In a landmark decision issued on June 18, the Sixth Circuit held that e-mail users have a reasonable expectation of privacy in their e-mail communications, and thus, e-mails have the same Fourth Amendment constitutional privacy protections as telephone conversations and sealed "regular" mail. As a result, at least in that Circuit, the government is not entitled to search and seize e-mail communications directly from an Internet Service Provider ("ISP") related to an account holder’s e-mails without obtaining a warrant based on probable cause or providing prior notice to that e-mail account holder. As discussed below, the Court recognized an exception to this ruling that may become important for employers and others to review, which involves an analysis of the right to access an employee’s e-mails.
In Warshak v. United States1, the Court was faced with the review of a federal district court’s entry of a preliminary injunction prohibiting the government from seizing the content of e-mail communications maintained by an ISP without providing prior notice to the relevant e-mail account holder, Mr. Steven Warshak. The case involved actions taken by the United States government during a criminal investigation of Warshak for mail and wire fraud, money laundering, and other related federal offenses. The government obtained orders from a federal magistrate judge directing Warshak’s ISPs, NuVox Communications and Yahoo, to turn over information pertaining to his e-mail accounts, including the contents of his e-mails.
The orders were issued under 18 U.S.C. §2703(d) of the Stored Communications Act (the "SCA")2, which provides that information can be obtained based on a "reasonable grounds" standard that "falls short of probable cause."3 The orders were issued under seal, and they prohibited NuVox and Yahoo from disclosing the orders to Warshak. Over a year after the first order was issued to NuVox, the government finally provided Warshak notice of the orders.
Warshak filed suit seeking declaratory and injunctive relief in the United States District Court for the Southern District of Ohio, alleging that the compelled disclosure of his e-mails without a warrant violated the Fourth Amendment and the SCA. After filing the complaint, Warshak’s counsel sought the government’s assurance that it would not seek additional orders under § 2703(d) directed at Warshak’s e-mail, at least during the pendency of the litigation. The government declined such assurances, and Warshak moved for a temporary restraining order and/or preliminary injunction prohibiting future searches of his e-mails.
In granting the preliminary injunction, the district court not only enjoined the government from moving to seize the contents of Warshak’s personal e-mail account maintained by an ISP, but also enjoined the government from moving to seize the contents of personal e-mail accounts of any resident in the Southern District of Ohio without prior notice to the account holder. The district court reasoned that because the standard for obtaining the § 2703(d) order is lower than the probable cause standard necessary to obtain a search warrant, a warrantless search is only justified in instances where notice and an opportunity to be heard are provided to the account holder.
In affirming the district court’s order, the Sixth Circuit analogized the privacy interest that e-mail users hold in the content of their e-mail to the privacy interest recognized in the content of telephone calls. Specifically, the Court recognized that in the context of telephone calls, the Supreme Court has made it clear that the caller assumes the risk of the phone company disclosing the records that he or she conveyed to it, such as who the caller dialed and other information related to the account, but the assumption of risk excludes the content of the conversation. In other words, the government cannot "bootstrap an intermediary’s limited access to one part of the communication (e.g., the phone number) to allow it access to another part (the content of the conversation)."4
For corporations or organizations that utilize third-party service providers or store e-mails with third parties (e.g., for backup storage purposes), it is important to note that this decision could be applied to provide constitutional protection to those e-mails such that warrantless searches of those third parties would require notice to the e-mail account holder.
For employers, ISPs, or other intermediaries, it is also important to note that the Court carved out a limitation to the broad ruling of the federal district court. The Court noted that if the government can show that the e-mail account holder has waived his or her expectation of privacy with respect to the employer/intermediary, then compelled disclosure of the e-mails through notice to such employer/intermediary alone would be appropriate. The Court stated that an account holder may waive his or her expectation of privacy where the employer/intermediary established and utilized the right to inspect, monitor or audit the content of e-mails revealed to it. Thus, if an employer/intermediary has established e-mail policies or a user agreement explicitly providing that e-mails and other files will be audited, inspected, and monitored, the employee’s knowledge of this fact may extinguish the employee’s reasonable expectation of privacy in the content of his or her e-mail.
In analyzing Warshak’s expectation of privacy with respect to his ISPs, the Court applied Supreme Court precedent and noted that "simply because the phone company or the ISP could access the content of e-mails and phone calls, the privacy expectation in the content of either is not diminished, because there is a societal expectation that the ISP or the phone company will not do so as a matter of course."5 In a somewhat prognostic statement, the Sixth Circuit added, "[i]t goes without saying that like the telephone earlier in our history, e-mail is an ever-increasing mode of private communication, and protecting shared communications through this medium is as important to the Fourth Amendment principles today as protecting telephone conversations has been in the past."6
Under the Court’s framework, whether an account holder or employee has waived his or her expectation of privacy with respect to his or her employer, ISP, or other intermediary is a question that involves an analysis of the applicable email policies or user agreements and an analysis of whether the rights to inspect, monitor, or audit are actually exercised. This decision re-emphasizes how important it is for companies to tune up policies relating to e-mail, records retention, and e-communications.
Footnotes
1 ___ F. 3d. ___, No. 06-4092, 2007 WL 1730094 (6th Cir. June 18, 2007).
2 The Stored Communications Act ("SCA"), codified at 18 U.S.C. §§2701 to 2712, was passed by Congress in 1986. The SCA contains a number of provisions pertaining to the accessibility of "stored wire and electronic communications and transactional records." At issue in Warshak v. United States is §2703 of the SCA, which provides procedures through which a governmental entity can access user records, other subscriber information, and the content of electronic messages. Id. at *3.
3 Warshak, at *4.
4 Id. at *11.
5 Id. (emphasis in original).
6 Id. at *12-13.