In October 2017, the government sought an order, pursuant to
Whether an entity is an ECS or RCS provider, and regulated as such by the SCA, carries significant consequences: the SCA's statutory scheme bestows upon covered entities greater responsibilities regarding the disclosure and safeguarding of their customers' electronic information, and each violation of that Act risks civil, criminal, and administrative penalties. See
I. BACKGROUND
The procedural history of this matter is summarized briefly below, followed by a description of Airbnb's electronic communication services as relevant to the application at issue.
*204A. Procedural History
The government filed its first application for an order, under
The government filed a second application on October 4, 2017, again requesting an order under § 2705(b) precluding Airbnb from disclosing the existence of another grand jury subpoena and again asserting that Airbnb is a provider of ECS or RCS, as defined by the SCA. App. ¶¶ 4-6. Like the August application, the second application expressly noted that the government's investigation had revealed reason to believe that specific Airbnb user accounts were being used to facilitate violations of federal law.
On December 4, 2017, the government filed an amended application for a § 2705(b) order. See Amended App. at 1. Like the original application, the amended application sought "the same basic subscriber information from Airbnb as the August 2017 subpoena, but it requested that information for a different time period."
B. Background Concerning Airbnb
Airbnb, a corporation based in San Francisco, California, provides an internet-based *205service through a website and a smartphone application that allows property owners to rent accommodations, including their personal homes, to people seeking accommodations. Obj. at 3. The company describes itself as "a trusted community marketplace for people to list, discover, and book unique accommodations around the world-online or from a mobile phone or tablet." About Us , AIRBNB , https://www.airbnb.com/about/about-us (last visited January 26, 2018). Property owners use the website and the application to advertise their properties for rent with user-provided photographs and descriptions. Obj. at 3. Prospective customers may use the service to find properties, research properties through user reviews and communications with prospective hosts, and rent properties on short-term or long-term bases.
To use this service, all Airbnb users-whether customers or hosts-must create individualized, verified personal accounts.
Airbnb's website also describes how the company responds to law-enforcement requests for user information. See How Does Airbnb Respond to Data Requests from Law Enforcement? , AIRBNB , https://www.airbnb.com/help/article/960/how-does-airbnb-respond-to-data-requests-from-law-enforcement#RequestsfromUS (last visited January 26, 2018). Specifically, the company lists the following requirements for "non-emergency information requests from US law enforcement": (1) "A valid trial, grand jury or administrative subpoena is required to compel the disclosure of basic subscriber records (defined in
Please note that Airbnb, Inc. has a policy of using commercially reasonable efforts to notify users in the United States when we receive legal process from a third party requesting user data. Generally, except where a court order (and not just the request for information itself) requires delayed notification or no notification, or except where notification is otherwise prohibited by law or where we, in our sole discretion, believe that providing notice would be futile, ineffective or would create a risk of injury or bodily harm to an individual or group, or to our property, we will endeavor to provide reasonable prior notice to the relevant user of the request for user data in the event the user wishes to seek appropriate protective relief.
II. STANDARD OF REVIEW
Magistrate judge orders issued under the SCA in unassigned criminal matters are subject to de novo review. See In re Search of Information Associated with [redacted]@gmail.com That Is Stored at Premises Controlled by Google, Inc. ("Google "), No. 16-mj-757,
III. DISCUSSION
To address whether Airbnb is a provider of "electronic communication services" or "remote computing services," as defined in the SCA, the applicable statutory framework is first reviewed, followed by analysis showing, consistent with the government's objection, that Airbnb is an ECS provider for the purposes of the government's amended application.
*207A. Statutory Framework
Congress enacted the SCA in 1986 as part of the Electronic Communications Privacy Act ("ECPA"), Pub. L. No. 99-508,
The SCA's § 2703 permits the government, in specified circumstances, to compel ECS and RCS providers to disclose customer records or information, as well as the contents of their customers' stored electronic communications. This provision's framework provides a sliding scale of protections, such that the legal mechanism law enforcement utilizes and the showing required depend on the kind of information sought. In other words, "[t]he rules for compelled disclosure operate like an upside-down pyramid.... The higher up the pyramid you go, the more information the government can obtain." Orin S. Kerr, A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It ("User's Guide "), 72 GEO. WASH. L. REV. 1208, 1222 (2004).
A grand jury subpoena seeking records under § 2703(c)(2) may be used at the "lowest threshold" of the pyramid, see
*208Moreover, the government is not required to notify a customer that such information pertaining to the customer has been obtained.
