Opinion
Misc. Action No. 17-2682 (BAH)
03-08-2018
IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER PURSUANT TO 18 U.S.C. § 2703(D)
MEMORANDUM OPINION
In October 2017, the government sought an order, pursuant to 18 U.S.C. § 2703(d) of the Stored Communications Act ("SCA"), 18 U.S.C. §§ 2701 et seq., to compel Royal Caribbean Cruises, Ltd. ("RCCL") "an internet service provider based in Miami, Florida, to disclose subscriber and transactional records in relation to" money transfers executed via the internet at specific times on three consecutive days using a specific Internet Protocol ("IP") address. Amended Application of the U.S. for Order Pursuant to 18 U.S.C. § 2703(d) ("Amend. App.") at 1, 7, ECF No. 1. A Magistrate Judge denied the application on the ground that the government had failed to show that RCCL is either a "provider of electronic communication service" ("ECS") or a "provider of remote computing service" ("RCS") subject to a disclosure order under § 2703(d). See Mag. J.'s Order Denying Amend. App. ("Mag. J. Order") at 2-3, ECF No. 2. Pending before the Court is the government's objection to the Magistrate Judge's denial. See Gov't's Obj. Mag. J. Order ("Gov't's Obj."), ECF No. 3. Following a hearing and supplemental submissions from RCCL and the government, the Court concludes, as RCCL concedes, that for purposes of the government's application, objection, and proposed § 2703(d) order, RCCL is an ECS provider under the SCA. Thus, the government's objection is sustained, the Magistrate Judge's order is reversed, and the application is granted.
I. BACKGROUND
The procedural history of this matter is summarized briefly below, followed by a description of RCCL's electronic communication service as relevant to the application at issue.
A. Procedural History
On July 25, 2017, the government filed an application, in Miscellaneous No. 17-1756, for a § 2703(d) order to compel RCCL to disclose subscriber and transactional records related to money transfers made, using a particular IP address ("Target IP Address"), by persons suspected of defrauding approximately three hundred victims. See Amend. App. at 2-3, 7. A Magistrate Judge stayed the government's application on July 31, 2017, pending supplementation of the application with additional information, including, as relevant here, any authority supporting the government's assertion that RCCL is a provider of ECS or RCS within § 2703's meaning. Id. at 3. The government withdrew the application on August 22, 2017, and, nearly two months later, filed an amended application in the captioned Miscellaneous docket that addressed the Magistrate Judge's inquiry. Id. Over a month later, on November 29, 2017, the Magistrate Judge denied the amended application on the ground that the government's argument, if accepted, would subject to § 2703(d) "every entity which now offers free WiFi," a conclusion the Magistrate Judge could not square "with the intent of Congress in enacting the [SCA]." Mag. J. Order at 2-3.
The government sought this order, pursuant to § 2703(d) and 18 U.S.C. § 3512(a), and the Council of Europe, Convention on Cybercrime, opened for signature Nov. 23, 2001(entered into force for the United States Jan. 1, 2007), T.I.A.S. No. 13174, C.E.T.S. 185, S. TREATY DOC. NO. 108-11 (2003), to "help authorities in Slovakia identify the individual or individuals who are responsible for" a fraud scheme that occurred in 2015 "and/or determine the nature and scope of the individual's or individuals' activities." Amend. App. at 1, 7-8. The alleged scheme involved one or more individuals acting on behalf of Fantravel, LLC offering package holidays abroad via a website. Id. at 7. Upon a customer's purchase of a package holiday, Fantravel and the customer would enter into a contractual agreement whereby the customer would pay Fantravel in advance to arrange the package holiday. Id. Fantravel allegedly failed to comply with its contractual obligation to arrange or facilitate the holiday package, however. Id. Rather, during the period December 15 through 17, 2015, funds paid by at least 300 individual victims—totaling €314,449—were transferred to Fantravel and another company's bank accounts via the internet, using the Target IP Address maintained and assigned by RCCL. Id. The government requested, on November 10, 2016, that RCCL preserve for 90 days "all stored communications, records, and other evidence in [RCCL's] possession regarding" the Target IP Address over specified time periods. Decl. of Terry Griffith, Director, Incident Mgmt., RCCL ¶ 10, ECF No. 11; id., Ex. B, Preservation Request, ECF No. 11-1.
