Constitutional & Regulatory
Cite as: Jessica Belskis, Applying the Wiretap Act to Online Communications after United States v. Councilman, 2 Shidler J. L. Com. & Tech. 18 (Apr. 14, 2006), at <http://www.lctjournal.washington.edu/Vol2/a018Belskis.html>
© 2006 Jessica Belskis
This article examines the federal Wiretap Act and its application to online communications in light of the United States Court of Appeals for the First Circuit’s recent decision in United States v. Councilman. The federal Wiretap Act places legal limits on the surveillance of electronic communications, but courts struggle to make sense of its application to online communications. Formerly, courts held that the Wiretap Act did not apply to the retrieval of communications from places of electronic storage. However, in United States v. Councilman, the First Circuit suggests that retrieval of emails from temporary places of electronic storage fall within the Wiretap Act. In order to avoid liability, businesses that monitor customers online should seek customer consent and familiarize themselves with different interpretations of the federal statute as well as various state wiretap statutes.
Introduction
The Electronic Communications Privacy Act
United States v. Councilman and the Meaning of “Interception”
Implications for Online Businesses
State Wiretap Statutes
Conclusion
Practice Pointers
<1> To what extent can businesses legally gather customer information through computer or online surveillance? Businesses commonly place cookies2 on customer computers, and some businesses, such as Google with its Gmail service, scan emails to learn customers’ buying habits, preferences and personal information. The federal Wiretap Act regulates online and computer surveillance;3 however, the Act is “a complex, often convoluted, area of the law,”4 and relatively few cases have interpreted the Act’s application to online surveillance. Recently, the United States Court of Appeals for the First Circuit clarified the application of the Act to email communications in United States v. Councilman.5 Businesses should be aware of Councilman’s implications when creating online monitoring systems.
<2> In 1968, Congress enacted the Omnibus Crime Control and Safe Streets Act, the precursor to the Electronic Communications Privacy Act (ECPA).6 Title III of the Omnibus Crime Control and Safe Streets Act, known as the Wiretap Act, addressed the interception of wire and oral communications.7
<3> In 1986, Congress enacted the ECPA8 in order to expand the protections of the Wiretap Act. The stated purpose of the ECPA is to “protect against the unauthorized interception of electronic communications … [and] update and clarify Federal privacy protections and standards in light of dramatic changes in new computer and telecommunications technologies.”9 The ECPA broadens the scope of the earlier statute by including, most notably, coverage of electronic communications.
<4> The ECPA consists of two titles: the Wiretap Act and the Stored Communications Act. Title I, the Wiretap Act, prohibits anyone from “intentionally intercept[ing] or endeavor[ing] to intercept any wire, oral, or electronic communication.”10 The Wiretap Act exempts wire and electronic communication service providers acting in their normal course of business. The Wiretap Act also exempts situations where one party to the intercepted communication grants consent.11 Title II, the Stored Communications Act, prohibits anyone from “intentionally access[ing] without authorization a facility through which an electronic communication service is provided” and from “intentionally exceed[ing] an authorization to access that facility.”12 The Stored Communications Act exempts providers of electronic or wire communications services, regardless of whether the provider acts in the normal course of business.13
<5> Liability under the Wiretap Act (hereinafter “the Act”) requires three elements. First, the Act requires proof of specific intent.14 Under this element, a party must intentionally or recklessly disregard the law in order to be found liable.15
<6> Second, the Act requires presence of a “wire, oral, or electronic communication.”16 These elements are separately defined by the Act. For example, “electronic communication” is defined as “any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce.” Therefore, computer communications are electronic communications under the Act.17 In order to demonstrate the presence of a wire, oral, or electronic communication, a party bringing a suit under the Act must have entertained a reasonable expectation of privacy.18 Where a party’s conversation takes place using loud voices in a small room while in the presence of other persons, and the conversation can be heard with “[a] naked ear under uncontrived circumstances,” there can be no reasonable expectation of privacy.19 In such a case, the party’s suit would fail for lack of an oral communication as defined by the Act.
