A previous Practice Point discussed the background and oral argument of two Supreme Court cases raising significant issues under the Stored Communications Act (SCA): Carpenter v. United States and United States v. Microsoft. Both of those cases recently reached resolution with the Supreme Court.
In Carpenter, a six-justice majority held that law enforcement collection of cell phone transactional records detailing geographic location is Fourth Amendment search. In an opinion authored by Chief Justice Roberts, the Court untangled two opposing lines of Fourth Amendment precedent regarding the longstanding “third-party doctrine” and more recent cases suggesting a right to privacy in one’s geographic location and cell phone contents.
The case stemmed from federal law enforcement obtaining the transactional records of defendant Carpenter’s cell phones. Those agents used the data to determine that Carpenter’s cell phones connected with towers near robberies they were investigating.
Law enforcement had used a court order issued pursuant to section 2703 of the SCA to obtain those records. Section 2703 allows the government to compel disclosure of “transactional records” based on “reasonable grounds to believe” that the information is relevant to an investigation. This standard is less stringent that the Fourth Amendment’s requirement of a warrant supported by “probable cause.”
Carpenter moved to suppress the transactional records in the trial court, arguing that the more stringent Fourth Amendment standard applied to the collection. The trial court denied the motion, and Carpenter was convicted.
The Sixth Circuit also rejected Carpenter’s Fourth Amendment argument on appeal, finding Carpenter had no reasonable expectation of privacy in his cell phone records under the “third-party doctrine.” That doctrine provides that people who voluntarily provide information to third parties, such as banks or phone companies, have no “reasonable expectation” of privacy with regard to that information under the Fourth Amendment.
In reversing the Sixth Circuit, the Court stated that “an individual maintains a legitimate expectation of privacy in the record of his physical movements,” regardless of whether government surveillance or provider data collection creates those records. The Court adopted its reasoning from United States v. Jones, where a five-justice majority held that the Fourth Amendment required police to obtain a warrant supported by probable cause to attach a GPS tracker to a car. The Court largely relied on Justice Sotomayor’s concurring opinion from Jones. That concurrence stated that individuals have a reasonable expectation of privacy regarding their specific geographic location, because such information could allow the government to extrapolate conclusions regarding their personal life, including “political and religious beliefs” and “sexual habits.” Interestingly, the Court’s reliance on Justice Sotomayor’s Jones concurrence potentially continues a pattern begun in the seminal Fourth Amendment case Katz v. United States, in which a concurring opinion went on to be adopted as the definitive statement of the “reasonable expectation” of privacy test.
The Court also differentiated Carpenter from the application of the “third-party doctrine,” finding that consumers do not choose to share their geographic location and movements through cell phones. In reaching this conclusion, the Court stressed “the inescapable and automatic” nature of the collection and the necessity of cell phones in modern life. In this analysis, the Court relied on its Riley v. California opinion, in which Chief Justice Roberts colorfully described the ubiquity of cell phones and the personal nature of their contents, noting that a “visitor from Mars might conclude that they were an important feature of human anatomy.”
In contrast, Justice Kennedy’s dissent advocated for applying of third-party doctrine. Justice Kennedy emphasized that the contract between providers and consumers addresses the collection of geographic data through cell phones. Because the collection of the cell phone location records is valuable to providers, the providers contract with consumers to allow them to collect and sell them. This barred Carpenter from having any reasonable expectation that the records would be private in Justice Kennedy’s view.
The Carpenter opinion could potentially lead to the expansion of a right to privacy beyond records of movements and implicate government surveillance efforts. While the Court stated its decision was one of “narrow” scope, limited to “the record of [one’s] physical movements,” the Court’s analysis of Jones and adoption of Justice Sotomayor’s concurrence arguably extends the application of Carpenter beyond its stated holding. Notably, the Court described Jones as a case in which “[a] majority of this Court has already recognized that individuals have a reasonable expectation of privacy in the whole of their physical movements.” The Court also quoted an expansive definition of the “reasonable expectation” of privacy in Justice Sotomayor’s Jones concurrence. That definition states that “society’s expectation has been that law enforcement agents and others would not— and indeed, in the main, simply could not—secretly monitor and catalogue every single movement of an individual’s car for a very long period.” These provisions of the opinion suggest a right to privacy in one’s movements beyond mere records of them.
Microsoft was another case before the Supreme Court raising SCA issues. However, the Court ultimately did not have to address those issues following the passage of the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) discussed at oral argument. The Court confirmed the CLOUD Act allowed the government to moot the case in a three-page opinion.
The issue in Microsoft was whether SCA warrants can be used to obtain data on servers located outside the United States. The government sought to compel Microsoft to produce data in connection with a criminal investigation under an SCA warrant. Microsoft delivered responsive data stored in the United States, but refused to produce responsive data kept on a foreign server and moved to quash the warrant.
In moving to quash, Microsoft argued that transferring that data to the United States authorities would violate European data privacy laws and subject Microsoft to enforcement actions and fines. Microsoft contended that SCA warrants only apply within the “United States and in United States-controlled areas.” The company further argued that it could not be compelled to obey the laws of one jurisdiction by violating the laws of another.
The trial court denied Microsoft’s motion to quash, but the Second Circuit reversed, finding that the SCA requires execution of a warrant within that country, which violates the established presumption against extraterritorial application of statutes.
The government mooted the extraterritoriality issue using a CLOUD Act provision mandating that email service providers disclose emails in their “possession, custody, or control” regardless of the location of those emails. The Court held that the government’s issuance of a new warrant covering the information in the original warrant Microsoft moved to quash meant “no live dispute remains” in the case pending before it.
