Emails, Non-resident Aliens and the Electronic Communications Privacy Act

As Wikipedia explains, Congress adopted the Electronic Communications Privacy Act (ECPA) of 1986 to

extend government restrictions on wire taps from telephone calls to include transmissions of electronic data by computer. Specifically, ECPA was an amendment to Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (the Wiretap Statute), which was primarily designed to prevent unauthorized government access to private electronic communications.

And as Wikipedia notes, Title III “was passed in part as a response” to the U.S. Supreme Court’s decisions in Berger v. New York, 388 U.S. 41 (1967) and Katz v. U.S., 389 U.S. 347 (1967), both of which held that the 4^th Amendment’s prohibition on unreasonable searches and seizures applies to the interception of phone calls. In so doing, they overruled the Supreme Court’s 1928 decision in Olmstead v. U.S., 277 U.S. 438 (1928), which had held that intercepting phone conversations was neither a 4^th Amendment “search” or a “seizure.”

Title III implemented the Berger and Katz decisions by specifying the 4^th Amendment-based procedures officers must use to get an authorization to intercept phone calls. You can, if you’re interested, read more about that in the article you can find here. As noted above, ECPA extended the Title III requirements to electronic communications and, as Wikipedia notes, “added new provisions prohibiting access to stored communications”. The provisions governing access to stored communications appeared in part of ECPA that is usually referred to as the Stored Communications Act, which was codified as 18 U.S. Code §§ 2701-27012.

And that brings us to Suzlon Energy, Ltd. v. Microsoft Corp., ___F.3d __, 2011 WL 4537843 (U.S. Court of Appeals for the 9^th Circuit 2011). According to this opinion, Suzlon “demanded that Microsoft produce documents from the Microsoft Hotmail email account of Rajagopalan Sridhar, an Indian citizen imprisoned abroad.” Suzlon Energy, Ltd. v. Microsoft Corp., supra. More precisely, Suzlon

sought emails under 28 U.S. Code § 1782 to use in a civil fraud proceeding pending against Sridhar and others in the Federal Court of Australia (the `Australian Proceedings’). Although Sridhar is a citizen of India and is imprisoned abroad, the relevant emails are stored on a domestic server by a domestic corporation, Microsoft.

Suzlon Energy, Ltd. v. Microsoft Corp., supra. (If you'd like some information on the factual context of this case, you can find it here.)

Section 1782(a) states that the federal

district court of the district in which a person resides or is found may order him to give his testimony or statement or to produce a document or other thing for use in a proceeding in a foreign or international tribunal, including criminal investigations conducted before formal accusation.

The suit was filed in the U.S. District Court for the Western District of Washington, which is a place where the Microsoft Corporation “resides.”

The district court judge “initially granted Suzlon’s petition for production of documents (‘Production Order’)” but changed course after “Microsoft filed objections” to the order granting the petition. Suzlon Energy, Ltd. v. Microsoft Corp., supra. The judge found “Sridhar was entitled to the protection of the Electronic Communications Privacy Act . . . even though he was a foreign citizen.” Suzlon Energy, Ltd. v. Microsoft Corp., supra. Suzlon appealed, which led to the 9^th Circuit Court of Appeals’ issuing the opinion we’re going to examine in this post. Suzlon Energy, Ltd. v. Microsoft Corp., supra.

On appeal, Suzlon argued “that the ECPA applies to foreign citizens such as Sridhar”. Suzlon Energy, Ltd. v. Microsoft Corp., supra. In addressing that issue, the Court of Appeals noted that the “threshold question” was “whether the plain language of the ECPA extends to foreign citizens.” Suzlon Energy, Ltd. v. Microsoft Corp., supra. This panel of 9^th Circuit Court of Appeals judges began its analysis by explaining that the Circuit had, in earlier cases, held that ECPA

limits § 1782 by making it illegal for an entity that provides an electronic communication service to the public to produce the contents of its stored communications. . . . The relevant provision of the ECPA states that `a person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service.’ 18 U.S. Code § 2702(a)(1).

The ECPA defines `electronic communication service’ as `any service which provides to users thereof the ability to send or receive wire or electronic communications.’ 18 U.S. Code § 2510(15). The ECPA defines a `user’ as `any person or entity who -- (A) uses an electronic communication service; and (B) is duly authorized by the provider of such service to engage in such use.’ 18 U.S. Code § 2510(13) (emphasis added).

Suzlon Energy, Ltd. v. Microsoft Corp., supra. The court then noted that the issue to be decided was whether

the protections of the ECPA extend to the contents of communications of foreign citizens. In other words, does the mere fact that Sridhar happens to lack U.S. citizenship mean that Microsoft has to produce his emails under a § 1782 order? The answer depends on the proper interpretation of `any person’ in § 2510(13). To resolve this dispute, the Court turns to the plain text of the statute.

