VPNs with servers in Guam

Under the Stored Communications Act, a provider of electronic communication service or remote computing service must, on a governmental request, preserve records pending a court order for 90 days, extended once by another 90 (§ 2703(f)). That duty is triggered by a request; it is not a standing retention period.

Subscriber data is obtainable by subpoena: name, address, connection and session-time records, length and types of service, any subscriber number or temporarily assigned network address, and means of payment (§ 2703(c)(2)). Whether a VPN operator is such a provider is not established.

The Organic Act of Guam provides that no law may be enacted in Guam abridging the freedom of speech or of the press (48 U.S.C. § 1421b(a)).

Guam’s code makes it a misdemeanour, with up to one year’s imprisonment and a $1,000 fine, to use a computer with intent to harass or abuse by anonymous contact, threats, obscene material sent after a request to stop, or false postings about a person (9 GCA § 28.90).

A minor’s use of a computer or telecommunications device to create, send or possess nude images of a minor is a separate offence (§ 28.100).

Federal law separately punishes a threat to injure sent in interstate or foreign commerce with up to five years (18 U.S.C. § 875(c)). An account is traced through the subscriber records a provider must disclose to a governmental entity under § 2703(c)(2), including session times and any temporarily assigned network address.

The Organic Act guarantees the right to be secure against unreasonable searches and seizures and requires warrants on probable cause supported by oath or affirmation (48 U.S.C. § 1421b(c)). Federal law requires a warrant for the contents of a communication in electronic storage for 180 days or less (§ 2703(a)).

Subscriber records need a warrant, court order or subpoena, according to what is sought (§ 2703(c)). The order of the rows is the security score, and a server’s location is not a recommendation.