STEVEN WARSHAK, Plaintiff-Appellee, v. UNITED STATES OF AMERICA, Defendant-Appellant.
No. 06-4092
UNITED STATES COURT OF APPEALS FOR THE SIXTH CIRCUIT
Decided and Filed: June 18, 2007
491 F.3d 315
Before: MARTIN and DAUGHTREY, Circuit Judges; SCHWARZER, District Judge.
RECOMMENDED FOR FULL-TEXT PUBLICATION Pursuant to Sixth Circuit Rule 206 File Name: 07a0225p.06 Argued: April 18, 2007
Appeal from the United States District Court for the Southern District of Ohio at Cincinnati. No. 06-00357—Susan J. Dlott, District Judge.
COUNSEL
OPINION
BOYCE F. MARTIN, JR., Circuit Judge. The government appeals the district court’s entry of a preliminary injunction, prohibiting it from seizing “the contents of any personal e-mail account maintained by an Internet Service Provider in the name of any resident of the Southern District of Ohio without providing the relevant account holder or subscriber prior notice and an opportunity to be heard on any complaint, motion, or other pleading seeking issuance of such an order.” D. Ct. Op. at 19. For the reasons discussed below, we largely affirm the district court’s decision, requiring only that the preliminary injunction be slightly modified on remand.
I.
In March 2005, the United States was engaged in a criminal investigation of Plaintiff Steven Warshak and the company he owned, Berkeley Premium Nutraceuticals, Inc. The investigation pertained to allegations of mail and wire fraud, money laundering, and related federal offenses. On May 6, 2005, the government obtained an order from a United States Magistrate Judge in the Southern District of Ohio directing internet service provider (“ISP”) NuVox Communications to turn over to government agents information pertaining to Warshak’s e-mail account with NuVox. The information to be disclosed included (1) customer account information, such as application information, “account identifiers,” “[b]illing information to include bank account numbers,” contact information, and “[any] other information pertaining to the customer, including set up, synchronization, etc.”; (2) “[t]he contents of wire or electronic communications (not in electronic storage unless greater than 181 days old) that were placed or stored in directories or files owned or controlled” by Warshak; and (3) “[a]ll Log files and backup tapes.” Joint App’x at 49.
The order stated that it was issued under
On May 31, 2006, over a year after obtaining the NuVox order, the United States wrote to Warshak to notify him of
In considering the factors for a preliminary injunction, the district court reasoned that e-mails held by an ISP were roughly analogous to sealed letters, in which the sender maintains an expectation of privacy. This privacy interest requires that law enforcement officials obtain a warrant, based on a showing of probable cause, as a prerequisite to a search of the e-mails. Because it viewed Warshak’s constitutional claim as meritorious, the district court deemed it unnecessary to examine his likelihood of success on the SCA claim. It also found that Warshak would suffer irreparable harm based on any additional constitutional violations, that such harm was imminent in light of the government’s past violations and its refusal to agree not to conduct similar seizures in the future, that Warshak lacked an adequate remedy at law to protect his Fourth Amendment rights, and that the public interest in preventing constitutional violations weighed in favor of the injunction. The district court also made clear that further factual development would be necessary for a final disposition, and that the injunction was tailored to protect Warshak from constitutional violations in the interim.
The district court rejected the full scope of Warshak’s request to enjoin the government from seizing any of his e-mails in the future. It stated that it was not “presently prepared to hold that
The gist of this remedy appears to be that when a hearing is required and the e-mail account holder is given an opportunity in court to resist the disclosure of information, any resulting order is more like a subpoena than a search warrant. Therefore the standard necessary to obtain an
The government appeals from the district court’s ruling.
II.
The SCA, passed by Congress in 1986, is codified at
Subsection (a) requires the use of a warrant to access messages that have been in storage for 180 days or less. Subsection (b) provides that to obtain messages that have been stored for over 180 days, the government generally must either (1) obtain a search warrant, (2) use an administrative subpoena, or (3) obtain a court order. The latter two require prior notice to the subscriber, allowing the subscriber an opportunity for judicial review before the disclosure:
(b) Contents of wire or electronic communications in a remote computing service.
(1) A governmental entity may require a provider of remote computing service to disclose the contents of any wire or electronic communication to which this paragraph is made applicable by paragraph (2) of this subsection--
(A) without required notice to the subscriber or customer, if the governmental entity obtains a warrant issued using the procedures described in the Federal Rules of Criminal Procedure by a court with jurisdiction over the offense under investigation or equivalent State warrant; or
(B) with prior notice from the governmental entity to the subscriber or customer if the governmental entity--
(i) uses an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena; or
(ii) obtains a court order for such disclosure under subsection (d) of this section; except that delayed notice may be given pursuant to section 2705 of this title.
Subsection (d), which is referenced in subsection (b), sets forth the procedure
A court order for disclosure under subsection (b) or (c) may be issued by any court that is a court of competent jurisdiction and shall issue only if the governmental entity offers specific and articulable facts showing that there are reasonable grounds to believe that the contents of a wire or electronic communication, or the records or other information sought, are relevant and material to an ongoing criminal investigation. In the case of a State governmental authority, such a court order shall not issue if prohibited by the law of such State. A court issuing an order pursuant to this section, on a motion made promptly by the service provider, may quash or modify such order, if the information or records requested are unusually voluminous in nature or compliance with such order otherwise would cause an undue burden on such provider.
(a) Delay of notification.
