Snap Inc.   Law Enforcement Guide Last Updated: September 21, 2018 Download the most recent version at https://www.snapchat.com/lawenforcement Contact Information for Law Enforcement Sending Legal Process and Related Inquiries We accept service of legal process and general questions from law enforcement via email or mail. Note: Receipt of law enforcement requests by these means is for convenience only and does not waive any objections or legal rights of Snap Inc. or its users. Email: lawenforcement@snapchat.com Mail: Custodian of Records Snap Inc. 2772 Donald Douglas Loop North Santa Monica, CA 90405 Requesting Emergency Law Enforcement Assistance For emergency law enforcement assistance, complete and submit the Law Enforcement Emergency Response Form: https://lawenforcement.snapchat.com/emergency Note: This form is for use only by sworn law enforcement officials requiring emergency assistance regarding a threat of imminent death or bodily injury. All other inquiries from law enforcement must be directed to the email address above. Table of Contents I. Snap and Law Enforcement Overview 2 II. Snap User Notice Policy 3 III. How Snapchat Works 4 IV. Identifying a Snapchat Account 6 V. Required Legal Process 8 VI. Preservation Requests 11 VII. Emergency Requests 12 VIII. Testimony 12 IX. Sample Language and Forms for Legal Process Requests 13 1 I. Snap and Law Enforcement Overview Snapchat is a mobile application made by Snap Inc. (“Snap”) and available through the iPhone App Store and Google Play Store. The Snapchat app provides users a way to share moments with photos, videos, and chats. This guide provides information for law enforcement officials seeking records from Snap. U.S. Legal Process Requirements Snap discloses account records solely in accordance with our Terms of Service, the Stored Communications Act, 18 U.S.C. §2701, et seq. (“SCA”), and other applicable laws. The SCA mandates that we disclose certain user data to law enforcement only in response to specific types of legal process, including subpoenas, court orders, and search warrants. Generally, the SCA authorizes law enforcement to compel us to disclose basic subscriber information, non-content account information, and account content (as described in Section V “Required Legal Process” below) in response to appropriate legal process. International Legal Process Requirements Non-U.S. governmental and law enforcement agencies must rely on the mechanics of the Mutual Legal Assistance Treaty (“MLAT”) or letters rogatory processes to seek user information from Snap. As a courtesy to international law enforcement, we will review and respond to properly submitted preservation requests (see Section VI “Preservation Requests” below) while the MLAT or letters rogatory process is undertaken. Snap may, at its discretion, provide limited user account information to government agencies outside of the U.S. on an emergency basis when we believe that doing so is necessary to prevent death or serious physical harm to someone. Support for Law Enforcement Because Snap is committed to assisting law enforcement investigations as the law requires, we provide email support to law enforcement agencies for non-emergency matters, and 24-hour online service for emergency situations involving the threat of imminent death or bodily injury. Contact information for our Law Enforcement Operations team is provided on the cover of this guide. Please note that Snap cannot provide legal advice to law enforcement officials. If you need clarification about SCA’s restrictions on providers like Snap, please contact the Department of Justice’s Computer Crime and Intellectual Property Section (CCIPS) at 202-514-1026 and ask to speak to the Duty Attorney. 2 II. Snap User Notice Policy Our policy is to notify affected Snapchat users when we receive legal process seeking their records, information, and content. Before we respond to the legal process, we allow affected users seven days to challenge the legal process in court and to provide us a file-stamped copy of the challenge. However, we do not provide such user notice when: (1) providing notice is prohibited by a court order issued under 18 U.S.C. § 2705(b) or by other legal authority; or (2) we believe an exceptional circumstance exists, such as cases involving child exploitation or the threat of imminent death or bodily injury. To minimize delays related to user notice, you can take one of the following steps, if applicable: 1. Inform us upfront that you have no objection to us notifying affected users of your legal process. This saves us the step of notifying you of Snap’s user notice policy and awaiting your confirmation that you have no objection. 2. Provide a court order consistent with 18 U.S.C. § 2705(b) that prohibits us from providing notice to affected users. 3. Provide an appropriate legal basis for prohibiting us from providing notice to affected users. 