Appeals Court Says Feds Need Warrants to Search E-Mail

A federal appeals court on Monday issued a landmark decision (.pdf) that holds that e-mail has similar constitutional privacy protections as telephone communications, meaning that federal investigators who search and seize emails without obtaining probable cause warrants will now have to do so.

"This decision is of inestimable importance in a world where most of us have webmail accounts," said Kevin Bankston, a staff attorney for the Electronic Frontier Foundation.

The ruling by the Sixth U.S. Circuit Court of Appeals in Ohio upheld a lower court ruling that placed a temporary injunction on e-mail searches in a fraud investigation against Steven Warshak, who runs a supplements company best known for a male enhancement product called Enzyte. Warshak hawks Enzyte using "Smiling Bob" ads that have gained some notoriety.

The case boiled down to a Fourth Amendment argument, in which
Warshak contended that the government overstepped its constitutional reach when it demanded e-mail records from his internet service providers. Under the 1986 federal Stored Communications Act (SCA), the government has regularly obtained e-mail from third parties without getting warrants and without letting targets of an investigation know
(ergo, no opportunity to contest).

But a district court held that the SCA violates the Fourth Amendment by allowing the feds to secretly seize e-mail without probable cause warrants. Under the SCA, the government is required to get warrants for any e-mails that have been stored on third-party servers for less than 180 days. (the SCA came into effect long before the days of eternal Gmail storage.) After that, it can use an administrative subpoena or a different court order, provided it notified the target of the investigation. (the feds missed their legally mandated deadline for notifying Warshak by nearly a year.) To make matters more complicated, the government argued that the definition of "electronic storage" in the statute meant the feds only needed warrants when e-mail had yet to be opened or downloaded.

"The DOJ reading of the statue in practical terms is that any e-mail you have opened it can obtain without a warrant," Bankston said. But the district court ruled that the Fourth Amendment holds otherwise. And the appellate court affirmed the lower court's decision, agreeing that e-mail users have a reasonable expectation of privacy, regardless of how old their correspondence is and where it is stored. From the decision:

"In considering the factors for a preliminary injunction, the district court reasoned that e-mails held by an ISP were roughly analogous to sealed letters, in which the sender maintains an expectation of privacy. This privacy interest requires that law enforcement officials warrant, based on a showing of probable cause, as a prerequisite to a search of the e-mails."

To reach its decision, the court relied on two amici curiae that presented compelling arguments for shoring up current privacy law with respect to e-mail. Both the Electronic Frontier Foundation (together with the ACLU
and the Center for Democracy and Technology) and a coalition of internet law professors argued that e-mail is a vital form of communication in today's world and its privacy must be safeguarded under the constitution lest society's ability to engage in unfettered debate and discussion be eroded.

From the EFF amicus brief (.pdf):

"This case must be considered in the context of one overriding fact: millions of Americans use email every day for practically every type of personal business. Private messages and conversations that once would have been communicated via postal mail or telephone now occur through email, the most popular mode of Internet communication. Love letters, family photos, requests for (and offerings of) personal advice, personal financial documents, trade secrets, privileged legal and medical information—all are exchanged over email, and often stored with email providers after they are sent or received.
These myriad private uses of email demonstrate society’s expectation that the personal emails sent and received over the Internet and stored with email providers are as private as a sealed letter, a telephone call, or even papers that are kept in the home."

From the internet professors' brief:

"E-mail has become so indispensable that it must be reasonable for us to expect that it is private. One who looks at our e-mails obtains a detailed view into our innermost thoughts; no previous mode of surveillance exposes more. When we compose private and professional e-mails, embed links to Internet sites in some, and attach documents, pictures, sound files and videos to others, we rely on the privacy of the medium. Society does not make us rely at our peril but rather accepts as reasonable our expectations of privacy in e-mail."

Because of the secrecy in which SCA
investigations have been conducted, it's impossible to say how widespread this kind of government snooping into e-mail has been. "We don't know how often [it's happened]," said Susan Freiwald, a law professor at the University of San Francisco who submitted one of the briefs. "The only way to find this out is if the ISPs told us or the government told us. The information is not reported to Congress."

Bankston suggested that the practice was widespread: "It is absolutely routine. It is and has been the Department of Justice and presumably local law enforcement's standard practice for obtaining e-mails over the last 20 years."

There have been no previous constitutional challenges of the
SCA, likely because ISPs don't want to cause trouble and targets of investigations don't know that their e-mail is being read. "This demonstrates the importance of judicial review," Freiwald said. "You don't ask an agency to set its own governing rules."