IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER PURSUANT TO 18 U.S.C. § 2705(b)
Misc. Action No. 17-2490 (BAH)
UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
January 30, 2018
UNDER SEAL
MEMORANDUM OPINION
In Oсtober 2017, the government sought an order, pursuant to
Whether an entity is an ECS or RCS provider, and regulated as such by the SCA, carries significant consequences: the SCA’s statutory scheme bestows upon covеred entities greater responsibilities regarding the disclosure and safeguarding of their customers’ electronic information, and each violation of that Act risks civil, criminal, and administrative penalties. See
I. BACKGROUND
The procedural history of this matter is summarized briefly below, followed by a description of Airbnb’s electronic communication services as relevant to the application at issue.
The government filed its first application for an order, under
The government filed a second application on October 4, 2017, again requesting an order under
On December 4, 2017, the government filed an amended application for a
B. Background Concerning Airbnb
Airbnb, a corporation based in San Francisco, California, provides an internet-based
To use this service, all Airbnb users—whether customers or hosts—must create individualized, verified personal accounts. Id.; see also How Do I Create an Account?, AIRBNB, https://www.airbnb.com/help/article/221/how-do-i-create-an-account (last visited January 26, 2018); What Are the Requirements to Book on Airbnb?, AIRBNB, https://www.airbnb.com/help/article/1170/what-are-the-requirements-to-book-on-airbnb (last visited January 26, 2018). A central component of each user’s account is the “smart messaging system,” which enables “hosts and guests [to] communicate with certainty.” How It Works, AIRBNB, https://www.airbnb.com/help/getting-started/how-it-works (last visited January 26, 2018); Why Should I Pay and Communicate through Airbnb Directly?, AIRBNB, https://www.airbnb.com/help/article/209/why-should-i-pay-and-communicate-through-airbnb-directly (last visited January 26, 2018). Customers seeking to reserve accommodations from particular hosts use this messaging system to send electronic messages directly to hosts to ask questions about the hosts or their accommodations and, eventually, to book rеservations. See How Do I Contact a Host before Booking a Reservation?, AIRBNB, https://www.airbnb.com/help/article/147/how-do-i-contact-a-host-before-booking-a-reservation (last visited January 26, 2018); How Do I Submit a Reservation Request?, AIRBNB, https://www.airbnb.com/help/article/85/how-do-i-submit-a-reservation-request (last visited January 26, 2018). After using this system to initiate reservations and contact prospective hosts, Airbnb customers may provide their personal contact information to the hosts and communicate directly over the phone or via email, as they prefer. Obj. at 4 & n.1; see also How Do I View and Send Messages?, AIRBNB, https://www.airbnb.com/help/article/145/how-do-i-view-and-send-messages (last visited January 26, 2018). Importantly, these messages are sent from user to user, rather than from users to Airbnb itself. See How Do I View and Send Messages?, supra. Airbnb’s website explains to users that “[p]aying or communicating outside of Airbnb also makes it harder for us to protect your information and puts you at greater risk of fraud and other security issues, such as phishing.” Why Should I Pay and Communicate through Airbnb Directly?, supra.
Airbnb’s website also describes how the company responds to law-enforcement requests for user information. See How Does Airbnb Respond to Data Requests from Law Enforcement?, AIRBNB, https://www.airbnb.com/help/article/960/how-does-airbnb-respond-to-data-requests-from-law-enforcement#RequestsfromUS (last visited January 26, 2018). Specifically, the company lists the following requirements for “non-emergency information requests from US law enforcement”: (1) “A valid trial, grand jury or administrative subpoena is required to compel the disclosure of basic subscriber records (defined in
Please note that Airbnb, Inc. has a policy of using commercially reasonable efforts to notify users in the United States when we receive legal process from a third party requesting user data. Generally, except where a court order (and not just the request for information itself) requires delayed notification or no notification, or except where notification is otherwise prohibited by law or where we, in our sole discretion, believe that providing notice would be futile, ineffective or would create a risk of injury or bodily harm to an individual or group, or to our property, we will endeavor to provide reasonable prior notice to the relevant user of the request for user data in the event the user wishes to seek appropriate protective relief.
