South Bronx Blog: Obtaining NYC DOE Personnel's Emails

Sunday, January 4, 2015

Your Guide To Fun With Google Mail

LINK

Francesco Portelos has been MIA since December 23 and I figured I might pick up the
slack (Yes, it is unsolicited, but what the heck?) of a little primer of my own (Not taking anything away from DTOE's own resource's page) which I hope can be added over there. And when Francesco is found he can add anything to this if he so wishes. 

The NYCDOE uses Outlook for all it's email purposes. However, all Outlook email is subject to FOIL and any and all discovery requests in a court of law. The NYCDOE is
a public entity and all those working for the NYCDOE are in the realm of public employees. 

Even if the emails are deleted they are stored indefinitely in servers at, I believe, MetroTech. 

But some people, and not just at the NYCDOE, have figured out a way around
using "official" email. As someone in government said to me, "Here is my personal
email. Use this to communicate with me it is not FOILable."

But back to the NYCDOE. Yes, some schools have set up email domains and
accounts through third parties. GoDaddy, Yahoo, Hotmail, and yes, even Google Mail
or as we call it, Gmail with their owndomains. 

But let's focus on Google mail.

Through Google mail one can have their on domain (instead of @gmail.com one can
have something like, @failingschool.com) which might make one think they are
impervious to any FOIL requests or discovery requests.

This is false.

Once a private email provider (In this case Gmail) is used to discuss business, especially
one like a government agency that email account is than considered to be a government account subject to all laws of FOIL and discovery. 


But Kevin Smith of Fort Lee NJ asks a question;

"What if the emails in question have been deleted by the account? Then what?"

Good question Kevin!

The Crack Team checked with several people in the industry and with people at Google.
The answers we got back were pretty much the same;

"With over a million servers world wide the deleted emails remain on the Google servers forever"

See, problem solved Kevin. We guess Kevin won't be deleting any emails anytime soon, right Kev?

But how does one get those emails? This was the question put forth to us by Kevin Jones
of Fort Lee NJ.

Thank you Kevin, The Crack Team has researched your questions and please click here 
and for those who can;t wait some of the highlights are below.

We here at SBSB hope that this post and the information below can and will be helpful.

What kinds of data do you disclose for different products?

To answer that, let's look at four services from which government agencies in the U.S. commonly request information: Gmail, YouTube, Google Voice and Blogger. Here are examples of the types of data we may be compelled to disclose, depending on the ECPA legal process, the scope of the request, and what is requested and available. If we believe
a request is overly broad, we will seek to narrow it.

Gmail

Subpoena:

• Subscriber registration information (e.g., name, account creation information, associated email addresses, phone number)
• Sign-in IP addresses and associated time stamps

Court Order:

• Non-content information (such as non-content email header information)
• Information obtainable with a subpoena

What's the difference between a subpoena, a search warrant and a court order under ECPA? And what information can a government agency get from Google with each?

It's complex, but here's a summary of the different forms of legal process covered by ECPA:

Subpoena

Of the three types of ECPA legal process for stored information, the subpoena

has the lowest threshold for a government agency to obtain. In many jurisdictions, including the federal system, there is no requirement that a judge or magistrate

review a subpoena before the government can issue it. A government agency can

use a subpoena to compel Google to disclose only specific types of information

listed in the statute. For example, a valid subpoena for your Gmail address could compel us to disclose the name that you listed when creating the account, and the

IP addresses from which you created the account and signed in and signed out

(with dates and times). Subpoenas can be used by the government in both criminal

and civil cases.

On its face, ECPA seems to allow a government agency to compel a communications provider to disclose the content of certain types of emails and other content with a subpoena or an ECPA court order (described below). But Google requires an ECPA search warrant for contents of Gmail and other services based on the Fourth Amendment to the U.S. Constitution, which prohibits unreasonable search and seizure.

ECPA Court Order

Unlike an ECPA subpoena, obtaining an ECPA court order requires judicial review. To receive an ECPA court order, a government agency must present specific facts to a judge or magistrate demonstrating that the requested information is relevant and material to an ongoing criminal investigation.

With such a court order, a government agency can obtain the same information as a subpoena, plus more detailed information about the use of the account. This could include the IP address associated with a particular email sent from that account or used to change the account password (with dates and times), and the non-content portion of email headers such as the "from," "to" and "date" fields. An ECPA court order is available only for criminal investigations.

Does a law enforcement agency in the U.S. have to use legal process to compel Google to provide user data or will a phone call be enough?

The government needs legal process—such as a subpoena, court order or search warrant—to force Google to disclose user information. Exceptions can be made in certain emergency cases, though even then the government can't force Google to disclose.