6th Circuit Rules There Is A Reasonable Expectation of Privacy In Stored E-Mail

December 14, 2010. The U.S. Court of Appeals (6thCir) issued its opinion [98 pages in PDF] in US v. Warshak, which involves application of the 4th Amendment to the government's ex parte seizure of approximately 27,000 of Warshak's private e-mails.

The Court of Appeals held that a subscriber enjoys a reasonable expectation of privacy in the contents of emails that are stored with, or sent or received through, a commercial ISP. The government may not compel a commercial ISP to turn over the contents of a subscriber’s emails without first obtaining a warrant based on probable cause.

The Court of Appeals drew analogies between e-mail and USPS mail and phone calls, which cannot be opened or intercepted without a warrant. It did not speculate in dicta regarding the application of the 4th Amendment to other forms of data stored with third party service providers, or cloud computing.

Introduction. In the present case the Court of Appeals held that Warshak held a reasonable expectation of privacy, so that since the government seized his e-mail from his ISP without a warrant issued pursuant to the 4th Amendment -- it only had an order issued under a lower Stored Communications Act (SCA) standard -- it violated his 4th Amendment rights.

Ordinarily, this would lead to exclusion. However, the Court of Appeals also held that since the government relied in good faith upon the SCA, the exclusionary rule does not preclude admission into evidence of those e-mails. Warshak's conviction is therefore affirmed.

The key aspect of this opinion though is the precedent that it sets going forward that there is a 4th Amendment expectation of privacy in stored e-mail. The government needs a warrant to seize it.

This opinion maintains the relevance of the 4th Amendment to e-mail . This is a huge victory for advocates of privacy and liberty interests in the context of government surveillance and seizures in the context new information technologies. This opinion is a set back overreaching and overzealous government prosecutors and agents.

This opinion also works to remove one disincentive to adopt new technologies.

This is an opinion in an appeal from criminal convictions for crimes associated with the marketing of "nutraceuticals" and "natural supplements". The underlying criminal activity is not technology related.

This matter has been before the 6th Circuit before. TLJ wrote extensively about two earlier landmark opinions. (For a detailed summary of the underlying facts, see the 2007 story.)

Previously, a three judge panel of the 6th Circuit held that there is a reasonable expectation of privacy in stored e-mail. However, an en banc panel then vacated the earlier opinion on ripeness grounds. Due to the criminal trial and conviction, the issue was indisputably ripe for the present opinion.

See, June 18, 2007, three judge panel opinion [20 pages in PDF], and story titled "6th Circuit Holds That People Have a Reasonable Expectation of Privacy in E-Mail Stored With, or Sent or Received Through, an ISP" in TLJ Daily E-Mail Alert No. 1,597, June 19, 2007. See also, July 11, 2008, en banc opinion [15 pages in PDF], and story titled "6th Circuit En Banc Panel Holds Warshak Case Lacks Ripeness" in TLJ Daily E-Mail Alert No. 1,794, July 15, 2008. Warshak I is also reported at 490 F.3d 455. Warshak II is also reported at 532 F.3d 521.

The present opinion affirms in part the convictions of Steven Warshak and Harriet Warshak for conspiracy, mail fraud and other offenses. What is notable about this long opinion, and what is covered in this story, is the Court's discussion of Warshak's challenge to his conviction on the basis that the District Court admitted into evidence e-mails which the government seized from his ISP without a warrant.

The government obtained from a magistrate judge of the U.S. District Court (SDOhio) an ex parte sealed order directing NuVox Communications (which is now Windstream) to give it e-mail of Warshak. The order also prohibited NuVox from disclosing the existence of the order. The orders stated that they were issued pursuant to the 18 U.S.C. § 2703, which is part of the SCA. The order allowed the government to delay notice to Warshak for 90 days. The government delayed notice for one year.

More specifically, the government first made a request, pursuant to S 2703(f), to NuVox to preserve and archive Warshak's e-mail. NuVox did so. It then obtained from the District Court a subpoena pursuant to § 2703(b) to seize archived e-mail. It then obtained from the District Court an ex parte court order under § 2703(d) that required NuVox to surrender any additional email messages. Warshak did not receive notice of either the subpoena or order for one year.

