Bill Text: NY A03527 | 2021-2022 | General Assembly | Introduced
Bill Title: Relates to search warrants for electronic communication services, remote computing services and electronic location information; allows law enforcement to execute search warrants for electronic data held inside and outside New York state.
Spectrum: Partisan Bill (Democrat 4-0)
Status: (Introduced - Dead) 2021-12-10 - enacting clause stricken [A03527 Detail]
Download: New_York-2021-A03527-Introduced.html
STATE OF NEW YORK ________________________________________________________________________ 3527 2021-2022 Regular Sessions IN ASSEMBLY January 27, 2021 ___________ Introduced by M. of A. RODRIGUEZ, PEOPLES-STOKES, VANEL -- Multi-Spon- sored by -- M. of A. COOK -- read once and referred to the Committee on Codes AN ACT to amend the criminal procedure law, in relation to establishing the EMAIL privacy act (electronic messaging and individual location) The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. This act shall be known and may be cited as the "EMAIL 2 privacy act (electronic messaging and individual location)". 3 § 2. Paragraph (c) of subdivision 1 of section 690.15 of the criminal 4 procedure law is amended and a new paragraph (d) is added to read as 5 follows: 6 (c) A designated or described person[.]; 7 (d) Designated or described electronic customer data or electronic 8 location information held in electronic storage, including the contents 9 of and records and other information related to a wire communication or 10 electronic communication held in electronic storage. For purposes of 11 this paragraph, "electronic communication" has the meaning assigned by 12 section 250.00 of the penal law, "electronic storage", "wire communi- 13 cation", "electronic customer data" and "electronic location informa- 14 tion" have the meaning assigned by section 690.05 of this article. 15 § 3. Subdivision 2 of section 690.05 of the criminal procedure law, as 16 amended by chapter 504 of the laws of 1991, the opening paragraph as 17 amended by chapter 424 of the laws of 1998, is amended and a new subdi- 18 vision 3 is added to read as follows: 19 2. A search warrant is a court order and process directing a police 20 officer to conduct: 21 (a) a search of designated premises, or of a designated vehicle, or of 22 a designated person, for the purpose of seizing designated property or 23 kinds of property, and to deliver any property so obtained to the court 24 which issued the warrant; or EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD03010-01-1A. 3527 2 1 (b) a search of a designated premises for the purpose of searching for 2 and arresting a person who is the subject of: (i) a warrant of arrest 3 issued pursuant to this chapter, a superior court warrant of arrest 4 issued pursuant to this chapter, or a bench warrant for a felony issued 5 pursuant to this chapter, where the designated premises is the dwelling 6 of a third party who is not the subject of the arrest warrant; or 7 (ii) a warrant of arrest issued by any other state or federal court 8 for an offense which would constitute a felony under the laws of this 9 state, where the designated premises is the dwelling of a third party 10 who is not the subject of the arrest warrant[.]; or 11 (c) a search of designated or described electronic customer data or 12 electronic location information held in electronic storage or mobile 13 device, including the contents of, and records and other information 14 related to a wire communication or electronic communication held in 15 electronic storage or mobile device. 16 3. The following definitions are applicable to this article: 17 (a) "Electronic storage" means any storage of electronic customer data 18 in a computer, computer network, or computer system, regardless of 19 whether the data is subject to recall, further manipulation, deletion, 20 or transmission, and includes any storage of a wire or electronic commu- 21 nication by an electronic communications service or a remote computing 22 service. 23 (b) "Wire communication" means an aural transfer made in whole or in 24 part through the use of facilities for the transmission of communi- 25 cations by the aid of wire, cable, or other like connection between the 26 point of origin and the point of reception, including the use of such a 27 connection in a switching station, furnished or operated by a person 28 authorized to engage in providing or operating the facilities for the 29 transmission of communications as a communications common carrier. The 30 term includes the electronic storage of a wire communication. 31 (c) "Electronic customer data" means data or records that: 32 (i) are in the possession, care, custody, or control of a provider of 33 an electronic communications service or a remote computing service; and 34 (ii) contain: (1) information revealing the identity of customers of 35 the applicable service; 36 (2) information about a customer's use of the applicable service; 37 (3) information that identifies the recipient or destination of a wire 38 communication or electronic communication sent to or by the customer; 39 (4) the content of a wire communication or electronic communication 40 sent to or by the customer; and 41 (5) any data stored by or on behalf of the customer with the applica- 42 ble service provider. 