The Sixth Circuit holds that there is a reasonable expectation of privacy in stored e-mails, and an e-mail user has standing to challenge overbroad subpoenas to ISPs for the e-mails. The case involved suit under the Stored Communications Act, 18 U.S.C. \u00a7\u00a7 2701-12, distinguishing holders of e-mail and recipients who have already received e-mail. This is a significant case, and it extends established law about mail in transit to e-mails in transit. The District Court’s preliminary injunction is affirmed as modified. Warshak v. United States, 490 F.3d 455, 2007 FED App. 0225P (6th Cir. 2007):<\/p>\n
2. Reasonable expectation of privacy in e-mail content<\/em><\/p>\n
Two amici curiae convincingly analogize the privacy interest that e-mail users hold in the content of their e-mails to the privacy interest in the content of telephone calls, recognized by the Supreme Court in its line of cases involving government eavesdropping on telephone conversations. See Smith v. Maryland<\/em>, 442 U.S. 735, 99 S. Ct. 2577, 61 L. Ed. 2d 220 (1979); Katz v. United States<\/em>, 389 U.S. 347, 88 S. Ct. 507, 19 L. Ed. 2d 576 (1967); Berger v. New York<\/em>, 388 U.S. 41, 87 S. Ct. 1873, 18 L. Ed. 2d 1040 (1967). In Berger<\/em> and Katz<\/em>, telephone surveillance that intercepted the content of a conversation was held to constitute a search, because the caller “is surely entitled to assume that the words he utters into the mouthpiece will not be broadcast to the world,” and therefore cannot be said to have forfeited his privacy right in the conversation. Katz<\/em>, 389 U.S. at 352. This is so even though “[t]he telephone conversation itself must be electronically transmitted by telephone company equipment, and may be recorded or overheard by the use of other company equipment.” Smith<\/em>, 442 U.S. at 746 (Stewart, J., dissenting). On the other hand, in Smith,<\/em> the Court ruled that the use of pen register, installed at the phone company’s facility to record the numbers dialed by the telephone user, did not amount to a search. This distinction was due to the fact that “a pen register differs significantly from the listening device employed in Katz, for pen registers do not acquire the contents of communications.” 442 U.S. at 741 (emphasis in original).<\/p>\n
The distinction between Katz<\/em> and Miller<\/em> makes clear that the reasonable expectation of privacy inquiry in the context of shared communications must necessarily focus on two narrower questions than the general fact that the communication was shared with another. First, we must specifically identify the party with whom the communication is shared, as well as the parties from whom disclosure is shielded. Clearly, under Katz<\/em>, the mere fact that a communication is shared with another person does not entirely erode all expectations of privacy, because otherwise eavesdropping would never amount to a search. It is true, however, that by sharing communications with someone else, the speaker or writer assumes the risk that it could be revealed to the government by that person, or obtained through a subpoena directed to that person. See Miller<\/em>, 425 U.S. at 443 (“[T]he Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities.”). The same does not necessarily apply, however, to an intermediary that merely has the ability to access the information sought by the government. Otherwise phone conversations would never be protected, merely because the telephone company can access them; letters would never be protected, by virtue of the Postal Service’s ability to access them; the contents of shared safe deposit boxes or storage lockers would never be protected, by virtue of the bank or storage company’s ability to access them.<\/p>\n
The second necessary inquiry pertains to the precise information actually conveyed to the party through whom disclosure is sought or obtained. This distinction provides the obvious crux for the different results in Katz<\/em> and Smith<\/em>, because although the conduct of the telephone user in Smith<\/em> “may have been calculated to keep the contents of his conversation private, his conduct was not and could not have been calculated to preserve the privacy of the number he dialed.” 442 U.S. at 743. Like the depositor in Miller<\/em>, the caller in Smith “assumed the risk” of the phone company disclosing the records that he conveyed to it. Id.<\/em> Yet this assumption of the risk is limited to the specific information conveyed to the service provider, which in the telephone context excludes the content of the conversation. It is apparent, therefore, that although the government can compel disclosure of a shared communication from the party with whom it was shared, it can only compel disclosure of the specific information to which the subject of its compulsion has been granted access. It cannot, on the other hand, bootstrap an intermediary’s limited access to one part of the communication (e.g. the phone number) to allow it access to another part (the content of the conversation).<\/p>\n
