The Fourth Amendment, the Constitution’s primary guarantor of individual privacy against Government intrusion, embodies and codifies deeply held American values. On the other hand, now more than ever we must look to the Government to protect us against a wide range of criminal activity that threatens our safety, our economic well being and our system of government; to provide that protection the Government must have reasonable means to obtain information that is useful in a criminal investigation or prosecution. Reconciling those often conflicting values and interests presents particularly troubling questions in the context of electronic communications such as e-mail and other uses of the Internet. People are making increasing use of the Internet to store personal information; criminals are making increasing use of the Internet to commit or facilitate their crimes.

1. General Fourth Amendment principles

The Fourth Amendment directs that, certain exceptions aside, the police may not enter someone’s home or office to search for and seize evidence unless they first go to a judge, spell out probable cause, and obtain a warrant authorizing the search and seizure.

But the Supreme Court has held in a variety of contexts that if a person knowingly reveals information to a second party, he has no constitutional protection if that second party voluntarily turns that information over to the Government.

Thus, in Smith v. Maryland, the Supreme Court held that a telephone company customer has no constitutional basis to complain if the phone company, in response to a police request, places a pen register on his phone, enabling the police to make a record of all the phone numbers (local as well as long distance) he dials from his phone. By "knowingly exposing numerical information to the phone company," the Supreme Court held, anyone who makes a phone call assumes the risk that the phone company will voluntarily share that information with the police.

Similarly I have no constitutional complaint if the company that picks up my garbage turns it over to the police instead of mashing it up with the rest of the refuse it collects on its route. By voluntarily putting my garbage out at the curb, the Supreme Court has held, I give up my privacy rights in it.

When the Government serves someone with a subpoena requiring that person to testify or to surrender certain evidence, the Government need not show probable cause, and need not first obtain judicial approval. This is because of the long-established principle that, except for certain situations involving legal privilege, "The public is entitled to every man’s evidence."

Thus, for example, in U.S. v. Miller, the Supreme Court held that a bank customer has no constitutional protection if an FBI agent shows up at the bank with a subpoena for her bank records.

If an FBI agent shows up at my door with a subpoena requiring me to bring my financial records (or my computer hard drive) to the grand jury, I can move to quash the subpoena, but so far as the Fourth Amendment is concerned, my motion must be denied so long as the Government can show a reason to believe that what the investigators seek is relevant to their investigation and the subpoena is not overly broad or too burdensome.

If I am the target of the investigation, the Government will often be reluctant to subpoena evidence from me, not because of the Fourth Amendment, but because of the Fifth. The Fifth Amendment does not protect the contents of the subpoenaed documents or files, but it often protects the act of surrendering them in compliance with the subpoena. But the Fifth Amendment does not protect me if instead the Government subpoenas such records from someone else -- for example, from a friend, a business partner, or my bank.

A logical starting place with e-mail is to compare it to the two forms of communication it most closely resembles: telephone calls and mail delivered by the Postal Service.

Each is protected from unauthorized interception: it is a crime for a private person to tap someone’s phone, or open and read someone else’s mail, and law enforcement officials may not do either without an interception order (in the case of a phone call), or search warrant (in the case of mail), based on probable cause to believe that evidence of a crime will be revealed. If I have phone conversations with someone else (call her "X"), the Government does not need a search warrant or interception order to require X to reveal what we said; it can simply serve her with a subpoena. Similarly, the Government can serve a subpoena on X directing her to surrender all correspondence she has received from me. Unless X is my spouse or my attorney, I have no legal basis to oppose the subpoena. And unless X is my lawyer or my spouse or asserts a claim that testifying about our phone conversations or surrendering my letters would incriminate her, X has no legal grounds to refuse to comply, either.

The same is true with e-mails: the Government could serve a subpoena on X, requiring her to turn over all e-mails she received from me. And that is as it should be: unless X and I share a legally privileged relationship, a grand jury, court or Congressional committee is entitled to X’s evidence, however reluctant X may be to give that evidence.

Now suppose that, instead of serving a subpoena on X to turn over copies of our e-mail correspondence, the Government seeks information from my Internet service provider or remote computer storage facility, either of which may have a record of all my e-mail -- what I sent as well as what I received. Are my e-mails available to the Government merely by subpoena, like the Supreme Court has held is the case with regard to my bank records or the numbers I dial on my phone?

To deal with these issues, Congress, in the Electronic Communications Privacy Act of 1986 (ECPA), made an elaborate series of distinctions based on what the Government sought, from whom it sought it, and when. Briefly the law is as follows.

1. Interception of e-mail as it is being sent. ECPA requires the Government to obtain an interception order from a judge. The prerequisites for such an order are somewhat more demanding than those for a regular search warrant but somewhat less demanding than those for an order to tap a telephone or bug a particular premises.

