9th Circuit Rules on Application of Wiretap Act and Stored Communications Act to Secure Web Sites

August 23, 2002. The U.S. Court of Appeals (9thCir) issued its opinion [39 pages in PDF] in Konop v. Hawaiian Airlines, a case involving application of the Wiretap Act and the Stored Communications Act to password protected discussion web sites. This is the Appeals Courts' second opinion in this case.

The Appeals Court held in this second opinion that the unauthorized accessing of messages posted to a password protected web site does not violate the Wiretap Act because the Wiretap Act only covers messages intercepted during transmission, not those intercepted in storage. And hence, the Appeals Court affirmed the District Court's summary judgment on this issue in favor of a defendant who accessed the web site under false pretences. The Appeals Court reversed the District Court's summary judgment for the defendant on the Stored Communications Act issue, but only on narrow grounds peculiar to this case.

Background. Robert Konop, a pilot for Hawaiian Airlines (HA), operated a bulletin board web site for discussion of HA union representation issues. Konop, who opposed labor concessions sought by HA, made statements in the web site that were critical of both his employer and the pilots' union. The web site was password protected, and required registration and consent not to disclose the contents of the web site. An HA VP named James Davis repeatedly accessed the web site under false pretenses: logging in as pilots who had authority to access the web site. The two other pilots, named Wong and Gardner, had authority to use the website, and gave Davis permission and information to access the web site.

Previous Proceedings. Konop filed a complaint in U.S. District Court (DHawaii) against HA alleging that HA (1) intercepted an electronic communication in violation of the Wiretap Act, as amended by the Electronic Communications Privacy Act (ECPA), (2) accessed an electronic communications facility in violation of the Stored Communications Act, (3) violated the Railway Labor Act in several respects, and (4) committed various torts under Hawaii state law.

The trial court dismissed all of Konop's claims on summary judgment, except for retaliatory suspension under the Railway Labor Act. Konop appealed all issues except the state tort claims. The District Court did not find, or base its judgment upon a finding, that the other HA pilots, Wong and Gardner, ever used the web site.

The Appeals Court, in its first opinion [PDF], issued on January 8, 2001, reversed the District Court's judgment on both the Wiretap Act and Stored Communications Act claims on the grounds that there were triable issues of fact. The Appeals Court held that "The contents of secure websites are ``electronic communications´´ in intermediate storage that are protected from unauthorized interception under the Wiretap Act." It further held that "the Wiretap Act protects electronic communications from interception when stored to the same extent as when in transit." See, 236 F.3d 1035. However, the Appeals Court vacated this opinion. See, 262 F.3d 972.

Appeals Court. In this second opinion, the Appeals Court affirmed the judgment of the District Court with respect to the Wiretap Act claim and the retaliation claim under the Railway Labor Act. It reversed with respect to the claims under the Stored Communications Act and the remaining claims under the Railway Labor Act.

The same three judge panel -- Judges Robert Boochever, Richard Paez and Stephen Reinhardt -- participated in both opinions. Reinhardt wrote a partial dissent to this second opinion.

The Statutes. The prohibition of the Wiretap Act is codified at 18 U.S.C. 2511. It applies to anyone who "intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication". The relevant definitions are codified at 18 U.S.C. § 2510.

The key terms for this case are "intercept" and "electronic communication". Section 2510(c)(4) provides that intercept "means the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device." Section 2510(c)(12) provides, in part, that electronic communication "means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system ..."

The Stored Communications Act prohibition is codified at 28 U.S.C. 2701.

The Appeals Court first commented on the legislative history of the ECPA, which was passed by the Congress in 1986. (See, Pub. L. No. 99-508, 100 Stat. 1848). The Court wrote that "Title I of the ECPA amended the federal Wiretap Act, which previously addressed only wire and oral communications, to ``address[ ] the interception of ... electronic communications.´´ ... Title II of the ECPA created the Stored Communications Act (SCA), which was designed to ``address[ ] access to stored wire and electronic communications and transactional records.´´ ... As we have previously observed, the intersection of these two statutes ``is a complex, often convoluted, area of the law.´´ ... In the present case, the difficulty is compounded by the fact that the ECPA was written prior to the advent of the Internet and the World Wide Web. As a result, the existing statutory framework is ill-suited to address modern forms of communication like Konop's secure website." (Citations omitted.)

The Court also noted that "The legislative history of the ECPA suggests that Congress wanted to protect electronic communications that are configured to be private, such as email and private electronic bulletin boards." It added that "The nature of the Internet, however, is such that if a user enters the appropriate information (password, social security number, etc.), it is nearly impossible to verify the true identity of that user. ... We are confronted with such a situation here."

Wiretap Act. The Appeals Court affirmed summary judgment for HA on this issue. The Court first concluded that Konop's website fits the definition of "electronic communication." However, the Court held that HA did not "intercept" an electronic communication.

After a lengthy analysis of precedent, the Court concluded that "for a website such as Konop's to be ``intercepted´´ in violation of the Wiretap Act, it must be acquired during transmission, not while it is in electronic storage." And since the Appeals Court found no "interception", it affirmed the District Court's summary judgment against Konop on his Wiretap Act claims.

Stored Communications Act. The Appeals Court wrote that "The SCA makes it an offense to ``intentionally access[ ] without authorization a facility through which an electronic communication service is provided ... and thereby obtain[ ] ... access to a wire or electronic communication while it is in electronic storage in such system.´´ 18 U.S.C. § 2701(a)(1). The SCA excepts from liability, however, ``conduct authorized ... by a user of that service with respect to a communication of or intended for that user.´´ 18 U.S.C. § 2701(c)(2). The district court found that the exception in § 2701(c)(2) applied because Wong and Gardner consented to Davis' use of Konop's website. It therefore granted summary judgment to Hawaiian on the SCA claim."

However, the Appeals Court, focusing on the term "user", reversed the District Court. The Appeals Court reasoned that because (1) Section 2701 provides that only a "user" can authorize access by a third party, (2) Section 2701 defines "user" as someone who "uses the service", and (3) the District Court did not make a finding that Wong and Gardner had used the service, that therefore there is not sufficient evidence in the record to sustain the application of authorization exception, and the summary judgment for HA must be vacated.

Of course, on remand, it is hypothetically possible that the District Court would make the requisite finding of use by the authorizer, and enter summary judgment for HA once again. Moreover, the Appeals Court's holding is not likely to have wide reach, because most persons who have a password to a protected web site, and know their password, have also used that web site.

Railway Labor Act. The Court also addressed the Railway Labor Act claims at length. However, those are not addressed in this article.

Dissent. Judge Stephen Reinhardt dissented from the majority's opinion with respect to the Wiretap Act. He wrote that "I dissent, however, from Part B of Section I, which holds that the term ``intercept´´ in the Wiretap Act, as applied to electronic communications, refers solely to contemporaneous acquisition. I conclude instead that ``stored electronic communications´´ are subject to the statute's intercept prohibition as well."

Advice for Congress. The Court also wrote that "We observe that until Congress brings the laws in line with modern technology, protection of the Internet and websites such as Konop's will remain a confusing and uncertain area of the law." However, it is very difficult to move wiretap or ECPA related bills through the Congress because the issues involved are so contentious. Moreover, many members of the Congress are currently not disposed to following the advice of the Ninth Circuit, as a result of its recent opinion regarding constitutionality of the Pledge of Allegiance.