Preview
1 W. DOUGLAS SPRAGUE (202121)
COVINGTON & BURLING LLP
2 Salesforce Tower ELECTRONICALLY
3 15 Mission Street, Suite 5400 F I L E D
San Francisco, California 94105-2533 Superior Court of California,
County of San Francisco
4 Telephone: (415) 591-6000
Facsimile: (415) 591-6091 07/16/2020
5 Email: dsprague@cov.com Clerk of the Court
BY: EDNALEEN ALEGRE
Deputy Clerk
6 ALEXANDER A. BERENGAUT (pro hac vice pending)
MEGAN A. CROWLEY (pro hac vice pending)
7 COVINGTON & BURLING, LLP
8 One City Center
850 Tenth Street, NW
9 Washington, DC 20001-4956
Telephone: (202) 662-5367
10 Facsimile: (202) 662-6291
Email: aberengaut@cov.com
11
mcrowley@cov.com
12
Attorneys for Respondent GitHub, Inc.
13
SUPERIOR COURT FOR THE STATE OF CALIFORNIA
14 FOR THE COUNTY OF SAN FRANCISCO
15 EX PARTE. Case No. CPF-20-517083
Joseph Colone
16 GITHUB, INC.’S OPPOSITION TO
APPLICANT MOTION TO COMPEL PRODUCTION
17 OF RECORDS PURSUANT TO
CAL. PENAL CODE § 1334.2;
18 DECLARATION OF W. DOUGLAS
SPRAGUE
19
Honorable Judge Ethan P. Schulman
20 Department: 302
21 Hearing Date: July 28, 2020
Hearing Time: 9:00 a.m.
22
23
24
25
26
27
28
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 TABLE OF CONTENTS
2 Page(s)
3 INTRODUCTION..........................................................................................................................6
4 FACTUAL BACKGROUND ........................................................................................................ 7
5 ARGUMENT ............................................................................................................................... 11
6 I. The Subpoena Violates and Is Preempted By Federal Law. ........................................... 11
7 A. GitHub Is Regulated by the SCA......................................................................... 11
8 B. The Subpoena Violates the SCA’s Prohibition on Disclosure. ........................... 12
9 II. Section 1334.2 Does Not Authorize the Relief Applicant Seeks. ................................... 15
10 III. Applicant Has Not Satisfied the Requirements of Section 1334.2. ................................. 18
11 CONCLUSION............................................................................................................................ 19
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
2
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 TABLE OF AUTHORITIES
2 Page(s)
3 Cases
4
Barber v. Page
5 (1968) 390 U.S. 719................................................................................................................17
6 In re Barnett
(2003) 31 Cal.4th 466 .............................................................................................................17
7
Crispin v. Christian Audigier, Inc.
8 (C.D. Cal. 2010) 717 F. Supp. 2d 965 ....................................................................................13
9 Dist. Title v. Warren
10 (D.D.C. Dec. 23, 2016) 2016 WL 10749155..........................................................................20
11 Facebook, Inc. v. Super. Ct.
(2018) 4 Cal. 5th 1245 ......................................................................................................12, 20
12
Facebook v. Wint
13 (D.C. 2019) 199 A.3d 625 ......................................................................................................16
14 France v. Super. Ct.
15 (1927) 201 Cal. 122 ................................................................................................................17
16 In re Grothe
(Ill. App. 1st Dist. 1965) 208 N.E.2d 581...............................................................................18
17
Hickey v. Comm’r. of Correction
18 (Conn. App. 2004) 842 A.2d 606 .....................................................................................17, 18
19 Holmes v. Winter
(N.Y. 2013) 3 N.E.3d 694.......................................................................................................18
20
21 Latif v. Obama
(D.C. Cir. 2011) 677 F.3d 1175 ..............................................................................................16
22
In re Lawley
23 (2008) 42 Cal. 4th 1231 ....................................................................................................15, 16
24 M.C.A. v. State of California
(1982) 128 Cal. App. 3d 225 ..................................................................................................19
25
Murray v. Giarratano
26
(1989) 492 U.S. 1....................................................................................................................15
27
Negro v. Super. Ct.
28 (2014) 230 Cal. App. 4th 879 .................................................................................................16
3
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 O’Grady v. Super. Ct.
(2006) 139 Cal. App. 4th 1423 .............................................................................13, 14, 15, 16
2
People v. Boyer
3
(2006) 38 Cal. 4th 412 ............................................................................................................15
4
People v. Cavanaugh
5 (1968) 69 Cal. 2d 262 .............................................................................................................19
6 People v. Foy
(2016) 245 Cal. App. 4th 328 .................................................................................................20
7
People v. Hammon
8 (1997) 15 Cal. 4th 1117 ..........................................................................................................16
9
People v. Super. Ct. (Jans)
10 (1990) 224 Cal. App. 3d 1405 ................................................................................................17
11 Quon v. Arch Wireless Operating Co., Inc.
(9th Cir. 2008) 529 F.3d 892, rev’d on other grounds, 130 S. Ct. 2619 (2010).....................12
12
Ex parte Rieck
13 (Tex. Crim. App. 2004) 144 S.W.3d 510 ...............................................................................18
14
Sams v. Yahoo!, Inc.
15 (N.D. Cal. May 18, 2011) 2011 WL 1884633,
aff’d, 713 F.3d 1175 (9th Cir. 2013) .......................................................................................18
16
Sanchez v. State
17 (Tex. App. 1985) 691 S.W.2d 795..........................................................................................19
18 State v. Johnson
(Tenn. Crim. App. 2017) 538 S.W.3d 32 ...............................................................................14
19
20 In re Subp. Duces Tecum
(E.D. Va. 2008) 550 F. Supp. 2d 606 ...............................................................................13, 18
21
Suzlon Energy Ltd. v. Microsoft Corp.
22 (9th Cir. 2011) 671 F.3d 726 ..................................................................................................14
23 Thomas v. Pacheco
(Ark. 1987) 740 S.W.2d 123 ..................................................................................................17
24
United States v. Amawi
25
(N.D. Ohio 2008) 552 F. Supp. 2d 679 ..................................................................................14
26
United States v. Warshak
27 (6th Cir. 2010) 631 F.3d 266 ..................................................................................................14
28
4
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 Vista Marketing, LLC v. Burkett
(11th Cir. 2016) 812 F.3d 954 ..........................................................................................12, 13
2
Statutes
3
4 18 U.S.C. § 2510................................................................................................................... passim
5 18 U.S.C. § 2702................................................................................................................... passim
6 18 U.S.C. § 2703(c)(2) .................................................................................................................14
7 18 U.S.C. § 2711.....................................................................................................................12, 14
8 CAL. PENAL CODE § 1334.2............................................................................................. passim
9 Tex. Code Crim. Proc. Ann. art. 24.28 .............................................................................17, 18, 19
10 Tex. Gov’t Code Ann. § 78.002(a) ...............................................................................................14
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
5
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 INTRODUCTION
2 Applicant Joseph Colone seeks an order from this Court pursuant to Section 1334.2 of the
3 California Penal Code, compelling GitHub, Inc.—a web-based platform where users can store
4 computer code and collaborate to develop software—to produce the confidential and proprietary
5 content data of one of its customers. Applicant’s request should be denied because it violates
6 federal law and fails to comply with Section 1334.2 in multiple respects.
