How Your Private Emails Can Be Used Against You in Court

A cybersecurity scholar argues that the power to subpoena information that consumers have stored in the cloud is overly broad

Who has copies of your emails? You do, of course, as do all the people you sent them to. But so does Google or Yahoo or whichever cloud email service you use. And emails are just the beginning: more and more of our communications and transactions are happening online and stored by someone for some amount of time.

In this new world, the rules that govern grand jury subpoenas may have troubling implications, argues Joshua Gruenspecht, a cybersecurity expert at the Center for Democracy and Technology, in the spring issue of the Harvard Journal of Law & Technology.

Grand jury subpoenas are used to collect evidence. Unlike warrants, subpoenas can be issued with less than probable cause. The reasoning for the lower bar is in part that if someone does not want to turn over the requested evidence, he or she can contest the subpoena in court. Grand juries can subpoena not only the person who created a document but any third parties who might be in possession of that document. Under the Stored Communications Act, a grand jury can subpoena certain types of data from third parties whose only role is storing that data.

Gruenspecht argues that this reflects outdated notions of the role of third parties. When these laws developed, it was reasonable to believe that any third party with access to someone's data would have a stake in that data and a relationship with the person who created it. The opportunity to contest a subpoena was therefore assumed to be genuine. But when a company that merely stores the data is subpoenaed, it may have no reason to protest and just fork over the information.

In the old days of storing information in filing cabinets, subpoena power was constrained because people didn't save everything and investigators had to know where to look to find incriminating evidence. Today, Gruenspecht writes, "mass digital storage ... has significantly increased the chances that records of any given document exist and is increasingly unifying the locations in which those records can be found."

Google, law-abiding corporate citizen that it is, says, "As stated in our Terms of Service and Privacy Policy, Google complies with valid legal processes seeking account information, such as search warrants, court orders, or subpoenas." Google promises to notify its users when their information is subpoenaed, but doing the legal minimum might make any cloud company less than the ideal consumer advocate.

Image: opensourceway/Flickr.