43 (d) "Electronic location information" means any information that 44 relates to: (i) the location of a cellular telephone, mobile or other 45 wireless communications device; and (ii) is wholly or partly generated 46 by or derived from the operation of the device. 47 § 4. The criminal procedure law is amended by adding a new section 48 690.60 to read as follows: 49 § 690.60 Search warrants; government access to stored customer data, 50 communications and electronic location information. 51 1. An authorized police officer may require a provider of electronic 52 communications service or a provider of a remote computing service to 53 disclose electronic customer data or electronic location information 54 that is in electronic storage by obtaining a warrant. 55 2. In executing a search warrant directing a provider of an electronic 56 communications service or a provider of a remote computing service toA. 3527 3 1 disclose only electronic customer data that is information revealing the 2 identity of customers of the applicable service or information about a 3 customer's use of the applicable service a police officer need not give 4 notice to the subscriber or customer: 5 (a) by obtaining an administrative subpoena authorized by statute; 6 (b) by obtaining a grand jury subpoena; 7 (c) by obtaining a warrant; 8 (d) by obtaining the consent of the subscriber or customer to the 9 disclosure of the data; 10 (e) by obtaining a court order; or 11 (f) as otherwise permitted by applicable federal law. 12 3. A provider of telephonic communications service shall disclose to 13 an authorized police officer, without any form of legal process, 14 subscriber listing information, including name, address, and telephone 15 number or similar access code that: 16 (a) the service provides to others in the course of providing publicly 17 available directory or similar assistance; or 18 (b) is solely for use in the dispatch of emergency vehicles and 19 personnel responding to a distress call directed to an emergency 20 dispatch system or when the information is reasonably necessary to aid 21 in the dispatching of emergency vehicles and personnel for the immediate 22 prevention of death, personal injury, or destruction of property. 23 4. A provider of telephonic communications service shall provide an 24 authorized police officer with the name of the subscriber of record 25 whose published telephone number is provided to the service by an 26 authorized police officer. 27 5. Electronic location information may be obtained by an authorized 28 police officer without any form of legal process, if: 29 (a) the device is reported stolen by the owner; or 30 (b) there exists an immediate life-threatening situation. 31 § 5. The criminal procedure law is amended by adding a new section 32 690.65 to read as follows: 33 § 690.65 Search warrants; warrant issued in this state for stored 34 customer data, communications or electronic location informa- 35 tion. 36 1. This section applies to a warrant required under section 690.60 of 37 this article to obtain electronic customer data, including the contents 38 of a wire communication, electronic communication or electronic location 39 information. 40 2. On the filing of an application by an authorized police officer, a 41 district judge may issue a search warrant under this section for elec- 42 tronic customer data held in electronic storage, including the contents 43 of and records and other information related to a wire communication or 44 electronic communication held in electronic storage or electronic 45 location information, by a provider of an electronic communications 46 service or a provider of a remote computing service described by subdi- 47 vision eight of this section, regardless of whether the customer data is 48 held at a location in this state or at a location in another state. An 49 application made under this subdivision must demonstrate probable cause 50 for the issuance of the warrant and must be supported by the oath or 51 affirmation of the authorized police officer. 52 3. A search warrant may not be issued under this section unless the 53 application required by section 690.35 of this article sets forth suffi- 54 cient and substantial facts to establish probable cause that: 55 (a) a specific offense has been committed; andA. 3527 4 1 (b) the electronic customer data or electronic location information 2 sought: 3 (i) constitutes evidence of that offense or evidence that a particular 4 person committed that offense; and 5 (ii) is held in electronic storage by the service provider on which 6 the warrant is served under subdivision seven of this section. 7 4. Only the electronic customer data or electronic location informa- 8 tion described in the application required by section 690.35 of this 9 article may be seized under the warrant. 10 5. The police officer shall execute the warrant not later than the 11 tenth day after the date of issuance, except that the officer shall 12 execute the warrant within a shorter period if so directed in the 13 warrant by the district judge. For purposes of this subdivision, a 14 warrant is executed when the warrant is served in the manner described 15 by subdivision seven of this section. 