Statute Used to Get Emails Held Unconstitutional

Last week, an Ohio federal district court issued a decision that could have major repercussions for law enforcement's ability to investigate cybercrme cases.

The case is Steven Warshak v. United States (Southern District of Ohio Case No. 1:06-cv-357). The opinion was issued on July 21 by Judge Susan Dlott, who sits in Cincinnati.

The case is a civil suit: Warshak sued the U.S. government, claiming that it violated "the Fourth Amendment to the United States Constitution by directing two" Internet Service Providers "to produce . . . electronic mail (`email') of Warshak's from their servers pursuant to warrantless search orders issued under" 18 U.S. Code section 2703(d). He then filed a motion asking the court "to prospectively enjoin the United States from obtaining and enforcing any future 2703(d) orders."

According to the opinion, last year federal agents were investigating "allegations of mail and wire fraud, money laundering, and other federal offenses in connection with the operations of Berkeley Premium Nutraceuticals, Inc. . . . a company owned by Warshak." As part of that investigation, the agents obtained section 2703(d)orders from a federal magistrate; the orders directed two Internet Service Providers (Yahoo! and NuVox Communications) to turn over information about Warshak's emails and email account. The ISP's complied, and turned the information over last year. Warshak was informed of all this on May 31, 2006, after the federal unsealed the orders to the ISP's. This prompted his lawsuit, which had two claims; we will only focus on one, the Fourth Amendment issue, because this is the issue on which he prevailed.

Section 2703(d) lets a court issue an order, like the orders above, that require an ISP to produce emails if officers offer "specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication. . . are relevant and material to an ongoing criminal investigation." According to the opinion, the agents met this requirement, and so obtained the orders seeking Warshak's emails.

Now, as the opinion correctly notes, this "reasonable grounds to believe that the contents" of email "are relevant and material to an ongoing criminal investigation" standard is a lower standard than the probable cause standard included in the Fourth Amendment. The Fourth Amendment states that "no warrants shall issue but upon probable cause", which means the government must show probable cause to believe that a crime has been committed and that evidence of the crime will be found in the place to be searched. While probable cause has not been quantified, it is clear that "reasonable grounds" is a less demanding requirement than "probable cause." And the government conceded that in this case.

This, then, is the issue: The statute lets the government use a sub-Fourth Amendment standard to obtain email. This will be permissible if the Fourth Amendment does not encompass email stored on an ISP; it will not be permissible if the Fourth Amendment does encompass email stored on an ISP.

The Supreme Court held about 150 years ago that we have a Fourth Amendment expectation of privacy in sealed letters and packages sent via snail mail. The Supreme Court held about 30 years ago that we do not have a Fourth Amendment expectation of privacy in the numbers we dial from a telephone, even a telephone in our own home, because we have "voluntarily shared" that information with the phone company; since, according to this logic, we voluntarily shared the information with the phone company, they can give it to the government, without a warrant, if they like. (We will assume here that the Supreme Court was correct when it held that we have no Fourth Amendment expectation of privacy in dialed phone numbers; I do not think the Court was correct, but we will not go into that here.)

Warshak argued that "emails stored on the servers of commercial ISPs" are more analogous to sealed letters sent via snail mail than they are to the phone numbers we dial. This is his theory:

"[I]n the case of email, the subscriber perhaps maintains more control over the email lettter than in any other traditional third party carrier context. . . . [T]he sender or receiver of a closed letter or package actually relinquishes control of the container and cannot immediately repossess the letter or package -- it is in the physical possession of the postal carrier and/or common carrier outside the dominion and control of the sender or recipient. In the email context, the owner of the email can repossess a read-and-then-closed email at any moment, without any notice or permission from the ISP, can retake the email, delete the email from his mailbox, or do what she wants to do with the email. . . ."

Steven Warshak v. United States.

Judge Dlott agreed, at least conditionally: "While the Court is prepared to reconsider its views upon the presentation of further evidence . . . it is not persuaded . . . that an individual surrenders his reasonable expectation of privacy in his personal emails once he allows those emails . . . to be stored on a subscriber account maintained on the server of a commercial ISP." The judge therefore issued a preliminary injunction barring the United States government from using a section 2703(d) order to obtain "the contents of any personal email account maintained by" an ISP "in the name of any resident of the Southern District of Ohio, including but not limited to Steve Warshak."

The injunction is limited to the Southern District of Ohio (which encompasses the southern half of the state, including Columbus, Cincinnati and Dayton) because this is the scope of this federal court's jurisdiction. If, however, Judge Dlott stands by her decision (the Department of Justice will certainly ask her to reconsider), then this opinion would become a firmly-established precedent. (Right now, it is a precedent, but unless and until she rejects a motion to reconsider it at least has the potential to become an altered, or even an erased, precedent.)

If she were to do that, then I am sure the Department of Justice would appeal her decision to the Sixth Circuit Court of Appeals (the federal court of appeals that hears cases from Ohio), because it effectively nullifies the government's ability to use section 2703(d) to obtain emails and email information from ISPs. The even greater concern for the Department of Justice, though, is that this decision will establish the general principle of 2703(d) is unconstitional because it violates the Fourth Amendment. If that principle stands, then the statute will be unenforceable in any state in the United States. The Fourth Amendment, after all, applies everywhere, not just in the Southern District of Ohio.