Id. Consistent with these statements, “counsеl for Airbnb represented to the government that Airbnb considered itself a provider of an electronic communication service and/or a remote computing service (‘RCS’) under the SCA” and “further represented that, if served with a nondisclosure order under
II. STANDARD OF REVIEW
Magistrate judge orders issued under the SCA in unassigned criminal matters are subject to de novo review. See In re Search of Information Associated with [redacted]@gmail.com That Is Stored at Premises Controlled by Google, Inc. (“Google”), No. 16-mj-757, 2017 WL 3445634, at *3 n.3 (D.D.C. July 31, 2017). Specifically, under
III. DISCUSSION
To address whether Airbnb is a provider of “electronic communication services” or “remote computing services,” as defined in the SCA, the applicable statutory framework is first reviewed, followed by analysis showing, consistent with the government’s objection, that Airbnb is an ECS provider for the purposes of the government’s amended application.
Congress enacted the SCA in 1986 as part of the Electronic Communications Privacy Act (“ECPA”), Pub. L. No. 99–508, 100 Stat. 1848 (1986).1 The SCA regulates how stored wire and
electronic communications may lawfully be accessed or disclosed and imposes on covered entities certain obligations regarding the disclosure and safeguarding of customer and subscriber information. For example, an entity that provides “an electronic communication service to the public” may not “knowingly divulge to any person or entity the contents оf a communication” that the entity maintains in “electronic storage” on behalf of its customers.
The SCA’s
A grand jury subpoena seeking records under
The central question, then, is whether Airbnb is a provider of ECS or RCS such that it is covered by the SCA generally and, in particular, by
With technological advances since the enactment of ECPA and the SCA, the difference between ECS and RCS has eroded because “most network service providers are multifunctional” and “can act as providers of ECS in some contexts, providers of RCS in other contexts, and as neither in some contexts as well.” Kerr, User’s Guide, 72 GEO. WASH. L. REV. at 1215; see also In re United States, 665 F. Supp. 2d 1210, 1214 (D. Or. 2009) (“Today, most ISPs provide both ECS and RCS; thus, the distinction serves to define the service that is being provided at a particular time (or as to a particular piece of electronic communication at a particular time), rather thаn to define the service provider itself.”). Thus, distinguishing between ECS and RCS has been described as a “context sensitive” exercise that focuses on “the provider’s role with respect to a particular copy of a particular communication, rather than the provider’s status in the abstract.” Kerr, User’s Guide, 72 GEO. WASH. L. REV. at 1215 & n.48.
In this case, whether Airbnb is an ECS or RCS provider does not need to be belabored
B. Airbnb Is an ECS Provider for the Purposes of This Application
Airbnb’s electronic messaging system provides users with the ability to send and receive electronic communications to each other, not just to Airbnb itself, thus making the company a provider of ECS for the purposes of the government’s amended application and grand jury subpoena. Moreover, Airbnb is an ECS provider despite its provision of other services that are not ECS or RCS and regardless of whether its primary business function is the provision of ECS.
1. Airbnb’s Messaging System Provides Users with the Ability to Send and Receive Electronic Communications
The grand jury subpoena at issue seeks “[a]ll customer or subscriber account information for any and all accounts associated with” a particular e-mail address, including the same types of information listed in
Airbnb’s messaging system allows customers and hosts to send and receive electronic messages to each other regarding potential accommodations, including questions about and images of available properties. See How Do I Contact a Host before Booking a Reservation?, supra; How Do I View and Send Messages?, supra. Such messages, which involve transfers of “writing,” and often “images,” “in whole or in part by a wire, radio, electromagnetic, photoelectric or photooptical system that affects interstate or foreign commerce,” are “electronic communications” under the SCA.
