Four Requests, One Morning: Cassio's SCA Triage
Cassio is a U.S. cloud-storage provider. Its trust-and-safety team receives four items on the same morning from a federal agent: (1) an administrative subpoena under 18 U.S.C. §2703(c)(2) demanding 'all subscriber records and all stored files' for account [email protected]; (2) a §2703(d) order, supported by 'specific and articulable facts,' authorizing 30 days of prospective cell-site and GPS data from Cassio's mobile app; (3) a §2703(f) preservation letter covering the same account; and (4) an email asking Cassio to 'just confirm whether the account exists' so the agent can decide whether to seek a warrant. Cassio's legal team has five business days. The account holder is a U.S. citizen with no notice of any of this, and Cassio's terms of service promise to notify users of legal requests unless legally barred.
1. Which items can Cassio comply with, in whole or in part, and which must it push back on?
Read the worked answer
(1) Subpoena - partial compliance. §2703(c)(2) lets a subpoena compel subscriber records: name, address, account creation date, session times, IP logs, and means of payment. 'All stored files' is content, which requires a warrant under §2703(a) (or §2703(b) prior notice, or an exigency). Cassio should produce the records and refuse the content, citing United States v. Warshak and the practical reality that most courts now demand a warrant for stored content regardless of the 180-day text.
(2) §2703(d) order. Valid for stored records on 'specific and articulable facts.' Prospective precise GPS from an app is closer to Carpenter v. United States than to a pen register; the better practice is to require a warrant for prospective precise location and to seek clarification or narrow the order rather than silently comply.
(3) Preservation. Mandatory - preserve for 90 days, renewable for another 90. Preservation is not disclosure.
(4) Existence confirmation. An informal email is not legal process; disclosing even account existence is a permissive-disclosure question under §2702. Require a subpoena.
2. Can Cassio notify the account holder? What is its obligation under its own terms of service?
Read the worked answer
Notice is the default unless a statute or court order bars it. A §2703(b) subpoena path contemplates prior notice to the subscriber; a §2703(d) order likewise permits notice unless the court issues a §2705(b) preclusion order. A §2703(f) preservation letter carries no notice obligation at all - it is silent, not secret, but notifying is not required.
Because no §2705(b) order has been served, Cassio's ToS promise is triggered: it should notify the account holder that legal process has been received, describing its scope without disclosing investigative detail, and state an intention to comply on a set date.
If a §2705(b) order later appears, examine it: since the 2017 DOJ policy, nondisclosure orders should be time-limited and narrow, and a permanent or indefinite gag is vulnerable to challenge. Cassio should preserve its objection rather than treat the order as unappealable, and should document each step - the government may seek to compel, and a clean record of good-faith triage is the best defense.