Court Refuses To Rule On ECPA Warrantless E-mail Searches

utkalum writes "After Steven Warshak's indictment and conviction on charges of mail and wire fraud, money laundering and other federal charges, he learned that key evidence in the case was obtained by the government under a 1986 law permitting no-warrant searches of email communications stored for longer than 180 days. He also learned that, despite the Electronic Communication Privacy Act's requirement that such searches be disclosed to the suspect no more than 90 days after they were commenced, the Government simply couldn't be bothered to comply. Now, the US Court of Appeals for the Sixth Circuit has refused (9-5) to hear Warshak's constitutional challenge to the Act (PDF), claiming that the question raised is 'not yet ripe' for adjudication. It's worth noting that the court also vacated an earlier injunction against using that act to read the e-mail of other people in Warshak's district. Read on for an excerpt from the ruling. 'Not only do "we have no idea whether or when" such a search will occur but we also "have no idea" what e-mail accounts, or what types of e-mail accounts, the government might investigate ... That uncertainty looms large in a debate about the expectations of privacy in e-mail accounts. The underlying merits issue in the case is this: In permitting the government to search e-mails based on "reasonable grounds," is 2703(d) consistent with the Fourth Amendment, which generally requires "probable cause" and a warrant in the context of searches of individuals, homes and, perhaps most analogously, posted mail? The answer to that question will turn in part on the expectations of privacy that computer users have in their e-mails — an inquiry that may well shift over time, that assuredly shifts from internet-service agreement to internet-service agreement and that requires considerable knowledge about everevolving technologies.'

Comments

Bush told me...

[packeteer]

Its ok to break the law as long as your catching a bad guy right?

Re:Bush told me...

[I cant believe its n]

Well, I hear torture is ok.

Re:Bush told me...

[Nimey]

Goddamnit, that's not funny. That's depressing.

Bush told me....

[Roskolnikov]

This doesn't apply at the White House, apparently they don't archive their email.....or at least you can't prove that they may or may not......

Possession is 9 points of the law

[shanen]

Unless we own our personal information, we will have no privacy and no freedom. If I know *EVERYTHING* about you and have a few henchmen, then I can surely control you and eliminate your freedom. No one is perfect. You must have some weakness that can be approached. Some way to be bribed? Or surely you've made some embarrassing mistakes that could be leveraged against you? What's your hook? Gambling? Booze? Whatever it is, if I know enough about you, then I can eventually make you do whatever I want.

Is there a solution? Yes. We must own our personal data. It cannot belong to the companies to buy and sell like oil futures and shares in gold mines. The strongest form of ownership is possession--the famous 9 points of the law. Once you have possession, then it is up to the other side to show they have some claim on your personal property (in the form of information in this case).

If any company wants to store some information about me, they should be required to store it on *MY* computer. They can sign it so that I can't tamper with it. That's a trivial aspect. However, whenever they want to *USE* my information, they should be required to tell me why. This can mostly be automated in the form of my personal privacy preferences, and for most queries there is no reason I should stop them--but I should always be free to change my mind.

(I only see one other alternative that preserves any personal freedom. That would be the total exposure of everyone's personal information. It would be a kind of war, but at least all of us could be on a kind of equal footing. Yet however much I would like to know the full truth about Dubya Bush, I don't think that's going to happen.)

'ripeness' is valid

[Red Flayer]

Now, the US Court of Appeals for the Sixth Circuit has refused (9-5) to hear Warshak's constitutional challenge to the Act (PDF), claiming that the question raised is 'not yet ripe' for adjudication.

Anyone who is going to tartly respond to this inflammatory statement would do well to read the link contained in the statement... 'ripeness' is an important legal concept, and it is clear that the matter is, as yet, unripe.

In order for the 'ripeness' qualification to be met, decision on the claim must affect the outcome. It's clear from reading the link that the outcome would not be affected, since the government is unlikely to perform another ex parte search; and even if they did, it wouldn't matter, since the guy who was indicted knows full well that he is under indictment, and would be even more of a fool to leave any more emails hanging around for the government to search.

As for the other issues, I'll not comment, since I don't think my words would bear the fruit.