Notably, this determination focuses on Airbnb’s provision of a user-to-user messaging service, rather than a service that merely allows users to contact or interact with the company electronically. Several courts have concluded that providing only the latter type of service does not make a company an ECS provider under the SCA, because in that situation, the company is using rather than providing ECS. See, e.g., In re Jetblue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299, 307 (E.D.N.Y. 2005) (concluding that a company “does not become an [ECS] provider simply because it maintains a website that allows for the transmission of electronic communications between itself and its customers”); Crowley v. CyberSource Corp., 166 F. Supp. 2d 1263, 1270 (N.D. Cal. 2001) (finding that an online merchant with a website allowing customers to send electronic communications only to the merchant, rather than to other customers, did not provide an ECS); see also Keithly v. Intelius Inc., 764 F. Supp. 2d 1257, 1271–72 (W.D. Wash. 2011) (holding that an online information service from which customers could purchase employee background checks was not an ECS provider because it merely “use[d] elеctronic communications to conduct its business on the internet” and did not “provide the wire or electronic communication services utilized by its customers”); Dyer v. Nw. Airlines Corps., 334 F. Supp. 2d 1196, 1199 (D.N.D. 2004) (concluding that ECS “does not encompass businesses selling traditional products or services online”); Andersen Consulting LLP v. UOP, 991 F. Supp. 1041, 1043 (N.D. Ill. 1998) (concluding that a company that purchased internet access from an ECS provider did not independently provide internet services to the public for the purposes of
2. Airbnb Is an ECS Provider Regardless of Its Primary Business Function
The fact that Airbnb provides an ECS, and that the government seeks records pertaining to that ECS, is enough to warrant granting the government’s application. The provision of such services does not need to be Airbnb’s primary business function in order for the ECS portion of its business to be covered by the SCA. Indeed, “[t]he language chosen by Congress [in defining ECS] captures any service that stands as a conduit fоr the transmission of wire or electronic communications from one user to another” and makes no reference to whether the service at issue is a primary business function or is merely ancillary to support a business function. Council on Am.-Islamic Relations Action Network, Inc. v. Gaubatz, 793 F. Supp. 2d 311, 334 (D.D.C. 2011) (internal quotation marks and citation omitted) (emphasis added); see also S. REP. NO. 99-541 at 14, reprinted in 1986 U.S.C.C.A.N. at 3568 (“Existing telephone companies and electronic mail companies are providers of electronic communication services. Other services like remote computing services may also provide electronic communication services.”). Rather, the statutory definitions of ECS and RCS are functional and context sensitive: “the key is the provider’s role with respect to a particular copy of a particular communication, rather than the provider’s status in the abstract.” Kerr, User’s Guide, 72 GEO. WASH. L. REV. at
Thus, as numerous courts have held, an entity that provides ECS or RCS as only one part of its business is still covered by the SCA. See, e.g., Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 114–15 (3d Cir. 2003) (concluding that an insurance company that provided an e-mail service to its employees was an ECS provider); United States v. Mullins, 992 F.2d 1472, 1478 (9th Cir. 1993) (concluding that a travel agency that provided its travel agents with computer terminals running an electronic travel reservation system was an ECS provider); Becker v. Toca, No. 07-7202, 2008 WL 4443050, at *4 (E.D. La. Sept. 26, 2008) (concluding that “an online business or retailer may be considered an [ECS] provider if the business has a website that offers сustomers the ability to send messages or communications to third parties”); Bohach v. City of Reno, 932 F. Supp. 1232, 1236 (D. Nev. 1996) (concluding that a city whose police department provided computers, software, and pagers to its personnel was an ECS provider); see also Kaufman v. Nest Seekers, LLC, No. 05-6782, 2006 WL 2807177, at *6 (S.D.N.Y. 2006) (“An on-line business which provides its customers, as part of its commercial offerings, the means by which the customers may engage in private electronic communications with third-parties may constitute a facility through which electronic communication service is provided.”). A company also does not have to provide an ECS to the public to fall under the SCA; it is enough that the company provides an ECS to its own customers. See Council on Am.-Islamic Relations Action Network, 793 F. Supp. 2d at 334 (“Congress drafted Section 2701(a) broadly, and providing an electronic communication service to the public is not part of the statutory inquiry.”) (internal quotation marks and citation omitted). Accordingly, for the purposes of this matter and the corresponding grand jury subpoena, Airbnb provides an ECS—namely, an electronic, user-to-user messaging system—and therefore falls within the auspices of
3. Airbnb Holds Itself Out to Its Customers As an ECS Provider
Finally, the fact that Airbnb views its own services as ECS or RCS is instructive. As already discussed, Airbnb hоlds itself out to its customers as an entity that is regulated by the SCA. See How Does Airbnb Respond to Data Requests from Law Enforcement?, supra; Obj. at 5. In doing so, Airbnb emphasizes to its current and potential customers that their information is subject to the heightened privacy protections of the SCA and assures them that Airbnb abides by the strictures of that law in handling electronic information. While this declaration does not, by operation of law, make Airbnb an ECS provider, that a company concedes being subject to a statutory regime and its attendant penalties is telling.
IV. CONCLUSION
For the reasons stated abоve, the government’s objection is sustained, the Magistrate Judge’s Order dated December 22, 2017, is reversed, and the government’s amended application for an order pursuant to
Date: January 29, 2018
BERYL A. HOWELL
Chief Judge