6th Circuit Holds That People Have a Reasonable Expectation of Privacy in E-Mail Stored With, or Sent or Received Through, an ISP

June 18, 2007. The U.S. Court of Appeals (6thCir) issued its opinion [20 pages in PDF] in Warshak v. U.S., a case regarding the 4th Amendment, the Stored Communications Act (SCA), and government access to e-mail held by internet service providers (ISPs).

Summary. The government obtained orders under obsolete provisions of the SCA that enabled it to obtain from two ISPs e-mail from the personal accounts of Steven Warshak, a Cincinnati peddler of "nutraceuticals" and "natural supplements". The government obtained the orders under a mere relevance standard, and provided no notice to Warshak until one year latter. He sued the government.

The Court of Appeals held that "individuals maintain a reasonable expectation of privacy in e-mails that are stored with, or sent or received through, a commercial ISP". Hence, the 4th Amendment's requirement that the government must obtain a warrant based upon probable cause applies to certain stored e-mail. The Court of Appeals added that alternatively the government can give prior notice to the targeted individual. The government cannot merely rely upon the statutory procedure set out in the SCA to seize stored e-mail.

The Court of Appeals also affirmed, with minor modification, the preliminary injunction issued by the U.S. District Court (SDOhio). The Court of Appeals remanded to the District Court to enjoin the government from "seizing the contents of a personal e-mail account maintained by an ISP in the name of any resident of the Southern District of Ohio without either (1) providing the relevant account holder or subscriber prior notice and an opportunity to be heard, or (2) making a fact-specific showing that the account holder maintained no expectation of privacy with respect to the ISP, in which case only the ISP need be provided prior notice and an opportunity to be heard."

This is the first Court of Appeals to address the application of the 4th Amendment to personal e-mail accounts in the possession of an ISP. This is the first Court of Appeals to sustain a facial 4th Amendment challenge to the SCA.

This opinion, if it stands, is a major victory for groups that advocate 4th Amendment and/or privacy rights in the context of information technologies, and a major setback for the Department of Justice's (DOJ) efforts to erode Constitutional and privacy rights associated with these new technologies.

The 4th Amendment requires the government to obtain a court order, based upon a finding of probable cause to believe that a crime has been committed, before it can seize or search "persons, houses, papers, and effects". The Supreme Court has held since its 1967 opinion in Katz v. U.S. that this requirement extends to wiretapping telephone calls.

The Supreme Court applies a "reasonable expectation of privacy" test to determine whether a warrant based upon probable cause is required. The Court applies a two prong test. First, the Court asks whether the person targeted by the government investigation has an actual expectation of privacy in the object of the search. Second, the Court asks whether this expectation of privacy is one that society deems reasonable.

It should be noted here that while it was easy for the courts to apply the second prong to phone conversations, this second prong will challenge the courts in the context of emerging information technologies. First, what degree of privacy society wants is more of a question for democratic and legislative, rather than judicial, processes. Second, most federal judges lack a sufficient understanding how new technologies work, and how they are used, to render societal judgments regarding which uses of which technologies should be accorded protection.

The Department of Justice (DOJ) has long argued that the 4th Amendment protection does not apply to a wide range of communications that involve third party carriers or ISPs, even though such communications are functionally and constitutionally analogous under Katz to phone conversations, or to records that are stored on the servers owned by parties, even though such storage is functionally and constitutionally analogous to "houses, papers, and effects".

This just released opinion squarely addresses whether the 4th Amendment requirement applies to e-mail. In addition, by analogous reasoning, the 4th Amendment probable cause requirement would also apply to many other forms of data stored on the web servers of third party service providers.

Not only is this opinion the first to extend 4th Amendment protection to stored e-mail -- it is sweeping. The District Court sustained a facial challenge to the SCA (as opposed to an as applied to Warshak challenge). The DOJ argued that a facial challenge requires a finding that the statute can never be constitutionally applied. It offered hypothetical factual circumstances under which it argued that application of the SCA would be constitutional. The Court of Appeals went on to hold that 4th Amendment protection would apply in each of these circumstances.

