In re U.S. for an Order Pursuant to 18 U.S.C. 2705(B)

Citation: 289 F. Supp. 3d 201Docket: Misc. Action No. 17–2490 (BAH)

Court: Court of Appeals for the D.C. Circuit; January 28, 2018; Federal Appellate Court

SummaryOriginalCytator Case TreatmentBackward CitatorAnalysis

EnglishEspañolSimplified EnglishEspañol Fácil

In October 2017, the government requested a nondisclosure order under 18 U.S.C. § 2705(b) of the Stored Communications Act (SCA) to prevent Airbnb, Inc. from revealing the existence of a grand jury subpoena for at least one year. An initial application was summarily granted, but a subsequent amended application was denied by a Magistrate Judge, who determined that Airbnb was a "user" rather than a "provider" of electronic communication services (ECS) under the SCA. The government filed an Ex Parte Objection to this denial, arguing that Airbnb qualifies as a provider due to its electronic messaging system.

The court acknowledged that whether an entity is classified as an ECS or remote computing service (RCS) provider has significant implications, including greater responsibilities for safeguarding customer information and potential penalties for violations. The court ultimately found that Airbnb is an ECS provider for the purposes of the government's applications, thus reversing the Magistrate Judge's order and granting the government's application. The procedural history details that the government had previously filed two applications for similar nondisclosure orders, the first of which was granted, allowing Airbnb to produce records in response to a subpoena, while the second application was denied based on the provider/user classification issue.

On December 4, 2017, the government submitted an amended application for a 2705(b) order, seeking subscriber information from Airbnb for a different time frame than the original August 2017 subpoena. This amended application included additional arguments asserting that Airbnb qualifies as a provider of an electronic communication service (ECS) under the Stored Communications Act (SCA). The government argued that Airbnb's messaging system enables direct communication between users (guests and hosts), thereby satisfying the definition of an ECS provider as it allows users to send and receive electronic communications. Despite these assertions, the amended application was denied on December 22, 2017, mirroring the reasons for the denial of the original application. The government has since objected to this denial.

Airbnb, headquartered in San Francisco, offers an online platform through its website and mobile app, allowing property owners to rent out accommodations. Users must create verified personal accounts to access the service, which includes a "smart messaging system" facilitating direct communication between hosts and guests. This system allows users to send electronic messages to one another without involving Airbnb directly, although users may later share personal contact details for further communication.

Airbnb informs users that payments or communications outside its platform increase the risk of fraud and security issues. The company outlines its protocol for responding to law enforcement requests for user data, requiring a valid subpoena for basic subscriber records, a court order for certain account records, and a search warrant for communication content. Airbnb aims to notify users of such requests unless legally prohibited or if notifying could pose risks to individuals or property. The company identifies itself as a provider of electronic communication and remote computing services under the Stored Communications Act (SCA) and indicates it would not contest relevant legal orders. 

In terms of legal procedure, magistrate judge orders under the SCA for unassigned criminal matters are subject to de novo review. This is based on 28 U.S.C. § 636(b)(3), which allows magistrates to perform additional duties not inconsistent with U.S. laws. Since the matter was not referred by a district court judge, the magistrate's order falls under these additional duties, as outlined in Local Criminal Rules, allowing for the issuance of search warrants and subpoenas. Consequently, the order can be reviewed anew by the district court.

Airbnb is evaluated under the Stored Communications Act (SCA) to determine if it qualifies as a provider of 'electronic communication services' (ECS) or 'remote computing services' (RCS). The SCA, enacted in 1986 as part of the Electronic Communications Privacy Act, regulates access to and disclosure of stored wire and electronic communications, imposing strict obligations on entities regarding customer information. Specifically, ECS providers cannot knowingly disclose the contents of communications held in electronic storage. Violations can lead to severe penalties, including damages, imprisonment, and administrative actions.

The SCA permits government entities to compel ECS and RCS providers to disclose customer records and stored communications under certain conditions, utilizing a tiered framework of legal protections. The initial threshold for disclosure requires only a grand jury subpoena for basic subscriber information, such as names, addresses, and service records, without needing to show probable cause or notify the customer. This framework emphasizes the varying levels of protection based on the type of information sought, with minimal requirements for basic information compared to more sensitive data.

