Metadata

Abstract # Technical analysis of how metadata from telecommunications, messaging, and payments can identify, locate, and profile individuals in crisis situations—risks that persist even when content is encrypted.

The Electronic Communications Privacy Act of 1986 established the legal framework for government access to electronic communications in the US. It has three main parts: Title I (Wiretap Act) requires warrants for real-time interception of content. Title II (Stored Communications Act) governs access to stored communications with varying standards—a warrant for content under 180 days old, but only a subpoena for older content (though DOJ policy now requires warrants). Title III (Pen Register Act) covers metadata collection with minimal judicial oversight. ECPA’s framework predates cloud computing and treats email stored on servers differently than physical mail. Courts have struggled to apply 1986 concepts to modern services. The CLOUD Act amended ECPA to clarify extraterritorial application. For international users, ECPA’s relatively weak protections for stored data and metadata are a concern when using US services.