CANTIL-SAKAUYE, C. J. —
Real parties in interest Derrick D. Hunter and Lee Sullivan (defendants) were indicted by a grand jury and await trial on murder, weapons, and gang-related charges arising out of a driveby shooting in San Francisco. Each defendant served a subpoena duces tecum on one or more petitioners, social media service providers Facebook, Inc. (Facebook), Instagram, LLC (Instagram), and Twitter, Inc. (Twitter) (collectively, social media providers,
As explained below, the federal Stored Communications Act (18 U.S.C. § 2701 et seq.; hereafter SCA or Act)
Defendants implicitly accepted providers' reading of the Act and their conclusion that it bars providers from complying with the subpoenas. Nevertheless, defendants asserted that they need all of the requested communications (including any that may have been deleted) in order to properly prepare for trial and defend against the pending murder charges. They argued that the SCA violates their constitutional rights under the Fifth and Sixth Amendments to the United States Constitution to the extent it precludes compliance with the pretrial subpoenas in this case.
The trial court, implicitly accepting the parties' understanding of the SCA, agreed with defendants' constitutional contentions, denied providers' motions to quash, and ordered them to produce the requested communications for the court's review in camera. Providers sought, and the Court of Appeal issued, a stay of the production order. After briefing and argument, the appellate court disagreed with the trial court's constitutional conclusion and issued a writ of mandate, directing the trial court to quash the subpoenas. We granted review.
Accordingly, we solicited supplemental briefing concerning the proper interpretation of section 2702. In that briefing, all parties now concede that communications configured by the social media user to be public fall within section 2702(b)(3)'s lawful consent exception to section 2702's prohibition, and, as a result, may be disclosed by a provider. As we will explain, this concession is well taken in light of the relevant statutory language and legislative history.
The parties differ, however, concerning the scope of the statutory lawful consent exception as applied in this setting. Defendants emphasize that even those social media communications configured by the user to be restricted to certain recipients can easily be shared widely by those recipients and become public. Accordingly, they argue that when any restricted communication is sent to a "large group" of friends or followers the communication should be deemed to be public and hence disclosable by the provider under the Act's lawful consent exception. On this point we reject defendants' broad view and instead agree with providers that restricted communications sent to numerous recipients cannot be deemed to be public — and do not fall within the lawful consent exception. Yet we disagree with providers' assertion that the Act affords them "discretion" to defy an otherwise proper criminal subpoena seeking public communications.
Ultimately, whether any given communication sought by the subpoenas in this case falls within the lawful consent exception of section 2702(b)(3), and
We will direct the Court of Appeal to remand the matter to the trial court to permit the parties to appropriately further develop the record so that the trial court may reassess the propriety of the subpoenas under the Act in light of this court's legal conclusions.
According to testimony before the grand jury, at midday on June 24, 2013, Jaquan Rice, Jr., was killed and his girlfriend, B.K., a minor, was seriously injured in a driveby shooting at a bus stop in the Bayview district of San Francisco. Various surveillance videos showed a vehicle and someone firing a handgun from the rear window on the driver's side. A second person was depicted leaving the vehicle from the rear passenger-side door and firing a gun with a large attached magazine.
Witnesses identified defendant Derrick Hunter's 14-year-old brother, Quincy, as one of the shooters. During questioning in the early morning hours after the events, police homicide detectives told Quincy that they had "pulled all Instagram ... [and] Facebook stuff," and were aware that he knew the shooting victim. Quincy related that the victim had "tagged" him on Instagram in a video featuring guns. The detectives responded that they had been "working all day" on the matter and had "seen those posts." Quincy admitted that he shot the victim six times — and asserted that the victim "would have done the same thing to us."
Quincy stated that "Nina," his girlfriend's sister, had provided the car in which he, his brother, and one other male had driven. Within a few minutes
Renesha was codefendant Lee Sullivan's then girlfriend. She had rented the car used in the shooting and gave varying accounts of the events. According to her testimony before the grand jury, during the course of multiple interviews on the day and night of the killings, she initially "just made up names and stuff." Eventually she told the police that defendant Derrick Hunter and his younger brother Quincy were among those who had borrowed her car. Renesha did not mention defendant Sullivan's name until a few days later, when she "told them the truth about [Sullivan]," and that he had been involved along with the Hunter brothers.
Renesha related that on the day of the shooting she had driven with Sullivan and the Hunter brothers to a parking lot where they "got out and walked to Quincy['s] house." She explained that Sullivan told her the three young men were going to a store. Renesha recalled that she replied she would remain at the house and talk to her sister. She testified that Sullivan had not been wearing gloves when he and the others initially approached her to borrow the car, but she noticed that he was wearing gloves when they came out of Quincy's house and when they departed. According to Renesha, Sullivan drove away with the Hunter brothers in the backseat. She testified that when the three returned the car to her shortly thereafter it contained the phones of Sullivan and Derrick Hunter. She also testified that she had never seen Sullivan or either of the Hunter brothers with a gun.
Renesha explained that she had initially not revealed Sullivan's involvement because she had been scared and "just didn't want to have no parts of it because I'm the one that still has to live and walk these streets." She elaborated that once the police informed her that she might be arrested for murder, she "told them the truth," and yet still avoided implicating Sullivan until later in the process because she remained fearful of him. She maintained that after being threatened with prosecution she eventually told the full truth about Sullivan's role.
In presenting the case to the grand jury, the prosecution contended that defendants and Quincy were members of Big Block, a criminal street gang, and that Rice was killed for two reasons: (1) Rice was a member of West Mob, a rival gang, and (2) Rice had publicly threatened defendant Derrick Hunter's younger brother Quincy on social media. Inspector Leonard Broberg, a gang
Defendants were indicted and are presently charged with the murder of Rice and the attempted murder of B.K. They also face various gang and firearm enhancements. (Pen. Code, §§ 187, 664, 186.22, subd. (b)(1), 12022, subd. (a), 12022.53, subds. (d) & (e)(1).)