16 6. A warrant under this section may be served only on a service 17 provider that is a domestic entity or a company or entity otherwise 18 doing business in this state under a contract or a terms of service 19 agreement with a resident of this state, if any part of that contract or 20 agreement is to be performed in this state. The service provider shall 21 produce all electronic customer data, contents of communications, elec- 22 tronic location information, and other information sought, regardless of 23 where the information is held in the United States and within the period 24 allowed for compliance with the warrant, as provided by subdivision 25 eight of this section. A court may find any designated officer, desig- 26 nated director, or designated owner of a company or entity in contempt 27 of court if the person by act or omission is responsible for the failure 28 of the company or entity to comply with the warrant within the period 29 allowed for compliance. The failure of a company or entity to timely 30 deliver the information sought in the warrant does not affect the admis- 31 sibility of that evidence in a criminal proceeding. 32 7. A search warrant issued under this section is served when the 33 authorized police officer delivers the warrant by hand, by facsimile 34 transmission, or, in a manner allowing proof of delivery, by means of 35 the United States mail or a private delivery service to: 36 (a) a person specified by section three hundred five of the business 37 corporation law; 38 (b) the secretary of state in the case of a company or entity to which 39 section three hundred six of the business corporation law applies; or 40 (c) any other person or entity designated to receive the service of 41 process. 42 8. The district judge shall indicate in the warrant that the deadline 43 for compliance by the provider of an electronic communications service 44 or the provider of a remote computing service is the fifteenth business 45 day after the date the warrant is served if the warrant is to be served 46 on a domestic entity or a company or entity otherwise doing business in 47 this state, except that the deadline for compliance with a warrant 48 served in accordance with section three hundred six of the business 49 corporation law, may be extended to a date that is not later than the 50 thirtieth day after the date the warrant is served. The judge may indi- 51 cate in a warrant that the deadline for compliance is earlier than the 52 fifteenth business day after the date the warrant is served if the offi- 53 cer makes a showing and the judge finds that failure to comply with the 54 warrant by the earlier deadline would cause serious jeopardy to an 55 investigation, cause undue delay of a trial, or create a material risk 56 of:A. 3527 5 1 (a) danger to the life or physical safety of any person; 2 (b) flight from prosecution; 3 (c) the tampering with or destruction of evidence; or 4 (d) intimidation of potential witnesses. 5 9. If the authorized police officer serving the warrant under this 6 section also delivers an application form to the provider of an elec- 7 tronic communications service or the provider of a remote computing 8 service responding to the warrant, and the police officer also notifies 9 the provider in writing that an executed application is required, then 10 the provider shall verify the authenticity of the customer data, 11 contents of communications, electronic location information, and other 12 information produced in compliance with the warrant by including with 13 the information the application form completed and sworn to by a person 14 who is a custodian of the information or a person otherwise qualified to 15 attest to its authenticity that states that the information was stored 16 in the course of regularly conducted business of the provider and speci- 17 fies whether it is the regular practice of the provider to store that 18 information. 19 10. On a service provider's compliance with a warrant under this 20 section, an authorized police officer shall file a return of the warrant 21 and a copy of the inventory of the seized property as required under 22 section 690.50 of this article. 23 11. The district judge shall hear and decide any motion to quash the 24 warrant not later than the fifth business day after the date the service 25 provider files the motion. The judge may allow the service provider to 26 appear at the hearing by teleconference. 27 12. A provider of an electronic communications service or a provider 28 of a remote computing service responding to a warrant issued under this 29 section may request an extension of the period for compliance with the 30 warrant if extenuating circumstances exist to justify the extension. The 31 district judge shall grant a request for an extension based on those 32 circumstances if: 33 (a) the authorized police officer who applied for the warrant or 34 another appropriate authorized police officer agrees to the extension; 35 or 36 (b) the district judge finds that the need for the extension outweighs 37 the likelihood that the extension will cause an adverse circumstance 38 described by subdivision eight of this section. 