BILL ANALYSIS �
SB 467
Page 1
Date of Hearing: June 11, 2013
Counsel: Stella Choe
ASSEMBLY COMMITTEE ON PUBLIC SAFETY
Tom Ammiano, Chair
SB 467 (Leno) - As Amended: April 1, 2013
SUMMARY : Requires a search warrant when a governmental agency
is seeking to obtain the contents of a wire or electronic
communication that is stored, held or maintained by a provider
of electronic communication services or remote computing
services. Specifically, this bill :
1)Defines a "governmental entity" as a department or agency of
California or any political subdivision thereof, or an
individual acting for or on behalf of California or any
political subdivision thereof.
2)States, within three days after a governmental entity receives
those contents from a service provider, the governmental
entity shall serve upon, or deliver by registered or
first-class mail, electronic mail, or other means reasonably
calculated to be effective as specified by the court issuing
the warrant, to the subscriber, customer, or user a copy of
the warrant and a notice that includes the required
information, except that delayed notice may be given as
specified.
3)Allows a governmental entity, when a search warrant is sought,
to include in the application a request, supported by sworn
affidavit, for an order delaying the warrant notification
required under existing provisions of law.
4)Requires the court to grant the request if the court
determines that there is reason to believe that notification
of the existence of the warrant may have an adverse result as
defined, but only for the period of time that the court finds
there is reason to believe that the warrant notification may
have that adverse result, and in no event shall the period of
time for the delay exceed 90 days.
5)Authorizes the court to grant extensions of the delay of the
SB 467
Page 2
warrant notification of up to 90 days each on the same
grounds.
6)Requires the governmental entity, upon expiration of the
period of delay of the warrant notification, to serve upon, or
deliver by registered or first-class mail, electronic mail, or
other means reasonably calculated to be effective as specified
by the court issuing the warrant, the customer, user, or
subscriber a copy of the warrant together with a notice that
does both of the following:
a) States with reasonable specificity the nature of the
governmental inquiry; and,
b) Informs the customer, user, or subscriber all of the
following:
i) That information maintained for the customer or
subscriber by the service provider named in the process
or request was supplied to, or requested by, that
governmental entity and the date on which the supplying
or request took place;
ii) That warrant notification to the customer or
subscriber was delayed;
iii) The grounds for the court's determination to grant
the delay; and,
iv) Which provisions of this bill authorized the delay.
7)Removes the requirement that to be subject to these warrant
procedures the corporation must provide services to the
general public.
8)States, except as provided, a person or entity providing an
electronic communication service or remote computing service
shall not knowingly divulge to any person or entity the
contents of a wire or electronic communication that is stored,
held, or maintained by that service.
9)Specifies that a service provider may divulge the contents of
a communication under any of the following circumstances:
a) To an addressee or intended recipient of the
SB 467
Page 3
communication or an agent of the addressee or intended
recipient;
b) As otherwise authorized in Section 1524.2 of the Penal
Code;
c) With the lawful consent of the originator, an addressee,
or intended recipient of the communication, or the
subscriber in the case of remote computing service;
d) To a person employed or authorized or whose facilities
are used to forward the communication to its destination;
e) As may be necessary incident to the rendition of the
service or to the protection of the rights or property of
the provider of that service;
f) To a law enforcement agency if the contents were
inadvertently obtained by the service provider and appear
to pertain to the commission of a crime; or,
g) To a governmental entity, if the provider, in good
faith, believes that an emergency involving the danger of
death or serious physical injury to any person requires
disclosure without delay of communications relating to the
emergency.
10)States, except as provided, any provider of electronic
communication service or remote computing service, subscriber,
or other person aggrieved by any knowing or intentional
violation of this chapter may, in a civil action, recover from
the person, entity, or governmental entity that committed the
violation, relief as may be appropriate.
11)Provides in a civil action under this section, appropriate
relief includes, but is not limited to, all of the following:
a) Preliminary and other equitable or declaratory relief;
b) Damages as specified; and,
c) Reasonable attorney's fees and other litigation costs
reasonably incurred.