7 Applicant is a death row inmate, who was convicted and sentenced to death following a
8 criminal trial in Texas state court. In connection with its investigation into possible post-
9 conviction habeas claims on Applicant’s behalf, the Texas Office of Capital and Forensic Writs
10 (OCFW) seeks access to the source code for STRmix—a probabilistic genotyping computer
11 program developed and owned by the New Zealand-based Institute of Environmental Science and
12 Research Limited (ESR)—which was used in Applicant’s prosecution. Applicant initially sought
13 the source code from ESR, which agreed to provide access so long as OCFW signed a non-
14 disclosure agreement. OCFW refused; instead, it sought to bypass ESR and involve the courts
15 (in two states) by serving a subpoena for the source code and related materials on GitHub, which
16 hosts ESR’s data on its platform. Applicant has now moved to compel production of the source
17 code pursuant to Section 1334.2, which governs the attendance of California witnesses in out-of-
18 state criminal proceedings. His motion should be denied and the subpoena should be quashed for
19 the following three reasons.
20 First, the subpoena violates the federal Stored Communications Act, 18 U.S.C. §§ 2701,
21 et seq. (“SCA”), which prohibits certain Internet-based providers like GitHub from disclosing a
22 customer’s content data held in storage to “any person or entity,” id. § 2702(a). Although Section
23 2702(b) provides narrow exceptions to this general prohibition, none allows a provider to disclose
24 content data in response to a subpoena issued in a post-conviction habeas proceeding—regardless
25 of whether the subpoena was issued pursuant to a court order. Id. § 2702(b)(1)-(9). Applicant’s
26 subpoena seeks to compel GitHub to produce customer content data and accordingly violates this
27 prohibition on disclosure. Because the relief Applicant seeks squarely conflicts with the SCA,
28 his motion should be denied.
6
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 Second, even if Applicant’s request did not violate federal law, his motion should be
2 denied because it is facially invalid under Section 1334.2 of the California Penal Code. By its
3 express terms, Section 1334.2—which is based on the Uniform Act to Secure the Attendance of
4 Witnesses from Without a State in Criminal Proceedings—authorizes a court to compel testimony
5 from a California witness only in connection with a “prosecution or grand jury investigation.”
6 Here, however, Applicant demands access to ESR’s source code for use in connection with his
7 counsel’s investigation into post-conviction habeas claims in Texas—a proceeding that is neither
8 a prosecution nor a grand jury investigation. For this reason alone, Applicant’s Motion to Compel
9 should be denied. Even setting this dispositive flaw aside, Section 1334.2 also applies only to
10 requests for a witness’s testimony, and does not support a stand-alone request for documents, as
11 used here.
12 Third, Applicant’s motion should be denied because he has not made the requisite showing
13 to compel a witness’s testimony under Section 1334.2—namely, that the evidence is “necessary”
14 to the out-of-state proceeding. To the contrary, the record reflects that subpoenaing GitHub is not
15 necessary because the same evidence is available to OCFW from ESR directly. Applicant has
16 acknowledged that ESR is willing to provide access to the STRmix source code so long as
17 OCFW’s expert witness signs a non-disclosure agreement, and materials attached to his motion
18 make clear that ESR stands ready to work with OCFW to negotiate a mutually-acceptable non-
19 disclosure agreement. See Mot. Ex. A (ESR explaining that that “[c]oming to agreement on the
20 language of the NDA would be the most efficient way of getting the source code review
21 conducted”). Indeed, just yesterday, ESR again confirmed its willingness to negotiate the terms
22 of a mutually-acceptable NDA, including by offering the same terms to which Applicant’s expert
23 previously agreed in a separate matter. See Sprague Decl. Ex. 1. Thus, because the source code
24 is available from another source, Applicant has not—and cannot—establish that forcing GitHub
25 to produce ESR’s source code is “necessary.”
26 FACTUAL BACKGROUND
27 GitHub is a cloud-based development platform where people host and review computer
28 code, manage projects, and build computer software. GitHub maintains industry-leading privacy
7
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 policies and devotes substantial resources to protecting its customers’ data, including their
2 confidential and proprietary computer source code. See GitHub Privacy Statement,
3 https://docs.github.com/en/github/site-policy/github-privacy-statement (last visited July 15,
4 2020). The data GitHub’s customers place in private repositories remain the property of the
5 customers, not GitHub. See GitHub Terms of Service at E(2),
6 https://docs.github.com/en/github/site-policy/github-terms-of-service (last visited July 15, 2020)
7 (“GitHub considers the contents of private repositories to be confidential to you [and] will protect
8 the contents of private repositories from unauthorized use, access, or disclosure in the same
9 manner that we would use to protect our own confidential information of a similar nature.”).
10 Applicant is a death row inmate. Mot. at 3–4.1 During his criminal trial in Texas state
11 court, the prosecution relied on results from DNA testing conducted using the STRmix program,
12 which is a probabilistic genotyping computer program developed by ESR, a research institute
13 owned by the government of New Zealand. Id. After Applicant’s conviction, OCFW was
14 appointed by a court in the 252nd District Court of Jefferson County, Texas, to investigate
15 potential post-conviction claims on his behalf. Id. After unsuccessfully seeking to obtain the
16 STRmix source code from the Texas Department of Public Safety Crime Lab, which had
17 conducted the DNA analysis used at Applicant’s trial, Applicant petitioned the Texas court for an
18 order requiring ESR to make available certain materials relating to the operation of the software,
19 including the source code. On May 5, 2019, the court issued the requested order, requiring ESR
20 to make the source code available to OCFW after it signed a non-disclosure agreement. OCFW
21 then refused to sign the NDA, claiming that its terms were “onerous and unnecessary.” Id. at 5.
22 At Applicant’s request, the court then modified its order, replacing the NDA with a protective
23 order, to which ESR objected. Id.
24 Instead of continuing to negotiate a mutually-acceptable NDA with ESR, Applicant sought
25 to compel GitHub to produce the STRmix source code, over ESR’s objection. See Mot. Ex. A.
26
27
1
These facts about the Texas proceeding are drawn from Applicant’s motion and the
28 materials attached thereto, which GitHub does not dispute for purposes of this motion.