39 § 6. The criminal procedure law is amended by adding a new section 40 690.70 to read as follows: 41 § 690.70 Search warrants; warrant issued in another state for stored 42 customer data, communications or electronic location informa- 43 tion. 44 Any domestic entity that provides electronic communications services 45 or remote computing services to the public shall comply with a warrant 46 issued in another state and seeking information described in subdivision 47 two of section 690.65 of this article, if the warrant is served on the 48 entity in a manner equivalent to service of process required by subdivi- 49 sion eight of section 690.65 of this article. 50 § 7. The criminal procedure law is amended by adding a new section 51 690.75 to read as follows: 52 § 690.75 Search warrants; back-up preservation for stored customer data, 53 communications or electronic location information. 54 1. A subpoena or court order for disclosure of certain electronic 55 customer data or electronic location information held in electronic 56 storage by a provider of an electronic communications service or aA. 3527 6 1 provider of a remote computing service may require that provider to 2 create a copy of the customer data or electronic location information 3 sought by the subpoena or court order for the purpose of preserving that 4 data. The provider may not inform the subscriber or customer whose data 5 is being sought that the subpoena or court order has been issued. The 6 provider shall create the copy within a reasonable time as determined by 7 the court issuing the subpoena or court order. 8 2. The provider of an electronic communications service or the provid- 9 er of a remote computing service shall immediately notify the authorized 10 police officer who presented the subpoena or court order requesting the 11 copy when the copy has been created. 12 3. The authorized police officer shall notify the subscriber or 13 customer whose electronic customer data or electronic location informa- 14 tion is the subject of the subpoena or court order of the creation of 15 the copy not later than three days after the date of the receipt of the 16 notification from the applicable provider that the copy was created. 17 4. The provider of an electronic communications service or the provid- 18 er of a remote computing service shall release the copy to the request- 19 ing authorized police officer not earlier than the fourteenth day after 20 the date of the police officer's notice to the subscriber or customer if 21 the provider has not: 22 (a) initiated proceedings to challenge the request of the police offi- 23 cer for the copy; or 24 (b) received notice from the subscriber or customer that the subscrib- 25 er or customer has initiated proceedings to challenge the request. 26 5. The provider of an electronic communications service or the provid- 27 er of a remote computing service may not destroy or permit the 28 destruction of the copy until the electronic customer data or electronic 29 location information has been delivered to the applicable law enforce- 30 ment agency or until the resolution of any court proceedings, including 31 appeals of any proceedings, relating to the subpoena or court order 32 requesting the creation of the copy, whichever occurs last. 33 6. An authorized police officer who reasonably believes that notifica- 34 tion to the subscriber or customer of the subpoena or court order would 35 result in the destruction of or tampering with electronic customer data 36 or electronic location information sought may request the creation of a 37 copy of the data. The police officer's belief is not subject to chal- 38 lenge by the subscriber or customer or by a provider of an electronic 39 communications service or a provider of a remote computing service. 40 7. (a) A subscriber or customer who receives notification as described 41 in subdivision three of this section may file a written motion to quash 42 the subpoena or vacate the court order in the court that issued the 43 subpoena or court order not later than the fourteenth day after the date 44 of the receipt of the notice. The motion must contain an affidavit or 45 sworn statement stating: 46 (i) that the applicant is a subscriber or customer of the provider of 47 an electronic communications service or the provider of a remote comput- 48 ing service from which the electronic customer data or electronic 49 location information held in electronic storage for the subscriber or 50 customer has been sought; and 51 (ii) the applicant's reasons for believing that the customer data or 52 electronic location information sought is not relevant to a legitimate 53 law enforcement inquiry or that there has not been substantial compli- 54 ance with the provisions of this article in some other respect. 55 (b) The subscriber or customer shall give written notice to the 56 provider of an electronic communications service or the provider of aA. 3527 7 1 remote computing service of the challenge to the subpoena or court 2 order. The authorized police officer requesting the subpoena or court 3 order must be served a copy of the papers filed by personal delivery or 4 by registered or certified mail. 5 8. (a) The court shall order the authorized police officer to file a 6 sworn response to the motion filed by the subscriber or customer if the 7 court determines that the subscriber or customer has complied with the 8 requirements of subdivision seven of this section. On request of the 9 police officer, the court may permit the response to be filed in camera. 