Prior to trial, in late 2014, both defendants served subpoenas duces tecum (Pen. Code, § 1326, subd. (b)) on Twitter. Defendant Sullivan's subpoena sought "[a]ny and all public and private content" that had been "published by" Renesha Lee, who was identified by an attached photocopied screenshot of one of her Twitter accounts. The request specified no temporal boundary and stated that it "includes but is not limited to" (1) so-called record data, consisting of "user information [and] associated e-mail addresses," "activity logs," and "location data"; and (2) content information, such as "photographs, videos, private messages, ... posts, status updates, ... and comments including information deleted by the account holder." It further sought the identity and contact information concerning the custodian of records who
Only defendant Sullivan served subpoenas on Facebook and Instagram. The Facebook subpoena requested information regarding the accounts of both Rice and Renesha Lee. The language of the subpoena tracked Sullivan's request to Twitter, broadly seeking "[a]ny and all public and private content," including deleted material, that had been "published by" either Rice or Renesha Lee, each of whom was identified by an attached photocopied screenshot of that person's Facebook account. As with Sullivan's subpoena served on Twitter, the subpoena specified no temporal boundary and sought the same record data, content, and authentication information mentioned above.
Sullivan's subpoena served on Instagram similarly sought "[a]ny and all public and private content," including deleted material, published by Rice and Renesha Lee, each of whom was again identified by photocopied screenshots showing their account information.
Counsel for Facebook and its subsidiary Instagram responded to the Sullivan subpoenas by a single letter in December 2014, asserting that as providers governed by federal statute (the SCA), they are precluded under that law from divulging the requested stored communications. The letter stated that under the SCA only the government may compel covered providers to divulge such stored content. Accordingly, the letter recommended that defense counsel instead seek the requested information directly from the account holder or from "any party to the communication" — persons who, unlike a covered provider, are "not bound by the SCA." Alternatively, the letter suggested that defense counsel might "work[] with the prosecutor to
Eventually all three providers moved to quash the subpoenas. They reiterated the assertions in their letters that defendants might try to obtain the requested information directly from the social media user who posted the communication, or from any recipient
Defendants opposed the motions to quash,
Defendants presented offers of proof concerning the information sought from the various accounts. The prosecution had secured from Facebook and Instagram some of the available social media communications attributed to Rice and, as obligated, had shared that information with defendants in the course of discovery.
Although the prosecution had secured and shared some of Rice's Facebook communications and a portion of the Instagram posts attributed to him, the prosecution had not sought from providers the social media communications of their key witness, Renesha Lee. Nevertheless, it appears from the record that at least one of Renesha Lee's Twitter accounts was public and contained numerous tweets that were accessible to defense counsel. Counsel evidently accessed that account and identified content that, they asserted, indicated a strong likelihood that other similar, yet undiscovered — and possibly deleted — communications might exist. Defendants alleged that the prosecution's case turns on Renesha Lee's credibility and that "she is the only witness who implicates Sullivan in the killing."
In support of these assertions defendants' opposition appended, as an exhibit, photocopied screenshots of what was represented as two of Renesha Lee's Twitter accounts. They quoted a September 2013 tweet showing a photograph of a hand holding a gun and making specific threats: "I got da. 30 wit dat extend clip..... BIIIITCH I WILL COME 2YA FRONT DOOR....." Various other tweets from both accounts suggested a similar theme. Defendants asserted their need for and intention to use these and any other similar tweets, posts, comments, or messages, including deleted content, made by Renesha Lee on Twitter, Facebook, or Instagram, in order to impeach her anticipated testimony at trial. Defense counsel stated that, despite diligent efforts, Renesha Lee could not be located to be served with a subpoena duces tecum.
The first session of the bifurcated hearing on the motions to quash was held in early January 2015. The trial court began by explaining that, in light of the pleadings, it was inclined to find the sought material "critical" to the defense against the pending charges, and to conclude that "defendants have a
The trial court next addressed Twitter's assertion that any "deleted contents" would "not [be] reasonably available" and hence providers would "not ... be able to produce deleted contents or authenticate deleted content." The court expressed skepticism concerning Twitter's assertion that it would be unable to produce deleted content, observing: "[W]hat I ... know from my time in discovery [is] that when I delete e-mails, they are not all deleted. [¶] Now, I don't know ... to what extent they are kept on some server or archive that could be retrieved through some sort of search function, or whether some forensic computer person has a way of reconstructing files or not. [¶] So ... if you are going to say that you complied and ... state under penalty of perjury [supported by a] showing ... that you have done what you can do, that's a separate thing. But, I doubt very much I am going to change my position that this material is critical, it has to be produced, and you are the ones holding it." Accordingly, the court tentatively denied the motions to quash and ordered that the materials be provided to it for in camera review pursuant to Penal Code section 1326. At the same time, the trial court allowed additional briefing to be filed before it ruled finally on the matter.
In its subsequent brief Twitter reiterated its assertion that section 2702 of the SCA fails to "distinguish between `private' and `public' content for purposes of its restrictions on providers' disclosure" and it maintained that "service providers are prohibited from producing any content, regardless of status." Facebook and Instagram asserted in their own subsequent brief that section 2702 of the SCA bars the requested discovery and that the Act "contains no exception for criminal defense subpoenas." Consistent with their broad assertion that no exception applied under section 2702, they did not address whether any of the sought communications had been configured by the account holder to be public or private/restricted. Twitter, by contrast, directly confronted that issue in its own final supplemental responsive brief, noting
In response, defendants contested the assertions by Facebook and Instagram that defendants could gain access to the sought communications by other means.
After considering the additional briefing, in late January 2015 the trial court confirmed its earlier conclusions, commenting that it would be "untenable" to deny the requested material to defendants. The court further explored with the parties the issues of deleted communications and burdens that compliance would impose on providers. In that regard counsel for providers asserted that deleted tweets "don't persist in backup for all eternity" and to the extent some remained in storage, "they are going to be very cumbersome and burdensome to obtain." The court responded that it had insufficient information with which to weigh the benefit of production versus burdens, and noted that it could easily impose a temporal restriction on the information sought in order to render the request more reasonable and less burdensome. The court then asked counsel to address recovery of deleted content concerning "your other clients" — Facebook and Instagram. But that discussion never occurred, producing an evidentiary lacuna as to those providers. Thereafter, neither the parties nor the court addressed whether any of the sought tweets had been configured as public, or whether, for any time period, the user had
The trial court finalized its tentative rulings, denying all three motions to quash and ordering that providers submit all of the sought materials for its in camera review by a deadline in late February 2015.
