Thread by @OrinKerr

Provider-deleted files and contents are not protected by the Stored Comm's Act, DDC rules per MJ Faruqui. In effect, if a provider moderates contents, all private messages and e-mails deleted can be freely disclosed and are no longer private.

Thread.
context-cdn.washingtonpost.com/notes/prod/def… #N

First, some context. Back in 2018, Facebook deleted a bunch of accounts run by the Myanmar government because it was spreading disinformation on Facebook. Later, the Gambian government sued the Myanmar government in the International Court of Justice.

The Gambian govt is trying to get the contents of the accounts that Facebook deleted to show Myanmar's disinformation campaign. It is using a federal statute that allows discovery from the US to aid in foreign litigation to get it. (context: akingump.com/a/web/106630/a…)

Facebook has objected to the disclosure. FB is trying to protect the privacy of its accounts, as directed under the Stored Comm's Act: 18 U.S.C. 2702, the non-disclosure rule, says that contents of accounts usually can't be disclosed. FB is saying the non-disclosure applies.

In the new decision, MJ Faruqui concludes that the non-disclosure rule protecting account privacy doesn't apply. The reasoning goes like this.

1) The SCA provides protections for messages in transit, and backups of those messages, as well as for storage and processing.

2) After a provider has decided to delete an account, the provider is no longer providing those services. The provider may keep copies of what it has deleted, but it's no longer keeping the copies for purposes associated with the statute.

Therefore all privacy protections end.

This strikes me as a fairly astonishing interpretation of the statute. As a matter of law, it seems wrong: I don't think SCA's protections hinge on the provider's motive, with a provider creating or eliminating statutory protection based on its reason for storage of a file copy.

Also, it's a stunning interpretation in its consequences. Under the op, the most fundamental rule of Internet privacy -- that your e-mails and messages are protected from disclosure -- is largely meaningless. A provider can just delete your account and hand out your messages.

I was particularly disappointed in how Judge Faruqui responds to Facebook when it raised the policy consequences. His first reaction was to mock Facebook for trying to protect privacy.

That's embarrassing. 1st, Facebook is an enormous company. The privacy teams that respond to legal process have nothing to do with parts in the news stories. And 2nd, FB's correct argument is not just about FB: It's about every e-mail and private message held in the US.

Second, Faruqui's claim that this is really a small issue seems plainly wrong. Under his op, any Internet provider can just delete a file and disclose it to anyone. And if they want to keep stuff private, they can't moderate the content. That's big.

I might write later about some of the nerdier aspects of the ruling, and in particular the ECS/RCS distinction (which FB may have botched in its brief, not helping its case), but I'll stick with that for now.

cc: @alexstamos @Riana_Crypto @MJZwills @20002ist

One more thought. In FN11, Judge Faruqui argues that this doesn't expand law enforcement power because the govt still needs a warrant under the 4th Amendment. But it's not at all that simple, for two reasons.

First, the government does not need a warrant if the provider is disclosing voluntarily, without govt prompting. In that case the provider is a private actor, so there's no warrant requirement. See US v. Adkinson, 916 F.3d 605, 610 (7th Cir. 2019) (per curiam).

Second, the same reasoning would apply to non-content records not protected by the 4th. The govt could ask for account records of deleted accounts w/o a 2703(d) order, or any cause at all. Maybe even ask for acct to be deleted 1st, to avoid the court order requirement.

(Oh, and yes, I realize it's a little uncomfy criticizing an opinion that cited me. And I do appreciate the cites! :) But I gather it's not helpful to respond to an opinion differently based on that.)

One more big issue. Much of the court's holding is unnecessary. The great majority of what the Gambian govt wants are public posts, that the court separately holds can be disclosed under the consent exception.

That's following a holding of the Cal SCT from a few years ago. I tend to see that result as right but the analysis as weak: I think public postings shouldn't be covered by the SCA b/c they're outside the ECS/RCS framework, not b/c there is consent to disclosure.

But either way, it means that most of the court's holding eliminating privacy protections for deleted accounts isn't needed: The users consented to disclosure of most of what the Gambian govt wants anyway. (The Gambian govt does get private messages from the accounts, tho.)

I just now read the conclusion of the opinion. It reads as a sort of assessment of Facebook's corporate morality and place in the world. In an opinion about the SCA coming from a magistrate judge, that is, I think, out of place.

As an aside, is there some political context to this opinion that created the impression that FB's interpretation of the SCA was some sort of cynical corporate policy to serve FB's interests or hide FB's wrongdoing? I think any provider would have taken that interpretation.

I assume this is it: Human rights activists really want to see what happened, and at least some of them interpret FB's invoking 2702's nondisclosure rule as some sort of bogus claim FB cooked up to try to block investigations into genocide. fortifyrights.org/mya-inv-oped-2…

So from that perspective, this is seen as a narrative of FB aiding genocide, and a judge speaking truth to power by making Facebook follow the law and share the contents of the accounts. (I guess that's how it's seen in those circles, at least.)