Federal Judge Says E-mail Not Protected By 4th Amendment

DustyShadow writes "In the case In re United States, Judge Mosman ruled that there is no constitutional requirement of notice to the account holder because the Fourth Amendment does not apply to e-mails under the third-party doctrine. 'When a person uses the Internet, the user's actions are no longer in his or her physical home; in fact he or she is not truly acting in private space at all. The user is generally accessing the Internet with a network account and computer storage owned by an ISP like Comcast or NetZero. All materials stored online, whether they are e-mails or remotely stored documents, are physically stored on servers owned by an ISP. When we send an e-mail or instant message from the comfort of our own homes to a friend across town the message travels from our computer to computers owned by a third party, the ISP, before being delivered to the intended recipient. Thus 'private' information is actually being held by third-party private companies."" Updated 2:50 GMT by timothy: Orin Kerr, on whose blog post of yesterday this story was founded, has issued an important correction. He writes, at the above-linked Volokh Conspiracy, "In the course of re-reading the opinion to post it, I recognized that I was misreading a key part of the opinion. As I read it now, Judge Mosman does not conclude that e-mails are not protected by the Fourth Amendment. Rather, he assumes for the sake of argument that the e-mails are protected (see bottom of page 12), but then concludes that the third party context negates an argument for Fourth Amendment notice to the subscribers."

Comments

Stop using FedEx

[QuantumG]

Wow, best to stop using FedEx and other *private* companies to send mail then.

Re:Stop using FedEx

[rtb61]

Perhaps you can tell me the difference between a phone call and a email. Phone calls are protected by wiretapping laws, it is a criminal offence to listen in to private phone calls or record them without the permission of all parties involved. Both phone calls and email are simply digital transmission over wire, both pass through other parties to get to the final destination, the only difference is the hardware and coding to encode, decode and interpret them.

Face it, the judge is an idiot of the first order, I mean come on has the boob never heard of ADSL. It completely ignores the fact that email servers are completely automated and require no human intervention to reach their destination. It is time for email software to make use of the DMCA and, incorporate a simple encryption technique that prevents the email from being read as plain text but require a simple for legal reasons only decryption technique with a default warning if the person is not the intended recipient, for email where the default recipient email address does not match the target email address.

Basically am encryption technique that is no more secure than you typical envelope but still providing the full legal security of a typical envelope, with the added bonus of the DMCA to beat them over the head with.

I wonder if you can use the DMCA to your advantage

[atlasdropperofworlds]

As a bit of an aside, does it matter if you try to make the data private via encryption?

There could be an interesting relationship here: If you claim (probably rightfully) that you own the copyright to the 'content' in question, and encrypt it, does this mean that it would be unlawful for anyone to try and decrypt it under the DMCA?

By this logic...

[TrebleJunkie]

...your medical records aren't private, either. When you use a hospital or a doctor's office, you're not in your own home, and your records of the visit are stored at the facility. This judge is a moron.

Re:By this logic...

[DaveV1.0]

Actually, they are private because there is a law saying they are private.

Does this mean...

[Anonymous Coward]

when we send mail via USPS, since the mail isn't technically in our homes while it is sitting in the post office, that the government can read it without violating A4?

Not the same, in several aspects

[Yobgod Ababua]

It's not about transportation, it's about destination.
Plus there's no expectation that FedEx would (or should) have access to the *contents* of your mail, but an ISP-hosted email account, currently, does have full access to the content, with your tacit approval.

There are options, potentially, for the more privacy minded:
* POP email with "delete from server" active will limit how much of your mail your ISP has access to.
* Run your own mailserver.
* Develop a mailserver that stores mail in an encrypted folder and requires your key to access.

That last one could also go a long way to helping solve the issue where private companies have to host their own mail and forbid employees from using other accounts solely to avoid the exposure of proprietary communications to third parties (the ISP). It also shouldn't be too difficult to set up...

Re:Not the same, in several aspects

[klingens]

It's not about transportation, it's about destination.

Every PO-box is then unprotected under 4th amendment too?

Re:Not the same, in several aspects

[Volante3192]

I was thinking the same thing about safety deposit boxes.

Re:Not the same, in several aspects

[wizardforce]

Plus there's no expectation that FedEx would (or should) have access to the *contents* of your mail, but an ISP-hosted email account, currently, does have full access to the content, with your tacit approval.

So does the phone company regarding your phone calls. That doesn't mean that there isn't a reasonable expectation of privacy.

Re:Not the same, in several aspects

[dgatwood]

Indeed, if you'd like a citation that agrees with you, http://cyberlaw.stanford.edu/packets001954.shtml is a good place to start.

Re:Not the same, in several aspects

[whoever57]

Replying to my own post, but I see from RTFA that the judge addressed the privacy policies. However, he seems to have read them differently to me. He says that Gmail uses agree to google disclosing the information in response to a lawful request (ie, a subpoena) and somehow reads from this that users dont have any expectation of privacy. Personally, I would think that expecting disclosure to require a warrant was pretty much an expectation or privacy. Otherwise, we can never have an expectation of privacy. Perhaps he means that because Google employees can read the emails, there is no expectation of privacy, but this is using a black and white test where is it not appropriate. I understand that Google employees can read my emails in gmail, but I have reason to expect that the contents won't go any further.

Re:Not the same, in several aspects

[Shadow of Eternity]

I rent an apartment, am I fucked as well?