<7> The third element of liability under the Act is “interception.”20 Interception has proven to be the trickiest aspect of the statute, and most debate surrounding the Wiretap Act’s application to computer and internet surveillance examines this fuzzy concept. The statute defines “intercept” as the “aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.”21 The Act defines electronic, mechanical, or other devices as “any device or apparatus which can be used to intercept a wire, oral or electronic communication” other than instruments furnished to the subscriber of a communication service or being used by a provider of a communication service in the ordinary course of its business.22
<8> Under the Act, interception refers to third-party acquisition of communication contents but not transactional information.23 Transactional information consists of information related to user transactions, such as dialing, routing, addressing, and signaling information. Cookies normally register transactional data and do not intercept content of communications; therefore, the Wiretap Act generally does not cover cookies. In re DoubleClick Inc. Privacy Litigation exemplifies this distinction.24 In DoubleClick, a corporate provider of internet advertising products and services used cookies to collect information about Internet users in order to target online advertising. Plaintiffs argued that the cookies were “wiretaps” intercepting their communications. The United States District Court for the Southern District of New York held, however, that there was no violation of the Wiretap Act. Although the court based its decision on a consent theory, commentators generally refer to this case to articulate the content-transactional distinction.25 The section below further explores the concept of interception.
<9> The Wiretap Act contains two major exceptions. First, no violation takes place when a communication service provider, whose facilities are used in the transmission of the communication, intercepts a communication in the normal course of business or when the interception is necessary to protect the property or rights of the provider.26 Second, the statute makes interception permissible where at least one party to the communication gives prior consent.27
<10> Circuit Courts of Appeal that have considered the matter have traditionally held that “‘intercept’ under the ECPA must occur contemporaneously with transmission.”28 According to this theory, the Wiretap Act does not cover communications sitting in any type of electronic storage, because interception does not occur instantaneously with transmission. Therefore, where a communication is sent but remains unopened in the recipient’s computer, third-party acquisition of this stored communication does not violate the Wiretap Act. For example, where the Secret Service seized a computer used to operate an electronic bulletin board system containing private electronic mail messages which had not yet been retrieved by their intended recipients, the Fifth Circuit Court of Appeals held there was no violation of the Wiretap Act because the definition of “electronic communication” does not include electronic storage of such communications.29
<11> The Ninth Circuit Court of Appeals similarly held that a lawyer who used a patently unlawful subpoena to gain access to email stored by an Internet service provider did not violate the Wiretap Act because the “Act only applies to the acquisition contemporaneous with transmission,” and “Congress did not intend for ‘intercept’ to apply to ‘electronic communications’ when those electronic communications are in electronic storage.”30 In Konop v. Hawaiian Airlines, the Ninth Circuit Court of Appeals held that when the vice president of Hawaiian Airlines accessed the plaintiff pilot’s website without permission, there was no violation of the Wiretap Act. The Court found that “[f]or a website such as Konop’s to be ‘intercepted’ in violation of the Wiretap Act, it must be acquired during transmission, not while it is in electronic storage.”31 The Eleventh Circuit Court of Appeals ruled that when an individual used a Trojan Horse virus to hack into another’s computer and download files stored on the computer’s hard drive, there was no violation of the Act32 because “a contemporaneous interception—i.e., an acquisition during ‘flight’—is required to implicate the Wiretap Act with respect to electronic communications.”33
<12> What happens when the interception of a communication occurs both: (1) contemporaneously with transmission; and (2) while the communication sits in a location of electronic storage? “Traveling the internet, electronic communications are often—perhaps constantly—both ‘in transit’ and ‘in storage’ simultaneously, a linguistic but not a technological paradox.”34 United States v. Councilman posed this vexing issue to the First Circuit Court of Appeals.35 The First Circuit initially ruled that such an acquisition does not violate the Wiretap Act (Councilman I).36 However, the court reversed following an en banc rehearing, holding that such acquisition does constitute an interception and, therefore, violates the Wiretap Act (Councilman II).37
<13> In Councilman, defendant Bradford C. Councilman was the vice-president of an online rare and out-of-print book listing service called Interloc. In addition to the book listing service, Interloc provided customers with email accounts and acted as a service provider for these accounts. In order to better target customers and respond to growing competition from Amazon.com, Interloc intercepted and copied email communications sent from Amazon.com to its customers before delivering the messages into customer email accounts. Plaintiffs charged that Councilman violated the Wiretap Act by intercepting these email communications. The Stored Communications Act was inapplicable in this case due to a statutory exception that exempts communication service providers.38
