The Fourth Amendment and email preservation letters

When investigators learn that a target of a criminal case has an email account with a known address, it is common for them to send a preservation letter to the email provider. A preservation letter tells the provider to preserve the contents of the account because legal process may be on the way. This post considers a question: When does the use of preservation letters violate the Fourth Amendment? I think a significant amount of its use raises serious constitutional problems. This post explains why, and it offers some thoughts on how defense counsel can raise the issue in court.

I. Background

Preservation letters are often referred to as "f" letters, as they are provided for in 18 U.S.C. 2703(f). Here's the text:

(f) Requirement To Preserve Evidence.
(1)In general.-
A provider of wire or electronic communication services or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.
(2)Period of retention.-
Records referred to in paragraph (1) shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity.

The basic idea is that when the government lets the provider know that it is planning on serving legal process on the provider for the records, the provider is supposed to save a copy of the relevant account records. The provision was added in 1996, as Section 804 of the the Antiterrorism and Effective Death Penalty Act, to deal with the problem of routinely deleted company records. In the 1990s, it was common for Internet providers to delete account records after 30 or 60 days. If an Internet provider stored records for 30 days, and the government learned of the account on Day 29 after the crime occurred, the provider might delete the records in the ordinary course before the legal process was obtained. The preservation provision avoids that. It envisions that the provider will hold on to the records so that they won't be deleted in the ordinary course by the time the government comes back with its legal process.

The language used is odd, though, for two reasons. First, it is written partly as an order and partly as an option. The provider "shall" take steps in response to a "request," the statute says, which is a weird mix of mandatory and permissive language. Second, the authority applies to "records and other evidence," which leaves it somewhat unclear as to whether it means only metadata or also includes contents. Section 2703 refers to metadata as "records or other information pertaining to a subscriber to or customer of such service (not including the contents of communications)." The phrase "records and other evidence" is textually broader than that, although it's not clear whether that difference was intentional. Note that the statute refers to a "court order or other legal process" without also mentioning a warrant that would be obtained for contents, which might suggest that the provision was intended to apply only to non-content records that (especially in the 1990s) might be deleted by the provider rather than contents that could be deleted by the account holder.

Despite this ambiguity, the preservation authority is routinely used by the government to preserve contents of communications. The Justice Department's model 2703(f) letter expressly requests preservation of contents. And it turns out that a lot of investigators and prosecutors issue such letters often. You never know when a target might delete his incriminating files, they figure, so just in case, you can send off a letter right away. No cause is required, and there is no oversight. The statute gives the government 90 days of preservation plus another 90 days with renewed request. That long time window lets them issue letters readily up front and to then see how the investigation unfolds.

II. Why Use of Preservation Letters Raises Serious Fourth Amendment Problems

Now we get to the big question: How does using 2703(f) letters to preserve contents of communications square with the Fourth Amendment? I think that the use of preservation letters for contents raises really serious constitutional concerns. Here's why.

First, when providers preserve accounts in response to letters, they are state actors for Fourth Amendment purposes. They are acting pursuant to a law that says that they "shall take all necessary steps to preserve records" in response to the notice. See In the Matter of Warrant to Search a Certain E-Mail Account Controlled and Maintained by Microsoft Corporation, 829 F.3d 197 (2d Cir. 2016) (noting in the SCA context that "[w]hen the government compels a private party to assist it in conducting a search or seizure, the private party becomes an agent of the government" under the Fourth Amendment).

Second, when providers act pursuant to preservation letters, they generally run off a new copy of the relevant records and store them separately pending possible legal process. In my view, making a new copy of files for separate use "seizes" any records that are protected by the Fourth Amendment. See Orin Kerr, "Fourth Amendment Seizures of Computer Data,"119 Yale L.J. 700 (2010). The contents of emails are clearly protected by the Fourth Amendment. See United States v. Warshak, 631 F.3d 266, 285-88 (6th Cir. 2010). As a result, compliance with the issuance of a 2703(f) letter should ordinarily trigger a Fourth Amendment seizure. When emails are seized and held pending the prospect of future legal process, I would think that is a continuing seizure of the emails for the period that the emails are held on the government's behalf.

