Yahoo Prevails in Legal Battle Testing Whether the Stored Communications Act Allows Feds Access to Americans' E-mails without Probable Cause or a Warrant

The Stored Communications Act was enacted at a time when e-mail generally wasn’t stored on servers at all, but instead passed through them briefly on their way to the recipient’s inbox. Federal prosecutors argued that opened e-mail less than 180 days old is no longer in “electronic storage” as defined by the law — which allows the feds to obtain that e-mail without probable cause.

Yahoo Beats Feds in E-Mail Privacy Battle

April 16, 2010

Wired - Yahoo prevailed Friday over Colorado federal prosecutors in a legal battle testing whether the Constitution’s warrant requirements apply to Americans’ e-mail.

Saying the contested e-mail “would not be helpful to the government’s investigation,” (.pdf) the authorities withdrew demands for e-mail in a pending and sealed criminal case. For the moment, the move ends litigation over the hotly contested issue of when a warrant under the Fourth Amendment is required for Yahoo and other e-mail providers to release consumer communications to the authorities.

The brouhaha concerned a 1986 law that already allows the government to obtain a suspect’s e-mail from an internet service provider or webmail provider without a probable-cause warrant, once it’s been stored for 180 days or more. The government contended, and then backed off Friday, that it could get e-mail less than 180-days old if that e-mail has been read by the owner, and that the Constitution’s Fourth Amendment protections don’t apply.

Yahoo was backed (.pdf) by the Electronic Frontier Foundation, Google and the Center for Democracy & Technology in challenging the government’s position. It defied a court order to turn over those e-mails to the feds in a Colorado criminal probe that is under seal. Litigation over the topic ensued, and the government blinked in a legal standoff highlighting antiquated privacy laws.

Had the courts adopted the government’s position, (.pdf) the vast majority of Americans’ e-mail would be accessible to the government without probable cause, whenever law enforcement believes the messages would be relevant to a criminal investigation, even if the e-mail’s owner was not suspected of wrongdoing.

Still, the government’s move does not resolve the privacy issue, but merely instead delays it for a later day.

The legal jockeying began Dec. 3, when a Colorado magistrate ordered Yahoo to hand over to authorities e-mail communications under six months old “received by the specified accounts that the owner or user of the account has already accessed, viewed or downloaded.”

Yahoo refused, claiming the 1986 Stored Communications Act requires the government to show probable cause to obtain that e-mail. The government asserted a lesser, warrantless standard that the “communications sought are relevant and material to an ongoing criminal investigation.”

The difference between those standards is the subject of fierce debate in the legal community.

But all sides agree that obtaining unopened e-mail less than 180 days old requires the authorities to make a probable-cause showing to a judge, and that after 180 days stored e-mail — read or unread — can be accessed without such a warrant.

The Stored Communications Act was enacted at a time when e-mail generally wasn’t stored on servers at all, but instead passed through them briefly on their way to the recipient’s inbox. In today’s reality, e-mail can, and is, being stored on servers forever. A consortium of businesses, including Google and Microsoft, recently asked Congress to update the law and require probable cause to obtain any e-mail.

Until Friday, the government’s position in the Colorado case tried to push the outdated law even further. Prosecutors were arguing that opened e-mail less than 180 days old is no longer in “electronic storage” as defined by the law — which allows the feds to obtain that e-mail without probable cause.

Yahoo spokeswoman Dana Lengkeek said in a telephone interview that:

“We’re pleased with the decision and we continue to be committed in protecting the privacy of users.”

Colorado prosecutors declined comment.

Feds Can Search, Seize P2P Files Without Warrant
Shield Law Overturns Warrant for Student Photographer
TSA Threatens Blogger Who Posted New Screening Directive
FBI Raids Boarding Pass Maker’s House, Seizes Computers
Want a Wiretap Warrant? No Problem, Court Says
Court’s Steroid Ruling Pumps Up Computer Privacy
FCC’s Warrantless Household Searches Alarm Experts
Feds ‘Pinged’ Sprint GPS Data 8 Million Times Over a Year

Yahoo, Verizon: Our Spy Capabilities Would ‘Shock’, ‘Confuse’ Consumers

December 1, 2009

Wired - Want to know how much phone companies and internet service providers charge to funnel your private communications or records to U.S. law enforcement and spy agencies?

