The Securities and Exchange Commission (SEC) thinks it and other federal agencies should be allowed to compel third party providers of web-based email and other cloud services to disclose personal communications without a warrant. And just to rub salt in the privacy wound, the SEC wants to attach this new power to the widely praised and much needed Electronic Communications Privacy Act (ECPA) Amendments Act (S.607).
First, some background. S. 607, which was introduced by Senators Leahy and Lee and approved by the Judiciary Committee in April, would make it clear that government agencies must obtain a warrant if they want third party service providers to disclose content stored on behalf of their customers. Most large providers, including Google, Microsoft, and Facebook, already require warrants when the government seeks disclosure of communications content because a 2010 Sixth Circuit case, U.S. v. Warshak, found that the Fourth Amendment protects content even if stored with a third party provider. The SEC chair, however, has requested an exception from the warrant requirement.
Currently, to obtain information, the SEC serves a subpoena on the target of an investigation compelling the target to provide relevant materials. The target must then provide all documents that are relevant and non-privileged, whether they are stored in a filing cabinet, on an internal network, or in the cloud. The SEC uses many mechanisms to ensure that targets disclose relevant documents. It can, for example, enforce its subpoena in court against a recalcitrant or shady target.