Warshak v. United States: Tomorrow the Sixth Circuit will be holding argument in Warshak v. United States, a rather odd case involving e-mail privacy. I'm pretty sure the court won't get to the merits, but it's a notable case nonetheless.

  Warshak, a suspect in a massive fraud case, sought an injunction against the government obtaining his e-mail from his ISP pursuant to the Stored Communications Act. Warshal reasoned that the Stored Communications Act lets the government obtain e-mail in some cases with less process than a full search warrant, and that if the government were to obtain his e-mail in that way that it would end up violating his Fourth Amendment rights. The district court judge in the case ended up crafting a rather strange injunction to address possible Fourth Amendment shortcomings in the statute: the judge ruled that the United States could not obtain e-mail with less process than a warrant in any case anywhere in the Southern District of Ohio unless it gave that person prior notice and an opportunity to be heard.

    The government's brief on appeal before the Sixth Circuit is here; Warshak's brief is here.

  I ended up deciding not to file an amicus brief in the case because it seems very unlikely that the court will reach the merits. I don't think I have ever come across a preliminary injunction of a statute on Fourth Amendment grounds, and I imagine the court will reverse on procedural grounds without getting into the merits. That's the right call, in my view: With one quirky historical exception, review of Fourth Amendment challenges has always been as-applied, not facial. Courts ask whether the government's conduct was an unreasonable search or seizure, not whether following the statute will in some cases or all cases violate the Fourth Amendment. (For the classic discussion of the dangers of facial review of statutes under the Fourth Amendment, see Chief Justice Warren's opinion in Sibron v. New York.)

  A facial review in this particular case would be particularly problematic. There are no facts yet, and the Fourth Amendment is intensely fact-specific. Further, we don't even know if the government's reading of the statute is correct; there's a split in the courts as to what the relevant government authorities actually are (as explained here). Finally, the Fourth Amendment issues in the case are both incredibly important and tremendously complex; they would require a court to wade through the reasonable expectation of privacy test in remotely stored files, the standard of reasonableness for orders to compel third party data, and third-party consent rights for system administrators — and all without any facts and no clear sense of the relevant statutory law.

  I'm pretty sure the Sixth Circuit won't want to jump into all of these questions in such an odd procedural posture. It seems pretty clearly unwise to try. It makes much more sense for the court to let the case develop in the usual course: Warshak has already been indicted, and if e-mail evidence is used against him he can file a motion to suppress (and/or bring a civil claim under Bivens).

  If you're interested in more on the substantive legal issues here, I go into depth on a number of these issues in my casebook; I also have an extended discussion of the role of the courts in applying the Fourth Amendment to new technologies in this article.

  UPDATE: There were also two amicus briefs filed on the merits of the case, just in case the panel delves into the Fourth Amendment issues. A group of privacy law and Internet law professors led by Susan Freiwald and Patricia Bellia filed one brief; the Electronic Frontier Foundation filed another. I think both briefs raise interesting arguments, although the issues are much more complicated than either suggests. In any event, I think the procedural posture of the case means that the Fourth Amendment issues are best left for another day.

  ANOTHER UPDATE: To get an idea of how difficult some of the Fourth Amendment issues are, check out the amicus brief I wrote in 2002 in a somewhat similar Eighth Circuit case, United States v. Bach. I wrote that amicus brief because I wanted to make sure the panel recognized the very difficult issues it was potentially facing. I thought about updating my Bach amicus brief and submitting it in the Warshak case, but I ended up being short on time (and I figured the procedural problems made it unlikely the court would get to the substance). Note also that the facts of the Bach case did not implicate the third-party consent issues raised in Warshak.

Sixth Circuit Blockbuster on E-Mail Privacy: In an earlier blog post on a pending case in the Sixth Circuit, Warshak v. United States, I figured there was no way the court would get to the merits of the Fourth Amendment issue lurking in the case: there were no facts yet and no decided statutory law, and surely the panel wouldn't be so reckless as to presumptively strike down a federal statute in the absence of facts or law given the procedural problems with the case. I had a funny feeling things would turn out differently when I learned who was on the panel, though, and that funny feeling turned out to be justified: the panel just issued a blockbuster decision that tries to answer how the Fourth Amendment applies to e-mail (all without any facts, amazingly) based on arguments from amicus briefs that the government didn't address all in the context of an appeal from a preliminary injunction. Wow. More on the decision later today.