The Magistrate Judge unsealed her Memorandum Order denying the application on the same day of issuance. Minute Order, dated Dec. 12, 2017.
The government promptly objected. See Gov't's Obj. Following a hearing held the next day, the government submitted additional information in response to this Court's inquiries, including that "RCCL is not prepared to take, and does not take, a position on the legal issue—whether they constitute an 'electronic communications service' or 'remote computing service' for purposes of this request"—but that "[i]f requested by the Court, RCCL will research and brief whether or not it has a position on the issue." Gov't's Notice of Filing In Resp. to Court's Order, at 2, ECF No. 4. Following a second hearing, RCCL was afforded the opportunity to address "(1) the configuration of its on-board internet systems and (2) whether RCCL is a provider of 'electronic communications services' or 'remote computing services' for purposes of the government's Objection." Minute Order, dated Jan. 12, 2018. RCCL made its submission on March 1, 2018. RCCL's Resp., ECF No. 10.
B. Background Concerning Royal Caribbean
RCCL, an American cruise company based in Miami, Florida, Amend. App. at 1, controls several Liberia-based entities that own cruise ships operating under the Royal Caribbean International, Celebrity Cruises, and Azamara Club Cruises brands, Decl. of Terry Griffith, Director, Incident Mgmt., RCCL ("RCCL Decl.") ¶ 3, ECF No. 11. To connect cruise ships to the internet, RCCL contracts with an Internet Service Provider ("ISP"), which owns and operates an antenna on each cruise ship "used for satellite connectivity to and from the ISP's shoreside network—the infrastructure owned and managed by the ISP that allows the ISP's customers to access the Internet." Id. ¶ 4. To enable the flow of internet communications between cruise ships and the internet, the ISP assigns each cruise ship's antenna a temporarily exclusive IP address from among the public IP addresses that have been allocated to that ISP by the appropriate regional internet registry. Id. ¶ 5. All communications between the cruise ship and the internet transmitted through the antenna use that public IP address. Id.
Each RCCL cruise ship also has an internal communication network ("Ship Network") to which onboard devices, such as personal mobile devices and laptops, may connect and through which such devices may access the internet through the ISP's antenna. Id. ¶ 6. Each Ship Network is typically subdivided into four Internal Networks that can be used to connect to the internet and a fifth Internal Network that generally does not connect to the internet. Id. The four internet-connected Internal Networks typically are (1) an encrypted network for RCCL employees' business use, (2) an encrypted network for vendors, known as "VendorNet," (3) an unencrypted network for guests and for crew members' personal use, and (4) an encrypted Unlicensed Mobile Access network for cellular telephone communications over the internet. Id. RCCL passengers, vendors, and crew members can connect wireless-enabled devices they have brought onboard with them to the applicable internal network. Id. RCCL typically contracts with a company that provides hardware and software to enable passengers to connect to the internet using Wi-Fi access points that are part of the Ship Network. Id. ¶ 7.
When a wireless-enabled device connects to one of the four internet-connected Internal Networks, a Dynamic Host Configuration Protocol ("DHCP") server for that network automatically assigns that device a non-routable "private" IP address, which is unknown outside the Ship Network. Id. ¶ 8. RCCL has contracted with a company called Xcontrol to provide and operate the DHCP server that automatically assigns private IP addresses on the Internal Network that passengers and crew use for personal use on RCCL ships operating under the Celebrity Cruises brand. Id. Each private IP address transmits communications only between a user's device and the Ship Network, not directly between the user's device and the internet. Id. Only the Ship Network—using the public IP address associated with the antenna—transmits communications through the antenna to the internet. Id. During all relevant periods, the Target IP Address was the public IP address assigned to the antenna installed onboard the RCCL ship at issue. Id. ¶ 11. That IP address was assigned to the ship's antenna by an ISP called Harris CapRock Communications ("HCCL"), with which RCCL had contracted to provide internet satellite connectivity to the ship. Id. HCCL used the Target IP Address for internet connectivity between the ship and HCCL's shoreside network in the United Kingdom. Id.
