New Jersey Supreme Court: If Cops Are Going To Digitally Wiretap A Facebook Account, They Need A Wiretap Order

Gathering evidence has never been easier than it is now. So much is created so easily and so often. And there are so many access points for law enforcement.

Sure, a few outliers (and outright liars [cough] Chris Wray [cough]) may claim everything is going dark," but never before in history have there been this many communication options facilitated by this many services. And most of those communications can be accessed without much difficulty, despite the occasional encryption roadblock.

Law enforcement entities are definitely taking advantage of the opportunities created by always-on(line) existences so many of us lead. But they often forget they still have an obligation to respect constitutional protections put in place years before so many of their investigative targets turned their lives into open books.

And that brings us to this case recently decided by the top court in New Jersey. Investigators in that state decided to use a very creative definition of the word stored" to a constitutional fight. And they've lost. (h/t FourthAmendment.com)

In this criminal case, investigators served Facebook with a standard Communications Data Warrant (CDW). In other words, it was a regular search warrant authorizing a search of Facebook's stored data for information related to suspected criminal activity.

But what the warrant demanded was far from the norm for search warrants. It didn't ask Facebook to hand over whatever it already had. Instead, it demanded Facebook ride shotgun on the targeted account and turn over any new content created by the user every 15 minutes for the next 30 days.

My friends, that is not a search. That is a wiretap. And a regular warrant cannot possibly justify this sort of ongoing, near-real time intrusion. That's the ruling [PDF] of the state's top court, which overturns the appellate court's inexplicable decision to pretend content retrieved every 15 minutes (which is as fast as Facebook can produce them) have somehow been stored" long enough to lower constitutional protections against government eavesdropping. It did limit this sort of search" to a ten-day window, but otherwise decided that future communications were also stored" communications during this time frame.

The government made the same pitch to the state Supreme Court. It said 15-minute intervals were the same thing as stored," that nothing in any statutory text said otherwise, and - on top of all that - claimed being limited to ten-days of eavesdropping using a regular warrant was where the appellate court actually went wrong.

Facebook - and a ton of amici - disagree:

Facebook argues that neither federal nor state statutory law authorizes the use of a search warrant to compel disclosure of the contents of prospective communications. Facebook instead maintains that the challenged searches are governed by the enhanced privacy protections of the wiretap acts.

Facebook also contends that the Appellate Division's decision contravenes the Federal and State Constitutions, which bar multiple intrusions based on a single warrant. Facebook argues as well that the CDWs are not anticipatory warrants and cannot be justified under the reasonable continuation doctrine.

[...]

Amici all support Facebook's position. The ACLU emphasizes that data surveillance" today is far more invasive" than wiretaps of old." As a result, the ACLU urges the Court to apply wiretap-like protections, as does the NJSBA [New Jersey State Bar Association].

Microsoft and Google represent that no other jurisdiction has sought ongoing, prospective surveillance of electronic communications based on a warrant. The companies state that when law enforcement agencies outside of New Jersey have made similar requests, they have presented wiretap orders.

After a detailed discussion of both federal (Stored Communications Act) and state laws, including wiretap provisions built into both sets of electronic surveillance laws, the court puts in plain English the state's desired outcome: the elimination of wiretap warrants (along with their safeguards and restrictions) entirely so long as the communications being targeted occur online.

Imagine instead an attempt by law enforcement to gain broad access to future electronic communications, including private messages, within 15 minutes, the earliest possible moment they are available, for 30 days - the very situation this case presents. A strict contemporaneity rule adopted before the advent of the Internet would not be a good fit to address that or other situations technology presents today. Nor would such a rule be consistent with the underlying purpose of the wiretap statutes - to protect individual privacy.

In addition, from a practical standpoint, if a strict contemporaneity approach applied, law enforcement today would never need to apply for a wiretap order to obtain future electronic communications from Facebook users' accounts on an ongoing basis. With either a wiretap order or a CDW, the State today cannot receive information from Facebook any sooner than 15 minutes after a communication has been transmitted. In light of that reality, it would be only natural for law enforcement to apply for a CDW [Communications Data Warrant], which is easier to obtain but has fewer safeguards for individual privacy.

The State's argument raises yet other, similar concerns. In time, as technology improves, today's unavoidable 15-minute delay may well get shorter and shorter. The logical extension of the State's position is that law enforcement could avoid the requirements and protections of the wiretap acts by simply asking Facebook to wait a few minutes, while data is stored, before providing electronic communications on an ongoing, future basis. That cannot be right given the underlying aim of the statutes.

The state's arguments all fail. The intrusion the state wants the court to bless with a ruling in its favor is even more intrusive than normal wiretaps, in which irrelevant or privileged conversations cannot be legally captured or listened to by investigators. The state Supreme Court isn't having it.

[N]early contemporaneous access to a wide array of prospective electronic communications, every 15 minutes for a full month into the future, is highly intrusive.

There are no limits to the content the State seeks here. In addition to public posts by Facebook users, the proposed orders encompass private communications of all sorts, including any messages to one's spouse, cleric, doctor, or lawyer. Yet the CDW orders have no minimization requirements.

In essence, the State seeks the functional equivalent of a wiretap - but without the added safeguards the wiretap acts require.

Nope. Wrong. Not going to happen.

As a result, we find that a warrant based on probable cause is not enough to monitor prospective electronic communications in nearly real time, on an ongoing basis, under the constitution. The principles set forth in Berger and its progeny require the State to make a heightened showing and adhere to the additional safeguards provided in the wiretap acts. Our conclusion is grounded in the privacy protections the State Constitution guarantees.

Down goes the warrant. Up goes the precedent. And none of this should have come as a surprise to law enforcement. If you want to eavesdrop, you need more than a regular warrant. That it's Facebook, rather than phone companies, being targeted doesn't change the underlying constitutional equation. The state tried to pull a fast one and Facebook called it out on its bullshit. And everyone in New Jersey is better protected thanks to its refusal to comply with an obviously unlawful order.