12)Specifies that the court may assess as damages, in a civil
SB 467
Page 4
action, the sum of the actual damages suffered by the
plaintiff and any profits made by the violator as a result of
the violation, but in no case shall a person be entitled to
recover less than the sum of $1,000.
13)Authorizes the court to assess punitive damages if the
violation is willful or intentional.
EXISTING LAW :
1)Provides that the right of the people to be secure in their
persons, houses, papers, and effects, against unreasonable
searches and seizures, shall not be violated, and no warrants
shall issue, but upon probable cause, supported by Oath or
affirmation, and particularly describing the place to be
searched and the persons or things to be seized. (U.S.
Const., 4th Amend.; Cal. Const., art. I, � 13.)
2)States that a search warrant is an order in writing, in the
name of the people, signed by a magistrate, directed to a
peace officer, commanding him or her to search for a person or
persons, a thing or things, or personal property, and, in the
case of a thing or things or personal property, bring the same
before the magistrate. (Penal Code Section 1523.)
3)Provides that a search warrant cannot be issued but upon
probable cause, supported by affidavit, naming or describing
the person to be searched or searched for, and particularly
describing the property, thing, or things and the place to be
searched. (Penal Code Section 1525.)
4)Provides that a search warrant may be issued upon any of the
specified grounds, including when a provider of electronic
communication service or remote computing service has records
or evidence, as specified, showing that property was stolen or
embezzled constituting a misdemeanor, or that property or
things are in the possession of any person with the intent to
use them as a means of committing a misdemeanor public
offense, or in the possession of another to whom he or she may
have delivered them for the purpose of concealing them or
preventing their discovery. [Penal Code Section 1524(a).]
5)Requires a provider of electronic communication service or
remote computing service to disclose to a governmental
prosecuting or investigating agency the name, address, local
SB 467
Page 5
and long distance telephone toll billing records, telephone
number or other subscriber number or identity, and length of
service of a subscriber to or customer of that service, and
the types of services the subscriber or customer utilized,
when the governmental entity is granted a search warrant.
[Penal Code Section 1524.3(a).]
6)States that a governmental entity receiving subscriber records
or information is not required to provide notice to a
subscriber or customer of the warrant. [Penal Code Section
1524.3(b).]
7)Authorizes a court issuing a search warrant, on a motion made
promptly by the service provider, to quash or modify the
warrant if the information or records requested are unusually
voluminous in nature or compliance with the warrant otherwise
would cause an undue burden on the provider. [Penal Code
Section 1524.3(c).]
8)Requires a provider of wire or electronic communication
services or a remote computing service, upon the request of a
peace officer, to take all necessary steps to preserve records
and other evidence in its possession pending the issuance of a
search warrant or a request in writing and an affidavit
declaring an intent to file a warrant to the provider.
Records shall be retained for a period of 90 days, which shall
be extended for an additional 90-day period upon a renewed
request by the peace officer. [Penal Code Section 1524.3(d).]
9)Specifies that no cause of action shall be brought against any
provider, its officers, employees, or agents for providing
information, facilities, or assistance in good faith
compliance with a search warrant. [Penal Code Section
1524.3(e).]
10)Provides for a process for a search warrant for records that
are in the actual or constructive possession of a foreign
corporation that provides electronic communication services or
remote computing services to the general public, where the
records would reveal the identity of the customers using those
services, data stored by, or on behalf of, the customer, the
customer's usage of those services, the recipient or
destination of communications sent or from those customers, or
the content of those communications. (Penal Code Section
1524.2.)
SB 467
Page 6
EXISTING FEDERAL LAW authorizes a governmental entity to require
the disclosure by the provider of the contents of electronic
communications in electronic storage for 180 days or less only
pursuant to a warrant under the Federal Rules or under an
equivalent state warrant. If the contents of a wire or
electronic communication that has been in electronic storage in
an electronic communications system for more than 180 days, a
governmental entity may require its disclosure through other
means such as a subpoena or a court order. The federal law also
includes notification procedures. (18 USCS Section 2701 et
seq.)