After discussing the need for a preservation order (see post, fn. 47), the court vacated the trial date, which had been set for the next day. All parties agreed to reconvene in early March, after the trial court had an opportunity to conduct in camera review of the information that providers had been ordered to produce, or alternatively at a later date pending resolution of the writ proceeding providers intended to file contesting the court's oral production order.
Providers jointly filed a petition for a writ of mandate in the Court of Appeal contending that the trial court abused its discretion in denying the motions to quash. They asked the appellate court to "preserve the status quo" by issuing an immediate stay of the trial court's production order and planned in camera review. That court stayed the trial court's production order and issued an order to show cause asking why the relief sought in the petition should not be granted.
After full briefing and oral argument, the Court of Appeal filed an opinion concluding that the SCA barred enforcement of defendants' pretrial subpoenas and rejecting defendants' arguments that the Act violated their rights under the Fifth and Sixth Amendments to the federal Constitution. Reviewing the relevant case law with respect to the constitutional claims, the appellate court concluded: "The consistent and clear teaching of both United States Supreme Court and California Supreme Court jurisprudence is that a criminal
Because the parties agreed in the trial court that the SCA precluded providers from complying with defendants' subpoenas and the court accepted that proposition, the trial court proceeded on the assumption that providers' refusal to comply with the subpoenas raised only constitutional questions. It then decided the matter by resolving those constitutional issues in defendants' favor. As explained above, the Court of Appeal likewise viewed the case as raising only constitutional issues, and its decision in providers' favor was grounded on the appellate court's conclusion that defendants' constitutional claims were not viable in the pretrial context.
In their initial briefing in this court, the parties again proceeded on the assumption that the litigation raised only constitutional issues, and they debated the merits of defendants' constitutional contentions. Defendants reiterated the view that their federal constitutional right to due process under the Fifth Amendment, and their confrontation, compulsory process, and effective assistance of counsel rights under the Sixth Amendment, require that the Act be declared unconstitutional to the extent it precludes the enforcement of their subpoenas in this case. They candidly recognized that case authority supporting their position is sparse. Ultimately, they suggested that we should overrule or distinguish our own decisions (especially People v. Hammon (1997) 15 Cal.4th 1117 [65 Cal.Rptr.2d 1, 938 P.2d 986] and its progeny) in order to declare the SCA unconstitutional as applied and uphold their pretrial subpoenas. Providers, by contrast, asserted that no decision of any court supplies authority supporting defendants' entitlement to pretrial enforcement of their subpoenas. They argued that, to the extent defendants might later at
As mentioned, our initial review of the SCA and the relevant legislative history of the pertinent provisions, as well as prior judicial decisions addressing related issues, led us to question the validity of the statutory interpretation of the SCA on which the case was litigated below. Specifically, we questioned whether the relevant statute, section 2702(a), which appears to bar providers from disclosing electronic communications configured by the user to be private or restricted, also bars providers from disclosing communications that had been configured by the user to be public. Accordingly, we requested supplemental briefing directed to that issue, identifying the portions of the legislative history that appeared most relevant.
Congress enacted the Electronic Communications Privacy Act in 1986. (ECPA; Pub.L. No. 99-508 (Oct. 21, 1986), 100 Stat. 1848, 1860.) Title I of that law, amending the prior "Wiretap Act," addresses the interception of wire, oral, and electronic communications. (§§ 2510-2521.) Title II of the law, set out in chapter 121, is often referred to as the Stored Communications Act, or SCA. It addresses unauthorized access to, and voluntary and compelled disclosure of, such communications and related information. (§§ 2701-2712.)
Prior to the ECPA's enactment, the respective judiciary committees of the House of Representatives and the Senate prepared detailed reports concerning the legislation. Each explained that the main goal of the ECPA in general, and of the SCA in particular, was to update then existing law in light of dramatic
Section 2701(a) provides that, subject to specified exceptions, "whoever... [¶] ... intentionally accesses without authorization a facility through which an electronic communication service is provided" or "intentionally exceeds an authorization to access that facility" and "thereby obtains" an "electronic communication while it is in electronic storage in such system" commits an offense punishable by a fine or imprisonment. At the same time, a separate provision contained in another part of the ECPA, section 2511(2)(g)(i), articulates a substantial limitation on section 2701's access prohibition: "It shall not be unlawful under ... chapter 121 [that is, the SCA] ... [¶] ... to ... access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public."
Section 2702 addresses disclosure by certain covered service providers — and by no other person or entity. (Wesley College v. Pitts (D.Del. 1997) 974 F.Supp. 375, 389.) Section 2702(a)(1) declares that, subject to specified exceptions, "a person or entity providing an electronic communication service[
The next two subsections of section 2702 — (b) and (c) — list exceptions to the general prohibition on disclosure by a service provider set forth in subsection (a). Subsection (b) describes eight circumstances under which a provider "may divulge the contents of a communication." (§ 2702(b).) As relevant here, subparts (1) through (3) of subsection (b) permit disclosure: (1) "to an addressee or intended recipient of such communication or an agent of such addressee or intended recipient" (§ 2702(b)(1)); (2) pursuant to section 2703, which, as described below, permits a "governmental entity" to compel a covered provider to disclose stored communications by search warrant, subpoena or court order; and (3) "with the lawful consent of the originator or an addressee or intended recipient of such communication, or the subscriber in the case of [a] remote computing service" (§ 2702 (b)(3), italics added). As explained below, some of the communications sought under the subpoenas at issue here may fall within the lawful consent exception set forth in section 2702(b)(3).
Finally, subsection (c) of section 2702 describes six circumstances under which a covered provider may divulge non-content information — that is, any "record or other information pertaining to a subscriber to or customer of such service (not including the contents of communications...)."
The 1986 congressional reports took special note of then-existing electronic bulletin boards — early analogues to the social media platforms at issue here. In the course of these discussions, the respective judiciary committees focused on the configuration of posts as being private or public and indicated an understanding that section 2701, governing unauthorized access to communications, was intended to cover and protect only private and not public posts. Significantly, the reports indicated the same understanding regarding section 2702's ban on provider disclosure of electronic communications, as reflected in that section's lawful consent exception to the ban.
