Last week, two new district court opinions took opposing views on the question of whether the Fourth Amendment protects stored email. One of the cases easily adopted the prevailing view that the Constitution protects electronic communications, while the other ignored existing U.S. Supreme Court and Ninth Circuit precedent to find consumers have no expectation of privacy in messages stored with third parties. EFF will be watching these developments closely as we continue to press for email privacy rights in the Sixth Circuit Court of Appeals in U.S. v. Warshak and in other matters.

Email -- like letters, telephone calls or documents you keep in a rented locker -- should be fully protected by the Fourth Amendment. As with letters, calls or rented property, your expectation of privacy against the government does not weaken simply because you entrust the document to a third party for delivery or storage. Law enforcement needs a warrant to intercept your phone calls, even though they travel over wires owned by the phone company, or to search your storage locker or hotel room, even though the property owner has the right to enter in some circumstances. The same protections should and must apply to email. It matters not that a third party transports the messages (mail), that they are capable of interception (phone calls), or that they are kept on a third-party server (rented storage).

The government conceded Fourth Amendment protection in one of last week’s opinions and successfully fought against it in the other. In the New York case, United States v. Cioffi, the government wanted to search the defendant’s personal email account for messages showing that he and a confederate knew that they were misleading customers in a financial fraud scheme. The affidavit in support of the warrant asked for copies of messages related to the fraud offense but the warrant itself [more broadly]purported to give the agents permission to obtain all email
through a certain date. The government conceded that the e-mails were Fourth Amendment protected. The disputed issue was whether the warrant satisfied the constitutional requirement that it describe with particularity the place to be searched and the things to be seized. The court held that the warrant was overbroad because it authorized officers to obtain emails other than those for which there was probable cause, and therefore suppressed even the fraud-related messages that were discovered. This New York district court was right. The contents of electronic communications are protected by the Fourth Amendment, and that protection means law enforcement needs a valid warrant, not an obviously overbroad one, to search or seize the messages.

In contrast, the government in the Oregon case, In re: United States, successfully argued that you have no protectable Fourth Amendment rights in your email, at least in part because it is stored with third parties. Agents had applied for a warrant for email under the Stored Communications Act ("SCA"), but did not want to serve post-seizure notice of the return of the warrant on the account holders. After concluding that the SCA only required notice to the ISP, the court then asked whether the Fourth Amendment required notice on the account holder, or whether notice on the ISP was constitutionally adequate. While giving lip service to the idea that email is protected by the Fourth Amendment, the court nevertheless stated that a user has no protected expectation of privacy when she stores her messages with a third party. The court also pointed to email service privacy policies to assert that users are, or should be, aware that their personal information and the contents of their online communications are accessible to the ISP and its employees and thus can be shared with the government "in appropriate circumstances".

In re: United States is wrongly decided. While supposedly starting from the (correct) assumption that the Fourth Amendment protects email, the court then concludes that one has no expectation of privacy in materials stored with a third party. Email uses a store-and-forward transmission protocol; the messages are always transmitted through third parties. Moreover, almost all consumer email is stored at some point with a third party, whether as long term backup or incident to transmission. Thus, the presumption the court says it adopts is essentially meaningless; only those few corporations and individuals that host their own email would be arguably entitled to any constitutional protection the Oregon court says it assumes applies.

The opinion is also contrary to binding Supreme Court and Ninth Circuit precedent. In the 1967 cases of Berger and Katz, the U.S. Supreme Court held that the Fourth Amendment strongly protects telephone calls even though they travel over wires owned by the telephone company, or can be intercepted with a listening device on the outside of a telephone booth. The Court confirmed protection for the contents of communications in Smith v. Maryland, when it distinguished Katz from its holding allowing warrantless collection of dialed telephone numbers from the phone company, since the contents of communications were still protected. The Ninth Circuit, in which the Oregon court resides, has further confirmed that the Fourth Amendment protects electronic communications as well as phone calls in Quon v. Arch Wireless. In that case, the Department of Justice argued exactly what it argued in In re United States -- that because email and text messages are stored by third parties with the practical ability to read them, senders and recipients have no expectation of privacy in those messages. The appellate court rejected that view, holding that text messages, and presumably emails, are like letters or packages, and are protected even though the shipper could open them.

The Oregon court also got the analysis of the effect of terms of service and acceptable use policies dead wrong. In Quon, the Ninth Circuit followed its prior ruling in United States v. Heckenkamp, which held that a student did not lose his reasonable expectation of privacy in information stored on his computer, despite a university policy that it could access his computer in limited circumstances while connected to the university’s network. Like hotel rooms or storage lockers, a limited right of access on the part of the facility owner does not defeat all expectation of privacy versus the government. Moreover, the Oregon court itself had to admit that users might expect government access – not in all circumstances, but only "in appropriate circumstances", a situation that users can reasonably expect would involve a warrant based on probable cause.

There is other foolishness in the Oregon opinion, including the hyper-technical assertion that when the government copies your email, they have not seized your data because you still have a copy, so the government collection does not “meaningfully interfere” with your "possessory interest".

What’s even more disturbing, the Ninth Circuit may not get an opportunity to correct the Oregon district court. Since In re United States involved an ex parte proceeding, as of yet there is no real party in interest to appeal the court clearly erroneous opinion. Only if someone gets charged with a crime, and if that defendant becomes aware that the evidence the government intends to use was obtained as a result of a seizure that did not comport with the Fourth Amendment, will there be an opportunity for the affected party to ask for appellate review. This is one reason why EFF’s practice serving as amicus to district courts considering the applicability of the Electronic Communications Privacy Act and the Fourth Amendment to cell phone tracking, email seizures and other pre-indictment investigative techniques is so important – we may have only one chance to get it right before the government barges in without proper cause or authorization.

For other legal analysis of U.S. v. Cioffi and In re United States, please read Orin Kerr's post on The Volokh Conspiracy or Venkat Balasubramani's assessment on Eric Goldman's blog.