<14> The process of email transmission technically enables an email message to sit in electronic storage during the process of transmission. Email operates by splitting a message into small packets and then transferring these packets from computer to computer until the packets reach their final destination, where they are reconfigured.39 As packets travel from computer to computer, they are stored in intermediary locations called Message Transfer Agents (MTA).40 Each MTA stores the message locally before routing it through to another MTA until the message ultimately reaches the recipient’s mail server. Email service providers often use separate Mail Delivery Agents (MDA) to retrieve messages from the MTA and deliver them to recipients. Interloc used a program called procmail as its MDA. Interloc rewrote the procmail program code so that it intercepted, copied, and stored all incoming emails from Amazon.com before delivering them into recipients’ email boxes.41 The procmail program operated while messages were stored in the random access memory (RAM) or hard disks within the Interloc system. Therefore, Interloc intercepted the customer emails from temporary storage within Interloc’s own computer system. Councilman argued that because the communications were copied from electronic storage and because the term “electronic communication” does not include “electronic storage,” there was no interception as contemplated by the Wiretap Act.42
<15> In Councilman I, the First Circuit Court of Appeals ruled that Councilman did not violate the Wiretap Act because the email communications at issue were intercepted while in electronic storage. The Wiretap Act defines “wire communication” to include “any electronic storage” of wire communications43 and defines “electronic storage” as “any temporary, intermediate storage.”44 On the other hand, the Wiretap Act’s definition of “electronic communication” contains no mention of electronic storage. The First Circuit found that the inclusion of electronic storage within the statutory definition of wire communication, and the exclusion of electronic storage from the definition of electronic communication, suggests that “Congress did not intend for the Wiretap Act’s interception provisions to apply to communication in electronic storage.”45
<16> The Councilman I court acknowledged the problem of contemporaneity and conceded that Interloc intercepted emails contemporaneously as they were being transmitted. 46 However, the court explained that the contemporaneity rule was trumped because of: (1) the exclusion of “electronic storage” from the definition of “electronic communication”; (2) “the presence of the words ‘any temporary intermediate storage’” within the definition of “electronic storage”; and (3) the fact that “the electronic communications in this case were in a form of electronic storage.”47 Because procmail performed its operations while the communications were stored in RAM or hard disks within Interloc’s computer system, the communications were outside the scope of “electronic communication.”48
<17> The Councilman I court explained that Congress’s omission of “electronic storage” from the definition of “electronic communication” indicated that Congress meant to provide lesser protection to electronic communications than to wire and oral communications. Even if the omission was accidental, “it is not the province of this court to graft meaning onto the statute where Congress has spoken plainly.”49
<18> In October 2004, a majority of the First Circuit agreed to rehear Councilman en banc,50 whereupon the court withdrew and vacated the prior judgment. In Councilman II, the First Circuit ruled that the “electronic communication” includes “transient electronic storage that is intrinsic to the communication process.” Therefore, the court ruled that interception of an email communication in transient electronic storage violates the Wiretap Act.51
<19> In Councilman II, the court conceded that a plain meaning interpretation of the Wiretap Act suggests that “electronic communication” does not include transient electronic storage. The court explained the Russello maxim as holding that “where Congress includes particular language in one section of the statute but omits it in another section of the same Act, it is generally presumed that Congress acts intentionally and purposely in the disparate inclusion or exclusion.”52 However, the court noted that the Russello maxim holds true only where Congress acted deliberately and carefully in choosing its words of construction and where the provisions’ language, structure and circumstances of enactment are analogous.53 The definitions of “electronic communication” and “wire communication” were constructed at different times and under different circumstances, and contain language that is not parallel. Accordingly, it cannot be inferred that Congress intended to exclude transient stored communications from the definition of “electronic communications.”54
<20> In order to ascertain the true meaning of “electronic communications,” the court looked to legislative intent. House reports and hearings indicated that Congress intended to protect “pre- and post-transmission ‘temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission.”55 According to the court, although the statute defines “electronic storage” broadly to include any temporary or intermediate storage, the purpose of this broad definition is to heighten privacy protection for stored data and not to exclude email messages stored during transmission.56 In addition, by including “electronic storage” in the definition of “wire communication,” Congress intended to ensure the protection of voice mail and did not intend to affect the protection of email.57
<21> Although the Councilman facts involved interception of email communications contemporaneous with transmission, the First Circuit did not base its decision on the rule of contemporaneity. In dicta, the Councilman II court states that it did not address the issue of “whether the term ‘intercept’ applies only to acquisitions that occur contemporaneously with the transmission of a message from sender to recipient, or, instead, extends to an event that occurs after a message has crossed the finish line of transmission.”58 The opinion says that the traditional rule requiring a real-time interception may not be apt for questions involving the application of the Wiretap Act to electronic communications. In doing so, the First Circuit leaves open the possibility of a more expansive application of the Wiretap Act to post-transmission email communications that have arrived at the destination computer, but sit in storage at the destination unopened.
