Published at 41 Fed. Comm. L.J. 17 (Nov. 1988) /1/
Copyright © 1988, 1996 by Ruel Hernandez
/1/ This is the World Wide Web HTML version of the original draft version of my article published in the Federal Communications Law Journal which is published by the UCLA School of Law and the Federal Communications Bar Assocation. The published printed version of this article appears in the aforementioned law review journal at 41 Fed. Comm. L.J. 17 (Nov. 1988) with some minor editorial changes. Please refer to the published printed version for citation purposes. This World Wide Web HTML version is electronically published for comparison purposes. An early version of this article was published as Computer Electronic Mail and Privacy, 3 Computer L. & Sec. Rep. 4 (Great Britain) (Nov./Dec. 1987).
Approximately three to four years ago, Congress introduced legislation which sought to provide federal statutory guidelines for the privacy protection of electronic communications, including electronic mail (email), found on commercial computer-based services and on other remote computer systems. This culminated in the Electronic Communications Privacy Act of 1986 (ECPA). Federal law before ECPA did not provide any guidelines for protecting technologically-advanced forms of communications. Case law also did not provide adequate helpful guidance. The peculiarities of computers and computer storage were not addressed by the old wiretap laws. Electronic communications privacy could not stand up against constitutional privacy law as defined by the United States Supreme Court. The then existing law was "hopelessly out of date."/2/ Under the old law, there was no contemplation that computer-based electronic communications would be used to transmit messages across telephone lines to remote computer systems to be stored on disk for later retrieval by an intended recipient. Fortunately, with ECPA, email and other private electronic communications are given federal statutory privacy protection. In particular, ECPA gave both criminal law guidelines and rules for obtaining civil remedies.
The situation that prompts this discussion of ECPA and related areas is the first ever civil lawsuit using ECPA as one basis for its claims. The lawsuit, Thompson v. Predaina, was filed this past March 1988 in federal district court for the Southern District of Indiana, Civil Division./3/ There, Linda Thompson, a third-year law student, filed a pro se complaint against Bob Predaina, the systems operator (sysop) of the Professional's Choice Bulletin Board, a fee-based "hobbyist" electronic bulletin board system, for intruding, without any right or privilege, into her private email. She based her action on three federal theories, including two under ECPA, and a few common law state claims. The Thompson case appears to provide an excellent ECPA "test" case./4/ The situation provides an excellent opportunity to see how ECPA and other related law operate to protect, or not protect, one's privacy in the electronic communications context.
The following will be discussed: (1) the computer communications environment; (2) an initial pre-ECPA criminal situation; (3) the old law before ECPA; (4) a preliminary discussion of ECPA with some emphasis on its criminal procedure aspects; (5) ECPA, plus one other statute, as applied in the civil context to the Thompson situation; and (6) ECPA as applied in the civil context to the corporate situation.
The computer communications environment can be divided into three
parts: (1) commercial systems and networks; (2) "hobbyist" systems and
networks; and (3) corporate systems and networks.
Commercial systems and networks would include the popular consumer
computer online services of CompuServe, GEnie, the Source, BIX, the WELL,
Portal, QuantumLink, AppleLink, and Prodigy. These and other services
electronically provide private email, public discussion conferences, real-
time "chat" facilities, public domain software exchange, and access to news
and various databases. Also included in this catagory are the more
specialized computer databases, such as LEXIS, WestLaw, DIALOG, and Dow
Jones News Retrieval, where some limited private email and private user area
facilities may be provided. Commercial data communications networks, such
as Telenet and Tymnet, would be included in this catagory too. In his
"geodesic network report," Peter W. Huber writes that there are "[h]undreds,
perhaps thousands of [commercial] information service providers ... offering
immediate access to vast amounts of electronically stored information in an
extremely broad range of fields."/5/ He also writes that "[t]he industry
has grown explosively since 1979."/6/
"Hobbyist" systems and networks would include "electronic bulletin
boards" (BBS's) and the various cooperative networks. "Hobbyists" in this
area are generally "recreational" computer users who use computers and modem
communications as a hobby./7/ They are akin to amateur ham radio and
citizen band radio operators. Here, BBS's are typically stand-alone
personal computers provided and maintained by computer hobbyists out of
their own personal resources and their enjoyment. The individuals who
provide the BBS's are specifically known as "sysops" (systems operators).
Access to a BBS may be with or without a charge. Sysops may ask that users
pay a charge in order to pay for the phone line for the BBS. In addition to
providing public domain software and "shareware" exchange, these systems
generally provide free public and private electronic mail exchange to
computer/modem-equipped members of local communities./8/ Some sophisticated
systems, such as the UNIX-like ProLine system/9/ written for Apple II
computers, provide users with personal user directory areas much like the
CompuServe personal file areas where users may keep personal files./10/ The
ECPA Senate Report provides a definition of "electronic bulletin boards":
Corporate systems and networks may include whole private networks,
private-line service between two points with no connection to the public
telephone network, and private branch exchanges handling computer calls
within an organization. They may be privately-owned or leased facilities
dedicated to the exclusive use of a company. "They may range from point-to-
pont telephone lines to nationwide switched voice and data systems....
Stations connected to the network may call one another without using public
toll facilities."/13/ On private networks, Huber writes:
In addition to the three different catagories of commercial,
"hobbyist," and corporate systems and networks, there are "gateways," either
network routing addresses or specific services, that allow the linking up of
the separate "hobbyist" networks and commercial and corporate systems and
networks. In many cases, this computer interconnectivity allows the sending
of mail across "network boundaries."/18/ On commercial systems, they
typically allow a subscriber to cross over from the host to use another
commercial system's database without breaking the login connection to call
the other system directly. "Together, these networks form a
metanetwork (sometimes called Worldnet) that is used daily by many
communities of interest throughout the world."/19/
The pervasive use of computers for information transmission underscores
the need for privacy. However, the complexity of the software, the
networking schemes, and the actual use of computer communications show that
any privacy protection must be both comprehensive and flexible./20/
Law enforcement seeks criminal evidence stored as private email or
other data on a commercial computer service, such as CompuServe, GEnie or
the Source, or on a hobbyist BBS. For example, a computer user calls up a
computer communication system: By using the electronic mail function, he
leaves a private message that can only be read by a particular intended
recipient. The message is to inform the recipient of a conspiracy plan that
would violate a federal or state criminal statute. Law enforcement gets a
tip about the criminal activity and learn that incriminating evidence may be
found on the computer system.
In 1982, such a situation occurred./21/ A Detroit federal grand jury,
investigating a million-dollar cocaine ring, issued a subpoena ordering a
commercial service, the Source, to hand over a private user's data
files./22/ The files were routinely backed up to guard against system
crashes./23/ The grand jury was looking for evidence to show that the
cocaine ring was using the Source as a communications base to send messages
to members of the ring./24/ With such evidence, the grand jury could indict
those suspected of being part of the cocaine ring. The Source refused to
obey the subpoena on the basis of privacy./25/ The prosecution's argument
was that since the files containing messages were duplicated by the service,
any user's expectation of privacy would be extinguished./26/ A court battle
ensued. However, before a ruling could be made, the kingpin of the cocaine
ring entered a surprise preemptive guilty plea to federal drug trafficking
charges and the case against the Source was discontinued./27/
Publicly posted messages and other public material found on an online
system or service may be easily retrieved by law enforcement. For example,
a police officer could easily use a modem-equipped computer to call into a
local BBS or an online service and read publicly posted messages on the BBS
or online service. It is the private material, such as email, which poses
the problem. In the police officer example, the officer may only have a
mere user's account without greater privileges to access certain parts of
the system. More specifically, he cannot access the private email of others
with his mere user's account.