The extensive House Report, issued first, repeatedly focused on the public/private theme. It did so initially in a passage addressing section 2511(2) of the ECPA, which as noted above states in subsection (g)(i) that it "shall not be unlawful" under either the omnibus ECPA or its SCA subset to "access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public." The committee explained that under this provision, it would be "permissible to intercept electronic communications
The House Report next turned to the provision that we must construe here, section 2702, prohibiting disclosure by covered providers of communications contents. The committee revealed its understanding that the theme of distinguishing between public and private posts carried over from section 2701's access rule and applied as well to section 2702's bar on the divulging of communications by providers.
The report observed that although section 2702(a) articulates a general prohibition on disclosure by a provider, section 2702(b)(3), setting out one of eight exceptions to that rule, permits such a provider to divulge contents "with the lawful consent of the originator or any addressee or intended recipient" of the communication. (House Rep., supra, at p. 66.) The committee explained that, in its view, implied lawful consent by a user — and hence permissible disclosure by service providers — would readily be found with regard to communications configured by the user to be accessible to the public. It stressed that consent as contemplated by section 2702(b)(3) "need not take the form of a formal written document of consent." (House Rep., supra, at p. 66.) The report viewed consent to disclosure as being implied by a user's act of posting publicly, and/or by a user's acceptance of a provider's
Prior decisions have found that Facebook and Twitter qualify as either an ECS or RCS provider and hence are governed by section 2702 of the SCA.
Only a few decisions have construed the relevant provisions of the SCA, and nearly all have concerned civil litigation. Most have focused on claims that a party had obtained unauthorized access to stored communications under section 2701, and hence are not directly applicable here. Two decisions have addressed the question we face in this criminal matter — whether section 2702 bars covered service providers from divulging social media communications in response to a subpoena. For context — and because, as we will see, one of the key section 2702 disclosure cases subsequently relied on some of
Konop v. Hawaiian Airlines, Inc. (9th Cir. 2002) 302 F.3d 868 (Konop) concerned asserted unauthorized access to communications on a restricted and password-protected electronic bulletin board. The Ninth Circuit panel, citing some of the passages set out in the two judiciary committee reports noted above, concluded that this legislative history "suggests ... Congress wanted to protect electronic communications that are configured to be private, such as email and private electronic bulletin boards" and that Congress intended the configuration of communications would "`establish an objective standard [for] determining ... privacy protection.'" (Id., at pp. 875, 879, fn. 8, quoting House Rep., supra, at p. 41.) Subsequently, Snow v. DirecTV, Inc. (11th Cir. 2006) 450 F.3d 1314, quoted and extended Konop's observation. The Eleventh Circuit concluded that in light of section 2511(2)(g)(i) and some of the legislative history described earlier, Congress intended to confine the reach of section 2701's access bar to those stored electronic communications that were configured to be restricted and not readily accessible to the general public. (450 F.3d at pp. 1320-1321.)
More recently, in Ehling, supra, 961 F.Supp.2d 659, a federal district court addressed a party's asserted unauthorized access to a user's restricted Facebook posts. The court highlighted the House Report's understanding that the configuration of communications would determine whether any given post is "accessible to the public" (id., at p. 666), and it relied on section 2511(2)(g)(i) (permitting access to communications that are "readily accessible to the general public") as well as Konop and Snow in concluding that "the SCA covers: (1) electronic communications, (2) that were transmitted via an electronic communication service, (3) that are in electronic storage, and (4) that are not public" (Ehling, supra, at p. 667, italics added). The court found that Facebook "posts ... configured to be private meet all four criteria." (Ibid.) In reaching this conclusion the court observed that decisions "interpreting the SCA confirm that information is protectable as long as the communicator actively restricts the public from accessing the information." (Id., at p. 668, italics added.)
The Ehling court elaborated: "The touchstone of the Electronic Communications Privacy Act is that it protects private information. The language of the statute makes clear that the statute's purpose is to protect information that the communicator took steps to keep private." (Ehling, supra, 961 F.Supp.2d at p. 668.) It reasoned: "Facebook allows users to select privacy settings.... Access can be limited to the user's Facebook friends, to
In addition to the civil decisions construing section 2701's access rules and recognizing a public/private distinction in that setting, a few civil cases have concerned section 2702's prohibition on disclosure, as applied to third party subpoenas designed to compel providers to divulge electronic communications by the providers' users.
The first group of decisions addresses requests for disclosure by e-mail providers of their users' e-mail communications. A leading example is O'Grady, supra, 139 Cal.App.4th 1423, in which a California appellate court held section 2702 prevented an e-mail service provider from complying with a subpoena issued on behalf of Apple Computer (Apple). Apple sought the e-mail communications of an online news magazine to discover the identities of those who leaked confidential information about an impending Apple product. In concluding that section 2702 prohibited disclosure by the provider of such private e-mails (O'Grady, at pp. 1440-1451), the court distinguished between public posts that were made available "to the world," and the "contents of private [e-mail] messages" at issue in that case. (Id., at p. 1449, italics omitted.) The court noted that it would reach a different conclusion, and presumably find disclosure permissible, "if the discovery [could] be brought within one of the statutory exceptions — most obviously, a disclosure with the consent of a party to the communication" under the lawful consent exception of section 2702(b)(3). (O'Grady, at p. 1446; see also id., at p. 1447.) Likewise, other courts have concluded that section 2702 bars e-mail service providers from divulging private e-mail communications in response
Two additional section 2702 disclosure cases are more pertinent to our present inquiry because they concerned disclosure by service providers, not of private e-mail, but of social media communications. As explained below, these decisions reflect an understanding that Congress intended section 2702 to prohibit disclosure by providers of only private or restricted, but not public, social media communications.
