Government Surveillance, Privacy & Data
CDT Urges Court to Uphold Fourth Amendment Protections for Email Content
Recently, CDT joined the Electronic Frontier Foundation, National Association of Criminal Defense Lawyers, and the Brennan Center for Justice in a brief to argue that a user’s Fourth Amendment rights in email content do not expire when an email service provider terminates a user’s account pursuant to its terms of service. The government must still obtain a warrant prior to searching that user’s email account. The case is United States v. Ackerman, in which a district court determined – based on those facts – that a warrant was unnecessary to access email content because termination of the account vitiated the account holder’s reasonable expectation of privacy in his email. The case was appealed and we filed an amicus brief opposing this holding.
Walter Ackerman owned an email account through America Online (AOL). AOL had an automated filter designed to prevent the transmission of child pornography by comparing hashes of files sent through its network to hashes of known child porn. When Ackerman sent one particular email to a third person, the filter identified one of the images attached to the email as pornography. AOL intercepted the email, shut down Ackerman’s account, and forwarded the email to the National Center for Missing and Exploited Children (NCMEC). NCMEC opened the file without a warrant. Ackerman argued that NCMEC was a government agent and as such needed a warrant to search his email and attachment. Writing for a panel of the 10th Circuit, Judge Gorsuch (now Supreme Court Justice Gorsuch) agreed and the case was remanded for a determination of whether or not Ackerman had a reasonable expectation of privacy in his email (United States v. Ackerman, 831 F.3d 1292 (10th Cir. 2016)).
On remand, the district court dismissed Ackerman’s motion to suppress the evidence, finding that he did not have an objectively reasonable expectation of privacy in his email after the account service was terminated. The district court specifically pointed to AOL’s terms of service (TOS) which admonished users not to “participate in, facilitate, or further illegal activities.” They further stated that “[t]o prevent violations and enforce this TOS and remediate any violations, we can take any technical, legal, or other actions that we deem, in our sole discretion, necessary and appropriate without notice to you.” Siding with the government, the lower court held that as a result of this claimed right of access, Ackerman no longer had a reasonable expectation of privacy once his account was terminated.
It is CDT’s view that the district court’s holding undermines widely recognized Fourth Amendment protections for email content. Email and other electronic communications have become so pervasive that many would “consider them to be essential means or necessary instruments for self-expression, even self-identification” (City of Ontario v. Quon, 560 U.S. 746, 760 (2010)). The Fourth Amendment protects the content of email because it “is the technological scion of tangible mail, and it plays an indispensable part in the Information Age” (United States v. Warshak, 631 F.3d 266, 286 (6th Cir. 2010)). Warshak affirmed Fourth Amendment protections for email content holding that a “subscriber enjoys a reasonable expectation of privacy in the content of emails” stored, sent, or received through an internet service provider, and as such the government must have a search warrant before it can compel them to turn over the contents of a subscriber’s emails.
Oddly, the government agreed that Ackerman initially had an expectation of privacy in his email stored by AOL. But the government then argued that this expectation was extinguished when AOL terminated his account for violating AOL’s TOS. The district court agreed, holding that ISPs can unilaterally corrupt individuals’ Fourth Amendment rights merely by terminating a user’s account for a violation of a private contractual term. This holding is illogical: either the defendant had a reasonable expectation of privacy in his email, as the government conceded, or AOL’s TOS prevented him from ever forming an objectively reasonable expectation of privacy. Both cannot be true.
If the district court’s ruling is allowed to stand, email protections would be dealt a huge blow in the 10th Circuit. Under the court’s rationale, a service provider’s unilateral actions could vitiate any email user’s reasonable expectation of privacy in their entire account – likely comprising thousands of emails describing sensitive and intimate details of that user’s life. While in this case the account holder violated the TOS by distributing child pornography, non-criminal and less serious activity can violate a provider’s TOS. For example, for some platforms “intimidation” violates the provider’s TOS. Surely the user’s Fourth Amendment rights against a governmental search should not rest on a private company’s interpretation of a vague TOS, and its decision as to whether to terminate an account to enforce the TOS.
Generally, terms of service governing a consumer’s use of a private email service should not determine the scope of their Fourth Amendment protections in their private email. This isn’t to say that TOS can never inform the scope of rights afforded other online accounts. If you use a service to disseminate information to the public, the TOS for that service will state that your content is publically accessible. By agreeing to those terms you will have a limited expectation of privacy in the information you post publically, or none at all. However, those simply aren’t the facts of this case.
Most consumers want service providers to have some access to their accounts to filter out spam, to ensure strong cybersecurity, and to monitor for illicit content like child pornography. Access to perform these kinds of services, to which consumers routinely agree in TOS, should not destroy their expectation of privacy in their email content. If it did, Fourth Amendment protections for email content will cease to exist because most consumers regard such services as essential to their use of email. Service providers may remove their access to enable customers to claim Fourth Amendment protections, and customers would lose essential services.
For all of these reasons, we urged the 10th Circuit to reverse the district court’s decision, and to rule that termination of an account because of a violation of terms of service does not vitiate a consumer’s reasonable expectation of privacy in private email.