Richard McCutcheon*1<\/p>\n\n\n\n
[This essay is available in PDF at this link<\/a>]<\/p>\n\n\n\n The Stored Communications Act (SCA)[1]<\/sup><\/a> has generated numerous practical headaches for academics and judges as digital technology advances in scope and importance.<\/a>[2]<\/sup><\/a> Created in 1986 as part of the Electronic Communications Privacy Act (ECPA), the SCA established the statutory regime that governs access to stored electronic communications by the government and third parties.<\/a>[3]<\/sup><\/a> The SCA has been repeatedly criticized for being outdated and ill-suited for modern technology.[4]<\/sup><\/a> Despite a decade of continuous efforts to reform the SCA, none have been successful.[5]<\/sup><\/a><\/p>\n\n\n\n Certain provisions of the SCA are not only unintuitive and confusing but unconstitutional as well.[6]<\/sup><\/a> The SCA empowers government entities to require digital service providers to disclose electronic communications stored in a system for 180 days or more by using a subpoena instead of a warrant.[7]<\/sup><\/a> The 180-day distinction is neither principled, nor constitutional.<\/a>[8]<\/sup><\/a><\/p>\n\n\n\n The constitutionality of the SCA\u2019s temporal subpoena authority has been primarily predicated on the Fourth Amendment\u2019s third-party doctrine.[9]<\/sup><\/a> The third-party doctrine states that individuals have a reduced privacy interest in records held by third parties, such as internet service providers.<\/a>[10]<\/sup><\/a> Academics and commentators have strongly criticized the application of the third-party doctrine to digital technology.<\/a>[11]<\/sup><\/a> Several states rejected the third-party doctrine by using the Fourth Amendment equivalent found in their respective state constitutions.[12]<\/sup><\/a> The generally unfettered third-party doctrine allowed for the development of an immense and unprecedented surveillance state.[13]<\/sup><\/a><\/p>\n\n\n\n Over the last decade, the Supreme Court has begun reconsidering the Fourth Amendment\u2019s third-party doctrine.[14]<\/sup><\/a> In Carpenter v. United States<\/em>, the Court ruled that collection of cell-site location information (CSLI) under the SCA\u2019s subpoena authority was unconstitutional.[15]<\/sup><\/a> The Court justified its departure from the third-party doctrine by considering CSLI a special category of information worthy of full Fourth Amendment protections, requiring probable cause and a warrant to obtain.[16]<\/sup><\/a> Some commentators have speculated that Carpenter <\/em>marked the end of the third-party doctrine as applied to digital data and have anticipated a massive overhaul to digital surveillance law.<\/a>[17]<\/sup><\/a> Under the reasoning expressed in Carpenter<\/em>, electronically stored communications should be considered information of a similar type to cell-site location information.[18]<\/sup><\/a><\/p>\n\n\n\n In a post-Carpenter <\/em>world, the 180-day clause of the SCA should be considered impractical at best and unconstitutional at worst for three reasons. First, constitutional and policy justifications for the SCA\u2019s regulatory scheme have always been ill-conceived for the information age. Second, Carpenter<\/em> removes the critical constitutional justification of the SCA\u2019s temporal clause by effectively overturning the third-party doctrine sub silentio<\/em>. Third, even if Carpenter <\/em>did not abrogate the third-party doctrine, the Court in Carpenter <\/em>strongly indicated that it would no longer apply the third-party doctrine to most electronic communications. In the wake of Carpenter<\/em>, the SCA should be rewritten to be clearer and adhere to current Fourth Amendment jurisprudence.<\/p>\n\n\n\n Initially conceived as a privacy protection regulation meant to address gaps in Fourth Amendment coverage,[19]<\/sup><\/a>the SCA today infringes on, rather than supplements, the Fourth Amendment.[20]<\/sup><\/a> The 180-day storage clause of the SCA allows the government access to contents that would otherwise enjoy Fourth Amendment protection.[21]<\/sup><\/a> The disparate treatment of electronic communications based on a temporal distinction in the SCA has never been sufficiently justified by a policy or Fourth Amendment rationale.[22]<\/sup><\/a><\/p>\n\n\n\n Since much of the statutory language and concepts incorporated in the SCA originate from the 1968 Wiretap Act,[23]<\/sup><\/a> a brief primer on the Wiretap Act is necessary. Each Act affords different levels of protection based on its own respective distinctions concerning the categories of information sought. In short, the Wiretap Act provides the intellectual baseline from which the SCA attempts to draw and distinguish itself. This outdated baseline has ultimately created problems for the SCA\u2019s application today. <\/p>\n\n\n\n In its most basic form, the Wiretap Act provides enhanced statutory protection, in addition to the Fourth Amendment\u2019s safeguards, for communications \u201cintercept[ed]\u201d using a surveillance device.