That’s the question muckraker and Indiana University graduate student Christopher Soghoian asked all agencies within the Department of Justice, under a Freedom of Information Act (FOIA) request filed a few months ago. But before the agencies could provide the data, Verizon and Yahoo intervened and filed an objection on grounds that, among other things, they would be ridiculed and publicly shamed were their surveillance price sheets made public. Yahoo writes in its 12-page objection letter (.pdf), that if its pricing information were disclosed to Soghoian, he would use it “to ’shame’ Yahoo! and other companies — and to ’shock’ their customers.”

“Therefore, release of Yahoo!’s information is reasonably likely to lead to impairment of its reputation for protection of user privacy and security, which is a competitive disadvantage for technology companies,” the company writes.

Verizon took a different stance. It objected to the release (.pdf) of its Law Enforcement Legal Compliance Guide because it might “confuse” customers and lead them to think that records and surveillance capabilities available only to law enforcement would be available to them as well — resulting in a flood of customer calls to the company asking for trap and trace orders.

“Customers may see a listing of records, information or assistance that is available only to law enforcement,” Verizon writes in its letter, “but call in to Verizon and seek those same services. Such calls would stretch limited resources, especially those that are reserved only for law enforcement emergencies.”

Other customers, upon seeing the types of surveillance law enforcement can do, might “become unnecessarily afraid that their lines have been tapped or call Verizon to ask if their lines are tapped (a question we cannot answer).”

Verizon does disclose a little tidbit in its letter, saying that the company receives “tens of thousands” of requests annually for customer records and information from law enforcement agencies. Soghoian filed his records request to discover how much law enforcement agencies — and thus U.S. taxpayers — are paying for spy documents and surveillance services with the aim of trying to deduce from this how often such requests are being made. Soghoian explained his theory on his blog, Slight Paranoia:

In the summer of 2009, I decided to try and follow the money trail in order to determine how often Internet firms were disclosing their customers’ private information to the government. I theorized that if I could obtain the price lists of each ISP, detailing the price for each kind of service, and invoices paid by the various parts of the Federal government, then I might be able to reverse engineer some approximate statistics. In order to obtain these documents, I filed Freedom of Information Act requests with every part of the Department of Justice that I could think of.

The first DoJ agency to respond to his request was the U.S. Marshals Service (USMS), which indicated that it had price lists available for Cox Communications, Comcast, Yahoo and Verizon. But because the companies voluntarily provided the price lists to the government, the FOIA allows the companies an opportunity to object to the disclosure of their data under various exemptions. Comcast and Cox were fine with the disclosure, Soghoian reported. He found that Cox Communications charges $2,500 to fulfill a pen register/trap-and-trace order for 60 days, and $2,000 for each additional 60-day-interval. It charges $3,500 for the first 30 days of a wiretap, and $2,500 for each additional 30 days. Thirty days worth of a customer’s call detail records costs $40.

Comcast’s pricing list, which was already leaked to the internet in 2007, indicated that it charges at least $1,000 for the first month of a wiretap, and $750 per month thereafter.

But Verizon and Yahoo took offense at the request.

Yahoo objected on grounds that its pricing constituted “confidential commercial information” and cited Exemption 4 of the Freedom of Information Act and the Trade Secrets Act.

Exemption 4 of the FOIA refers to the disclosure of commercial or financial information that could result in a competitive disadvantage to the company if it were publicly disclosed. The company claims its pricing is derived from labor rates for employees and overhead and, therefore, disclosing the information would provide clues to its operating costs — regardless of whether these same clues are already available in public records, such as those the company files with the Securities and Exchange Commission. The company also claims that since Soghoian is trying to determine the actual amounts the Marshals Service paid Yahoo for responding to requests, the price lists are irrelevant, since “there are no standard prices for these transactions.”

But equally important to Yahoo’s objections was the potential for “criticism” and ridicule. Yahoo quoted Soghoian on his blog writing that his aim was to “use this blog to shame the corporations that continue to do harm to user online privacy.”

Yahoo also objected to the disclosure of its letter objecting to the disclosure of pricing information saying that “release of this letter would likely cause substantial competitive harm” to the company. The company added, in a veiled threat, that if the Marshals Service were to show anyone its letter objecting to the disclosure of pricing information, it could “impair the government’s ability to obtain information necessary for making appropriate decisions with regard to future FOIA requests.”

If anyone out there has a copy of Verizon or Yahoo’s law enforcement pricing list and wants to share it, feel free to use our anonymous tip address.