10 The court may conduct any additional proceedings the court considers 11 appropriate if the court is unable to make a determination on the motion 12 on the basis of the parties' initial allegations and response. 13 (b) The court shall rule on the motion as soon after the filing of the 14 officer's response as practicable. The court shall deny the motion if 15 the court finds that the applicant is not the subscriber or customer 16 whose electronic customer data or electronic location information held 17 in electronic storage is the subject of the subpoena or court order or 18 that there is reason to believe that the police officer's inquiry is 19 legitimate and that the customer data sought is relevant to that 20 inquiry. The court shall quash the subpoena or vacate the order if the 21 court finds that the applicant is the subscriber or customer whose data 22 is the subject of the subpoena or court order and that there is not a 23 reason to believe that the data is relevant to a legitimate law enforce- 24 ment inquiry or that there has not been substantial compliance with the 25 provisions of this article. 26 (c) A court order denying a motion or application under this section 27 is not a final order and no interlocutory appeal may be taken from the 28 denial. 29 § 8. The criminal procedure law is amended by adding a new section 30 690.80 to read as follows: 31 § 690.80 Search warrants; preclusion of notification for stored customer 32 data, communications or electronic location information. 33 1. An authorized police officer seeking electronic customer data or 34 electronic location information may apply to the court for an order 35 commanding the service provider to whom a warrant, subpoena, or court 36 order is directed not to disclose to any person the existence of the 37 warrant, subpoena, or court order. The order is effective for the period 38 the court considers appropriate. The court shall enter the order if the 39 court determines that there is reason to believe that notification of 40 the existence of the warrant, subpoena, or court order will have an 41 adverse result. 42 2. In this section, an "adverse result" means: 43 (a) endangering the life or physical safety of an individual; 44 (b) flight from prosecution; 45 (c) destruction of or tampering with evidence; 46 (d) intimidation of a potential witness; or 47 (e) otherwise seriously jeopardizing an investigation or unduly delay- 48 ing a trial. 49 § 9. The criminal procedure law is amended by adding a new section 50 690.85 to read as follows: 51 § 690.85 Search warrants; reimbursement of costs for stored customer 52 data, communications or electronic location information. 53 1. Except as provided by subdivision three of this section, an author- 54 ized police officer who obtains information under this article shall 55 reimburse the person assembling or providing the information for all 56 costs that are reasonably necessary and that have been directly incurredA. 3527 8 1 in searching for, assembling, reproducing, or otherwise providing the 2 information. These costs include costs arising from necessary disruption 3 of normal operations of an electronic communications service or remote 4 computing service in which the information may be stored. 5 2. The authorized police officer and the person providing the informa- 6 tion may agree on the amount of reimbursement. If there is no agreement, 7 the court that issued the order for production of the information shall 8 determine the amount. If no court order was issued for production of 9 the information, the court before which the criminal prosecution relat- 10 ing to the information would be brought shall determine the amount. 11 3. Subdivision one of this section does not apply to records or other 12 information maintained by a communications common carrier that relate to 13 telephone toll records or telephone listings unless the court determines 14 that the amount of information required was unusually voluminous or that 15 an undue burden was imposed on the provider. 16 § 10. The criminal procedure law is amended by adding a new section 17 690.90 to read as follows: 18 § 690.90 Search warrants; stored customer data, communications or elec- 19 tronic location information; no cause of action. 20 A subscriber or customer of a provider of an electronic communications 21 service or a provider of a remote computing service does not have a 22 cause of action against a provider or its officers, employees, or agents 23 or against other specified persons for providing information, facili- 24 ties, or assistance as required by a court order, warrant, subpoena, or 25 certification under this article. 26 § 11. The criminal procedure law is amended by adding a new section 27 690.95 to read as follows: 28 § 690.95 Search warrants; stored customer data, communications or elec- 29 tronic location information; cause of action. 30 Except as provided by section 690.90 of this article, a provider of an 31 electronic communications service or a provider of a remote computing 32 service, or a subscriber or customer of that provider, that is aggrieved 33 by a violation of this article has a civil cause of action if the 34 conduct constituting the violation was committed knowingly or inten- 35 tionally and is entitled to: 36 1. injunctive relief; 37 2. a reasonable attorney's fee and other litigation costs reasonably 38 incurred; and 39 3. the sum of the actual damages suffered and any profits made by the 40 violator as a result of the violation or one thousand dollars, whichever 41 is more. 42 § 12. The criminal procedure law is amended by adding a new section 43 690.96 to read as follows: 44 § 690.96 Search warrants; annual report of warrants and orders. 