Re:'ripeness' is valid

[corsec67]

This guy can't sue to prevent this from happening to other people?

Could someone who hasn't been caught by this snooping sue?

So, people who have been affect can't sue because it wouldn't happen again, and people who haven't been affected can't sue either?

Or is my thinking just wrong? (IANAL, so that is easy)

Re:'ripeness' is valid

[cpu_fusion]

I think you just described "mootness", not "ripeness."

Ripeness is a prudential rule (i.e. court-created) that the court uses to basically say that not enough is understood about the pros and cons of a particular ruling for stare decisis at the appellate level.

Sometimes the court invokes Ripeness when the counsel (or facts) are judged to be not adequate for a good decision. e.g. defense counsel sucks, or the facts suck, or whatever.

I'm not saying either is the case here; it's just a dodge for the court.

I think the prudential standing rules should be unconstitutional, but given that deciding constitutionality is the courts domain, I don't see them giving this power up.

Re:'ripeness' is valid

[Free_Meson]

A lot of folks here are going to complain about this decision without really understanding the case. It seems to me that this guy's lawyer made some poor decisions if he was pinning his hopes on this decision.

It appears that Warshak asked for two things:
-an injunction against future searches under 2703(d) without notice
-a ruling on the constitutionality of 2703(d) on the grounds that it allows the violation of a citizen's reasonable expectation of privacy without a warrant

On the first matter, the court's ripeness argument strikes the nail on the head. Warshak knows that he is under investigation now (indeed, he is convicted) so there's no need for judicially-delayed notification.

On the second matter, the court points out that a citizen's reasonable expectation of privacy (REP) when using an electronic mail/data storage service will vary with the terms of service agreed upon between the citizen and the service provider. Thus, whether a citizen has a REP should be decided on a case by case basis.

Warshak should be arguing that he had a REP and that the statute as applied to him was a violation of his 4th amendment rights. I don't think that's a winner, as 2703(d) appears to require probable cause or something like it.

Probable cause:

Probable cause is what would lead a person of reasonable caution and prudence to believe that a person, evidence, or contraband related to a crime is in a specific place at a specific time.

2703(d):

"a court of competent jurisdiction" may issue an order based on "specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation."

2703(d) is slightly more broad than probable cause, as there is no need for the records or other information sought to be useful as evidence of a crime. They need merely be relevant and material. For example, a contact list from Warshak's email service provider may give investigators an idea of who to contact to discover more victims of his wire fraud scheme without itself being evidence of said scheme. In this case, though, I suspect that investigators would have had sufficient probable cause had they sought a warrant. As with a warrant, investigators had to prove to an impartial magistrate their reasonable belief that Warshak's service provider had evidence relevant to a specific criminal investigation. The principle advantage gained by using 2703(d) in this case appears to be the delayed notice provision.

Re:'ripeness' is valid

[Londovir]

In the same spirit of respect, I have to disagree with what you posted.

If you read the entire opinion, the following was mentioned:

- The government sought permission twice from a magistrate judge to gain access to the guy's email records. (So it's not a warrant, but it WAS an official court order)
- The government had to demonstrate to the magistrate that the records they sought contained information "relevant and material to an ongoing criminal investigation" (So it wasn't a blind or frivolous fishing expedition)
- The government was ordered by the magistrate to delay giving notice since the judge felt there was a credible chance of the guy tampering with evidence
- The judge sealed the court orders related to the searches

My point is, unlike other abuses of government warrantless work, at least this one had some measure of judicial review involved. That makes this case different, IMHO, than other warrantless wiretapping and such, and care should be taken to not draw conclusions about either with a broad stroke here.

The court also felt that not only was the case "not ripe" for ruling (which has a very clear and painstakingly discussed meaning in the opinion), but that the guy partially argued on the wrong grounds. They almost suggest he MIGHT have had a shot of having his case heard if he'd argued 1st Amendment rather than 4th Amendment (since he alluded to the idea of a "chilling effect" when it comes to emails) - but he didn't, he argued 4th Amendment.