(1) A governmental entity acting under
section 2703(b) of this title may--(A) where a court order is sought, include in the application a request, which the court shall grant, for an order delaying the notification required under
section 2703(b) of this title for a period not to exceed ninety days, if the court determines that there is reason to believe that notification of the existence of the court order may have an adverse result described in paragraph (2) of this subsection; or(B) where an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury subpoena is obtained, delay the notification required under
section 2703(b) of this title for a period not to exceed ninety days upon the execution of a written certification of a supervisory official that there is reason to believe that notification of the existence of the subpoena may have an adverse result described in paragraph (2) of this subsection.(2) An adverse result for the purposes of paragraph (1) of this subsection is--
(A) endangering the life or physical safety of an individual;
(B) flight from prosecution;
(C) destruction of or tampering with evidence;
(D) intimidation of potential witnesses; or
(E) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
* * * * *
(4) Extensions of the delay of notification provided in section 2703 of up to ninety days each may be granted by the court upon application, or by certification by a governmental entity, but only in accordance with subsection (b) of this section.
(5) Upon expiration of the period of delay of notification under paragraph (1) or (4) of this subsection, the governmental entity shall serve upon, or deliver by registered or first-class mail to, the customer or subscriber a copy of the process or request together with notice that--
(A) states with reasonable specificity the nature of the law enforcement inquiry; and (B) informs such customer or subscriber--
(i) that information maintained for such customer or subscriber by the service provider named in such process or request was supplied to or requested by that governmental authority and the date on which the supplying or request took place;
(ii) that notification of such customer or subscriber was delayed;
(iii) what governmental entity or court made the certification or determination pursuant to which that delay was made; and
(iv) which provision of this chapter allowed such delay.
Subsection (b) of
The injunctive relief imposed by the district court has a specific narrow application to portions of the SCA. It would still allow seizures of e-mails pursuant to a warrant or with prior notice to a subscriber. The portions that it enjoins are the exception provided in section 2703(b)(1)(B)(ii), which allows for a court order with delayed notice to the account holder, and the procedures provided in
III.
The government focuses on four issues in challenging the preliminary injunction. First, it argues that Warshak’s claims are not justiciable in the first instance, based on the doctrines of standing and ripeness. Second, it contends that the Fourth Amendment’s probable cause standard is inapplicable in the context of SCA seizures, which it likens to compelled disclosures. This issue primarily covers Warhsak’s likelihood of success on the merits, the first factor in the preliminary injunction analysis. Next, it argues that Warshak’s claims are not the proper subject of a facial challenge to the provisions of the SCA in question. Finally, it challenges
We review a district court’s decision regarding a preliminary injunction for an abuse of discretion. Overstreet v. Lexington-Fayette Urban Cnty. Gov’t, 305 F.3d 566, 573 (6th Cir. 2002). Four factors must be considered and balanced by the district court in making its determination: “(1) whether the plaintiff has established a substantial likelihood or probability of success on the merits; (2) whether there is a threat of irreparable harm to the plaintiff; (3) whether issuance of the injunction would cause substantial harm to others; and (4) whether the public interest would be served by granting injunctive relief.” Nightclubs, Inc. v. City of Paducah, 202 F.3d 884, 888 (6th Cir. 2000) (overruled on other grounds, City of Littleton v. Z. J. Gifts D-4, L.L.C., 541 U.S. 774, 784 (2004)). “‘The district court’s determination will be disturbed only if the district court relied upon clearly erroneous findings of fact, improperly applied the governing law, or used an erroneous legal standard.’” Id. (quoting Connection Distrib. Co. v. Reno, 154 F.3d 281, 288 (6th Cir. 1998)).
We review de novo the legal questions of standing and ripeness. See Prime Media v. City of Brentwood, 485 F.3d 343, 348 (6th Cir. 2007).
A. Standing and Ripeness
1. Standing
The government first asserts that the district court lacked subject matter jurisdiction to entertain Warshak’s claims, both because Warshak lacked standing to challenge future searches under the SCA, and because his claims were not ripe for review. To establish standing, a plaintiff must allege “(1) an injury that is (2) ‘fairly traceable to the defendant’s allegedly unlawful conduct’ and that is (3) ‘likely to be redressed by the requested relief.’” Id. (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). Where a plaintiff seeks injunctive relief, a natural outgrowth of these factors requires a showing of ongoing injury or an imminent threat of future injury. See O’Shea v. Littleton, 414 U.S. 488, 495-96 (1974) (“Past exposure to illegal conduct does not in itself show a present case or controversy regarding injunctive relief . . . if unaccompanied by any continuing, present adverse effects.”); but see Los Angeles v. Lyons, 461 U.S. 95, 102 (1983) (“Past wrongs [are] evidence bearing on ‘whether there is a real and immediate threat of repeated injury.’” (quoting O’Shea, 414 U.S. at 495-96)). Although past harm to a plaintiff seeking injunctive relief can serve as relevant evidence, he must also show a threat that is “sufficiently real and immediate” to establish the “prospect of future injury” as part of the standing requirement. Lyons, 461 U.S. at 102-103 (citing O’Shea, 414 U.S. at 496-97). The district court found that Warshak showed a sufficient threat of imminent harm, in light of the past seizures of his e-mails and the fact that the government “refused to pledge not to obtain or enforce future 2703(d) orders of this kind against other e-mail accounts of Warshak’s.” D. Ct. Op. at 12.