45 1. No later than January fifteenth of each year, a provider of an 46 electronic communication service or a provider of a remote computing 47 service doing business in this state shall report to the office of 48 public safety the following information for the preceding calendar year, 49 disaggregated by each law enforcement agency in this state making the 50 applicable requests: 51 (a) the number of requests made for pen register or trap and trace 52 information; 53 (b) the number of requests made for ESN reader information; 54 (c) the number of requests made for location information; 55 (d) the number of individuals whose location information was 56 disclosed; andA. 3527 9 1 (e) the amount that each law enforcement agency was billed by the 2 communication common carrier or electronic communications service for 3 each request made under paragraph (a), (b) or (c) of this subdivision. 4 2. No later than the thirtieth day after the date of expiration of a 5 warrant or order issued under this article or an order extending the 6 period of a warrant or order issued under this article, or no later than 7 the thirtieth day after the date the court denies an application for a 8 warrant or order under this article, the court shall submit to the 9 office of public safety the following information, as applicable: 10 (a) the receipt of an application for a warrant or order under this 11 article; 12 (b) the type of warrant or order for which the application was made; 13 (c) whether any application for an order of extension was granted, 14 granted as modified by the court, or denied; 15 (d) the period of monitoring authorized by the warrant or order and 16 the number and duration of any extensions of the warrant or order; 17 (e) the offense under investigation, as specified in the application 18 for the warrant or order or an extension of the warrant or order; and 19 (f) the law enforcement agency or prosecutor that submitted an appli- 20 cation for the warrant or order or an extension of the warrant or order. 21 3. No later than January fifteenth of each year, each prosecutor that 22 submits an application for a warrant or order or an extension of a 23 warrant or order under this article shall submit to the office of public 24 safety the following information for the preceding calendar year; 25 (a) the information required to be submitted by a court with respect 26 to each application submitted by the prosecutor for the warrant or order 27 or an extension of the warrant or order; 28 (b) a general description of information collected under each warrant 29 or order that was issued by the court, including the approximate number 30 of individuals for whom location information was intercepted and the 31 approximate duration of the monitoring of the location information of 32 those individuals; 33 (c) the number of arrests made as a result of information obtained 34 under a warrant or order issued under this article; 35 (d) the number of criminal trials commenced as a result of information 36 obtained under a warrant or order issued under this article; and 37 (e) the number of convictions obtained as a result of information 38 obtained under a warrant or order issued under this article. 39 4. Information submitted to the office of public safety under this 40 section is public information and subject to disclosure. 41 5. No later than March first of each year, the office of public safety 42 shall submit a report to the governor, the state attorney general, the 43 speaker of the assembly, and the chairs of the standing committees of 44 the senate and assembly with primary jurisdiction over criminal justice. 45 The report must contain the following information for the preceding 46 calendar year: 47 (a) an assessment of the extent of tracking or monitoring by law 48 enforcement agencies of pen register, trap and trace, ESN reader, and 49 location information; 50 (b) a comparison of the ratio of the number of applications for 51 warrants or orders made under this article to the number of arrests and 52 convictions resulting from information obtained under a warrant or order 53 issued under this article; 54 (c) identification of the types of offenses investigated under a 55 warrant or order issued under this article; andA. 3527 10 1 (d) with respect to both state and local jurisdictions, an estimate of 2 the total cost of conducting investigations under a warrant or order 3 issued under this article. 4 § 13. The criminal procedure law is amended by adding a new section 5 690.97 to read as follows: 6 § 690.97 Search warrants; stored customer data, communications and elec- 7 tronic location information and use in a court of law. 8 Stored customer data, communications and electronic location informa- 9 tion obtained without any form of legal process and not pursuant to 10 section 690.60 of this article shall be inadmissible in a court of law. 11 § 14. This act shall take effect immediately.