The Court of Appeals held that the government violated Warshak's 4th Amendment rights by compelling his ISP to turn over the contents of his emails. However, the Court of Appeals also held that since the government agents relied upon the SCA in good faith, reversal is unwarranted.

The Electronic Frontier Foundation (EFF), American Civil Liberties Union (ACLU), and Center for Democracy and Technology (CDT) filed an amicus curiae brief on the e-mail issues.

4th Amendment and Katz. The 4th Amendment to the Constitution provides, in full, that "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The Supreme Court issued its landmark opinion in Katz v. U.S. in 1967. It is reported at 389 U.S. 347. In that case the FBI conducted a warrantless wiretap of a public telephone booth used by the defendant, and introduced the product of those wiretaps into evidence in a criminal trial.

The Supreme Court, with Justice Potter Stewart writing the opinion, held that warrants based upon probable cause are required for telephone wiretaps, even when the call is placed from a public phone booth. Stewart wrote that "the Fourth Amendment protects people, not places."

Former Justice Harlan used the phrase "constitutionally protected reasonable expectation of privacy" in his concurrence. He elaborated that "My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as ``reasonable.´´" (Parentheses in original.)

The just released opinion of the 6th Circuit relies upon Katz and its progeny. There is no prior Supreme Court or Court of Appeals opinion on the applicability of the 4th Amendment to e-mail held by an ISP, other than Warshak I and Warshak II.

The Congress followed up on the Katz opinion when it enacted the Omnibus Crime Control and Safe Streets Act of 1968, which is Public Law No. 90-351. It included the Wiretap Act, which is now codified at U.S.C. §§ 2510-2522. Two decades later the Congress extended meaningful statutory protection to electronic communications, including stored communications.

Court of Appeals Opinion. The Court applied the Katz two part method of analysis: (1) there must be a subjective expectation of privacy, and (2) it must be an expectation that society is expected to recognize.

"Turning first to the subjective component of the test, we find that Warshak plainly manifested an expectation that his emails would be shielded from outside scrutiny. As he notes in his brief, his ``entire business and personal life was contained within the ... emails seized.´´" The Court of Appeals continued that "Given the often sensitive and sometimes damning substance of his emails,15 we think it highly unlikely that Warshak expected them to be made public, for people seldom unfurl their dirty laundry in plain view."

"The next question is whether society is prepared to recognize that expectation as reasonable. ... This question is one of grave import and enduring consequence, given the prominent role that email has assumed in modern communication. Cf. Katz, 389 U.S. at 352 (suggesting that the Constitution must be read to account for ``the vital role that the public telephone has come to play in private communication´´). Since the advent of email, the telephone call and the letter have waned in importance, and an explosion of Internet-based communication has taken place. People are now able to send sensitive and intimate information, instantaneously, to friends, family, and colleagues half a world away. Lovers exchange sweet nothings, and businessmen swap ambitious plans, all with the click of a mouse button. Commerce has also taken hold in email. Online purchases are often documented in email accounts, and email is frequently used to remind patients and clients of imminent appointments. In short, ``account´´ is an apt word for the conglomeration of stored messages that comprises an email account, as it provides an account of its owner's life. By obtaining access to someone's email, government agents gain the ability to peer deeply into his activities. Much hinges, therefore, on whether the government is permitted to request that a commercial ISP turn over the contents of a subscriber’s emails without triggering the machinery of the Fourth Amendment." (Parentheses in original.)

"In confronting this question, we take note of two bedrock principles. First, the very fact that information is being passed through a communications network is a paramount Fourth Amendment consideration."

"Second, the Fourth Amendment must keep pace with the inexorable march of technological progress, or its guarantees will wither and perish."