Law enforcement's task is to gather enough evidence to substantiate a
criminal case. Specifically, law enforcement would want the private email,
or other private files, transmitted between suspected criminals on a
particular online system. In opposition, the service provider or sysop of
the computer communications system, in his assumed role as keeper of
transmitted private electronic messages, would not want to turn over the
private data. Needless to say, the user would also not want any privacy
invasion of his private electronic communications. Unfortunately, the pre-
ECPA privacy law would not provide much protection.
Before ECPA, there was no adequate privacy protection for electronic
communications. "Any law enforcement authority can, for example, confiscate
a local BBS and examine all the message traffic," including private email
and other private files./28/
There is little pre-ECPA case law available on computer communications
and Fourth Amendment constitutional problems.
Of the available cases, there are those which primarily dealt with
financial information found in bank and consumer credit database computers.
In U.S. v. Davey, the government had the right to require the production
of relevant information wherever it may be lodged and regardless of the form
in which it is kept and the manner in which it may be retrieved, so long as
it pays the reasonable costs of retrieval./29/ In a California case,
Burrows v. Superior Court, a depositor was found to have a reasonable
expectation that a bank would maintain the confidentiality of both his
papers in check form originating from the depositor and the depositor's bank
statements and records of those checks./30/ However, in U.S. v. Miller,
customer account records on a bank's computer were held to not be private
papers of the bank customer, and, hence, there was no Fourth Amendment
privacy problem when they are subpoenaed directly from the bank./31/
Although these cases have more of a business character in contrast to
personal email found on computer systems such as CompuServe or a hobbyist
BBS, they may hold that there would be very little to legally stop law
enforcement access to a user's private email found on an online system. For
example, although under Burrows a user may have a reasonable belief that
an online system would maintain the confidentiality of his private email
stored on the system, such material may be held to not be the private papers
of the user under Miller./32/ Therefore, there would be no Fourth
Amendment privacy problem. Law enforcement may have the right to require
the material's production wherever it may be held so long as the reasonable
costs of retrieval are paid as required by Davy./33/
Additionally, a prosecutor, as in the Detroit situation, may note how
files are duplicated and backed up on computer systems by the provider or
systems operator. If duplicated, the user may have no reasonable control of
the duplicates. However, the nature of computers always requires the
duplication and backup of any computer data as a safety precaution in case
of power failure or computer magnetic media destruction. All computer users
know of this common practice./34/ Knowing this common practice, a user has
reason to believe that the duplicated data would be stored away and not
given to others to examine. The user's subjective belief would be that his
email is private even if it is duplicated along with other system files for
backup purposes. Such a belief may be seen as objectively reasonable and
therefore may be a constitutionally protected expectation of privacy./35/
In other words, if the user subjectively expects privacy within the email
area of the system, and his expectation when viewed objectively is
reasonable, as may be found with the commonly known practice of data
backups, then the user's privacy expectation may be constitutionally
protected by the Fourth Amendment.
However, despite common practices and his expectations, a user may
still have to protect his electronic mail from any privacy intrusion./36/
The provider or operator of the system has ultimate control over the system.
He has complete access to all areas of the system. He could easily examine
all material on the system. The user could not reasonably protect his
"private" data from provider or operator invasion on a remote system. This
"knot-hole," where an observer can make an observation from a lawful
position, would exclude any reasonable expectation of privacy./37/ If there
is no privacy, there can be no search. If there is no search, there can be
no Fourth Amendment constitutional violation. Law enforcement can retrieve
the material.
The Justice Department noted the ambiguity of this knothole in a
response to Senator Leahy's question whether the pre-ECPA wiretap law was
adequate to cover computer communications. It was "not always clear or
obvious" whether a reasonable expectation of privacy ever existed./38/
Although email appears to come under the old 18 U.S.C. sec. 2510(1)
definition of "wire communication," wire communication was limited to audio
transmissions by wire or cable./39/ The old 18 U.S.C. sec. 2510(4) required
that unlawful interception be of "any wire or oral" communications and, as
such, there must be a human voice in the transmission and therefore be heard
as in normal non-telephonic voice conversations./40/ There would be a
problem as to whether an electronic communication could be intelligently
heard by the human ear. Data transmissions over telephone lines generally
sound like unintelligible noisy static or high pitched tones./41/
Also, there would certainly be no protection after a communication has
completed its transmission and was stored on a computer./42/ The
communication's conversion into stored computer data, thus no longer in
transmission until later retrieved or forwarded as transmission to another
computer system, would clearly take the communication out of the old
statutory protected coverage./43/
"Eighteen years ago ... Congress could not appreciate - or in some
cases even contemplate - [today's] telecommunications and computer
technology...."/44/
Courts could have tried to read computer communications protection into
the old federal wiretap statute or into existing state law. However, they
were reluctant to do so. The courts were "in no hurry to [revise or make
new law in this area] and some judges [were] openly asking Congress for
help.... [F]ederal Appeals Court Judge Richard Posner in Chicago said
Congress needed to revise current law, adding that 'judges are not
authorized to amend statutes even to bring them up-to-date.'"/45/
On October 21, 1986, President Reagan signed the Electronic
Communications Privacy Act of 1986 amending the federal wiretap law. ECPA
created parallel privacy protection against both interception of electronic
communications while in transmission and unauthorized intrusion of
electronic communications stored on a system.
The ECPA provides privacy protection for electronic communications made
by
ECPA also protects the electronic communication when it has been stored
after transmission, such as email left on an electronic computer
communication system for later pickup by its intended recipient. The
legislation makes it federal offenses to break into any electronic system
holding electronic communications or to exceed authorized access, to alter
or obtain stored communications, and to subsequently disclose the contents
of the electronic communications./52/
ECPA would protect electronic computer communication systems from law
enforcement invasion of user email without a court order./53/ Although the
burden of preventing disclosure of the email is placed on the subscriber or
user of the system, the government must give the subscriber or user fourteen
days notice to allow him to file a motion to quash a subpoena or to vacate a
court order seeking disclosure of his computer material./54/ However, the
government may give delayed notice where there are exigent circumstances or
no notice when the exigent circumstances are extreme as listed by the
Act./55/ Recognizing the easy user destruction of computer data, ECPA
allows the government to include in its subpoena or court order the
requirement that the provider or operator retain a backup copy of electronic
communications when there is risk of destruction./56/ In instances where
the material sought is unusually voluminous or burdensome to supply, there
may be reimbursement for any extra effort to obtain it or for any
disruptions in business./57/
ECPA provides that "'electronic communication service' means any
service which provides to users thereof the ability to send or receive wire
or electronic communications."/58/ A "remote computing service" is defined
in the Act as an electronic communications system that provides computer
storage or processing services to the public./59/ With regard to stored
communications, the "remote computing service" definition also sets public
online systems and services apart from wholly private corporate systems.