8
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 On January 3, 2020, the Texas court issued an Order and Certification stating that the source code
2 and other related items sought by Applicant are “material and necessary for the administration of
3 justice in this State.” Mot. Ex. A, Attachment 3 (“Texas Order”). Specifically, the Texas Order
4 directs GitHub to produce the STRmix software, source code, User Manual, Implementation and
5 Validation Guide, Installation Manual, “developmental validation records . . . including test
6 scripts, gap analysis documents, [and] risk identification documents,” Change Request forms, and
7 Release and Testing Reports. Id. On January 31, 2020, this Court issued a subpoena to GitHub
8 for the source code and related materials identified in the Texas Order, instructing GitHub to
9 permit Applicant’s experts to review the source code online, or in GitHub offices, or in the Ohio
10 office of ESR’s counsel, pursuant to the terms of the Protective Order entered by the Texas court.
11 See Mot. Ex. A (“Subpoena”).
12 After learning of Applicant’s Subpoena to GitHub, ESR reiterated that “[g]iven the
13 proprietary nature of the source code . . . [it] object[s] to any review of the source code without a
14 signed NDA.” Mot. Ex. A. ESR underscored that it “certainly objects to any review conducted
15 of any STRmix™ source code which may be hosted on the GitHub site.” Id. ESR also explained
16 that “[c]oming to agreement on the language of the NDA would be the most efficient way of
17 getting the source code review conducted.” Id.
18 Upon receipt of the Subpoena, GitHub notified Applicant that it was “unable to locate the
19 source code and supporting documents requested in [the] subpoena” because “GitHub does not
20 have any knowledge about the contents of [ESR’s] account and cannot say whether it contains”
21 the requested materials. Mot. Ex. B at 2. GitHub further explained that it “would not be able to
22 produce that content without the account owner’s consent,” but that “the account owner [i.e., ESR]
23 could and should be able to produce that information.” Id. After Applicant explained that ESR
24 had objected to GitHub’s production of the source code, GitHub reiterated that it “cannot inspect
25 a user’s private stored communications (or permit anyone else to do so) without the user’s consent.
26 Moreover, as mentioned previously, even if GitHub could inspect the account’s private contents,
27 [it] do[es] not have any knowledge about the contents of that account or the ‘STRmix’ source
28 code.” Id. GitHub explained that the “account owners would be the ones best positioned to
9
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 identify and produce the relevant source code from their private repositories,” and that if
2 Applicant “believe[s] that the ‘STRmix’ source code is located in [ESR’s] private storage, [his]
3 subpoena should be directed to [ESR], not GitHub.” Id.
4 On May 13, 2020, Applicant filed a Motion to Compel Production of Records Pursuant to
5 Cal. Penal Code § 1334.2, which he amended on June 18, 2020, seeking an order compelling
6 GitHub to produce ESR’s source code. Specifically, Applicant seeks an order under Section
7 1334.2 requiring GitHub to either (1) provide access to all the materials in ESR’s GitHub account
8 and permit Applicant’s expert to identify the source code, or (2) “ask its client ESR to identify
9 the source code so that GitHub provides access to only that material.” Mot. at 7.
10 Most recently, by letter dated July 14, 2020, ESR’s counsel reiterated ESR’s
11 “willing[ness] to continue negotiations on the terms of the Non-Disclosure and Confidentiality
12 Agreement in an attempt to develop an agreement satisfactory to ESR, OCFW and its expert
13 witness.” Sprague Decl. Ex. 1 at 2. The letter first explains that, to ESR’s counsel’s “knowledge
14 and belief, all the material being sought by the OCFW from ESR has been produced subject to a
15 Protective Order in the Texas proceeding, with the sole exception being the review of the
16 [requested] source code.” Id. at 1. The letter then underscores that “ESR stands ready to allow
17 an examination of the STRmix™ source code for Version 2.3.07 provided that any reviewing
18 expert executes an acceptable non-disclosure agreement containing terms establishing the manner
19 of inspection.” Id. Indeed, the letter explains, Applicant’s expert who wishes to review the source
20 code has already executed an NDA in connection with his review of the source code in another
21 criminal proceeding. The letter expresses ESR’s willingness to allow Applicant’s expert (1) to
22 review the source code again if he agrees in writing to the same NDA terms to which he previously
23 agreed, or (2) to testify in Applicant’s Texas proceeding based on his prior examination of the
24 source code. Id. Alternatively, ESR offered to continue to negotiate the terms of a mutually-
25 agreeable NDA. Id.
26
27
28
10
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 ARGUMENT
2 Applicant’s Motion to Compel should be denied for three independent reasons. First, his
3 request is barred by the SCA, which prohibits GitHub from disclosing ESR’s content data in
4 response to the Subpoena. Second, the motion is facially invalid, as Section 1334.2 neither
5 empowers a court to require a witness to provide testimony in an out-of-state habeas proceeding,
6 nor authorizes the issuance of a subpoena for documents. Third, Applicant has not established,
7 as he must, that the subpoenaed materials are “necessary” to the Texas proceeding.
8 I. The Subpoena Violates and Is Preempted By Federal Law.
9 A. GitHub Is Regulated by the SCA.
10 The SCA is part of the Electronic Communications Privacy Act, which Congress passed
11 in 1986 “to update then existing law in light of dramatic technological changes so as to create a
12 ‘fair balance between the privacy expectations of citizens and the legitimate needs of law
13 enforcement.’” Facebook, Inc. v. Super. Ct. (2018) 4 Cal. 5th 1245, 1262–63 (quoting H.R. Rep.
14 No. 99-647, 2d Sess., p. 19 (1986)). The SCA applies to two types of electronic service providers:
15 those that provide data storage and processing services, referred to as “remote computing
16 service[s]” or “RCS,” 18 U.S.C. § 2711(2), and those that provide communication services,
17 referred to as “electronic communication[s] service[s]” or “ECS,” id. § 2510(15). These
18 categories are not mutually exclusive. A “single service provider may act as an ECS at times and
19 an RCS at other times,” and thus may be subject to the SCA for each type of service. Vista
20 Marketing, LLC v. Burkett (11th Cir. 2016) 812 F.3d 954, 964 n.5.
21 Here, GitHub constitutes both an RCS and an ECS. The SCA defines an RCS as “the
22 provision to the public of computer storage or processing services by means of an electronic
23 communications system.” 18 U.S.C. § 2711(2). GitHub is a cloud-based hosting and
24 collaboration platform, where users store and process computer code. GitHub thus clearly is an
25 RCS, as it “provi[des] to the public” “computer storage or processing services by means of an
26 electronic communications system.” Id.; see also Quon v. Arch Wireless Operating Co., Inc. (9th
27 Cir. 2008) 529 F.3d 892, 900–02, rev’d on other grounds, 130 S. Ct. 2619 (2010) (explaining that
28 an RCS refers to “the processing or storage of data by an offsite third party,” and that an RCS
11
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 functions as a “virtual filing cabinet” or “an advanced computer processing program,” allowing
2 businesses to “farm out sophisticated processing to a service that would process the information”).