2. Access to electronic communications in storage for 180 days or less. In this situation, the law regards the service provider as the equivalent of the Postal Service: just as a search warrant is required to open a letter after it has been mailed but before it has been received, ECPA requires the Government to obtain a search warrant requiring the Internet Service Provider to turn over the targeted e-mails. To obtain a search warrant, the Government must persuade a judge that probable cause exists that the e-mails being sought will provide evidence of a crime. If the judge issues the warrant, the Government may obtain the e-mails immediately, without prior notice to the subscriber or customer.

3. Access to electronic communications in storage with a service provider for more than 180 days. ECPA treats this situation differently than the previous situation. The reasoning: after 180 days, the service provider is no longer acting like the Postal Service delivering the mail; it is acting more like a friend or business partner who is storing my records for me. Thus, ECPA gives the Government several options.

(1) It may apply to a judge for a search warrant, as in the previous situation.

(2) It may issue a subpoena, which does not require judicial approval or probable cause, but which does require advance notice to the subscriber or customer, who may bring a motion to quash. As outlined earlier, to defeat a motion to quash, the Government merely need show that there is reason to believe that evidence relevant to a legitimate investigation may be obtained from the subpoenaed items.

(3) It may seek a court order by demonstrating to the judge that there are "reasonable grounds to believe" that the information sought "are relevant and material to an ongoing investigation." In seeking such a court order, the Government may also seek permission to postpone notice to the subscriber or customer for up to 90 days by showing that there is "reason to believe" that such notice will jeopardize someone’s safety, result in the destruction of evidence, or in some other way impede the investigation.

4. Access to electronic communications stored with a remote computing service, regardless of for how long or short a period of time. In this situation as well, the Government has the same three options: a search warrant, a subpoena or a court order. The reasoning: the storage facility is not like the Postal Service delivering the mail; it is merely a third party who is storing my records for me.

5. Other Internet-related information

At present there is no clear law regulating Government access to other information about customers or subscribers that can be obtained from an ISP. If I keep my address book and appointment calendar in my pocket, in my desk drawer, or on my home computer’s hard drive, the Government can obtain them from me only by first getting a search warrant from a judge, based on probable cause. But if instead I keep my address book or appointment calendar with a service provided by an ISP, presumably the Fourth Amendment requires only that the Government serve a subpoena on the ISP. After all, I knowingly exposed the information to the ISP -- just as I expose "numerical data" to the telephone company when I dial my phone, and my financial transactions to the bank when I write a check or make a deposit or withdrawal.

Similarly, a subpoena would presumably suffice to obtain a list of the chat rooms or web sites a subscriber visited, assuming the ISP could retrieve or gather this information.

The Internet enables us to communicate, to associate, to research, to explore and to shop in ways that could not have been imagined a generation ago. Most of us use it to increase our knowledge, to stay in touch with friends, to increase the efficiency with which we do various chores (shopping, bill paying, etc.). As we do so, we create data about ourselves that should be protected from too-easy access, whether by the Government or by commercial entities.

On the other hand, we must not forget that there are those who use the Internet to learn how to build bombs, or to gather information for use in fraud or extortion, or to entice vulnerable children into sexual liaisons. If we make it too difficult for the Government to track and obtain a perpetrator’s use of the Internet for these purposes, its ability to protect us from these crimes may be seriously undermined.

It is appropriate for this Subcommittee to explore how it can protect the privacy from Government (and non-Government) intrusion of information generated by or stored on Internet-related services. In doing so it must strive to strike a balance between the right to privacy and the Government’s legitimate need to prevent crime and apprehend and prosecute criminals.

A variety of approaches are available. Congress could impose a search warrant requirement before the Government could obtain a wide range of information about an ISP’s customer or subscriber. This would insure substantial protection of privacy, but at some cost to law enforcement efficiency. In the alternative, it could create an intermediate level of protection. After the Supreme Court’s pen register decision in Smith v. Maryland, Congress enacted legislation imposing certain minimal requirements on the Government before it could obtain a pen register. The different ways ECPA treats e-mail under different circumstances provides another example of a nuanced approach of what should be protected, how vigorously, and under what circumstances.

I am grateful for the opportunity to appear before this Subcommittee and am eager to be of assistance in exploring these issues.

* * *

In accordance with House Rule XI, clause 2(g)(4), I hereby certify that I have received no Government grants, contracts or subcontracts in this or in the two preceding fiscal years.

Professor Clifford S. Fishman

The Columbus School of Law

The Catholic University of America

3600 John McCormack Road, NE

Washington, D.C. 20064

202-319-5140

fax 202-319-4459

Fishman@law.cua.edu