🚀 go-pugleaf

Part 2 of the Legal Bytes Newsletter..

---------------------------------------------------------------
Edward Cavazos, Attorney at Law    |     polekat@well.sf.ca.us
Andrews & Kurth, LLP               |     ecavazos@blkbox.com
4200 Texas Commerce Tower          |     (713) 220-4195 (v)
Houston, TX  77002                 |     (713) 220-4285 (f)



---------- Forwarded message ----------
Date: Fri, 23 Dec 1994 13:44:12 -0600 (CST)
From: pkennedy <pkennedy@io.com>
To: Legal Bytes <legal-bytes@io.com>
Subject: Legal Bytes 2.2 (Part 2).

[Legal Bytes Vol. 2, No. 2, continued]

5.   OTHER PEOPLE'S E-MAIL:  TO READ OR NOT TO READ?

     [The following is a revised version of an article that first
     appeared in Computer Underground Digest, Volume 6, Issue 96.]

     A lot of confusion remains regarding who can properly and
legally read electronic mail, and under what circumstances.  Most
of the questions arise about mail not address to you.  Can I read
it?  When?  Can I show it to others?  When?  Systems administrators
are especially concerned -- do they have the right to read mail
passing through their systems just for the fun of it?  For more
legitimate reasons?  What would be a legitimate reason?

     There is a complex federal statute dealing with the privacy of
electronic mail, but it does not answer all the questions.  Neither
can this article, but the goal is to lay out some general
principles about reading other people's mail, to cover some of the
basic situations.  More complicated scenarios, or new twists, will
require more thinking.

     A simple rule:  for several reasons, the wisest course for
everyone, sysops and system users alike, is to treat electronic
mail like Postal Service mail and telephone calls:  if the letter
or call is for you, don't snoop unless you have permission of at
least one of the parties.  If in doubt, don't.  Simple enough.  You
can rarely get in trouble for not reading someone else's mail.

     What laws govern?  The principal law regulating access to
electronic communications (including e-mail) is a federal statute,
applicable nation-wide, popularly known as the Electronic
Communications Privacy Act of 1986 (or "ECPA" for short).  The ECPA
amended the Wiretap Act to include electronic communications with
its previous provisions regarding oral and wire (telephone)
communications.  The ECPA also added a brand-new section governing
access to stored electronic communications (the "Stored
Communication" provision).[fn1]  A U.S. Court of Appeals recently
explained that Congress intended these two sections of the ECPA to
handle different situations -- the Wiretap Act governs interception
of data in the act of transmission, and the Stored Communication
provision governs access to electronic communications in storage. 
Although this distinction gets thin in certain situations, it is a
good working model.  There has been very little guidance from the
courts so far in interpreting the application of the ECPA and other
laws to e-mail, and so any conclusions in this article should be
taken for what they are, and no more -- informed guesses.  The
particular facts of any given situation will always be very
important.

[fn1:  These laws can be found at 18 U.S.C. s 2501, et seq., and 18
U.S.C. s 2701, et seq., respectively.]

     The Wiretap Act.  The Wiretap Act prohibits anyone from
intercepting electronic communications, or knowingly disclosing or
using intercepted communications.  Intercepting mean simply to
"acquire the contents" of the e-mail message.  There are some
exceptions: (1) if you are a party to the communication (of
course); (2) you are not a party, but a party to the communication
has given consent; (3) if the systems administrator is acting "in
the normal course of his employment while engaged in any activity
which is a necessary incident to the rendition of his service or to
the protection of the rights or property of the provider of that
service" (but not "service observing or random monitoring"); and
(4) if there is a court order authorizing the interception. 
18 U.S.C. s 2511(2).

     The Wiretap Act also specifically prohibits systems
administrators from divulging the contents of an electronic
communication, while in transmission, to anyone other than the
addressee or intended recipient, which means the systems
administrator cannot pass e-mail on to someone else, even if the
administrator does not get a copy of the mail.  There are
exceptions, here, too:  A systems administrator may forward mail
(1) with the permission of a party to the communication; (2) under
court order; (3) to a forwarding facility; or (4) to law
enforcement, if the communication appears to pertain to the
commission of a crime, (and the communication was inadvertently
obtained by the service provider).