The first opinion, Viacom Internat. Inc. v. YouTube Inc. (S.D.N.Y. 2008) 253 F.R.D. 256, addressed efforts by copyright owners to compel a social media provider, YouTube, to divulge stored information regarding videos that users had configured as private or restricted. (Id., at p. 264.) The federal district court quoted the House Report's observation, noted ante, part II.C., that one who posts a communication with a reasonable basis for knowing that it will be available to the public should be considered to have implicitly consented to such disclosure under section 2702(b)(3). (253 F.R.D. at p. 265.) The court held, however, that YouTube was barred under section 2702(a) from disclosing "videos that [users] have designated as private and chosen to share only with specified recipients" — and that on the facts presented, section 2702(b)(3)'s lawful consent exception was inapplicable. (Viacom, at pp. 264-265.)
The second decision, Crispin, supra, 717 F.Supp.2d 965, also concerned disclosure by a social media service provider under section 2702 in response to a civil discovery subpoena. The plaintiff in Crispin, an artist, sued the defendants, clothing manufacturers, asserting they violated a license to use his art. The defendants in turn issued subpoenas to various service providers, including Facebook and social media provider MySpace. The subpoenas broadly sought all manner of communications, ranging from public to private, between the plaintiff and others. The plaintiff moved to quash the subpoenas on various grounds, including that the providers were barred by section 2702 from making the disclosures. A magistrate concluded that the section did not apply, and declined to quash the subpoenas with respect to any of the communications.
Accordingly, the court in Crispin determined that the dispositive question was whether the posts had been configured by the user as being "sufficiently restricted that they are not readily available to the general public." (Crispin, supra, 717 F.Supp.2d at p. 991.) Further, the court found that any restrictive privacy configuration employed by the user should be honored, and would bar disclosure by a service provider under section 2702 of the SCA, even if the restricted group is comprised of all of a user's Facebook friends. (Crispin, at p. 990.)
Applying these principles to the motion to quash the civil subpoenas before it, the Crispin court observed that the parties had provided an incomplete record regarding the nature of the various private message services and other posts and comments services offered by those social media entities. Accordingly, the court remanded the matter "so that [the magistrate] can direct the parties to develop a fuller evidentiary record regarding plaintiff's privacy settings and the extent of access allowed to his Facebook [posts] and MySpace comments." (Crispin, supra, 717 F.Supp.2d at p. 991.)
As observed ante, part II.C., the House Judiciary Committee discussed the public/private distinction articulated under section 2511(2)(g)(i) of the ECPA, and revealed that it viewed that same distinction as carrying over and applying under the related access provision of the SCA, section 2701. The House Report then proceeded to describe the disclosure provision, section 2702, in a manner showing that it considered the same public/private distinction to apply in that context as well via the lawful consent exception
As alluded to earlier, in supplemental briefs concerning section 2702 filed in response to questions posed by this court, both parties now agree that a social media communication configured by a registered user to be public falls
Nevertheless, both parties urge us to address not only the scope of the lawful consent exception, but also the constitutional issues originally framed and briefed. As alluded to in footnote 31, ante, and as explained below, we find it proper at this point to address only the statutory issues, and not the constitutional claims.
As observed earlier, in the lower court proceedings the parties did not focus on the public/private configuration distinction. The trial court made no determination whether any communication sought by defendants was configured to be public (that is, with regard to the communications before us, one as to which the social media user placed no restriction on who might access it) or, if initially configured as public, was subsequently reconfigured as restricted or deleted. Nor is it clear that the trial court made a sufficient effort to require the parties to explore and create a full record concerning defendants' need for disclosure from providers — rather than from others who may have access to the communications. Consequently, at this point it is not apparent that the court had sufficient information by which to assess defendants' need for disclosure from providers when it denied the motions to quash and allowed discovery on a novel constitutional theory. In any event, because
In light of our interpretation of the Act, it is possible that the trial court on remand might find that providers are obligated to comply with the subpoenas at least in part. Accordingly, although we cannot know how significant any sought communication might be in relation to the defense, it is possible that any resulting disclosure may be sufficient to satisfy defendants' interest in obtaining adequate pretrial access to additional electronic communications that are needed for their defense. For these reasons, we will not reach or resolve defendants' constitutional claims at this juncture. Instead, we conclude that a remand to the trial court is appropriate.
In order to provide guidance to the trial court on remand, we discuss two issues regarding the statutory question that have been raised by the parties in their supplemental briefs.
The parties now generally agree that communications configured by a social media user to be public fall within section 2702(b)(3)'s lawful consent exception and presumptively may be disclosed by a provider. Beyond this point of agreement, the parties disagree starkly concerning the proper scope and interpretation of the implied consent exception.
Defendants advance an expansive interpretation of the exception. They argue that a user's implied consent to disclosure by providers under section 2702(b)(3) should be triggered not only by communications configured by the user to be public, but also by those configured by the user to be restricted, but nonetheless accessible to a "large group" of friends or followers. Defendants contend that, in practice, social media users "lose[] control over dissemination once the information is posted," and can have no reasonable expectation of privacy even with regard to such restricted communications in light of the fact that any authorized recipient can easily copy any communication and share it with others. (Cf. Moreno v. Hanford Sentinel, Inc. (2009) 172 Cal.App.4th 1125, 1129-1130 [91 Cal.Rptr.3d 858] [social media user had no reasonable expectation that a communication configured as restricted would not be shared with others and hence could not maintain a tort action for public disclosure of private facts].) Defendants observe that the Internet, attendant technology, and social media itself did not exist when Congress
In support, defendants rely primarily on distinguishable decisions finding social media communications discoverable in civil litigation from a social media user, not, as here, from a social media provider. (E.g., Fawcett v. Altieri (2013) 38 Misc.3d 1022 [960 N.Y.S.2d 592, 597] [private social media posts may be compelled from a user in civil discovery "just as material from a personal diary may be discoverable"].) They also rely on cases such as U.S. v. Meregildo (S.D.N.Y. 2012) 883 F.Supp.2d 523, 526 (Meregildo) [rejecting 4th Amend. claim and holding that a criminal defendant who restricted Facebook communications to "friends" had no legitimate expectation that a friend would not share that information with the government]. But none of these cases involving the propriety of compelling disclosure by social media users concerned or construed section 2702's prohibition on disclosure by providers.