3 GitHub also constitutes an ECS, which the SCA defines as “any service which provides to users
4 thereof the ability to send or receive wire or electronic communications.” 18 U.S.C. § 2510(15).
5 See also Crispin v. Christian Audigier, Inc. (C.D. Cal. 2010) 717 F. Supp. 2d 965, 979–82 (a
6 social networking site providing messaging services between users is an ECS). Because GitHub’s
7 collaborative web-based platform “provide[s] [users] with the ability to send and receive
8 electronic communications” in the form of user-to-user comments, as well through the
9 transmission of computer code itself, GitHub “qualifie[s]” as an ECS. Vista, 812 F.3d at 963–64;
10 see also, e.g., GitHub Team Management, https://github.com/features#team-management (last
11 visited July 15, 2020).
12 B. The Subpoena Violates the SCA’s Prohibition on Disclosure.
13 Section 2702(a)(1) of the SCA “contains plain and unambiguous language” that “plainly
14 prohibits an electronic communication or remote computing service to the public from knowingly
15 divulging to any person or entity the contents of customers’ electronic communications or
16 records.” In re Subp. Duces Tecum (E.D. Va. 2008) 550 F. Supp. 2d 606, 609–10. Specifically,
17 the statute provides that “a person or entity providing an electronic communication service to the
18 public shall not knowingly divulge to any person or entity the contents of a communication while
19 in electronic storage by that service.” 18 U.S.C. § 2702(a)(1). A similar prohibition applies to a
20 provider of “remote computing service to the public,” who “shall not knowingly divulge to any
21 person or entity the contents of any communication which is carried or maintained on that service”
22 that was received from “a subscriber or customer of such service.” Id. § 2702(a)(2); see also
23 O’Grady v. Super. Ct. (2006) 139 Cal. App. 4th 1423, 1443 (the SCA “clearly prohibits any
24 disclosure of stored email other than as authorized by enumerated exceptions”).
25 This statutory prohibition is subject to limited and narrow exceptions, 18 U.S.C.
26 § 2702(b)(1)-(9), none of which allow disclosure in response to a subpoena issued in a state habeas
27 proceeding. Indeed, courts have uniformly held that the SCA prohibits service providers from
28 disclosing the content of user communications in response to any type of civil subpoena, even
12
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 when accompanied by a court order. See, e.g., O’Grady, 139 Cal. App. 4th at 1442 (service
2 provider’s compliance with a civil subpoena seeking content data, even if accompanied by a court
3 order, would be an “unlawful act”); Suzlon Energy Ltd. v. Microsoft Corp. (9th Cir. 2011) 671
4 F.3d 726, 730 (“Declaring an implicit exception to the [SCA] for civil litigation would erode the
5 safety of the stored electronic information and trigger Congress’ privacy concerns.”).2
6 Even if Applicant’s Subpoena were construed as a request from a criminal defendant, as
7 opposed to a civil litigant, there would still be no applicable exception permitting disclosure of
8 content data. See 18 U.S.C. § 2702(b)(1)-(9) (no exception for subpoenas issued by criminal
9 defendants). In fact, only designated “governmental entities”—defined as “department or agency
10 of the United States or any State or political subdivision thereof”—can obtain customer content
11 from a provider. See 18 U.S.C. § 2711(4) (defining “governmental entity”). Courts have
12 consistently held that criminal defendants, even if represented by government agencies such as
13 public defenders, do not qualify as “governmental entities.” See United States v. Amawi (N.D.
14 Ohio 2008) 552 F. Supp. 2d 679, 680 (“the judiciary and its components, including the Federal
15 Public Defender” do not constitute governmental entities for purposes of the SCA); State v.
16 Johnson (Tenn. Crim. App. 2017) 538 S.W.3d 32, 69–70 (“The purpose and plain text of the SCA
17 make clear that the exceptions for governmental entities apply only to Fourth Amendment
18 government actors—investigative agencies and prosecuting attorneys—and not to criminal
19 defendants, irrespective of whether they happen to be represented by a publicly funded criminal
20 defender’s office.”) (citations omitted). And even qualifying “governmental entities” may compel
21 disclosure of content data only pursuant to a search warrant supported by a finding of probable
22 cause. See United States v. Warshak (6th Cir. 2010) 631 F.3d 266, 288.3
23
2
24 A subpoena may be used to seek only non-content information, such as a customer’s
“name,” “address,” “records of session times and durations,” “length of service,” “telephone or
25 instrument number or other subscriber number,” “means and source of payment,” and other non-
content records. 18 U.S.C. § 2703(c)(2).
26
3
A component of a state judiciary like OCFW likewise does not constitute a “governmental
27 entity” to which the SCA’s narrow exceptions to disclosure apply. See Tex. Gov’t Code Ann.
§ 78.002(a) (OCFW is a component of the Texas judicial system); 26 Tex. Jur. 3d Criminal
28 Procedure: Posttrial Proceedings § 281 (similar).
13
GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL
PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2
1 Here, the Subpoena violates the SCA because it purports to require GitHub, which is both
2 an RCS and an ECS, to produce the content of ESR’s communications—namely, the STRmix
3 software, source code, User Manual, Implementation and Validation Guide, Installation Manual,
4 “developmental validation records . . . including test scripts, gap analysis documents, [and] risk
5 identification documents,” Change Request forms, and Release and Testing Reports. Mot. Ex. A,
6 Attachment 3. These materials clearly constitute the “content” of “electronic communications”
7 under the SCA. See 18 U.S.C. § 2510(8) (defining “content” as “any information concerning the
8 substance, purport, or meaning of [an electronic] communication”); 18 U.S.C. § 2510(12)
9 (defining “electronic communication” as “any transfer of signs, signals, writing, images, sounds,
10 data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic,
11 photoelectronic or photooptical system that affects interstate or foreign commerce”). There is
12 accordingly no exception that would bring the Subpoena outside the SCA’s broad prohibition on
13 the disclosure of content data.4
14 Nor is there any constitutional reason for declining to enforce the SCA’s clear prohibition
15 on disclosure of ESR’s content data. “There is no federal right, constitutional or otherwise, to
16 discovery in a habeas corpus proceeding.” In re Lawley (2008) 42 Cal. 4th 1231, 1249 (citing