Again, in the context of corporate online communications systems, ECPA
coverage may be limited to situations involving "cracker" intrusions and
unauthorized employee access. Language in ECPA refers to "the person or
entity providing the wire or electronic communication service."/60/ Such
broad language would indicate the inclusion of individuals and businesses
who provide commercial, "hobbyist," and corporate systems and networks.
ECPA takes note of the different levels of security found on commercial
and "hobbyist" systems, i.e. the difference between system areas configured
to contain private electronic mail and other areas configured to contain
public material./61/ The electronic communications which a user seeks to
keep private, through methods provided by the system, would be protected by
ECPA./62/ In contrast, there would be no liability for access to features
configured by the system to be readily accessible by the general public./63/
An indicia of privacy on the system, such as passwords, prompts asking if a
message is to be kept private, or no warnings that there is no privacy
facilities on the system, may trigger ECPA coverage./64/
There are at least two possible ways to escape ECPA coverage. The
first is to simply not provide any means of privacy, e.g., no private email.
The second is to provide adequate notice that all material on a system are
to be publicly accessible by all users even though methods of providing
privacy appear to remain on the system. The bulletin board system
maintained by DePaul University College of Law in Chicago, Illinois,
provides an example of an electronic notice which is displayed upon user
access:
Do NOT use this system for any communication for which the sender intends
only the sender and the intended recipient or recipients to read./65/
Although not necessarily a way to escape ECPA coverage, one way of
foiling the intent of a government subpoena or court order requirement to
provide duplicate copies of private electronic communications would involve
the use of passworded private email as encrypted by certain services or
systems. Specifically, the private email capabilities of a particular
commercial service or hobbyist BBS may involve user-toggled passwording
which utilizes an encryption technique that no one, not even the provider,
knows how to decipher./68/ Thus, although law enforcement may be able to
get a backup copy of private messages, authorities may not be able to get
pass the encryption scheme to find the evidence sought out.
In her civil complaint against Predaina, Thompson alleges 10 counts and
asks for $112,250 in damages. The general situation is that Thompson was
exchanging private email via an "echo" intermail networked conference, on
the Predaina BBS. After reading her messages, she deleted them. Predaina
allegedly restored the private email and caused the email to become
public./69/ On the particular network the Predaina system is associated
with, the email was also allegedly "echoed" publicly on other BBS's along
the network. In addition to her federal claims, Thompson is also alleging
that Predaina then made remarks which were libelous, concerning her
reputation both in the public eye and with regard to the legal profession,
and which resulted in infliction of emotional distress. Such remarks would
presumedly be read on the Predaina BBS and along the network. In BBS slang,
such conduct would be the most extreme form of "flame" (as in inflaming
one's emotions)./70/
With regard to federal law, Thompson essentially brings three separate
federal claims. Two are under ECPA and a third under the Cable
Communications Policy Act of 1984 which amended the Communications Act of
1934 to include encrypted satelite cable broadcasts./71/
First, under Title I of the ECPA ("Wire and Electronic Communications
Interception and Interception of Oral Communications"), "any person whose
wire, oral, or electronic communications is intercepted, disclosed, or
intentionally used in violation of this chapter may in a civil action
recover from the person or entity which engaged in that violation such
relief as may be appropriate."/72/ Here, for example, a wrongdoer would
intercept a private communications while in transmission and divulge its
contents to someone other than the intended recipient (or his agent)./73/
The civil relief may include:
and
(3) reasonable attorney's fees and litigation costs./74/
or
Next under Title II of the ECPA ("Stored Wire and Electronic
Communications and Transactional Records Access"), "any provider of
electronic communication service, subscriber, or customer aggrieved by any
violation of this chapter in which the conduct constituting the violation is
engaged in with a knowing or intentional state of mind may, in a civil
action, recover from the person or entity which engaged in that violation
such relief as may be appropriate."/76/ Here, a wrongdoer would
intentionally access private communications that is stored, including the
forwarding of email along a network, on a system and/or knowingly divulge
its contents to someone other than the intended recipient and other persons
allowed by the statute./77/
A plaintiff could seek the same types of relief as under Title I of the
ECPA./78/ In addition, a plaintiff can seek any actual damages suffered by
her and any profits made by the wrongdoer as the result of his unlawful
access to the private communications, such as obtaining privileged
information by unlawfully accessing private electronic communication and
using it to gain a financial advantage he would not have gotten otherwise,
provided that damages can be no less than $1000./79/
Thompson's final federal claim is under Title VII of the Cable
Communications Policy Act of 1984 dealing with unauthorized publication or
use of communications. It provides:
The civil remedies allowed under this section are:
or
(3) $250 damages for each violation, but not more than $10,000./83/
However, if it is found that the wrongdoer did not know and had no
reason to know that his actions constituted a violation of section 605, a
judge has the discretion to reduce an award under this section to plaintiff
downward to $100./86/
Could this be a precedent-setting case? Certainly as the first case
under ECPA and also the first BBS case under the Cable Communications Policy
Act. Hypothetically, if the case is never decided, in a similar situation,
and depending on the evidence, a user may win and the sysop may have to pay
some form of remedy to the user. In the situation of stored communications,
as in the Thompson situation, where a user received private email, read it
and deleted it, a sysop may face civil liability under both Title II of the
ECPA and the Cable Communications Policy Act if he should undelete it on the
host system and then cause the message to become public. There may be no
liability under Title I of the ECPA since the private communications was
already received by the intended recipient and was not necessarily
intercepted while in transmission. More facts may be required to draw the
latter conclusion.
Thompson commented on her status as a user of an online service or
system: "Generally sysops are good at policing themselves and their
boards.... The reason for the lawsuit was that there apparently was going
to be no resolution between [Predaina and myself]. I think that if you have
a board that has a facility for private mail, you have a right to expect
that private mail stays private and is not spread all over."/87/
In tackling the question of whether ECPA could be found to apply to
corporate computer communications systems, one may find that the answer may
be both "yes" and "no." In other words, coverage and liability may have to
be limited to certain situations. The question would be who would be liable
under ECPA for snooping around a company's wholly private online system?
Two situations must be looked at. One is the "cracker" situation. The
second is the corporate "big brother" situation.
Examination of Title I of the ECPA provides some clues as to who may be
the wrongdoer in the cracker situation. Private and public systems must
first be contrasted.
The legislative history of ECPA provides evidence of ECPA's
applicability to corporate systems. In the "Purpose" section of the Senate
Report, there is the following paragraph:
Congress went one step further when it amended the definition of "wire
communications" to include "communication affecting interstate or foreign
commerce."/93/ The Senate Report says that this new "language recognizes
that private networks and intra-company communications systems are common
today and brings them within the protection of the statute."/94/ Although
the definition change applied to wire communications, this change along with
the legislative history are more evidence to show the Congress intended ECPA
be applied to both public and private systems.
With specific attention to stored electronic communications, ECPA added
several new sections of law, starting with the new Section 2701, to address
"the growing problem of unauthorized persons deliberately gaining access to,
and sometimes tampering with, electronic or wire communications
that are not intended to be available to the public."/95/ This would
again show how not-ordinarily-public systems, including wholly private
corporate systems, would come within the purvey of ECPA.