The government relies primarily upon Lyons to support its contention that Warshak’s claims are largely hypothetical, and do not support a showing of imminent harm. In Lyons, the plaintiff sought injunctive relief against the use of chokeholds by Los Angeles police after he had been put in a chokehold himself. 461 U.S. at 105. The Supreme
Warshak’s claims are distinguishable from those in Lyons for several reasons. First, unlike in Lyons, the government clearly has a policy of seizing e-mails — the very practice that Warshak alleges is unconstitutional. There is no dispute about the existence of this policy: not only have Warshak’s e-mails been seized twice pursuant to the policy, and not only has the government refused to abstain from future seizures, but a statute explicitly authorizes the challenged government action. The presence of this policy and its applicability to Warshak are likely sufficient on their own to give Warshak standing to seek equitable relief. See Lyons, 461 U.S. at 105-06 (“In order to establish an actual controversy in this case, Lyons would have had not only to allege that he would have another encounter with the police but also to make the incredible assertion either (1) that all police officers in Los Angeles always choke any citizen with whom they happen to have an encounter, whether for the purpose of arrest, issuing a citation, or for questioning, or (2) that the City ordered or authorized police officers to act in such manner.” (emphasis added)); see also Baur v. Veneman, 352 F.3d 625, 637 (2d Cir. 2003) (citing “alleged risk of harm aris[ing] from an established government policy” as a “critical factor that weigh[s] in favor of concluding that standing exists . . . .”); 31 Foster Children v. Bush, 329 F.3d 1255, 1266 (11th Cir. 2003) (“[F]uture injury that depends on either the random or unauthorized acts of a third party is too speculative to satisfy standing requirements. However, when the threatened acts that will cause injury are authorized or part of a policy, it is significantly more likely that the injury will occur again.”).
Further, although Warshak, like Lyons, finds himself in a confrontation with the government due to allegations of illegal conduct on his part, the nature of the confrontation is very different. Warshak has been subject to a lengthy, ongoing investigation, and even if it is prompted by suspicion of illegal conduct on his part, the ongoing nature of the investigation is clearly distinguishable from the brief encounter at issue in Lyons. Warshak’s fear of the challenged government conduct need not be premised on a showing that he will resist arrest, attempt to escape from police custody, or otherwise engage in a physical confrontation with police, as the Lyons plaintiff would have had to show. Instead, the challenged conduct here involves an investigation during which the government might seek to seize additional e-mails at any time. Although Warshak has now been indicted, and the investigation is at a different and less secretive stage, the government would certainly want to search more of his e-mails if it had reason to believe that they might be incriminating. The brief and somewhat random nature of the confrontation in Lyons distinguishes it from the ongoing, targeted confrontation here. The government points out that there is no way to determine with any degree of certainty that it
In light of the past e-mail seizures, the ongoing nature of the investigation against Warshak, and the government policy of seizing e-mails without a warrant or notice to the account holder, we agree with the district court that Warhsak has shown a sufficiently imminent threat of future injury to meet the injury in fact element of standing under Lyons.
As Warshak has shown an imminent threat of injury, this threat would clearly be redressed by the injunctive relief issued by the district court, because the government would be prohibited from repeating its allegedly unconstitutional conduct in the future. Although the government argues that the redressability requirement has not been met, its argument on this issue is subsumed by the imminent threat of injury inquiry, as it asserts that there is no redressability because there is no threatened future injury. The redressability requirement does not, therefore, present an independent basis for us to find a lack of standing.
2. Ripeness
The government also argues that Warshak’s claims are not ripe, as they are too hypothetical without a pending order directed at his e-mails. The ripeness inquiry focuses on three factors: (1) the “likelihood that the harm alleged by [the] plaintiffs will ever come to pass”; (2) “whether the factual record is sufficiently developed to produce a fair adjudication of the merits of the parties’ respective claims”; and (3) “the hardship to the parties if judicial relief is denied at [this] stage in the proceedings.” Adult Video Ass’n v. United States Dept. of Justice, 71 F.3d 563, 568 (6th Cir. 1995) (internal citations omitted). As this Court has explained, “[t]he ripeness doctrine generally applies in cases . . . in which a party seeks a declaratory judgment based on pre-enforcement review of a statute or regulation . . . .” Kardules v. City of Columbus, 95 F.3d 1335, 1343 (6th Cir. 1996).
The government contends that because Warshak challenges future e-mail seizures that he cannot prove will occur again, his claims are too hypothetical to be ripe. Warshak’s claim is distinguishable from the typical ripeness case, however, because he has suffered past alleged injuries from the exact conduct that he seeks to have enjoined, and because the ongoing nature of the investigation against him raises the likelihood of these harms occurring again. To a large extent, the first ripeness factor — the likelihood that alleged harm will ever come to pass — is quite similar to the standing requirement of an imminent threatened injury. Adult Video Ass’n., 71 F.3d at 567 (“[T]he ripeness doctrine not only depends on the finding of a case and controversy and hence jurisdiction under Article III, but it also requires that the court exercise its discretion to determine if judicial resolution would be desirable under all of the circumstances.”) (quoting Brown v. Ferro Corp., 763 F.2d 798, 801 (6th Cir. 1985)). The past alleged injuries and our finding of a continued threat of injury would suggest that Warshak meets the first ripeness prong.