In fact, from reading the opinion, it seems as though this guy completely "screwed up" his entire arguments. It sounds as though he sued on the grounds of future, potential searches, rather than on particular admissability of the emails that were gained during the prior 2 searches. It definitely was an issue that the guy sought to overturn ALL of 2703(d), for everyone, rather than just his particular case. The court makes great pains to state how they refuse to make a potential constitutional ruling for a general class situation where each person's particulars may be widely different.

I'd say the court did a reasonable thing with this decision, all things considered. The guy clearly should have known from his Yahoo TOS that his emails weren't going to be fully private in the first case - and in fact it was pointed out in his own TOS that "emails will be provided to the government upon request." (That argues, possibly, that the government may have been able to get the emails from Yahoo without any court involvement at all - depending on how Yahoo wants to proceed)

All in all, seems like nothing more to see here to me. Let's focus on FISA, where the real problems are, not on this non-case.

Re:Contact the court here:

[mitch.swampman]

Disregard my mangled post :(
Should read:
Court of Appeals
540 Potter Stewart U.S. Courthouse
100 East Fifth Street
Cincinnati, Ohio 45202
Phone: 513-564-7000

i'm going to take a radical position

[circletimessquare]

my position is: why does anyone expect communications going out on an open wire to be safe from snooping eyes? or even more absurd: why does anyone trust the government to ensure this illusion of privacy?

if you have anything of secrecy, encrypt it, or keep it off the net

i'm not excusing the governments behavior, but what i am saying is that the entire subject matter of privacy on the internet is absurd. at every node someone can snoop, not just the government. isps, criminal interests, corporate interests, just plain random goofballs

its NOT like the government coming into your home and ramsacking your stuff behind a locked door. its you piling your stuff out in the middle of main street and expecting the local police to ensure no one looks at it or takes it, and then crying bloody murder when a cop looks at it. you put it out there, why do you expect privacy? i don't get it, i never understood why this subject matter works people up into such a lather

to me, as soon as i hit send in my email box, if i haven't encrypted it, i EXPECT it to be seen by someone else

its not like i've cynically given up on government, its rather that i recognize the technology is not securable, regardless of whether the government ensists on absolute privacy in electronic communications or is a fascist state who insists on looking at your every word. either way, i don't see how the technology of the internet confirms a position of privacy. its just better to assume someone else is going to see it, right?

so i'm either totally crazy or way ahead of the curve, i don't know

everyone gets so emotional about this issue, and i just don't understand the panic and hysteria over losing a protection that never existed in the first place, or ever could possibly exist, regardless of the law being ultrafascist or ultraprotectionist

Re:Everevolving technologies?

[Null Nihils]

There really should be no expectation of privacy in e-mail.

Who are you to decide that? Like I said in a post on a similar topic:

"...the canonical user interface icon for e-mail is... a sealed envelope. Even ISPs will present their e-mail services with such an image.

In other words, the snagging point is the definition of "expectation of privacy" -- but the situation is really quite simple: The average user simply expects privacy, but the government is trying to force them to abandon that expectation, so they can then go and install ubiquitous e-mail surveillance without violating the letter of the US Constitution. The government is trying to win by arguing semantics, so what I find hardest to believe is that anyone is taking all this blatant skullduggery seriously.

... It's not like mailing a postcard, it's like sending an electrically encoded text message over a packet-switched data network where the only expected viewing point is at the intended recipient's terminal; this is how the e-mail protocol was designed to work. Sure, a malicious party can read it because it's not encrypted, but someone can easily slice open a postal mail envelope and read the contents of that, too.

The bottom line is, since a non-trivial effort has to be made to read the contents, and since the service has always been presented as a "sealed letter", the average user is not unreasonable in expecting privacy."

Re:Sorry dude

[mabhatter654]

the other side BROKE THE LAW. How are THEY getting punished? The only remedy a defendant has is to try to get the case thrown out. The court has no remedy to sit the lawyers that chose to break the rules in jail next to him. The prosecution obviously won't arrest it's own people for breaking the law and this is where the legal system has broken down in the last 40 years or so. There is no court remedy for abuses unless the "prosecution" chooses to file the charges... that's highly unfair and not "justice".

I'm not saying this guy shouldn't go to jail, but according to the facts of the case there should be a lawyer in jail next to him.