[24]<\/sup><\/a> Essentially, the Wiretap Act not only prohibits the warrantless surveillance of communications while the communication is in transit, but also imposes additional statutory requirements for obtaining a warrant.[25]<\/sup><\/a><\/p>\n\n\n\n Filling the holes not covered by the Wiretap Act, the SCA concerns \u201cstored\u201d communications held by \u201ca provider of electronic communication service.\u201d[26]<\/sup><\/a> Under the SCA, a service provider may be subpoenaed to surrender electronic communications that have been stored in its system for more than 180 days.[27]<\/sup><\/a> In other words, the same communication which the Wiretap Act requires a specialized warrant to intercept in real time would be accessible by subpoena after a 180-day period.[28]<\/sup><\/a><\/p>\n\n\n\n The distinctions in the statutes\u2019 treatment of intercepted and stored communications rest on three ill-formed justifications: (1) the third-party doctrine, (2) the concept of \u201cabandonment\u201d and (3) the retrospective-prospective surveillance distinction.<\/a>[29]<\/sup><\/a> Each rationale fails to justify the overbearing reach of the SCA\u2019s subpoena authority and provides an outdated, impractical framework for addressing the competing interests of privacy and security in the modern technological landscape. The third-party doctrine and abandonment justifications both share an identical flaw of improperly analogizing distinctions conceived for physical property to digital data without considering the practical differences between the two. Likewise, the retrospective-prospective distinction creates a reductive hierarchy of data sensitivity based on temporal lines instead of taking into account the practical reality of how data is consumed and used. The intellectual framework from which the SCA emerged thus contains irreparable flaws that unjustifiably diminish American privacy. <\/p>\n\n\n\n The third-party doctrine, a property-based distinction created by the Court\u2019s Fourth Amendment jurisprudence that empowers the government to seize property held by third parties without a warrant, has never worked in the context of digital data.[30]<\/sup><\/a> First established in United States v. Miller<\/em>[31]<\/sup><\/a> and refined by Smith v. Maryland<\/em>,[32]<\/sup><\/a> the third-party doctrine states that information voluntarily conveyed to a third party enjoys no expectation of privacy.[33]<\/sup><\/a> As the Court held in Katz v. United States<\/em>, the Fourth Amendment does not protect against government searches when the individual has no reasonable expectation of privacy in the object of the search.[34]<\/sup><\/a> The logic underpinning the third-party doctrine comes from the assumption that the disclosing individual assumed the risk of the third party\u2019s disclosure of that information to the government, thereby extinguishing any expectation of privacy.[35]<\/sup><\/a> The third-party doctrine does not make any practical sense in the context of digital data, and the problems associated with it have contaminated the composition of the SCA. <\/p>\n\n\n\n While the third-party doctrine has roots specifically in the Fourth Amendment, the Court\u2019s logic extended beyond interpreting the Fourth Amendment into shaping the statutory schemes for surveillance regulations.[36]<\/sup><\/a> For instance, the Wiretap Act offers increased protections beyond the Fourth Amendment\u2019s warrant requirement and exclusionary remedies since citizens already have a Fourth Amendment protection from warrantless wiretaps.[37]<\/sup><\/a> By contrast, the SCA does little to supplement protection and offers no exclusionary remedy for its violation.[38]<\/sup><\/a> The lesser protections under the SCA mirror the perceived \u2018lesser\u2019 privacy interests in stored communications held by third parties under the Fourth Amendment.[39]<\/sup><\/a><\/p>\n\n\n\n The SCA\u2019s statutory structure, when compared to the Wiretap Act, reflects the distinctions imposed by the third-party doctrine.[40]<\/sup><\/a> Communications in transit are not property held by any one individual given the nature of their constant movement.[41]<\/sup><\/a> Stored communications held by a third party, however, are the records of that third party.[42]<\/sup><\/a>According to the third-party doctrine, an individual has a lesser expectation of privacy in the records held by a third-party\u2014a distinction not reflected by reality.[43]<\/sup><\/a><\/p>\n\n\n\n The conceptual problems with the third-party doctrine in the context of digital surveillance have been extensively detailed by academics and privacy advocates.