We generally receive three types of information requests from law enforcement and government agencies: subpoenas, court orders, and search warrants.
We only provide content information and user communications to law enforcement/government agencies pursuant to a search warrant. See United States v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010). Unless prohibited by law or court order, our policy is to notify users prior to compliance with legal process to give them a fair opportunity to challenge the request. We review each information request received, and may choose to lodge our own challenge to the scope or validity on behalf of the user, whether or not the user pursues his/her own legal challenge.
A subpoena is a formal request for information that is not issued or reviewed by a judge, and may be used in a criminal or civil case. Subpoenas are generally issued by government agencies, government attorneys, or grand juries and may require us to produce account data such as username, email address, IP address, name, physical address, and payment records, if we have the information.
A court order is issued by a judge and may be used in a criminal or civil case. Court orders may be issued under a variety of US (and international) laws, such as Section 2703(d) of the Electronic Communications Privacy Act. A government agency/law enforcement officer generally has to show that there are reasonable grounds to obtain the evidence, which is a higher standard than is required for a subpoena.
Pen Register Orders/PRTT Requests
A pen register order is a type of court order that was traditionally related to collecting telephone information, but the USA Patriot Act expanded the orders to cover internet communications. With this type of court order, the government agency/law enforcement officer can obtain IP address information by showing that the information obtained will be relevant to an ongoing criminal investigation. Unlike other types of legal process, a pen register order allows the government agency/law enforcement officer to seek information on a going-forward basis.
Wiretap Orders/Title III Requests
We might also receive wiretap orders, which seek information on the contents of future communications, as they happen. Wiretap orders are difficult to obtain, as the government agency/law enforcement officer must prove to the court that there is probable cause that a crime is being committed using the account named in the order and that the wiretap will collect information relating to that crime. Further, the court has to find that other, less invasive methods of obtaining information have failed or would be excessively dangerous. The laws governing wiretap orders require them to be limited in time and also require notice of the wiretap to the user affected within a certain period of time.
A search warrant is only used in a criminal case and must be signed by a judge. The Fourth Amendment requires law enforcement officers to show probable cause that the evidence requested is related to a crime, which is a higher standard than is required for a subpoena. The warrant must also specifically describe the location and type of information to be seized. We require a search warrant before producing content information and/or user communications to government agencies/law enforcement.
We occasionally receive emergency requests from government agencies/law enforcement officers. Under the Electronic Communications Privacy Act, we may disclose information without a subpoena, court order, or search warrant if we believe that there is an immediate threat of death or serious physical injury. We are not required to disclose information without legal process, so when we receive emergency requests, we review it and ask the government agency/law enforcement officer why the normal legal process will not work. If we do provide information, we limit it to what we believe might prevent the imminent harm described. Further, we ask the government agency/law enforcement officer to obtain a subpoena, court order, or search warrant following the emergency request for cases in which information is provided.
It is our policy to notify users and provide them with a copy of any legal requests regarding their account or site, unless we are prohibited from doing so by a valid court order issued in the US. Our policy of notifying users about requests to preserve their information is meant to protect user privacy and promote transparency, while also avoiding interference with legitimate investigations of criminal activity. Preservation requests may only be submitted by government and law enforcement agencies conducting a criminal investigation in which the information sought is relevant. We will preserve records for 90 days in response to a valid request, which the government or law enforcement agency can extend upon request.