This focus on the specific information shared with the subject of compelled disclosure applies with equal force in the e-mail context. Compelled disclosure of subscriber information and related records through the ISP might not undermine the e-mail subscriber’s Fourth Amendment interest under Smith, because like the information obtained through the pen register in Smith and like the bank records in Miller, subscriber information and related records are records of the service provider as well, and may likely be accessed by ISP employees in the normal course of their employment. Consequently, the user does not maintain the same expectation of privacy in them vis-a-vis the service provider, and a third party subpoena to the service provider to access information that is shared with it likely creates no Fourth Amendment problems. n3 The combined precedents of Katz<\/em> and Smith<\/em>, however, recognize a heightened protection for the content of the communications. Like telephone conversations, simply because the phone company or the ISP could access the content of e-mails and phone calls, the privacy expectation in the content of either is not diminished, because there is a societal expectation that the ISP or the phone company will not do so as a matter of course.n4<\/p>\n
n4 As the Supreme Court explained in Smith<\/em>, the reasonable expectation of privacy inquiry “embraces two discrete questions. The first is whether the individual, by his conduct, has exhibited an actual (subjective) expectation of privacy,–whether, in the words of the Katz<\/em> majority, the individual has shown that he seeks to preserve [something] as private. The second question is whether the individual’s subjective expectation of privacy is one that society is prepared to recognize as reasonable, — whether, in the words of the Katz<\/em> majority, the individual’s expectation, viewed objectively, is justifiable under the circumstances.” 442 U.S. at 740 (internal citations and quotation marks omitted).<\/p>\n
Similarly, under both Miller<\/em> and Katz<\/em>, if the government in this case had received the content of Warshak’s e-mails by subpoenaing the person with whom Warshak was e-mailing, a Fourth Amendment challenge brought by Warshak would fail, because he would not have maintained a reasonable expectation of privacy vis-a-vis his e-mailing partners. See Phibbs<\/em>, 999 F.2d at 1077. But this rationale is inapplicable where the party subpoenaed is not expected to access the content of the documents, much like the phone company in Katz<\/em>. Thus, as Warshak argues, the government could not get around the privacy interest attached to a private letter by simply subpoenaing the postal service with no showing of probable cause, because unlike in Phibbs, postal workers would not be expected to read the letter in the normal course of business. See Ex Parte Jackson<\/em>, 96 U.S. 727, 733, 24 L. Ed. 877 (1878) (“No law of Congress can place in the hands of officials connected with the postal service any authority to invade the secrecy of letters and such sealed packages in the mail; and all regulations adopted as to mail matter of this kind must be in subordination to the great principle embodied in the fourth amendment of the Constitution.”). Similarly, a bank customer maintains an expectation of privacy in a safe deposit box to which the bank lacks access (as opposed to bank records, like checks or account statements) and the government could not compel disclosure of the contents of the safe deposit box only by subpoenaing the bank. <\/p>\n
This analysis is consistent with other decisions that have addressed an individual’s expectation of privacy in particular electronic communications. In Guest v. Leis,<\/em> 255 F.3d 325, 333 (6th Cir. 2007), we concluded that users of electronic bulletin boards lacked an expectation of privacy in material posted on the bulletin board, as such materials were “intended for publication or public posting. “Of course the public disclosure of material to an untold number of readers distinguishes bulletin board postings from e-mails, which typically have a limited, select number of recipients. See also Jackson,<\/em> 96 U.S. at 733 (“[A] distinction is to be made between different kinds of mail matter, — between what is intended to be kept free from inspection, such as letters, and sealed packages subject to letter postage; and what is open to inspection, such as newspapers, magazines, pamphlets, and other printed matter, purposely left in a condition to be examined.”). Although we stated that an e-mail sender would “lose a legitimate expectation of privacy in an e-mail that had already reached its recipient,” analogizing such an e-mailer to “a letter-writer,” this diminished privacy is only relevant with respect to the recipient, as the sender has assumed the risk of disclosure by or through the recipient. Id.