However, there are limitations and uncertainties regarding the reach of this opinion. It clearly reaches personal e-mail accounts. It does not affect "users of electronic bulletin boards" where there is "public posting". It does not affect employers' monitoring of e-mail of employees using company equipment and services. Although, the opinion is not clear regarding government access to employee e-mail when the employer has monitoring policies or agreements. The opinion states at one point that such employees still hold a reasonable expectation of privacy in e-mail as against the outside world. At another point it states that policies of monitoring and auditing can extinguish the expectation of privacy. The opinion lacks clarity on this.

Also, the opinion does not address related questions, such as what is the content of an e-mail, or how cell phone location data should be treated.

Background. Steven Warshak is an individual who resides in the Southern District of Ohio. The federal government conducted an investigation of Warshak and a company that he owned, Berkeley Premium Nutraceuticals, Inc. (BPN), a Cincinnati based provider of a range of products that BPN titles "natural supplements".

The government obtained from a magistrate judge of the U.S. District Court (SDOhio) an ex parte sealed order directing NuVox Communications to give it e-mail and customer account information of Warshak. The order also prohibited NuVox from disclosing the existence of the order. The government obtained a similar order directed to Yahoo.

The orders stated that they were issued pursuant to the 18 U.S.C. § 2703, which is part of the Stored Communications Act (SCA). The order allowed the government to delay notice to Warshak for 90 days. The government delayed notice for one year.

Warshak then promptly filed a complaint in U.S. District Court (SDOhio) against the United States challenging the constitutionality of the statute, and seeking injunctive relief.

The District Court granted Warshak a preliminary injunction. The U.S. brought the present appeal.

Stored Communications Act. The SCA is codified at 18 U.S.C. §§ 2701-2712.

First, the definitions are critical. The statute is not written in terms of "e-mail", "e-mail service providers", or "internet service providers". Rather, it uses the terms "remote computing service", "wire communication", "electronic communication", "electronic communications system", and "electronic communications service".

The original SCA was enacted in 1986. Many of its terms were included with an understanding of technologies are no longer in use, and without an understanding of technologies now being used. That is, the statute is obsolete and fails to provide investigators, judges, carriers, ISPs, and affected persons clear guidance regarding its meaning. The SCA procedure employed by the government in this case suggests that the government is able to exploit obsolete language to obtain results never contemplated by the Congress.

As the following recitation of statutory sections shows, the Congress made it easier for the government to seize the content of electronic communications from a "remote computing service" than from a "electronic communication service". The DOJ categorized NuVox and Yahoo as a "remote computing service".

18 U.S.C. § 2711 defines the term "remote computing service" (RCS) to mean "the provision to the public of computer storage or processing services by means of an electronic communications system".

18 U.S.C. § 2510 defines "electronic communications system" to mean "any wire, radio, electromagnetic, photooptical or photoelectronic facilities for the transmission of wire or electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications". It defines "electronic communication service" to mean "any service which provides to users thereof the ability to send or receive wire or electronic communications".

Section 2510 also defines "wire communication" as "aural transfer", and "electronic communication" as "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system ...".

Second, there are the provisions of the SCA that allow the government to seize electronic communications.

Subsection 2703(a) covers access to electronic communications held by a "electronic communications service". It provides that "A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant ...". However, the government did not obtain a warrant, and did not follow this route.

Alternatively, subsection 2703(a) provides that "A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days by the means available under subsection (b) ...". The government did not follow this route either.

Then, subsection 2703(b) covers access to "electronic communications" held by a "remote computing service" (RCS). First, it provides that "A governmental entity may require a provider of remote computing service to disclose the contents of any wire or electronic communication ... without required notice to the subscriber or customer, if the governmental entity obtains a warrant ...". But, the government did not follow this procedure either. This too would have required a warrant.

