Kik Chat Logs and Federal Subpoenas: What Investigators Get.

The subscriber information Kik provides to law enforcement in response to a subpoena includes:

• User’s name;
• Mailing address;
• Date and time of each session;
• IP address used;
• Contact information for any associated third-party payment account.

This is similar to “subscriber information” disclosures from Facebook or Instagram.

Obtaining actual communication content requires a higher legal standard than identifying a user. Federal investigators must meet the standard of “probable cause” under 18 U.S.C. § 2510 (authorizing a criminal search warrant) or, in some cases, “specific and articulable facts” under 18 U.S.C. § 2703(d) (a “D-order”).

Regarding chat logs, Kik informs users: “Kik does not retain the text of delivered one-to-one messages on its servers, and if we receive a request for your one-to-one messages, we cannot provide them because we do not have copies.” Investigators typically gain access to Kik chat logs from the user’s device, not from the company.

The Stored Communications Act (SCA), 18 U.S.C. §§ 2701-2712, governs provider disclosures. Historically, there was debate over whether a warrant was required for stored email content. While the Supreme Court has not issued a definitive answer, courts often require a warrant as a constitutional necessity. In the Sixth Circuit, Warshak (2010) established that a warrant issued under the Fourth Amendment is required to obtain a user’s stored messages.

Federal investigators seeking to monitor messages that have not yet been sent, identifying which accounts are communicating without accessing the content, must obtain a pen register order under 18 U.S.C. § 3123. These orders are limited to 60 days but are renewable.

What Can a Federal Subpoena Alone Obtain from Kik?

Subscriber Information

Account Activity and Login Information

Content Not expressly listed under a subpoena

Multimedia Content (Images and Videos)

Content of Third Party Private Messages

Preserved Content of Third Party Private Messages

What Account Records and Logs Does Kik Retain?

Registration and Phone Numbers

Unlike many other messaging apps, all a user needs to create an account at Kik is an email address. Kik does not require a phone number to start. As a result, the user’s phone number is never part of their unique identity on the platform. This differs from platforms like WhatsApp or iMessage, where a phone number is needed to identify a user. For federal investigators, this means that a Kik account is not directly tied to a phone number. Instead, investigators must rely on other information to try and determine a user’s identity.

Verification

Historically, Kik did not verify the email addresses provided at signup. While Kik has updated its processes since then, it is still possible for users to create accounts with inaccurate or fake information. This again makes it harder for federal investigators to prove a user’s identity by relying on email addresses alone.

Usernames

When you create an account on Kik, your username is permanent. You cannot change your username after registration. Anyone who knows your username will always know your username unless you delete your account entirely.

Account Creation IPs

Kik logs the IP address used when creating a new account. If you use the Kik app on your phone to create a new account, it logs your mobile data or wifi IP address. If you use your computer to create an account through your browser or app, it logs the IP address from your router.

Session Logs

Kik logs the IP address used during subsequent logins (or logins automatically triggered in the background), along with a timestamp. This helps federal investigators trace when you were logged into the app and what IP addresses you were using to access it.

Device Identifiers

When you install Kik on a device, Kik captures a unique device identifier. This is the same unique identifier that is tied to your account. The device identifier is assigned by the hardware manufacturer. Again, the device identifier is used rather than your phone number.

Undelivered Messages

Delivered one-to-one messages are never stored on Kik’s servers. This does not apply to the “Kik bot” chat, which is not one-to-one. Undelivered one-to-one messages will sit on Kik’s servers until they expire. Once expired, they are permanently deleted.

Statutory Retention Periods

No federal statute establishes a minimum period during which companies like Kik must retain stored communication data. Since Kik voluntarily retains limited information, and there are no federal laws to the contrary, it is up to the company to determine how and when it deletes its data.

How Do Investigators Connect a Kik Account to Someone?