Suzlon Energy, Ltd. v. Microsoft Corp., supra (emphasis in the original).

Since, as noted above, § 2510(13) defines “user” as “any person or entity” who uses an electronic communication service, the 9^th Circuit upheld the district court judge’s “finding that the plain text of the ECPA applies its terms to `any person,’ without qualification. . . . Any person means any person, including foreign citizens.” Suzlon Energy, Ltd. v. Microsoft Corp., supra. It also pointed out that

Congress could have added other requirements, such as U.S. citizenship, if that were the intent behind the ECPA. The fact that Congress did not do so indicates that it did not want to impose any additional limitations.

Suzlon Energy, Ltd. v. Microsoft Corp., supra.

Since “the plain language of the ECPA extends its protections to non-citizens” the Court of Appeals was “therefore obligated to enforce the statute as written”, i.e., to apply it to non-citizens such as Sridhar. Suzlon Energy, Ltd. v. Microsoft Corp., supra. Since the court found that the plain language of ECPA clearly encompassed non-U.S. citizens as well as U.S. citizens, it was not obligated to consider ECPA’s legislative history in order to determine what, if any light, it shed on the issue. Suzlon Energy, Ltd. v. Microsoft Corp., supra. Notwithstanding that, the Court of Appeals decided to “analyze the statute’s history for its instructive value.” Suzlon Energy, Ltd. v. Microsoft Corp., supra.

Suzlon argued that ECPA “was enacted against a background of 4^th Amendment protections”. Suzlon Energy, Ltd. v. Microsoft Corp., supra. Since the Supreme Court has held that the 4^th Amendment does not apply to searches and seizures directed at “property owned by a nonresident alien in a foreign country”, Suzlon was presumably trying to argue that since (i) ECPA was based on/derived from the 4^th Amendment, which does not apply to non-U.S. citizens not in the U.S. (ii) Congress did not intend ECPA to apply to non-U.S. citizens. Suzlon Energy, Ltd. v. Microsoft Corp., supra. Or, as the 9^th Circuit explains, portions of ECPA’s legislative history indicate that Congress’

primary intent in passing the ECPA was to protect the privacy interests of American citizens. Suzlon therefore argues that the intent of the ECPA was to protect only American citizens. But the fact that the ECPA was intended to shore up 4th Amendment rights does not mean that Congress specifically intended to exclude foreign citizens from the scope of the Amendment.

To the contrary, to fully protect American citizens it might be necessary to extend the ECPA to all domestic communications, regardless of who sent them. Further, Suzlon's restrictive reading of the ECPA would put email service providers in an untenable position. By limiting the ECPA only to those people entitled to 4th Amendment protection, as urged by Suzlon, an email service provider would need to assess whether a particular account holder was at all times a U.S. citizen, or later became a citizen, or was a resident alien with some 4th Amendment protection, or if there were other reasons to provide 4th Amendment rights.

This would be a costly, fact-intensive, and difficult determination. But under Microsoft's interpretation of `any person,’ it's clear that the ECPA at least applies whenever the requested documents are stored in the United States. The Court does not address here whether the ECPA applies to documents stored or acts occurring outside of the United States.

Suzlon Energy, Ltd. v. Microsoft Corp., supra (emphasis in the original).

Finally, the 9^th Circuit addressed Suzlon’s remaining argument: “that nowhere in the legislative history or text of the ECPA does Congress address civil litigation, indicating that perhaps Congress intended for the ECPA to only apply to . . . law enforcement.” Suzlon Energy, Ltd. v. Microsoft Corp., supra. The Court of Appeals didn’t buy this argument, either:

This argument ignores Ninth Circuit cases holding exactly the opposite. . . . [E]ven if Congress' most pressing concern was law enforcement agencies issuing subpoenas, that does not mean Congress was not also concerned about civil litigants issuing discovery requests. Declaring an implicit exception to the ECPA for civil litigation would erode the safety of the stored electronic information and trigger Congress' privacy concerns.

Suzlon Energy, Ltd. v. Microsoft Corp., supra.

Since it found that (i) nothing in the legislative history clearly refutes the plain language of the text” and (ii) “the underlying policy implications of the statute are most consistent with the plain text of the ECPA”, the 9^th Circuit held that ECPA “unambiguously applies to foreign citizens.” Suzlon Energy, Ltd. v. Microsoft Corp., supra. It therefore affirmed the district court judge’s decision denying the production of the emails. Suzlon Energy, Ltd. v. Microsoft Corp., supra.