Does the Constitution Protect the Privacy of E-mails? By Jonathan C. Scott and Kathleen Kilanowski A government investigation of the company responsible for those ubiquitous “Enzyte” commercials and an indictment of individuals operating a lab manufacturing Ecstasy have given two federal appellate courts the opportunity to consider the privacy of e-mail communications. In Warshak v. United States, 2007 WL 1730094 (6th Cir. 2007), the Sixth Circuit indicated that an individual should have a reasonable expectation of privacy with respect to the contents of e-mails. The court, however, also recognized that this privacy expectation could be easily lost. The Ninth Circuit in United States v. Forrester, 2007 WL 1952390 (9th Cir. 2007), has also recently held that the users have no reasonable expectation of privacy in the to/from addresses of e-mails, the IP addresses of the websites they visit, or the size of the e-mails they send or receive. While the decisions themselves deal with the government’s ability to access e-mail information, the implications of the rulings may affect how e-mail is dealt with in both civil and criminal contexts. Steve Warshak runs a company called Berkeley Premium Nutraceuticals which, among other things, sells the herbal product “Enzyte.” Advertised heavily on cable and late-night television featuring a character known as “Smiling Bob,” Enzyte promises “natural male enhancement.” In 2005, the federal government began investigating Warshak and his company. As part of its investigation, the government obtained court orders under the Stored Communications Act, 18 U.S.C. § 2701 et seq. (the “SCA”) to compel two commercial internet service providers (“ISPs”) to disclose material in Warshak’s personal and business e-mail accounts. The Act allows the government to compel disclosure of the contents of e-mails that have been held by ISPs for more than 180 days using less process than a warrant. Though the language is unclear, the Act may also allow the government to obtain “opened” e-mail stored less than 180 days through similar methods. When the e-mails were first obtained, the government did not notify Warshak that it had accessed his e-mails. Warshak was later informed about the disclosure of his e-mails by the ISPs, and he filed a civil suit in federal court seeking declaratory and injunctive relief on the grounds that the compelled disclosure of his e-mails violated the Act and the Fourth Amendment. Warshak also sought a preliminary injunction blocking the government from using the Act to compel disclosure of the contents of e-mail with less process than a warrant in all future cases in the Southern District of Ohio. At issue in Warshak v. United States was 18 U.S.C § 2703, which defines the circumstances under which the government may compel ISPs to disclose user records, subscriber information, and the content of electronic messages. More specifically at issue was whether the government could get access to Warshak’s e-mail content under this provision without giving him prior notice. The Sixth Circuit found that Warshak had a “reasonable expectation of privacy” in the content of his e-mails. In its lengthy opinion, the court compared the contents of e-mails to the contents of written letters, phone conversations, and safety deposit boxes at banks. With each of these items, we have a reasonable expectation that our “intermediary service provider” (such as the US Postal Service, the phone company, and the local bank), does not examine the contents of our conversations, our letters, and our safes merely because they could obtain access if they chose to. The court noted that postal workers, for instance, do not read the contents of our mail in the normal course of business.   As part of its privacy analysis, the court left open the clear possibility that any expectation of privacy could be waived by an e-mail account holder. The Sixth Circuit made a point to examine Warshak’s agreement with his commercial ISP and assess whether this agreement could amount to a waiver of any reasonable expectation of privacy of the e-mail’s contents with respect to the provider. The court recognized that when a user agreement specifically provides that e-mails will be monitored or audited, the user’s knowledge of this fact may well extinguish any reasonable expectation of privacy. In the absence of such statement, the court concluded that “the service provider’s control over the files and ability to access them under certain limited circumstances will not be enough to overcome an expectation of privacy.” Warshak’s agreement with his ISP allowed access only in limited circumstances, “rather than wholesale inspection, auditing, or monitoring of e-mails.” The court further indicated that “for now, the government has made no showing that e-mail content is regularly accessed by ISPs, or that users are aware of such access to content.” The court went on to state that “if the government can show, based on specific facts, that an e-mail account holder has waived his expectation of privacy vis-à-vis the ISP, compelled disclosure of e-mails through notice to the ISP alone would be appropriate.” In United States v. Forrester, the Ninth Circuit reached a similar conclusion with respect to the constitutionality of computer surveillance techniques. The government indicted Forrester and Alba on one count of conspiracy to manufacture Ecstasy. As part of its investigation, the government employed various methods to monitor Alba’s e-mail and internet activity, including installing what the court described as a “pen register analogue” on Alba’s computer. The only data obtained were the to/from addresses of Alba’s e-mail messages, the IP addresses of websites he visited, and the total volume of information sent to or from his computer account. Although decided after Warshak, the Ninth Circuit indicated that it was unaware of any other decisions by federal appellate courts addressing the constitutionality of such surveillance techniques. The court went on to hold that surveillance of e-mail and website addresses was conceptually indistinguishable from government surveillance of physical mail or telephone calls. The Supreme Court has previously held that while the contents of mail and phone calls are protected, the address and telephone number information is not entitled to protection because that information is voluntarily disclosed to third parties. Accordingly, the court held that the government’s monitoring of Alba’s e-mail to/from address information and website addresses was not a search for Fourth Amendment purposes. In the wake of Warshak and Forrester, it appears that a consensus may be developing in the federal courts that some aspects of e-mail and internet communications – to/from address information, website addresses, and the amount of data transferred – do not raise Fourth Amendment or other privacy issues. But the contents of e-mails raise different questions. While the Sixth Circuit recognized that a person does generally have an expectation of privacy with respect to the contents of e-mails, the court’s statement in dicta that such an expectation may be easily waived is troubling. It is doubtful that most users have ever read the agreement they made with their ISPs. As with many software licenses, users often simply click on the “Agree” box and bind themselves to the agreement terms. When language providing for auditing or monitoring is included in agreements, future courts may need to address whether what amounts to an adhesion contract should be construed as an actual waiver of privacy rights.