The U.S. Court of Appeals for the 6th Circuit recently became the first federal appellate court to consider whether individuals have a reasonable expectation of privacy, protected by the Fourth Amendment to the Constitution, in the contents of emails stored by an Internet service provider. In Warshak v. United States, No. 06-4092 (6th Cir. June 18, 2007), the court held that such a protected privacy interest exists and that the government may not obtain ex parte access to the contents of email in long-term storage without a showing of probable cause. Accordingly, the court held unconstitutional Section 2703(d) of the Stored Communications Act (18 U.S.C. § 2703(d)) to the extent that it purports to authorize law enforcement officials to obtain the contents of emails from a commercial Internet services provider upon less than probable cause and without notice to the person who sent the emails.
The 6th Circuit's decision in Warshak should be read together with the even more recent decision by the Court of Appeals for the 9th Circuit in United States v. Forrester, No. 05-54010 (9th Cir., July 6, 2007), holding that individuals do not have a reasonable expectation of privacy in email headers and email Internet Protocol addresses. These decisions together indicate that the greater protection accorded the contents of communications, compared to addressing/routing information associated with those communications, a difference long recognized in the contexts of postal mail and telephone conversations, extends to email communications as well. Such a result would also be consistent with the greater protection accorded the contents (as distinct from addresses) of electronic communications under the Electronic Communications Privacy Act.
Facts and Proceedings
In May 2005, federal investigators, in connection with a criminal investigation, obtained an order pursuant to 18 U.S.C. § 2703 from a U.S. magistrate judge in the Southern District of Ohio directing Mr. Warshak's Internet service provider to disclose, inter alia, the content of Mr. Warshak's emails. The order stated that it was issued under 18 U.S.C. § 2703—a provision of the Stored Communications Act—and that it was based on "specific and articulable facts showing that there are reasonable grounds to believe that the records or other information sought are relevant and material to an ongoing criminal investigation"—a standard that requires a lower showing than probable cause. The order prohibited the ISP from informing Mr. Warshak of its existence. The magistrate further ordered that the government notification to Mr. Warshak otherwise required by 18 U.S.C. § 2703(b)(1)(B) could be delayed for 90 days, as authorized by 18 U.S.C. § 2705. A similar order was subsequently directed to a second email ISP.
The government did not notify Mr. Warshak of the orders until May 2006. Mr. Warshak thereupon filed a lawsuit against the government claiming that the compelled disclosure of his emails without a search warrant violated both the Fourth Amendment and the Stored Communications Act. The district court granted a preliminary injunction prohibiting the government from seizing the contents of any emails from an ISP account of any resident of the Southern District of Ohio on less than probable cause without notice to the resident and an opportunity for a hearing. The government appealed the injunction.
On appeal, the government argued on the merits that the compelled disclosure of stored email should be evaluated on a reasonableness standard, rather than the probable cause standard applied by the district court. In essence, the government argued that the compelled disclosure of the contents of emails pursuant to a Section 2703 order should be treated as analogous to a subpoena, rather than a search warrant, on the grounds that Section 2703(d) orders and subpoenas are forms of compelled disclosures not effected by force.
The government also disputed whether Mr. Warshak had a reasonable expectation of privacy in the content of his emails. In particular, it argued that the fact that the Stored Communications Act permits ISPs to access all communications stored on their services means they also may divulge those communications in response to compulsory process.
The 6th Circuit's Decision
The 6th Circuit rejected the federal government's arguments. First, the court held that the government's argument that the lesser compelled disclosure standard should apply "begs the critical question of whether an email user maintains a reasonable expectation of privacy in his emails vis-à-vis the party who is subject to compelled disclosure—in this instance, the ISPs." The court concluded that under Fourth Amendment law, whether a probable cause or a reasonable standard applies depends upon whether the email user has a reasonable expectation of privacy in the contents of his stored emails. The court concluded that Mr. Warshak did have such a reasonable expectation.
