Relates to search warrants for electronic communication services, remote computing services and electronic location information; allows law enforcement to execute search warrants for electronic data held inside and outside New York state.
STATE OF NEW YORK
________________________________________________________________________
2313
2019-2020 Regular Sessions
IN ASSEMBLY
January 22, 2019
___________
Introduced by M. of A. RODRIGUEZ, BLAKE, PEOPLES-STOKES, VANEL --
Multi-Sponsored by -- M. of A. COOK -- read once and referred to the
Committee on Codes
AN ACT to amend the criminal procedure law, in relation to establishing
the EMAIL privacy act (electronic messaging and individual location)
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. This act shall be known and may be cited as the "EMAIL
2 privacy act (electronic messaging and individual location)".
3 § 2. Paragraph (c) of subdivision 1 of section 690.15 of the criminal
4 procedure law is amended and a new paragraph (d) is added to read as
5 follows:
6 (c) A designated or described person[.];
7 (d) Designated or described electronic customer data or electronic
8 location information held in electronic storage, including the contents
9 of and records and other information related to a wire communication or
10 electronic communication held in electronic storage. For purposes of
11 this paragraph, "electronic communication" has the meaning assigned by
12 section 250.00 of the penal law, "electronic storage", "wire communi-
13 cation", "electronic customer data" and "electronic location informa-
14 tion" have the meaning assigned by section 690.05 of this article.
15 § 3. Subdivision 2 of section 690.05 of the criminal procedure law, as
16 amended by chapter 504 of the laws of 1991, the opening paragraph as
17 amended by chapter 424 of the laws of 1998, is amended and a new subdi-
18 vision 3 is added to read as follows:
19 2. A search warrant is a court order and process directing a police
20 officer to conduct:
21 (a) a search of designated premises, or of a designated vehicle, or of
22 a designated person, for the purpose of seizing designated property or
23 kinds of property, and to deliver any property so obtained to the court
24 which issued the warrant; or
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD07279-01-9
A. 2313 2
1 (b) a search of a designated premises for the purpose of searching for
2 and arresting a person who is the subject of: (i) a warrant of arrest
3 issued pursuant to this chapter, a superior court warrant of arrest
4 issued pursuant to this chapter, or a bench warrant for a felony issued
5 pursuant to this chapter, where the designated premises is the dwelling
6 of a third party who is not the subject of the arrest warrant; or
7 (ii) a warrant of arrest issued by any other state or federal court
8 for an offense which would constitute a felony under the laws of this
9 state, where the designated premises is the dwelling of a third party
10 who is not the subject of the arrest warrant[.]; or
11 (c) a search of designated or described electronic customer data or
12 electronic location information held in electronic storage or mobile
13 device, including the contents of, and records and other information
14 related to a wire communication or electronic communication held in
15 electronic storage or mobile device.
16 3. The following definitions are applicable to this article:
17 (a) "Electronic storage" means any storage of electronic customer data
18 in a computer, computer network, or computer system, regardless of
19 whether the data is subject to recall, further manipulation, deletion,
20 or transmission, and includes any storage of a wire or electronic commu-
21 nication by an electronic communications service or a remote computing
22 service.
23 (b) "Wire communication" means an aural transfer made in whole or in
24 part through the use of facilities for the transmission of communi-
25 cations by the aid of wire, cable, or other like connection between the
26 point of origin and the point of reception, including the use of such a
27 connection in a switching station, furnished or operated by a person
28 authorized to engage in providing or operating the facilities for the
29 transmission of communications as a communications common carrier. The
30 term includes the electronic storage of a wire communication.
31 (c) "Electronic customer data" means data or records that:
32 (i) are in the possession, care, custody, or control of a provider of
33 an electronic communications service or a remote computing service; and
34 (ii) contain: (1) information revealing the identity of customers of
35 the applicable service;
36 (2) information about a customer's use of the applicable service;
37 (3) information that identifies the recipient or destination of a wire
38 communication or electronic communication sent to or by the customer;
39 (4) the content of a wire communication or electronic communication
40 sent to or by the customer; and
41 (5) any data stored by or on behalf of the customer with the applica-
42 ble service provider.
