September 21, 2023

D.C. Circuit Court Decision Brings Attention to Stored Communications Act

Holland & Knight Cybersecurity and Privacy Blog
Cary Aronovitz

A decision from the U.S. Court of Appeals for the District of Columbia Circuit in August 2023 made the rounds with headline-grabbing subjects such as X. Corp (formerly known as Twitter), sanctions and an investigation of former President Donald Trump. However, a key component of the decision centered around the Stored Communications Act (SCA), 18 U.S.C. § 2701 et seq., which establishes procedures for companies to respond to search warrant or subpoena requests in relation to its user's content or data.

Importantly, companies that obtain data and user communications – as varied as Twitter, Meta, Google, LinkedIn, Airbnb or Lyft – can find themselves served with a search warrant seeking the content of a user's communications. While it only requires a subpoena to obtain a subject's user history – such as rides taken with Lyft – to obtain the subject's communications with a Lyft driver, for example, requires a search warrant that is governed by the SCA.

The D.C. Circuit's Twitter opinion highlights the importance of a company or non-party's grasp and understanding of the SCA both in deciding to produce data and when the law permits – or even requires – the company to withhold such information. 

The SCA

The SCA prohibits service providers from knowingly divulging electronic communications stored under their control, although subject to certain exceptions. United States v. Wenk, 319 F. Supp. 3d 828, 829 (E.D. Va. 2017). Importantly, the SCA is a one-way government street; it only allows the government to seek electronically stored communications by an internet provider. Thus, in the Wenk decision, Google successfully quashed a subpoena from a criminal defendant seeking Google's records in its defense. In Wenk, the court noted that "based upon the plain language of the SCA, [18 USC 2702] service providers such as Google are not required to disclose communications covered by the Act," and recognized that while the SCA has exceptions for law enforcement or due to a party's consent, it does not provide exceptions for criminal defendants. Id.; see also United States v. Glenn, 341 F.R.D. 217, 222 (N.D. Ohio 2022) (quashing criminal subpoena to Meta for content of a deceased victim's social media account as "The SCA allows only the Government to seek electronically stored communications from internet provide").

Importantly, the SCA equally applies in the civil realm, and non-parties that receive subpoenas may object arguing disclosure of content of messages is protected or prohibited under the SCA. See Sines v. Kessler, No. 18-MC-80080-JCS, 2018 WL 3730434, at *10 (N.D. Cal. Aug. 6, 2018) (reiterating in a civil case that a non-party that provided electronic communication service to the public was prohibited from disclosing "content of a message without consent of the sender or recipient of the communication").

The NDO

At issue in the D.C. Circuit's Twitter opinion was Twitter's challenge to the nondisclosure order (NDO) that accompanied a search warrant for President Trump's messages within his Twitter account. While Twitter sought to notify the subject of the search warrant, the D.C. Circuit determined that the government had a compelling interest in preserving the integrity and secrecy of its investigation and that the NDO was narrowly tailored to serve that interest. Last, the district court's $350,000 sanction was upheld on appeal as the D.C. Circuit particularly noted Twitter's $40 billion valuation and the district court's effort to require compliance with its orders.

Conclusion

In sum, the SCA is an important statute that protects a service provider from disclosing its users' content information, subject to exceptions such as a duly signed search warrant or the user's consent. Companies and non-parties that receive subpoenas and other requests for information must understand the statute, which in many cases can save the company resources in responding to burdensome discovery requests. In addition, companies must be mindful of properly signed NDOs, which the D.C. Twitter decision reaffirms are typically upheld and preserve the integrity of government investigations.

Related Insights