In an important opinion issued Friday, the U.S. District Court for the Eastern District of Virginia in United States v. Appelbaum upheld a previous order instructing Twitter to turn over to the U.S. government Twitter records—not the content of tweets (that in this case were already publicly available)—related to the government’s ongoing Wikileaks investigations.
The opinion leads me to three conclusions. First, the anachronistic Stored Communications Act of 1986 (“Act”), which is part of the Electronic Communications Privacy Act of 1986’s procedural framework for law enforcement authorities to obtain wire and electronic information, needs to be overhauled to reflect the realities of modern technology. The myriad critics of the court’s opinion who wish to pursue a long-term litigation strategy should focus equal energy on the Act itself, not on courts that are bound by it. Second, if you want your Twitter content (e.g., Tweets) to be private, then keep it private. Under the Act, as the court states, records (defined below) are fair game, but content is not. If you want to keep it that way, avail yourself of Twitter’s privacy settings to keep your content out of the public eye. Third, at least with respect to the court’s decision to force Twitter to turn over said records (I will not address here the opinion’s findings on international comity as it pertains to one of the petitioners, a member of the Parliament of Iceland), I believe—and this is not the conclusion I expected to reach before reading it—that the court decided the case correctly.
On December 14, 2010, the court issued a sealed order pursuant to the Act requiring Twitter to turn over subscriber information concerning the following accounts and individuals: Wikileaks, @rop_g, @ioerror, @birgittaj, Julian Assange, Bradley Manning, Rop Gonggrijp, and Birgitta Jonsdottir. Applebaum, an American computer security researcher; Gonggrijp, a Dutch computer security specialist, and Jonsdottir, a citizen of Iceland and member of its national parliament, moved to vacate that order. Each of the petitioners is associated with Twitter “account names of interest to the government.” It is essential to review the records that the Order demands. These include:
- subscriber names, user names, screen names, or other identities;
- mailing address, residential addresses, business addresses, e-mail addresses, and other contact information;
- connection records, or records of session times and durations;
- length of service (including start date) and types of service utilized;
- telephone or instrument number of other subscriber number or identity, including any temporarily assigned network addresses;
- means and source of payment for such service (including any credit card or bank account number) and billing records; and
- non-content information associated with the contents of any communication or file stored by the accounts, such as the source and destination email address and IP addresses.
This is an extensive list, but also one that falls within the purview of the Act, as we shall see. No Twitter content is at issue.
The district court considered four legal issues, three of which are examined below. First, did the Petitioners have legal standing under the Act to bring a motion to vacate? Second, was the court’s original order properly issued? Third, did the original order violate the Petitioners’ First and Fourth Amendment rights? And finally, should the Order should be vacated as to Jonsdottir, the Icelandic member of parliament, for reasons of international community? (For the record, the court answered the last question in the negative.).
The court found that a customer may challenge an order issued under the Act when the person’s “contents of electronic communications” are requested. In this case, however, the court correctly reasoned that only records were requested. While some will no doubt argue that the court’s view of the difference between content and records is narrow, this there clearly is a difference between content (e.g., tweets themselves, and certainly ones that are made public) and the records requested by the government. The court thus held that the petitioners lacked standing. It should be noted that the court could well have ended its opinion there. It’s not shocking that it did not. As I have written elsewhere, the principles at stake in these technology-focused cases are extremely important and judges are expounding upon them.
Was The Court’s Original Order Properly Issued?
The Act requires that a court order be limited to information that is “relevant and material” to an ongoing criminal investigation. As the court noted, because the records at hand remained sealed pursuant to the original order, “petitioners face the difficulty of challenging a document they have not seen.” That determination was left to the court. Petitioners thus argued that their publicly posted tweets pertained mostly to non-Wikileak topics and thus cannot be deemed relevant or material. Petitioners missed the point: content was not at issue, and certainly not content that they chose to make public.
Petitioners’ First Amendment Claims
The First Amendment guarantees freedom of speech and assembly. Focusing on the guarantee of assembly, Petitioners argued that the government attempted to create a “map of association” with a chilling effect on their First Amendment rights. The court began its analysis with a footnote stating that it had “serious doubts as to whether Ms. Jonsdottir and Mr. Gonggrijp enjoy First Amendment rights under the U.S. Constitition” as non-citizens for their actions outside the United States. The court noted that while freedom of association may in fact be hampered by the disclosure of political membership/affiliations, freedom of association does not shield members from cooperating with legitimate government investigations. The court concluded that it found “no cognizable First Amendment violation” where the Petitioners had already made their Twitter posts and associations publicly available.
Petitioners’ Fourth Amendment Claims
Petitioners argued that the Order amounted to a warrantless search in violation of the Fourth Amendment. Particularly, they challenged the instructions that Twitter produce the IP addresses for their accounts for specified dates and times. The court rejected their arguments, citing U.S. Supreme Court precedent and a long line of federal court of appeals decisions from various circuits holding that there is no legitimate expectation of privacy in IP addresses because that information is also conveyed to and from third parties such as Internet Solution Providers. This holding has its roots in the U.S. Supreme Court’s opinions in United States v. Miller (1976), which held that a warrantless search of bank customers’ deposit information does not violate the Fourth Amendment because there can be no reasonable expectation of privacy in information voluntarily conveyed to bank employees, and Smith v. Maryland (1979), which held that the Fourth Amendment permits the government, without a warrant, to install a pen register to record numbers dialed from a telephone because a person voluntarily conveys the numbers without a legitimate expectation of privacy. It is critical to note one of the most important technical (in the technology sense) points of this particular case. Before creating a Twitter account, readers are notified that “IP addresses are among the kinds of ‘log data’ that Twitter collects, transfers, and manipulates.” Fair game.
What Can We Learn from the WikiLeaks Twitter Decision?
There is no question that the rate at which technology changes far outpaces the law’s ability to keep pace with it. Modern technology renders certain legal doctrines anachronistic and in need of serious reconsideration. The Stored Communications Act is a perfect example. In Warshak (above), for example, another case decided within the framework of the Act, the Sixth Circuit made plain that Fourth Amendment jurisprudence must keep pace with the “inexorable march of technological progress lest its guarantees wither and die.” Even so, it decided that case within the confines of the Act. In this case, the district court was similarly constrained. Cases such as this one will surface again and those who disagree with this opinion are highly organized and strong in number. In my opinion, continued litigation under the Act will prove to be disappointing. Those parties would be better served by attacking the Act itself not just in the courts, but also—and even primarily—vigorously through the legislative process.