17 Harris v. Nelson (1969) 394 U.S. 286, 295). The same is true as a matter of California state law.
18 See id. (California courts have not “recognized any state right to unfettered discovery.”). Indeed,
19 many of the constitutional protections that apply to “the trial stage of capital offense adjudication,
20 where the court and jury hear testimony, receive evidence, and decide the questions of guilt and
21 punishment”—including the right to counsel, to compulsory process, and to confront witnesses—
22 do not extend to post-conviction habeas proceedings. Murray v. Giarratano (1989) 492 U.S. 1,
23 9 (“We have similarly refused to hold that the fact that a death sentence has been imposed requires
Preview
1 W. DOUGLAS SPRAGUE (202121) COVINGTON & BURLING LLP 2 Salesforce Tower ELECTRONICALLY 3 15 Mission Street, Suite 5400 F I L E D San Francisco, California 94105-2533 Superior Court of California, County of San Francisco 4 Telephone: (415) 591-6000 Facsimile: (415) 591-6091 07/16/2020 5 Email: dsprague@cov.com Clerk of the Court BY: EDNALEEN ALEGRE Deputy Clerk 6 ALEXANDER A. BERENGAUT (pro hac vice pending) MEGAN A. CROWLEY (pro hac vice pending) 7 COVINGTON & BURLING, LLP 8 One City Center 850 Tenth Street, NW 9 Washington, DC 20001-4956 Telephone: (202) 662-5367 10 Facsimile: (202) 662-6291 Email: aberengaut@cov.com 11 mcrowley@cov.com 12 Attorneys for Respondent GitHub, Inc. 13 SUPERIOR COURT FOR THE STATE OF CALIFORNIA 14 FOR THE COUNTY OF SAN FRANCISCO 15 EX PARTE. Case No. CPF-20-517083 Joseph Colone 16 GITHUB, INC.’S OPPOSITION TO APPLICANT MOTION TO COMPEL PRODUCTION 17 OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2; 18 DECLARATION OF W. DOUGLAS SPRAGUE 19 Honorable Judge Ethan P. Schulman 20 Department: 302 21 Hearing Date: July 28, 2020 Hearing Time: 9:00 a.m. 22 23 24 25 26 27 28 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 TABLE OF CONTENTS 2 Page(s) 3 INTRODUCTION..........................................................................................................................6 4 FACTUAL BACKGROUND ........................................................................................................ 7 5 ARGUMENT ............................................................................................................................... 11 6 I. The Subpoena Violates and Is Preempted By Federal Law. ........................................... 11 7 A. GitHub Is Regulated by the SCA......................................................................... 11 8 B. The Subpoena Violates the SCA’s Prohibition on Disclosure. ........................... 12 9 II. Section 1334.2 Does Not Authorize the Relief Applicant Seeks. ................................... 15 10 III. Applicant Has Not Satisfied the Requirements of Section 1334.2. ................................. 18 11 CONCLUSION............................................................................................................................ 19 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 2 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 TABLE OF AUTHORITIES 2 Page(s) 3 Cases 4 Barber v. Page 5 (1968) 390 U.S. 719................................................................................................................17 6 In re Barnett (2003) 31 Cal.4th 466 .............................................................................................................17 7 Crispin v. Christian Audigier, Inc. 8 (C.D. Cal. 2010) 717 F. Supp. 2d 965 ....................................................................................13 9 Dist. Title v. Warren 10 (D.D.C. Dec. 23, 2016) 2016 WL 10749155..........................................................................20 11 Facebook, Inc. v. Super. Ct. (2018) 4 Cal. 5th 1245 ......................................................................................................12, 20 12 Facebook v. Wint 13 (D.C. 2019) 199 A.3d 625 ......................................................................................................16 14 France v. Super. Ct. 15 (1927) 201 Cal. 122 ................................................................................................................17 16 In re Grothe (Ill. App. 1st Dist. 1965) 208 N.E.2d 581...............................................................................18 17 Hickey v. Comm’r. of Correction 18 (Conn. App. 2004) 842 A.2d 606 .....................................................................................17, 18 19 Holmes v. Winter (N.Y. 2013) 3 N.E.3d 694.......................................................................................................18 20 21 Latif v. Obama (D.C. Cir. 2011) 677 F.3d 1175 ..............................................................................................16 22 In re Lawley 23 (2008) 42 Cal. 4th 1231 ....................................................................................................15, 16 24 M.C.A. v. State of California (1982) 128 Cal. App. 3d 225 ..................................................................................................19 25 Murray v. Giarratano 26 (1989) 492 U.S. 1....................................................................................................................15 27 Negro v. Super. Ct. 28 (2014) 230 Cal. App. 4th 879 .................................................................................................16 3 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 O’Grady v. Super. Ct. (2006) 139 Cal. App. 4th 1423 .............................................................................13, 14, 15, 16 2 People v. Boyer 3 (2006) 38 Cal. 4th 412 ............................................................................................................15 4 People v. Cavanaugh 5 (1968) 69 Cal. 2d 262 .............................................................................................................19 6 People v. Foy (2016) 245 Cal. App. 4th 328 .................................................................................................20 7 People v. Hammon 8 (1997) 15 Cal. 4th 1117 ..........................................................................................................16 9 People v. Super. Ct. (Jans) 10 (1990) 224 Cal. App. 3d 1405 ................................................................................................17 11 Quon v. Arch Wireless Operating Co., Inc. (9th Cir. 2008) 529 F.3d 892, rev’d on other grounds, 130 S. Ct. 2619 (2010).....................12 12 Ex parte Rieck 13 (Tex. Crim. App. 2004) 144 S.W.3d 510 ...............................................................................18 14 Sams v. Yahoo!, Inc. 15 (N.D. Cal. May 18, 2011) 2011 WL 1884633, aff’d, 713 F.3d 1175 (9th Cir. 2013) .......................................................................................18 16 Sanchez v. State 17 (Tex. App. 1985) 691 S.W.2d 795..........................................................................................19 18 State v. Johnson (Tenn. Crim. App. 2017) 538 S.W.3d 32 ...............................................................................14 19 20 In re Subp. Duces Tecum (E.D. Va. 2008) 550 F. Supp. 2d 606 ...............................................................................13, 18 21 Suzlon Energy Ltd. v. Microsoft Corp. 22 (9th Cir. 2011) 671 F.3d 726 ..................................................................................................14 23 Thomas v. Pacheco (Ark. 1987) 740 S.W.2d 123 ..................................................................................................17 24 United States v. Amawi 25 (N.D. Ohio 2008) 552 F. Supp. 2d 679 ..................................................................................14 26 United States v. Warshak 27 (6th Cir. 2010) 631 F.3d 266 ..................................................................................................14 28 