The third and final question is whether the seizure is "reasonable." This issue is a bit trickier, I think. On one hand, courts have long held that the Fourth Amendment allows the government some power to temporarily detain property without a warrant. On the other hand, those circumstances seem much narrower than what regularly happens with email account preservation letters.

Here's how I summarized the law in the LaFave et al. Criminal Procedure treatise in Section 4.2(b):

The government needs reasonable suspicion that the package contains contraband, law enforcement authorities to detain a package, and it can detain the package for a reasonable length of time. Whether the period of detention is "reasonable" requires a case-by-case inquiry, and it tends to focus on the duration of the delay, the diligence of law enforcement in attempting to minimize the delay, and the strength of the government's reason for delaying the package. For example, a detention of letters over a weekend for the purpose of subjecting them to a canine sniff test might be reasonable; a delay of a week or more when the government could have subjected the packages to a canine drug sniff in much less time would not be.

I would think that a lot of the use of preservation letters raises major problems under this caselaw. The duration of the seizure is often very long: 90 days or even up to 180 days, in contrast to the few days usually permitted. Given that long seizure, and how often preservation letters are not followed up with any legal process at all, the government often won't be diligent in trying to minimize the delay. And the strength of the reason for the delay will often be weak, as preservation letters require no cause at all and are often issued as a matter of course.

A plausible counterargument might be that perhaps the reasonableness calculation for preservation seizures of electronic information should be different from the reasonableness calculation for seizing physical property. When agents seize physical property, the fact that its owner is deprived of the property during the seizure is a major factor in the reasonableness balancing. The more the deprivation of property causes inconvenience or harm, the shorter the window of the seizure that is allowed. See, e.g., United States v. Mitchell, 565 F.3d 1347 (11th Cir. 2009) (seizure of personal computer for 21 days pending application for a warrant held unreasonable, in part because "computers are relied upon heavily for personal and business use").

In contrast, the account holder usually never knows that his emails were electronically seized. The account holder receives no notice of the preservation. If the government never follows up with legal process, the provider will just delete the copy eventually and the account holder never knows. This is troubling in its own right. But it's at least plausible that the lack of practical interference permits a longer seizure than would be allowed for physical property. There's less inconvenience if the person never even knows it happened, the argument would run. And yet even if a longer period is allowed, isn't 90 or 180 days still an exceptionally long period of time for a continuing seizure to be constitutionally reasonable?

So that's my argument. I've been offering it up when I lecture to defense attorney groups for a while now, but I know of only one case in which the argument was made. The case pleaded out before there was a judicial ruling, though, so there has been no decision on the question. I'm not sure how much traction the argument would get. Perhaps I'm more of a fan of the argument because I came up with it; originating credit can blur vision. But I think it's a significant argument that defense lawyers should be making.

III. How This Can Be Raised

I'll end with a practical question: How can this argument be raised in court? If you're a lawyer and the government found evidence inside your client's email that was seized pursuant to a warrant, you should find out whether a 2703(f) preservation request was first made - and if so, when. You should also find out whether the provider complied with the warrant by handing over the preserved version of the account rather than the version that existed at the time the warrant was executed. If the provider handed over the preserved copy, you can argue that the preservation process violated the Fourth Amendment (see Part II above) and that the evidence found pursuant to the warrant is a fruit of the poisonous tree.

The government might argue in response that the emails should come in anyway, even if the Fourth Amendment was violated, if the emails weren't actually deleted in the period between when the preservation letter was issued and the warrant was executed. The government could argue that the inevitable discovery doctrine should apply. If the government hadn't issued a preservation letter at all, the same emails would have been obtained using the later copy of the account. This might work if the facts support it, but it's important to note that the government has the burden of proof to establish inevitable discovery. The government needs to show that the evidence likely would have been discovered anyway, which I would think would require a showing that each particular email was in the account on the later date. And if that's true, then the government gets no obvious benefit from relying on 2703(f) letters to preserve the contents of communications that are protected by the Fourth Amendment.