Further in the Senate Report, the legislative history then notes the
differences "between offenses committed for purposes of commercial
advantage, malicious destruction or damage, or for private commercial gain
and all other types of violation."/96/ Although "private commercial gain"
may include logging unauthorized time on a pay subscription service with a
stolen password, "commercial advantage ... and other types of violation" may
include a competitor unlawfully accessing a closed, private company computer
to read company intra-company memoranda sent through an in-house company
computer online system./97/
Wholly private corporate systems are statutorily protected by ECPA from
unauthorized intrusions by those not privileged to access and use the
privacy of the system. More specifically, this would be protection against
crackers and unauthorized employees.
If an employee is authorized to use a company's in-house private system
for communications purposes, does he have the same privacy rights against
his employer under ECPA as a user on a hobbyist BBS or consumer commercial
online service has against others? The answer to this question may be found
in Title II of the ECPA.
Section 2701 provides that although it may be illegal to gain access
without authorization or to exceed authorized access to a system (and then
possibly do some damage in addition to examining into private electronic
communication), "the person or entity providing a wire or electronic
communications service" is not liable for any offenses regarding stored
communications (voice mail, email, and other recorded communications)./98/
One may think that corporate entities providing wholly private electronic
communications services would follow good faith standards as discussed with
regard to commercial and hobbyist systems and networks. However, that is
not the case with corporate systems. There is no offense if "the person or
entity providing a wire or electronic communications service" intentionally,
and not for the purpose of system quality control checks, examines
everything on the system./99/ Section 2701(c)(1) would appear to be a
statutory license allowing corporate "big brother" to access and shift
through private email on the company online computer system to check up on
its employees./100/
Section 2702(b)(5) may allow a company to divulge the contents of an
employee's electronic communications on its wholly private system "as may be
necessarily incident to the rendition of the service or to the protection
of the rights or property of the provider or the service...."/101/ An
employer may try to extend "the rights or property of the provider or the
service" to include the private internal business interests of a company
which happens to have a private in-house online system. All of the company
secrets, private corporate communications, and other material within the
company would be corporate property. As such, electronic communications or
other material found on a corporate online system, which system is to be
used for company purposes, may be accessed, examined, and disclosed by the
corporate sysop or owner. Telelaw expert and writer Brock Meeks writes:
Perhaps rightly so, the corporate exception acknowledges an employer's
private property rights in his business and all parts of it. However, to
the say the least, it may not benefit the employee./104/
Generally, in the corporate context, ECPA would only protect from
without, but not from the within. In other words, a corporate online system
may be statutorily protected from outside crackers and unauthorized
employees, but an employee authorized to use an in-house company system for
business purposes may not protected from his employer looking over his
electronic shoulder to shift through any "private" material transmitted or
stored on the system.
Therefore, with regard to the two situations:
First, one may only be liable under ECPA if (a) he is not part of the
company, i.e., he is a "cracker" invading the system from the outside with a
remote modem-equipped computer, or (b) he is an employee, or other person,
who is not authorized, or exceeds his authorization, to use the system.
Second, however, an employer, or one authorized by the company, would
be committing no offense under ECPA if he electronically eavesdrops on email
correspondence found on the system. This would be the corporate "big
brother" exception allowed under ECPA./105/
As we are about to move into the 21st century, we may be seeing more
cases like Thompson. We may also be seeing more "electronic" legislation
like ECPA. For instance, California was in the process of developing an
"information bill of rights" in Assembly Constitutional Amendment No. 36
before it unfortunately "died" in committee./106/ Despite that one setback,
formulation of similar legislation should continue in both the Congress and
the state legislatures so the law can keep a steady pace with the constantly
advancing technology. Fortunately, ECPA set the stage for needed changes in
the law by closing some of gaps and holes in electronic communications
privacy law.
/1/ This is the World Wide Web HTML version of the original draft version of
my article published in the Federal Communications Law Journal which is
published by the UCLA School of Law and the Federal Communications Bar
Assocation. The published printed version of this article appears in the
aforementioned law review journal at 41 Fed. Comm. L.J. 17 (Nov. 1988) with
some minor editorial changes. Please refer to the published printed
version for citation purposes. This World Wide Web HTML version is
electronically published for comparison purposes. An early version of this
article was published as Computer Electronic Mail and Privacy, 3
Computer L. & Sec. Rep. 4 (Great Britain) (Nov./Dec. 1987).
/2/ S. Rep. No. 541, 99th Cong., 2d Sess. 2 reprinted in 1986 U.S. Code Cong.
& Ad. News 3556 (statement of Sen. Leahy).
/3/ Thompson v. Predaina, C.A. No. IP-88 93C.
/4/ It previously appeared that the case would be settled out of court.
Thompson said, "Initially I said to him [Predaina], 'Let's shake hands and
stipulate to dismiss the case,' and he agreed ... but then he got an
attorney, and he asked for a continuance." Meeks, Federal Privacy Suit
Filed Against Bulletin Board Sysop, Microbytes Daily, April 2, 1988
(electronic newspaper).
/5/ P.Huber, The Geodesic Network: 1987 Report on Competition in
the Telephone Industry, U.S. Dept. of Justice, Antitrust Div., 7.1 (1987).
/6/ Id.
/7/ See Steven Dick, Towards A Rational Private Policy For Recreational
Telecomputing (September 1, 1988) (unpublished Michigan State University
Mass Media Ph.D. Program paper).
/8/ In a legal sense, public domain software is computer software that its
author does not claim a copyright on. "Public domain," in the common
computer user jargon, also means a free form of distribution of software
which may or may not have a copyright. A software's copyright owner may
retain a copyright to the software, but he is giving free licenses to
interested users to copy and distribute copies of the software. "Shareware"
is computer software distributed according to a unique marketing concept: a
user may freely download the software from the host BBS computer to his
personal computer, try out the software, and if he likes the software or
continues to use it, he must pay a registration fee to the software author
or publisher.
/9/ UNIX is a sophisticated operating system normally run on computers made
by AT&T, Sun Microsystems, and other computer manufacturers. It is a
popular operating system that has been configured or duplicated for other
computers. UNIX "allows for the most flexible implementation available for
a telecommunications system. The UNIX architecture has proven to be an
excellent environment for networked mail, public conferencing, and private
electronic mail." Morgan Davis, ProLine Information (August 1988)
(electronic documentation). The ProLine system was designed very much with
UNIX in mind.
/10/ A CompuServe user has his own "personal file area" on CompuServe where he
may privately keep his own personal electronic files. See CompuServe
Information Service Users Guide 4-25 - 4-27 (Sept. 1985). This is very
useful for people who travel or who are constantly away from their regular
computer systems. For instance, a reporter, a writer, or a businessman on a
trip can call CompuServe with his laptop computer and upload an electronic
document or file to his personal file area on CompuServe for later retrieval
when he returns home to download the document or file for more permanent
storage on his regular computer system. Likewise, "[e]ach member on a
ProLine system has a directory area in which to store [private] files."
M.Davis, supra.
/11/ S. Rep. No. 541, 99th Cong., 2d Sess. 8-9 reprinted in 1986 U.S. Code
Cong. & Ad. News 3562-3563. Congress may have made a poor choice of words
by broadly describing BBS's as "communications networks." Individual BBS's
may not be affiliated with an outside network system. They may be mere
computers set up to take incoming modem telephone calls from users.
