The Wall Street Journal and CNN recently reported that Facebook provided data about Russian advertising purchases made in the run-up to the 2016 election to Special Counsel Robert Mueller pursuant to a search warrant. According to the WSJ and CNN reports, Facebook produced copies of the ads, detailed information about the accounts that purchased the ads, and information about how the ads were targeted at Facebook users in the United States. Mueller’s choice to send Facebook a warrant and not a subpoena or a (d) order under the Electronic Communications Privacy Act (ECPA) (though he certainly may have sent Facebook and other providers additional legal process, including subpoenas and (d) orders) provides insight into the kind of information he may have been seeking and the kind of information he may have obtained.
Under its policies, Facebook requires a probable cause warrant to “compel the disclosure of the stored contents of any account, which may include messages, photos, videos, timeline posts, and location information” to the government. This is because Facebook, like other large tech companies, has adopted the Sixth Circuit’s interpretation (in United States v. Warshak) of ECPA and the Fourth Amendment as requiring a warrant to obtain emails. This matters because Congress enacted ECPA in 1986, when Mark Zuckerberg was just two-years old, roughly 15 years before Facebook would be conceived in a Harvard University dorm. ECPA has not been updated since, and, as a result, technology companies and courts are tasked with applying its antiquated language to govern the compelled disclosure of data held by modern tech companies like Facebook.
Under ECPA, Facebook would have disclosed some information to Mueller without a warrant, though some form of legal process is still required. For example, information that falls into the category of “basic subscriber information,” such as the information a user provides at account creation, like a name and email address, is obtainable with a subpoena issued under a “relevance” standard and without judicial review. That is, the information sought must have some connection to the investigation at hand. This is a low bar, and, under United States v. R. Enterprises, there is a presumption that a subpoena issued by a grand jury, such as the one Mueller impaneled, is reasonable. Meanwhile, “records and other information,” is something that Mueller would have been able to obtain using a 2703(d) order, which requires “specific and articulable facts showing reasonable grounds to believe” that “the records or other information sought are relevant and material to an ongoing criminal investigation.” This is a higher standard than the subpoena relevance standard, and (d) orders are subject to judicial review, but this is still lower than the probable cause standard of review required for a warrant. Consequently, a (d) order is insufficient to obtain content information stored by providers, like emails. This reflects Congress’ attempt to weigh the privacy interests an individual might have in information shared with a provider. Congress viewed content information, like correspondence, as deserving of greater protection than subscriber or billing information.
Mueller’s choice to use a warrant is therefore revealing. Mueller could have easily obtained subscriber and billing information about the Russian accounts using a grand jury subpoena. Instead, he may have obtained a warrant because Facebook required it prior to disclosing copies of the Russian ads. These ads were likely no longer public and may have therefore been considered content held in electronic storage by Facebook on behalf of the user, in which case a warrant would be required under ECPA. This broad interpretation of “electronic storage” under ECPA is supported by the Ninth Circuit’s ruling in Theofel v. Farey Jones.
Facebook would be likely to make the argument that a warrant is required for this information because tech companies have incentives to require a warrant before disclosing sensitive information when ECPA is ambiguous, particularly in high profile cases such as this one. Consumers pay attention to privacy in the post-Snowden era, and companies have responded by ramping up their scrutiny of legal process and transparency reporting about government surveillance requests. This is not to say that companies don’t care about privacy outside of high-profile cases. They do. This is evidenced by Facebook’s attempts to challenge a bulk warrant the company received in connection with a large fraud investigation. This is just to say that stakes associated with responding to a warrant, and getting the response right, are higher in cases such as this one.
Of course, it is also possible that Facebook did not require a warrant for the ads information because it interpreted this information as being outside the scope of ECPA. Even if not required by Facebook to obtain copies of the ads, a warrant may still have appealed to Mueller and his team because of uncertainty about whether a court might later hold that a warrant is required for this data. In addition, Mueller may have also chosen to get a warrant because a warrant increases the scope of the information that Facebook can disclose about the accounts that purchased the ads, including information that is clearly covered by ECPA. A warrant places content information contained within those accounts, like communications and location histories, etc. within investigative reach. In general, such information is likely to be of little utility for identifying individuals since these accounts were probably fake ones generated by Russian misinformation farms. Still, during the course of an investigation, a lead can come from anywhere — including a random message sent by a bored propagandist from a fake account to another, real, account. The vast amount of data and large number of accounts that can be obtained with a single warrant makes such a lead all the more likely. Trolls beware.