Alternatively, subsection 2703(b) provides that the government may require the RCS to disclose contents of electronic communications "with prior notice from the governmental entity to the subscriber or customer if the governmental entity ... uses an administrative subpoena ... or ... obtains a court order for such disclosure under subsection (d) ...". The government followed this route, to a point. This procedure does not require a warrant, but it does require prior notice.

Subsection 2703(d) sets the standard for issuance of a subsection 2703(b) order: "if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation." This relevance standard is much lower than the 4th Amendment's probable cause standard. It is much easier for government to meet this standard. And, in the present case, the government was able to convince a magistrate judge that it had satisfied this lower standard.

This route, however, requires prior notice to the individual. However, subsection 2703(b) adds the qualifier, "except that delayed notice may be given pursuant to section 2705". 18 U.S.C. § 2705, in turn provides for a maximum delay of 90 days if the court determines that one of several conditions is present. One of these, that there is "reason to believe" that prior notification would lead to "destruction of or tampering with evidence". The government sought such a delay, and obtained it from the court.

Hence, the government obtained an order to the ISP to turn over the content of e-mail, pursuant to the low standard of relevance (rather than probable cause). The order further allowed no notice to the individual for 90 days.

However, the government did not provide notice after 90 days. Rather it waited for over one year. That is, the government violated the statute and the Court's order.

The SCA's language is becoming increasingly obsolete and confusing as technologies and uses of those technologies advance. The DOJ also rarely appeals adverse decisions by magistrate judges and District Court judges. Forum shopping for accommodating judges achieves the desired results, and creates no settled law. The DOJ benefits from this legal uncertainty. Carriers, ISPs and magistrate judges have little firm basis upon which to refuse requests for warrantless no notice orders.

4th Amendment and Katz. The government and the court that issued the order (without probable cause, and without notice) followed their interpretation of statutory procedure under the SCA. In contrast, the District Court which enjoined the government, and Court of Appeals which just affirmed, held that the 4th Amendment is applicable.

4th Amendment to the Constitution provides, in full, that "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The Supreme Court issued its landmark opinion in Katz v. U.S. in 1967. It is reported at 389 U.S. 347. In that case the FBI conducted a warrantless wiretap of a public telephone booth used by the defendant, and introduced the product of those wiretaps into evidence in a criminal trial.

The Supreme Court, with Justice Potter Stewart writing the opinion, held that warrants based upon probable cause are required for telephone wiretaps, even when the call is placed from a public phone booth. Stewart wrote that "the Fourth Amendment protects people, not places."

Former Justice Harlan used the phrase "constitutionally protected reasonable expectation of privacy" in his concurrence. He elaborated that "My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as ``reasonable.´´" (Parentheses in original.)

The just released opinion of the 6th Circuit relies upon Katz and its progeny. There is no prior Supreme Court or Court of Appeals opinion on the applicability of the 4th Amendment to e-mail held by an ISP.

The Congress followed up on the Katz opinion when it enacted the Omnibus Crime Control and Safe Streets Act of 1968, which is Public Law No. 90-351. It included the Wiretap Act, which is now codified at U.S.C. §§ 2510-2522. Two decades later the Congress extended meaningful statutory protection to electronic communications, including stored communications. However, as the actions of the government in this case illustrate, the DOJ has put the statute to other uses.

There are few federal appellate opinions applying the 4th Amendment to information technologies. Hence, the Court of Appeals resorted to discussing some cases of minimal relevance. First, the Court cited the U.S. Court of Appeals (4thCir), February 29, 2000 opinion [16 pages in PDF] in U.S. v. Simons, which is reported at 206 F.3d 392. The court in that case found that the Simons lacked a reasonable expectation of privacy in the contents of a computer hard drive. However, he was a CIA employee, who used a CIA computer, at the CIA, while there was in effect a CIA policy of auditing computer usage. Simons proceeded to use his CIA computer to download porn. He was caught and prosecuted. The Court held that he had no reasonable expectation of privacy.