The Court of Appeals continued, "With those principles in mind, we begin our analysis by considering the manner in which the Fourth Amendment protects traditional forms of communication. In Katz, the Supreme Court was asked to determine how the Fourth Amendment applied in the context of the telephone. There, government agents had affixed an electronic listening device to the exterior of a public phone booth, and had used the device to intercept and record several phone conversations. ... The Supreme Court held that this constituted a search under the Fourth Amendment, ... notwithstanding the fact that the telephone company had the capacity to monitor and record the calls, ... In the eyes of the Court, the caller was ``surely entitled to assume that the words he utter[ed] into the mouthpiece w[ould] not be broadcast to the world.´´ ... The Court’s holding in Katz has since come to stand for the broad proposition that, in many contexts, the government infringes a reasonable expectation of privacy when it surreptitiously intercepts a telephone call through electronic means." (Citations omitted.)

"Letters receive similar protection", even though they had handed to USPS employees. The Court continued that "Given the fundamental similarities between email and traditional forms of communication, it would defy common sense to afford emails lesser Fourth Amendment protection."

"Email is the technological scion of tangible mail, and it plays an indispensable part in the Information Age", the Court reasoned. "It follows that email requires strong protection under the Fourth Amendment; otherwise, the Fourth Amendment would prove an ineffective guardian of private communication, an essential purpose it has long been recognized to serve."

"If we accept that an email is analogous to a letter or a phone call, it is manifest that agents of the government cannot compel a commercial ISP to turn over the contents of an email without triggering the Fourth Amendment. An ISP is the intermediary that makes email communication possible. Emails must pass through an ISP's servers to reach their intended recipient. Thus, the ISP is the functional equivalent of a post office or a telephone company. As we have discussed above, the police may not storm the post office and intercept a letter, and they are likewise forbidden from using the phone system to make a clandestine recording of a telephone call -- unless they get a warrant, that is." The Court of Appeals added that "It only stands to reason that, if government agents compel an ISP to surrender the contents of a subscriber’s emails, those agents have thereby conducted a Fourth Amendment search, which necessitates compliance with the warrant requirement absent some exception."

However, the Court of Appeals did not go so far as to hold that all stored e-mail will be subject to a reasonable expectation of privacy. For example, it noted that "a subscriber agreement might, in some cases, be sweeping enough to defeat a reasonable expectation of privacy in the contents of an email account".

Government agencies might thus request, or pressure, service providers in the future to include such exceptions in their terms of service and customer contracts. The Department of Justice (DOJ) and Federal Communications Commission (FCC) have considerable leverage over service providers, and have a history of using that leverage to promote the policy goals of federal law enforcement agencies.

But, the Court of Appeals also wrote that "the mere ability of a third-party intermediary to access the contents of a communication cannot be sufficient to extinguish a reasonable expectation of privacy". It added, "we are unwilling to hold that a subscriber agreement will never be broad enough to snuff out a reasonable expectation of privacy".

The Court of Appeals then wrote a lengthy analysis of the SCA, and concluded that the government acted in good faith reliance upon the SCA, and therefore, the email evidence need not be excluded.

This was a unanimous three panel decision. Judge Keith wrote an additional opinion. He addressed only the email issues. He agreed with the opinion of the Court, including that there was good faith reliance by the government. However, he wrote that he was troubled by the government's request that NuVox preserve Warshak's stored and future email communications without Warshak's knowledge.

Stored Communications Act. The SCA is codified at 18 U.S.C. §§ 2701-2712.

The SCA, like the rest of the Electronic Communications Privacy Act (ECPA), was drafted (in 1986) when many internet protocol (IP) based technologies did not yet exist. The statute is obsolete and fails to provide investigators, judges, carriers, ISPs, and affected persons clear guidance regarding its meaning. It is out of date and in need of revision.

There are proposals for reform, and the House Judiciary Committee's (HJC) Subcommittee on the Constitution has held hearings in the 111th Congress. See, story titled "Digital Due Process Coalition Proposes Changes to Federal Surveillance Law" in TLJ Daily E-Mail Alert No. 2,068, March 31, 2010. The actions of the government in this case suggest that the government is sometimes able to exploit obsolete language. This gives the government incentive to oppose revisions to the ECPA.