The government sought to compel disclosure from RCCL rather than from HCCL because the two companies' service agreement provides that once HCCL "leases the IP address to RCCL, [HCCL] neither maintain[s] records of what devices are accessing the Internet, nor when those devices are accessing the Internet." Amend. App. at 6.
By connecting to RCCL's passenger-accessible Internal Network, RCCL's passengers can "stream music and movies, upload pictures, video chat with family and friends using FaceTime or Skype, check [their] email, look [at] stock prices, surf the web and stay connected with work." How Fast Is Royal Caribbean's VOOM Wi-Fi Internet Connection On Board?, ROYAL CARIBBEAN INT'L, https://www.royalcaribbean.com/faq/questions/onboard-internet-wifi-speed (last visited Mar. 7, 2018). RCCL provides passengers with two options to access the internet. See What Internet Options Are Available On Board Royal Caribbean Cruise Ships?, ROYAL CARIBBEAN INT'L, https://www.royalcaribbean.com/faq/questions/connect-onboard-internet-wifi (last visited Mar. 7, 2018). Passengers may access RCCL's wireless internet service with a WiFi-capable device or visit one of several internet cafés located throughout the ship. Id. To access the internet wirelessly, a passenger must (1) "[c]onnect to 'royal-wifi' on [a] device" and (2) "[o]pen [an] internet browser and register for the package of [one's] choice." Is WiFi Available For All My Devices On A Royal Caribbean Cruise Ship?, ROYAL CARIBBEAN INT'L, https://www.royalcaribbean.com/faq/questions/onboard-internet-wifi-available (last visited Mar. 7, 2018). RCCL charges passengers to access the internet, either wirelessly or through an internet café, with prices varying by number of devices used and internet service package purchased. Id.; see also What Is VOOM An[d] How Much Does It Cost?, ROYAL CARIBBEAN INT'L, https://www.royalcaribbean.com/faq/questions/onboard-internet-wifi-device-policy (last visited Mar. 7, 2018); Afterwards, ROYAL CARIBBEAN INT'L, http://www.royalcaribbean.com.au/beforeyouboard/whatToKnow/topTenFAQs/detail.do?pagename=top_10_faqs&snav=2&faqId=310 (last visited Mar. 7, 2018). Indeed, RCCL advises passengers to purchase internet access "precruise to enjoy the biggest discount from onboard prices." How Can I Purchase VOOM Internet Before My Cruise?, ROYAL CARIBBEAN INT'L, https://www.royalcaribbean.com/faq/questions/internet-purchase-before-cruise (last visited Mar. 7, 2018). Prior to gaining wireless internet access, passengers are required to agree to a detailed set of terms and conditions. See RCCL's Resp., Ex. A., RCCL Wi-Fi Access Terms and Conditions, ECF No. 10-3; RCCL Decl. ¶ 9.
The Magistrate Judge erroneously assumed that RCCL fell into a category of "entities which offer free WiFi as a convenience," Mag. J. Order at 3 n.3, while the government "presumes that RCCL charges subscribers/customers of its internet access service and requires them to login or otherwise identify themselves, as the requested order seeks (among other things) subscriber names, addresses, identifying information and means of payments, information which RCCL would presumably only collect if its customers/subscribers were being charged for the service," Gov't's Obj. at 10 n.4.
II. STANDARD OF REVIEW
Under 28 U.S.C. § 636(b)(3), "[a] magistrate judge may be assigned such additional duties as are not inconsistent with the Constitution and laws of the United States." As this matter was not "designate[d]" to a magistrate judge by a district court judge within the meaning of § 636(b)(1)(A) or (B), the order denying the government's application is an exercise of the Magistrate Judge's "additional duties," pursuant to § 636(b)(3), in conjunction with this Court's Local Criminal Rule 57.17(a), under which magistrate judges are granted the "duty" and the "power" to "[i]ssue search warrants," as well as to "[i]ssue subpoenas . . . or other orders necessary to obtain the presence of parties or witnesses or evidence needed for court proceedings." LCrR 57.17(a)(3), (10).
