New technology inevitably throws a wrinkle into the legal industry. The advent of electronic written communication is revolutionizing several areas of the law. The ease of quick and efficient interaction with others that is inherent with electronic mail has caused the amount of potential evidence in legal matters to skyrocket. As a result, access to these potential treasure troves during government investigations has become an important issue. It is common knowledge that the Fourth Amendment provides protection against certain searches and seizures. What protections, however, apply to electronic mail?

 

Since the Electronic Communications Privacy Act (“ECPA”) was enacted in 1986, prosecutors have relied upon it to answer this question. Yet the Sixth Circuit recently issued a decision limiting the government’s power under a narrow but important section of this statute. In Warshak v. United States, 490 F.3d 455 (6th Cir. 2007), the court established that e-mail account holders may possess a reasonable expectation of privacy in the content of their personal e-mail messages.

 

The issue in Warshak implicated Title II of the ECPA, known as the Stored Communications Act (“SCA”). The SCA establishes particular procedures that a governmental entity must follow before it may compel an Internet service provider (“ISP”) to produce the contents of electronic communications that have been “stored.” If electronic communications have been unopened for 180 days or less, then the SCA requires that the governmental entity obtain a search warrant (18 U.S.C. §2703(a)). If electronic communications have been unopened for more than 180 days or have been opened, then a more complex, but less onerous, set of rules apply. In these situations, the government must issue an administrative subpoena, obtain a court order, or request a search warrant by showing probable cause (18 U.S.C. §2703(b)). In contrast, the government needs only to meet a general reasonableness standard to pursue a court order under the SCA (18 U.S.C. §2703(d)).

 

Of great importance is whether the account holders of the e-mail messages to be seized are given notice of the government’s access to these electronic communications. Under the SCA, an ISP is allowed to notify affected customers that it has received a subpoena or court order. The government is normally required to give notice to these customers, although if it proceeds via a court order, it can, under certain circumstances, delay its notice and prohibit the ISP from notifying the affected customers (18 U.S.C. § 2705). Prosecutors have historically used the delayed notice provisions of the SCA to their advantage. (The Electronic Frontier Foundation, an organization responsible for one of two amici curiae briefs filed in Warshak, noted in a statement released after the Sixth Circuit’s decision that “[o]ver the last 20 years, the government has routinely used the [SCA] to secretly obtain stored e-mail from e-mail service providers without a warrant.” See http://www.eff.org/news/archives/2007_06.php#005321.)

 

The delayed notice provision of the SCA and its tension with the protections guaranteed by the Fourth Amendment troubled the Sixth Circuit. In June 2007, the Sixth Circuit issued its landmark decision in Warshak, affirming the entry of a preliminary injunction prohibiting the government from seizing the contents of personal e-mail accounts maintained by ISPs without providing the affected customer prior notice and an opportunity to be heard. The Sixth Circuit held that the government cannot seize the content of e-mail messages maintained by an ISP pursuant to a court order unless it makes a fact-specific showing that the affected customer did not maintain an expectation of privacy with respect to the ISP.

 

In Warshak, the government, while conducting a criminal investigation of Warshak and his company, obtained court orders directing two ISPs to disclose Warshak’s e-mail account information, including contents of e-mail messages. The orders were under seal and prohibited the ISPs from notifying Warshak of the investigation unless authorized by the court. When the government finally disclosed the investigation, Warshak sued and alleged that the compelled disclosure of the content of his e-mail messages without a warrant violated his Fourth Amendment rights and the SCA. When the government refused to provide assurances that it would not seek additional orders, Warshak moved for a preliminary injunction prohibiting future searches. The district court found in favor of Warshak and issued a preliminary injunction. The government appealed this injunction, challenging the district court’s decision on several grounds, including its finding that e-mail users maintained a reasonable expectation of privacy with regard to the content of their e-mail messages.

 

The Sixth Circuit began its analysis by noting that the primary reason that compelled disclosures, such as subpoenas and court orders under the SCA, are subject to the lower standard of reasonableness is because these disclosures can be contested in court prior to compulsion. The court cautioned that the owner of an e-mail account who was the subject of a compelled disclosure would have the right to challenge a compelled disclosure only if he or she held a “legitimate expectation of privacy” with regard to the content of the e-mail messages. As a result, the court explained that it was necessary to determine whether an e-mail account holder possessed an expectation of privacy with respect to the actual entity that was being compelled to produce the content of his or her account. In Warshak, that entity was Warshak’s ISP.