That case is U.S. v. Simons, U.S. Court of Appeals for the 4th Circuit, App. Ct. No. 99-4238, an appeal from the U.S. District Court for the Eastern District of Virginia, Judge James Cacheris presiding, D.C. No. CR-98-375.

The Court of Appeals also relied upon the U.S. Court of Appeals (9thCir) April 2007 opinion [13 pages in PDF] in U.S. v. Heckenkamp. That case did not involve seizure of e-mail from an ISP. Rather, it involved seizure of data from a computer owned by a student that was located in his dormitory room. It was prosecution for violation of 18 U.S.C. § 1030 in which the issue was the admissibility of evidence acquired in a warrantless remote search of a student's hard drive by a university network administrator who was acting in association with the FBI. See, story titled "9th Circuit Constrains Computer Privacy" in TLJ Daily E-Mail Alert No. 1,563, April 10, 2007.

Heckenkamp prevailed on the issue of whether he held a reasonable expectation of privacy in the contents of his computer. The Court of Appeals opinion provides guidance regarding when there is a reasonable expectation of privacy in computers that are attached to networks. However, Heckenkamp lost on the second issue -- the special needs exception to the warrant and probable cause requirement.

That case is U.S.A. v. Heckenkamp, U.S. Court of Appeals for the 9th Circuit, App. Ct. Nos. 05-10322 and 05-10323, appeals from the U.S. District Court for the Northern District of California, D.C. Nos. CR-03-20041-JW and CR-00-20355-JW, Judge James Ware presiding. Judge Sidney Thomas wrote the opinion of the Court of Appeals, in which Judges William Canby and Michael Hawkins joined.

Neither Simons nor Heckenkamp was a SCA case. Neither involved stored e-mail held by a third party ISP.

Court of Appeals Opinion. The DOJ raised numerous arguments in its brief [75 pages in PDF]. The Court of Appeals first rejected its justiciability arguments that Warshak lacked standing, and that the case was not yet ripe.

These arguments were tenuous at best, given that the government had committed the acts of seizing e-mail, the acts were directed at Warshak, that Warshak plead and the Court found that the government violated his Constitutional rights, and that the government insisted on continuing its practices.

As for standing, and its injury in fact requirement, the Court concluded that "In light of the past e-mail seizures, the ongoing nature of the investigation against Warshak, and the government policy of seizing e-mails without a warrant or notice to the account holder, we agree with the district court that Warhsak has shown a sufficiently imminent threat of future injury to meet the injury in fact element of standing".

With respect to to both standing and ripeness the Court wrote that the DOJ "has not identified a single case" that matches the facts of this case.

Next, the Court rejected the main argument of the DOJ, that the 4th Amendment is not applicable, and that the SCA's relevance standard is the appropriate standard. The DOJ argued that there was no search or seizure within the meaning of the 4th Amendment. Rather, there was merely a compelled disclosure, pursuant to statute, akin to a subpoena, from a third party.

The Electronic Frontier Foundation (EFF), Center for Democracy and Technology (CDT), and American Civil Liberties Union (ACLU) submitted an amicus brief [38 pages in PDF] arguing for applicability of the 4th Amendment. Also, Susan Freiwald of the University of San Francisco School of Law and Patricia Bellia of Notre Dame Law School submitted an amicus brief [41 pages in PDF] arguing the same. The Court of Appeals wrote that these two "amici curiae convincingly analogize the privacy interest that e-mail users hold in the content of their e-mails to the privacy interest in the content of telephone calls". (In addition, Freiwald wrote an article [PDF] for the Stanford Technology Law Review titled "First Principles of Communications Privacy" that discusses this case, and the issues involved in this case.)

The Court of Appeals wrote that "individuals maintain a reasonable expectation of privacy in e-mails that are stored with, or sent or received through, a commercial ISP. The content of e-mail is something that the user ``seeks to preserve as private,´´ and therefore ``may be constitutionally protected.´´" (Quoting from Katz.)