Pursuant to Local Criminal Rule 59.3, a "magistrate judge's warrant or order for which review is requested" "in a criminal matter not assigned to a district judge, as authorized by LCrR 57.17(a) and 28 U.S.C. § 636(b)(3) . . . may be accepted, modified, set aside, or recommitted to the magistrate judge with instructions, after de novo review by the Chief Judge." LCrR 59.3(a) & (b); see also In re Search of Information Associated with [redacted]@gmail.com That Is Stored at Premises Controlled by Google, Inc. ("Google"), No. 16-mj-757, 2017 WL 3445634, at *5 (D.D.C. July 31, 2017) (noting that "because this case arises out of the Magistrate Judge's 'additional duties' jurisdiction pursuant to § 636(b)(3), the Magistrate Judge's order is subject to de novo review by the district court."); In re U.S. for an Order Pursuant to 18 U .S.C. § 2705(b) ("Airbnb"), No. 17-mc-2490, 2018 WL 692923, at *3 (D.D.C. Jan. 30, 2018) ("Magistrate judge orders issued under the SCA in unassigned criminal matters are subject to de novo review."). Accordingly, the Magistrate Judge's order is subject to de novo review by the district court.
III. DISCUSSION
The applicable statutory framework is first briefly summarized, followed by analysis showing, consistent with the government's objection, that RCCL is an ECS provider, as defined in the SCA, for purposes of the government's application, objection, and proposed § 2703(d) order.
A. Statutory Framework
Congress enacted the SCA in 1986 as part of the Electronic Communications Privacy Act ("ECPA"), Pub. L. No. 99-508, 100 Stat. 1848 (1986). "The SCA regulates how stored wire and electronic communications may lawfully be accessed or disclosed and imposes on covered entities certain obligations regarding the disclosure and safeguarding of customer and subscriber information." Airbnb, 2018 WL 692923, at *4. "Entities covered by the SCA face serious penalties for violations of the Act, including actual damages of not less than $1,000 per offense, punitive damages in certain cases, up to a year's imprisonment for first offenses not committed for purposes of commercial advantage, and administrative discipline." Id. (citing 18 U.S.C. §§ 2701(b)(2), 2707(a)-(d)). As Airbnb explained:
The SCA's § 2703 permits the government, in specified circumstances, to compel ECS and RCS providers to disclose customer records or information, as well as the contents of their customers' stored electronic communications. This provision's framework provides a sliding scale of protections, such that the legal mechanism law enforcement utilizes and the showing required depend on the kind of information sought. In other words, the rules for compelled disclosure operate like an upside-down pyramid. The higher up the pyramid you go, the more information the government can obtain.Id. (alterations and internal quotation marks omitted) (quoting Orin S. Kerr, A User's Guide to the Stored Communications Act, and a Legislator's Guide to Amending It ("User's Guide"), 72 GEO. WASH. L. REV. 1208, 1222 (2004))).
An order pursuant to § 2703(d) may compel a provider of ECS or RCS to disclose "record[s] or other information pertaining to a subscriber to or customer of such service," 18 U.S.C. § 2703(c)(1), but "only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that . . . the records or other information sought, are relevant and material to an ongoing criminal investigation" to obtain such an order, id. § 2703(d). Such orders may compel disclosure of the myriad types of data maintained by a provider to enable a customer's use of the service, but not "the contents of communications." Id. § 2703(c)(1); see Kerr, User's Guide, supra, at 1222 & n.96. "[T]he government is not required to notify a customer that such information pertaining to the customer has been obtained," and "may require the recipient of the [§ 2703(d) order] not to notify the customer only by obtaining a court order under § 2705(b) for nondisclosure." Airbnb, 2018 WL 692923, at *4 (citing 18 U.S.C. §§ 2703(c)(3)), 2705(b)).