  UPDATE: Here's the key part of the opinion:

[W]e have little difficulty agreeing with the district court that individuals maintain a reasonable expectation of privacy in e-mails that are stored with, or sent or received through, a commercial ISP. The content of e-mail is something that the user “seeks to preserve as private,” and therefore “may be constitutionally protected.” Katz, 389 U.S. at 351. It goes without saying that like the telephone earlier in our history, e-mail is an ever-increasing mode of private communication, and protecting shared communications through this medium is as important to Fourth Amendment principles today as protecting telephone conversations has been in the past. See Katz, 389 U.S. at 352 (“To read the Constitution more narrowly is to ignore the vital role that the public telephone has come to play in private communication.”)

Notably, the court's Fourth Amendent analysis combines aspects of the probabilistic, private facts, positive law and policy model (the above-quoted section being from the policy model section).

A Series of Posts on Warshak v. United States, the E-Mail Privacy Case: Today's Fourth Amendment decision in Warshak v. United States is astonishing on a number of fronts. If it stands on the books, it will revolutionize the way that Fourth Amendment challenges are brought; it will constitutionalize an area of law long thought to be statutory, invalidating some statutes along the way; and it will create the rather surprising result that Fourth Amendment protections are actually significantly stronger online than in the physical world.

  With that said, the caveat "if it remains on the books" is very important here. Whether the panel's view of the Fourth Amendment is right or wrong, Judge Martin had to reach out to decide as much as he did. In so doing, he had to make some procedural moves that strike me as pretty obviously wrong. If the Sixth Circuit en banc corrects the procedural errors, all of the panel's substantive Fourth Amendment holdings will go away.

  I think Warshak will be a very good case for en banc review. Indeed, assuming the government petitions for rehearing, I would plan to write a brief urging the en banc court to grant the petition. In the next few posts I want to explain why I think the case is so remarkable, and also very troubling. My plan is to start with the procedural problems, then post on the panel's Fourth Amendment holdings, and then post on the difficulties with the panel's Fourth Amendment holdings.

The Facts and Injunction in Warshak v. United States: In this post, I want to explore the facts and the scope of the injunction in the Sixth Circuit's big e-mail privacy decision in Warshak v. United States. In my next post, I'll cover the court's legal analysis; and in the posts after that I'll critique them.

  For the last few years, Steve Warshak has run a company selling pharmaceutical drugs such as penis enlargement pills and diet pills called Berkeley Premium Nutraceuticals. (Background here.) In 2006, Warshak was indicted on 107 counts of wire fraud, bank fraud, money laundering, and assorted other crimes; that same year, the FTC also brought a civil action against him and his company.

  This case involves a civil suit filed by Warshak against the United States while his criminal investigation was in progress but after he had already been sued by the FTC. In 2005, the government was investigating Warshak and obtained court orders under the Stored Communications Act to compel two commercial ISPs — South Carolina-based Nuvox Communications and California-based Yahoo! — to disclose material in Warshak's e-mail ccounts. The Stored Communications Act allows the government to compel contents held by ISPs for more than 180 days using less process than a warrant, and, depending on how the statute is construed, it may also allow the government to obtain "opened" e-mail stored less than 180 days with less process as well. The government also obtained a court order permitted by 18 U.S.C. 2705 delaying notice to Warshak for 90 days.

  Both Nuvox and Yahoo turned over e-mails to the government in response to the court order, although they disagreed on how to read the statute and therefore released different information. Nuvox turned over both opened e-mails and e-mails in storage for more than 180 days. California-based Yahoo, presumably under the direction of a 2004 Ninth Circuit SCA decision in a case called Theofel v. Farey-Jones, turned over only e-mails in storage for more than 180 days.

  What happened next isn't exactly clear, but it looks like counsel for Warshak somehow found out about the disclosures, and that by that time more than 90 days had passed (the government apparently forgot to renew its order to delay notice, so notice had been due but not received.) Warshak, then not yet indicted, filed a civil suit alleging that the use of the Stored Communications Act to compel his e-mails violated both the SCA and the Fourth Amendment. Of importance here, Warshak also sought a preliminary injunction blocking the government from using the Stored Communications Act to compel the contents of e-mail with less process than a warrant in all future cases in the Southern District of Ohio.

  The district court granted Warshak's motion in part in order to stop what it thought would be unconstitutional uses of the Stored Communications Act. Specifically, the district court enjoined the government from compelling e-mail belonging to people in the Southern District of Ohio from ISPs anwhere in the country using Stored Communications Act orders less than full warrants unless the government provided notice to the persons first. The scope of the injunction was sort of a head-scratcher, but apparently it reflected a belief that use of less than a warrant violated the Fourth Amendment without notice but that less than a warrant was okay if the suspect was given prior notice. The government then appealed, and the issue before the Sixth Circuit was whether the district court properly granted the preliminary injunction.