4 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 Vista Marketing, LLC v. Burkett (11th Cir. 2016) 812 F.3d 954 ..........................................................................................12, 13 2 Statutes 3 4 18 U.S.C. § 2510................................................................................................................... passim 5 18 U.S.C. § 2702................................................................................................................... passim 6 18 U.S.C. § 2703(c)(2) .................................................................................................................14 7 18 U.S.C. § 2711.....................................................................................................................12, 14 8 CAL. PENAL CODE § 1334.2............................................................................................. passim 9 Tex. Code Crim. Proc. Ann. art. 24.28 .............................................................................17, 18, 19 10 Tex. Gov’t Code Ann. § 78.002(a) ...............................................................................................14 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 5 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 INTRODUCTION 2 Applicant Joseph Colone seeks an order from this Court pursuant to Section 1334.2 of the 3 California Penal Code, compelling GitHub, Inc.—a web-based platform where users can store 4 computer code and collaborate to develop software—to produce the confidential and proprietary 5 content data of one of its customers. Applicant’s request should be denied because it violates 6 federal law and fails to comply with Section 1334.2 in multiple respects. 7 Applicant is a death row inmate, who was convicted and sentenced to death following a 8 criminal trial in Texas state court. In connection with its investigation into possible post- 9 conviction habeas claims on Applicant’s behalf, the Texas Office of Capital and Forensic Writs 10 (OCFW) seeks access to the source code for STRmix—a probabilistic genotyping computer 11 program developed and owned by the New Zealand-based Institute of Environmental Science and 12 Research Limited (ESR)—which was used in Applicant’s prosecution. Applicant initially sought 13 the source code from ESR, which agreed to provide access so long as OCFW signed a non- 14 disclosure agreement. OCFW refused; instead, it sought to bypass ESR and involve the courts 15 (in two states) by serving a subpoena for the source code and related materials on GitHub, which 16 hosts ESR’s data on its platform. Applicant has now moved to compel production of the source 17 code pursuant to Section 1334.2, which governs the attendance of California witnesses in out-of- 18 state criminal proceedings. His motion should be denied and the subpoena should be quashed for 19 the following three reasons. 20 First, the subpoena violates the federal Stored Communications Act, 18 U.S.C. §§ 2701, 21 et seq. (“SCA”), which prohibits certain Internet-based providers like GitHub from disclosing a 22 customer’s content data held in storage to “any person or entity,” id. § 2702(a). Although Section 23 2702(b) provides narrow exceptions to this general prohibition, none allows a provider to disclose 24 content data in response to a subpoena issued in a post-conviction habeas proceeding—regardless 25 of whether the subpoena was issued pursuant to a court order. Id. § 2702(b)(1)-(9). Applicant’s 26 subpoena seeks to compel GitHub to produce customer content data and accordingly violates this 27 prohibition on disclosure. Because the relief Applicant seeks squarely conflicts with the SCA, 28 his motion should be denied. 6 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 Second, even if Applicant’s request did not violate federal law, his motion should be 2 denied because it is facially invalid under Section 1334.2 of the California Penal Code. By its 3 express terms, Section 1334.2—which is based on the Uniform Act to Secure the Attendance of 4 Witnesses from Without a State in Criminal Proceedings—authorizes a court to compel testimony 5 from a California witness only in connection with a “prosecution or grand jury investigation.” 6 Here, however, Applicant demands access to ESR’s source code for use in connection with his 7 counsel’s investigation into post-conviction habeas claims in Texas—a proceeding that is neither 8 a prosecution nor a grand jury investigation. For this reason alone, Applicant’s Motion to Compel 9 should be denied. Even setting this dispositive flaw aside, Section 1334.2 also applies only to 10 requests for a witness’s testimony, and does not support a stand-alone request for documents, as 11 used here. 12 Third, Applicant’s motion should be denied because he has not made the requisite showing 13 to compel a witness’s testimony under Section 1334.2—namely, that the evidence is “necessary” 14 to the out-of-state proceeding. To the contrary, the record reflects that subpoenaing GitHub is not 15 necessary because the same evidence is available to OCFW from ESR directly. Applicant has 16 acknowledged that ESR is willing to provide access to the STRmix source code so long as 17 OCFW’s expert witness signs a non-disclosure agreement, and materials attached to his motion 18 make clear that ESR stands ready to work with OCFW to negotiate a mutually-acceptable non- 19 disclosure agreement. See Mot. Ex. A (ESR explaining that that “[c]oming to agreement on the 20 language of the NDA would be the most efficient way of getting the source code review 21 conducted”). Indeed, just yesterday, ESR again confirmed its willingness to negotiate the terms 22 of a mutually-acceptable NDA, including by offering the same terms to which Applicant’s expert 23 previously agreed in a separate matter. See Sprague Decl. Ex. 1. Thus, because the source code 24 is available from another source, Applicant has not—and cannot—establish that forcing GitHub 25 to produce ESR’s source code is “necessary.” 26 FACTUAL BACKGROUND 27 GitHub is a cloud-based development platform where people host and review computer 28 code, manage projects, and build computer software. GitHub maintains industry-leading privacy 7 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 policies and devotes substantial resources to protecting its customers’ data, including their 2 confidential and proprietary computer source code. See GitHub Privacy Statement, 3 https://docs.github.com/en/github/site-policy/github-privacy-statement (last visited July 15, 4 2020). The data GitHub’s customers place in private repositories remain the property of the 5 customers, not GitHub. See GitHub Terms of Service at E(2), 6 https://docs.github.com/en/github/site-policy/github-terms-of-service (last visited July 15, 2020) 7 (“GitHub considers the contents of private repositories to be confidential to you [and] will protect 8 the contents of private repositories from unauthorized use, access, or disclosure in the same 9 manner that we would use to protect our own confidential information of a similar nature.”). 10 Applicant is a death row inmate. Mot. at 3–4.1 During his criminal trial in Texas state 11 court, the prosecution relied on results from DNA testing conducted using the STRmix program, 12 which is a probabilistic genotyping computer program developed by ESR, a research institute 13 owned by the government of New Zealand. Id. After Applicant’s conviction, OCFW was 14 appointed by a court in the 252nd District Court of Jefferson County, Texas, to investigate 15 potential post-conviction claims on his behalf. Id. After unsuccessfully seeking to obtain the 16 STRmix source code from the Texas Department of Public Safety Crime Lab, which had 17 conducted the DNA analysis used at Applicant’s trial, Applicant petitioned the Texas court for an 18 order requiring ESR to make available certain materials relating to the operation of the software, 19 including the source code. On May 5, 2019, the court issued the requested order, requiring ESR 20 to make the source code available to OCFW after it signed a non-disclosure agreement. OCFW 21 then refused to sign the NDA, claiming that its terms were “onerous and unnecessary.” Id. at 5. 