

As to the private messages sent on these social networking sites, the court relied on Weaver and the dicta in Theofel to hold that when messages are opened and retained on the site, Facebook and MySpace operate as RCS providers, and the messages are subject only to the subpoena requirement.

The court next turned to the "wall postings" on Facebook and the MySpace comments page, which permit users to post messages on another user's profile space. The court first analogized these comment pages to the traditional electronic bulletin board services (BBS). A BBS is a website that permits users to post messages on a "board" for the general public to view. Precedent and legislative history established that these bulletin boards were covered under the SCA. However, to be entitled to protection under the SCA, access to messages posted on these sites must be restricted in some meaningful way from the public at large. Facebook and MySpace, the court reasoned, provide a similar function: they permit users to post messages on other users' "walls" so long as they have authorization to do so. Although these social networking sites were considered ECSs, the court still had to determine whether the information had been in "electronic storage" under the SCA. The court concluded that messages that had not been retrieved fell within the first definition of electronic storage—that is, that they were being temporarily stored "incidental to transmission." However, because Crispin had already accessed the messages, they fell within the second electronic storage pathway—stored for backup purposes. Ultimately, the Court remanded the case to the magistrate judge to determine if "either the general public had access to plaintiff's Facebook and MySpace comments, or access was limited to a few." If the latter, the communications would fall under the SCA's protections and the subpoena would be quashed.

YouTube Videos

In Viacom Intern. Inc. v. YouTube Inc. , the federal district court for the Southern District of New York had to determine whether access to YouTube videos was governed by the SCA. There, Viacom claimed that videos posted on Google's video-sharing website YouTube violated federal copyright law. Viacom requested certain videos from Google as part of its discovery requests. The court first concluded, with little discussion, that Google was an RCS provider under the SCA. It then moved on to the question of whether the SCA permitted such disclosure. Viacom argued that users who posted videos on YouTube have authorized disclosure of those videos under Section 2702(b)(3), which allows the provider to "divulge the contents of a communication ... with the lawful consent of ... the subscriber." The court rejected this argument, observing that, although YouTube's Terms of Use and Privacy Policy provides a disclaimer that any video posted in the public areas of the site may be divulged, none of the provisions in that user agreement "can be fairly construed as a grant of permission from users to reveal to plaintiffs the videos they have designated as private and chosen to share only with specified recipients." Thus, the court held the SCA did not permit Viacom access to those videos that had been marked private by the user who posted them. The court, however, permitted Viacom access to non-content data such as "the number of times each video has been viewed on YouTube.com or made accessible on a third-party website through an 'embedded' link to the video."

Differences in Privacy Protections in the Physical World, Traditional Computing, and Cloud Computing

In summary, there are many similarities between searches in the physical and digital worlds. For instance, for law enforcement to access the contents of a postal letter, it must first obtain a warrant based upon probable cause, but routing information on the outside of the letter does not receive the same protection. This distinction also applies to telephone calls, where law enforcement cannot surreptitiously record the content of one's conversation, but can access the numbers dialed with lesser process. The limited number of courts reviewing this issue under the Fourth Amendment have applied this same content/non-content distinction to electronic communications such as e-mails. To access the content of an e-mail, law enforcement generally must obtain a warrant. To obtain the routing information, such as an IP address or the to/from address of an e-mail, a subpoena will usually suffice.

However, there are also differences between searches in the physical world and the Internet. For example, under the SCA, the government can access the contents of e-mails stored for more than 180 days, and in some circuits, e-mails that have been opened no matter how long they are stored, with a subpoena and notice to the customer. This is a clear difference from the physical world, as the government cannot access one's private physical letters, no matter how long they are stored, without a warrant. Also, in many instances, evidence obtained by an illegal search in the physical world is not admissible in a criminal prosecution under the exclusionary rule. Under the SCA, however, there is no suppression remedy; thus, even evidence unlawfully obtained may be admitted into evidence at trial. In any event, if applicable, the Fourth Amendment provides a baseline threshold which the SCA cannot lessen.

Additionally, the few courts that applied the SCA to e-mail and other Internet communications seem to have created a dividing line between traditional forms of Internet computing and cloud-based computing. For instance, under the Ninth Circuit's approach in Theofel , traditional e-mail services are covered under the SCA's more stringent warrant requirement, whereas the cloud-based e-mails in Weaver were subject to the lesser subpoena requirement. In Viacom Intern. Inc. , Youtube was considered an RCS provider thus also subjecting posted videos to the subpoena requirement. It remains to be seen whether future courts will apply this distinction between cloud-based and traditional forms of electronic communications.

Proposed Changes to the Current Statutory Framework

Several courts, commentators, and government officials alike have called for an overhaul of ECPA, though disagreement may exist as to how to balance the competing interests of the government, the communications industry, and the individual. Senator Patrick J. Leahy, chairman of the Senate Judiciary Committee, observed at a committee hearing that while ECPA is a useful tool for government officials, it is "hampered by conflicting standards that cause confusion for law enforcement, the business community, and American consumers alike." He further observed that "a single e-mail could be subject to as many as four different levels of privacy protections under ECPA, depending on where it is stored and when it is sent." Several observers have also opined on perceived flaws in the SCA: "It is more complicated than it needs to be. It has sections that are redundant and merely confusing. The absence of a statutory suppression remedy has created significant uncertainty about how the statute works. The SCA also offers surprisingly low privacy protections when the government seeks to compel the contents other than unretrieved communications held pending transmission for 180 days or less." The Department of Justice has also called for changes to ECPA, but has cautioned against the implementation of a heightened standard for accessing electronic communications:

Congress may wish to consider that raising the standard for obtaining information under ECPA may substantially slow criminal and national security investigations. In general, it takes longer for law enforcement to prepare a 2703(d) order application than a subpoena, and it takes longer to obtain a search warrant than a 2703(d) order. In a wide range of investigations, including terrorism, violent crimes, and child exploitation, speed is often judged to be essential.