FISCAL EFFECT : Unknown
COMMENTS :
1)Author's Statement : According to the author, "SB 467 updates
California's electronic privacy law into the modern age,
ensuring emails and other electronic communications content
are protected from warrantless government intrusion when
stored online and in the cloud.
"Under SB 467, no government entity shall obtain the contents of
an electronic communication without a warrant issued by an
officer of the court, regardless of how long it has been in
electronic storage or whether it has been opened or unopened.
"Law enforcement's ability to investigate and solve crimes with
the aid of electronic communications will not be harmed by SB
467. First, the federal Department of Justice recently
announced for the first time that it supports a requirement
that law enforcement obtain a search warrant before accessing
the contents of electronic communications from a service
provider.
"Second, SB 467 codifies the practices of some of the biggest
technology companies in California, including Google,
Facebook, Microsoft and Yahoo!, all of whom require a search
warrant before disclosing the contents of electronic
communications.
"Third, SB 467 allows police to obtain the contents of
electronic communications without a warrant if they have the
consent of the user, or an emergency involving the risk of
SB 467
Page 7
death or serious injury requires immediate disclosure of
electronic communications without a search warrant."
2)Fourth Amendment Protections : The Fourth Amendment of the
United States Constitution provides that "the right of the
people to be secure in their persons, houses, papers and
effects, against unreasonable searches and seizures, shall not
be violated, and no Warrants shall issue, but upon probable
cause, supported by Oath of Affirmation, and particularly
describing the place to be searched, and the persons or things
to be seized." Section 13, Article I of the California
Constitution mirrors the Fourth Amendment of the United States
Constitution.
The Fourth Amendment is implicated when "a person has exhibited
an actual (subjective) expectation of privacy, and the
expectation must be one that society is prepared to recognize
as 'reasonable'." [Katz v. United States (1967) 389 U.S. 347,
361.] When there is no "reasonable expectation of privacy",
then government officials are not constrained by the Fourth
Amendment's warrant requirement. However, if there is a
"reasonable expectation of privacy", a warrantless search of
"persons, houses, papers, and effects" is "per se
unreasonable" unless it falls "within some established
exception to the warrant requirement." [U.S. v. Chadwick
(1977) 433 U.S.1, 6.]
In United States v. Warshak (6th Cir. 2010) 631 F.3d 266, the
court found that "[g]iven the fundamental similarities between
email and traditional forms of communication, it would defy
common sense to afford emails lesser Fourth Amendment
protection. (Citations omitted.) Email is the technological
scion of tangible mail, and it plays an indispensable part in
the Information Age. Over the last decade, email has become
'so pervasive that some persons may consider [it] to be [an]
essential means or necessary instrument for self-expression,
even self-identification.' [Citing City of Ontario v. Quon
(2010) 130 S. Ct. 2619, 2630.] It follows that email requires
strong protection under the Fourth Amendment; otherwise, the
Fourth Amendment would prove an ineffective guardian of
private communication, an essential purpose it has long been
recognized to serve." (United States v. Warshak, supra, 631
F.3d at pp. 285-286.)
This bill addresses these privacy concerns by requiring a valid
SB 467
Page 8
search warrant in order to obtain the content of electronic
communications, which is currently only required if they have
been stored, held or maintained by a provider of electronic
communication services or remote computing services for 180
days or less. [18 USCS Section 2703(a).]
3)Current Privacy Practices of Electronic Communication Services
Providers : Some of the biggest technology companies in
California already require a search warrant before disclosing
the contents of electronic communications. According to a
recent article, "Google, Microsoft, Yahoo, and Facebook all
say that they require full warrants in order to provide the
contents of emails and messages to government entities . . .