43 (d) "Electronic location information" means any information that
44 relates to: (i) the location of a cellular telephone, mobile or other
45 wireless communications device; and (ii) is wholly or partly generated
46 by or derived from the operation of the device.
47 § 4. The criminal procedure law is amended by adding a new section
48 690.60 to read as follows:
49 § 690.60 Search warrants; government access to stored customer data,
50 communications and electronic location information.
51 1. An authorized police officer may require a provider of electronic
52 communications service or a provider of a remote computing service to
53 disclose electronic customer data or electronic location information
54 that is in electronic storage by obtaining a warrant.
55 2. In executing a search warrant directing a provider of an electronic
56 communications service or a provider of a remote computing service to
A. 2313 3
1 disclose only electronic customer data that is information revealing the
2 identity of customers of the applicable service or information about a
3 customer's use of the applicable service a police officer need not give
4 notice to the subscriber or customer:
5 (a) by obtaining an administrative subpoena authorized by statute;
6 (b) by obtaining a grand jury subpoena;
7 (c) by obtaining a warrant;
8 (d) by obtaining the consent of the subscriber or customer to the
9 disclosure of the data;
10 (e) by obtaining a court order; or
11 (f) as otherwise permitted by applicable federal law.
12 3. A provider of telephonic communications service shall disclose to
13 an authorized police officer, without any form of legal process,
14 subscriber listing information, including name, address, and telephone
15 number or similar access code that:
16 (a) the service provides to others in the course of providing publicly
17 available directory or similar assistance; or
18 (b) is solely for use in the dispatch of emergency vehicles and
19 personnel responding to a distress call directed to an emergency
20 dispatch system or when the information is reasonably necessary to aid
21 in the dispatching of emergency vehicles and personnel for the immediate
22 prevention of death, personal injury, or destruction of property.
23 4. A provider of telephonic communications service shall provide an
24 authorized police officer with the name of the subscriber of record
25 whose published telephone number is provided to the service by an
26 authorized police officer.
27 5. Electronic location information may be obtained by an authorized
28 police officer without any form of legal process, if:
29 (a) the device is reported stolen by the owner; or
30 (b) there exists an immediate life-threatening situation.
31 § 5. The criminal procedure law is amended by adding a new section
32 690.65 to read as follows:
33 § 690.65 Search warrants; warrant issued in this state for stored
34 customer data, communications or electronic location informa-
35 tion.
36 1. This section applies to a warrant required under section 690.60 of
37 this article to obtain electronic customer data, including the contents
38 of a wire communication, electronic communication or electronic location
39 information.
40 2. On the filing of an application by an authorized police officer, a
41 district judge may issue a search warrant under this section for elec-
42 tronic customer data held in electronic storage, including the contents
43 of and records and other information related to a wire communication or
44 electronic communication held in electronic storage or electronic
45 location information, by a provider of an electronic communications
46 service or a provider of a remote computing service described by subdi-
47 vision eight of this section, regardless of whether the customer data is
48 held at a location in this state or at a location in another state. An
49 application made under this subdivision must demonstrate probable cause
50 for the issuance of the warrant and must be supported by the oath or
51 affirmation of the authorized police officer.
52 3. A search warrant may not be issued under this section unless the
53 application required by section 690.35 of this article sets forth suffi-
54 cient and substantial facts to establish probable cause that:
55 (a) a specific offense has been committed; and
A. 2313 4
1 (b) the electronic customer data or electronic location information
2 sought:
3 (i) constitutes evidence of that offense or evidence that a particular
4 person committed that offense; and
5 (ii) is held in electronic storage by the service provider on which
6 the warrant is served under subdivision seven of this section.
7 4. Only the electronic customer data or electronic location informa-
8 tion described in the application required by section 690.35 of this
9 article may be seized under the warrant.
10 5. The police officer shall execute the warrant not later than the
11 tenth day after the date of issuance, except that the officer shall
12 execute the warrant within a shorter period if so directed in the
13 warrant by the district judge. For purposes of this subdivision, a
14 warrant is executed when the warrant is served in the manner described
15 by subdivision seven of this section.