The SCA, which is now applied to stored e-mail, does not use the terms "e-mail", "e-mail service providers", or "internet service providers". Rather, it uses the terms "remote computing service", "wire communication", "electronic communication", "electronic communications system", and "electronic communications service".

As the following recitation of statutory sections shows, the Congress made it easier for the government to seize the content of electronic communications from a "remote computing service" than from a "electronic communication service". The DOJ categorized NuVox as a "remote computing service".

18 U.S.C. § 2711 defines the term "remote computing service" (RCS) to mean "the provision to the public of computer storage or processing services by means of an electronic communications system".

18 U.S.C. § 2510 defines "electronic communications system" to mean "any wire, radio, electromagnetic, photooptical or photoelectronic facilities for the transmission of wire or electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications". It defines "electronic communication service" to mean "any service which provides to users thereof the ability to send or receive wire or electronic communications".

Section 2510 also defines "wire communication" as "aural transfer", and "electronic communication" as "any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system ...".

Second, there are the provisions of the SCA that allow the government to seize electronic communications.

Subsection 2703(a) covers access to electronic communications held by a "electronic communications service". It provides that "A governmental entity may require the disclosure by a provider of electronic communication service of the contents of a wire or electronic communication, that is in electronic storage in an electronic communications system for one hundred and eighty days or less, only pursuant to a warrant ...". However, the government did not obtain a warrant, and did not follow this route.

Alternatively, subsection 2703(a) provides that "A governmental entity may require the disclosure by a provider of electronic communications services of the contents of a wire or electronic communication that has been in electronic storage in an electronic communications system for more than one hundred and eighty days by the means available under subsection (b) ...". The government did not follow this route either.

Then, subsection 2703(b) covers access to "electronic communications" held by a "remote computing service" (RCS). First, it provides that "A governmental entity may require a provider of remote computing service to disclose the contents of any wire or electronic communication ... without required notice to the subscriber or customer, if the governmental entity obtains a warrant ...". But, the government did not follow this procedure either. This too would have required a warrant.

Alternatively, subsection 2703(b) provides that the government may require the RCS to disclose contents of electronic communications "with prior notice from the governmental entity to the subscriber or customer if the governmental entity ... uses an administrative subpoena ... or ... obtains a court order for such disclosure under subsection (d) ...". The government followed this route, to a point. This procedure does not require a warrant, but it does require prior notice.

Subsection 2703(d) sets the standard for issuance of a subsection 2703(b) order: "if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation." This relevance standard is much lower than the 4th Amendment's probable cause standard. It is much easier for government to meet this standard. And, in the present case, the government was able to convince a magistrate judge that it had satisfied this lower standard.

This route, however, requires prior notice to the individual. However, subsection 2703(b) adds the qualifier, "except that delayed notice may be given pursuant to section 2705". 18 U.S.C. § 2705, in turn provides for a maximum delay of 90 days if the court determines that one of several conditions is present. One of these, that there is "reason to believe" that prior notification would lead to "destruction of or tampering with evidence". The government sought such a delay, and obtained it from the court.

Hence, the government obtained an order to the ISP to turn over the content of e-mail, pursuant to the low standard of relevance (rather than probable cause). The order further allowed no notice to the individual for 90 days. However, the government did not provide notice after 90 days. Rather it waited for over one year. That is, the government violated the statute and the Court's order.

This case is US v. Steven Warshak, Harriet Warshak, and TCI Media, Inc., U.S. Court of Appeals for the 6th Circuit, App. Ct. Nos. 08-3997, 08-4085, 08-4087, 08-4212, 08-4429, and 09-3176, appeals from the U.S. District Court for the Southern District of Ohio at Cincinnati, D.C. Nos. 06-00111, 06-00111-001, 06-00111-2, and 06-00111-7, Judge Arthur Spiegel presiding. Judge Boggs wrote the opinion of the Court of Appeals, in which Judge McKeague joined. Judge Keith wrote an opinion in which he concurred in the result.