COMPUTER ELECTRONIC MAIL AND PRIVACY                    ====================================                                     by                             Ruel T. Hernandez                             801 Cedarbend Way                       Chula Vista, California 92010                           (619) 421-6517 (voice)                          (CompuServe: 71450,3341)                         (GEnie Mail: R.HERNANDEZ)                              January 11, 1987               Copyright (c) 1986, 1987 by Ruel T. Hernandez     (This is an edited version of a law school seminar paper I wrote atCalifornia Western School of Law.  A another version of the paper, entitled"Electronic Mail - Your Right to Privacy," by Ruel T. Hernandez as told toDan Gookin, was published as the cover story in The Byte Buyer, San Diego'sMicrocomputer Magazine, volume 4, number 24, December 5, 1986.  That versionmay also be found on their BBS at 619/226-3304 or 619/573-0359.  Note,citations to the Electronic Communications Privacy Act of 1986 refer to thefinal version passed by the House of Representatives on October 2, 1986,which was passed by the Senate the day before, as listed in theCongressional Record.)                                INTRODUCTION     Two years ago, legislation was introduced into Congress that sought toprovide federal statutory guidelines for privacy protection of computercommunications, such as electronic mail found on commercial computer systemsand on remote computer systems, commonly known as bulletin board systems(BBS).  Old federal wiretap law only gave protection to normal audiotelephonic communications.  There was no contemplation of computers or theiroperators using telephone lines to communicate.  The old federal wiretap lawregulated police interceptions of communications while they are beingtransmitted on a telephone line.  Before the Electronic CommunicationsPrivacy Act of 1976, the law did not provide guidelines for protecting thetransmitted message once it was stored within a computer system.                                 QUESTIONS     (1) Whether electronic mail and other intended private material storedwithin an electronic computer communication system have Fourth Amendmentprivacy protection?     (2) Should private electronic mail and other such material be accordedthe protection guidelines as with telephone communication and the U.S. Mail?                                  PROBLEM     Law enforcement seeks criminal evidence stored as E-Mail on either alocal, user-supported BBS, or on a commercial computer service, such asCompuServe, GEnie or The Source.  (Note, this situation is equallyapplicable to personal, private data stored on a remote system for laterretrieval, as with CompuServe's online disk storage capabilities.)     For instance, a computer user calls up a computer communication system.Using the electronic mail function, he leaves a private message that canonly be read by an intended recipient.  The message is to inform therecipient of a conspiracy plan to violate a federal or state criminalstatute.  Law enforcement gets a tip about the criminal activity and learnthat incriminating evidence may be found on the computer system.     In 1982, such a situation occurred.  (Meeks, Brock, "Life at 300 Baud:Crime on the BBS Network," Profiles, August, 1986, 12-13.)  A Detroitfederal grand jury, investigating a million-dollar cocaine ring, issued asubpoena ordering a commercial service, The Source, to hand over privatesubscriber data files.  The files were routinely backed up to guard againstsystem crashes.  The grand jury was looking for evidence to show that thecocaine ring was using The Source as communication base to send messages tomembers of the ring.  With such evidence, the grand jury could implicate orindict those suspected to be a part of the cocaine ring.  The Source refusedto obey the subpoena.  The prosecution argued The Source could notvicariously assert a subscriber's privacy rights.  Constitutional rights arepersonal and could only be asserted by the person whose rights are invaded.Additionally, if the files containing messages were duplicated, anyreasonable expectation of privacy by users would be extinguished.  A courtbattle ensued.  However, before a ruling could be made, the kingpin of thecocaine ring entered a surprise guilty plea to federal drug traffickingcharges.  The case against the Source was discontinued.     Publicly posted messages and other public material may be easilyretrieved by law enforcement.  It is the private material, such as E-Mail,that poses the problem.     Law enforcement's task is then to gather enough evidence tosubstantiate a criminal case.  Specifically, they would want the E-Mail, orother private files, transmitted by suspected criminals.  