16 6. A warrant under this section may be served only on a service
17 provider that is a domestic entity or a company or entity otherwise
18 doing business in this state under a contract or a terms of service
19 agreement with a resident of this state, if any part of that contract or
20 agreement is to be performed in this state. The service provider shall
21 produce all electronic customer data, contents of communications, elec-
22 tronic location information, and other information sought, regardless of
23 where the information is held in the United States and within the period
24 allowed for compliance with the warrant, as provided by subdivision
25 eight of this section. A court may find any designated officer, desig-
26 nated director, or designated owner of a company or entity in contempt
27 of court if the person by act or omission is responsible for the failure
28 of the company or entity to comply with the warrant within the period
29 allowed for compliance. The failure of a company or entity to timely
30 deliver the information sought in the warrant does not affect the admis-
31 sibility of that evidence in a criminal proceeding.
32 7. A search warrant issued under this section is served when the
33 authorized police officer delivers the warrant by hand, by facsimile
34 transmission, or, in a manner allowing proof of delivery, by means of
35 the United States mail or a private delivery service to:
36 (a) a person specified by section three hundred five of the business
37 corporation law;
38 (b) the secretary of state in the case of a company or entity to which
39 section three hundred six of the business corporation law applies; or
40 (c) any other person or entity designated to receive the service of
41 process.
42 8. The district judge shall indicate in the warrant that the deadline
43 for compliance by the provider of an electronic communications service
44 or the provider of a remote computing service is the fifteenth business
45 day after the date the warrant is served if the warrant is to be served
46 on a domestic entity or a company or entity otherwise doing business in
47 this state, except that the deadline for compliance with a warrant
48 served in accordance with section three hundred six of the business
49 corporation law, may be extended to a date that is not later than the
50 thirtieth day after the date the warrant is served. The judge may indi-
51 cate in a warrant that the deadline for compliance is earlier than the
52 fifteenth business day after the date the warrant is served if the offi-
53 cer makes a showing and the judge finds that failure to comply with the
54 warrant by the earlier deadline would cause serious jeopardy to an
55 investigation, cause undue delay of a trial, or create a material risk
56 of:
A. 2313 5
1 (a) danger to the life or physical safety of any person;
2 (b) flight from prosecution;
3 (c) the tampering with or destruction of evidence; or
4 (d) intimidation of potential witnesses.
5 9. If the authorized police officer serving the warrant under this
6 section also delivers an application form to the provider of an elec-
7 tronic communications service or the provider of a remote computing
8 service responding to the warrant, and the police officer also notifies
9 the provider in writing that an executed application is required, then
10 the provider shall verify the authenticity of the customer data,
11 contents of communications, electronic location information, and other
12 information produced in compliance with the warrant by including with
13 the information the application form completed and sworn to by a person
14 who is a custodian of the information or a person otherwise qualified to
15 attest to its authenticity that states that the information was stored
16 in the course of regularly conducted business of the provider and speci-
17 fies whether it is the regular practice of the provider to store that
18 information.
19 10. On a service provider's compliance with a warrant under this
20 section, an authorized police officer shall file a return of the warrant
21 and a copy of the inventory of the seized property as required under
22 section 690.50 of this article.
23 11. The district judge shall hear and decide any motion to quash the
24 warrant not later than the fifth business day after the date the service
25 provider files the motion. The judge may allow the service provider to
26 appear at the hearing by teleconference.
27 12. A provider of an electronic communications service or a provider
28 of a remote computing service responding to a warrant issued under this
29 section may request an extension of the period for compliance with the
30 warrant if extenuating circumstances exist to justify the extension. The
31 district judge shall grant a request for an extension based on those
32 circumstances if:
33 (a) the authorized police officer who applied for the warrant or
34 another appropriate authorized police officer agrees to the extension;
35 or
36 (b) the district judge finds that the need for the extension outweighs
37 the likelihood that the extension will cause an adverse circumstance
38 described by subdivision eight of this section.
39 § 6. The criminal procedure law is amended by adding a new section
40 690.70 to read as follows:
41 § 690.70 Search warrants; warrant issued in another state for stored
42 customer data, communications or electronic location informa-
43 tion.