Defendants criticize decisions such as Crispin, supra, 717 F.Supp.2d 965, and Ehling, supra, 961 F.Supp.2d 659, for analogizing social media communications to what they characterize as "nearly obsolete" electronic bulletin boards. They insist that focusing on such allegedly outdated sites prevented those courts from understanding that sharing is the essence of modern social media. Indeed, defendants and amici curiae on their behalf argue that, in the context of social media communications, there generally is no such thing as true privacy. Accordingly, they assert, even those social media communications configured by a user to be available to only specific friends or followers and that exhibit a "veneer of privacy" should nevertheless be treated as public. Defendants argue that such communications should not be protected by section 2702(a) — or that, alternatively, they should be deemed to fall within the lawful consent exception of section 2702(b)(3).
Providers and amicus curiae Google LLC (Google) by contrast, assert that a registered user who configures a communication to be viewed by any number of friends or followers — but not by the public generally — evinces an intent not to consent to disclosure by a provider under 2702(b)(3), but instead to preserve some degree of privacy. They too rely on Meregildo, supra, 883 F.Supp.2d 523, 525, which observed that Facebook "postings using more secure privacy settings reflect the user's intent to preserve information as private." They also rely on Ehling, supra, 961 F.Supp.2d at page 668, which, as noted earlier, focused on whether a Facebook user "actively restrict[ed] the public from accessing the information" and found that when a user configures a communication to be available on only a limited basis and "inaccessible to
To begin with, we reject defendants' unsupported and rather startling assertion that social media communications and related technology fall categorically outside section 2702(a)'s general prohibition against disclosure by providers to "any person or entity."
In this respect, providers argue, defendants' view "would effectively eliminate expectations of privacy in all communications" and hence "would undermine the privacy rights of all users, including those of criminal suspects and defendants. If the SCA excluded electronic communications that are
As observed ante, part II.C., the House Judiciary Committee suggested, in its discussion of access rules, an understanding that a user's configuration would "establish an objective standard" to determine privacy protection. (House Rep., supra, at p. 41.) When subsequently addressing the disclosure rules — and the lawful consent exception to those rules — the House committee stressed that a user's consent to disclosure could be implied in view of, among other things, providers' available published policies. (House Rep., supra, at p. 66.) Providers' posted policies and answers to frequently asked questions (FAQs), described below, are readily available, and they appear to shed light on the issues presented in this litigation. Although we will highlight and quote some of these available policies and FAQs, we emphasize that in doing so we do not preclude any party from advancing any additional point or argument — including the legal significance that should or should not be accorded such policies and FAQs.
The policies and FAQs warn registered users that a communication configured as public will generally become, in the words of the House Report, supra, at page 62, "readily accessible to the general public," and available to any person via the Internet, whether that person is registered with the social media provider, or not.
Providers' FAQs warn that even communications configured as restricted still might be shared by an authorized recipient with anyone else.
Providers contend that to the extent section 2702(b)(3)'s lawful consent exception applies to any of the communications at issue here, that provision simply authorizes them to comply with the subpoenas, but does not by itself compel them to comply with the subpoenas. They further assert that section 2702(b) affords providers who are authorized to disclose, the "discretion" to refuse to do so — even in the face of an otherwise proper subpoena lawfully issued under state law. We agree with the first proposition, but not with the second.
As explained below, a California Court of Appeal decision, Negro v. Superior Court (2014) 230 Cal.App.4th 879 [179 Cal.Rptr.3d 215] (Negro), has thoroughly considered and rejected providers' argument. In that litigation, the plaintiff sued multiple defendants concerning business transactions. Prior to trial, the plaintiff subpoenaed defendant Negro's e-mail service provider, Google, seeking e-mail communications between him, his codefendants, and others. Defendant Negro eventually expressly consented to disclosure by Google of e-mails between himself and specific persons and entities covering a defined range of dates. But despite its user's express consent, Google refused to comply with the civil subpoena. On review, the Court of Appeal considered and applied section 2702(b)(3)'s lawful consent exception, ultimately finding that the defendant had given his express and enforceable
As an initial matter, the court in Negro, supra, 230 Cal.App.4th 879, rejected the claim that the SCA confers "a blanket exemption or immunity on service providers against compulsory civil discovery process." (Negro, at p. 899.) The court acknowledged that the SCA does not, on its face, contain any exception for or mention of civil (or for that matter criminal) discovery subpoenas. But the court explained that the Act's failure to expressly include such subpoenas does not "suggest that it rendered" the normal state law "discovery process impotent in all circumstances." (Negro, at p. 899.)
Turning to the same argument reprised by providers here, the court in Negro addressed Google's assertion "that the language of the Act makes the consent exception `permissive' and the provider's disclosure under it `voluntary'... so that `Google may not be compelled by an order issued in a civil proceeding to disclose content, even with the user's consent.'" (Negro, supra, 230 Cal.App.4th at p. 900.) The appellate court observed that Google relied on section 2702(b)'s "use of the word `may' to frame the exception for disclosure based on a user's consent," and on the passage quoted above from the federal magistrate's order in In re Facebook, Inc., supra, 923 F.Supp.2d at page 1206. (Negro, at p. 900.) The court determined that the magistrate's reasoning "places much more weight on a very small word than it is designed to bear. It is certainly true that `may' generally conveys permission, and that when used in contradistinction to `shall' it implies a discretionary power or privilege, as distinguished from a mandatory duty. [Citations.]" (Id., at p. 901.) But, the court reasoned, "The subdivision where `may' appears is framed not as a grant of discretionary power or as the imposition of a
The appellate court in Negro continued: "Another federal magistrate judge has observed that `there should be a clear expression of congressional intent before relevant information essential to the fair resolution of a lawsuit will be deemed absolutely and categorically exempt from discovery and not subject to the powers of the court under [rules governing disclosure].' [Citation.] Congress's use of the word `may' to frame an exception to the Act's general prohibition on disclosure is not such a `clear expression of ... intent' as will justify a reading of the Act that categorically immunizes service providers against compulsory civil process where the disclosure sought is excepted on other grounds from the protections afforded by the Act." (Negro, supra, 230 Cal.App.4th at p. 902.)