The central question is whether the entity to which the proposed SCA order is directed—here, RCCL—"is a provider of ECS or RCS such that it is covered by the SCA generally and, in particular, by §§ 2703 and 2705." Id. at *5. The SCA defines ECS as "any service which provides to users thereof the ability to send or receive wire or electronic communications." 18 U.S.C. § 2510(15). This category of providers is "generally understood to refer to 'telephone companies and electronic mail companies,'" Airbnb, 2018 WL 692923, at *5 (quoting Kerr, User's Guide, supra, at 1214 n.38), but the operative definitions reach more broadly. The SCA defines the term "electronic communication" as "'any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce.'" Id. (quoting 18 U.S.C. § 2510(12)). "RCS, by contrast, is defined as 'the provision to the public of computer storage or processing services by means of an electronic communications system,'" with "'electronic communications system' further defined to mean 'any wire, radio, electromagnetic, photooptical or photoelectronic facilities for the transmission of wire or electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications.'" Id. (quoting 18 U.S.C. §§ 2510(14), 2711(2)). "The term 'electronic storage' means 'any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof,' . . . including any storage 'for purposes of backup protection of such communication.'" Id. (quoting 18 U.S.C. §§ 2510(17)(A)-(B)).
As noted in Airbnb, "technological advances since the enactment of ECPA and the SCA" have "eroded" much of the difference between ECS and RCS providers, as "'most network service providers are multifunctional' and 'can act as providers of ECS in some contexts, providers of RCS in other contexts, and as neither in some contexts as well.'" Id. (quoting Kerr, User's Guide, supra, at 1215). "Thus, distinguishing between ECS and RCS has been described as a 'context sensitive' exercise that focuses on 'the provider's role with respect to a particular copy of a particular communication, rather than the provider's status in the abstract.'" Id. (quoting Kerr, User's Guide, supra, at 1215).
B. Royal Caribbean is an ECS Provider for the Purposes of This Application
RCCL provides passengers the ability to access the internet in order to, among other things, effectuate money transfers, thus making the company a provider of ECS for the purposes of the government's amended application, objection, and proposed § 2703(d) order. Moreover, RCCL is an ECS provider notwithstanding its provision of other services that are not ECS or RCS and regardless of whether its primary business function is the provision of ECS.
As the government points out, "if this Court determines that RCCL is not an ECS [provider], the records sought will not be conferred with the higher protections provided by the SCA. Instead, the government will be able to obtain these records as ordinary business records simply using a grand jury subpoena." Amend. App. at 5 n.4 (quoting FED. R. CRIM. P. 17(c)).
1. Royal Caribbean's Provision of Internet Access to Passengers Qualifies It As A Provider of Electronic Communication Service.
As discussed above, while the Target IP Address is the public-facing IP address connecting a particular RCCL cruise ship to the internet, RCCL Decl. ¶¶ 5, 11, the internal Ship Network dynamically assigns specific "private" IP addresses to individual customers to use for particular sessions of internet connectivity, id. ¶ 8. These private IP addresses are "unknown outside the Ship Network" and "can transmit communications only between a user's device and the Ship Network, not directly with the Internet." Id. Multiple RCCL passengers might connect to the internet using the same Target IP Address. Id. The government's proposed § 2703(d) order seeks to compel RCCL to disclose "[a]ll records and other information," other than the contents of communication, relating to the passenger(s) using the Target IP address to connect to the Internet on three particular occasions—for sessions lasting thirty-nine seconds, nineteen minutes and thirty-three seconds, and two minutes and fifteen seconds, respectively, on three consecutive days—to make money transfers as part of the criminal scheme under investigation. Amend. App. at 1-3, 7; id., Attach. A ("Proposed Order Attach.") at 1, ECF No. 1. This information may enable law enforcement to identify the individual or individuals who took part in the criminal scheme.