It continued that "It goes without saying that like the telephone earlier in our history, e-mail is an ever-increasing mode of private communication, and protecting shared communications through this medium is as important to Fourth Amendment principles today as protecting telephone conversations has been in the past."

The Court of Appeals also wrote a more detailed analysis of when communications, and third party storage, are subject to a reasonable expectation of privacy and entitled to 4th Amendment protection.

The Court of Appeals also wrote that "Heckenkamp and Simons provide useful bookends for the question before us, regarding when the use of some intermediary provider of computer and e-mail services -- be it a commercial ISP, a university, an employer, or another type of entity -- amounts to a waiver of the user’s reasonable expectation of privacy in the content of the e-mails with respect to that intermediary. In instances where a user agreement explicitly provides that e-mails and other files will be monitored or audited as in Simons, the user’s knowledge of this fact may well extinguish his reasonable expectation of privacy. Without such a statement, however, the service provider’s control over the files and ability to access them under certain limited circumstances will not be enough to overcome an expectation of privacy, as in Heckenkamp."

The Court of Appeals also held that NuVox's terms of service, which allowed it to access e-mail, does not undermine the expectation of privacy. The Court contrasted these contractual terms to the audit policy in Simons. It wrote that the ISP's "right to access e-mails under these user agreements is reserved for extraordinary circumstances". In contrast, the CIA's notified its employees of its broad audit policy.

Moreover, under the Court's reasoning, the DOJ could not evade the effect of this reasoning by asking ISPs to amend their terms of service to allow access by the government. It is the "expectation of privacy" that matters. The Court added that "the government has made no showing that e-mail content is regularly accessed by ISPs, or that users are aware of such access of content."

The Court of Appeals also held that it does not affect its conclusion that "ISPs regularly screen users’ e-mails for viruses, spam, and child pornography." The Court noted that this scanning is done by technology, and not manually, and hence, "would not disclose the content of the e-mail to any person at the ISP or elsewhere".

The DOJ also argued that Warshak must prove that the challenged portion of the statute can never be constitutionally applied in order for the facial challenge to be upheld. It argued several hypothetical scenarios under which the statute might be upheld, and the basis that account holders under these scenarios no longer hold a reasonable expectation of privacy. Hence, the Court of Appeals considered these one by one, and made a holding as to each one.

The Court of Appeals held that e-mail account holders whose accounts have expired still hold a reasonable expectation of privacy.

The Court of Appeals held that e-mail account holders still hold a reasonable expectation of privacy when the provider reserves a right to screen e-mail.

The Court of Appeals held that e-mail account holders whose accounts were acquired anonymously or with false information still hold a reasonable expectation of privacy. The Court of Appeals wrote that "if a hypothetical user wanted to conceal his identity or address from the ISP, the provision of misinformation would not bear in any way upon the privacy of the content of the user’s e-mails."

The Court of Appeals also addressed ISP user agreements. It wrote that "the government points to certain user-provider relationships that could diminish the subscriber’s expectation of privacy. These include an employer that issues e-mail accounts to its employees and requires them to waive any expectation of privacy in the account, and ISPs with similar requirements in their terms of service. As discussed above, we reject the argument that the user agreements in this case have such an effect. In some situations, like that in Simons, the user agreement might indicate that the user lacks a privacy interest vis-a-vis the employer or other relevant e-mail provider. This possibility does not diminish a privacy right with respect to the entire outside world, however."

The Court of Appeals also addressed injunction procedure.

Representation of Individual Privacy Interests. The present case was brought by an individual who was subjected to a warrantless no notice seizure of his e-mail communications. Neither NuVox nor Yahoo, who cooperated with the government, participated in this appeal. Moreover, no trade group that represents telecommunications carriers or ISPs participated.

In contrast, the CDT, ACLU, EFF, and law professors submitted amicus briefs in support of the individual.

