The Sixth Circuit Court of Appeals held on June 18th, in Warshak v. U.S., that people have a reasonable expectation of privacy in the contents of their email so that the government needs to obtain a search warrant before being able to obtain it.

The issue in the case was whether Warshak had a reasonable expectation of privacy in the email stored on his ISP’s servers. The government had obtained an order, authorized by the Stored Communications Act, to compel Warshak’s ISP to disclose  Warshak’s email to the government without notifying Warshak. The defendant argued that this is improper search and seizure under the Fourth Amendment because of his reasonable expectation of privacy in the email.

The opinion by Judge Martin seems to rely on an analogy between email and phone calls. The courts have long established that there is a reasonable expectation of privacy in the content of phone calls notwithstanding the phone company’s ability to listen to calls. Under the established precedent, the government cannot eavesdrop on calls without a warrant. The Sixth Circuit held that email is similar to a phone call, for expectation of privacy purposes, and the phone call expectation of privacy reasoning applies to email.

The court seems to limit the holding, however. If ISP employees regularly look at customer email in the ordinary course of business or if the ISP has a broad authorization (by EULA or something similar) to look at customer email, then the outcome of the case might have been different as customers would have decreased expectation of privacy. It is also interesting to note that the court recognized that inspection of email by computer programs, such as virus or spam checkers, security filters, or other tools that process email based on its contents, does not decrease the expectation of privacy in one’s email - instead, manual (or otherwise human) inspection of email is necessary to erode the privacy expectation.

The pragmatic comment about this outcome is that it may not apply as broadly as one might think. Most ISPs may, if they do not already have, bury somewhere in their EULAs a "no reasonable expectation of privacy in stored email" language  and this would defeat what the privacy expectation SIxth Circuit has carefully carved out. The ruling leaves much details to be fleshed out and subsequent cases interpreting this ruling may turn out to be as important as this one.

It is hard not to notice the new template. Few people asked why I chose black-dominant theme and the answer is - it is appropriate for the state of the Internet at least as far as cybercrime proliferation comes. Almost all meaningful research projects and statistics show that cybercrime is on the rise, that it is more sophisticated and harder to detect, that more people are vulnerable, and that the damages are higher. This is no reason for cheerful theme.

The main transition to the new design is complete. However, please bear with me as I make minor tweaks to the layout to perfect it. You will most likely not notice it, but if you do - my apologies in advance. Comments are, of course, always welcome.