44 Any domestic entity that provides electronic communications services
45 or remote computing services to the public shall comply with a warrant
46 issued in another state and seeking information described in subdivision
47 two of section 690.65 of this article, if the warrant is served on the
48 entity in a manner equivalent to service of process required by subdivi-
49 sion eight of section 690.65 of this article.
50 § 7. The criminal procedure law is amended by adding a new section
51 690.75 to read as follows:
52 § 690.75 Search warrants; back-up preservation for stored customer data,
53 communications or electronic location information.
54 1. A subpoena or court order for disclosure of certain electronic
55 customer data or electronic location information held in electronic
56 storage by a provider of an electronic communications service or a
A. 2313 6
1 provider of a remote computing service may require that provider to
2 create a copy of the customer data or electronic location information
3 sought by the subpoena or court order for the purpose of preserving that
4 data. The provider may not inform the subscriber or customer whose data
5 is being sought that the subpoena or court order has been issued. The
6 provider shall create the copy within a reasonable time as determined by
7 the court issuing the subpoena or court order.
8 2. The provider of an electronic communications service or the provid-
9 er of a remote computing service shall immediately notify the authorized
10 police officer who presented the subpoena or court order requesting the
11 copy when the copy has been created.
12 3. The authorized police officer shall notify the subscriber or
13 customer whose electronic customer data or electronic location informa-
14 tion is the subject of the subpoena or court order of the creation of
15 the copy not later than three days after the date of the receipt of the
16 notification from the applicable provider that the copy was created.
17 4. The provider of an electronic communications service or the provid-
18 er of a remote computing service shall release the copy to the request-
19 ing authorized police officer not earlier than the fourteenth day after
20 the date of the police officer's notice to the subscriber or customer if
21 the provider has not:
22 (a) initiated proceedings to challenge the request of the police offi-
23 cer for the copy; or
24 (b) received notice from the subscriber or customer that the subscrib-
25 er or customer has initiated proceedings to challenge the request.
26 5. The provider of an electronic communications service or the provid-
27 er of a remote computing service may not destroy or permit the
28 destruction of the copy until the electronic customer data or electronic
29 location information has been delivered to the applicable law enforce-
30 ment agency or until the resolution of any court proceedings, including
31 appeals of any proceedings, relating to the subpoena or court order
32 requesting the creation of the copy, whichever occurs last.
33 6. An authorized police officer who reasonably believes that notifica-
34 tion to the subscriber or customer of the subpoena or court order would
35 result in the destruction of or tampering with electronic customer data
36 or electronic location information sought may request the creation of a
37 copy of the data. The police officer's belief is not subject to chal-
38 lenge by the subscriber or customer or by a provider of an electronic
39 communications service or a provider of a remote computing service.
40 7. (a) A subscriber or customer who receives notification as described
41 in subdivision three of this section may file a written motion to quash
42 the subpoena or vacate the court order in the court that issued the
43 subpoena or court order not later than the fourteenth day after the date
44 of the receipt of the notice. The motion must contain an affidavit or
45 sworn statement stating:
46 (i) that the applicant is a subscriber or customer of the provider of
47 an electronic communications service or the provider of a remote comput-
48 ing service from which the electronic customer data or electronic
49 location information held in electronic storage for the subscriber or
50 customer has been sought; and
51 (ii) the applicant's reasons for believing that the customer data or
52 electronic location information sought is not relevant to a legitimate
53 law enforcement inquiry or that there has not been substantial compli-
54 ance with the provisions of this article in some other respect.
55 (b) The subscriber or customer shall give written notice to the
56 provider of an electronic communications service or the provider of a
A. 2313 7
1 remote computing service of the challenge to the subpoena or court
2 order. The authorized police officer requesting the subpoena or court
3 order must be served a copy of the papers filed by personal delivery or
4 by registered or certified mail.
5 8. (a) The court shall order the authorized police officer to file a
6 sworn response to the motion filed by the subscriber or customer if the
7 court determines that the subscriber or customer has complied with the
8 requirements of subdivision seven of this section. On request of the
9 police officer, the court may permit the response to be filed in camera.
10 The court may conduct any additional proceedings the court considers
11 appropriate if the court is unable to make a determination on the motion
12 on the basis of the parties' initial allegations and response.