 

The Sixth Circuit found that e-mail account holders generally possess a reasonable expectation of privacy with respect to their ISPs. It noted that a person sending an e-mail message would not have such an expectation as to the recipient of the message because the sender assumes the risk of disclosure by the recipient. With respect to the ISP, however, a person sending an e-mail message usually expects that the ISP will not access the contents of the e-mail message. The court analogized its decision to established forms of communication, reasoning that there was no expectation of privacy when information was disclosed to a recipient of a letter or the person receiving a telephone call, but that there was with regard to employees of the post office or telephone company through which the communication traveled.

 

The court rejected two key arguments advanced by the government regarding privacy in e-mail accounts. It found that general language in ISP user agreements that reserved the right of an ISP to access the content of e-mail messages in limited circumstances did not extinguish a user’s general expectation of privacy. Further, the court reasoned that the practice of scanning e-mail messages for viruses or child pornography did not diminish the expectation of privacy because these were automated processes as opposed to human review of the content of e-mail messages.

 

The Sixth Circuit contrasted Warshak’s situation from prior cases that dealt with electronic documents. It distinguished Guest v. Leis (255 F.3d 325 (6th Cir. 2007)), which held that users of electronic bulletin boards did not have an expectation of privacy in the material posted on the board. It also took notice of the Fourth Circuit decision, United States v. Simons (206 F.3d 392 (4th Cir. 2000)), which held that a reasonable expectation of privacy did not exist for an employee’s computer files if the employer had a policy that explicitly notified the employee of its intention to audit, inspect, and monitor computer files. The Sixth Circuit explained that in the context of e-mail, if an ISP required a user agreement that explicitly provided that e-mail messages would be monitored or audited, and the ISP actually performed these actions, then the account holder may not hold a reasonable expectation of privacy.

 

The court concluded that because an expectation of privacy usually attaches to e-mail messages, notice to account holders that their e-mail messages are being disclosed is essential in protecting their Fourth Amendment rights. To this effect, it issued an injunction prohibiting the seizure of personal e-mail pursuant to a court order issued under the SCA “without either (1) providing the relevant account holder or subscriber prior notice and an opportunity to be heard, or (2) making a fact-specific showing that the account holder maintained no expectation of privacy with respect to the ISP, in which case only the ISP need be provided prior notice and an opportunity to be heard.” (Warshak, 490 F.3d at 482)

 

The Warshak decision appears to be the first to address the issue of whether or not e-mail users hold a constitutional right to privacy in the content of their e-mail messages when a court order is issued to an ISP. Some practitioners have criticized the decision because the Sixth Circuit relied heavily on cases decided under Title I of the ECPA, which deals with communications in transit, as opposed to Title II, which pertains to stored communications. This distinction may not prove to be meaningful because, ultimately, the Sixth Circuit held that the Constitution afforded protection to e-mail account holders in addition to the protections already in the SCA, even if the targeted e-mail messages are older than 180 days. As Warshak is grounded in constitutional requirements, the specifics of statutory interpretation are not likely to change its reception.

 

Warshak’s impact on computer surveillance may be far-reaching, although it remains to be seen how other circuits will react. Decisions from other courts suggest that Warshak has the potential to fit into the framework regarding discovery of electronic documents. For example, the Ninth Circuit recently joined other pioneering courts in establishing the constitutional boundaries of computer surveillance techniques (See United States v. Forrester, 2007 U.S. App. LEXIS 17626 (9th Cir., July 25, 2007)). The Ninth Circuit in Forrester held that “computer surveillance techniques that revealed the to/from address of e-mail messages, the IP addresses of websites visited and the total amount of data transmitted to or from an account” were outside the scope of the Fourth Amendment (Forrester, 2007 U.S. App. LEXIS 17626 at *18). The court analogized seizure of this type of information to those of pen registers or examinations of the outside of sealed envelopes (Id.). The Ninth Circuit made clear that its “holding extend[ed] only to these particular techniques and [did] not imply that more intrusive techniques or techniques that reveal more content information are also constitutionally identical to the use of a pen register.” (Id. at *23 (emphasis added).)

