Preservation Letters Under 2703(f): Your Data Is Frozen and You Weren't Told.

Yes, investigators can. Section 2703(f) of the Stored Communications Act (SCA) authorizes preservation demands before the arrival of “legal process.” If the § 2703(f) data preservation demand results in sufficient suspicion, then the data will remain frozen for an additional 90 days, totaling up to 180 days.

So it seems like the “legal process” is the ultimate, and the § 2703(f) demand is just the lead up. But that’s not exactly the case. The statutory text of § 2703(f) has neither a requirement for judicial approval nor a requirement for subscriber notice. In fact, the Electronic Communications Privacy Act of 1986’s “interception” restriction only applies to the “electronic communication” itself, not to stored data.

To explain this a bit more, the Electronic Communications Privacy Act of 1986 is a broad statute that placed the focus on “interception.”

Under the Electronic Communications Privacy Act, “interception” is defined as:

Interception of any wire, oral, or electronic communication . ..

The Electronic Communications Privacy Act’s “interception” restriction is limited to “electronic communication.” That definition is:

Electronic communication means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce.

When Congress amended the Electronic Communications Privacy Act, it created the Stored Communications Act, which is codified at 18 U.S.C. §§ 2701-2713. The Stored Communications Act allows investigators to access “electronic communications” (not just “interception”) through subpoenas, court orders, and warrants. Specifically, 18 U.S.C. § 2703 governs government requests and demands for stored data held by cloud providers and other entities.

Section 804 of the Antiterrorism and Effective Death Penalty Act of 1996 added Section 2703(f) to the Stored Communications Act. This section allows government officials to demand the “preservation of records, including those which are stored in electronic form” in order to “preserve” them pending “legal process.”

What Exactly Does a Section 2703(f) Letter Preserve?

The statutory text of Section 2703(f) says “that a governmental entity may request to the provider to preserve records and other evidence in its possession pending the issuance of a court order, subpoena, or other process.”

As described above, that looks like it allows a government official to preserve everything that the cloud provider has in its possession.

And when you look at the Justice Department’s model preservation letter, it seems to agree. The model letter says:

“As we are investigating . .., we request that you preserve . .. all data currently in your possession pertaining to the accounts and/or devices listed below.”

That means that the Justice Department is requesting the preservation of any and all records and data the provider has in its possession. But can providers comply with requests like that?

While providers have a lot of tools at their disposal to comply with government requests, in many cases, they rely on “account snapshots.” This means that they make a copy of the account data they possess at that moment in time. Then they store the copy as a “preserved” version for future use.

Crucially, the Justice Department’s model preservation letter sends the demand to the provider’s Legal Compliance Department. It says to “instruct the account holder to not use the devices . .. as an excuse to delete data” to ensure the “preserved data is reflective of the data currently in your possession, without any data loss by the user.”

This means the request is intended to capture not only the records and other evidence in the provider’s possession when the request arrives, but also any data the user adds to his or her account after the request arrives.

However, that interpretation is not entirely right. To understand why, you need to look at the Justice Department’s computer-crime-related electronic data preservation guidelines. The guidelines state:

“ Preserve the data that the service provider or other entity has in its possession or control at the time it receives the request.”

This confirms what we suspected, that the § 2703(f) preservation request is only intended to capture the data that is in the service provider’s or other entity’s “possession or control at the time it receives the request.”

The Justice Department’s computer-crime-related electronic data preservation guidelines also make clear that “data preservation will be a snapshot in time.” So, if you delete a piece of evidence after a § 2703(f) preservation request, the provider will still have the copy it made. And, similarly, if you add a new piece of evidence, it will not be part of the “snapshot” that the provider has preserved.

So, even though the Justice Department’s model letter uses language that might be open to interpretation, the DOJ guidelines clarify the scope of § 2703(f) preservation requests.

Why Wasn’t I Told My Cloud Data Was Frozen?

The answer to this question is a little more complicated than the answer to the previous question.

The answer is “We can’t tell you that we served a 2703 warrant.” But, that’s not quite what happened.

The 2703 warrant is a search warrant served on a service provider. A 2703 warrant requires that the service provider disclose the “contents of a wire or electronic communication” or “records or other information pertaining to the computer, network, server, or other facility involved.”

The stored communications stored in the cloud are “electronic communications.”

The Electronic Communications Privacy Act of 1986 established Section 2703(a) as originally enacted. As a result, warrants are required to obtain “contents of wire or electronic communications” that have been in electronic storage for “180 days or less.” If a request is for communication in electronic storage for “more than 180 days,” then the government only needs to present the specific facts that justify the information is being sought “under the circumstances” of the investigation.

