FOUNDATIONS
Data already sitting on a provider’s server is considered what?
Stored communications
The body of an email is considered what?
Content
What does a preservation letter do?
Prevents deletion of data
Which legal tool has the highest bar for approval?
Title III wiretap
Investigators want old cloud-stored emails. Stored or real-time?
Stored
Capturing communications as they occur is considered what?
Real-time interception
IP addresses and timestamps are considered what?
Metadata
How long does a preservation letter typically last?
90 days
Title III wiretaps are typically authorized for how long?
30 days
Investigators want live phone call audio. What authority applies?
Title III
Pen/Trap captures content or metadata?
Metadata
Metadata generally requires a lower or higher legal threshold than content?
Lower
A 2703(d) order requires what level of proof?
Specific articulable facts
Which authority captures real-time metadata only?
Pen Register / Trap & Trace
Investigators want IP logs from an ISP. Content or metadata?
Metadata
Real-time content interception generally requires what authority?
Title III wiretap
A subject line of an email is content or metadata?
Content
Content of stored emails generally requires what?
A warrant
Which legal tool is commonly used for stored provider records without content?
2703(d) order
Freezing data before legal process uses what tool?
Preservation letter
A PCAP collected after the fact is considered stored or real-time?
Stored
Pen/Trap statutes explicitly exclude what?
Content
Preservation equals production — true or false?
False
What must be shown for a criminal warrant?
Probable cause
Stored data older than 180 days historically fell under which statute?
ECPA / SCA