Subpoena to Encrypted App Provider Highlights Overbroad FBI Requests for Information

"According to Al Gidari, the director of privacy at Stanford University’s Center for Internet and Society and a former attorney for many of the major technology companies — requests for transactional data for an application like Signal should probably require a court order rather than a subpoena, or what’s known as a 2703 (d) order.

“I would say that upstream and downstream providers as listed in the Signal subpoena is outside the scope” of what FBI can ask for, he wrote in an email. He compared this information to “email header information.”

Gidari says that the way the FBI wrote the request, asking for things like upstream and downstream providers, suggests it understands the meaningful difference between Internet communications and phone calls. “I get that they don’t like the limitation, but Congress chose a long time ago to treat internet communications metadata differently than phone call metadata,” he wrote."