4. Inform us that your case involves child exploitation, or the threat of imminent death or bodily injury, and provide an appropriate legal and factual basis for us to independently make that determination. 3 III. How Snapchat Works The following is an overview of how the Snapchat app works. Additional information is available on the Snapchat Support Site at https://support.snapchat.com. Snaps Snaps are photos or videos taken using the Snapchat app’s camera on an individual’s mobile device, and may be shared directly with the user’s friends, or in a Story (explained below) or Chat. Snap’s servers are designed to automatically delete a Snap after it has been viewed by all intended recipients. Snap’s servers are designed to automatically delete an unopened Snap sent directly to a recipient after 30 days and an unopened Snap in Group Chat after 24 hours. Stories A user can add Snaps to their “Story”. A Story is a collection of Snaps displayed in chronological order. Users can manage their privacy settings so that their Story can be viewed by all Snapchatters, their friends, or a custom audience. A user can also submit their Snaps to our crowd-sourced service “Our Story”, which enables their Snaps to be viewed by all Snapchatters in Search and Snap Map. Snap’s servers are designed to automatically delete a Snap in a user’s Story 24 hours after the user posts the Snap, but the user may delete part or all of the Story earlier. Submissions to Our Story may be saved for longer periods of time. Memories Memories is Snapchat’s cloud-storage service. Users can save their sent or unsent Snaps, posted Stories, and photos and videos from their phone’s photo gallery in Memories. Content saved in Memories is backed up by Snap and may remain in Memories until deleted by the user. Users may encrypt their content in Memories (called “My Eyes Only”), in which case the content is not accessible to Snap and cannot be decrypted by Snap. 4 Chat A user can type messages, send Snaps, audio notes, and video notes to friends within the Snapchat app using the Chat feature. Our servers are designed to automatically delete one-to-one chats once the recipient has opened the message and both the sender and recipient have left the chat screen, depending on the user’s chat settings. Snap’s servers are designed to automatically delete unopened one-to-one chats in 30 days. Users can also chat in groups. Chats sent in groups are deleted after 24 hours whether they are opened or not. A user can save a message in Chat by pressing and holding the message. The user can unsave the message by pressing and holding it again. This will delete it from our servers. Users can also delete chats that they have sent to a recipient before the recipient has opened the chat or after the recipient has saved the chat. Location Data If a user has device-level location services turned on and has opted into location services on Snapchat, Snap will collect location data at various points during the user’s use of Snapchat, and retention periods for location data vary depending on the purpose of the collection. Users have some control over the deletion of their location data in the app settings. 5 IV. Identifying a Snapchat Account Before sending us a legal request, law enforcement must first identify the username of the account. Note: Users and law enforcement often confuse an account's username with an account’s display name (also referred to as a vanity name). We cannot locate an account by a display name. Snapchat Username A Snapchat username is a unique identifier associated with a specific Snapchat account, and it cannot be changed by the user. A display name, on the other hand, is not a unique identifier and can be created and changed by a user to indicate how the user will appear within the app. A user can also change a friend’s display name to determine how that friend will appear to that particular user on the app, similar to how one can customize contact names on a smartphone. Snapchat username attributes: • Must be 3-15 characters long • Must begin with a letter • Can only contain letters, numbers, and the special characters hyphen ( - ), underscore ( _ ), and period ( . ) • Cannot end with a hyphen, underscore, or period • Cannot contain spaces • Cannot contain emojis or other symbols such as @, $, #, etc. • Will appear only in lower-case letters within the app Unlike a username, a display name can contain special characters and symbols beyond hyphen, underscore, or period, as well as spaces, emojis, and capital letters. 6 Example of Snapchat username and display name: Display Name Not Unique. Cannot be used to locate Snapchat account. Username Unique. Can be used to locate Snapchat account. (The image above is a popup in Snapchat that can be accessed by pressing and holding on a user found within Search or a Chat screen.) In the example above, the username is “niknak_111” and the display name has been set to “Niki”, which appears above the username. Note that there can be only one Snapchat user with the username “niknak_111”, but any number of users with the display name “Niki”. If a display name has not been created, the username will appear instead. TIP: If you are unsure if you have the correct username, type it into the Snapchat Search screen to see if it appears. If it does not appear, then it does not exist or may have been deleted. Note: Some deleted accounts may still have some limited information stored depending on various factors. If you are unable to identify a username, we can try — with varying degrees of success — to locate the account with a phone number or email address. For context, Snap does not require users to submit a phone number or email address to create a Snapchat account. Because phone numbers and email addresses can easily be changed by users, this information has historically not been reliable in identifying users. Note: We are unable to locate Snapchat accounts based on any of the following data: display name, real name, date of birth, street address, social security number, and photos. 7 V. Required Legal Process Sending Legal Process to Snap Please send all law enforcement criminal legal process and preservation requests (see Section VI “Preservation Requests” below) by email to lawenforcement@snapchat.com. Although we accept service of law enforcement criminal legal process by U.S. mail and overnight courier services delivered to the address provided on the cover of this guide, our response time will be significantly slower. Note: We do not utilize fax service and are unable to accept service of criminal legal process by fax. Legal Process Requirements Overview We can release user data on a non-emergency basis only if we receive law enforcement criminal legal process that fully complies with the law. The legal process should be submitted on a non-editable static file (such as PDF), name “Snap Inc.” as the Custodian of Record, and should be dated and signed. To facilitate a prompt response when requesting data for more than one user (i.e., multiple usernames), those requests should be included in one legal process document. When providing legal process requesting production of user data, please include the following details: Snapchat username (see Section IV “Identifying a Snapchat Account” above) The specific type of data you are seeking (see below) Any applicable due date Response contact information (preferably an email address, or if not, then a non-P.O. box physical address) • If you object to us notifying affected users and why (see Section II “Snap User Notice Policy” above) • • • • The required legal process varies depending on the type of user data you seek, as described below. Please also see Section VI below regarding preservation requests. 8 Basic Subscriber Information Basic subscriber information is collected when a user creates a new Snapchat account, alters information at a later date, or otherwise interacts with the Snapchat app. Basic subscriber information may include: • • • • • • Snapchat username Email address Phone number Display name Snapchat account creation date and IP address Timestamp and IP address of account logins and logouts Note: Not all information listed above is required for a user to use the app, and Snap does not independently verify user-provided subscriber information. The basic subscriber information entered by a user in creating an account is maintained as long as the user has not edited the information or removed the information from the account. Once the user makes a change, the previously existing information is overwritten. Upon receipt of a preservation request (see Section VI below), however, we can attempt to capture the user data available at that time; and future actions by the user will not affect the preserved user data. We also retain logs containing IP addresses associated with account login and logout for a limited period of time after the user has deleted their Snapchat account. Legal process required for basic subscriber information: Basic subscriber information can be obtained through a subpoena (including one issued by a grand jury), administrative subpoena, or civil investigative demand pursuant to 18 U.S.C. § 2703(c)(2); a court order issued in accordance with 18 U.S.C. § 2703(d); or a federal or state search warrant. Logs of Previous Snaps, Stories, and Chats Logs contain metadata about a user’s Snaps, Stories, and Chats, but not the user’s content. Legal process required for logs: Logs of previous Snaps, Stories, and Chats can be obtained pursuant to a court order under 18 U.S.C. § 2703(d) or a federal or state search warrant. 9 9 Location Data Location data may be available for a Snapchat user who has turned on location services on their device and opted into location services in the app settings. Legal process required for location data: Location data, to the extent available, can be obtained pursuant to a federal or state search warrant. Content Because Snap’s servers are designed to automatically delete most user content as described in Section III “How Snapchat Works” above, and because much of a user’s content is encrypted, we often cannot retrieve user content except in very limited circumstances. Memories content may be available until deleted by a user. My Eyes Only content is encrypted, and although we can provide the data file, we have no way to decrypt the data. Legal process required for message content or media content: Content, to the extent available, can be obtained pursuant to a federal or state search warrant. 10 VI. Preservation Requests Because Snapchat user data is not retained for a long period of time, it is important that law enforcement understands the concept of preservations and why it is important to request them. A preservation is a snapshot in time of a user’s data, including basic subscriber information, metadata (usage logs) and content (Chats, Snaps, Stories, and Memories). As referenced earlier, Snap retains different types of user data for different periods of time. It is likely that law enforcement would want Snap to make a preservation as soon as possible after an alleged incident for which it seeks evidence. We honor formal requests from law enforcement to preserve user data in accordance with 18 U.S.C. § 2703(f). Upon receiving a signed and dated preservation request on law enforcement department letterhead, we will attempt to preserve available account information associated with any properly identified Snapchat users (see Section IV “Identifying a Snapchat Account” above) in an offline file for up to 90 days and will extend the preservation for one additional 90-day period with a formal extension request. If you require an extension, submit a formal signed and dated preservation extension request on law enforcement department letterhead. The request needs to stipulate that it is an extension request and not an original preservation request. Note: 18 U.S.C. § 2703(f) does not contemplate “serial” preservation requests or multiple extension requests beyond one additional 90-day period. Accordingly, we do not comply with such requests. 11 VII. Emergency Requests Sworn law enforcement officials may request user data on an emergency basis 24 hours a day by completing and submitting the Law Enforcement Emergency Response Form: https://lawenforcement.snapchat.com/emergency Emergency requests must be submitted by a sworn law enforcement official and must come from an official law enforcement email domain. When filling out the emergency form, please provide the Snapchat username (see Section IV “Identifying a Snapchat Account” above) or associated phone number or email address, describe the nature of the emergency as specifically as possible, and specify the information that you are seeking to resolve the emergency situation. Under 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4), we are able to voluntarily disclose information when we believe in good faith that an emergency posing a threat of imminent death or serious bodily injury requires immediate disclosure. VIII. Testimony Snap does not provide expert witness testimony. However, data productions made to law enforcement will be accompanied by a signed Certificate of Authenticity, which should eliminate the need for the testimony of a Custodian of Records. 12 IX. Sample Language and Forms for Legal Process Requests This section provides sample language that law enforcement may use to complete their request for basic subscriber information, logs of previous Snaps, or preservation of a Snapchat account. As a reminder, please send legal process requests to lawenforcement@snapchat.com. Sample Language to Request Basic Subscriber Information “Basic subscriber information for the Snapchat account(s) associated with the username(s) ___________________ consisting of the email address, phone number, account creation date, and timestamps and IP address for account logins/logouts.” Sample Language to Request Logs of Previous Snaps “Logs, including sender, recipient, date, and time, concerning the previous Snaps sent to or from the Snapchat account(s) with the username(s) ________________. ” Sample Preservation Request Letter (Must be on law enforcement department letterhead, dated, signed, and sent from an official governmental email address.) Dear Custodian of Records: The below listed account(s) is(are) the subject of an ongoing criminal investigation at this agency, and it is requested pursuant to 18 U.S.C. § 2703(f) that records associated with said account(s) be preserved pending the issuance of a search warrant or other legal process seeking disclosure of such information: [Specify Snapchat account username(s) or associated email address(es) or phone number(s) to be preserved (See Section IV, above).] I understand that Snap Inc. reserves the right to delete any account that violates its Terms of Service. If you have any questions concerning this request please contact me at [insert email address and phone contact]. Sincerely, (Your Signature) (Your Name and Title Typed) 13