That's a higher standard than currently required by US law,
which as of now is largely defined by the Electronic
Communications Privacy Act (ECPA). The ECPA was passed in
1986 and sets a relatively low bar for accessing private
data." These companies reported that they all have their own
"policies that require a warrant before providing the content
of messages" and that the "fourth amendment backs them up."
[Bohn, "Google, Microsoft, Yahoo, and Facebook say they
require warrants to give over private content," The Verge
(Jan. 26, 2013).]
During a hearing held by the House Judiciary Subcommittee on
Crime, Terrorism, Homeland Security and Investigations,
Richard Salgado, the Director for Law Enforcement and
Information Security at Google provided the following
testimony regarding the need to update the ECPA:
"ECPA was enacted in 1986 - well before the web as we know it
today even existed. The ways in which people use the Internet
in 2013 are dramatically different than 25 years ago.
"In 1986, there was no generally available way to browse the
World Wide Web, and commercial email had yet to be offered to
the general public. Only 340,000 Americans subscribed to cell
phone service, and not one of them was able to send a text
message, surf the web, or download applications. To the
extent that email was used, users had to download messages
from a remote server onto their personal computer, holding and
storing data was expensive, and storage devices were limited
by technology and size.
"In 2013, hundreds of millions of Americans use the web every
SB 467
Page 9
day - to work, learn, connect with friends and family,
entertain themselves, and more. Data transfer rates are
significantly faster than when ECPA became law - making it
possible to share richer data, collaborate with many people,
and perform more complicated tasks in a fraction of the time.
Video sharing sites, video conferencing applications, search
engines, and social networks - all the stuff of science
fiction in 1986 - are now commonplace. Many of these services
are free.
"The distinctions that ECPA made in 1986 were foresighted in
light of technology at the time. But in 2013, ECPA frustrates
users' reasonable expectations of privacy. Users expect, as
they should, that the documents they store online have the
same Fourth Amendment protections as they do when the
government wants to enter the home to seize documents stored
in a desk drawer. There is no compelling policy or legal
rationale for this dichotomy." [Testimony of Richard Salgado,
Director, Law Enforcement and Information Security, Google
Inc., House Judiciary Subcommittee on Crime, Terrorism,
Homeland Security and Investigations Hearing on "ECPA Part 1:
Lawful Access to Stored Content" (March 19, 2013).]
4)Arguments in Support :
a) The California Newspaper Publishers Association writes,
"The threat of law enforcement obtaining information
protected by law from third parties presents serious
problems for newspaper publishers, editors and working
journalists. California has unique protections that allow
publishers, editors and working journalists to do their job
and protect sensitive sources and their unpublished notes
from being routinely accessed by law enforcement and
litigants.
"This information is protected from subpoena under the
California Shield Law (See, Cal. Const. Art. Sec. 2 and
Evidence Code Sec.1040) and by the absolute prohibition on
the search of newsrooms contained in the Penal Code (See,
Sec. 1524 (g)). These protections against forced
disclosure of sensitive information are meaningless if all
of the contents of a journalist's electronic communications
can be obtained from a third party without a warrant."
b) According to the Electronic Frontier Foundation , the
SB 467
Page 10
sponsor of this bill, "The Electronic Communications
Privacy Act ("ECPA"), the federal law that governs access
to electronic communications stored by online service
providers - and which California's law is modeled after -
was enacted in 1986, long before the advent of the World
Wide Web as we know it, let alone smartphones and e-mail
inboxes with infinite storage capacity.
"ECPA's age shows most dramatically when examining how it
regulates law enforcement access to the contents of
electronic communications. Under ECPA, law enforcement can
obtain the contents of electronic communications stored
online with a service provider for less than 180 days only
with a search warrant. But once a message has been stored
for more than 180 days, law enforcement can obtain its
contents without a search warrant.
"This 180-day dividing line was born out of the technological
realities of 1986, when people didn't have the capacity or
need to store years of electronic correspondence online.
Online storage was limited and Congress presumed people
would download important electronic messages onto their own
personal computers. Any message sitting on a server for
more than 180 days was considered abandoned. And of course
there was no such thing as Gmail, Facebook or Twitter in
1986.
