Stored Communications Act

The Stored Communications Act (SCA), codified at 18 U.S.C. Chapter 121 §§ 2701–2713), is a United States law that addresses voluntary and compelled disclosure of "stored wire and electronic communications and transactional records" held by third-party Internet service providers (ISPs). It was enacted as Title II of the Electronic Communications Privacy Act of 1986 (ECPA).

The SCA creates Fourth Amendment-like privacy protection for email and other digital communications stored on the Internet. It limits the government's ability to compel an ISP to turn over content information and non-content information (such as logs and "envelope" information from email). It also limits the ability of commercial ISPs to reveal content information to non-government entities.

The Fourth Amendment to the U.S. Constitution protects the people's right "to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." When applied to information stored online, however, the Fourth Amendment's protections are potentially far weaker. In part, this is because the Fourth Amendment defines the "right to be secure" in spatial terms that do not directly apply to the "reasonable expectation of privacy" in an online context. The Fourth Amendment has been stressed as a right that protects people and not places, which leaves the interpretation of the amendment's language broad in scope. In addition, society has not reached clear consensus over expectations of privacy in terms of more modern (and developing, future) forms of recorded and/or transmitted information.

Furthermore, users generally entrust the security of online information to a third party, an ISP. In many cases, Fourth Amendment doctrine has held that in doing so, users relinquish any expectation of privacy. The third-party doctrine holds "that knowingly revealing information to a third party relinquishes Fourth Amendment protection in that information." While a search warrant and probable cause are required to search one's home, under the third-party doctrine only the exception of consent (a much lower hurdle than probable cause) are needed to subject an ISP to disclose the contents of an email or of files stored on a server.

As per request by the House Committee on the Judiciary, Subcommittee on Courts, Civil Liberties, and the Administration of Justice, as well as the Senate Committee on Governmental Affairs asking the Office of Technology Assessment (OTA) to create a report about protections surrounding electronic communications, it was found that individuals were at risk. This risk identified current protections for electronic mail as being "weak, ambiguous, or nonexistent." The report concluded that "[t]he existing statutory framework and judicial interpretations thereof do not adequately cover new and emerging electronic surveillance technologies." Congress acknowledged that traditional Fourth Amendment protections were lacking. As a result, the Electronic Communications Privacy Act was enacted in 1986 as an update to the Federal Wiretap Act of 1968, which addressed protections on telephone (land) line privacies. The provisions are distributed into three titles, with Title II being the Stored Communications Act.

Section 2701 (18 U.S.C. § 2701) of the SCA provides criminal penalties for anyone who "intentionally accesses without authorization a facility through which an electronic communication service is provided or … intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished ... ."

Section 2702 (18 U.S.C. § 2702) of the SCA targets two types of online service, "electronic communication services" and "remote computing services." The statute defines an electronic communication service as "any service which provides to users thereof the ability to send or receive wire or electronic communications." A remote computing service is defined as "the provision to the public of computer storage or processing services by means of an electronic communications system." This section also describes conditions under which a public ISP can voluntarily disclose customer communications or records. In general, ISPs are forbidden to "divulge to any person or entity the contents of any communication which is carried or maintained on that service." However, ISPs are allowed to share "non-content" information, such as log data and the name and email address of the recipient, with anyone other than a governmental entity. In addition, ISPs that do not offer services to the public, such as businesses and universities, can freely disclose content and non-content information. An ISP can disclose the contents of a subscriber's communications authorized by that subscriber.

Section 2703 (18 U.S.C. § 2703) of the SCA describes the conditions under which the government is able to compel an ISP to disclose "customer or subscriber" content and non-content information for each of these types of service: