|
6/18. The U.S. Court of Appeals (6thCir)
issued its opinion
[20 pages in PDF] in Warshak v. U.S., a case regarding the 4th Amendment, the
Stored Communications Act (SCA), and government access to e-mail held by internet service
providers (ISPs).
Summary. The government obtained orders under obsolete provisions
of the SCA that enabled it to obtain from two ISPs e-mail from the personal
accounts of Steven Warshak, a Cincinnati peddler of "nutraceuticals"
and "natural supplements". The government obtained the orders under a mere
relevance standard, and provided no notice to Warshak until one year latter. He
sued the government.
The Court of Appeals held that "individuals maintain a reasonable expectation of
privacy in e-mails that are stored with, or sent or received through, a commercial ISP".
Hence, the 4th Amendment's requirement that the government must obtain a warrant based upon
probable cause applies to certain stored e-mail. The Court of Appeals added that
alternatively the government can give prior notice to the targeted individual. The
government cannot merely rely upon the statutory procedure set out
in the SCA to seize stored e-mail.
The Court of Appeals also affirmed, with minor modification, the preliminary injunction
issued by the U.S. District Court (SDOhio). The
Court of Appeals remanded to the District Court to enjoin the government from "seizing
the contents of a personal e-mail account maintained by an ISP in the name of any resident
of the Southern District of Ohio without either (1) providing the relevant account holder
or subscriber prior notice and an opportunity to be heard, or (2) making a fact-specific
showing that the account holder maintained no expectation of privacy with respect to the ISP,
in which case only the ISP need be provided prior notice and an opportunity to be
heard."
This is the first Court of Appeals to address the application of the 4th Amendment to
personal e-mail accounts in the possession of an ISP. This is the first Court of Appeals
to sustain a facial 4th Amendment challenge to the SCA.
This opinion, if it stands, is a major victory for groups that advocate 4th Amendment
and/or privacy rights in the context of information technologies, and a major setback for
the Department of Justice's (DOJ) efforts to
erode Constitutional and privacy rights associated with these new technologies.
The 4th Amendment requires the government to obtain a court order, based upon
a finding of probable cause to believe that a crime has been committed, before
it can seize or search "persons, houses, papers, and effects". The Supreme Court
has held since its 1967 opinion in Katz v. U.S. that this requirement
extends to wiretapping telephone calls.
The Supreme Court applies a "reasonable expectation of privacy" test to
determine whether a warrant based upon probable cause is required. The Court
applies a two prong test. First, the Court asks whether the person targeted by
the government investigation has an actual expectation of privacy in the object
of the search. Second, the Court asks whether this expectation of privacy is one
that society deems reasonable.
It should be noted here that while it was easy for the courts to apply the
second prong to phone conversations, this second prong will challenge the courts
in the context of emerging information technologies. First, what degree of
privacy society wants is more of a question for democratic and legislative,
rather than judicial, processes. Second, most federal judges lack a sufficient
understanding how new technologies work, and how they are used, to render societal
judgments regarding which uses of which technologies should be accorded protection.
The Department of Justice (DOJ) has long argued
that the 4th Amendment protection does not apply to a wide range of
communications that involve third party carriers or ISPs, even though such
communications are functionally and constitutionally analogous under Katz
to phone conversations, or to records that are stored on the servers owned by
parties, even though such storage is functionally and constitutionally
analogous to "houses, papers, and effects".
This just released opinion squarely addresses whether the 4th Amendment
requirement applies to e-mail. In addition, by analogous reasoning, the 4th
Amendment probable cause requirement would also apply to many other forms of
data stored on the web servers of third party service providers.
Not only is this opinion the first to extend 4th Amendment protection to stored e-mail
--
it is sweeping. The District Court sustained a facial challenge to the SCA (as opposed to
an as applied to Warshak challenge). The DOJ argued that a facial challenge requires a
finding that the statute can never be constitutionally applied. It offered hypothetical
factual circumstances under which it argued that application of the SCA would be
constitutional. The Court of Appeals went on to hold that 4th Amendment
protection would apply in each of these circumstances.
However, there are limitations and uncertainties regarding the reach of this opinion.
It clearly reaches personal e-mail accounts. It does not affect "users of electronic
bulletin boards" where there is "public posting". It does not affect
employers' monitoring of e-mail of employees using company equipment and
services. Although, the opinion is not clear regarding government access to
employee e-mail when the employer has monitoring policies or agreements. The
opinion states at one point that such employees still hold a reasonable
expectation of privacy in e-mail as against the outside world. At another point
it states that policies of monitoring and auditing can extinguish the
expectation of privacy. The opinion lacks clarity on this.
Also, the opinion does not address related questions, such as what is the content of
an e-mail, or how cell phone location data should be treated.
Background. Steven Warshak is an individual who resides in the Southern District
of Ohio. The federal government conducted an investigation of Warshak and a company that
he owned, Berkeley Premium Nutraceuticals, Inc.
(BPN), a Cincinnati based provider of a range of products that BPN titles "natural
supplements".
The government obtained from a magistrate judge of the U.S. District Court (SDOhio) an ex
parte sealed order directing NuVox Communications to
give it e-mail and customer account information of Warshak. The order also prohibited NuVox
from disclosing the existence of the order. The government obtained a similar order
directed to Yahoo.
The orders stated that they were issued pursuant to the
18 U.S.C. § 2703, which is part of the Stored
Communications Act (SCA). The order allowed the government to delay notice to
Warshak for 90 days. The government delayed notice for one year.
Warshak then promptly filed a complaint in U.S. District Court (SDOhio) against the
United States challenging the constitutionality of the statute, and seeking injunctive
relief.
The District Court granted Warshak a preliminary injunction. The U.S. brought the present
appeal.
Stored Communications Act. The SCA is codified at
18
U.S.C. §§ 2701-2712.
First, the definitions are critical. The statute is not written in terms of
"e-mail", "e-mail service providers", or "internet service
providers". Rather, it uses the terms "remote computing service", "wire
communication", "electronic communication", "electronic communications
system", and "electronic communications service".
The original SCA was
enacted in 1986. Many of its terms were included with an understanding of technologies are
no longer in use, and without an understanding of technologies now being used. That is, the
statute is obsolete and fails to provide investigators, judges, carriers, ISPs, and
affected persons clear guidance regarding its meaning. The SCA procedure
employed by the government in this case suggests that the government is able to
exploit obsolete language to obtain results never contemplated by the Congress.
As the following recitation of statutory sections shows, the Congress made it easier for
the government to seize the content of electronic communications from a "remote
computing service" than from a "electronic communication service". The
DOJ categorized NuVox and Yahoo as a "remote computing service".
18 U.S.C. § 2711 defines the term "remote computing service" (RCS) to mean
"the provision to the public of computer storage or processing services by means
of an electronic communications system".
18 U.S.C. § 2510 defines "electronic communications system" to mean "any
wire, radio, electromagnetic, photooptical or photoelectronic facilities for the transmission
of wire or electronic communications, and any computer facilities or related electronic
equipment for the electronic storage of such communications". It defines
"electronic communication service" to mean "any service which provides to
users thereof the ability to send or receive wire or electronic communications".
Section 2510 also defines "wire communication" as "aural transfer",
and "electronic communication" as "any transfer of signs, signals, writing,
images, sounds, data, or intelligence of any nature transmitted in whole or in part by a
wire, radio, electromagnetic, photoelectronic or photooptical system ...".
Second, there are the provisions of the SCA that allow the government to
seize electronic communications.
Subsection 2703(a) covers access to electronic communications held by a "electronic
communications service". It provides that "A governmental entity may
require the disclosure by a provider of electronic communication service of the
contents of a wire or electronic communication, that is in electronic storage in
an electronic communications system for one hundred and eighty days or less,
only pursuant to a warrant ...". However, the government did not obtain a
warrant, and did not follow this route.
Alternatively, subsection 2703(a) provides that "A governmental entity may
require the disclosure by a provider of electronic communications services of
the contents of a wire or electronic communication that has been in electronic
storage in an electronic communications system for more than one hundred and
eighty days by the means available under subsection (b) ...". The government did
not follow this route either.
Then, subsection 2703(b) covers access to "electronic communications" held by
a "remote computing service" (RCS). First, it provides that "A
governmental entity may require a provider of remote computing service to
disclose the contents of any wire or electronic communication ... without
required notice to the subscriber or customer, if the governmental entity
obtains a warrant ...". But, the government did not follow this procedure
either. This too would have required a warrant.