"The opposite is true today. With bigger online storage
capacity and the prevalence of smartphones and tablets,
people are leaving more of their electronic correspondence
online in order to access them on any device wherever they
are. But under ECPA the only way to take advantage of this
convenience is to surrender your right of privacy.
"Courts are starting to recognize this tension. In 2010,
the Sixth Circuit Court of Appeals ruled in United States
v. Warshak that people have a reasonable expectation of
privacy in email, meaning that any portion of ECPA that
authorizes warrantless access to electronic communications
violates the Fourth Amendment.
"SB 467 codifies these principles and ensures that
California's statutory regime stays compliant with the
Fourth Amendment. SB 467 protects emails and other
electronic communications content from warrantless
SB 467
Page 11
government intrusion when stored online and in the cloud,
regardless of how long it is stored online or whether it
has been opened or unopened."
5)Arguments in Opposition :
a) The California District Attorneys Association argues,
"Federal law applies only to those electronic communication
services available to the general public and California law
mirrors that limitation. The proposed amendments to Penal
Code Section 1524.2 eliminate this restricted coverage.
Thus, the federal statutes do no regulate access to a
closed system service such as that provided by a corporate
information technology (IT) system or the IT system of a
county government. SB 467 would extend coverage to private
systems. This change will be the first item to cause
confusion about how to proceed to legally obtain Intranet
contents of communications.
"The amended section also requires that law enforcement must
give notice to the person whose electronic messages are
obtained by search warrant within three days of law
enforcement receiving the messages. This is not required
at all under the federal law if a search warrant is used
(18 USC 2703(b)(1)(A)). Prior notice to the customer of
the service is only required if law enforcement proceeds by
way of what is referred to as a 'd' order (from sec.
2793(d)). A 'd' order can be issued on less than probable
cause. (See 18 USC 2703(b)(1)(B) for the notice
requirement.) Thus, this bill will impose a new burden on
law enforcement.
"Proposed new section 1524.6 prohibits a person or entity
providing 'electronic communications services' or 'remote
computing services' from knowingly divulging the contents
of any communications stored, held, or maintained by those
services. The federal statute has the same type of
prohibition but applies only to services available to the
general public. They do not govern a closed communication
system within a corporation or governmental entity. SB 467
would extend the prohibition to both the public and private
systems which will add to the confusion.
b) The Los Angeles County District Attorney's Office
writes, "SB 467 would require a governmental entity to
SB 467
Page 12
obtain a search warrant whenever the governmental entity is
seeking to obtain the contents of a wire communication that
is stored, held, or maintained by a service provider, as
specified.
"Governmental entities employ one-fifth of all workers today.
Our office believes SB 467 interferes with a governmental
employers need to access employees' information systems to
ensure that governmental assets are used only for their
intended purpose, for official business, and not for
personal emails or other illegal and prohibited uses."
6)Prior Legislation :
a) SB 1980 (McPherson), Chapter 864, Statutes of 2002,
created state procedures, similar to those in federal law,
for a governmental entity to gather specified records, not
including the contents of stored communications, from a
provider of electronic communication service or a remote
computing service by search warrant.
b) SB 662 (Figueroa), Chapter 896, Statutes of 1999,
established a procedure for obtaining and serving a search
warrant on a foreign corporation that provides electronic
communication services or remote computing service to the
general public and is registered to do business in
California.
REGISTERED SUPPORT / OPPOSITION :
Support
Electronic Frontier Foundation (Sponsor)
American Civil Liberties Union
California Newspaper Publishers Association
California Public Defenders Association
Opposition
Association for Los Angeles Deputy Sheriffs
California District Attorneys Association
California Police Chiefs Association
California State Sheriffs' Association
Los Angeles County District Attorney's Office
Los Angeles Police Protective League
SB 467
Page 13
Riverside Sheriffs' Association
Analysis Prepared by : Stella Choe / PUB. S. / (916) 319-3744