However, Congress may have been trying to indicate that users can "network"
together when calling a single BBS.
/12/ "Echoing" is a process by which message traffic contained in an echo
conference is automatically uploaded to other BBSs linked via an "echo mail"
program. This allows users to call different systems, but yet participate
in the same echo conference. Depending on the toggles or flags set on
particular messages, the echoed messages may be seen publicly along the
network or only by a particular user. This is just one of the many
different message distribution processes available. There are other
processes depending on the network involved. See Quarterman & Hoskins,
Notable Computer Networks, 29 Communications of the ACM 932 (October 1986).
Echo and other networked conferences are different from "local" conferences
where messages remain on the local system or service.
/13/ W. John Blyth & Mary M. Blyth Telecommunications: Concepts,
Development, and Management 89 (1985).
/14/ P.Huber, supra, at 3.45.
/15/ Quarterman & Hoskins, supra, at 933.
/16/ Id.
/17/ Keaveney, Custom-Built Bulletin Boards, Personal Computing, August 1987,
91. "Telephone tag" is a common office place occurrence where a busy person
in one office cannot reach another person in different office by telephone.
The original caller leaves a message asking that the other person to call
him back. When the other person returns the call, he may not be able to
reach the original caller and he too leaves a call-back message. An
electronic mail system can eliminate this round-robin. A voice mail system,
as is being used in some companies, can also eliminate the problem.
See TE&M Special Report Electronic/Voice Mail, Telephone Engineer & Management,
Sept. 1, 1987 (series of articles on voice mail), at 57-81.
/18/ Quarterman & Hoskins, supra, at 941. Each network is bound within
itself. Fortunately, there are ways to interconnect different networks,
i.e., to cross a "network boundary" from one network to another. For
example, in the case of electronic mail, one can send email from from an
ARPA Internet affiliated node to a mailbox on the MCI Mail service and vice
versa using specific address routing instructions. See A.DeSchon and
J.Postel, Mail Forwarding Between MCI-Mail and ARPA-Mail Using Intermail
(October 1985) (electronic documentation). Likewise, a CompuServe user can
send email to and receive email from a MCI Mail user. See CompuServe online
instructions (GO QAMCI) (electronic online instructions). However, some
boundaries may not be crossed. For instance, one will find that although
email may be sent from a CompuServe mailbox to MCI Mail and then on to a
mailbox on an ARPA Internet node, email from an ARPA Internet node cannot be
sent through MCI Mail to CompuServe unless there is special government or
industry clearance.
/19/ Quarterman & Hoskins, supra, at 932 (emphasis in original).
/20/ Privacy protection for computer communications must be comprehensive
enough to cover the different types of computer comunications whether while
in transmission or while stored waiting for retrieval by an intended
recipient. The protection must also be flexible enough to account for the
practical aspects of maintaining and operating a computer communications
system or network. For example, the operator of such a system or a network
must in the course of business come in contact with the private material of
others on the system or network. Such maintenance or course of business
contact should not be seen as a privacy invasion.
/21/ Meeks, Life at 300 Baud: Crime on the BBS Network, Profiles, Aug. 1986,
at 12-13.
/22/ Id. at 12.
/23/ Id. at 13.
/24/ Id. at 12.
/25/ Id.
/26/ Id. at 13. Another prosecution argument, although not reported by Meeks,
would be that the Source could not vicariously assert a user's privacy
rights. Fourth Amendment rights are personal and could only be asserted by
the person whose rights are invaded. Rakas v. Illinois, 439 U.S. 128, 133,
99 S.Ct. 421, 425 (1978) (petitioners lacked standing to object to
prosecution evidence of a rifle and shells seized by police during a search
of an automobile in which petitioners were passengers).
/27/ Id.
/28/ Meeks, Life at 300 Baud: Crime on the BBS Network, at 13.
/29/ U.S. v. Davey, 426 F.2d 842, 844-845 (2d Cir. 1970) (IRS-issued summons
requiring a consumer credit corporation to produce certain credit reports of
named individuals).
/30/ Burrows v. Superior Court, 13 Cal. 3d 238, 243, 529 P.2d 590, 593, 118
Cal. Rptr. 166, 169 (1974) (police detective illegally obtained photostatic
copies of an attorney's bank statements from attorney's bank without the aid
of legal process).
/31/ U.S. v. Miller, 425 U.S. 435, 96 S.Ct. 1619 (1976) (tax evader who
possessed an unregistered liquor still under state whiskey tax laws has no
protectible Fourth Amendment interest in his bank records).
/32/ Burrows, supra; Miller, supra.
/33/ Davy, supra.
/34/ The common refrain among computer users, computer manufacturers, and
software publishers is "backup your data." Otherwise, a user may suffer
an irretrievable loss of information or software. The magnetic media, e.g.,
diskette, hard drive, or ramdisk, may encounter a problem, such as a power
surge, causing the data to be lost.
/35/ Katz v. U.S., 389 U.S. 347, 88 S.Ct. 507 (1967) (police bugged a
telephone booth by placing a sensitive electronic survellience device
outside the booth without any penetration). For there to be a
constitutionally protected expectation of privacy under the Fourth
Amendment, a person's subjective privacy expectation must be seen as
objectively reasonable. For example, a person in a closed telephone booth
may subjectively believe that he has privacy within the booth even if the
booth is a glass enclosure that other people could look into. By closing
the door, others could objectively see that the person is expecting some
privacy. But see infra note 36 and accompanying text.
/36/ California v. Ciraolo, 476 U.S. 207, 106 S.Ct. 1809 (1986) (police
airplane observing illegal marijuana plants in the yard of a home).
/37/ Id., 476 U.S. at 210, 106 S.Ct. at 1811 ("[I]f there is an opening, the
police may look").
/38/ S. Rep. No. 541, 99th Cong., 2d Sess. 4 reprinted in 1986 U.S. Code Cong.
& Ad. News 3558.
/39/ 18 U.S.C.S. sec. 2510(1) (Law. Co-op. 1979).
/40/ 18 U.S.C.S. sec. 2510(4) (Law. Co-op. 1979).
/41/ Modem communications involves a process where the digital signals of a
computer are converted into analog signals which can be transmitted over
telephone lines. Once the signals are received at another computer, the
signals are converted back into digital signals easily understood by the
other computer. This modulation and demodulation process requires the use
of a modem device as the interface between the computer and the telephone
network. While the signals are on the telephone line, they sound like
unintelligible static or high-pitched tones to the human ear. Only a
computer equipped with a modem can understand the signals. See W.Blyth &
M.Blyth Telecommunications: Concepts, Development, and Management 70, 306
(1985).
/42/ 18 U.S.C.S. secs. 2510, 2511 (Law. Co-op. 1979).
/43/ Id.
/44/ 132 Cong. Rec. S7992 (daily ed. June 19, 1986) (statement of Sen. Leahy).
/45/ Cohodas, Congress Races to Stay Ahead of Technology, Congressional
Quarterly Weekly Report, May 31, 1986, (Magazine) 1233.