Alternatively, subsection 2703(b) provides that the government may require
the RCS to disclose contents of electronic communications "with prior notice
from the governmental entity to the subscriber or customer if the governmental
entity ... uses an administrative subpoena ... or ... obtains a court order for
such disclosure under subsection (d) ...". The government followed this route,
to a point. This procedure does not require a warrant, but it does require prior notice.
Subsection 2703(d) sets the standard for issuance of a subsection 2703(b)
order: "if the governmental entity offers specific and articulable facts showing
that there are reasonable grounds to believe that the contents of a wire or
electronic communication, or the records or other information sought, are
relevant and material to an ongoing criminal investigation." This relevance
standard is much lower than the 4th Amendment's probable cause standard. It is
much easier for government to meet this standard. And, in the present case, the
government was able to convince a magistrate judge that it had satisfied this
lower standard.
This route, however, requires prior notice to the individual. However, subsection 2703(b)
adds the qualifier, "except that delayed notice may be given pursuant to section
2705".
18 U.S.C. § 2705, in turn provides for a maximum delay of 90 days if the court
determines that one of several conditions is present. One of these, that there is
"reason to believe" that prior notification would lead to "destruction
of or tampering with evidence". The government sought
such a delay, and obtained it from the court.
Hence, the government obtained an order to the ISP to turn over the content
of e-mail, pursuant to the low standard of relevance (rather than probable
cause). The order further allowed no notice to the individual for 90 days.
However, the government did not provide notice after 90 days. Rather it waited for over
one year. That is, the government violated the statute and the Court's order.
The SCA's language is becoming increasingly obsolete and confusing as technologies and
uses of those technologies advance. The DOJ also rarely appeals adverse decisions by
magistrate judges and District Court judges. Forum shopping for accommodating judges achieves
the desired results, and creates no settled law. The DOJ benefits from this legal uncertainty.
Carriers, ISPs and magistrate judges have little firm basis upon which to refuse requests
for warrantless no notice orders.
4th Amendment and Katz. The government and the court
that issued the order (without probable cause, and without notice) followed
their interpretation of statutory procedure under the SCA. In contrast, the
District Court which enjoined the government, and Court of Appeals which just
affirmed, held that the 4th Amendment is applicable.
4th Amendment to the Constitution provides, in full, that "The right of the
people to be secure in their persons, houses, papers, and effects, against
unreasonable searches and seizures, shall not be violated, and no Warrants shall
issue, but upon probable cause, supported by Oath or affirmation, and
particularly describing the place to be searched, and the persons or things to
be seized."
The Supreme Court issued its landmark
opinion in Katz v. U.S. in 1967. It is reported at 389 U.S. 347. In
that case the FBI conducted a warrantless wiretap of a public telephone booth
used by the defendant, and introduced the product of those wiretaps into
evidence in a criminal trial.
The Supreme Court, with Justice Potter Stewart writing the opinion, held that
warrants based upon probable cause are required for telephone wiretaps, even
when the call is placed from a public phone booth. Stewart wrote that "the
Fourth Amendment protects people, not places."
Former Justice Harlan used the phrase "constitutionally protected reasonable
expectation of privacy" in his concurrence. He elaborated that "My
understanding of the rule that has emerged from prior decisions is that there is
a twofold requirement, first that a person have exhibited an actual (subjective)
expectation of privacy and, second, that the expectation be one that society is
prepared to recognize as ``reasonable.´´" (Parentheses in original.)
The just released opinion of the 6th Circuit relies upon Katz and its
progeny. There is no prior Supreme Court or Court of Appeals opinion on the
applicability of the 4th Amendment to e-mail held by an ISP.
The Congress followed up on the Katz opinion when it enacted the
Omnibus Crime Control and Safe Streets Act of 1968, which is Public Law No.
90-351. It included the Wiretap Act, which is now codified at U.S.C. §§
2510-2522. Two decades later the Congress extended meaningful statutory
protection to electronic communications, including stored communications.
However, as the actions of the government in this case illustrate, the DOJ has
put the statute to other uses.