     Stored Communications.  All bulletin board e-mail residing in
a storage device -- whether permanently or temporarily incident to
transmission -- is covered by the Stored Communications provisions
of the ECPA, 18 U.S.C. s 2701, et seq.  These provisions protect e-
mail from two things:  (1) unauthorized access, alteration and
disruption, and (2) unauthorized disclosure.  18 U.S.C. s 2701,
s 2702.  The first provision prohibits "hacking"-type activity, the
second protects the privacy of the mail from disclosure to
unintended recipients without authorization.  This provision has
similar exceptions for disclosing e-mail as found in the Wiretap
Act, described above.

     If you violate the ECPA.   If you intercept, disclose, use,
obtain, alter, prevent access to, or divulge electronic
communications in violation of the ECPA, you have committed a
crime.  Not only that, you can get sued in civil court, and end up
paying the lawyer who sues you.  This makes the safer course not to
read mail if unsure -- especially because the ECPA is not the only
law out there.

     The important exceptions.  Anyone can read or pass along e-
mail with the consent of one of the parties.  Systems
administrators need not worry about forwarding messages, or reading
messages that "bounce" in order to figure out what to do with them. 

     Sysops may also review messages as a "necessary incident" (1)
"to the rendition of his service" or (2) "to the protection of the
rights or property of the provider of that service."  There is some
debate on the breadth of these exceptions.  No court case has
discussed how they apply to BBSs.  Prudent systems administrators
should read these exceptions narrowly.  The whole point of the ECPA
indicates that these exceptions are not a license to read users'
mail at will, or even to spot-check to see if users are up to no
good.  The law says that the systems administrator "shall not
utilize service observing or random monitoring except for
mechanical or service quality control checks."  Any spot-checking
must be to monitor the system's functioning, not the users'
activities.

     What if a systems administrator has specific information that
a certain user might be using e-mail to discuss or even facilitate
a crime?  Does that justify nosing through the user's e-mail? 
Again, I believe only very narrow circumstances could justify it. 
The systems administrator is no more responsible for criminal plots
in e-mail than Ma Bell is for telephone conspiracies.  For that
reason, the law need not give the administrator a private-cop badge
to rifle through e-mail and monitor for any signs of crime. 
Because the ECPA permits a systems administrator to disclose to the
police the contents of an e-mail message that was inadvertently
obtained and which appears to pertain to the commission of a crime,
this strongly implies that intentional sleuthing by systems
administrators is forbidden.

     If a systems administrator has specific information that a
user is about to damage the system or crash the service, say with
a virus, the systems administrator could justify reviewing that
user's e-mail as a protection to the system.  The harder case is if
the administrator suspects that a user's actions might be criminal,
but the only threat to the system is that it might get seized by
law enforcement on account of the user.  (Most BBS crime poses no
other threat to the system, as it usually depends on the systems'
continued functioning).  Here, the administrator might argue that
the threat of a seizure of the system (and the resulting loss of
property) justifies reading the suspected user's e-mail.  At
minimum, however, the ECPA's specific prohibition of random
monitoring would require the systems administrator to have good,
solid evidence against the user, not just a vague suspicion or
anonymous claims that something bad is going on.

     A good point of reference:  Remember that the same laws
protecting electronic communications generally apply to BBSs and
telephone companies alike.  Most people would like to see Ma Bell's
right to monitor phone calls be as narrow as possible.  And
consider the voice mail services that phone companies now offer --
they are not that different than e-mail, are they?

     Trying to avoid these rules.  Some systems administrators
still try to avoid the ECPA's restrictions on their curiosity by
posting disclaimers such as "NOTICE:  This system does not provide
private electronic communications" or "WARNING:  We read your mail. 
It is not private."  With these warnings, some systems
administrators think they can freely read everyone's e-mail.  These
warnings are a bad idea.

     First, they probably won't do the job.  While the facts of the
particular case will matter, such disclaimers will have a tough
time in court.  Judges and juries don't like "take it or leave it"
ultimatums when it comes to privacy.  The disclaimer probably isn't
true, except on small boards:  the system almost certainly does
provide the means to communicate free from all prying eyes except
the systems administrator, and on any busy system, the
administrator can't read all the mail, which may re-create in
practice the very expectation of privacy the administrator is
trying to deny.

