🚀 go-pugleaf

In article <BuFKv7.FBJ@rice.edu> jaw@owlnet.rice.edu (Joseph A. Watters) writes:
>I'm sorry, but there seem to be some confusion about the facts in your
>original post.  Wang worked for Borland International.  He had an MCI
>Mail account.  MCI is the electronic communications service provider.
>An *MCI* staff worker was closing the account, not a Borland employee.
>...

	This still isn't clear to me.  Was it a Borland employee or an
MCI employee.

>The MCI worker is part of the service provider and is explicitly exempt
>from the prohibitions on reading another person's stored electronic
>communications.  Unless I seriously misunderstand how MCI Mail works, I
>wouldn't think that a Borland employee could close/look into another
>person's MCI mail account.  If the mail messages were somehow stored on
>a Borland system before they were sent out to/through MCI Mail
>(although the original post seems to indicate something else), if that
>Borland employee's duties are to maintain the mail accounts, then
>he/she is still considered to be part of an electronic communications
>service provider, because in this case, Borland is also a provider.
>Thus, again, according to the ECPA, what the employee apparently did
>was legal.

	Actually, it might not be.  If the employee involved was not part of
the "provider" then we either have someone illegally breaking into someone
else account OR the account was owned by Borland in which case they can
decide who gets access to it.  (Actually, this might bring up an analogy
with the idea of wiretaping employees phones.  Doesn't sound ethical
to me, but it might be legal...)  On the other hand, the employee might
be part of a service provider: MCI (or Borland if they did some of the work).
In this case, the employee is permitted some access, but I don't think they
are allowed to go on snooping expeditions.  Relevant sections from the
law after the ECPA of 1986 was enacted might be:

[My comments are at end or in brackets like this]

Title 18

Chapter 119 Wire and Electronic Communications Interception and Interception
of Oral Communications

Sections 2511 Interception and disclosure of wire, oral, or electronic
communications prohibited.
...
(2) (a) (i) It shall not be unlawful under this chapter for an operator of a
switchboard, or an officer, employee, or agent of a provider of wire or
electronic cummunication service, whose facilities are used in the
transmission of a wire communication, to intercept, disclose, or use that
communication in the normal course of his employement while engaged in any
activity which is a necessary incident to the rendition of his service or to
the proteciton of the rights or property of the provider of that srvice,
except that a provider of wire communication service to the public shall not
utilize service observing or random monitoring except for mechanical or
service quality control checks.

[Note "necessary incident".  Was it necessary?]

[or this may be the relevation section]

Chapter 121 Stored Wire and Electronic Communications and Transational
Records Access

Sections 2702. Disclosure of contents

(a) Prohibitions. -- Except as provide in subsection (b) --

(1) a person or entity providing an electronic communication service to the
public shall not knowingly divulge to any person or entity the contents of a
communication while in electornic storage by that srvice; and

(2) a person or entity providing remote computing servie to the public shall
not knowingly divulge to any person or entity the contents of any
communication which is carried or maintained on that service --

	(A) on behalf of, and received by means of electronic transmission
	from (or created by means of computer processing of communications
	received by means of electrnoic transmission from), a subscriber or
	customer of such service;

	(B) solely for the purpose of providing storage or computer
	processing services to such subscriber or customer, if the provider
	is not authorized to access the contents of any such communications
	for purpose of providing any service other than storage or computer
	processing.

(b) Exceptions.-- A person or entity may divulge the contents of a
communication --

	(1) to the addresses or intended recipient of such communication or
	an agent of such adddressee or intended recipient;

	(2) as otherwise authorized in section 2516, 2511 (2) (a), or 2703
	of this title;

[Note: 2516 and 2703 talk about warrants, 2511 is excerpted above.]

	(3) with the lawful consent of the originator or an addressee or
	intended recipient of such communication, or the subscriber in the
	case of a remote computing service;

	(4) to a person employed or authrized or whose facilities are used to forward such communication to its destination;

	(5) as may be necessary incident to the rendition of the service or
	to the protection of the rights or property of the provider of that
	service; or

	(6) to a law enforcement agency, if such contents --

		(A) were inadvertently obtained by the service provider; and

[inadvertent?????]

		(B) appear to pertain to the commission of a crime.

[How did messages appear to pertain to commission of a crime?  Would have to
see them to know.  Just who did this employee tell, it doesn't appear like
they were authorized to go to Borland at all even if they know that a crime
was being committed against them.  They would have to go to the authorities
first.]

COMMENTS

	Employees of service providers are definitely protected if they
access messages as part of their normal duties.  That brings up the question
of whether it is necessary as part of someones duties to read messages left
in someones account before it is deleted.  If that is in fact normal
procedure at MCI Mail, I would think that customers would like to know about
it and might be upset.  It's not clear what the penalties are for improper
disclosure by an employee as they are not directly listed.  The previous
section (not shown above) includes fines of $5000 and imprisonment up to 6
months for unlawful access if no commercial advantage occurs (much worse if
commercial advantage occurs), but says that conduct authorized by a provider
is excepted.  Very confusing.  Oh, another thing I found interesting was
there is a prohibiton of use in evidence of improperly intercepted wire or
oral communications, but electronic (computer) communications are not
mentioned in that section.  It would seem from my laymens reading that
although it might be illegal for an MCI employee to deliberately look for
incriminating mail if they found any it could still be used in court.
Particularily if you look at the last exception (6) above...  Anyone really
interested in these issues should probably obtain copies of the relevant
section of law and consult a lawyer who specializes in this area for
anything important.

				Bill Bogstad