Mobile Forensics · Cloud & Account Evidence · Lesson 3 of 5

Legal Process & Providers

See how US law sorts account data, and how providers are asked to keep it.

Different data, different paperwork

When investigators need data that only a provider holds, and the account holder isn't consenting, they use legal process. Rules vary a lot by country, so this lesson uses the United States as the example and keeps it high level. It isn't legal advice.

In the US, a key law is the Stored Communications Act (SCA), part of a 1986 law, found at 18 U.S.C. 2701 and following sections. Section 2703 sets out what the government must show to make a provider hand over different kinds of data. Think of it as a ladder: the more private the data, the more the government has to show.

• Basic subscriber information. Name, address, session times and durations, length of service, assigned network addresses, and means and source of payment. A subpoena, a demand that doesn't need a judge's prior approval, can reach this.
• Other non-content records. Things like email header details or account logs. These can be reached with a special court order under section 2703(d), which requires specific and articulable facts showing the records are relevant and material to an ongoing criminal investigation.
• Content. The messages, photos and documents themselves. For content stored 180 days or less, the statute requires a warrant, which a judge issues only on probable cause. The statute has older, weaker options for older content, but in practice major providers such as Google say they require a warrant for content such as email, documents and photos.

Courts also shape these rules. In Carpenter v. United States (2018), the Supreme Court held that the government generally needs a warrant to get historical cell-site location records from a phone company, records you met in Mobile Fundamentals.

A warrant also has limits. It describes what may be searched and seized, and investigators must stay within that scope, just as with a phone in the lab.

Preservation and transparency

Getting a warrant takes time, and data can disappear in the meantime. A user might delete messages, or a backup might expire, as you saw in the first module. The SCA has a tool for this at section 2703(f).

A preservation request asks a provider to set aside a copy of specific records it already holds while the government obtains the legal process needed to get them. The statute says the provider must take all necessary steps to preserve them, and must keep them for 90 days. That can be extended by another 90 days on a renewed request. A preservation request doesn't hand anything over. It only freezes a copy. Investigators still need a subpoena, court order or warrant to receive the data. Apple's transparency report describes these as requests to preserve a one-time copy of customer account data.

Providers also handle emergency requests. When someone may be in serious physical danger, an agency can ask a provider to disclose information voluntarily to prevent harm.

How often does all this happen? Many providers publish transparency reports with counts of government requests. Apple reports in half-year periods and lists categories such as device, account, account preservation, emergency and US national security requests. Google publishes its own report on requests for user information and explains how it handles them, including that it requires valid legal process except in emergencies.

Other countries have their own laws and standards. A foreign agency usually can't simply send a US subpoena. Google says it responds to requests from outside the US only when the disclosure is consistent with US law, the requesting country's law and Google's own policies. Governments may also use treaties called mutual legal assistance treaties (MLATs) to request evidence held abroad. Rules change, so investigators check the current law where they work.