     Second, the disclaimers may make things worse.  While trying
to limit the risk of an ECPA lawsuit by a user, the disclaimer will
raise the systems administrator's risks in other areas.  An
administrator who actually reads his or her user's e-mail can be
charged with knowing its content, and this increases the potential
for successful civil suits for libel, as well as the danger of
criminal prosecution for aiding criminal activity on the BBS.  The
administrator can always claim "I didn't read that message," but
the system's own words say the opposite.  Worse, if the system is
seized by law enforcement, the systems administrator may lose very
helpful allies:  the users.  When innocent users try to sue the
police for violating their rights under the ECPA, the police will
be sure to defend their acts based on what the system itself told
them:  "no private e-mail here!"  The ECPA should be a great
deterrent against the wholesale seizure of BBSs; systems
administrators diminish that deterrent by using these disclaimers.

     Finally, what possible reason, other than plain rude nosiness,
justifies reading other people's mail?  The law not only imposes no
responsibility to read or monitor mail flowing through a system, it
prohibits it.  Systems administrators who fear criminal
responsibility for what their users are discussing in e-mail are as
wrong as if Southwestern Bell was worried about being held
responsible for crimes committed over their phone system.

     Don't Forget State Privacy Laws.  In addition to the federal
ECPA, each state has varying laws to protect its citizens' privacy. 
Some states prohibit the recording of telephone conversations
unless both parties consent, for instance, which is tougher than
federal law.  States also have vaguely defined, but real, general
civil privacy rights that could be violated by unauthorized reading
of electronic mail.

     For example, it appears to be generally accepted that the ECPA
does not protect the privacy of an employee's e-mail from her
employer's snooping (although it takes some effort to explain why
this is probably the case).  However, state laws may recognize
narrow spheres of privacy at work.  An employer who for years
provides private, secure electronic communications among its
employees may have permitted such a sphere of privacy to develop. 
If the employer suddenly, without notice, begins reading employee
e-mail, it could violate state civil law.  

     The safer practice for an employer would be to have a clear,
written policy stating that company electronic mail is not private,
and that the company retains (or is reclaiming) the right to review
employee mail.  Companies with gateways to outside mail services
should be especially clear on their policy, because, rightly or
wrongly, employees will have a greater expectation of privacy for
personal mail they receive from outside the company, similar to
personal letters sent to a work address.

     A tough, unanswered question:  What about users' personal file
directories on UNIX machines or BBS's?  Many BBSs, Internet
providers, and other computer systems provide their users storage
areas.  Many systems call and treat these areas as "private," and
use the storage space as a selling point for their system.

     Would a systems administrator violate the ECPA by nosing
through a private user's storage area, which commonly contains e-
mail?  The ECPA protects the privacy of e-mail, but copyright law
imposes strict liability for copyright infringement.  (See Legal
Bytes, Vol. 2, No. 1, "BBS System Operators' Liability for
Copyright Infringement:  Let the Sysop Beware").  How does a
systems administrator avoid unknowingly harboring infringing
computer files without checking these storage areas?  The solution
may lie in the systems administrator getting proper consent from
the user, before the fact, to monitor these files, but --  as with
most tough questions of the application of the ECPA to computer
communications -- no court has ruled on the question yet.

====================================================================

ABOUT THIS NEWSLETTER
         
LEGAL BYTES is a service to our clients and friends.  These
articles are intended to be summaries and brief discussions of
emerging legal issues in the field of computer law.  They are 
not intended to be exhaustive discussions of the topics.  Because 
of their nature, they should not be relied upon as legal advice 
or used as a basis for reaching a conclusion.  If you have ideas 
or topics you would like to see discussed in LEGAL BYTES, drop us 
a line.

Legal Bytes is online at:  

ftp.eff.org, /pub/Publications/E-Journals/Legal_Bytes/
gopher.eff.org, 1/Publications/E-Journals/Legal_Bytes
gopher://gopher.eff.org/11/Publications/E-Journals/Legal_Bytes
http://www.eff.org/pub/Publications/E-Journals/Legal_Bytes/

To subscribe to Legal Bytes:  

Send a message to legal-bytes-Request@io.com and include the words
"subscribe legal-bytes" in the _body_ of the message.


ABOUT GEORGE, DONALDSON & FORD, L.L.P.

George, Donaldson & Ford, L.L.P., is a registered limited liability
partnership specializing in litigation and in counseling clients in
a broad range of practice areas, including computer law, copyright,
trademark, trade secrets, business, libel, invasion of privacy, 
and constitutional law. 

Attorneys at George, Donaldson & Ford, L.L.P., are not board
certified in any specialty.  No designation has been made by the
Texas Board of Legal Specialization for a Certificate of Special 
Competence in the area of computer law.  

====================================================================