Electronic evidence laws raise questions

On Jan. 1 of this year, the rules governing how state and local prosecutors and investigators obtain electronic evidence changed. That was the day two new laws - the California Electronic Privacy Act (CalECPA) and Assembly Bill 929 - took effect.

Previously, state and local officials looked to the federal Electronic Communications Privacy Act (federal ECPA) and state judicial decisions to supply the procedures for obtaining electronic evidence - that is, information about email, text messages and phone calls.

Federal ECPA divides electronic evidence into three broad categories: (1) the content of electronic communications (e.g., what the email says); (2) the transactional data surrounding the communications (e.g., header information and IP addresses, data on the location of the devices sending and receiving the communication); and (3) subscriber information (e.g., name and billing information). This federal law was the response to U.S. Supreme Court decisions declaring that people lose their expectation of privacy (and thus Fourth Amendment protection) in some of the information disclosed to third parties such as telephone companies and Internet service providers, Smith v. Maryland, 442 U.S. 735, 742-46 (1979), thereby leaving the area unregulated without legislative guidance. Federal ECPA specifies that prosecutors generally need a warrant to obtain content less than 180 days old; need a court order based on "reasonable grounds" to obtain transactional data; and need a subpoena to obtain subscriber information. 18 U.S.C. Sections 2307(b), 2703(c)(1)(A), 2703(c)(1)(B), 2703(d), 2703(c)(2), 2703(c)(3). Of course, these general rules have exceptions: Prosecutors can obtain transactional data through a pen register or trap-and-trace device (devices used to capture outgoing or incoming call data on a real-time basis) with just a certification that the information will be relevant to an ongoing investigation, 18 U.S.C. Sections 3122(b)(2), 3123(b), and many courts have subsequently held that locational transaction data requires a warrant, e.g., In re United States, 620 F.3d 304, 319 (3d Cir. 2010).

The California courts have interpreted California's "Fourth Amendment," Cal. Const., art. I, Section 13, to require a warrant for subscriber information, People v. Chapman, 36 Cal. 3d 98, 105-11 (1984), and a probable-cause-based court order for pen registers and trap-and-trace information, People v. Larkin, 194 Cal. App. 3d 650, 654 (1987).

CalECPA and AB 929 replace this patchwork with a more comprehensive set of statutes that are similar, but not identical, to federal ECPA. CalECPA and AB 929 both regulate "government entities," not the defense. Penal Code Sections 1546.1, 1546.2, 638.51, 638.52.

CalECPA reaches "electronic information," which it further breaks down into (1) "electronic device information" (i.e., information "stored on or generated by" an electronic device); and (2) "electronic communications information" (i.e., content and all transactional data except subscriber information). Id. Section 1546(d), (g), (h). Prosecutors and investigators may not obtain "electronic device information" - either from others or by directly accessing a device - unless they obtain (1) a type of "super warrant" created by CalECPA that requires probable cause plus notice and a form of minimization; (2) a wiretap order; or (3) the "specific consent" of the device's "authorized possessor" or owner. Id. Sections 1546.1(c), (d) (setting forth special warrant requirements), 1546.2(a), (c) (same). CalECPA's procedures for obtaining "electronic communications information" turns on who has it: To get information from a service provider, a prosecutor or investigator in most instances needs a CalECPA "super warrant" or a wiretap, id. Section 1546.1(b); to get it from the sender, addressee or intended recipient of a communication, the prosecutor or investigator generally uses a CalECPA "super warrant," that person's voluntary consent, or a subpoena, id. Section 1546.1(a)(3), (i)(1); and to get it from an employing entity regarding electronic communications provided to the entity's officers, directors, employees or agents, a prosecutor or investigator generally needs a CalECPA "super warrant," the entity's consent or a subpoena, id. Section 1546.1(i)(2). Prosecutors and investigators may obtain subscriber information with just a subpoena, or the service provider's voluntary consent where such consent complies with federal and state law. Id. Section 1546.1(f).