 

Federal courts addressing the privacy interests relevant to electronic mail will continue to flesh out the parameters of the protections afforded to such communications. The chart below illustrates some of the current boundaries, in light of Warshak and Forrester:

 

Reasonable Expectation of Privacy

• Contents of personal e-mail accounts maintained by an ISP so long as there is no fact-specific showing that the account holder held no expectation of privacy with respect to the ISP (Warshak, 490 F.3d at 482).

No Reasonable Expectation of Privacy

• Contents of personal e-mail accounts when a user has waived his or her expectation of privacy with respect to the ISP. An example of this is when the user consents to an agreement that explicitly provides for regular monitoring of e-mail messages and other files and the ISP actually conducts such monitoring (Warshak, 490 F.3d at 475-76).
• “Subscriber information and related records,” where such non-content information can be accessed by employees of the ISP in their normal course of business. This includes a user’s basic identifying information, including “the to/from addresses of e-mail messages, the IP addresses of websites visited, and the total amount of data transmitted to or from an account.” (Forrester, 495 F.3d 1041, 1048-49 (9th Cir. 2007).)
  Note: The Ninth Circuit held that IP addresses are not protected under the Fourth Amendment. It specifically reserved judgment on URLs, which can reveal content.
• E-mail messages disseminated by the recipient after it has reached its destination. The sender assumes the risk of disclosure by the recipient (e.g., by forwarding or by posting on a blog) (Warshak, 490 F.3d at 471-72).
• Electronic bulletin board postings, because the number of recipients is neither limited nor select. (Guest, 255 F.3d 325 (6th Cir. 2007).)
• Electronic files on an employee’s office computer, when employer has policy that provides for blanket monitoring of employee’s computer activity. (Simons, 206 F.3d 392 (4th Cir. 2000).)

The Warshak decision is important in that it may reflect an acceptance of the common usage of e-mail messages as a private form of communication not subject to external eyes. Attorneys and their clients have witnessed this reality as a result of reviews of employees’ electronic communications necessitated by government subpoenas or civil discovery requests. The proliferation and contents of these electronic messages illustrate that people do not expect their e-mail messages to be reviewed by unintended recipients.

 

The Sixth Circuit’s decision underscores for employers the importance of examining their electronic communications policies. Employers should evaluate their policies with an eye towards both providing adequate notice to employees regarding limitations on privacy and actually monitoring electronic mail. These procedures could mitigate against potential privacy lawsuits. Further, companies need to carefully consider subpoenas and other requests for employees’ electronic communications in light of these pitfalls— it should not be assumed that an employer can produce these without informing employees.

 

In contrast, commercial ISPs may want to take advantage of the protections afforded by the Warshak ruling. ISPs could tailor their user agreements to provide the most protection to the privacy expectations of their customers and market this protection.

 

An additional implication is the protection afforded under the attorney-client privilege for e-mail messages sent by attorneys to clients that contain privileged information. With the Warshak ruling, the recognized privacy expectation likely bolsters the protections of the privilege. The flip side of this issue, however, is that attorneys need to be careful that they do not send privileged information through an ISP with policies that serve to extinguish any reasonable expectation of privacy. If the provider is a law firm, then the privilege could reasonably attach to the entire firm. If the provider is a commercial provider, then the attorney should be mindful of the potential destruction of the privilege.

 

Yet, in the rapidly evolving digital age, the Sixth Circuit’s ruling may not stand the test of time. In fact, on October 9, 2007, the Sixth Circuit voted to rehear Warshak en banc; accordingly, the previous decision and judgment were vacated and the mandate stayed, pending appeal. See Warshak v. United States, 2007 U.S. App. LEXIS 23741 at *1-2 (6th Cir., Oct. 9, 2007). As of June 22, 2008, the status of the Warshak rehearing was “submitted awaiting decision.” Despite this uncertainty, several other Circuits have already issued opinions following or citing the Warshak decision, reinforcing its significance in the field of electronic privacy.

 

Other courts may distinguish between electronic mail sent through standard means and electronic mail that is encrypted. Most people who have used the Internet for shopping or financial transactions have been bombarded with warnings that the Internet is not secure. Encryption offers a means to secure electronic communication and send a clear signal that an individual expects privacy. Such a distinction would be significantly narrower than the holding in Warshak.