If the government’s practice was to notify Warshak prior to seeking seizure of his e-mails, the second and third ripeness factors might support a determination that his claims are not ripe. In the context of administrative law, for example, a legal challenge is often unripe before a final agency decision, in part because a better developed legal challenge can be brought
The government’s elusive practices have themselves limited Warshak’s abilities to seek redress for future constitutional violations in any other manner. Further, the past alleged Constitutional violations have demonstrated that the challenged conduct is at least not hypothetical. The government has not identified a single case where either standing or ripeness were found lacking where the plaintiff alleged multiple past constitutional violations, a statute explicitly condoned similar alleged violations in the near future, the threat of such violations continued in light of pending charges against the subject of the violation, and the government insisted on its prerogative to continue the challenged conduct. Nor do we believe that any reading of the precedents of this Court or the Supreme Court can support such a result. For these reasons, we affirm the district court’s determination that Warshak’s claims are justiciable, and proceed to consider them on the merits.
B. Likelihood of Success on the Merits: Probable Cause versus Reasonableness and Fourth Amendment Implications of SCA Orders
1. Probable Cause versus Reasonableness
With respect to the merits of the preliminary injunction, the government argues that court orders issued under section 2703 are not searches but rather compelled disclosures, akin to subpoenas. As a result, according to the government, the more stringent showing of probable cause, a prerequisite to the issuance of a warrant under the Fourth Amendment, is inapplicable, and an order under section 2703 need only be supported by a showing of “reasonable relevance.”
The government is correct that “whereas the Fourth Amendment mandates a showing of probable cause for the issuance of search warrants, subpoenas are analyzed only under the Fourth Amendment’s general reasonableness standard.” Doe v. United States, 253 F.3d 256, 263-64 (6th Cir. 2001). As this Court has explained, “[o]ne primary reason for this distinction is that, unlike ‘the immediacy and intrusiveness of a search and seizure conducted pursuant to a warrant[,]’ the reasonableness of an administrative subpoena’s command can be contested in federal court before being enforced.” Id. at 264 (quoting In Re Subpoena Duces Tecum, 228 F.3d 341, 347-49 (4th Cir. 2000)); see also Donovan v. Lone Steer, 464 U.S. 408, 415 (1984). The government is also correct that this principle extends to subpoenas to third-parties — that is, entities other than the subject of the investigation, like NuVox and Yahoo in this case. See United States v. Phibbs, 999 F.2d 1053, 1077 (6th Cir. 1993).
Phibbs makes explicit, however, a necessary Fourth Amendment caveat to the rule regarding third-party subpoenas: the party challenging the subpoena has “standing to dispute [its] issuance on Fourth Amendment grounds” if he can “demonstrate that he had a legitimate expectation of privacy attaching to the records obtained.” Id.; see also United States v. Miller, 425 U.S. 435, 444 (1976) (“Since no Fourth Amendment interests of the depositor are implicated here, this case is governed by the general rule that the issuance of a subpoena to a third party to obtain the records of that party does not violate the rights of a defendant.” (emphasis added)). This language reflects the rule that where the party challenging the disclosure has voluntarily disclosed his records to a third party, he maintains no expectation of privacy in the disclosure vis-a-vis that individual, and assumes the risk of that person disclosing (or being compelled to disclose) the shared information to the authorities. See, e.g., United States v. Jacobsen, 466 U.S. 109, 117 (1984) (“[W]hen an individual reveals private information to another, he assumes the risk that his confidant will reveal that information to the authorities, and if that occurs the Fourth Amendment does not prohibit governmental use of that information.”).
Combining this disclosure to a third party with the government’s ability to subpoena the third party alleviates any need for the third-party subpoena to meet the probable cause requirement, if the challenger has not maintained an expectation of privacy with respect to the individual being compelled to make the disclosure. For example, in Phibbs, the documents in question were credit card and phone records that were “readily accessible to employees during the normal course of business.” 999 F.2d at 1078. A similar rationale was employed by the Supreme Court in Miller. 425 U.S. at 442 (“The checks are not confidential communications but negotiable instruments to be used in commercial transactions. All of the documents obtained, including financial statements and deposit slips, contain only information voluntarily conveyed to the banks and exposed to their employees in the ordinary course of business.”). See also SEC v. Jerry T. O’Brien, Inc., 467 U.S. 735, 743 (1984) (“When a person communicates information to a third party even on the understanding that the communication is confidential, he cannot object if the third party conveys that information or records thereof to law enforcement authorities.”). The government’s compelled disclosure argument, while relevant, therefore begs the critical question of whether an e-mail user maintains a reasonable expectation of privacy in his e-mails vis-a-vis the party who is subject to compelled disclosure — in this instance, the ISPs. If he does not, as in Phibbs or Miller, then the government must meet only the reasonableness standard applicable to compelled disclosures to obtain the material. If, on the other hand, the e-mail user does maintain a reasonable expectation of privacy in the content of the e-mails with respect to the ISP, then the Fourth Amendment’s probable cause standard controls the e-mail seizure.