<\/a>[44]<\/sup><\/a> The general expert consensus states that the third-party doctrine simply does not work as intended and greatly expands the government\u2019s surveillance capabilities without strong justification.<\/a>[45]<\/sup><\/a>Since internet architecture requires the use of third parties to function, essentially all communications online are subject to the third-party doctrine.[46]<\/sup><\/a><\/p>\n\n\n\n Online communications form the backbone of American social and financial lives in the twenty-first century.[47]<\/sup><\/a>People increasingly rely on the internet for everyday communication, dating, political participation, and financial services.[48]<\/sup><\/a> The categorical exclusion of information held by third parties from Fourth Amendment protection has given the government has access to people\u2019s most private information with a mere subpoena due to the SCA\u2019s limited statutory protection.[49]<\/sup><\/a><\/p>\n\n\n\n The third-party doctrine creates a massive contradiction: despite the fact that many individuals\u2019 most private and intimate communications occur online, those communications have no reasonable expectation of privacy since the online technology requires third parties to function. Recognizing the issue, the Court has become more sensitive to the issues presented by the third-party doctrine in the last decade.[50]<\/sup><\/a> As discussed in Part III, the third-party doctrine has been increasingly questioned by the Court, and Carpenter <\/em>may have put the final nail in the coffin.[51]<\/sup><\/a><\/p>\n\n\n\n Even without the Court\u2019s recent reconsideration of the Fourth Amendment, the third-party doctrine as a policy decision makes little practical sense. Internet usage among Americans has become inseparable from everyday life, with essentially every American younger than age fifty utilizing internet services in some manner.[52]<\/sup><\/a> The recent COVID-19 crisis has only further highlighted the essential quality of internet to American life.[53]<\/sup><\/a> <\/p>\n\n\n\n The problems presented by the third-party doctrine are well-known and have only been exacerbated by technological development. As Professor Solove eloquently put it in his 2002 seminal work on the third-party doctrine from 2002, \u201c[w]e are becoming a society of records, and these records are not held by us, but by third parties.\u201d[54]<\/sup><\/a> Today, individuals who want to participate in everyday society must surrender their information to third parties to use practically any digital platform.[55]<\/sup><\/a><\/p>\n\n\n\n To permit the invasion of an individual\u2019s privacy as a cost for participation in society undermines the concept of a right to privacy itself. The SCA purports to be a privacy protection measure, but instead it allows almost limitless access to immensely sensitive information merely because those records are held by third parties. If an everyday person cannot hope to maintain privacy with regards to digital data, what privacy truly remains? If one\u2019s private sexual, political, personal, and emotional expressions can be readily obtained by the government without meaningful recourse to contest their collection, what can even be considered worth protecting? <\/p>\n\n\n\n Even in the days of Smith <\/em>and Miller<\/em>, the third-party doctrine was ill-suited to handle privacy issues.[56]<\/sup><\/a> As far back as the late 1970s when Smith <\/em>was decided, service providers were already engaging in substantial data-collection practices beyond consumers\u2019 ability to control.[57]<\/sup><\/a> The problems inherent in the third-party doctrine have been exponentially magnified by the increasing importance of digital technology.<\/p>\n\n\n\n The untenable Fourth Amendment jurisprudence of the third-party doctrine infected the SCA at its inception. As a result, the SCA inherited an equally untenable, overly broad distinction in its statutory regime: the idea that digital records held by third parties warrant lesser protections. The SCA\u2019s troubled upbringing created a Frankenstein\u2019s Monster of a surveillance law that achieves the opposite goals of its original intentions. <\/p>\n\n\n\n The seemingly arbitrary decision to revoke protection for stored communications older than 180 days stems from a tortured application of the concept of abandonment.[58]<\/sup><\/a> For Fourth Amendment purposes, property is abandoned when a person can no longer claim a \u201ccontinuing, legitimate expectation of privacy\u201d concerning the property at issue.[59]<\/sup><\/a> While the test is fact dependent, the critical components of abandonment are actions indicating that the owner sought to relinquish ownership of the property.[60]<\/sup><\/a> Once the property has been abandoned, the property loses Fourth Amendment coverage.[61]<\/sup><\/a><\/p>\n\n\n\n For physical property, the concept of abandonment makes intuitive, practical sense. After all, in most circumstances, when an individual has left physical property with a third party for an extended duration and made no effort to retrieve it, it is safe to assume that individual no longer cares about the property. For example, mail left unopened at the post office for over a year can be considered abandoned.[62]<\/sup><\/a><\/p>\n\n\n\n The principles of abandonment cannot be easily applied to digital data. Unlike physical property, online data in the vast majority of circumstances cannot function independently or be withdrawn from the third-party service provider.[63]<\/sup><\/a>To use the mail example, it would be as if mail could only be viewed from the post office, and the post office retained its own copy of the mail. Even if one were to create one\u2019s own copy, the post office would still retain the mail. As a result, the third party always retains possession of the property in the digital sphere, unlike physical property. The amount of time data spends stored digitally does not reflect whether the end user intends to make use of it, and to use the data, the data inevitably must be stored with a third party. <\/p>\n\n\n\n Applying the concept of abandonment to digital data makes little sense and reflects the persistent problem of using pre-Internet jurisprudence in the context of digital data.[64]<\/sup><\/a> When the property in question always is held by the third party, there can be no meaningful expression of disowning based solely on the duration the third party held the property. Analogizing physical property concepts like abandonment to digital data ignores the substantial differences in how digital data operates.[65]<\/sup><\/a><\/p>\n\n\n\n No compelling justification exists to incorporate the abandonment doctrine into the digital surveillance sphere. The Department of Justice itself admits the SCA\u2019s 180-day duration provides no principled rationale for its differential treatment and recommends removing it.[66]<\/sup><\/a> Abandonment has no place in justifying the SCA\u2019s subpoena authority. <\/p>\n\n\n\n The third flawed reason for differential treatment between stored communication and communication in transit stems from a policy distinction in retrospective versus prospective surveillance.[67]<\/sup><\/a> Retrospective surveillance seeks to obtain information that already exists, whereas prospective surveillance obtains information as it is created.[68]<\/sup><\/a> Hence, \u201cstored\u201d communications being an important component of the SCA\u2014and why \u201cstored\u201d information may be considered worthy of lesser protections when compared to the Wiretap Act, which seeks information in transit. <\/p>\n\n\n\n In the past, academics have viewed the privacy concerns implicated by retrospective surveillance as different from prospective surveillance, with the former implicating lesser privacy considerations than the latter.[69]<\/sup><\/a> The distinctions rest on considerations that lack merit in the modern technology-driven world.[70]<\/sup><\/a><\/p>\n\n\n\n Given the scope and character of Americans\u2019 online interactions, the retrospective-prospective dichotomy can be considered a distinction without a difference. People place more information than ever before in the digital sphere, including their most intimate secrets and important information.[71]<\/sup><\/a> Stored communications often reveal people\u2019s political, sexual, religious, and familial associations.[72]<\/sup><\/a> That the information was obtained in real-time, rather than retroactively, does not change the sensitive nature of the information taken.<\/p>\n\n\n\n Academics have attempted to justify the retrospective-prospective distinction by illustrating two weak practical differences.[73]<\/sup><\/a> First, prospective surveillance can constitute a \u201cdragnet\u201d which inadvertently captures irrelevant or unneeded information for the government\u2019s lawful objective.[74]<\/sup><\/a> By contrast, retrospective surveillance may be more limited by only capturing information that already exists and can be identified as proportional to the government\u2019s lawful objective.[75]<\/sup><\/a> Second, due to the aforementioned issues inherent to prospective surveillance, filtration remains a more challenging practical consideration for prospective surveillance and incidental observations of sensitive information may be more of a risk.