Stored Communications Act (SCA)

The Stored Communications Act framework

The Stored Communications Act at 18 U.S.C. Sections 2701-2712 governs access to electronic communications held in electronic storage by communication service providers. The SCA was enacted as part of the Electronic Communications Privacy Act of 1986 and has been the central federal statute governing electronic communications privacy for decades. The framework establishes both privacy protections for communications users and procedures for government and private access to stored communications.

The SCA criminal provisions at Section 2701 reach unauthorized access to communications held in electronic storage by communication service providers. The base offense is a misdemeanor for most violations, with felony enhancement for violations committed for commercial advantage, financial gain, or in furtherance of any criminal or tortious act. The civil provisions at Section 2707 provide a private cause of action for SCA violations with statutory and actual damages, attorney fees, and other relief.

The SCA provisions distinguish between two categories of stored communications. The first category is communications held in electronic storage by providers of electronic communications services. The second category is communications and other records held by remote computing services. The two categories have different procedural requirements for government access and different protections against unauthorized private access.

Government access procedures under the SCA

The government access procedures under the SCA vary based on the type of information sought and the type of provider involved. Section 2703 establishes the procedural requirements for government access to stored communications and related records. The requirements include warrants based on probable cause for content of communications stored for 180 days or less, lesser process (including subpoenas with notice) for content stored for more than 180 days, and various forms of process for transactional records and subscriber information.

The procedural framework has been substantially affected by judicial decisions and statutory amendments. The Sixth Circuit decision in United States v. Warshak, 631 F.3d 266 (6th Cir. 2010), held that the SCA distinction between communications stored for 180 days or less and communications stored for longer periods is unconstitutional under the Fourth Amendment, requiring warrants for content regardless of storage duration. The Warshak framework has been generally followed by other circuits and has effectively imposed a warrant requirement for content access.

The defense in SCA cases must analyze whether the government access complied with the constitutional and statutory requirements. The defense can challenge the validity of the warrant or other process used, the scope of the access permitted, and the compliance with notice requirements where applicable. The motion-to-suppress practice in SCA cases follows the general framework for Fourth Amendment violations but with specific application to the electronic communications context.

The CLOUD Act and the international dimension

The Clarifying Lawful Overseas Use of Data Act enacted in 2018 amended the SCA to address access to communications stored outside the United States. The CLOUD Act provides that providers must comply with U.S. legal process for communications they control regardless of where the communications are physically stored. The Act also establishes a framework for executive agreements with foreign governments to facilitate cross-border access to communications.

The CLOUD Act framework responded to the Supreme Court litigation in United States v. Microsoft Corp., 584 U.S. 236 (2018), which addressed whether the SCA required disclosure of communications stored outside the United States. The CLOUD Act resolved the underlying legal question but created new procedural and substantive issues that continue to develop through litigation. The framework continues to affect international cooperation in criminal investigations and civil disputes.

The defense practice in cases involving international elements should understand the CLOUD Act framework and its implications. The framework affects both prosecution of cases involving foreign-stored communications and defense of cases where foreign privacy laws may limit the use of obtained communications. The international dimension adds substantial complexity to SCA practice and requires familiarity with both domestic and foreign legal frameworks.

Private cause of action and litigation considerations

The SCA private cause of action under Section 2707 provides substantial remedies for SCA violations. The remedies include actual damages but not less than $1,000 in statutory damages, equitable or declaratory relief, reasonable attorney fees, and punitive damages in cases of willful or intentional violations. The remedies framework makes SCA litigation attractive for plaintiffs and has produced substantial body of case law on the application of the statute.

The litigation framework includes various procedural and substantive issues. Standing requirements address who can bring SCA claims. The exhaustion requirements (none under the SCA) affect the timing of litigation. The discovery framework affects what information can be obtained in litigation. The summary judgment standards affect when cases can be resolved without trial. Each procedural area has substantial case law that affects SCA litigation strategy.

The defense in SCA civil cases involves both substantive defenses and procedural challenges. The substantive defenses include consent (express or implied), legitimate business purpose (for some forms of access), and various other affirmative defenses that may apply to specific factual situations. The procedural challenges include standing, statute of limitations, and the various other procedural defenses available in federal litigation. The defense practice requires comprehensive analysis of all available defenses and the strategic considerations affecting each.

Carpenter v. United States and the historical cell site location framework

The Supreme Court decision in Carpenter v. United States, 585 U.S. 296 (2018), held that the Fourth Amendment requires a warrant for government access to historical cell site location information, narrowing the third-party doctrine in the digital context. The Carpenter framework affects SCA practice in cases involving location data and other forms of digital surveillance that go beyond traditional stored communications. The decision creates substantial protection for location privacy and has been applied by lower courts to various forms of digital surveillance. Defense practice in cases involving location data should preserve Carpenter arguments through pretrial motions to suppress and should develop the factual record needed to demonstrate the type and duration of location surveillance at issue. The Carpenter framework continues to develop through ongoing litigation about its application to specific surveillance contexts.