  In the decision handed down yesterday, the Sixth Circuit mostly affirmed the district court's injunction, albeit with one modification. Under the Sixth Circuit's opinion, the federal government can't use a Stored Communications Act 2703(d) order to get the contents of "personal e-mail" held by an ISP in the name of a resident of the Southern District of Ohio unless the government either provides notice and an opportunity to be heard or else makes a fact-specific showing that the account holder maintained no reasonable expectation of privacy "with respect to the ISP." The panel explains earlier in the opinion that the test for whether a "reasonable expectation of privacy with respect to the ISP" does not exist is whether "the ISP or other intermediary clearly established and utilized the right to inspect, monitor, or audit the content of e-mails, or otherwise had content revealed to it."

  If I understand what the Sixth Circuit has in mind, the government has three possible ways to compel the contents of e-mails under the Sixth Circuit's injunction: 1) via a full probable cause warrant, 2) with a 2703(d) order preceded by an ex parte proceeding in which the government first notifies the ISP and then proves to the issuing magistrate that "the ISP or other intermediary clearly established and utilized the right to inspect, monitor, or audit the content of e-mails, or otherwise had content revealed to it," or 3) if the government first notifies the customer, under a lower reasonableness standard as a matter of constitutional law and a 2703(d) specific and articulable facts standard as a matter of statutory law.

  Oddly, the injunction does not seem to address the other path the SCA permits, namely compelling contents with a subpoena. The injunction doesn't mention subpoenas, although the opinion's reasoning suggests that it should. I'm not sure what to make of that.

The Legal Rulings in Warshak v. United States: In my last post, I explained the facts of Warshak v. United States, the Sixth Circuit's new decision that largely rewrites the law of e-mail privacy. In this post, I want to explain the opinion's legal rulings.

  Two caveats before I begin. First, I'll mostly (although not entirely) save the commentary for later. The Warshak opinion announces five or six novel and far-reaching propositions of law, and I think it's important for us to start with an understanding of what those rulings are before we get to whether the court had a solid basis or announcing them. Second, I should emphasize that there may be room for disagreement as to the meaning of some of the passages. The opinion is quite complex and not exactly a model of clarity, and I struggled over some of the passages. Given this, I hope those who disagree with my interpretations will politely explain why in the comment thread.

  On to the opinion, starting with procedural issues and then moving on to the Fourth Amendment rulings.

The Procedural Rulings
  Let's get the procedural, non-Fourth Amendment matters out of the way first. These parts are less high-profile than the substantive Fourth Amendment issues, but they're the rulings that let the court get to the Fourth Amendment issues so we need to appreciate them to understand the case. In particular, there are two key procedural rulings:

  (1) When a person challenges a statute under the Fourth Amendment, the court has the power to consider all of the possible applications of the challenged statute, determine which ones violate the Fourth Amendment, and then enjoin the ones that would violate the Fourth Amendment while allowing the statute to be used in ways that the court concludes would be constitutional.

  According to the court, individuals can bring facial challenges to statutes under the Fourth Amendment "where the statute, on its face, endorses procedures to authorize a search that clearly do not comport with the Fourth Amendment." However, courts ruling on such facial challenges do not need to uphold or strike down statutes in their entirety. Rather, courts can impose a "narrow" type of facial invalidation in which the court can determine which applications of the statute would be constitutional and which would be unconstitutional. The court can then prohibit only the unconstitutional applications of the statute and permit the rest.

  (2) The plaintiff in this case has standing and his claims are ripe to challenge future acts under the SCA, and the balance of factors favors an injunction here.

  Warshak has standing to challenge the government's future conduct because the government has obtained his e-mails twice before and might do so again because the statute permits the government's action. Although Warshak has been indicted and the case has moved on to a different stage, it is possible that the government might try to get his e-mail again using the same technique it used in 2005. His claims are not excessively hypothetical because it seems likely that future efforts to obtain Warshaks e-mail probably would be pretty similar to the two past ones. Further, the government wants to act in ways that violate the Fourth Amendment, which is contrary to the public interest and favors issuing the injunction.

The Fourth Amendment Rulings
On to the Fourth Amendment rulings. They are:

  (1) The threshold that the Fourth Amendment requires when compelling evidence with a subpoena or similar order depends on who has privacy rights and whether the persons who have privacy rights have been given prior notice of the government's action.