The specific information that the government seeks from RCCL includes the subscriber or subscribers' (1) "Names (including subscriber names, user names, and screen names);" (2) "Addresses (including mailing addresses, residential addresses, business addresses and e-mail addresses);" (3) "Local and long distance telephone connection records;" (4) "Records of session times and durations, and the temporarily assigned network addresses (such as IP addresses) associated with those sessions;" (5) "Length of service (including start date) and types of service utilized;" (6) "Telephone or instrument numbers (including media access control ('MAC') addresses);" (7) "Other subscriber numbers or identities (including the registration IP address);" and (8) "Means and source of payment for such service (including any credit card or bank account number) and billing records." Proposed Order Attach. at 1. The government also seeks to compel production of "[r]ecords of user activity of the user(s), customer(s), or subscriber(s) who used the IP Address at the date and time set forth above for each connection made to or from the Domain, including log files; messaging logs; the date, time, length, and method of connections; data transfer volume; user names; and source and destination IP addresses," and "[i]nformation about each communication sent or received by the user(s), customer(s), or subscriber(s) who used the IP Address at the date and time set forth above, including the date and time of the communication, the method of communication, and the source and destination of the communication (such as source and destination e-mail addresses, IP addresses, and telephone numbers)." Id. at 1-2. These requested records are "record[s] or other information pertaining to a subscriber to or customer" of an ECS provider subject to compelled production under the SCA, 18 U.S.C. § 2703(c), because RCCL, by providing passengers the ability to access the internet—which includes the ability to send and receive electronic communications—is a provider of ECS.
RCCL is an ECS provider for purposes of the government's application and objection because RCCL provided the internet access that enabled the targets to execute money transfers of funds from at least 300 victims over the internet using the Target IP Address on three particular occasions. Amend. App. at 7. The communications effectuating these money transfers constitute "transfer[s] of signs, signals, . . . data, or intelligence of any nature transmitted in whole or in part by a[n] . . . electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce," and thus satisfy the SCA's definition of "electronic communication." 18 U.S.C. § 2510(12). The SCA's definition of "electronic communication service," meanwhile, "captures any service that stands as a 'conduit' for the transmission of wire or electronic communications from one user to another." Council on Am.-Islamic Relations Action Network, Inc. v. Gaubatz, 793 F. Supp. 2d 311, 334 (D.D.C. 2011); see also Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 876 (9th Cir. 2002) (holding that provision of internet access enabling a user to access a website and transfer information from website owner to user "fits the definition of 'electronic communication'"). "[S]ervices that 'facilitate communication' between users typically have 'features that would appear to satisfy the broad definitions of the types of providers covered by the SCA, such as allowing users the ability to send and receive electronic communications.'" Airbnb, 2018 WL 692923, at *6 (alterations omitted) (quoting In re U.S. for an Order Pursuant to 28 U .S.C. § 1651(a) for Order Precluding Notice of Grand Jury Subpoena, No. 17-mc-1604, 2017 WL 3278929, at *1 n.1 (D.D.C. July 7, 2017)). RCCL "facilitate[d] communication," id. (alterations and internal quotation marks omitted), and served as a "conduit," Gaubatz, 793 F. Supp. 2d at 334, for the investigatory targets by providing internet access, see How Fast Is Royal Caribbean's VOOM Wi-Fi Internet Connection On Board?, supra ("[Y]ou will be able to stream music and movies, upload pictures, video chat with family and friends using FaceTime or Skype, check your email, look your stock prices, surf the web and stay connected with work.").
The SCA expressly excludes "electronic funds transfer information stored by a financial institution in a communications system used for the electronic storage and transfer of funds" from the definition of "electronic communications." 18 U.S.C. § 2510(12)(D). This exclusion is inapplicable here because although the information at issue may qualify as "electronic funds transfer information," the data is stored by RCCL, which is not "a financial institution." Id.
