E-mail Account Holders Have Right to Privacy, Appeals Court Upholds

A US federal appeals court yesterday upheld a district court ruling in favor of an individual whose e-mail records were copied by government investigators from servers at Yahoo and another ISP. In finding that the government violated Steven Warshak's Fourth Amendments rights against unreasonable search and seizure, it may have prevented the government from loosely applying a key tool in its ability to obtain e-mail records without a warrant: the Stored Communications Act (SCA).

Warshak was the subject of a 2005 criminal investigation of himself and his company, which apparently sold vitamin supplements. In March of that year, investigators obtained an order from a federal magistrate to acquire e-mail records from Warshak's NuVox account, ordering NuVox not to disclose even the existence of that order for at least 90 days. Later in September, the government issued a similar request to Yahoo. Both complied.

The basis of the magistrate's order was a portion of the SCA that stated the government was in possession of "specific and articulable facts showing that there are reasonable grounds to believe that the records or other information sought are relevant and material to an ongoing criminal investigation."

In other words, the government was able to speak its reasons - using words - to the magistrate, which should be good enough to imply that such reasons exist.

Warshak only learned that his e-mails had been scanned in June of 2006. Immediately, he sought a restraining order against the government seizing any more records. A district court in Ohio granted that part of Warshak's request concerning e-mails already sent, though it refused to extend the order so as to prohibit the government from seizing any future e-mails he may happen to send from any ISP. The government appealed the part that the district court granted.

In its appeal, the government claimed it abided by an exception to the SCA, which otherwise states seizures of e-mails from an ISP can only take place with prior notice given to the customer, or else through a search warrant.

That exception is with regard to a federal criminal investigation, which the case against Warshak supposedly was. But as the appeals court noted from a thorough read of the SCA, the ability to delay notice to a customer can only come from a court order - and no such court ever convened on that topic.

Part of the government's case argued that Warshak wasn't really hurt by having his e-mails scanned, implying that he may never have been able to claim "injury" had he never been notified of the seizure act in the first place. The appeals court dismissed this argument basically on the grounds that Warshak was injured because the Constitution says he was.

The government also argued that e-mails are searched all the time for harmful or pornographic content, or possible references to terrorist action, without harm to the senders or recipients. The appeals court dismissed that argument as well, on the grounds that people aren't the ones going through all those e-mails searching for porn or WMD.

"The reasonable expectation of privacy of an e-mail user goes to the content of the e-mail message," reads the appeals court's decision yesterday. "The fact that a computer scans millions of e-mails for signs of pornography or a virus does not invade an individual's content-based privacy interest in the e-mails and has little bearing on his expectation of privacy in the content. In fact, these screening processes are analogous to the post office screening packages for evidence of drugs or explosives, which does not expose the content of written documents enclosed in the packages."

That part of the decision could be critical to future lawmaking. It effectively distinguishes between the concept of what a message says, versus how a message says it. The Constitution protects free speech - the right for messages to say what they say. It does not protect against the way they make their presentation or state their case. In effect - especially if the US Supreme Court were to uphold this opinion - what Sixth Circuit Judges Martha Daughtrey and John Martin found, perhaps unintentionally, was that the portrayal of a message may do harm, and can be stopped, without infringing upon the rights of the person who creates or sends the message.

For the purposes of this specific case, however, the judges found automatic surveillance of electronic communications, and the seizure of specific messages sent by one citizen, are not similar processes. The latter injures the individual who sends the messages; the former does not.

But perhaps the piece de resistance comes later in the judges' opinion, in response to the government's argument that old e-mails are effectively disused, and thus the sender has no more expectation that disused e-mails be private than a hotel guest should expect his room to remain private after he checks out.

"This analogy lacks any connection to the actual practices of commercial ISPs," Judges Daughtrey and Martin write. "When a hotel guest checks out of his room, another person will occupy it, access every part of it in which he might have maintained any privacy interest, put his underwear in the same drawer, and otherwise extinguish any privacy interest to the fullest extent. Dominion and control over the hotel room is entirely surrendered to the hotel management, which in turn passes it on to the next guest who occupies the room. On the other hand, when an e-mail user stops using an e-mail address that is tied to his personal identity, he would certainly not expect that somebody else could come along, sign up for the same account, and not only send e-mails in his name, but read every past e-mail that he had failed to delete from the account or sent to someone else. There is no reason to believe that dominion or control over the contents of the account is yielded to the ISP or another user. This analogy is entirely inapposite."

With the opinion having risen to a crescendo, why stop there? To the government's argument that Warshak shouldn't have expected privacy on an e-mail account that he may have obtained under false pretenses, which would effectively make him a thief and no more worthy of privacy protection than a carjacker seated in a stolen vehicle, the appeals court bowled another strike.

"This argument is another red herring, primarily because it cannot account for the majority of commercial e-mail services that offer their services for free. This obviously begs the question of why someone would have to commit fraud to get an account."

Yesterday, the Electronic Freedom Foundation issued a statement praising the Sixth Circuit for having found, in its words, "that the SCA violates the Fourth Amendment." In fact, the appeals court did not find that at all, ruling instead that the US Government actually violated the SCA. It had been making free use of the exception for delayed notification, as a means of justifying not notifying anyone about seizing e-mails - and furthermore, of ordering ISPs not to notify anyone either. But digging deep enough into the SCA's language, the judges found the exception doesn't stretch that far, and that the government overstepped its bounds.

EFF staff attorney Kevin Bankston did summarize the findings mostly accurately, however: "Email users expect that their Hotmail and Gmail inboxes are just as private as their postal mail and their telephone calls. The government tried to get around this common-sense conclusion, but the Constitution applies online as well as offline, as the court correctly found. That means that the government can't secretly seize your emails without a warrant." Why Bankston neglected to refer to Yahoo Mail - one of the subjects of this case, after all - remains unclear.