If a warrant is served under the Electronic Communications Privacy Act or the Stored Communications Act, then Section 2705(b) may apply. This provision provides:

“The governmental entity may delay notification of the existence of the court order or subpoena where there is reason to believe that notification may result in: (A) endangering the life or physical safety of an individual; (B) flight from prosecution; (C) destruction of or tampering with evidence; (D) intimidation of potential witnesses; or (E) otherwise seriously jeopardizing an investigation or unduly delaying a trial.”

So, if there is a warrant, then notice may be delayed.

But, as discussed above, the preservation request itself does not result in judicial approval.

The only way to find out about a § 2703(f) demand is to find out about the legal process that follows.

But, as discussed above, there might be no legal process, and the § 2703(f) demand might result in nothing.

How Long Can the Government Keep My Data Frozen?

The initial period of preservation is 90 days. The governmental entity then has to “submit an application or issue a court order, subpoena, or other process” by the end of the initial 90-day preservation period. If it does not, then the provider is no longer obligated to continue preserving the material.

However, if the governmental entity submits a renewed request, the provider must extend the preservation, and the statute requires no showing of suspicion to support that extension. With a renewed preservation request, the preservation continues for another 90 days.

Congress added Section 2703(f) to the Electronic Communications Privacy Act through Section 804 of the Antiterrorism and Effective Death Penalty Act of 1996.

The provision addressed issues with preserving evidence in the face of routine and program-driven deletion practices. With providers that are deletion-driven, investigators may not have time to apply for a warrant before the evidence vanishes.

With this background in mind, it makes sense to consider the preservation period to be temporary. Indeed, Section 2703(f) expressly provides one possibility of extension, stating that the “request can be renewed. .. one time.” The provision does not mention serial re-requests, and the Justice Department’s guidelines call the 2703(f) demand “temporary.”

However, when you dig a little deeper, it turns out that Section 2703(f) doesn’t say it only applies when investigators have a warrant application in mind. In fact, one of the ACLU’s points in the brief is that preservation demands “have been used on a wide scale before warrants were pursued.” The ACLU brief also cites a specific case where a preservation demand was issued “nine months before a warrant was applied for.”

If, as in some cases, a § 2703(f) preservation request does not serve merely to buy time to apply for a warrant, and rather is simply intended to freeze a user’s account, this raises some serious Fourth Amendment concerns. With a data snapshot as a result, investigators are essentially ensuring that “no evidence is destroyed in the interim,” thereby removing the incentive to promptly apply for a warrant.

Todd Spodek is the managing partner of Spodek Law Group, a second generation criminal defense firm that has been practicing since 1976.

Can I Challenge a Preservation Letter Before Prosecutors Get My Data and Other Information?

Once the government obtains a warrant to access preserved evidence, any issues that arise during the preservation phase will still remain. However, the issue is that the Stored Communications Act does not give the customer any mechanism to challenge the preservation before disclosure.

While Section 2703(d) and Section 2703(h)(2) contain the following quash provisions:

• “A court may order a person served with a court order to produce . .. the person’s records to set aside, modify or limit the scope of such order,” and,
• “A person who receives a subpoena to disclose information . .. can move in a United States district court to quash or modify the subpoena,”

both provisions apply to the “disclosure process” itself, not a preservation request.

And since Section 2703(f) is not subject to judicial review, and has no application to the process that follows a preservation request, it seems unlikely that Section 2703(f) warrants any special judicial scrutiny.

The Stored Communications Act provides no means of relief for violations by the United States. Section 2707 permits a party to seek civil recovery against a defendant, “other than the United States,” for the “knowing or intentional” violation of “any provision of this title.” However, the United States is explicitly exempt.

As opposed to Section 2707, Section 2712 allows an individual aggrieved by a willful violation of this chapter to bring a damages action against the United States, recovering actual damages of not less than $10,000 plus litigation costs.

Further, Section 2708 explicitly prohibits suppression as a remedy for non-constitutional violations under the Stored Communications Act.

It is worth noting that while the law provides no mechanism for customers to challenge a Section 2703(f) demand, there is a mechanism for the targeted provider to challenge an order. In this case, Section 2703(d) provides that the issuing court, on a motion made promptly by the service provider, may quash or modify the order if the information or records requested are “unusually voluminous in nature” or compliance would otherwise cause “an undue burden” on the provider.

As discussed previously, providers are often more concerned about complying with § 2703(f) requests than about the requests’ legality. This may explain why the Justice Department’s computer-crime guidelines are entitled to presume the targeted entity’s compliance as soon as it learns of the request, as well as since “the burden is nominal.”

Furthermore, this perspective is also provided for in Section 2703(e), which provides “complete immunity” for any entity that “discloses the records or information as a result of a warrant, court order, subpoena, or other process” or is otherwise induced to disclose “records or information.”

So, in practice, the government, the targeted entity, and the law see a § 2703(f) request as very different from an actual request to disclose records. Thus, it is almost as important for a customer to defend against the preservation request itself, as it is to defend against the disclosure that will come next.

Does a Preservation Letter Violate the Fourth Amendment?