Username vs. Display Name

When federal investigators send a request to Kik, they must cite the Kik username, not the Kik display name. This is because Kik usernames are permanent, but display names can be changed at any time. Additionally, multiple Kik accounts can share the same display name.

Device Identifiers

If you’ve created multiple Kik accounts using the same handset, those accounts will be connected by their device identifier.

IP Logs

Kik’s logs of IP addresses have no meaning in themselves. To find out where a user is located, federal investigators must send a second subpoena to the internet service provider (ISP) whose IP address appears in Kik’s logs. This is because the ISP is the only entity that can link the IP address to a specific subscriber.

Source Port Numbers

Most internet connections are shared or dynamic. In these situations, an IP address alone is not enough to pinpoint a specific device or user. To identify a specific subscriber, federal investigators need the source port number in addition to the IP address.

Account vs. Person

A Kik subpoena identifies a Kik account, not the person holding the phone. The subpoena may show the IP address used to log into the account and how that IP address links to a specific ISP account, but this does not identify the individual who was using the account.

Provider Certification

A provider’s certification that a particular customer account was linked to a particular IP address at a particular time is not sufficient to prove that the customer account holder was the person who operated the Kik account.

Attribution and Corroboration

For federal investigators to establish attribution, they need to corroborate the information contained in a Kik subpoena with information from another source, such as:

• Data stored on the user’s device: The metadata for one or more of the user’s devices, such as mobile phones or computers, could be used to corroborate the information contained in Kik’s records.
• Photographs: Photographs from social media sites, such as Facebook or Instagram, could show who had a device in their hand at the time that device was used to access a Kik account.
• Payment records: As noted in the Kik and Meta FAQs, identifiers for third-party payment records (e.g., credit card or PayPal accounts) can also be used to establish attribution.

Todd Spodek and the attorneys at Spodek Law Group handle federal cases of this kind from New York, Brooklyn, Queens and Los Angeles.

How Does Preservation Affect Old or Deleted Kik Chats?

Section 2703(f) of the SCA requires that a provider preserve all records pertaining to a specific account for 90 days from the time the request is served. Providers can extend the preservation hold one time for another 90 days.

Preservation is a freeze on data that is currently available to the provider. If data has been deleted or has already expired, a preservation request will not affect it.

Agents typically send a preservation letter well before they draft a search warrant affidavit. This gives the agents time to compile the evidence required to support the warrant. The warrant is sent only after preservation has been obtained.

On a computer or Android device, Kik stores conversations in a SQLite database file called “kikDatabase.db.”

Specialized forensic software is used to access this file. The software can recover deleted rows by scanning unallocated database pages. This allows investigators to restore much of the account’s chat history.

Because many multimedia messages are cached on the device rather than stored in a database, cached media can outlive the deletion of the conversation that delivered it.

A warrant to Kik only compels the provider to disclose the content that remains retained at the time that the warrant is served.

Can Investigators Get Kik Chats from Somewhere Else?

Interaction with Federal Agents and Law Enforcement Officers

Yes, federal agents and law enforcement officers can get Kik chat content that does not come from Kik’s servers. Several scenarios are common, and many involve the acquisition of evidence with little to no legal process. For example, if agents engage with an account holder while posing as minors, any messages sent from that account holder to the undercover agent will not be the subject of warrants or subpoenas. Similarly, if another Kik user takes a screenshot of their Kik conversation and shares it with federal law enforcement, the agent in possession of the screenshot will be able to review the image with no legal process required.

Search of a Device Incident to Arrest

To search an arrestee’s phone, however, agents need a warrant. This was the holding of the Supreme Court in Riley v. California (2014). Before the Supreme Court’s decision in Riley, agents and other federal investigators were able to conduct warrantless searches of a person’s phone upon arresting them. This is different from the search incident to arrest exception to the warrant requirement, which allows for warrantless searches of vehicles and other means of transportation in certain criminal proceedings.

