In this post, I want to explore the facts and the scope of the injunction in the Sixth Circuit's big e-mail privacy decision in Warshak v. United States. In my next post, I'll cover the court's legal analysis; and in the posts after that I'll critique them.

  For the last few years, Steve Warshak has run a company selling pharmaceutical drugs such as penis enlargement pills and diet pills called Berkeley Premium Nutraceuticals. (Background here.) In 2006, Warshak was indicted on 107 counts of wire fraud, bank fraud, money laundering, and assorted other crimes; that same year, the FTC also brought a civil action against him and his company.

  This case involves a civil suit filed by Warshak against the United States while his criminal investigation was in progress but after he had already been sued by the FTC. In 2005, the government was investigating Warshak and obtained court orders under the Stored Communications Act to compel two commercial ISPs — South Carolina-based Nuvox Communications and California-based Yahoo! — to disclose material in Warshak's e-mail ccounts. The Stored Communications Act allows the government to compel contents held by ISPs for more than 180 days using less process than a warrant, and, depending on how the statute is construed, it may also allow the government to obtain "opened" e-mail stored less than 180 days with less process as well. The government also obtained a court order permitted by 18 U.S.C. 2705 delaying notice to Warshak for 90 days.

  Both Nuvox and Yahoo turned over e-mails to the government in response to the court order, although they disagreed on how to read the statute and therefore released different information. Nuvox turned over both opened e-mails and e-mails in storage for more than 180 days. California-based Yahoo, presumably under the direction of a 2004 Ninth Circuit SCA decision in a case called Theofel v. Farey-Jones, turned over only e-mails in storage for more than 180 days.

  What happened next isn't exactly clear, but it looks like counsel for Warshak somehow found out about the disclosures, and that by that time more than 90 days had passed (the government apparently forgot to renew its order to delay notice, so notice had been due but not received.) Warshak, then not yet indicted, filed a civil suit alleging that the use of the Stored Communications Act to compel his e-mails violated both the SCA and the Fourth Amendment. Of importance here, Warshak also sought a preliminary injunction blocking the government from using the Stored Communications Act to compel the contents of e-mail with less process than a warrant in all future cases in the Southern District of Ohio.

  The district court granted Warshak's motion in part in order to stop what it thought would be unconstitutional uses of the Stored Communications Act. Specifically, the district court enjoined the government from compelling e-mail belonging to people in the Southern District of Ohio from ISPs anwhere in the country using Stored Communications Act orders less than full warrants unless the government provided notice to the persons first. The scope of the injunction was sort of a head-scratcher, but apparently it reflected a belief that use of less than a warrant violated the Fourth Amendment without notice but that less than a warrant was okay if the suspect was given prior notice. The government then appealed, and the issue before the Sixth Circuit was whether the district court properly granted the preliminary injunction.

  In the decision handed down yesterday, the Sixth Circuit mostly affirmed the district court's injunction, albeit with one modification. Under the Sixth Circuit's opinion, the federal government can't use a Stored Communications Act 2703(d) order to get the contents of "personal e-mail" held by an ISP in the name of a resident of the Southern District of Ohio unless the government either provides notice and an opportunity to be heard or else makes a fact-specific showing that the account holder maintained no reasonable expectation of privacy "with respect to the ISP." The panel explains earlier in the opinion that the test for whether a "reasonable expectation of privacy with respect to the ISP" does not exist is whether "the ISP or other intermediary clearly established and utilized the right to inspect, monitor, or audit the content of e-mails, or otherwise had content revealed to it."

  If I understand what the Sixth Circuit has in mind, the government has three possible ways to compel the contents of e-mails under the Sixth Circuit's injunction: 1) via a full probable cause warrant, 2) with a 2703(d) order preceded by an ex parte proceeding in which the government first notifies the ISP and then proves to the issuing magistrate that "the ISP or other intermediary clearly established and utilized the right to inspect, monitor, or audit the content of e-mails, or otherwise had content revealed to it," or 3) if the government first notifies the customer, under a lower reasonableness standard as a matter of constitutional law and a 2703(d) specific and articulable facts standard as a matter of statutory law.

  Oddly, the injunction does not seem to address the other path the SCA permits, namely compelling contents with a subpoena. The injunction doesn't mention subpoenas, although the opinion's reasoning suggests that it should. I'm not sure what to make of that.