  The court envisions three different categories of privacy protection for orders to compel:

  First, when the government is seeking evidence with a subpoena and no third party has a reasonable expectation of privacy in the information, the Fourth Amendment standard is the traditional reasonableness standard.

  Second, when the government is seeking evidence with a subpoena and a third party has a reasonable expectation of privacy in the information but is not given prior notice, then the Fourth Amendment requires probable cause.

  Third, when the government is seeking evidence with a subpoena and a third party has a reasonable expectation of privacy in the information but is given prior notice allowing them to challenge the subpoena, then the Fourth Amendment standard drops back down to traditional reasonableness. In other words, the Fourth Amendment requires probable cause or notice, but the presence of notice drops the required legal threshold down to reasonableness.

  (2) E-mail users always have a reasonable expectation of privacy against the outside world in their e-mail.

  The contents of stored e-mail held by an ISP are like the contents of landline telephone calls, sealed letters, or sealed packages. The fact that ISPs have the technical ability to access e-mail doesn't matter, any more than does the fact that the Post Office has the technical ability to break open your envelopes and read your postal mail. An ISP might access subscriber and non-content information associated with an e-mail, but the ISP has not been granted access to the e-mail's contents and there is a "societal expectation" that they normally will not access contents.

  Notably, however, a user's reasonable expectation of privacy in e-mail is not the same as a person's reasonable expectation of privacy in physical spaces. Rather, it is broader, because computer accounts are different from physical spaces. In the physical world, a person's reasonable expectation of privacy is contingent on his relationship to the place. Thus, Katz had a reasonable expectation of privacy in the phone booth only temporarily when he was making a call; a hotel guest loses his reasonable expectation of privacy after checkout time; and a burglar has no reasonable expectation of privacy in a house he has burglarized. Fourth Amendment rights in physical spaces depend on whether the person has a legitimate relationship with the space sufficient to establish constitutional proection.

  According to the court, these concepts do not apply to computer accounts. The court reasons that these Fourth Amendment rules in physical space exist because physical space can be used by multiple people. For example, a hotel guest loses a reasonable expectation of privacy at checkout time because the next guest is coming and soon will be putting his stuff in the room. But e-mail is different: e-mail accounts are not ordinarilty used by multiple people. If you stop paying the bill for your ISP account, you wouldn't expect some other Internet user to gain access to your account and start looking through your e-mail! As a result, you maintain a reasonable expectation of privacy in your account even if you signed up for the account fraudulently or you decided to abandon the account.

  Indeed, even a hacker likely has a reasonable expectation of privacy in the contents of e-mails in an account he has hacked. A thief does not have a reasonable expectation of privacy in the contents of a computer he has stolen. But if a hacker breaks into an account and puts his private information there, the analogy to a stolen physical computer is unhelpful because the hacker didn't actually "steal" the e-mail account or the server that hosts it.

  (3) A clear statement by an ISP in Terms of Service that it regularly accesses e-mail content combined with a) evidence that users are aware of that policy and b) evidence that the ISP utilizes the policy does not eliminate Fourth Amendment protection altogether, but does eliminate a reasonable expectation of privacy "vis a vis the provider," allowing a lower subpoena standard to be used to compel evidence from the ISP.

  According to the court, there are two kinds of reasonable expectations of privacy: those generally and those vis-a-vis ISPs. (Editorial note: This is wrong as a matter of basic Fourth Amendment law; there is no such thing as reasonable expectations of privacy vis a vis different people or entities. But I promised not to talk about the merits here, so I'll get to that in a future post.) In some circumstances, ISP monitoring can eliminate the user's reasonable expectation of privacy vis a vis the ISP although not vis a vis the outside world. The key line is between "total access" and "less in-depth screening"; "total access" eliminates the REP with respect to the provider but "less in-depth screening" does not.

  The court elaborates on the line and offers the following constitutional test: to establish that a user has waived a reasonable expectation of privacy in e-mail vis a vis the provider, the goverment must show "based on specific facts," "that the ISP or other intermediary clearly established and utilized the right to inspect, monitor, or audit the contents, or otherwise had content revealed to it." If the government can establish this, then the user's reasonable expectation of privacy "vis a vis the provider" is waived, and the Fourth Amendment is now satisfied if the subpoena or order to compel is obtained under a reasonableness standard rather than probable cause.

  (4) Computer scanning of e-mail for key words, types of images or "similar indicia of wrongdoing" in a way that does not disclose contents to an actual person does not invade any Fourth Amendment rights.