There are few federal appellate opinions applying the 4th Amendment to
information technologies. Hence, the Court of Appeals resorted to discussing
some cases of minimal relevance. First, the Court cited the
U.S. Court of Appeals (4thCir),
February 29, 2000
opinion [16
pages in PDF] in U.S. v. Simons, which is reported at
206 F.3d 392. The court in that case found that the
Simons lacked a reasonable expectation of privacy in the contents of a computer
hard drive. However, he was a CIA employee, who used a CIA computer, at the CIA,
while there was in effect a CIA policy of auditing computer usage. Simons
proceeded to use his CIA computer to download porn. He was caught and
prosecuted. The Court held that he had no reasonable expectation of privacy.
That case is U.S. v. Simons, U.S. Court of Appeals for the 4th
Circuit, App. Ct. No. 99-4238, an appeal from the U.S. District Court for the
Eastern District of Virginia, Judge James Cacheris presiding, D.C. No. CR-98-375.
The Court of Appeals also relied upon the
U.S. Court of Appeals (9thCir) April 2007
opinion [13 pages in PDF] in U.S. v. Heckenkamp. That case did not involve seizure
of e-mail from an ISP. Rather, it involved seizure of data from a computer owned by a student
that was located in his dormitory room. It was prosecution for violation of 18 U.S.C. § 1030
in which the issue was the admissibility of evidence acquired in a warrantless remote search
of a student's hard drive by a university network administrator who was acting in association
with the FBI. See,
story titled "9th Circuit Constrains Computer Privacy" in
TLJ Daily E-Mail
Alert No. 1,563, April 10, 2007.
Heckenkamp prevailed on the issue of whether he held a reasonable expectation
of privacy in the contents of his computer. The Court of Appeals opinion
provides guidance regarding when there is a reasonable expectation of privacy in
computers that are attached to networks. However, Heckenkamp lost on the second
issue -- the special needs exception to the warrant and probable cause requirement.
That case is U.S.A. v. Heckenkamp, U.S. Court of Appeals for the 9th
Circuit, App. Ct. Nos. 05-10322 and 05-10323, appeals from the U.S. District
Court for the Northern District of California, D.C. Nos. CR-03-20041-JW and
CR-00-20355-JW, Judge James Ware presiding. Judge Sidney Thomas wrote the opinion of the
Court of Appeals, in which Judges William Canby and Michael Hawkins joined.
Neither Simons nor Heckenkamp was a SCA case. Neither involved
stored e-mail held by a third party ISP.
Court of Appeals Opinion. The DOJ raised numerous arguments in its
brief [75 pages in PDF]. The Court of Appeals first rejected its justiciability
arguments that Warshak lacked standing, and that the case was not yet ripe.
These arguments were tenuous at best, given that the government had committed the acts
of seizing e-mail, the acts were directed at Warshak, that Warshak plead and the Court found
that the government violated his Constitutional rights, and that the government
insisted on continuing its practices.
As for standing, and its injury in fact requirement, the Court concluded that
"In light of the past e-mail seizures, the ongoing
nature of the investigation against Warshak, and the government policy of
seizing e-mails without a warrant or notice to the account holder, we agree with
the district court that Warhsak has shown a sufficiently imminent threat of
future injury to meet the injury in fact element of standing".
With respect to to both standing and ripeness the Court wrote that the DOJ "has not
identified a single case" that matches the facts of this case.
Next, the Court rejected the main argument of the DOJ, that the 4th Amendment
is not applicable, and that the SCA's relevance standard is the appropriate
standard. The DOJ argued that there was no search or seizure within the meaning
of the 4th Amendment. Rather, there was merely a compelled disclosure, pursuant
to statute, akin to a subpoena, from a third party.
The Electronic Frontier Foundation (EFF), Center for
Democracy and Technology (CDT), and American Civil Liberties Union (ACLU) submitted an
amicus brief
[38 pages in PDF] arguing for applicability of the 4th Amendment. Also,
Susan Freiwald
of the University of San Francisco School of Law and
Patricia Bellia
of Notre Dame Law School submitted an
amicus
brief [41 pages in PDF] arguing the same. The Court of Appeals wrote that these two
"amici curiae convincingly analogize the privacy interest that e-mail users hold in the
content of their e-mails to the privacy interest in the content of telephone calls".