/46/ 18 U.S.C.S. secs. 2510(12) (Law. Co-op. Supp. May 1988); see also 18
U.S.C.S. sec. 2511 (Law. Co-op. Supp. May 1988).
/47/ 18 U.S.C.S. 2510(12)(B) (Law. Co-op. Supp. May 1988).
/48/ 18 U.S.C.S. sec. 2510(12) (Law. Co-op. Supp. May 1988).
/49/ S. Rep. No. 541, 99th Cong., 2d Sess. 14 reprinted in 1986 U.S. Code
Cong. & Ad. News 3568.
/50/ Id.
/51/ 18 U.S.C.S. sec. 2511(1) (Law. Co-op. Supp. May 1988). ECPA coverage in
the corporate situation may be limited to "cracker" and unauthorized
employee situations as will be discussed later.
/52/ 18 U.S.C.S. secs. 2701(a), 2702(a) (Law. Co-op. Supp. May 1988).
/53/ 18 U.S.C.S. secs. 2516, 2517, 2518, 2703 (Law. Co-op. Supp. May 1988).
/54/ 18 U.S.C.S. sec. 2704(b) (Law. Co-op. Supp. May 1988).
/55/ 18 U.S.C.S. sec. 2705(a)(2) (Law. Co-op. Supp. May 1988) (endangering the
life or physical safety of an individual; flight from prosecution;
destruction or tampering with evidence; intimidation of potential witness;
or otherwise seriously jeopardizing an investigation or unduly delaying a
trial).
/56/ 18 U.S.C.S. sec. 2704(a) (Law. Co-op. Supp. May 1988).
/57/ 18 U.S.C.S. sec. 2706 (Law. Co-op. Supp. May 1988).
/58/ 18 U.S.C.S. secs. 2510(15), 2710(1) (Law. Co-op. Supp. May 1988)
(emphasis added).
/59/ 18 U.S.C.S. sec. 2710(2) (Law. Co-op. Supp. May 1988).
/60/ 18 U.S.C.S. secs. 2701(c)(1), 2702(a)(1) (Law. Co-op. Supp. May 1988).
/61/ 18 U.S.C.S. sec. 2511(2)(g)(i) (Law. Co-op. Supp. May 1988); S. Rep. No.
541, 99th Cong., 2d Sess. 18 reprinted in 1986 U.S. Code Cong. & Ad. News
3572; S. Rep. No. 541, 99th Cong., 2d Sess. 36 reprinted in 1986 U.S. Code
Cong. & Ad. News 3590.
/62/ 18 U.S.C.S. secs. 2511(1), 2701(a), 2702(a) (Law. Co-op. Supp. May 1988).
/63/ 18 U.S.C.S. sec. 2511(2)(g)(i) (Law. Co-op. Supp. May 1988).
/64/ See Wiley & Leibowitz, Electronic Privacy Act is Progress --
But It Still Is Not a Panacea, The National Law Journal, January 12, 1987,
at 20:
/65/ Most modem programs have the ability to "capture," or to record, a user's
call to a BBS or online service for later review or editing. For instance,
a user examining the database on an online service may want to "capture"
important information he is reading on the computer screen. Or he may want
to "capture" received email for permanent storage on his own computer
diskettes. This eliminates the need for notetaking by hand or the use of
printouts to capture the information. The screen "capture" of the DePaul
notice is just one example of this ability. Other computer software, not
necessarily modem programs, provide similar abilities to "capture" screen
information also.
/66/ Print and broadcast journalists have unfortunately confused the terms
"hacker" and "cracker." Hackers are computer users who happen to very good
at computer programming. Like magazine writer "hacks," hackers happen to
very good at writing computer software programs. Crackers, on the other
hand, are individuals who criminally try to "crack" into computer networks
for illegal access. See Steven Levy, Hacker: Heroes of the Computer
Revolution (1984).
/67/ See infra note 64. If there are no privacy toggles, the warning would
certainly be adequate.
/68/ There is a commercial consumer service that finds itself in this
situation. "Not even [their] 'god' number could ever read the [passworded]
mail." Hernandez, Computer Electronic Mail and Privacy, 3 The Computer Law
and Security Report 4, 8 (Great Britain) (Nov./Dec. 1987).
/69/ Some BBS software programs do not completely remove a message from the
system when the user "deletes" or "erases" it. Although the message may no
longer be in a user's queue to read, the message may still be in the message
base until completely purged from the system by the sysop. Until then,
depending on the software, the sysop may be able to "undelete," "unerase" or
"restore" the message for anyone to read. Depending on what toggles the
sysop activates, the restored message may become public or private. Unlike
a mere user who only has a limited number of privileges on the BBS, a sysop
has the greater ability to manipulate his system in almost any way he
chooses. Of course, such manipulation depends on the software that the
sysop is using.
/70/ News of the Thompson case has heightened the liability awareness of
sysops all around the nation. Articles for online electronic publications
have been distributed about the case. Discussions about the case are held
on various commercial and hobbyist online services and systems. A live May
1988 conference was even held at the John Marshall Law School Center for
Information Technology and Privacy Law. Also, shortly after news of the
Thompson case became known, but perhaps more in response to the general
problem situation, a book discussing privacy, copyright, state criminal
laws, and other BBS legal issues was published by two New York attorneys who
also happen to be veteran sysops. See J.Wallace & R.Morrison
SYSLAW: The Sysop's Legal Manual (1988) (published by LLM Press, 150
Broadway, Suite 607, New York, New York 10038).
/71/ Cable Communications Policy Act of 1984 sec. 5(b), 47 U.S.C.S. sec. 605
(Law. Co-op. Supp. May 1988). The original section 605 of the
Communications Act of 1934 was previously replaced with a substitute section
605 under the Omnibus Crime Control and Safe Streets Act of 1968. S. Rep.
No. 1097, 90th Cong., 2d Sess. reprinted in 1968 U.S. Code Cong. & Ad. News
2112, 2196-2197.
/72/ 18 U.S.C.S. sec. 2520(a) (Law. Co-op. Supp. May 1988)
/73/ 18 U.S.C.S. secs. 2520(a), 2511 (Law. Co-op. Supp. May 1988).
/74/ 18 U.S.C.S. sec. 2520(b) (Law. Co-op. Supp. May 1988).
/75/ 18 U.S.C.S. sec. 2520(d) (Law. Co-op. Supp. May 1988).
/76/ 18 U.S.C.S. sec. 2707(a) (Law. Co-op. Supp. May 1988).
/77/ 18 U.S.C.S. secs. 2707(a), 2701(a), 2702(a) (Law. Co-op. Supp. May 1988).
/78/ 18 U.S.C.S. sec. 2707(b) (Law. Co-op. Supp. May 1988).
/79/ 18 U.S.C.S. sec. 2707(c) (Law. Co-op. Supp. May 1988).
/80/ 47 U.S.C.S. sec. 605(a) (Law. Co-op. Supp. May 1988).
/81/ Id.
/82/ S. Rep. No. 1097, 90th Cong., 2d Sess. reprinted in 1968 U.S. Code Cong.
& Ad. News 2112, 2197; 47 U.S.C.S. sec. 605(a) (Law. Co-op. Supp. May
1988).
/83/ 47 U.S.C.S. secs. 605(d)(3)(B), 605(d)(3)(C) (Law. Co-op. Supp. May
1988).