  According to the court, such computer-driven screening is like post office screening of packages for evidence of drugs or explosives. Because such screening does not trigger the Fourth Amendment — on a Caballes dog-sniff rationale, I assume — digital screening does not do so either. (Presumably this means that the any NSA monitoring of e-mail for keywords or the use of FBI devices installed at ISPs to scan e-mail and attachments for digital images of child pornography do not implicate the Fourth Amendment. However, the court does not elaborate on this point.)

  (5) When e-mail is obtained pursuant to a search warrant, the particularity requirement requires that warrants must "target e-mails that could reasonably be believed to have some connection to its specific investigation."

  When the government has probable cause to believe evidence of crime or contraband is in an e-mail account, it cannot request the entire e-mail account. The warrant has to be selective and only ask for specific documents or categories of documents. (Given that ISP employees execute warrants for e-mail accounts, rather than police officers, I don't know how this is supposed to work. Perhaps cops need to actually come to the ISP and screen the e-mails onsite or else the police must start outsourcing minimization to the ISP employees? Or can the ISP send the entire contents to the FBI, which will then execute the search on the account based on the particular warrant much as hey would a PC? More on this later, too.) The court suggests that magistrates should consider limiting e-mail warrants based on the date of the e-mail, the "to" and "from" adress, or keywords, but does not impose a requirement of that.

* * * *
  So there you have it. As you can see, the court sure managed to pack in a lot of law into a 20-page opinion. I don't think I'm exagerrating to say it's an entirely new regime for e-mail privacy. In my next post, I'll finally start critiquing the opinion on the merits. I plan to start by critiquing the court's procedural rulings, some of which struck me as pretty obviously wrong and contrary to fairly clear Supreme Court precedent that the panel opinion didn't cite. Stay tuned....

The Procedural Errors of Warshak v. United States: In this post on Warshak, I want to address why I think the case was obviously wrongly decided as a procedural matter. The court simply had no business trying to imagine all the ways the statute might be applied and resolving the constitutionality of all of those hypothetical applications. No court has ever done that before, and it's a dramatic break with decades of Fourth Amendment practice that the Supreme Court long ago foreclosed. Not only that, as I have argued in this 2004 law article, it's a reckless practice as a matter of policy: courts simply lack the institutional ability to enact entire surveilance regimes all at once, and any effort to do so is bound to create major headaches (as this one will, for reasons I'll get to in a future post).

  Let's start with some background about how Fourth Amendment law is made. The basic starting point of Fouth Amendment decisionmaking is that it is based on concrete facts: a search or seizure occurs and then its legality is challenged, either pursuant to a civil action or a motion to suppress. The court holds a hearing, figures out exactly what happened, and then applies the Fourth Amendment to the facts as found.

  This does not mean that prospective injunctive relief does not exist in Fourth Amendment law; but it does mean it is rare and its scope is very limited. Courts consider injunctive relief for Fourth Amendment violations when the government has an ongoing program: For example, the police might have enacted a new program putting up a particular kind of road block, or a school might have a policy requiring drug testing of public school students. In these cases, however, the scope of the injunctive relief is always very limited: the court considers whether the recurring known facts as they exist render the government conduct constitutional or unconstitutional. The court's role is limited to giving the existing program the Constitutional thumbs-up or thumbs-down.

  The Warshak court took a radically different approach. According to Judge Martin, courts can rule on facial challenges to statutes that regulate searches and seizures. In this setting, courts have the power to survey all of the possible applications of the statute and determine which ones will be constitutional and which ones won't be; the court can then draft the appropriate injunction to ensure the government oly acts constitutionality in the types of cases potentially covered by the statute. The Court drew this power from two cases: Berger v. New York, 388 U.S. 41 (1967), which considered a facial challenge to a New York wiretapping statute, and Ayotte v. Planned Parenthood, 546 U.S. 320 (2006), the recent abortion case authorizing lower courts to craft injunctive relief for the use of a challenged abortion statute to a set of unconstitutional applications of the statute.

  But this is pretty clearly incorrect. It is true that the Supreme Court did once entertain a facial Fourth Amendment challenge to a statute, in Berger. (There were very unusual circumstances, in case you're interested: Congress was considering the wiretapping legislation ultimately enacted as Title III, and the Justices wanted to and did get their 2 cents in about what it would say. ) However, the Court quickly shut the door on facial Fourth Amendment challeges just a year later in Sibron v. New York, 392 U.S. 40 (1968).