A computercommunications service, as keeper and transmitter of private electronicmessages, would not want to turn over the private data.                           INADEQUACY OF OLD LAW     Brock Meeks of Profiles magazine noted that as of August, 1986, "no ...protection exist[ed] for electronic communications.  Any law enforcementagency can, for example, confiscate a local BBS and examine all the messagetraffic," including and private files and E-Mail.  (Ibid.)     In the next section, case law will be examined and statutory law priorto the Electronic Communications Privacy Act of 1986 (ECPA) will be noted.Seemingly applicable statutes, as they stood, provided no guidelines forprivacy protection of electronic computer communication systems, such asCompuServe, GEnie, and local, user-operated BBSs.CASE LAW     There is little case law available on computer communications andFourth Amendment constitutional problems.  (M.D. Scott, Computer Law, 9-9(1984 & Special Update, August 1, 1984).)  If not for the surprisepreemptive guilty plea, the above described Detroit case may have providedguidance on computer communications and privacy issues.     Of the available cases, Scott noted those that primarily dealt withfinancial information found in bank and consumer credit organizationcomputers.   In U.S. v. Davey, 426 F.2d 842, 845 (2 Cir. 1970), thegovernment had the right to require the production of relevant informationwherever it may be lodged and regardless of the form in which it is kept andthe manner in which it may be retrieved, so long as it pays the reasonablecosts of retrieval.  In a California case, Burrows v. Superior Court, 13Cal. 3d 238, 243, 118 Cal. Rptr. 166, 169 (1974), a depositor was found tohave a reasonable expectation that a bank would maintain the confidentialityof both those papers in check form originating from the depositor and thedepositor's bank statements and records of those same checks.  However, inU.S. v. Miller, 425 U.S. 435, 440 (1976), customer account records on abanks' computer were held to not be private papers of the bank customer,and, hence, there is no Fourth Amendment problem when they are subpoenaeddirectly from the bank.     The computer data and information in these cases have more of abusiness character in contrast to personal E-Mail found on remote computersystems such as CompuServe or a local BBS.  Under the old law, a prosecutor,as in the Detroit case, may try to analogize duplicated and backed up E-Mailto business situations where data on business computer databases are alsobacked up.  Both types of computer data are stored on a system and thenlater retrieved.  The provider of the remote computing service or the sysopwould counterargue that the nature of computers always require theduplication and backup of any computer data, whether the data files are E-Mail or centrally-based financial or credit data.  Duplication does notnecessarily make E-Mail the same as financial or credit data stored inbusiness computers.  Centrally-based business information is more concernedwith the data processing.  That information is generally stored andretrieved by the same operator.  E-Mail is more concerned with personalcommunications between individuals where the sender transmits a privatemessage to be retrieved only by an intended recipient.  The sender and therecipient have subjective expectations of privacy that when viewedobjectively is reasonable.  Therefore, there is a constitutionally protectedexpectation of privacy under Katz v. U.S., 389 U.S. 347, 19 L.Ed. 88 S.Ct.507 (1967).  However, the prosecution would note under California v.Ciraolo, -- U.S. --, 106 S.Ct. 1809 (1984), the users would have to protecttheir electronic mail from any privacy intrusion.  The provider or operatorof the remote system has ultimate control of his system.  He has completeaccess to all areas of the system.  He could easily examine the material.The prosecution would note the user could not reasonably protect his privatedata from provider or operator invasion.  This "knot-hole" would exclude anyidea of privacy.  If there is no privacy, there can be no search andtherefore no Fourth Amendment constitutional violation.  Law enforcement canretrieve the material.FEDERAL WIRETAP STATUTES     The federal wiretap statutes, before the Electronic CommunicationPrivacy Act of 1986, protected oral telephone communications from policeinterceptions.  This protection was made in 1968 in response to electroniceavesdropping by government.  (Cohodas, Nadine, "Congress Races to stayAhead of Technology," Congressional Quarterly Weekly Report, May 31, 1986,1235.)  Although E-Mail appears to come under the statute's definition of"wire communication," under the old law, it was limited to audiotransmissions by wire or cable and does not mention stored computer data.