Jennifer Granick of the Electronic Frontier Foundation provides some legal analysis of recent court decisions involving stored email communications.
Last week, two new district court opinions took opposing views on the question of whether the Fourth Amendment protects stored email. One of the cases easily adopted the prevailing view that the Constitution protects electronic communications, while the other ignored existing U.S. Supreme Court and Ninth Circuit precedent to find consumers have no expectation of privacy in messages stored with third parties. EFF will be watching these developments closely as we continue to press for email privacy rights in the Sixth Circuit Court of Appeals in U.S. v. Warshak and in other matters.
In contrast, the government in the Oregon case, In re: United States, successfully argued that you have no protectable Fourth Amendment rights in your email, at least in part because it is stored with third parties. Agents had applied for a warrant for email under the Stored Communications Act (“SCA”), but did not want to serve post-seizure notice of the return of the warrant on the account holders. After concluding that the SCA only required notice to the ISP, the court then asked whether the Fourth Amendment required notice on the account holder, or whether notice on the ISP was constitutionally adequate. While giving lip service to the idea that email is protected by the Fourth Amendment, the court nevertheless stated that a user has no protected expectation of privacy when she stores her messages with a third party. The court also pointed to email service privacy policies to assert that users are, or should be, aware that their personal information and the contents of their online communications are accessible to the ISP and its employees and thus can be shared with the government “in appropriate circumstances”.
In re: United States is wrongly decided. While supposedly starting from the (correct) assumption that the Fourth Amendment protects email, the court then concludes that one has no expectation of privacy in materials stored with a third party. Email uses a store-and-forward transmission protocol; the messages are always transmitted through third parties. Moreover, almost all consumer email is stored at some point with a third party, whether as long term backup or incident to transmission. Thus, the presumption the court says it adopts is essentially meaningless; only those few corporations and individuals that host their own email would be arguably entitled to any constitutional protection the Oregon court says it assumes applies.