This is consistent with other litigation, Congressional hearings, and proceedings before administrative agencies. Neither carriers nor ISPs, nor the groups that represent them, with few exceptions, are defending or advocating the constitutional and privacy rights of their customers or users. Moreover, when the carriers or ISPs have asserted the privacy rights of their customers, it has usually been associated with advocating their own interests in minimizing the financial burdens to them of providing surveillance, or advocating the legality of business models that are adverse to the holders of copyrights.

There is a symbiotic relationship between government agencies that seek surveillance and companies that are in a position to provide that surveillance. This relationship facilitates mutual cooperation. The government has an interest in obtaining surveillance from these companies. These companies have an interest in obtaining beneficent treatment in government regulatory and enforcement actions that might impact them or their competitors.

Moreover, if carriers of ISPs disclose their cooperation with the government, they face criminal prosecution by the government, and civil lawsuits from their customers.

TLJ spoke with Susan Freiwald of the University of San Francisco School of Law, who submitted an amicus brief in this case. She said that the carriers and ISPs "are in a tough position". She said that "there is nothing to gain in opposing" government requests. Moreover, they can get in trouble for talking about privacy, as was the case when the Department of Justice sought search terms data.

TLJ phoned NuVox's General Counsel, Riley Murphy, who did not return the call.

The government sought in this and other cases to obtain information about individuals by going to their service providers. To the extent that the government sought mere relevance, rather than probable cause, based orders, there was no meaningful review of the privacy interests by a neutral judge. To the extent that the government sought no notice orders, the affected individuals had no opportunity to advocate their privacy interests. Rather, under the procedure used by the government in this and other cases, the only entities that have had an opportunity to assert the interests of the individuals have been the carriers and ISPs. However, they are not doing so.

The 6th Circuit, by holding that the government must either give prior notice to the targeted individual, or obtain a warrant based upon probable cause, assures that privacy rights are considered in the process.

More Reaction. Marc Rotenberg, head of the Electronic Privacy Information Center (EPIC), told TLJ that "it is about time that we inject a little 4th Amendment vitality" in this area. He added that this opinion may impact more than government seizure of e-mail. It could reach other stored electronic communications, including any web based activity in which an ISP is in possession of the data of others.

Kevin Bankston of the EFF stated in a release that "Email users expect that their Hotmail and Gmail inboxes are just as private as their postal mail and their telephone calls ... The government tried to get around this common-sense conclusion, but the Constitution applies online as well as offline, as the court correctly found. That means that the government can't secretly seize your emails without a warrant."

TLJ spoke briefly with Nathan Judish, who argued the case for the government. He declined to discuss the case.

TLJ also phoned Warshak's company, Berkeley Premium Nutraceuticals (BPN). TLJ spoke only with an operator, and no one took or returned the call. But, a recorded message for incoming calls stated that "this call may be monitored or recorded".

Case Information. This case is Steven Warshak v. United States of America, U.S. Court of Appeals for the 6th Circuit, App. Ct. No. 06-4092, an appeal from the U.S. District Court for the Southern District of Ohio, at Cincinnati, D.C. No. 06-00357, Judge Susan Dlott presiding.

Judge Boyce Martin wrote the opinion of the Court, in which Judges Martha Daughtrey and William Schwarzer (USDC/NDCal sitting by designation) joined.

Judge Dlott was appointed by former President Clinton. Two of the members of the three judge panel are also Democrats. Judge Martin is a Carter appointee, and a liberal whom conservatives love to loath. Judge Daughtrey is a Clinton appointee. Schwartzer, who is a senior status District Court Judge for the Northern District of California, was appointed by former President Ford. Just prior to his appointment, he was Senior Counsel for the President's Commission on CIA Activities Within the United States, which was also known as the Rockefeller Commission.

Perhaps it should be noted too that former Justice Potter Stewart, who wrote the Supreme Court's opinion in Katz, was from Cincinnati, and served on the 6th Circuit.

See also, the EFF's web page containing links to pleadings in this case.