2. Reasonable expectation of privacy in e-mail content
Two amici curiae convincingly analogize the privacy interest that e-mail users hold in the content of their e-mails to the privacy interest in the content of telephone
The distinction between Katz and Miller makes clear that the reasonable expectation of privacy inquiry in the context of shared communications must necessarily focus on two narrower questions than the general fact that the communication was shared with another. First, we must specifically identify the party with whom the communication is shared, as well as the parties from whom disclosure is shielded. Clearly, under Katz, the mere fact that a communication is shared with another person does not entirely erode all expectations of privacy, because otherwise eavesdropping would never amount to a search. It is true, however, that by sharing communications with someone else, the speaker or writer assumes the risk that it could be revealed to the government by that person, or obtained through a subpoena directed to that person. See Miller, 425 U.S. at 443 (“[T]he Fourth Amendment does not prohibit the obtaining of information revealed to a third party and conveyed by him to Government authorities.”). The same does not necessarily apply, however, to an intermediary that merely has the ability to access the information sought by the government. Otherwise phone conversations would never be protected, merely because the telephone company can access them; letters would never be protected, by virtue of the Postal Service’s ability to access them; the contents of shared safe deposit boxes or storage lockers would never be protected, by virtue of the bank or storage company’s ability to access them.
The second necessary inquiry pertains to the precise information actually conveyed to the party through whom disclosure is sought or obtained. This distinction provides the obvious crux for the different results in Katz and Smith, because although the conduct of the telephone user in Smith “may have been calculated to keep the contents of his conversation private, his conduct was not and could not have been calculated to preserve the privacy of the number he dialed.” 442 U.S. at 743. Like the depositor in Miller, the caller in Smith “assumed the risk” of the phone company disclosing the records that he conveyed to it. Id. Yet this assumption of the risk is limited to the specific information conveyed to the service provider, which in the telephone context excludes the content of
This focus on the specific information shared with the subject of compelled disclosure applies with equal force in the e-mail context. Compelled disclosure of subscriber information and related records through the ISP might not undermine the e-mail subscriber’s Fourth Amendment interest under Smith, because like the information obtained through the pen register in Smith and like the bank records in Miller, subscriber information and related records are records of the service provider as well, and may likely be accessed by ISP employees in the normal course of their employment. Consequently, the user does not maintain the same expectation of privacy in them vis-a-vis the service provider, and a third party subpoena to the service provider to access information that is shared with it likely creates no Fourth Amendment problems.3 The combined precedents of Katz and Smith, however, recognize a heightened protection for the content of the communications. Like telephone conversations, simply because the phone company or the ISP could access the content of e-mails and phone calls, the privacy expectation in the content of either is not diminished, because there is a societal expectation that the ISP or the phone company will not do so as a matter of course.4
Similarly, under both Miller and Katz, if the government in this case had received the content of Warshak’s e-mails by subpoenaing the person with whom Warshak was e-mailing, a Fourth Amendment challenge brought by Warshak would fail, because he would not have maintained a reasonable expectation of privacy vis-a-vis his e-mailing partners. See Phibbs, 999 F.2d at 1077. But this rationale is inapplicable where the party subpoenaed is not expected to access the content of the documents, much like the phone company in Katz. Thus, as Warshak argues, the government could not get around the privacy interest attached to a private letter by simply subpoenaing the postal service with no showing of probable cause, because unlike in Phibbs, postal workers would not be expected to read the letter in the normal course of business. See Ex Parte Jackson, 96 U.S. 727, 733 (1878) (“No law of
This analysis is consistent with other decisions that have addressed an individual’s expectation of privacy in particular electronic communications. In Guest v. Leis, 255 F.3d 325, 333 (6th Cir. 2001), we concluded that users of electronic bulletin boards lacked an expectation of privacy in material posted on the bulletin board, as such materials were “intended for publication or public posting.” Of course the public disclosure of material to an untold number of readers distinguishes bulletin board postings from e-mails, which typically have a limited, select number of recipients. See also Jackson, 96 U.S. at 733 (“[A] distinction is to be made between different kinds of mail matter, — between what is intended to be kept free from inspection, such as letters, and sealed packages subject to letter postage; and what is open to inspection, such as newspapers, magazines, pamphlets, and other printed matter, purposely left in a condition to be examined.”). Although we stated that an e-mail sender would “lose a legitimate expectation of privacy in an e-mail that had already reached its recipient,” analogizing such an e-mailer to “a letter-writer,” this diminished privacy is only relevant with respect to the recipient, as the sender has assumed the risk of disclosure by or through the recipient. Id. at 333 (citing United States v. King, 55 F.3d 1193, 1196 (6th Cir. 1995)).6 Guest did not hold that the mere use of an intermediary such as an ISP to send and receive e-mails amounted to a waiver of a legitimate expectation of privacy.
Other courts have addressed analogous situations where electronic communications were obtained based on the sender’s use of a computer network. In United States v. Simons, the Fourth Circuit held that a government employee lacked a reasonable expectation of privacy in electronic files on his office computer, in light of the employer’s policy that explicitly notified the employee of its intention to “audit, inspect, and monitor,” his computer files. 206 F.3d 392, 398 (4th Cir. 2000). In light of this explicit policy, the employee’s belief that his files were private was not objectively reasonable. Id. On the other hand, in United States v. Heckenkamp, the Ninth Circuit held that a university student did have a reasonable expectation of privacy in his computer files even though he “attached [his computer] to the university network,” because the “university policies do not eliminate Heckenkamp’s expectation of privacy in his computer.” 482 F.3d 1142, 1146-47 (9th Cir. 2007). Although the university did “establish limited instances in which university administrators may access his computer in order to protect the university’s systems,” this exception fell far short of a blanket monitoring or auditing policy, and the Ninth Circuit deemed it insufficient to waive the user’s expectation of privacy.