(In addition, Freiwald wrote an
article [PDF] for
the Stanford Technology Law Review titled "First Principles of Communications
Privacy" that discusses this case, and the issues involved in this case.)
The Court of Appeals wrote that "individuals maintain a reasonable expectation of
privacy in e-mails that are stored with, or sent or received through, a commercial ISP. The
content of e-mail is something that the user ``seeks to preserve as private,´´ and therefore
``may be constitutionally protected.´´" (Quoting from Katz.)
It continued that "It goes without saying that like the telephone earlier in
our history, e-mail is an ever-increasing mode of private communication, and
protecting shared communications through this medium is as important to Fourth
Amendment principles today as protecting telephone conversations has been in the
past."
The Court of Appeals also wrote a more detailed analysis of when
communications, and third party storage, are subject to a reasonable expectation
of privacy and entitled to 4th Amendment protection.
The Court of Appeals also wrote that "Heckenkamp and Simons provide
useful bookends for the question before us, regarding when the use of some intermediary
provider of computer and e-mail services -- be it a commercial ISP, a university, an
employer, or another type of entity -- amounts to a waiver of the user’s reasonable
expectation of privacy in the content of the e-mails with respect to that intermediary. In
instances where a user agreement explicitly provides that e-mails and other files will be
monitored or audited as in Simons, the user’s knowledge of this fact may well
extinguish his reasonable expectation of privacy. Without such a statement,
however, the service provider’s control over the files and ability to access
them under certain limited circumstances will not be enough to overcome an
expectation of privacy, as in Heckenkamp."
The Court of Appeals also held that NuVox's terms of service, which allowed it
to access e-mail, does not undermine the expectation of privacy. The Court
contrasted these contractual terms to the audit policy in Simons. It wrote that
the ISP's "right to access e-mails under these user agreements is reserved for
extraordinary circumstances". In contrast, the CIA's notified its employees of
its broad audit policy.
Moreover, under the Court's reasoning, the DOJ could not evade the effect of
this reasoning by asking ISPs to amend their terms of service to allow access by
the government. It is the "expectation of privacy" that matters. The Court added
that "the government has made no showing that e-mail content is regularly
accessed by ISPs, or that users are aware of such access of content."
The Court of Appeals also held that it does not affect its conclusion that
"ISPs regularly screen users’ e-mails for viruses, spam, and child pornography."
The Court noted that this scanning is done by technology, and not manually, and
hence, "would not disclose the content of the e-mail to any person at the ISP or
elsewhere".
The DOJ also argued that Warshak must prove that
the challenged portion of the statute can never be constitutionally applied in
order for the facial challenge to be upheld. It argued several hypothetical
scenarios under which the statute might be upheld, and the basis that account
holders under these scenarios no longer hold a reasonable expectation of
privacy. Hence, the Court of Appeals considered these one by one, and made a
holding as to each one.
The Court of Appeals held that e-mail account holders whose accounts have
expired still hold a reasonable expectation of privacy.
The Court of Appeals held that e-mail account holders still hold a reasonable
expectation of privacy when the provider reserves a right to screen e-mail.
The Court of Appeals held that e-mail account holders whose accounts were acquired
anonymously or with false information still hold a reasonable expectation of privacy. The
Court of Appeals wrote that "if a hypothetical user wanted to conceal his identity or
address from the ISP, the provision of misinformation would not bear in any way
upon the privacy of the content of the user’s e-mails."
The Court of Appeals also addressed ISP user agreements. It
wrote that "the government points to certain user-provider relationships that
could diminish the subscriber’s expectation of privacy. These include an
employer that issues e-mail accounts to its employees and requires them to waive
any expectation of privacy in the account, and ISPs with similar requirements in
their terms of service. As discussed above, we reject the argument that the user
agreements in this case have such an effect. In some situations, like that in
Simons, the user agreement might
indicate that the user lacks a privacy interest vis-a-vis the employer or other
relevant e-mail provider. This possibility does not diminish a privacy right
with respect to the entire outside world, however."
The Court of Appeals also addressed injunction procedure.
Representation of Individual Privacy Interests. The present case was
brought by an individual who was subjected to a warrantless no notice seizure of his
e-mail communications. Neither NuVox nor Yahoo, who cooperated with the
government, participated in this appeal. Moreover, no trade group that
represents telecommunications carriers or ISPs participated.