/84/ 47 U.S.C.S. sec. 605(d)(3)(C)(ii) (Law. Co-op. Supp. May 1988).
/85/ Thompson v. Predaina, C.A. No. IP-88 93C.
/86/ 47 U.S.C.S. sec. 605(d)(3)(C)(iii) (Law. Co-op. Supp. May 1988).
/87/ Moran, Federal Privacy Suit Against BBS Operator, Online Today daily
edition, March 26, 1988 (CompuServe electronic magazine).
/88/ 18 U.S.C.S. sec. 2511(2)(g)(i) (Law. Co-op. Supp. May 1988) (emphasis
added).
/89/ 18 U.S.C.S. secs. 2511(1), 2701(a), 2702(a) (Law. Co-op. Supp. May 1988).
/90/ 18 U.S.C.S. sec. 2511(2)(g)(i) (Law. Co-op. Supp. May 1988).
/91/ S. Rep. No. 541, 99th Cong., 2d Sess. 2-3 reprinted in 1986 U.S. Code
Cong. & Ad. News 3556-3557.
/92/ But see infra corporate big brother discussion.
/93/ 18 U.S.C.S. sec 2510(1) (Law. Co-op. Supp. May 1988).
/94/ S. Rep. No. 541, 99th Cong., 2d Sess. 12 reprinted in 1986 U.S. Code
Cong. & Ad. News 3566 (emphasis added).
/95/ S. Rep. No. 541, 99th Cong., 2d Sess. 35 reprinted in 1986 U.S. Code
Cong. & Ad. News 3589 (emphasis added).
/96/ S. Rep. No. 541, 99th Cong., 2d Sess. 36 reprinted in 1986 U.S. Code
Cong. & Ad. News 3590; 18 U.S.C.S. sec. 2701(b)(1) (Law. Co-op. Supp. May
1988).
/97/ Id.
/98/ 18 U.S.C.S. sec. 2701 (Law. Co-op. Supp. May 1988).
....
(c) Exceptions -- Subsection (a) of this section does not apply with
respect to conduct authorized --
/100/ Id.
/101/ 18 U.S.C.S. sec. 2702(b)(5) (Law. Co-op 1979 & Supp. May 1988) (emphasis
added).
/102/ Electronic message from Brock Meeks (March 30, 1988) (discussing "ECPA
and Corporate Systems").
/103/ This legislative intent to exclude corporate monitoring of employees
from ECPA was confirmed by those who followed the drafting of the
legislation. Electronic message from Brock Meeks (March 31, 1988)
(discussing "Re: ECPA Application to Corporate Systems?"). Meeks quoting
Jerry Berman, counsel for the American Civil Liberties Union, a participant
in the drafting of the legislation: "ECPA 'goes right up to the water's
edge [of employee privacy protection] but stops short' and to have included
some employee privacy protection against employers in the corporate context
'would have killed the bill.'" Id. A similar exception may be allowed for
wire communications within a company's private telephone network. See 18
U.S.C.S. sec. 2511(2)(a)(i) (Law. Co-op. Supp. May 1988).
/104/ Although an employer may argue that employee monitoring ensures the
quality of employee work, an employee may argue that such monitoring may
causes employee stress and perhaps even feelings of distrust in the
workplace.
/105/ Needless to say, the same ECPA criminal procedures may apply in the
corporate context as in the commercial and "hobbyist" contexts if law
enforcement seeks to obtain evidence on a corporate system. However, a
corporate entity may have more discretion whether to seek protection from
governmental intrusion under ECPA or to voluntarily turn over the evidence
to law enforcement on a mere request under the corporate "big brother"
exception.
/106/ Information Age Bill of Rights, Calif. Assembly Const. Amend. No. 36,
introduced by Assemblywoman Gwen Moore, March 6, 1987. ACA 36 "died" in the
California Senate Judiciary Committee on June 21, 1988. Electronic message
from Bob Jacobson, Principal Consultant to Assemblywoman Moore (June 21,
1988) (discussing "Info Age Bill of Rights Rides Again! (Part II)").
Although ACA 36 is dead, the result at the state level is an awareness of
the need for new law to keep up with changing technology.
(end)
Privacy and worldwide government surveillance
Thank You ENVIRONMENT
Electronic "bulletin boards" are communications networks created by
computer users for the transfer of information among computers. These
may take the form of proprietary systems or they may be noncommercial
systems operating among computer users who share special interests.
These noncommercial systems may [or may not] involve fees covering
operating costs and may require special "passwords" which restrict
entry to the system. These bulletin boards may be public or semi-
public in nature, depending on the degree of privacy sought by users,
operators or organizers of such systems./11/
Augmenting the single stand-alone BBS's are the various cooperative and
research networks that link network-affiliated BBS's or other online systems
or services. This networking is often conducted with the assistance of
business, government, and university mainframe computers through the use of
sophisticated routing networks. Examples of these networks include ARPA
Internet, UUCP, USENET, BITNET, FIDO, OPUS, and ProLine. These networks use
computer automation and sophisticated message-addressing instructions to
network computers via common carrier telephone lines in order to exchange
private email between users of different systems or to exchange publicly
"posted" messages in national, and often worldwide, conference discussions.
Given the proper address-routing instructions, a user may communicate with
another user on a cross-town BBS or on a BBS in another part of the country.
For instance, in the FIDO and OPUS type networks, messages may be "echoed"
in "echo" conferences along the network./12/ Although there is some delay
as messages are being routed through a network, these networks help to
reduce or eliminate the computer hobbyist's need to make direct toll or long
distance telephone calls to faraway systems or having to pay subscription
fees to use a commercial online communications service.
Private networks are used primarily by business and governmental
customers whose telecommunications expenditures are $10 million or more
annually. A private network consists of transmission facilities, nodal
switches, and other customer premises equipment configured for the
exclusive use of a single, geographically dispersed organization. The
transmission facilities used in the network may, however, be provided
largely or entirely by public (i.e. common) carriers, both local and
interexchange. Many private networks rival public networks in
their geographic scope and in the number of telephones they serve..../14/
Large corporations like AT&T, DEC, IBM, and Xerox have implemented
internal computer communications networks in support of their business
operations./15/
Many of these are just LAN [Local Area Networks] within
particular buildings, although some are international
or even intercontinental in scope. The administration and
funding of such networks usually come from a single
company and their users are mostly employees of that company./16/
On a smaller scale, many businesses have also been turning to the use
of smaller computer BBS-type systems and BBS-type networking for increased
productivity, reduced paperwork, improved client contact and elimination of
"telephone tag."/17/ In various cases, such computer communications systems
may be networked with corporate or cooperative networks.