Finally, the appellate court concluded: "In sum, we find no sound basis for the proposition that the Act empowers service providers to defy civil subpoenas seeking discovery of materials that are excepted from the Act's prohibitions on disclosure. Insofar as the Act permits a given disclosure, it permits a court to compel that disclosure under state law." (Negro, supra, 230 Cal.App.4th at p. 904.) Accordingly, the court held that in light of the fact that the user/defendant had consented to disclosure by the service provider, "the Act does not prevent enforcement of a subpoena seeking materials in conformity with the consent given." (Ibid.)
Providers do not directly address the logic or substance of the Negro court's analysis quoted above. Instead, they assert, first, that the appellate court's decision is distinguishable because the underlying lawful consent in that case was express, whereas the present case concerns implied consent. This attempt to avoid Negro's analysis ignores the legislative history described ante, part II.C., disclosing that Congress specifically contemplated that implied lawful consent would satisfy the lawful consent exception. It also is in tension with providers' own concession that implied lawful consent is effective with regard to communications configured by a registered user to be public. (See ante, pt. III.A.)
Alternatively, providers suggest that the SCA should be interpreted to bar the enforcement of any state subpoena that directs service providers to divulge public communications that the Act permits but does not require them to disclose. They assert that Negro's contrary analysis and conclusion must be
Having addressed the legal issues that can be decided on the present record, we turn to other matters raised in providers' briefs that cannot be resolved at this stage — and some of which must await exploration on remand.
As observed earlier, the subpoenas in this case broadly seek "[a]ny and all public and private content." Providers in their supplemental briefs assert variously that "much" or "most" (or all except a "small subset") of the communications sought by the subpoenas were configured by the users to be private or restricted, not public, and hence the lawful consent exception generally will not assist defendants in this case. Because the parties did not acknowledge the relevance and applicability of the lawful consent exception in the trial court, no reliable record was made concerning either registered
As noted, providers concede that they may, pursuant to the lawful consent exception set forth in 2702(b)(3), disclose a post configured by the user to be public. They maintain, however, that the fact a user may have initially configured a post for public distribution should not necessarily resolve the question of the applicability of the lawful consent exception. Specifically, providers observe that a communication originally configured to be public subsequently can be reconfigured by the user to be restricted, can be deleted by the user, or the user can close the account.
Defendants, by contrast, insist that once a registered social media user configures a communication as public and posts it, triggering section 2702(b)(3)'s lawful consent exception and presumptively allowing disclosure by a provider, the user cannot subsequently revoke that implied consent to disclosure, even if the user promptly reconfigures any post as restricted or deletes the post or closes the account. In support, defendants assert that "any reasonable user knows once you make information publicly available on social media it will be `... broadly and instantly disseminate[d]' ... `to a wide range of users, customers, and services, including search engines, developers, and publishers ...' just as Twitter advises in its terms of service."
Providers may be understood to invoke Congress's intent to protect users' privacy (as described ante, pt. II.A.), and to suggest that their proposed interpretation — under which a provider would be required to honor a user's reconfiguration or deletion so long as it was undertaken by the time a subpoena is issued — would afford greater protection to that privacy interest.
Providers assert that in light of a registered user's ability to reconfigure communications, "providers may not easily be able to determine the intended audience of a communication at any given point in time" and "it may be difficult for a provider to accurately identify" whether a given communication when posted was public or restricted. Likewise, speaking on providers' behalf, amicus curiae Google avers: "Providers do not routinely maintain records of past privacy settings for each post or message. Lacking such records, it would be impossible to determine the privacy configuration that applied when a communication was posted or sent." (Italics added.) Providers also assert that "if a user changes the privacy setting for a communication, a service may not be able to accurately determine prior privacy settings." In addition, providers assert it would be difficult for them to retrieve deleted communications. As noted by the trial court, however, a subpoena recipient has a general obligation to undertake reasonable efforts to locate responsive materials. Again, any technical difficulties a given provider may face in determining the relevant history of a particular communication, or retrieving any deleted communication, are matters to be explored at the anticipated hearing on remand.
Providers similarly urge that they should be protected from excessive burdens. As observed ante, part II.A., Congress articulated its main purposes in enacting the SCA: affording privacy protections to users while accommodating the legitimate needs of law enforcement. It also articulated a tertiary goal: to avoid discouraging the use and development of new technologies. Providers' briefs characterize this additional purpose as one of "enhanc[ing] the use of communications services and protect[ing] providers from being embroiled as a nonparty in litigation." Amicus curiae on providers' behalf, Google, characterizes this additional purpose even more specifically as "protecting providers from an otherwise limitless burden of responding to requests to disclose their users' communications." Providers rely on dictum in
Of course, any third party or entity — including a social media provider — may defend against a criminal subpoena by establishing that, for example, the proponents can obtain the same information by other means, or that the burden on the third party is not justified under the circumstances. (City of Alhambra v. Superior Court (1988) 205 Cal.App.3d 1118, 1134 [252 Cal.Rptr. 789]; cf. Kling v. Superior Court (2010) 50 Cal.4th 1068, 1074-1075, 1078 [116 Cal.Rptr.3d 217, 239 P.3d 670].) Indeed, the Act itself specifically contemplates that providers may raise such issues in the context of compelled disclosure to a governmental entity under section 2703(d) (a court "may quash or modify such order, if the information or records requested are unusually voluminous in nature or compliance with such order otherwise would cause an undue burden on such provider"), and the same principles would apply in the present setting.
As noted, providers advanced similar arguments regarding the burden of compliance with the subpoenas in the earlier trial court proceeding. (Ante,
We vacate the Court of Appeal's decision and direct that court to remand the matter to the trial court for proceedings consistent with this opinion.
Chin, J., Corrigan, J., Liu, J., Cuéllar, J., Kruger, J., and Yegan, J.,
The court described the evolution of the SCA, extensively quoted sections 2701, 2702 and 2703, and briefly discussed some of the cases cited above, including Crispin. (Johnson, supra, 538 S.W.3d at pp. 63-69.) The appellate court next focused solely on section 2703, which as noted earlier concerns a governmental entity's authority to compel disclosure from providers. (Johnson, at pp. 69-70.) The court observed that the underlying defendants did not qualify as governmental entities — and from there jumped to the broad conclusion that the defendants "could not obtain" pursuant to their subpoenas "any information directly from the social media providers under the terms of the SCA." (Id., at p. 70, italics added.) In proceeding as it did, the Johnson court's dictum failed to consider the legislative history outlined above, the scope of section 2702's disclosure bar, or the lawful consent exception to that bar. As a result, the court failed to consider whether any of the sought social media communications had been configured by the users to be public, and thus were disclosable by the providers pursuant to the defense subpoenas.