Occasionally I am just absolutely struck fuck-dumb by the sheer level of pants on head retardedness displayed in decisions like this. Then I realise the 1st and 2nd amendments come into play.

Re:Not the same, in several aspects

[erroneus]

Tacit approval? I cannot agree. Most people consider their email to be the same as their real mail. There is no reasonable cause to consider the technical details of the email process as the common user has no knowledge of such details and typically believes his email is secure whether or not that is actually the case.

This judge is simply wrong to assert that the technical details disqualifies email from having 4th amendment protection.

FedEx has the same access to the contents of the mail as an email host provider has to read a user's email. One has but to access it. We "trust" FedEx not to tamper with or damage our mail. We "trust" email service providers not to tamper with or damage our email. I see no cause for technical details to play as a factor primarily because the constitution makes no qualifications for protection and it is not for legislators, judges or presidents to add qualifications that aren't stated. I believe it is unconstitutional to attempt to do so.

Re:Not the same, in several aspects

[whoever57]

That is where the judge gets the interpretation that there is no expectation of privacy. If you understand that Google employees can read your email in gmail, then you don't expect that your emails are private.

And, following that logic, my banking details are not private because bank employees can read them, my medical details are not private because insurance company employees can read them, my phone calls are not private because telephone company employees can listen to them, etc..

This is not the same everywhere.

[www.sorehands.com]

Recently in the second Circuit, it has been ruled that gmail users do have an expectation of privacy in their e-mail account. http://online.wsj.com/public/resources/documents/Bear1.pdf. Here the Court ruled that the warrant was too broad since it didn't restrict the inspection of e-mails that were unrelated to the investigation.

In light of both rulings, it may not prevent the government inspection, but could be grounds to suppress. Furthermore, the Stored communications act prohibits a warrant for this type of information unless, "offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation."

Re:Geeks may say

[TheGratefulNet]

I run my own mail server, you insensitive clod!

of course, the 'ever so smart judge' does not know this fine nuance.

the fact that packets travel along routers, bridges and gateways means that some of your 'property' is stored/forwarded outside your 'house'. BUT SO WHAT??

US mail travels in a store-forward way. are they allowed to read your mail because its 'not in your house, at the time' ?

finally, why is this moran allowed to concluded that ALL mail sits on 'webservers' ? even if it IS web-based, oftentimes its pop/imapped to your home system and then deleted off the server. or maybe you run old style port25 mail and it truly does go point to point and never 'sits' on an ISP for more than transit-time.

I'm really annoyed by judges who make decisions based on FALSE assumptions and lack of understanding. this judge should be fired or even tried for treason. his crime is THAT great; its a threat to some fundamental privacy that the constitution (once) allowed us.

those who seek to over-rule constitutional laws ARE traitors. look it up.

ECPA

[Anonymous Coward]

I see that the electronic communication privacy act of 1986 is being ignored once again.

http://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act

3rd-party doctrine

[MobyDisk]

When a person uses the Internet, the user's actions are no longer in his or her physical home... All materials stored online, whether they are e-mails or remotely stored documents, are physically stored on servers owned by an ISP

Yes, just like:
- Mail
- Safe deposit boxes
- Bank accounts
- Voice mails
- Telephone conversations
- Storage units

As far as I know, all of the above things are subject to the 4th amendment. WTF???!!!

Re:ok

[dgatwood]

More to the point, it is clearly no different than a bank safety deposit box, and those cannot be searched without a warrant. The mere fact that we are talking about data instead of physical objects should have no legal bearing on the requirement of a warrant for search and seizure. This is a clear case of bailment, and in bailment cases with a corporate entity, one can generally assume a right to privacy.

This will definitely get overturned on appeal unless the lawyers involved are inept.

Re:I wonder if you can use the DMCA to your advant

[Sir Holo]

A postcard is public, a letter in an envelope is private.

Re:Unencrypted e-mail is like postcards

[JoshuaZ]

A postcard isn't a good analogy. If I send a postcard, lots of people might see what is on it by simple chance. For example, the mail carrier might see it when they pick it up. In order for someone to read an email they need to go out of their way to access it in some form. That such access is easy doesn't say much. It is easy for someone to access physical mail often when people use a physical mailbox in the suburbs. Moreover, anyone in the postal service can easily access the internal contents of your mail without getting caught (steaming open a letter is really easy and hard to notice). That doesn't mean that the government has a right to read all my physical mail without a warrant. Just because something is possible doesn't mean that it is considered either normal or acceptable practice.

Re:ok

[Jeremiah Cornelius]

Funny, in the UK we had police smash into almost 7,000 safe-deposit boxes.

More than 500 officers smashed their way into thousands of safety-deposit boxes to retrieve guns, drugs and millions of pounds of criminal assets. At least, that's what was supposed to happen."

It was a warrant-expansion, from one of those "seizure of criminals assests" laws, that were started first in the States. Gone ALL wrong, 'tho'.

"Many of the clientele were families who had fled turmoil, pogroms, coups and wars and long had a cultural preference for locking away money and jewels, building up a vehement distrust for the integrity of traditional banks. Here, stepping down the spiral staircase at the back to the darkened boxes below, they felt reassured that their most important possessions were safe."

Read more: http://www.dailymail.co.uk/home/moslive/article-1222777/The-raid-rocked-Met-Why-gun-drugs-op-6-717-safety-deposit-boxes-cost-taxpayer-fortune.html

Re:Geeks may say

[pyr02k1]

I would like a warrant for the Senates email accounts please... All of em...