Notably, RCCL likely is the only entity from which the government could obtain records that would enable the targets' identification. Records in the possession of the financial services provider that the targets used to execute the funds transfers in question likely could not reveal the targets' identities, as all web communications sent to persons aboard an RCCL cruise ship are transmitted through the public, outward-facing IP address assigned to the ship's antenna, and only then directed to the private, inward-facing IP addresses assigned to particular passengers and crew members. RCCL Decl ¶ 5, 8. A § 2703(d) order directed to the financial services provider thus could identify at most the particular ship from which the targets acted, not the particular persons who executed the funds transfers in question. Similarly, the government likely could not obtain information enabling the targets' identification from Xcontrol or HCCL. As the government has explained, the terms of RCCL's service agreements with third-party ISPs prevent such ISPs from "maintain[ing] records of what devices are accessing the Internet, []or when those devices are accessing the Internet." See Amend. App. at 7. In any event, whether the government could have directed the proposed § 2703(d) order to a different entity—such as a financial services entity or ISP—simply has no bearing on whether RCCL meets the statutory definition of an ECS provider subject to compelled disclosure of subscriber or customer records. Equally irrelevant to RCCL's status as an ECS provider is the fact that RCCL contracts with third parties to obtain the "Internet satellite connectivity" and other "hardware and software that enables guests onboard to connect to the Internet using WiFi access points," rather than providing internet access without third party assistance. RCCL Decl. ¶¶ 7, 11. Under the SCA, whether the government may compel an entity to disclose records concerning electronic communications service turns not on whether the entity "owns" the means by which such service is provided, but on whether the entity "provide[s]" such service. 18 U.S.C. 2703(c).
The government's amended application addressed only HCCL in particular, but its reasoning appears equally applicable to both HCCL and Xcontrol. See Amend. App. at 7.
2. Royal Caribbean's Primary Business Function Is Irrelevant To Its Status As A Provider of ECS.
The Magistrate Judge denied the government's application on the ground that to classify "any business which provides web access as a convenience" as an ECS provider would render "every entity which now offers free WiFi" to be an ECS provider within the SCA's meaning, a result the Magistrate Judge concluded would be "[in]consistent with the intent of Congress in enacting the [SCA]." Mag. J. Order at 2-3; see also Sealed Order at 2 n.2, 17-mc-1756 (noting "a general concern that such an interpretation would mean that any business which provides wireless internet access to patrons would be subject to orders pursuant to § 2703(d)," and "would work an unwarranted expansion of the statute"). This reasoning is both inapplicable here and otherwise unfounded for several reasons.
As the government correctly observes, "this [matter] does not involve a provider of free WiFi, as the government understands it." Gov't Obj. at 9-10. Rather, RCCL charges passengers to access the internet, whether wirelessly or through an internet café. See Afterwards, supra. Moreover, the government's proposed order seeks only limited records relating to particular times and internet connection sessions as to which the government has presented specific and articulable facts that the investigatory targets used the public-facing Target IP Address to execute money transfers of the proceeds of the alleged fraud. See Amend. App. at 7. In this respect, as the government correctly observes, construing § 2703 to apply to subscriber or customer records protects rather than infringes on privacy, as the government must "offer[] specific and articulable facts showing that there are reasonable grounds to believe that . . . records or other information sought, are relevant and material to an ongoing criminal investigation" to obtain an order under § 2703(d), whereas the government need not make such a showing to obtain the records as ordinary business records pursuant to a grand jury subpoena, see Amend. App. at 5 n.4 (quoting FED. R. CRIM. P. 17(c)). As such, this is a focused request that does not seek all records pertaining to any RCCL passenger's use of the Target IP Address over the duration of a cruise.
More fundamentally, the Magistrate Judge's hesitance to conclude that the SCA could reach entities that merely provide internet access to customers is at odds with the language chosen by Congress in defining ECS, expressly to mean "any service which provides to users thereof the ability to send or receive wire or electronic communications." 18 U.S.C. § 2510(15). This definition "captures any service that stands as a conduit for the transmission of wire or electronic communications from one user to another and makes no reference to whether the service at issue is a primary business function or is merely ancillary to support a business function." Airbnb, 2018 WL 692923, at *6 (internal quotation marks omitted); accord Gaubatz, 793 F. Supp. 2d at 334 (same). "Rather, the statutory definitions of ECS and RCS are functional and context sensitive." Airbnb, 2018 WL 692923, at *6. What matters is "the service that is being provided at a particular time (or as to a particular piece of electronic communication at a particular time), rather than . . . the service provider itself." In re United States, 665 F. Supp. 2d 1210, 1214 (D. Or. 2009); see also Kerr, User's Guide, supra, at 1215 (identifying "the provider's role with respect to a particular copy of a particular communication, rather than the provider's status in the abstract," as the relevant criterion in determining whether an entity is a provider of ECS or RCS). Thus, "an entity that provides ECS . . . as only one part of its business is still covered by the SCA." Airbnb, 2018 WL 692923, at *7 (citing Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 114-15 (3d Cir. 2004) (insurance company that provided email service to its employees was an ECS provider); United States v. Mullins, 992 F.2d 1472, 1478 (9th Cir. 1993) (airline that provided travel agents with computerized travel reservation system accessed through separate computer terminals was an ECS provider)). Accordingly, for the purposes of this matter and the corresponding proposed § 2703(d) order, RCCL provides an ECS and therefore falls within the scope of § 2703(d).