Cloud Backup and Device Storage

If not stored on Kik’s servers, Kik chat logs and messages must survive in some other form. If the account owner or another person engaged in the conversation did not get to use the content, it will only be available via a computer or mobile device, or the cloud backup of the device. An investigator may reach backup logs and messages on Google if he or she serves Google with a criminal search warrant or other court-ordered process. The same process will apply for Apple as well.

Recipient’s Phone

Even if the sender of messages has deleted a chat log, messages sent to and from the sender may still be stored on a recipient’s phone. A Kik subpoena will not get these logs, as Kik does not store the message logs or the content of one-to-one conversations on its servers.

Lawful Consent

As noted in the Kik and Meta FAQs, Kik can also disclose information about its users if the user gives Kik lawful consent to release the information. Section 2702(b)(3) of the SCA provides for this situation.

Forensic Examination of Device

Finally, as noted above, if a warrant is served on Kik, it only authorizes the disclosure of information from Kik. It does not authorize a forensic examination of the user’s phone. A separate warrant is required for access to the user’s phone and its stored data.

What Should I Do After Receiving a Kik-related Subpoena?

1. Retain a Federal Defense Attorney and Have Your Attorney Respond

This is the first step after receiving a Kik-related subpoena. This is important because most Kik-related subpoenas are grand jury subpoenas to obtain Kik records and logs in order to build a case against the account holder. Your attorney can communicate with the prosecutors and reach an agreement regarding the subpoena’s return date or the scope of the request to protect your interests.

2. Initiate a Litigation Hold

A litigation hold is the most important first step in any litigation, including receiving a Kik-related subpoena. This is because any subsequent request for the recipient’s device could lead to allegations of obstruction of justice or spoliation of evidence. 18 U.S.C. § 1519 provides for criminal penalties for the knowing destruction of evidence undertaken with intent to “obstruct, destroy, falsify, or impair any record, document, or other object with intent to obstruct, influence, or impede the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States.”

3. Do Not Delete Your Kik Account or Messages

Deleting your Kik account, messages, and logs on the eve of or after receiving the Kik-related subpoena makes you extremely vulnerable to allegations of obstruction of justice or spoliation of evidence. While you may not have knowingly provided inaccurate information to the investigators or are trying to cover up your role, the fact that you deleted your Kik account or messages after receiving the subpoena can justify the filing of charges against you.

4. Wait Until You Are Ready to Enter the Grand-Jury Room

After receiving a grand-jury subpoena to testify, remember that this is different from testifying in court. Grand jury proceedings are held in secret and the individual giving testimony has no right to counsel. Your attorney can provide advice before you enter the grand jury room and upon exit, but not while you are in the room. Be prepared for this reality.

5. Confirm Your Subpoena’s Return Date

Your subpoena will list a date and time for production of records or testimony. Your attorney can confirm that this date is correct or negotiate a return date that provides more time to prepare.

6. Decide Whether You Want to Quash the Subpoena or Negotiate Its Scope

Under Rule 17(c)(2) of the Federal Rules of Criminal Procedure, a court may quash a subpoena if it is “unreasonable or oppressive.” Your attorney can determine whether quashing is warranted based on the circumstances at hand. This could involve filing a motion to quash or negotiating the subpoena’s scope with the federal prosecutors or a Grand Jury prosecutor.

7. Decide Whether to Comply or Invoke Your Constitutional Rights

Depending on the circumstances, it may be advisable to comply with the subpoena rather than to insist on your constitutional rights. While a subpoena generally cannot defeat a valid attorney-client privilege, it is common for a subpoena to reach communications to which the recipient is entitled to assert the Fifth Amendment.

Get Advice on Your Situation

If you want someone to look at the specifics of your case, Spodek Law Group handles federal criminal defense nationwide from New York and Los Angeles. The firm has been practicing since 1976 and its motto is simple: we owe loyalty to only you. Call 212-300-5196.