Heckenkamp and Simons provide useful bookends for the question before us, regarding when the use of some intermediary provider of computer and e-mail services — be it a commercial ISP, a university, an employer, or another type of entity — amounts to a waiver of the user’s reasonable expectation of privacy in the content of the e-mails with respect to that intermediary. In instances where a user agreement explicitly provides that e-mails and other files will be monitored or audited as in Simons, the user’s knowledge of this fact may well extinguish his reasonable expectation of privacy. Without such a statement, however, the service provider’s control over the files and ability to access them under certain limited circumstances will not be enough to overcome an expectation of privacy, as in Heckenkamp.
Turning to the instant case, we have little difficulty agreeing with the district court that individuals maintain a reasonable expectation of privacy in e-mails that are stored with, or sent or received through, a commercial ISP. The content of e-mail is something that the user “seeks to preserve as private,” and therefore “may be constitutionally protected.” Katz, 389 U.S. at 351. It goes without saying that like the telephone earlier in our history, e-mail is an ever-increasing mode of private communication, and protecting shared communications through this medium is as important to Fourth Amendment principles today as protecting telephone conversations has been in the past. See Katz, 389 U.S. at 352 (“To read the Constitution more narrowly is to ignore the vital role that the public telephone has come to play in private communication.”)
The government asserts that ISPs have the contractual right to access users’ e-mails. The district court’s ruling was based on its willingness to credit Warshak’s contrary factual argument that “employees of commercial ISPs [do not] open and read — [nor do] their subscribers reasonably expect them to open and read — individual subscriber e-mails as a matter of course.” D. Ct. Op. at 10-11. This factual determination tracks the language from Miller and Phibbs that suggests a privacy interest in records held by a third party is only undermined where the documents are accessed by the third party or its employees “in the ordinary course of business.” Miller, 425 U.S. at 442. Moreover, as explained in the Ninth Circuit’s decision in Heckenkamp, mere accessibility is not enough to waive an expectation of privacy. See Heckenkamp, 482 F.3d at 1146 (holding that university policies establishing “limited instances in which university administrators may access [the user’s] computer in order to protect the university’s systems” was insufficient to eliminate an expectation of privacy); see also Katz, 389 U.S. at 351 (“[W]hat [a pay phone user] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.” (emphasis added)). Where a user agreement calls for regular auditing, inspection, or monitoring of e-mails, the expectation may well be different, as the potential for an administrator to read the content of e-mails in the account should be apparent to the user. See Simons, 206 F.3d at 398. Where there is such an arrangement, compelled disclosure by means of an SCA order directed
The government also insists that ISPs regularly screen users’ e-mails for viruses, spam, and child pornography. Even assuming that this is true, however, such a process does not waive an expectation of privacy in the content of e-mails sent through the ISP, for the same reasons that the terms of service are insufficient to waive privacy expectations. The government states that ISPs “are developing technology that will enable them to scan user images” for child pornography and viruses. The government’s statement that this process involves “technology,” rather than manual, human review, suggests that it involves a computer searching for particular terms, types of images, or similar indicia of wrongdoing that would not disclose the content of the e-mail to any person at the ISP or elsewhere, aside from the recipient. But the reasonable expectation of privacy of an e-mail user goes to the content of the e-mail message. The fact that a computer scans millions of e-mails for signs of pornography or a virus does not invade an individual’s content-based privacy interest in the e-mails and has little bearing on his expectation of privacy in the content. In fact, these screening processes are analogous to the post office screening packages for evidence of drugs or explosives, which does not expose the content of written documents enclosed in the packages. The fact that such screening occurs as a general matter does not diminish the well-established reasonable expectation of privacy that users of the mail maintain in the packages they send.
It is also worth noting that other portions of the SCA itself strongly support an e-mail user’s reasonable expectation of privacy in the content of his e-mails.
The government’s compelled disclosure argument is initially on point, but fails to address adequately the caveat relating to a party’s maintenance of a reasonable expectation of privacy in documents in the custody of a third party. A warrant based on probable cause would not have been necessary had the government subpoenaed Warshak or given him prior notice of its intent to seek an SCA order, because the need for this higher showing would be offset by his ability to obtain judicial review before producing any e-mails. See Phibbs, 999 F.2d at 1077 (“The subpoena has to be ‘sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance [would] not be unreasonable.’ If it is a subpoena duces tecum, the government does not have to secure a judicial warrant before service is effectuated. Nonetheless, ‘the subpoenaed party [must be able to] obtain judicial review of the reasonableness of the demand prior to suffering penalties for refusing to comply.’” (citing See v. City of Seattle, 387 U.S. 541, 544 (1967))). The same rationale would apply if the government subpoenaed a third party that had access to the content of the e-mails, and against whom Warshak had no claim of privacy, such as the recipient of one of his e-mails. By the same token, an SCA order that provided notice to the ISP alone, and not to the user, would be appropriate in the limited instances where the user had waived his expectation of privacy with respect to the ISP, such as where the government can show that auditing, monitoring, or inspection are expressly provided for in the terms of service, or where the user has e-mailed content directly to the ISP. Where the third party is not expected to access the e-mails in the normal course of business, however, the party maintains a reasonable expectation of privacy, and subpoenaing the entity with mere custody over the documents is insufficient to trump the Fourth Amendment warrant requirement.