As discussed, if the government gets a warrant to access the preserved records, it will do that through a § 2703(a) warrant. That warrant must be supported by probable cause.

But what happens if there is no warrant? The government has a statutory tool to preserve evidence by using a preservation letter.

Are you entitled to challenge a § 2703(f) request in court?

To do this, you must be able to establish the grounds for a constitutional challenge.

Four Conditions for a Fourth Amendment Challenge to § 2703(f)

There are four conditions for a Fourth Amendment challenge to a § 2703(f) preservation demand.

The first condition is that the evidence the government wants to preserve must be protected by the Fourth Amendment. With email content, this is established by Warshak. With other content and data, it should be easy to establish.

The second condition is that compelled assistance from a third party will make that third party a government agent. With a provider, that means the provider has to act as an agent of the law enforcement official issuing the request.

The third condition is that copying the digital file creates a seizure. If you possess the file, and that file is then copied, it is hard to argue that a seizure has not occurred.

The fourth condition is that there are no exigent circumstances justifying the government’s request for preservation. Section 2703(f) has no express requirement for a government entity to establish exigency before it sends a preservation demand to a service provider.

If all four conditions are met, you could potentially argue that the preservation demand is an unreasonable search or seizure of your records in the cloud.

The Outcome of Rosenow v. United States

What happened when this issue was brought to court?

Unfortunately, the answer is not good for customers. In Rosenow v. United States, 50 F.4th 715 (9th Cir. 2022), the Ninth Circuit Court of Appeals rejected a challenge to a § 2703(f) preservation demand.

In Rosenow, the defendant argued that Section 2703(f) is unconstitutional, and that his cloud files were illegally preserved.

The Ninth Circuit rejected the Fourth Amendment challenge, stating that the federal government failed to meet “the stringent test for declaring a constitutionally valid statutory provision unconstitutional.”

While the government accepted the fourth condition, acknowledging that exigent circumstances should be required in some cases, it otherwise maintained that a § 2703(f) preservation demand is constitutional.

When the Justice Department asked the Supreme Court to decline the case, it presented the case with the title “Preservation of Records, Statutory Provision Under Attack.”

However, the Supreme Court declined to hear the case, and denied certiorari. The Court then returned the matter back to the Ninth Circuit.

As a result, the judgment of the District Court stands, affirming the decision of the Ninth Circuit that the preservation copying caused “no meaningful interference with [the] defendant’s possessory interests,” and that Section 2703(f) does not require an showing of exigent circumstances for a preservation request.

As a result, the government continues to use the § 2703(f) preservation demand as a tool in criminal investigations. And, with no judicial review, no customer notice, and no Fourth Amendment protection, targeted customers will never know their cloud data has been frozen until, and if, it is ever released.

What Should I Do After I Discover a § 2703(f) Preservation Request?

If you find out about a § 2703(f) preservation request, you should consult with your attorney immediately. While you cannot challenge the request itself, there is plenty to discuss about the potential implications of the request.

Can you challenge a preservation request if you think that the government does not have cause?

The answer is no, as discussed above. That’s because a § 2703(f) request does not need to meet any of the preconditions for the issuance of a warrant or subpoena.

But does this mean that you should not worry about the implications of a § 2703(f) request?

The answer is, not necessarily. If you find out that the government served a § 2703(f) preservation request, then you may want to challenge the § 2703(f) request when your information becomes part of a criminal case.

Even if you don’t have the evidence to quash the subpoena, you may be able to quash the subpoena based on the government’s use of the preserved copy to find additional evidence in your account.

And if the government continues to seek to obtain your information, then the inevitable discovery doctrine may apply. Under the inevitable discovery doctrine, it is up to the government to show that it has the means to obtain the evidence independently.

However, if the government’s preservation request leads to a potential criminal investigation, you may have to think about the consequences of deleting files from your live account. If you delete evidence with the intent to impede, obstruct, or influence a pending or future federal investigation, you could be charged with a federal crime.

Under the following federal criminal statutes, destroying or concealing evidence of a crime is an unlawful act:

• 18 U.S.C. Section 1519: “Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States, or any public office, case, controversy, or matter under the jurisdiction of any court of the United States...”
• 18 U.S.C. Section 1512(c)(1): “ Whoever corruptly alters, destroys, mutilates, or conceals a record, document, or other object (i) with intent to impair the object’s integrity or availability for use in an official proceeding - or (ii) otherwise in that manner corruptly, with the purpose of rendering the object unavailable for use in an official proceeding - “

If you get caught, and the government is able to demonstrate that they have an “unpreserved copy” of the evidence, then it will be a difficult case to beat in court.

And so, after learning about a § 2703(f) preservation request, what next?

There is much more to discuss.

The first step is to review the information contained in the preservation request. That is because Section 2703(f) does not specify the particularity of the materials to be preserved. You have to make sure that you understand what is on the table.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.