The court analogized the content of emails to the content of telephone calls. Although the user, just like a telephone caller, assumes the risk that the other party to the communication may disclose the contents to the world, the Section 2703 orders were directed to ISPs, not to Mr. Warshak or his email correspondents.
Most importantly, the 6th Circuit held that email account holders do have a reasonable expectation of privacy in the contents of messages stored in their accounts with commercial ISPs. The court concluded that commercial ISPs most closely resemble telecommunications common carriers and the postal service, organizations that do not routinely eavesdrop upon or open communications in transit. Thus, the court held that email content enjoys the same constitutional protection as the content of telephone conversations and the contents of sealed letters. (On an apparent Bush administration initiative to lessen the search warrant requirements for first-class letters, see "How Private is Your Mail? Postal Signing Statement Provokes Controversy" (Jan. 2007 Privacy in Focus).
Accordingly, the court concluded that the government's obtaining of the contents of an email is a "search" akin to the wiretapping orders in Katz v. United States, 389 U.S. 347 (1967) and Berger v. New York, 388 U.S. 41 (1967). In so doing, the court rejected the government's argument that such an expectation would not be reasonable in light of language in the ISPs' service agreements reserving the ISPs' right to access user emails. Instead, the court credited the district court's finding that employees of commercial ISPs do not routinely open and read individual subscriber emails.
However, the court left open the possibility that other facts could destroy any reasonable expectation of privacy. For example, the court noted that where a user agreement "calls for regular auditing, inspection, or monitoring of emails, the expectation may well the different, as the potential for an administrator to read the content of emails in the account should be apparent to the user." In particular, employees using an employer's email system who are on notice that the employer may monitor the contents of such emails may not have a reasonable expectation of privacy.
Here, however, the court found that Mr. Warshak had a reasonable expectation of privacy in the contents of his emails stored with the ISPs. The court went on to hold that the Section 2703 order was inadequate where, as here, the ex parte nature of the seizure had deprived him of any opportunity for judicial review:
Where the third party is not expected to access the emails in the normal course of business, however, the party maintains a reasonable expectation of privacy, and subpoenaing the entity with mere custody over the documents is insufficient to trump the Fourth Amendment warrant requirement.
As a result, the 6th Circuit in Warshak essentially upheld the lower court's preliminary injunction.
Content More Protected Than Email Addresses
In contrast, the Warshak court noted that an email sender has a lesser expectation of privacy in the email address of the other party to a communication, as that—unlike the contents—is information delivered to and used by the service provider in providing the service and becomes a routine part of its business records. Citing Smith v. Maryland, 442 U.S. 735 (1979), the court held that the record of the addressee of the communication is the type of information that a caller or sender conveys to the service provider.
Indeed, the 9th Circuit recently held precisely that in United States v. Forrester, No. 05-50410 (9th Cir. July 6, 2007). In Forrester, the court ruled that the Fourth Amendment does not protect email headers and Internet Protocol addresses. The Forrester court held that surveillance of email headers and IP addresses is analogous to pen registers that record numbers dialed by telephones and to inspection of the addresses on the outside of sealed envelopes. The Forrester court upheld the use of a court order, and did not require a search warrant, to authorize the surveillance.
Warshak is the first case to extend to email content the constitutional protections accorded telephone conversations and letter mail. As such, it can be read as recognizing the important role that email has come to play in American life over the past 15 years. Read together, the Warshak and Forrester cases draw the same line between the protected nature of the contents of communications and the less protected nature of addressing information that exists for telephone and postal communications. Indeed, Congress has also drawn the same distinction in the Wiretap and Stored Communications titles of the Electronic Communications Privacy Act.
Future cases will flesh out the ultimate significance of Warshak. If adopted elsewhere, law enforcement may have to overcome an additional hurdle when conducting criminal investigations. Look for challenges in the employment law context, as, in the wake of Warshak, employees may increasingly argue that they have a reasonable expectation of privacy in the contents of emails stored on their employer's email systems.