<22> Violators of the Wiretap Act can be fined or imprisoned for up to five years.59 Although only time will tell whether other federal circuits will follow the Councilman II holding, online businesses should avoid unreasonable risk. Businesses should presume that Councilman II’s stricter rendition of the statute is correct, and they should comply accordingly. Under Councilman II, scanning customer emails or placing cookies on customer computers in order to surreptitiously intercept content of communications could result in liability under the Wiretap Act, even if the intercepted data technically sits in “electronic storage” during transmission. Businesses wishing to use these methods to collect customer information should first seek clear consent from customers.
<22> The Wiretap Act’s consent exception allows interception of an electronic communication “where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception.”60 Consent can be express or implied, and courts generally look at the overall circumstances when making a determination.61 In order to be safe, businesses should seek express written consent.
<23> Consent agreements should be broadly written to include all types of information businesses might collect. After acquiring consent, businesses should stay well within the bounds of their agreement. When a data collection business serving online pharmaceutical companies used cookies to collect customer names, addresses, telephone numbers, email addresses, dates of birth, genders, insurance statuses, education levels, occupations, medical conditions, and medications, the First Circuit held that the data collection business exceeded its consent by collecting such personally identifiable information. The court determined that the customer pharmaceutical companies agreed only to the interception of a subset of these communications.62 In addition, businesses should enable customers to take simple steps to avoid collection of their personal information. Where an online advertising company used cookies to collect personal user information and create detailed user profiles, the United States District Court for the Southern District of New York determined that the company did not violate the Wiretap Act because it only collected transactional data and enabled users to prevent data collection by visiting a special website and requesting an “opt-out” cookie.63
<24> Forty-nine states and the District of Columbia have their own state wiretap statutes.64 Because states largely modeled their statues after the federal act,65 and because states cannot “impose requirements less stringent” than the federal standard,66 state courts often read their wiretap statutes as being consistent with interpretations of the federal act. States may set forth standards stricter than the federal statute.67 Currently, twelve states have two-party consent requirements, meaning that both parties to the communication must give consent in order to make interception of a communication permissible. These states are California,68 Connecticut,69 Delaware,70 Florida, 71 Illinois,72 Maryland,73 Massachusetts,74 Michigan,75 Montana,76 New Hampshire,77 Pennsylvania,78 and Washington.79
<25> Many online businesses appear not to comply with these two-party consent statutes. DoubleClick, for example, has permission from commercial websites to intercept their web communications with their users. However, individual users generally do not consent to the interception of personal information. Google might also be liable under state wiretap statutes for the way it administers its Gmail product.80 Gmail is an email service provider that provides target advertising to customers. Advertisers buy keywords from Gmail, and Gmail scans the contents of incoming emails in order to determine which relevant advertisement to display when the recipient opens his or her email. Although Gmail subscribers give consent by signing waivers, individuals who exchange emails with Gmail users do not consent to the interception and scanning of their communications.
<26> Given this appearance of noncompliance, it is somewhat surprising that online businesses have not been summoned to state court for violating two-party consent statutes. Perhaps the traditional rule that a communication must be “contemporaneous with transmission” in order to fall within the Wiretap Statute has deterred nonconsenting parties from filing suit, because this interpretation generally exonerates businesses from liability. Councilman II offers a different interpretation so that communications in “electronic storage,” which are not necessarily “contemporaneous with transmission,” might fall under the purview of the Act. Online businesses should act cautiously and obtain consent from all parties to the communication whenever possible.
<27> Before implementing customer monitoring or surveillance devices, online businesses should familiarize themselves with both federal and state wiretap statutes. The federal Wiretap Act places legal limits on online and computer surveillance, but courts disagree over application of the Act, making it difficult for online businesses to draw a clear set of guidelines. The First Circuit recently interpreted the Wiretap Act and its application to email in United States v. Councilman.81 Whether other circuits will follow the Councilman II interpretation remains unknown; therefore, practitioners and businesses should stay abreast of developments in their jurisdictions.