The central question, then, is whether Airbnb is a provider of ECS or RCS such that it is covered by the SCA generally and, in particular, by §§ 2703 and 2705. The SCA defines ECS as "any service which provides to users thereof the ability to send or receive wire or electronic communications,"
With technological advances since the enactment of ECPA and the SCA, the difference between ECS and RCS has eroded because "most network service providers are multifunctional" and "can act as providers of ECS in some contexts, providers of RCS in other contexts, and as neither in some contexts as well." Kerr, User's Guide , 72 GEO. WASH. L. REV. at 1215 ; see also In re United States ,
In this case, whether Airbnb is an ECS or RCS provider does not need to be belabored *209because Airbnb holds itself out to the public as an entity covered by § 2703 of the SCA and assures its customers that they are entitled to the SCA's heightened privacy protections. See How Does Airbnb Respond to Data Requests from Law Enforcement?, supra ("A valid trial, grand jury or administrative subpoena is required to compel the disclosure of basic subscriber records (defined in
B. Airbnb Is an ECS Provider for the Purposes of This Application
Airbnb's electronic messaging system provides users with the ability to send and receive electronic communications to each other, not just to Airbnb itself, thus making the company a provider of ECS for the purposes of the government's amended application and grand jury subpoena. Moreover, Airbnb is an ECS provider despite its provision of other services that are not ECS or RCS and regardless of whether its primary business function is the provision of ECS.
1. Airbnb's Messaging System Provides Users with the Ability to Send and Receive Electronic Communications
The grand jury subpoena at issue seeks "[a]ll customer or subscriber account information for any and all accounts associated with" a particular e-mail address, including the same types of information listed in § 2703(c)(2). Notice of Filing, Attach. A, Grand Jury Subpoena ("Subpoena") at 9, ECF No. 7; see also Obj. at 13 (noting that the subpoena seeks "records relating to a user of Airbnb's ECS (i.e. , Airbnb's electronic messaging service)," namely, "the basic subscriber information described in
Airbnb's messaging system allows customers and hosts to send and receive electronic messages to each other regarding potential accommodations, including questions about and images of available properties. See How Do I Contact a Host before Booking a Reservation? , supra ; How Do I View and Send Messages?, supra . Such messages, which involve transfers of "writing," and often "images," "in whole or in part by a wire, radio, electromagnetic, photoelectric or photooptical system that affects interstate or foreign commerce," are "electronic communications" under the SCA.
Notably, this determination focuses on Airbnb's provision of a user-to-user messaging service, rather than a service that merely allows users to contact or interact with the company electronically. Several courts have concluded that providing only the latter type of service does not make a company an ECS provider under the SCA, because in that situation, the company is using rather than providing ECS. See, e.g., In re Jetblue Airways Corp. Privacy Litig. ,
2. Airbnb Is an ECS Provider Regardless of Its Primary Business Function
The fact that Airbnb provides an ECS, and that the government seeks records pertaining to that ECS, is enough to warrant granting the government's application. The provision of such services does not need to be Airbnb's primary business function in order for the ECS portion of its business to be covered by the SCA. Indeed, "[t]he language chosen by Congress [in defining ECS] captures any service that stands as a conduit for the transmission of wire or electronic communications from one user to another" and makes no reference to whether the service at issue is a primary business function or is merely ancillary to support a business function. Council on Am.-Islamic Relations Action Network, Inc. v. Gaubatz ,
Thus, as numerous courts have held, an entity that provides ECS or RCS as only one part of its business is still covered by the SCA. See, e.g., Fraser v. Nationwide Mut. Ins. Co. ,
3. Airbnb Holds Itself Out to Its Customers As an ECS Provider
Finally, the fact that Airbnb views its own services as ECS or RCS is instructive. As already discussed, Airbnb holds itself out to its customers as an entity that is regulated by the SCA. See How Does Airbnb Respond to Data Requests from Law Enforcement?, supra ; Obj. at 5. In doing so, Airbnb emphasizes to its current and potential customers that their information is subject to the heightened privacy protections of the SCA and assures them that Airbnb abides by the strictures of that law in handling electronic information. While this declaration does not, by operation of law, make Airbnb an ECS provider, that a company concedes being subject to a statutory regime and its attendant penalties is telling.
IV. CONCLUSION
For the reasons stated above, the government's objection is sustained, the Magistrate Judge's Order dated December 22, 2017, is reversed, and the government's amended application for an order pursuant to
Notes
ECPA comprises three titles: Title I, codified in chapter 119 of Title 18, at