[76]<\/sup><\/a><\/p>\n\n\n\n Perhaps at one point where the subject matter and contents of stored digital information were limited in scope and importance, the retrospective-prospective justification had its place as a meaningful way to distinguish searches by sensitivity. However, in the modern age, where stored data contains extremely sensitive information regularly, the lesser status afforded to retrospectively obtained data does not make practical sense. Information obtained through each mode of surveillance can pry into private information. <\/p>\n\n\n\n Both retrospective and prospective surveillance present significant privacy concerns of the highest order. Even if prospective surveillance presents some additional privacy considerations, it does not justify the severely disparate treatment that the electronic surveillance statutory regime establishes between data in transit and stored data. <\/p>\n\n\n\n Further, the retrospective-prospective justification focuses on the wrong variable. Instead of concerning itself with what privacy interests are implicated, the retrospective-prospective distinction primarily considers the ease of filtration of information. Even if one disregards the filtration difficulties imposed by the vast amount of data searchable under the SCA, the focus on filtration subordinates a major privacy consideration to a minor enforcement consideration. The proper focus is on the sensitivity of the information captured, not the filtration of unnecessary or incidental information. <\/p>\n\n\n\n The retrospective-prospective distinction has become an outdated, meaningless distinction.[77]<\/sup><\/a> Prior to the modern information age, the distinction may have meant something practically, if still conceptually unprincipled, when the records held by third parties generally encompassed a limited species of data.[78]<\/sup><\/a> Considering the modern realities of how information is conveyed, however, the competing privacy interests in retrospective versus prospective surveillance are minimal. This flawed distinction created the backbone of SCA\u2019s statutory framework, distinguished it from the Wiretap Act, and contributed to its unworkable nature in the modern era. <\/p>\n\n\n\n The critical assumption forming the basis of the SCA\u2019s subpoena powers was that, due to the third-party doctrine, the Fourth Amendment did not protect stored communications.[79]<\/sup><\/a> Over the last decade, however, members of the Court have increasingly challenged the logic underpinning the third-party doctrine.[80]<\/sup><\/a> Those challenges, along with the Court\u2019s dissatisfaction with the third-party doctrine, culminated in the Carpenter<\/em> decision and likely extinguished the doctrine entirely\u2014despite the Court\u2019s protestation to the contrary. <\/p>\n\n\n\n Carpenter <\/em>concerned the FBI\u2019s search of cell-site location information (\u201cCSLI\u201d) under the SCA.[81]<\/sup><\/a> Cell phones generate CSLI to connect to nearest \u201ccell-site,\u201d which provides wireless service to the cell phone.[82]<\/sup><\/a> CSLI collects the phone\u2019s geographic location with a timestamp to assist in locating the nearest cell-site and performing a variety of other functions.[83]<\/sup><\/a><\/p>\n\n\n\n The FBI sought 152 days of CSLI from MetroPCS and Sprint concerning Timothy Carpenter, a suspect in a string of armed robberies.[84]<\/sup><\/a> Using the SCA\u2019s subpoena powers, the FBI obtained the information, and Carpenter was convicted at trial.[85]<\/sup><\/a> Carpenter appealed his conviction on the grounds the CSLI had been obtained without a warrant in violation of the Fourth Amendment.[86]<\/sup><\/a><\/p>\n\n\n\n The Court agreed with Carpenter that a warrant was required for the government to obtain the CSLI data for use against him at his trial.[87]<\/sup><\/a> In a 5-4 decision, the Court determined that due to the revealing and automatic nature of CSLI, the acquisition of the data was a search under the Fourth Amendment.[88]<\/sup><\/a> Writing for the majority, Chief Justice Roberts noted the decision was \u201cnarrow\u201d and not intended to disturb the ordinary application of the third-party doctrine.[89]<\/sup><\/a> Nonetheless, the principles expressed in Carpenter<\/em> reveal that the decision may not be as narrow as Chief Justice Roberts stated.[90]<\/sup><\/a><\/p>\n\n\n\n The dissenting members of the Court expressed significant doubts that the holding of Carpenter <\/em>could be constrained to the \u201cnarrow\u201d facts presented in the case. In his dissent, Justice Gorsuch remarks that Carpenter <\/em>put the third-party doctrine on \u201clife support.\u201dIntroduction<\/a><\/h1>\n\n\n\n
I. The Wiretap Act and Past Justifications for the SCA\u2019s Statutory Structure<\/a><\/h1>\n\n\n\n
A. The Third-Party Doctrine Justification: Broad, Impractical Nonsense<\/a><\/h2>\n\n\n\n
B. The Abandonment Justification: Should Be Abandoned in the Digital Sphere<\/a><\/h2>\n\n\n\n
C. The Retrospective-Prospective Distinction: The Distinction with No Difference<\/a><\/h2>\n\n\n\n
II. Carpenter<\/em>: <\/em>The End of the Third-Party Doctrine and the SCA As We Know It<\/a><\/h1>\n\n\n\n
A. Carpenter and Its Allegedly \u201cNarrow\u201d Holding<\/a><\/h2>\n\n\n\n