The Stored Communications Act (SCA) permits the government to obtain certain records and information from providers of electronic communications services or remote computing services relating to their customers or subscribers. Under the SCA, the government may compel the disclosure of different categories of information via subpoena, a court order under 18 U.S.C. § 2703(d), or a search warrant. The SCA does not by default forbid a provider from notifying anyone. Providers will be prohibited from voluntarily notifying their users of the receipt of legal process under the SCA only if the government obtains a protective order under 18 U.S.C. § 2705(b), based on a demonstrated need for protection from disclosure.

Each § 2705(b) order should be supported by an appropriate factual basis, and each order should extend only as long as necessary to satisfy the government’s interest. Prosecutors who are applying for § 2705(b) orders must follow the steps outlined below:

1. 1. Prosecutors must conduct an individualized, meaningful, and case-specific assessment regarding the need for protection from disclosure prior to seeking a § 2705(b) order and only seek an order when circumstances require.
2. 2. In applying for a § 2705(b) order, prosecutors should tailor the application to include the available facts of the specific case and/or concerns attendant to the particular type of investigation. The prosecutor should identify which of the factors set forth in § 2705(b)(1)–(5) apply and explain why. For example, prosecutors might choose to include information about the relationship of the data sought to the subject(s) of the investigation or describe the potential for related accounts or data to be destroyed or otherwise made inaccessible to investigators. Similarly, prosecutors may identify concerns attendant to the risk of flight or harm to public safety in that particular investigation, including such concerns based on experience with similar types of investigations. The factors justifying protection from disclosure may be similar in many cases, particularly at the outset of an investigation. As appropriate, prosecutors may state the extent to which the stage of the investigation limits the availability of case-specific facts justifying the § 2705(b) order.
   When applying for an initial § 2705(b) order to accompany a subpoena seeking basic subscriber information in an ongoing investigation that is not public or known to the subject(s) of the investigation, stating more general reasons for protection from disclosure under § 2705(b)—such as the risk that subject(s) will flee, destroy or tamper with evidence, change patterns of behavior, or notify confederates—frequently will suffice. At a later stage of the investigation, for example, when a search warrant is being sought, the prosecutor should include more specific facts, as available, in support of the protective order.
   If a § 2705(b) order would delay notice to a Member of Congress, Congressional Office, or a Congressional Staffer, as defined in JM 9-85.110, or a Member of the News Media, as defined in JM 9-13.400, the prosecutor must disclose such information in the application.
3. 3. Prosecutors may seek a single protective order that covers multiple grand jury subpoenas issued as part of the same investigation, or a single protective order that covers other sets of nearly identical legal process in a discrete investigation. A single protective order for multiple items of process should be sought only if the facts justifying protection from disclosure are the same for all items of process covered by the order. Prosecutors should ensure that a copy of the protective order is served with each item of process covered by the order.
4. 4. Barring exceptional circumstances, prosecutors filing § 2705(b) applications may only seek to delay notice for one year or less.
5. 5. If factors justifying protection from disclosure continue to exist at the expiration of the original order, subsequent extensions of equal or shorter duration may be sought. Requests should be supported with such additional, specific facts as may have been developed through the investigation, and prosecutors should not assume that a prior need for a protective order means a subsequent order is necessary. Applications for protective orders must be approved in writing by a supervisor designated by the United States Attorney or the appropriate Assistant Attorney General whenever the application is for a second or successive period of non-disclosure, such that the total period of the protective order exceeds 18 months. The litigating component making the application shall maintain a record of such approval. Supervisory approval for a successive protective order is not necessary if one or more target(s) of the investigation is located outside the United States and/or is a current fugitive.
6. 6. Applications for additional protective orders must also be approved in writing by a supervisor designated by the United States Attorney or the appropriate Assistant Attorney General whenever it appears reasonably likely that the target(s) of the investigation already knows of the investigation’s existence. The litigating component making the application shall maintain a record of such approval.
7. 7. When closing an investigation or matter, a prosecutor must immediately assess whether there is a basis to maintain any outstanding protective orders issued pursuant to § 2705(b). If the prosecutor concludes that there is no such basis, the office must terminate the protective order and ensure the service provider is notified of any such termination (and, if necessary, notify and/or seek approval from the appropriate court before doing so). If the prosecutor believes there is a compelling reason to maintain a protective order, the prosecutor must seek approval from a supervisor designated by the United States Attorney or the appropriate Assistant Attorney General to allow the protective order to remain in effect. If the prosecutor has reason to believe that there is another Department prosecutor investigating the same individual or criminal conduct, he or she should coordinate with the other prosecutor(s) as applicable when deciding whether to terminate any outstanding protective order. Early termination of protective orders is not required for accounts that prosecutors believe were solely used as part of criminal infrastructure.
8. 8. All sections and offices must establish a protocol by which they routinely review the need for § 2705(b) orders in an ongoing investigation or case as part of an office’s regular case review. All sections and offices must also establish a protocol by which an investigation’s or case’s outstanding § 2705(b) orders are reviewed as part of a case closing procedure.
9. 9. There may be “exceptional circumstances” in which § 2705(b) orders of longer duration are necessary, such as in certain national security investigations with a significant foreign nexus, where the investigation significantly differs from routine criminal investigations. Prosecutors must notify the Department’s Criminal Division or National Security Division when they seek a § 2705(b) protective order of greater than one year due to “exceptional circumstances.” Supervisors in the section or office seeking such orders should conduct a review at least annually of such orders in order to confirm that any such unexpired orders remain necessary, move to lift any unexpired orders that are no longer necessary, and notify the Criminal Division or National Security Division of the results of that review, as warranted.
10. 10. The Department recognizes that judges may direct shorter or longer periods for orders, consistent with the language of § 2705(b).

This policy does not impact or alter existing procedures governing protective orders pursuant to any other authority, including 18 U.S.C. § 2709(c) or the Termination Procedures for National Security Letter Nondisclosure Requirement, Federal Bureau of Investigation (Nov. 24, 2015). Questions related to the interpretation or recommended implementation of this guidance should be directed to the Computer Crime and Intellectual Property Section of the Criminal Division or the National Security Cyber Section of the National Security Division.

[updated September 2024]