Legislation has been introduced in the 112 th and 113 th Congresses, and various measures have been proposed by other entities, to overhaul ECPA.

Recent Legislative Proposals

Recent legislative proposals introduced in the 112 th and 113 th Congresses aim to clarify and strengthen the requirements for accessing an individual's electronic communications under the SCA. Although the language in each bill differs, several of the provisions in each bill relating to the SCA have the same substantive effect. These bills would

require a government entity to obtain a warrant based upon probable cause to retrieve the content of information from both providers of electronic communication services and remote computing services; eliminate the 180-day rule currently contained in Section 2703(a), so that communications stored for 180 days or 181 days would be treated the same; amend Section 2703(a) to not only cover communications in "electronic storage" but also those that are being "held or maintained" by that service; require the government to notify the customer of any search conducted under the SCA within three days, including a copy of the warrant, unless delayed notice is permitted under Section 2705; and eliminate the ability of providers to voluntarily share content and subscriber information with a government entity unless one of the Section 2702(b) exceptions applies.

Additionally, H.R. 6399 from the 112 th Congress would have also

created a statutory suppression remedy for violations of the SCA; required the Administrative Office of the United States Courts to report annually to Congress on how many orders or warrants were sought and issued concerning the contents of electronic communications; and required a provider to report annually to the Administrative Office of the United States Courts the number of legal demands it has received from federal, state, and local law enforcement agencies, and the number of accounts about which information was disclosed. The providers can receive compensation for the costs of compiling these records.

Other Proposals

Uniformity and Technology Neutrality

Although each of the legislative proposals above would apply the same rules to both ECS and RCS providers, it is not clear that this approach would sufficiently capture all of the various communications that occur in the cloud. As some observers have pointed out, sites such as eBay, which permit users to buy and sell items online, are probably not ECS providers, as they do not provide users the ability to send or receive communications on the Internet. And it has been argued that the site is not an RCS provider, as it does not provide "processing service" for its users, although he notes this debate is ambiguous at best as this term is neither defined by statute nor construed in any case. Thus, even if Congress applies the same rules to both ECS and RCS providers, some cloud services such as eBay might still not be covered. Congress could either draft language specifically covering cloud services, or draft a broad definition for the class of entities that would come within the SCA's ambit, preferably aiming for technology neutrality.

Another observer offered the following language, which intends to rescind the 180-day rule, apply the same rules to all service providers, and provide protections even if a message has been received or downloaded by the user:

A governmental entity may only require a provider of communications services to disclose the contents of a wire or electronic communication, if transmitted or stored electronically, only upon the issuance of a warrant by a court of competent jurisdiction, whether or not the provider stores the communication after receipt by the user, and regardless of whether the communication remains on the server after receipt or is downloaded to the user's device.

Consent Provisions

Currently, there is an exception under ECPA for interceptions made with prior consent of one of the parties to the communication. However, ECPA does not define "consent." For instance, does clicking on a user agreement when one signs up for Gmail or Hotmail suffice as consent for these providers to access the content of one's e-mails and share them with the government? One commentator has suggested that the consent requirement should be clarified:

Notably, an e-mail service might scan the contents of customers' e-mail messages for content that suggests an interest in certain products and may provide that information to behavioral advertising agencies that create consumer databases and feed online ads on behalf of their clients. Under ECPA, those service providers have violated the law if they have not obtained user consent for those practices. Unfortunately, ECPA's failure to define consent leaves users and service providers without guidance on this point. Is a consumer's decision to use a monitored e-mail service, after being given an opportunity to read a privacy policy, sufficient to indicate consent? Or should explicit opt-in consent, pursuant to conspicuous notice, be required?

As an example of this opt-in regime, as part of the Driver's Privacy Protection Act, Congress required state motor vehicle departments to receive the express consent of individuals before sharing certain personal information. A similar approach could be implemented with ECPA.

Conclusion

The Supreme Court once remarked that when an individual "puts something in his filing cabinet, in his desk drawer, or in his pocket, he has the right to know it will be secure from an unreasonable search or an unreasonable seizure." Does this proposition hold true today when people turn to digital desk drawers, digital filing cabinets, and digital pockets? For the most part, many of the protections that apply to the physical world have been transferred to the digital world. In the physical world the contents of letters, telephone calls, and other forms of communication are generally protected by the Fourth Amendment's prohibition against unreasonable searches and seizures. The limited number of courts reviewing the question have held that the content of Internet communications are similarly protected from government searches under the Fourth Amendment. These protections may be supplemented by the SCA, which accords varying degrees of privacy safeguards to both public and private intrusions, depending on how long the communication has been stored and how the provider of the network service is classified under its complicated definitions. Additionally, courts have occasionally applied lesser degrees of protection to communications sent and received through cloud-based services than with traditional forms of Internet communications, based on the manner the information is stored by each, and how such storage is defined under the SCA. Recent legislative proposals would apply the same rules to communications in the physical and digital worlds and between traditional computing and cloud computing.