The district court enjoined the United States “from seizing, pursuant to court order under
C. Was Warshak’s claim appropriately upheld as a facial challenge?
The government argues that under United States v. Salerno, Warshak must prove that the challenged portion of the statute can never be constitutionally applied in order for the facial challenge to be upheld. 481 U.S. 739, 745-46 (1987) (“A facial challenge to a legislative Act is, of course, the most difficult challenge to mount successfully, since the challenger must establish that no set of circumstances exists under which the Act would be valid.”). It specifically contends that, assuming some ISP e-mail account holders maintain a reasonable expectation of privacy in the content of their e-mails, there still are likely to be others who do not. Because the statute would be constitutional with respect to these account holders, the government argues that it should not be facially invalidated. It also identifies several hypothetical scenarios in which it contends the account holder’s reasonable expectation of privacy could be maintained.
Warshak and amici initially counter that the statement from Salerno relied upon by the government in fact overstates the requirement for facially enjoining a statute. In a separately written concurrence in a denial of a petition of certiorari, Justice Stevens has pointed out that the “rigid and unwise dictum” from Salerno upon which the government now relies was neither an accurate statement of the law nor, more importantly, an accurate description of the Supreme Court’s practice with respect to
There are a few well-known exceptions to the “no circumstances” test for facial validity. For example, in the First Amendment context, an overbreadth challenge allows a plaintiff to facially challenge a statute that can be constitutionally applied to his own conduct so as to protect the speech of others from any chilling effect the statute might have. See, e.g., Prime Media, 485 F.3d at 348-49. In the abortion context, the “undue burden” test has a similar effect, as an abortion statute can be facially invalid even if, in some instances, its prohibition of certain abortions would be constitutional. See Casey, 505 U.S. at 895. We have noted that “[a]lthough Casey does not expressly purport to overrule Salerno [in the abortion context], in effect it does.” Women’s Medical Professional Corp. v. Voinovich, 130 F.3d 187, 194 (6th Cir. 1997). Although these exceptions pertain to specific subject matters that are not applicable here, they do demonstrate that the “no circumstances” standard is less sacrosanct than the government suggests.
The fact that there are exceptions to Salerno and that members of the Supreme Court have quibbled in the public record about its ongoing validity does not demonstrate its invalidity as a general principle pertaining to facial challenges. A more convincing argument about why Salerno does not apply in the Fourth Amendment context is the Supreme Court’s decision in Berger, a case that is particularly analogous to this one. In Berger, the Court facially invalidated a New York statute that provided for court ordered wiretaps of telephone conversations on a showing of less than probable cause. 388 U.S. at 54. The Court explicitly stated that by allowing such a procedure, the statute violated the Warrant Clause by endorsing searches without a showing of probable cause. “The purpose of the probable-cause requirement of the Fourth Amendment, to keep the state out of constitutionally protected areas until it has reason to believe that a specific crime has been or is being committed, is thereby wholly aborted.” Id. at 59. The Court acknowledged that it had “in the past, under specific conditions and circumstances, sustained the use of eavesdropping devices.” Id. at 63. Under the government’s present Salerno argument, this fact would have precluded facial invalidation of the statute in Berger as well. Yet the prospect of a constitutional application of the statute, either where a court order was supported by probable cause, or where the participants in the conversation lacked a reasonable expectation of privacy, did not prevent facial invalidation in Berger.
Under Berger, facial invalidation is justified where the statute, on its face, endorses procedures to authorize a search that clearly do not comport with the Fourth Amendment. A seizure of e-mails from an ISP, without either a warrant supported by probable cause, notice to the account holder to render the intrusion the functional equivalent of a subpoena, or a showing that the user maintained no expectation of privacy in the e-mail, amounts to exactly this. Therefore the district court’s injunction was appropriate under Berger, regardless of the ongoing validity of the statement from Salerno on which the government relies.
The government also argues that by reserving the right to screen e-mails, the ISPs diminish any expectation of privacy their subscribers might have. Again, it is entirely possible, if not likely, that this process occurs without ever having a human being read the content of subscribers’ e-mails. Where total access is the norm, we hold that the government may show as much and then may compel disclosure through the ISP. Less in-depth screening, however, is insufficient to diminish the privacy interest in an e-mail account.
As another example, the government contends that when an e-mail account is abandoned, as could occur with ISPs that require payment which the user fails to remit, the account holder maintains no reasonable expectation of privacy. The government analogizes this situation to a hotel room, in which the guest has an expectation of privacy, but abandons it when he leaves the room or is evicted by management. See, e.g., United States v. Allen, 106 F.3d 695, 699 (6th Cir. 1997). This analogy lacks any connection to the actual practices of commercial ISPs. When a hotel guest checks out of his room, another person will occupy it, access every part of it in which he might have maintained any privacy interest, put his underwear in the same drawer, and otherwise extinguish any privacy interest to the fullest extent. Dominion and control over the hotel room is entirely surrendered to the hotel management, which in turn passes it on to the next guest who occupies the room. On the other hand, when an e-mail user stops using an e-mail address that is tied to his personal identity, he would certainly not expect that somebody else could come along, sign up for the same account, and not only send e-mails in his name, but read every past e-mail that he had failed to delete from the account or sent to someone else. There is no reason to believe that dominion or control over the contents of the account is yielded to the ISP or another user. This analogy is entirely inapposite.
