If the federal government wants to compel an online service provider, like Yahoo or Google, to turn over your email, they need a warrant. That's the industry-accepted best practice, implemented by nearly every major service provider. More importantly, it's what the Fourth Amendment requires.
The Securities and Exchange Commission (SEC), the federal agency charged with enforcing federal securities laws, seems to think it falls outside the warrant requirement. In a civil case currently pending in Maryland, the agency asked a federal judge to compel Yahoo to comply with an administrative subpoena—read, not a warrant—it sent to the company, which would require the company to turn over the emails of one of its users. An administrative subpoena lacks the privacy safeguards of a warrant, including a higher standard justifying government access (i.e., probable cause) and prior review by a judge.
Yahoo fought back, refusing to comply with the subpoena and opposing the SEC's motion. Last week, EFF, joined by our friends at CDT, filed an amicus brief in support of Yahoo. Our brief made a simple point: if the federal government wants to compel a third-party provider to turn over a user's email, it needs a warrant. That rule applies to the SEC, just as any other federal or state government agency.
The SEC's position isn't a new one. They have long claimed a right to access email content from providers without a warrant. In fact, the SEC has been one of the primary obstacles to passing an update to the Electronic Communications Privacy Act (ECPA), the federal law that governs government access to emails and other content stored in the cloud. But this is the first time (as far as we know) that the SEC has tested its theory in court.
Fortunately, even though the SEC has so far been successful in blocking attempts to amend ECPA, the agency still has to contend with the Constitution. As we explained in our brief, because users have a reasonable expectation of privacy in their email stored with online service providers (a point SEC wisely conceded), the Fourth Amendment requires the agency to obtain a warrant—or to rely on an exception to the warrant requirement—in order to intrude upon that privacy.
The SEC argues that, as a civil law enforcement agency, it lacks the power to obtain a warrant by itself. But as we pointed out, whenever there is a criminal component to an investigation—as is the case here—the SEC can coordinate with the Justice Department to obtain a warrant. Apparently, the SEC is concerned that, in purely civil cases, when it can't work with the Justice Department to obtain a warrant, companies or individuals may be able to shield their emails from disclosure. But civil litigation offers a variety of levers for the SEC to pull in order to obtain the same or similar information, without compelling its disclosure from a third-party service provider.
Ultimately, our constitutional privacy rights shouldn't be diminished just because the SEC wants to conduct its investigations more efficiently. The hearing in the case is scheduled for Friday, June 30. We hope the court will send a clear message to government agencies: if you want to compel a third-party provider to turn over email content, get a warrant.