13 (b) The court shall rule on the motion as soon after the filing of the
14 officer's response as practicable. The court shall deny the motion if
15 the court finds that the applicant is not the subscriber or customer
16 whose electronic customer data or electronic location information held
17 in electronic storage is the subject of the subpoena or court order or
18 that there is reason to believe that the police officer's inquiry is
19 legitimate and that the customer data sought is relevant to that
20 inquiry. The court shall quash the subpoena or vacate the order if the
21 court finds that the applicant is the subscriber or customer whose data
22 is the subject of the subpoena or court order and that there is not a
23 reason to believe that the data is relevant to a legitimate law enforce-
24 ment inquiry or that there has not been substantial compliance with the
25 provisions of this article.
26 (c) A court order denying a motion or application under this section
27 is not a final order and no interlocutory appeal may be taken from the
28 denial.
29 § 8. The criminal procedure law is amended by adding a new section
30 690.80 to read as follows:
31 § 690.80 Search warrants; preclusion of notification for stored customer
32 data, communications or electronic location information.
33 1. An authorized police officer seeking electronic customer data or
34 electronic location information may apply to the court for an order
35 commanding the service provider to whom a warrant, subpoena, or court
36 order is directed not to disclose to any person the existence of the
37 warrant, subpoena, or court order. The order is effective for the period
38 the court considers appropriate. The court shall enter the order if the
39 court determines that there is reason to believe that notification of
40 the existence of the warrant, subpoena, or court order will have an
41 adverse result.
42 2. In this section, an "adverse result" means:
43 (a) endangering the life or physical safety of an individual;
44 (b) flight from prosecution;
45 (c) destruction of or tampering with evidence;
46 (d) intimidation of a potential witness; or
47 (e) otherwise seriously jeopardizing an investigation or unduly delay-
48 ing a trial.
49 § 9. The criminal procedure law is amended by adding a new section
50 690.85 to read as follows:
51 § 690.85 Search warrants; reimbursement of costs for stored customer
52 data, communications or electronic location information.
53 1. Except as provided by subdivision three of this section, an author-
54 ized police officer who obtains information under this article shall
55 reimburse the person assembling or providing the information for all
56 costs that are reasonably necessary and that have been directly incurred
A. 2313 8
1 in searching for, assembling, reproducing, or otherwise providing the
2 information. These costs include costs arising from necessary disruption
3 of normal operations of an electronic communications service or remote
4 computing service in which the information may be stored.
5 2. The authorized police officer and the person providing the informa-
6 tion may agree on the amount of reimbursement. If there is no agreement,
7 the court that issued the order for production of the information shall
8 determine the amount. If no court order was issued for production of
9 the information, the court before which the criminal prosecution relat-
10 ing to the information would be brought shall determine the amount.
11 3. Subdivision one of this section does not apply to records or other
12 information maintained by a communications common carrier that relate to
13 telephone toll records or telephone listings unless the court determines
14 that the amount of information required was unusually voluminous or that
15 an undue burden was imposed on the provider.
16 § 10. The criminal procedure law is amended by adding a new section
17 690.90 to read as follows:
18 § 690.90 Search warrants; stored customer data, communications or elec-
19 tronic location information; no cause of action.
20 A subscriber or customer of a provider of an electronic communications
21 service or a provider of a remote computing service does not have a
22 cause of action against a provider or its officers, employees, or agents
23 or against other specified persons for providing information, facili-
24 ties, or assistance as required by a court order, warrant, subpoena, or
25 certification under this article.
26 § 11. The criminal procedure law is amended by adding a new section
27 690.95 to read as follows:
28 § 690.95 Search warrants; stored customer data, communications or elec-
29 tronic location information; cause of action.
30 Except as provided by section 690.90 of this article, a provider of an
31 electronic communications service or a provider of a remote computing
32 service, or a subscriber or customer of that provider, that is aggrieved
33 by a violation of this article has a civil cause of action if the
34 conduct constituting the violation was committed knowingly or inten-
35 tionally and is entitled to:
36 1. injunctive relief;
37 2. a reasonable attorney's fee and other litigation costs reasonably
38 incurred; and
39 3. the sum of the actual damages suffered and any profits made by the
40 violator as a result of the violation or one thousand dollars, whichever
41 is more.