Finally, the government points to “e-mail accounts that are procured through fraudulent means” as situations where an account holder has no reasonable expectation of privacy. This argument is another red herring, primarily because it cannot account for the majority of commercial e-mail
In light of our minor modification of the district court’s injunction, we hold that narrow, facial invalidation of the statute is justified. See Ayotte v. Planned Parenthood, 546 U.S. 320, 328-329 (2006) (“Generally speaking, when confronting a constitutional flaw in a statute, we try to limit the solution to the problem. We prefer, for example, to enjoin only the unconstitutional applications of a statute while leaving other applications in force, or to sever its problematic portions while leaving the remainder intact.” (citing United States v. Raines, 362 U.S. 17, 20-22 (1960) and United States v. Booker, 543 U.S. 220, 227-229 (2005))).10 The government has not accounted in any way for the privacy of shared communications, which since Katz have been protected from disclosure without either a warrant, the consent of one of the parties to the conversation, or compelled disclosure accompanied by an opportunity for judicial review. Our order sufficiently narrows the facial attack on the statute so that only its unconstitutional applications are enjoined, thereby obviating any problems under Salerno.
D. Balancing of Preliminary Injunction Factors
In addition to its argument pertaining to Warshak’s likelihood of success on the merits, the government contends that other preliminary injunction factors — irreparable harm and balancing of the interests of the public and the parties — do not support the injunction here. The district court determined that Warshak would be irreparably harmed by future intrusions into his private e-mails, and that money damages cannot compensate him for this harm. With regard to the balancing of interests, the district court noted that “it is always in the public interest to prevent violation of a party’s constitutional rights.” D. Ct. Op. at 15 (citing Deja Vu of Nashville, Inc. v. Metro. Gov’t of Nashville & Davidson County, 274 F.3d 377, 400 (6th Cir. 2001)). The district court also stated that its order would not unduly inhibit law enforcement, as the preliminary injunction would still permit e-mail seizures pursuant to a warrant or after the provision of notice to the account holder, and that law enforcement interests cannot trump the Fourth Amendment concerns raised by the government’s conduct. It therefore concluded that “all four factors weigh in favor of granting preliminary injunctive relief to Warshak.” Id. at 15-16. This balancing determination is reviewed for an abuse of discretion, under which this Court “accords great deference to the decision of the district court. The district court’s determination will be disturbed only if the district court relied upon clearly erroneous findings of fact, improperly applied the governing law, or used an erroneous legal standard.” Blue Cross & Blue Shield Mut. v. Blue Cross & Blue Shield Ass’n, 110 F.3d 318, 322 (6th Cir. 1997).
On appeal, the government contends that Warshak will not suffer irreparable harm, relying again on its argument that Warshak cannot show an imminent threat of future seizures, and also contending that he can recover money damages for any future violations of the SCA, that he would receive notice of future seizures of his e-mails now that he has been indicted and there would be no reason to hide the investigation, and that a motion to suppress in his criminal trial represents another adequate remedy for Warshak’s fear of future seizures.
Initially, for similar reasons to our determination that Warshak has standing to bring suit, we conclude that Warshak has shown imminent threat of harm in the form of continued invasions of his Fourth Amendment rights. This determination is based on the past e-mail seizures,11 which violated the SCA itself as well as the Fourth Amendment, the government’s ongoing investigation of Warshak, and the government’s clear policy of seizing e-mails without a warrant or notice to the account holder. Further, the government’s contention that it would have no reason to seek future disclosures without providing notice to Warshak seems at odds with its refusal to give him any assurance that this would be the case. Although it
The government’s remaining arguments regarding alternative remedies would not protect the privacy interest that Warshak is seeking to uphold. His privacy interest in his e-mail conversations goes beyond not wanting to be incriminated by his e-mails, which is the only potential remedy from a suppression motion in his criminal case. Further, although money damages might be available to Warshak for the violations,12 they similarly would not necessarily provide an adequate remedy. Warshak is seeking to protect the privacy of his communications, guaranteed to him by the Fourth Amendment, rather than merely seeking not to be incriminated by the content of his e-mails or to be compensated for the privacy violations he has suffered. We cannot conclude that the district court abused its discretion in finding that irreparable harm to Warshak supported the issuance of the preliminary injunction.
The district court’s decision also appears to be supported by the balancing of the interests of Warshak, the government, and the public. Although the government claims that its investigative abilities will be unduly hampered by the injunction, it still can search e-mails stored with ISPs either through obtaining a warrant, by notifying the account holder, or, in light of our modification to the injunction, by making a fact specific showing that the account holder has waived his expectation of privacy with respect to the ISP. Further, under
For these reasons, we agree with the district court that the other preliminary injunction factors support the injunctive relief it issued. At a minimum, we would be hard-pressed to believe that they show in any way that the district court abused its discretion, particularly in light of the narrowed scope of the preliminary injunction that our added modification has imposed.
IV.
The district court correctly determined that e-mail users maintain a reasonable expectation of privacy in the content of their e-mails, and we agree that the injunctive relief it crafted was largely appropriate, although we find necessary one modification. On remand, the preliminary injunction should be modified to prohibit the United States from seizing the contents of a personal e-mail account maintained by an ISP in the name of any resident of the Southern District of Ohio, pursuant to a court order issued under
BOYCE F. MARTIN, JR.
CIRCUIT JUDGE
Notes
(f) Requirement to preserve evidence.
(1) In general. A provider of wire or electronic communication services or a remote computing service, upon the request of a governmental entity, shall take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process.
(2) Period of retention. Records referred to in paragraph (1) shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the governmental entity.