The Magistrate Judge did not address Mullins and "regard[ed] the holding in Fraser as one confined to that case," for reasons not made clear in the Magistrate Judge's opinion. Mag. J. Order at 2. While Fraser did not involve, as here, a government application for compelled disclosure, its holding that an employer's access to an employee's e-mail account on the employer's system was not violative of the SCA rested on the clear conclusion that the employer was a "communications service provider[]," regardless of its primary business function, and therefore subject to SCA's exception, under 18 U.S.C. 2701(c)(1), allowing such providers to access their own systems with impunity. 352 F.3d at 115.
3. Royal Caribbean Does Not Oppose Its Classification , In This Matter , As A Provider Of ECS.
RCCL "does not oppose for present purposes the government's position that RCCL is a provider of an [ECS] under the [SCA's] broad definition of ECS in the operations of its Ship Network that enable individuals onboard its cruise ships to send or receive electronic communications via the Internet to third parties." RCCL's Resp. at 1-2. RCCL's concession bolsters the conclusion that RCCL provides ECS for purposes of the government's application, objection, and proposed § 2703(d) order, though for the reasons explained above, this concession is unnecessary to reach this conclusion.
RCCL emphasizes that it "tak[es] [no] position on whether the SCA would reach records that pertain to a non-U.S.-based guest on a voyage that never entered U.S. territory, including U.S. territorial waters," as "the records at issue in this matter pertain to a Florida-based voyage." RCCL's Resp. at 2 n.1. This Court has held that the SCA applies to "records or the content of electronic communications from a U.S.-based service provider" regardless of whether the records sought, "in whole or in part, may be stored on servers abroad," provided that the government has sufficiently supported its application with the showing necessary under the SCA (either "probable cause" for a warrant issued pursuant to § 2703(a) or "specific and articulable facts" for an order issued pursuant to § 2703(d)). Google, 2017 WL 3445634, at *5. Google identified the relevant consideration, in determining whether the government may compel a service provider to produce electronic information, as whether the provider is "subject to the jurisdiction of U.S. courts," rejecting an argument that the government could not compel production by a U.S.-based service provider of "records stored abroad." Id. at *15. Thus, because the relevant consideration in determining whether the SCA subjects subscriber or customer records to compelled disclosure is whether a provider is based in the United States, id., and because it is not disputed that RCCL is based in Miami, Florida, see Amend. App. at 1, whether the passenger(s) whose records are demanded by the § 2703(d) order is based in the United States or voyaged through U.S. territory is irrelevant.
As RCCL notes, the U.S. Supreme Court may address issues related to the SCA's reach in United States v. Microsoft Corp., No. 17-2. RCCL's Resp. at 2 n.1. --------
IV. CONCLUSION
For the reasons stated above, the government's objection is sustained, the Magistrate Judge's Order is reversed, and the government's amended application for an order pursuant to 18 U.S.C. § 2703(d) is granted. The government is directed, by March 19, 2018, to review this Memorandum Opinion and the entire record in this matter and advise the Court of which docket entries may be unsealed in whole or in part, with proposed redactions as necessary to protect any ongoing criminal investigations. An appropriate Order, which is filed under seal, accompanies this Memorandum Opinion.
Date: March 8, 2018
/s/_________
BERYL A. HOWELL
Chief Judge