In support of their argument that a trial court does not qualify as a person or entity under the statute, amici curiae simply cite Marbury v. Madison (1803) 5 U.S. 137 [2 S.Ct. 60]. They argue that Congress must be presumed to have been aware of "existing law" (including Pen. Code, § 1326's in camera review procedures) as well as the Fifth and Sixth Amendment rights of defendants — and hence, they postulate, Congress must have contemplated that such an exception for in camera and ex parte review by a trial court would be "read into the Act" by the courts, "when and if," as here, "the need arises." Amici curiae add that "Congress ... knows that the courts are the forum where controversies such as the one here will be resolved and that the courts will determine their own procedures" — including amici curiae's contemplated compelled compliance with in camera review by the trial court. Finally, amici curiae assert that to the extent the Act "is interpreted to prohibit [in camera] judicial assessment of the exculpatory significance of the subpoenaed records," the SCA, as applied in this case, violates defendants' Fifth and Sixth Amendment rights, and hence is unconstitutional. Putting aside the constitutional claim, neither the statutory language nor its legislative history supports amici curiae's claim that the statute can reasonably be interpreted to permit disclosure of all electronic communications, private or public, to a court under all circumstances.
In addition, the three largest search engines — Google, Bing, and Yahoo! — also display in their results a link to a cached version of the social media user's page. (See, e.g., Google, Search Help, View webpages cached in Google Search Results <https://support.google.com/ websearch/answer/1687222?hl=en> [as of May 22, 2018].) Google explains that "[c]ached links show you what a web page looked like the last time Google visited it" and that "Google takes a snapshot of each web page as a backup in case the current page isn't available.... If you click on a link that says `Cached,' you'll see the version of the site that Google stored." (Ibid.)
Accordingly, when a user configures a post to be available to only specifically listed persons, the provider will be able to honor that user's choice only within the service — by disabling those recipients from, in turn, sharing that communication with others within the system through the system's sharing tools. Moreover, all three providers warn users that such configuration protection within each system does not prevent any authorized recipient from employing mechanisms outside the system to copy any post (by, for example, downloading or creating a screenshot) and then sharing the communication with anyone on the Internet. (See, e.g., Twitter, About public and protected Tweets/Who can see my Tweets? <https:// support.twitter.com/articles/14016> [as of May 22, 2018] ["Keep in mind that when you choose to share content on Twitter with others, this content may be downloaded or shared"].) Indeed, as Twitter advises, even when a user protects communications by restricting them to specific persons, that user's communications might nevertheless be shared by any such person with anyone else. (Twitter Help Center, Twitter Privacy Policy/Information Collection and Use/Direct Messages and Non-Public Communications <https://twitter.com/privacy?lang=en> [as of May 22, 2018] ["When you use features like Direct Messages to communicate privately, please remember that recipients may copy, store, and re-share the contents of your communications"]; see also Facebook, Data Policy/How is this information shared?/Sharing our Services/People you share and communicate with <https://www.facebook.com/policy.php> [as of May 22, 2018] ["people you share and communicate with may download or re-share this content with others on and off our Services"]; Instagram, Privacy Policy/3. Sharing of your information/Parties with whom you may choose to share your User Content <https://help.instagram.com/155833707900388> [as of May 22, 2018] ["Once you have shared User Content or made it public, that User Content may be re-shared by others.... [¶] If you remove information that you posted to the Service, copies may remain viewable in cached and archived pages of the Service, or if other Users or third parties using the Instagram API [application programming interface] have copied or saved that information."].)
Nor are we aware of any prior case involving a user who has placed minimal restrictions on a communication within a large social media service (as another hypothetical example, a user who might disseminate a communication to all two billion Facebook users except for one or two people). Although we hold that limiting a communication to a "large group" does not render a post public, and acknowledge that on remand the trial court might find that the public configurations at issue in this case render the resulting communications public under the SCA, we also observe that neither the hypothetical discussed at oral argument nor this additional hypothetical involving minimal restrictions is presented in this case. Therefore, we need not and do not resolve whether such communications would be sufficiently public to imply consent to disclosure under section 2702(b)(3).
From what we can glean from the record, it appears that Renesha Lee may not have changed the default on one of her Twitter accounts and made her tweets and/or any replies private. (See ante, pt. I.D. and related discussion.) The record does not address the configuration of Renesha Lee's Facebook communications. Finally, regarding Instagram, the record suggests that Renesha may have configured one Instagram account to be private. In addition, the record suggests that she may have had, and deleted, multiple additional accounts with some or all of the social media providers. The configurations of these additional accounts are unknown. (See ante, fn. 5.) Regarding victim Rice, the limited record suggests that he had accounts, perhaps multiple, and of unknown configuration, with Facebook and Instagram — and that some if not all of those accounts (including at least one relied upon by the prosecution's gang expert) have been closed. (Ibid.)
Finally, yet another matter, not discussed in the parties' briefs, may require consideration on remand. As alluded to ante, part I.F., after the trial court confirmed its production ruling, counsel for defendant Sullivan asked that providers be ordered to preserve all data at issue in this case. The court stated that it would not immediately issue an oral preservation order because it wanted the parties to first work out among themselves language addressing providers' preservation obligations, and stated: "You will have to draft something and submit it, and see if you can reach an agreement. And if you get competing orders, we will have to have another hearing about that." The record before us, however, contains no preservation order; no mention of such an order appears in the briefs; and the superior court docket for each case, as to which we have taken judicial notice, reflects no such order. (See, e.g., Williams v. Russ (2008) 167 Cal.App.4th 1215, 1223 [84 Cal.Rptr.3d 813] [addressing a party's "failure to preserve evidence for another's use in pending or future litigation" and corresponding sanctions].)