INITIAL CRIMINAL PROCEDURE CONFLICT
INADEQUACY OF OLD LAW
PRE-ECPA CASE LAW
OLD FEDERAL WIRETAP STATUTES
ECPA -- THE NEW LAW
any transfer of signs, signals, writing, images, sounds,
data or intelligence of any nature transmitted in whole or
in part by a wire, radio, electromagnetic, photoelectronic or
photooptical system that affects interstate or foreign commerce..../46/
Electronic communication was defined in very broad terms of what is
transmitted, excluding wire or oral communications,/47/ and how it is
transmitted so long as the means of transmission affects interstate or
foreign commerce./48/ Generally, that may include all telephonic means that
"cannot fairly be characterized as containing the human voice."/49/ The
Senate Report noted examples of electronic communications to include non-
voice communications such as "electronic mail, digitized transmissions, and
video teleconferences."/50/ Interception and disclosure of the electronic
communications is prohibited./51/
SYSTEMS COVERED
ESCAPING COVERAGE
PURSUANT TO THE ELECTRONIC AND [sic] COMMUNICATIONS PRIVACY ACT OF
1986, 18 USC 2510 et. seq., NOTICE IS HEREBY GIVEN THAT THERE ARE NO
FACILITIES PROVIDED BY THIS SYSTEM FOR SENDING OR RECEIVING PRIVATE OR
CONFIDENTIAL ELECTRONIC COMMUNICATIONS. ALL MESSAGES SHALL BE DEEMED
TO BE READILY ACCESSIBLE TO THE GENERAL PUBLIC.
Although the DePaul notice states otherwise, user-operated message privacy
toggles remained on the board when this disclaimer was first viewed. Before
ECPA, similar disclaimers were used on hobbyist BBS's where sysops warn that
their systems may not be secure against "crackers" and therefore users
should go elsewhere if they wish to have privacy safety./66/ Despite the
privacy toggles, a warning such as on the DePaul system may be found to be
adequate to take the system out of ECPA coverage./67/
ECPA AND THOMPSON v. PREDAINA
FEDERAL CIVIL CLAIMS
(1) equitable or declaratory relief;
Defenses include good faith reliance on any of the following:
(2) punitive damages;
(1) a court warrant or order, a grand jury subpoena, a
legislative authorization, or a statutory authorization
(even it turns out to be invalid);
There is plenty of latitude allowed in these defenses so long as there
is good faith. Of course, a court may have the discretion to decide whether
certain conduct was in good faith.
(2) a request by an investigative or law enforcement officer
in emergency situations such as:
(i) immediate danger of death or serious bodily injury
to any person,
(3) a good faith determination that ECPA allowed the intrusion./75/
(ii) conspiratorial activities threatening the national
security interest, or
(iii) conspiratorial activities characteristic of
organized crime;
no person receiving, assisting in receiving, transmitting, or assisting
in transmitting, any interstate or foreign communication by wire or
radio shall divulge or publish the existence, contents, substance,
purport, effect, or meaning thereof, except through authorized channels
of transmission or reception,
The section here focuses on individuals charged with handling messages, e.g.
email, in the "receiving, assisting in receiving, transmitting, or assisting
in transmitting" of communications./81/ Section 605 "is designed to
regulate the conduct of communications personnel" who may disclose the
contents of communications they are charged or have charged themselves with
handling./82/ A BBS sysop may be found to be included among this group of
individuals.
(1) to any person other than the addressee, his agent or
attorney,
(2) to a person employed or authorized to forward such
communication to its destination,
(3) to proper accounting or distributing officers of the
various communication centers over which the
communication may be passed,
(4) the master of a ship under whom he is serving,
(5) in response to a subpena issued by a court of
competent jurisdiction,
(6) on demand of other lawful authority./80/
(1) an injunction against the wrongdoer to stop what he is doing;
Additionally, if a violation was willfully committed and for direct or
indirect commercial advantage or private financial gain, a court may
increase any award to the plaintiff up to $50,000./84/ Thompson made a
commercial advantage claim in paragraph 22 of her complaint: "Petitioner ...
further alleges that all of the facts alleged of the Respondent were
committed willfully, knowingly, intentionally or recklessly, and/or for the
purpose of direct or indirect commercial advantage of the Respondent."/85/
(2) actual damages suffered by the plaintiff, plus any
profits made by the wrongdoer who would not have made
them if not for the unlawful use of the communications;
THOMPSON AS PRECEDENT?
ECPA AND CORPORATE SYSTEMS
THE CRACKER SITUATION
It shall not be unlawful under this chapter or chapter 121
of this title for any person (i) to intercept or access
an electronic communication made through an electronic
communication system that is configured so that such
electronic communication is readily accessible to the general public./88/
This means there is no legal liability under ECPA for accessing or
intercepting an electronic communication that can be obtained publicly,
e.g., reading a public message in a conference configured to be public on a
BBS. However, when read along with the ECPA prohibition against the illegal
interception, access, and disclosure of transmitted and stored electronic
communications,/89/ it would be unlawful under ECPA for a cracker or an
unauthorized employee to intercept, access, or disclose private electronic
communications transmitted or stored on a wholly configured private online
systems, e.g., corporate online systems, which are not accessible to the
general public./90/
Today we have large-scale electronic mail operations,
computer-to-computer data transmissions, cellular and cordless
telephones, paging devices and video teleconferencing. A phone
call can be carried by wire, by microwave or fiber optics. It
can be transmitted in the form of digitized voice, data or
video. Since the divestiture of AT&T and deregulation, many
different companies, not just common carriers, offer a wide
variety of telephone and other communication services. It does not
make sense that a phone call transmitted via common carrier is
protected by the current [pre-ECPA] federal wiretap statute,
while the same phone call transmitted via a private
telephone network such as those used by many major
U.S. corporations today, would not be covered by the statute./91/
The Congress is saying that both publicly accessible systems and wholly
private corporate systems should be treated the same./92/
THE CORPORATE BIG BROTHER SITUATION
If the "entity" is a corporate sponsored system, then the sysop of
that corporate system could indeed make any private files public
without fear of coming under the jurisdiction of the ECPA.
Because all [those] using the corporate system are
"employees" of the entity, there is no expectation of privacy./102/
Thus, with regard to electronic communications found on a corporate online
system, there can be no reasonable expectation of privacy and no ECPA
protection in the employer-employee situation./103/
CORPORATE PROTECTION
CONCLUSION
ENDNOTES
Restrictions on access to stored communications, however, are not
intended to apply to electronic bulletin boards and similar services
readily available to the general public. One seeking access may imply
authorization where the means of access are widely known and there are
no "warnings, encryptions, password requests, or other indicia of
intended privacy" encountered.
Quoting H.R.Rep. 647, 99th Cong. 2d Sess. (1986) at 62. See also S. Rep.
No. 541, 99th Cong., 2d Sess. 36 reprinted in 1986 U.S. Code Cong. & Ad.
News 3590. However, if a BBS has an indicia of privacy, such as passwords,
segregation of private and public messages, etc., then ECPA may apply. A
user may find it very rare that an online system, whether commercial or
hobbyist, has no password login procedures, no user registration or
validation process, or no private email facilities.
(a) Offense -- Except as provided in subsection (c) of this section
whoever --
/99/ 18 U.S.C.S. sec. 2701(c)(1) (Law. Co-op 1979 & Supp. May 1988).
(1) intentionally accesses without authorization a facility
through which an electronic communication service is provided;
or
and thereby obtains, alters, or prevents authorized access to a wire or
electronic communication while it is in electronic storage shall be
punished as provided in subsection (b) of this section....
(2) intentionally exceeds an authorization to access that
facility;
(1) by the person or entity providing a wire or electronic
communications service;
(2) by a user of that service with respect to a communication of
or intended for that user....
For Visiting
![]()
Ruel.Net