<\/em> at 333 (citing United States v. King<\/em>, 55 F.3d 1193, 1196 (6th Cir. 1995)). n6 Guest did not hold that the mere use of an intermediary such as an ISP to send and receive e-mails amounted to a waiver of a legitimate expectation of privacy.<\/p><\/blockquote>\n
Before getting to this question, the court had to determine what standard applied for subpoenas for e-mail. If the e-mail sender or recipient had a reasonable expectation of privacy, the government’s burden to obtain them was higher: <\/p>\n
Phibbs<\/em> makes explicit, however, a necessary Fourth Amendment caveat to the rule regarding third-party subpoenas: the party challenging the subpoena has “standing to dispute [its] issuance on Fourth Amendment grounds” if he can “demonstrate that he had a legitimate expectation of privacy attaching to the records obtained.” Id.; see also United States v. Miller<\/em>, 425 U.S. 435, 444, 96 S. Ct. 1619, 48 L. Ed. 2d 71 (1976) (“Since no Fourth Amendment interests of the depositor are implicated here, this case is governed by the general rule that the issuance of a subpoena to a third party to obtain the records of that party does not violate the rights of a defendant.” (emphasis added)). This language reflects the rule that where the party challenging the disclosure has voluntarily disclosed his records to a third party, he maintains no expectation of privacy in the disclosure vis-a-vis that individual, and assumes the risk of that person disclosing (or being compelled to disclose) the shared information to the authorities. See, e.g., United States v. Jacobsen<\/em>, 466 U.S. 109, 117, 104 S. Ct. 1652, 80 L. Ed. 2d 85 (1984) (“[W]hen an individual reveals private information to another, he assumes the risk that his confidant will reveal that information to the authorities, and if that occurs the Fourth Amendment does not prohibit governmental use of that information.”).<\/p>\n
Combining this disclosure to a third party with the government’s ability to subpoena the third party alleviates any need for the third-party subpoena to meet the probable cause requirement, if the challenger has not maintained an expectation of privacy with respect to the individual being compelled to make the disclosure. For example, in Phibbs<\/em>, the documents in question were credit card and phone records that were “readily accessible to employees during the normal course of business.” 999 F.2d at 1078. A similar rationale was employed by the Supreme Court in Miller<\/em>. 425 U.S. at 442 (“The checks are not confidential communications but negotiable instruments to be used in commercial transactions. All of the documents obtained, including financial statements and deposit slips, contain only information voluntarily conveyed to the banks and exposed to their employees in the ordinary course of business.”). See also SEC v. Jerry T. O’Brien, Inc.,<\/em> 467 U.S. 735, 743, 104 S. Ct. 2720, 81 L. Ed. 2d 615 (1984) (“When a person communicates information to a third party even on the understanding that the communication is confidential, he cannot object if the third party conveys that information or records thereof to law enforcement authorities.”). The government’s compelled disclosure argument, while relevant, therefore begs the critical question of whether an e-mail user maintains a reasonable expectation of privacy in his e-mails vis-a-vis the party who is subject to compelled disclosure — in this instance, the ISPs. If he does not, as in Phibbs<\/em> or Miller<\/em>, then the government must meet only the reasonableness standard applicable to compelled disclosures to obtain the material. If, on the other hand, the e-mail user does maintain a reasonable expectation of privacy in the content of the e-mails with respect to the ISP, then the Fourth Amendment’s probable cause standard controls the e-mail seizure.<\/p><\/blockquote>\n
Comment:<\/em> It could be said that the government came into this case having already shot itself in the foot over the abuse of NSLs and lost credibility about its admitted inability to comply with the law in collecting this type of information.<\/p>\n","protected":false},"excerpt":{"rendered":"
b2evALnk.b2WPAutP Continue reading