AB 929 predicates the issuance of a pen register or trap-and-trace device upon a certification of relevance and a judicial finding of probable cause that the information obtained will serve one of eight enumerated purposes. Id. Section 658.52(a), (b).

These new provisions give prosecutors and investigators answers on what they need to do to obtain electronic evidence. They also raise several questions:

(1) Do CalECPA's generally more stringent requirements for obtaining electronic evidence apply when that evidence is obtained by a joint federal-state task force that is later used in a state prosecution? CalECPA defines a "government entity" to include any "individual acting for or on behalf of the state or a political subdivision thereof." Id. Section 1546(i). Does that reach a federal agent working on a truly joint task force?

(2) Which statute governs pen registers and trap-and-trace devices? CalECPA's definition of "electronic communications information" reaches "information pertaining to any individual or device participating in the communication," id. Section 1546(d), which would seem to encompass incoming and outgoing call data captured by these devices; if CalECPA applies, then a "super warrant" would be needed to obtain such information. AB 929 requires a certification and a judicial finding of probable cause regarding the information to be obtained. If AB 929's standard is different than CalECPA's, which standard controls? This is no idle question: The remedy for violating CalECPA is suppression, id. Section 1546.4(a), and that suppression remedy is constitutionally valid because CalECPA was passed by a two-third majority of the Legislature, Cal. Const., art. I, Section 28(f)(2). Thus, a prosecutor who follows AB 929 but not CalECPA risks suppression of the electronic evidence.

(3) Which set of CalECPA's rules applies to information generated by or stored on an electronic device? That is the very definition of "electronic device information," but CalECPA's definition of "electronic communications information" is broad enough to reach the same information. Electronic device information may be obtained by specific consent; electronic communications information may not. Which controls?

(4) What effect, if any, does CalECPA have when a non-law enforcement agency uses a subpoena to obtain electronic information that is later handed over to a prosecutor or investigator? CalECPA authorizes the use of a subpoena when "the information is not sought for the purpose of investigating or prosecuting a criminal offense," Pen. Code Section 1546.1(b)(4), but does not speak to what happens if that information is subsequently passed along.

(5) Can parole and probation officers look through a parolee's or probationer's electronic device? CalECPA allows law enforcement to obtain "electronic device information" when the owner or "authorized possessor" of the device gives "specific consent," but define "specific consent" as consent "provided directly to the government entity seeking" it. Id. Section 1546(k). Does this definition exclude a statutory condition of parole or a judicially imposed condition of probation when neither the legislature nor court asked for that consent?

(6) What effect do CalECPA or AB 929 have on the earlier case law interpreting California's "Fourth Amendment"? Those decisions ostensibly require a probable cause-based order to obtain content, transactional data or subscriber information, but CalECPA and AB 929 in many instances require less. To be sure, noncompliance with California's "Fourth Amendment" does not warrant suppression to the extent it goes beyond the federal Fourth Amendment. Cal. Const., art. I, Section 28(f)(2). So following CalECPA and AB 929 would not require any suppression. But California judges take an oath to obey California's Constitution, id. art. XX, Section 3. Because they oversee the responses to subpoenas issued to third parties in criminal cases, Pen. Code Section 1326; Kling v. Superior Court, 50 Cal. 4th 1068, 1079 (2010), can they take actions that comply with CalECPA and AB 929 if those actions contravene the earlier decisions interpreting the Constitution?

(7) How do portions of CalECPA square with the federal Fourth Amendment? CalECPA allows governmental entities to subpoena content and transactional data from the participants to an electronic communication and from an employing entity. To the extent that content is protected by the Fourth Amendment and thus requires a warrant, see Quon v. Arch Wireless Operating Co. Inc., 529 F.3d 892, 905-06 (9th Cir. 2008), overruled on other grounds, 560 U.S. 746 (2010), is use of a subpoena constitutional?

It is too early to know how many of these new questions will necessitate judicial or legislative help to answer. But the ever-increasing importance of electronic evidence means these new statutes will have ever-increasing relevance in the years ahead.