by Sophilia Wu
Through the years, the Electronic Communications Protection Act of 1986 (ECPA) has been amended several times, including by the USA PATRIOT Act. The ECPA extended previously existing government restrictions on wire taps from telephone calls to include transmissions of electronic communications by computers. As technology continues to advance, the courts are forced to apply the ECPA to issues that did not exist when the law was initially enacted, resulting in courts struggling to answer questions with insufficient tools. Two recent examples include: 1) the question of whether URLs are considered content or metadata; and 2) whether search warrants may be used to access data stored in foreign countries.
Are URLs Content or Metadata?
In 2015, the U.S. Court of Appeals for the Third Circuit considered whether internet advertising businesses violated federal law when they placed tracking cookies on users’ web browsers in contravention of the browsers’ cookie blockers and the businesses’ own public statements. In re Google Inc. Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015), cert. denied sub nom. The most important point that the Court made was that in addition to functioning as metadata, some URLs also function as content.
Federal surveillance law distinguishes between the content of communication, which is protected under the Wiretap Act (Title I of the ECPA), and the non-content means of establishing communications (metadata), which is not protected and governed by the Pen Register Act (Title III of the ECPA). In the underlying action, the District Court held that the URLs in the electronic transmissions intercepted by the defendants are location identifiers, which constitute metadata, not content.
However, the Court of Appeals explained that the dichotomy between content and metadata is not always so clear. Instead, the analysis is contextual, and turns on the role of location identifier in the intercepted communication. The Court of Appeals reasoned that URLs, which normally function as routing and location-based metadata, could also contain search terms entered into a search engine, which would reveal that the user is conducting a search for a particular topic, thus constituting content. Thus the Court of Appeals determined that some URLs also qualify as content.
However, the Court of Appeals chose not to establish a test, stating that, “[w]e need not make a global determination as to what is content, and why, in the context of queried URLs. Lack of consensus, the complexity and rapid pace of change associated with the delivery of modern communications, and the facileness of direct analogy to mail and telephone cases counsel the utmost care in considering what is, and what is not, “content” in the context of web queries.”
Can U.S. Search Warrants Access Data Stored on Foreign Servers?
In 2016, the U.S. Court of Appeals for the Second Circuit held in Microsoft Corp. v. United States, 829 F.3d 197 (2d Cir. 2016), that electronic communications that are stored exclusively on foreign servers cannot be reached by U.S. prosecutors under the Stored Communication Act’s (SCA) warrant provisions (Title II of the ECPA). In this case, Microsoft refused to provide e-mail content information stored on servers in Ireland, arguing that this subjected U.S. prosecutors to Irish laws. The United Statesargued that Microsoft could access the information from its offices in the United States, so it was a domestic matter subject to domestic law. Ultimately, the Court of Appeals, siding with Microsoft, held that the SCA’s emphasis was on the privacy of the content of a user’s stored communications.
In a concurring opinion, Judge Gerard Lynch said that he was “skeptical of the conclusion that the mere location abroad of the server on which the service provider has chosen to store communications should be controlling,” and opined “[t]hat may be the default position to which a court must revert in the absence of guidance from Congress, but it is not likely to constitute the ideal balance of conflicting policy goals.”
A 2017 decision in the Eastern District of Pennsylvania resulted in a different answer: Google, in connection with a doestic criminal investigation, was ordered to comply with FBI search warrants and produce emails stored on foreign servers. In re Search Warrant No. 16-960-M-01 to Google (E.D. Pa. Feb. 3, 2017). (Notably, the facts in Google are different, as Google was unable to identify where the information was stored.)
Sophilia Wu is an attorney at Mullin Law PC. She can be reached at firstname.lastname@example.org.