22 At Applicant’s request, the court then modified its order, replacing the NDA with a protective 23 order, to which ESR objected. Id. 24 Instead of continuing to negotiate a mutually-acceptable NDA with ESR, Applicant sought 25 to compel GitHub to produce the STRmix source code, over ESR’s objection. See Mot. Ex. A. 26 27 1 These facts about the Texas proceeding are drawn from Applicant’s motion and the 28 materials attached thereto, which GitHub does not dispute for purposes of this motion. 8 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 On January 3, 2020, the Texas court issued an Order and Certification stating that the source code 2 and other related items sought by Applicant are “material and necessary for the administration of 3 justice in this State.” Mot. Ex. A, Attachment 3 (“Texas Order”). Specifically, the Texas Order 4 directs GitHub to produce the STRmix software, source code, User Manual, Implementation and 5 Validation Guide, Installation Manual, “developmental validation records . . . including test 6 scripts, gap analysis documents, [and] risk identification documents,” Change Request forms, and 7 Release and Testing Reports. Id. On January 31, 2020, this Court issued a subpoena to GitHub 8 for the source code and related materials identified in the Texas Order, instructing GitHub to 9 permit Applicant’s experts to review the source code online, or in GitHub offices, or in the Ohio 10 office of ESR’s counsel, pursuant to the terms of the Protective Order entered by the Texas court. 11 See Mot. Ex. A (“Subpoena”). 12 After learning of Applicant’s Subpoena to GitHub, ESR reiterated that “[g]iven the 13 proprietary nature of the source code . . . [it] object[s] to any review of the source code without a 14 signed NDA.” Mot. Ex. A. ESR underscored that it “certainly objects to any review conducted 15 of any STRmix™ source code which may be hosted on the GitHub site.” Id. ESR also explained 16 that “[c]oming to agreement on the language of the NDA would be the most efficient way of 17 getting the source code review conducted.” Id. 18 Upon receipt of the Subpoena, GitHub notified Applicant that it was “unable to locate the 19 source code and supporting documents requested in [the] subpoena” because “GitHub does not 20 have any knowledge about the contents of [ESR’s] account and cannot say whether it contains” 21 the requested materials. Mot. Ex. B at 2. GitHub further explained that it “would not be able to 22 produce that content without the account owner’s consent,” but that “the account owner [i.e., ESR] 23 could and should be able to produce that information.” Id. After Applicant explained that ESR 24 had objected to GitHub’s production of the source code, GitHub reiterated that it “cannot inspect 25 a user’s private stored communications (or permit anyone else to do so) without the user’s consent. 26 Moreover, as mentioned previously, even if GitHub could inspect the account’s private contents, 27 [it] do[es] not have any knowledge about the contents of that account or the ‘STRmix’ source 28 code.” Id. GitHub explained that the “account owners would be the ones best positioned to 9 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 identify and produce the relevant source code from their private repositories,” and that if 2 Applicant “believe[s] that the ‘STRmix’ source code is located in [ESR’s] private storage, [his] 3 subpoena should be directed to [ESR], not GitHub.” Id. 4 On May 13, 2020, Applicant filed a Motion to Compel Production of Records Pursuant to 5 Cal. Penal Code § 1334.2, which he amended on June 18, 2020, seeking an order compelling 6 GitHub to produce ESR’s source code. Specifically, Applicant seeks an order under Section 7 1334.2 requiring GitHub to either (1) provide access to all the materials in ESR’s GitHub account 8 and permit Applicant’s expert to identify the source code, or (2) “ask its client ESR to identify 9 the source code so that GitHub provides access to only that material.” Mot. at 7. 10 Most recently, by letter dated July 14, 2020, ESR’s counsel reiterated ESR’s 11 “willing[ness] to continue negotiations on the terms of the Non-Disclosure and Confidentiality 12 Agreement in an attempt to develop an agreement satisfactory to ESR, OCFW and its expert 13 witness.” Sprague Decl. Ex. 1 at 2. The letter first explains that, to ESR’s counsel’s “knowledge 14 and belief, all the material being sought by the OCFW from ESR has been produced subject to a 15 Protective Order in the Texas proceeding, with the sole exception being the review of the 16 [requested] source code.” Id. at 1. The letter then underscores that “ESR stands ready to allow 17 an examination of the STRmix™ source code for Version 2.3.07 provided that any reviewing 18 expert executes an acceptable non-disclosure agreement containing terms establishing the manner 19 of inspection.” Id. Indeed, the letter explains, Applicant’s expert who wishes to review the source 20 code has already executed an NDA in connection with his review of the source code in another 21 criminal proceeding. The letter expresses ESR’s willingness to allow Applicant’s expert (1) to 22 review the source code again if he agrees in writing to the same NDA terms to which he previously 23 agreed, or (2) to testify in Applicant’s Texas proceeding based on his prior examination of the 24 source code. Id. Alternatively, ESR offered to continue to negotiate the terms of a mutually- 25 agreeable NDA. Id. 26 27 28 10 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 ARGUMENT 2 Applicant’s Motion to Compel should be denied for three independent reasons. First, his 3 request is barred by the SCA, which prohibits GitHub from disclosing ESR’s content data in 4 response to the Subpoena. Second, the motion is facially invalid, as Section 1334.2 neither 5 empowers a court to require a witness to provide testimony in an out-of-state habeas proceeding, 6 nor authorizes the issuance of a subpoena for documents. Third, Applicant has not established, 7 as he must, that the subpoenaed materials are “necessary” to the Texas proceeding. 8 I. The Subpoena Violates and Is Preempted By Federal Law. 9 A. GitHub Is Regulated by the SCA. 10 The SCA is part of the Electronic Communications Privacy Act, which Congress passed 11 in 1986 “to update then existing law in light of dramatic technological changes so as to create a 12 ‘fair balance between the privacy expectations of citizens and the legitimate needs of law 13 enforcement.’” Facebook, Inc. v. Super. Ct. (2018) 4 Cal. 5th 1245, 1262–63 (quoting H.R. Rep. 14 No. 99-647, 2d Sess., p. 19 (1986)). The SCA applies to two types of electronic service providers: 15 those that provide data storage and processing services, referred to as “remote computing 16 service[s]” or “RCS,” 18 U.S.C. § 2711(2), and those that provide communication services, 17 referred to as “electronic communication[s] service[s]” or “ECS,” id. § 2510(15). These 18 categories are not mutually exclusive. A “single service provider may act as an ECS at times and 19 an RCS at other times,” and thus may be subject to the SCA for each type of service. Vista 20 Marketing, LLC v. Burkett (11th Cir. 2016) 812 F.3d 954, 964 n.5. 21 Here, GitHub constitutes both an RCS and an ECS. The SCA defines an RCS as “the 22 provision to the public of computer storage or processing services by means of an electronic 23 communications system.” 