The government can prohibit the recipient of a grand jury subpoena from notifying the customer by obtaining a court order under 18 U.S.C. § 2705(b) for nondisclosure. To secure this order, the government must demonstrate that notifying the subscriber could result in one of several adverse outcomes: endangerment to an individual’s life or safety, flight from prosecution, evidence tampering, witness intimidation, or significant jeopardization of an investigation or trial delay. A key issue is whether Airbnb qualifies as a provider of electronic communication services (ECS) or remote computing services (RCS) under the Stored Communications Act (SCA). ECS is defined as any service allowing users to send or receive wire or electronic communications, typically associated with telephone and email services. Electronic communication encompasses any transfer of data transmitted via wire or radio systems affecting interstate or foreign commerce. RCS refers to public computer storage or processing services via an electronic communications system. The definitions of "electronic communications system" and "electronic storage" further clarify these terms, with electronic storage including temporary storage incidental to transmission and backup protection. Advances in technology have blurred the lines between ECS and RCS, as many network service providers offer both services. Thus, distinguishing between ECS and RCS has become a context-sensitive task, focusing on the provider's role concerning specific communications rather than their overall classification.

Airbnb asserts it qualifies as an electronic communication service (ECS) provider under the Stored Communications Act (SCA), specifically section 2703, which grants heightened privacy protections. To disclose basic subscriber records, a valid subpoena is necessary. Airbnb has indicated to the government that it considers itself an ECS provider and would not contest the applicability of related statutes if served with appropriate legal orders.

Airbnb's electronic messaging system enables users to send and receive communications among themselves, affirming its status as an ECS for the purposes of a grand jury subpoena seeking customer account information linked to a specific email address. This system facilitates user interactions regarding accommodations through messages that include text and images, constituting "electronic communications" under the SCA.

The court recognizes that services enabling user communication typically meet the definitions of ECS providers, as they allow for the exchange of electronic communications. Thus, Airbnb's user-to-user messaging service qualifies as providing the ability to send and receive wire or electronic communications, underscoring its classification as an ECS provider focused on user interactions rather than just communications with the company itself.

Several court rulings have established that simply offering a service that allows for the transmission of electronic communications does not qualify a company as an Electronic Communications Service (ECS) provider under the Stored Communications Act (SCA). For example, in *In re Jetblue Airways Corp. Privacy Litig.*, the court determined that a company does not become an ECS provider merely by maintaining a website for communication with customers. Similarly, *Crowley v. CyberSource Corp.* found that an online merchant did not provide ECS because it only facilitated communications directed to itself and not to other customers. In *Keithly v. Intelius Inc.*, the court ruled that a service selling background checks was not an ECS provider, as it merely utilized electronic communications for business rather than providing them. Other cases, like *Dyer v. Nw. Airlines Corps.* and *Andersen Consulting LLP v. UOP*, reinforced that businesses primarily selling products or services online, or purchasing internet access from an ECS provider, do not independently provide ECS.

In contrast, Airbnb qualifies as an ECS provider due to its electronic messaging system, which allows users to send and receive communications among themselves. The classification as an ECS provider does not hinge on whether this function is Airbnb's primary business. Congressional definitions of ECS encompass any service that acts as a conduit for electronic communications, irrespective of its primary business function. Courts have consistently held that an entity providing ECS as a part of its operations falls under the SCA, as highlighted in cases like *Fraser v. Nationwide Mut. Ins. Co.* and *United States v. Mullins*, where companies that offered electronic communication tools as ancillary services were still deemed ECS providers.

In Becker v. Toca, the court determined that an online business can be classified as an electronic communication service (ECS) provider if it allows customers to send messages to third parties through its website. This interpretation was supported by additional cases, indicating that entities providing private electronic communication to users, even if not publicly accessible, fall under the Stored Communications Act (SCA). The court emphasized that Section 2701(a) of the SCA does not limit ECS provision to public offerings. Airbnb was identified as an ECS provider due to its user-to-user messaging system, which subjects it to the SCA's privacy protections. The court noted that Airbnb presents itself as compliant with the SCA, suggesting a recognition of its obligations under the law, despite this self-identification not legally confirming its status as an ECS provider.

Consequently, the government’s objection to a prior ruling was upheld, reversing the Magistrate Judge's order and granting the government’s amended request under 18 U.S.C. 2705(b). The government was instructed to review the case records by February 2, 2018, to determine which entries may be unsealed while ensuring protection of ongoing investigations. The Electronic Communications Privacy Act (ECPA) is outlined as comprising three titles, with Title II specifically addressing the SCA relevant to this case.