In contrast, the CDT, ACLU, EFF, and law professors submitted amicus
briefs in support of the individual.
This is consistent with other litigation, Congressional hearings, and proceedings before
administrative agencies. Neither carriers nor ISPs, nor the groups that represent them, with
few exceptions, are defending or advocating the constitutional and privacy rights of their
customers or users. Moreover, when the carriers or ISPs have asserted the privacy rights of
their customers, it has usually been associated with advocating their own interests in
minimizing the financial burdens to them of providing surveillance, or advocating the
legality of business models that are adverse to the holders of copyrights.
There is a symbiotic relationship between government agencies that seek
surveillance and companies that are in a position to provide that surveillance.
This relationship facilitates mutual cooperation.
The government has an interest in obtaining surveillance from these companies.
These companies have an interest in obtaining beneficent treatment in government
regulatory and enforcement actions that might impact them or their competitors.
Moreover, if carriers of ISPs disclose their cooperation with the government,
they face criminal prosecution by the government, and civil lawsuits from their customers.
TLJ spoke with Susan Freiwald of the University of San Francisco School of Law, who
submitted an amicus brief in this case. She said that the carriers and ISPs "are in a
tough position". She said that "there is nothing to gain in opposing"
government requests. Moreover, they can get in trouble for talking about privacy, as was
the case when the Department of Justice sought search terms data.
TLJ phoned NuVox's General Counsel, Riley Murphy, who did not return the call.
The government sought in this and other cases to obtain information about
individuals by going to their service providers. To the extent that the
government sought mere relevance, rather than probable cause, based orders,
there was no meaningful review of the privacy interests by a neutral judge. To
the extent that the government sought no notice orders, the affected individuals
had no opportunity to advocate their privacy interests. Rather, under the
procedure used by the government in this and other cases, the only entities that
have had an opportunity to assert the interests of the individuals have been the
carriers and ISPs. However, they are not doing so.
The 6th Circuit, by holding that the government must either give prior notice
to the targeted individual, or obtain a warrant based upon probable cause,
assures that privacy rights are considered in the process.
More Reaction. Marc Rotenberg, head of the
Electronic Privacy Information Center (EPIC), told TLJ that "it is about
time that we inject a little 4th Amendment vitality" in this area. He added that
this opinion may impact more than government seizure of e-mail. It could reach
other stored electronic communications, including any web based activity in
which an ISP is in possession of the data of others.
Kevin Bankston of the EFF stated in a
release that "Email users expect
that their Hotmail and Gmail inboxes are just as private as their postal mail and their
telephone calls ... The government tried to get around this common-sense conclusion, but
the Constitution applies online as well as offline, as the court correctly found. That
means that the government can't secretly seize your emails without a warrant."
TLJ spoke briefly with Nathan Judish, who argued the case for the government.
He declined to discuss the case.
TLJ also phoned Warshak's company, Berkeley Premium Nutraceuticals (BPN). TLJ spoke only
with an operator, and no one took or returned the call. But, a recorded message for incoming
calls stated that "this call may be monitored or recorded".
Case Information. This case is Steven Warshak v. United States of America,
U.S. Court of Appeals for the 6th Circuit, App. Ct. No. 06-4092, an appeal from the U.S.
District Court for the Southern District of Ohio, at Cincinnati, D.C. No. 06-00357, Judge
Susan Dlott presiding.
Judge Boyce Martin wrote the opinion of the Court, in which Judges
Martha Daughtrey
and William Schwarzer (USDC/NDCal sitting by designation) joined.
Judge Dlott was appointed by former President Clinton. Two of the members of the three
judge panel are also Democrats. Judge Martin is a Carter appointee, and a liberal whom
conservatives love to loath. Judge Daughtrey is a Clinton appointee. Schwartzer, who is a
senior status District Court Judge for the Northern District of California, was appointed by
former President Ford. Just prior to his appointment, he was Senior Counsel for
the President's Commission on CIA Activities Within the United States, which was
also known as the Rockefeller Commission.
Perhaps it should be noted too that former Justice Potter Stewart, who wrote the Supreme
Court's opinion in Katz, was from Cincinnati, and served on the 6th Circuit.
See also, the EFF's web page
containing links to pleadings in this case.
|