42 § 12. The criminal procedure law is amended by adding a new section
43 690.96 to read as follows:
44 § 690.96 Search warrants; annual report of warrants and orders.
45 1. No later than January fifteenth of each year, a provider of an
46 electronic communication service or a provider of a remote computing
47 service doing business in this state shall report to the office of
48 public safety the following information for the preceding calendar year,
49 disaggregated by each law enforcement agency in this state making the
50 applicable requests:
51 (a) the number of requests made for pen register or trap and trace
52 information;
53 (b) the number of requests made for ESN reader information;
54 (c) the number of requests made for location information;
55 (d) the number of individuals whose location information was
56 disclosed; and
A. 2313 9
1 (e) the amount that each law enforcement agency was billed by the
2 communication common carrier or electronic communications service for
3 each request made under paragraph (a), (b) or (c) of this subdivision.
4 2. No later than the thirtieth day after the date of expiration of a
5 warrant or order issued under this article or an order extending the
6 period of a warrant or order issued under this article, or no later than
7 the thirtieth day after the date the court denies an application for a
8 warrant or order under this article, the court shall submit to the
9 office of public safety the following information, as applicable:
10 (a) the receipt of an application for a warrant or order under this
11 article;
12 (b) the type of warrant or order for which the application was made;
13 (c) whether any application for an order of extension was granted,
14 granted as modified by the court, or denied;
15 (d) the period of monitoring authorized by the warrant or order and
16 the number and duration of any extensions of the warrant or order;
17 (e) the offense under investigation, as specified in the application
18 for the warrant or order or an extension of the warrant or order; and
19 (f) the law enforcement agency or prosecutor that submitted an appli-
20 cation for the warrant or order or an extension of the warrant or order.
21 3. No later than January fifteenth of each year, each prosecutor that
22 submits an application for a warrant or order or an extension of a
23 warrant or order under this article shall submit to the office of public
24 safety the following information for the preceding calendar year;
25 (a) the information required to be submitted by a court with respect
26 to each application submitted by the prosecutor for the warrant or order
27 or an extension of the warrant or order;
28 (b) a general description of information collected under each warrant
29 or order that was issued by the court, including the approximate number
30 of individuals for whom location information was intercepted and the
31 approximate duration of the monitoring of the location information of
32 those individuals;
33 (c) the number of arrests made as a result of information obtained
34 under a warrant or order issued under this article;
35 (d) the number of criminal trials commenced as a result of information
36 obtained under a warrant or order issued under this article; and
37 (e) the number of convictions obtained as a result of information
38 obtained under a warrant or order issued under this article.
39 4. Information submitted to the office of public safety under this
40 section is public information and subject to disclosure.
41 5. No later than March first of each year, the office of public safety
42 shall submit a report to the governor, the state attorney general, the
43 speaker of the assembly, and the chairs of the standing committees of
44 the senate and assembly with primary jurisdiction over criminal justice.
45 The report must contain the following information for the preceding
46 calendar year:
47 (a) an assessment of the extent of tracking or monitoring by law
48 enforcement agencies of pen register, trap and trace, ESN reader, and
49 location information;
50 (b) a comparison of the ratio of the number of applications for
51 warrants or orders made under this article to the number of arrests and
52 convictions resulting from information obtained under a warrant or order
53 issued under this article;
54 (c) identification of the types of offenses investigated under a
55 warrant or order issued under this article; and
A. 2313 10
1 (d) with respect to both state and local jurisdictions, an estimate of
2 the total cost of conducting investigations under a warrant or order
3 issued under this article.
4 § 13. The criminal procedure law is amended by adding a new section
5 690.97 to read as follows:
6 § 690.97 Search warrants; stored customer data, communications and elec-
7 tronic location information and use in a court of law.
8 Stored customer data, communications and electronic location informa-
9 tion obtained without any form of legal process and not pursuant to
10 section 690.60 of this article shall be inadmissible in a court of law.
11 § 14. This act shall take effect immediately.