18 U.S.C. § 2711(2). GitHub is a cloud-based hosting and 24 collaboration platform, where users store and process computer code. GitHub thus clearly is an 25 RCS, as it “provi[des] to the public” “computer storage or processing services by means of an 26 electronic communications system.” Id.; see also Quon v. Arch Wireless Operating Co., Inc. (9th 27 Cir. 2008) 529 F.3d 892, 900–02, rev’d on other grounds, 130 S. Ct. 2619 (2010) (explaining that 28 an RCS refers to “the processing or storage of data by an offsite third party,” and that an RCS 11 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 functions as a “virtual filing cabinet” or “an advanced computer processing program,” allowing 2 businesses to “farm out sophisticated processing to a service that would process the information”). 3 GitHub also constitutes an ECS, which the SCA defines as “any service which provides to users 4 thereof the ability to send or receive wire or electronic communications.” 18 U.S.C. § 2510(15). 5 See also Crispin v. Christian Audigier, Inc. (C.D. Cal. 2010) 717 F. Supp. 2d 965, 979–82 (a 6 social networking site providing messaging services between users is an ECS). Because GitHub’s 7 collaborative web-based platform “provide[s] [users] with the ability to send and receive 8 electronic communications” in the form of user-to-user comments, as well through the 9 transmission of computer code itself, GitHub “qualifie[s]” as an ECS. Vista, 812 F.3d at 963–64; 10 see also, e.g., GitHub Team Management, https://github.com/features#team-management (last 11 visited July 15, 2020). 12 B. The Subpoena Violates the SCA’s Prohibition on Disclosure. 13 Section 2702(a)(1) of the SCA “contains plain and unambiguous language” that “plainly 14 prohibits an electronic communication or remote computing service to the public from knowingly 15 divulging to any person or entity the contents of customers’ electronic communications or 16 records.” In re Subp. Duces Tecum (E.D. Va. 2008) 550 F. Supp. 2d 606, 609–10. Specifically, 17 the statute provides that “a person or entity providing an electronic communication service to the 18 public shall not knowingly divulge to any person or entity the contents of a communication while 19 in electronic storage by that service.” 18 U.S.C. § 2702(a)(1). A similar prohibition applies to a 20 provider of “remote computing service to the public,” who “shall not knowingly divulge to any 21 person or entity the contents of any communication which is carried or maintained on that service” 22 that was received from “a subscriber or customer of such service.” Id. § 2702(a)(2); see also 23 O’Grady v. Super. Ct. (2006) 139 Cal. App. 4th 1423, 1443 (the SCA “clearly prohibits any 24 disclosure of stored email other than as authorized by enumerated exceptions”). 25 This statutory prohibition is subject to limited and narrow exceptions, 18 U.S.C. 26 § 2702(b)(1)-(9), none of which allow disclosure in response to a subpoena issued in a state habeas 27 proceeding. Indeed, courts have uniformly held that the SCA prohibits service providers from 28 disclosing the content of user communications in response to any type of civil subpoena, even 12 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 when accompanied by a court order. See, e.g., O’Grady, 139 Cal. App. 4th at 1442 (service 2 provider’s compliance with a civil subpoena seeking content data, even if accompanied by a court 3 order, would be an “unlawful act”); Suzlon Energy Ltd. v. Microsoft Corp. (9th Cir. 2011) 671 4 F.3d 726, 730 (“Declaring an implicit exception to the [SCA] for civil litigation would erode the 5 safety of the stored electronic information and trigger Congress’ privacy concerns.”).2 6 Even if Applicant’s Subpoena were construed as a request from a criminal defendant, as 7 opposed to a civil litigant, there would still be no applicable exception permitting disclosure of 8 content data. See 18 U.S.C. § 2702(b)(1)-(9) (no exception for subpoenas issued by criminal 9 defendants). In fact, only designated “governmental entities”—defined as “department or agency 10 of the United States or any State or political subdivision thereof”—can obtain customer content 11 from a provider. See 18 U.S.C. § 2711(4) (defining “governmental entity”). Courts have 12 consistently held that criminal defendants, even if represented by government agencies such as 13 public defenders, do not qualify as “governmental entities.” See United States v. Amawi (N.D. 14 Ohio 2008) 552 F. Supp. 2d 679, 680 (“the judiciary and its components, including the Federal 15 Public Defender” do not constitute governmental entities for purposes of the SCA); State v. 16 Johnson (Tenn. Crim. App. 2017) 538 S.W.3d 32, 69–70 (“The purpose and plain text of the SCA 17 make clear that the exceptions for governmental entities apply only to Fourth Amendment 18 government actors—investigative agencies and prosecuting attorneys—and not to criminal 19 defendants, irrespective of whether they happen to be represented by a publicly funded criminal 20 defender’s office.”) (citations omitted). And even qualifying “governmental entities” may compel 21 disclosure of content data only pursuant to a search warrant supported by a finding of probable 22 cause. See United States v. Warshak (6th Cir. 2010) 631 F.3d 266, 288.3 23 2 24 A subpoena may be used to seek only non-content information, such as a customer’s “name,” “address,” “records of session times and durations,” “length of service,” “telephone or 25 instrument number or other subscriber number,” “means and source of payment,” and other non- content records. 18 U.S.C. § 2703(c)(2). 26 3 A component of a state judiciary like OCFW likewise does not constitute a “governmental 27 entity” to which the SCA’s narrow exceptions to disclosure apply. See Tex. Gov’t Code Ann. § 78.002(a) (OCFW is a component of the Texas judicial system); 26 Tex. Jur. 3d Criminal 28 Procedure: Posttrial Proceedings § 281 (similar). 13 GITHUB, INC.’S OPPOSITION TO MOTION TO COMPEL PRODUCTION OF RECORDS PURSUANT TO CAL. PENAL CODE § 1334.2 1 Here, the Subpoena violates the SCA because it purports to require GitHub, which is both 2 an RCS and an ECS, to produce the content of ESR’s communications—namely, the STRmix 3 software, source code, User Manual, Implementation and Validation Guide, Installation Manual, 4 “developmental validation records . . . including test scripts, gap analysis documents, [and] risk 5 identification documents,” Change Request forms, and Release and Testing Reports. Mot. Ex. A, 6 Attachment 3. These materials clearly constitute the “content” of “electronic communications” 7 under the SCA. See 18 U.S.C. § 2510(8) (defining “content” as “any information concerning the 8 substance, purport, or meaning of [an electronic] communication”); 18 U.S.C. § 2510(12) 9 (defining “electronic communication” as “any transfer of signs, signals, writing, images, sounds, 10 data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, 11 photoelectronic or photooptical system that affects interstate or foreign commerce”). There is 12 accordingly no exception that would bring the Subpoena outside the SCA’s broad prohibition on 13 the disclosure of content data.4 14 Nor is there any constitutional reason for declining to enforce the SCA’s clear prohibition 15 on disclosure of ESR’s content data. “There is no federal right, constitutional or otherwise, to 16 discovery in a habeas corpus proceeding.” In re Lawley (2008) 42 Cal. 4th 1231, 1249 (citing 17 Harris v. Nelson (1969) 394 U.S. 286, 295). The same is true as a matter of California state law. 18 See id. (California courts have not “recognized any state right to unfettered discovery.”). Indeed, 19 many of the constitutional protections that apply to “the trial stage of capital offense adjudication, 20 where the court and jury hear testimony, receive evidence, and decide the questions of guilt and 21 punishment”—including the right to counsel, to compulsory process, and to confront witnesses— 22 do not extend to post-conviction habeas proceedings. Murray v. Giarratano (1989) 492 U.S. 1, 23 9 (“We have similarly refused to hold that the fact that a death sentence has been imposed requires