OrinKerr.com

This is a very long blog post in response to a troubling new Fourth Amendment decision handed down by the Ninth Circuit yesterday, United States v. Ziegler. It’s a long post because the issues are both very important and very complicated, and the only way to show the problems with the decision is to do it in a fairly detailed way. I think the post is worth the payoff; the stakes of the case are potentially enormous, so the court’s wrong turn is worth explaining in depth.

First, some background. One of the tricky aspects of Fourth Amendment law is the distinction between the Fourth Amendment protection of government employees and private sector employees. The basic rule for the private sector is that employees have privacy rights at work unless their work space is completely open to the public, with the caveat that their employer can consent to a search of spaces that are not open to the public.

The rules for government employment are totally different, thanks to the Supreme Court’s somewhat odd decision in O’Connor v. Ortega. In that case, the Supreme Court created a sui generis, split-the-baby-in-half regime for government employee Fourth Amendment rights (announced in a plurality opinion by, you guessed it, Justice O’Connor). Under the O’Connor framework for government employee privacy, Fourth Amendment protections in the government workplace hinge on whether the workspace is shared with other employees, or whether the employer has enacted legitimate workplace policies that define privacy rights. The result is that government employees have much less Fourth Amendment protection than private sector employees, with the caveat that government employers cannot consent to a search while private sector employers can. (For more on this, and all the relevant case citations, see the chapter on it in the Justice Department manual on Searching and Seizing Computers that I wrote in ’99-’01.)

With that background in mind, it’s a little painful to read yesterday’s opinion by the Ninth Circuit in United States v. Ziegler. Ziegler was an employee of a company called Frontline Processing, described in the opinion as “a company that services Internet merchants by processing on-line electronic payments” in Bozeman, Montana. Ziegler downloaded some child pornography to his computer at work, and his employer, in an effort to help out the FBI, went into Ziegler’s office and copied his computer to give to the FBI. The computer contained child pornography, leading to charrges. Ziegler then filed a motion to suppress, arguing that he had a reasonable expectation of privacy on his workplace computer that was violated by the government-directed search.

The correct way to resolve this case would have been to say that of course Ziegler had a reasonable expectation of privacy in the contents of his private-sector office, see Mancusi v. DeForte, 392 U.S. 364 (1968), including the computer in his office. Then the court should have turned to whether the search was either a private search or else a reasonable warrantless search pursuant to the employer’s valid third-party consent. Unfortunately, however, it seems that no one realized that private-sector Fourth Amendment privacy rights are so different from public-sector Fourth Amendment privacy rights. The defense attorney apparently didn’t notice the difference, and it seems that the AUSA didn’t either. (I couln’t find the briefs on Westlaw, but the opinions summarize the parties’ positions.) And the failure to understand this basic distinction in Fourth Amendment law then worked its way up the line, with apparently no one stepping back and noticing that you couldn’t rely on the public sector Fourth Amendment cases to analyze whether a private-sector employee has a reasonbable expectation of privacy at work.

The unfortunate result is an opinion that makes a quite clearly incorrect conclusion that private-sector employees do not have a reasonable expectation of privacy in the workplace computers in their offices when the employer has access rights to the machine. The Court based its holding primarily by analogy to United States v. Simons, a Fourth Circuit case imvolving a federal government agency search:

In United States v. Simons, the case upon which the district court relied, the Fourth Circuit reasoned that an employer’s Internet-usage policy—which required that employees use the Internet only for official business and informed employees that the employer would “conduct electronic audits to ensure compliance,” including the use of a firewall— defeated any expectation of privacy in “the record or fruits of [one’s] Internet use.” 206 F.3d at 395, 398. A supervisor had reviewed “hits” originating from Simons’s computer via the firewall, had viewed one of the websites listed, and copied all of the files from the hard drive. Id. at 396. Despite that the computer was located in Simons’s office, the court held that the “policy placed employees on notice that they could not reasonably expect that their Internet activity would be private.” Id. at 398.
As the government suggests, similar circumstances inform our decision in this case. Though each Frontline computer required its employee to use an individual log-in, Schneider and other IT-department employees “had complete administrative access to anybody’s machine.” As noted, the company had also installed a firewall, which, according to Schneider, is “a program that monitors Internet traffic . . . from within the organization to make sure nobody is visiting any sites that might be unprofessional.” Monitoring was therefore routine, and the IT department reviewed the log created by the firewall “[o]n a regular basis,” sometimes daily if Internet traffic was high enough to warrant it. Upon their hiring, Frontline employees were apprised of the company’s monitoring efforts through training and an employment manual, and they were told that the computers were company-owned and not to be used for activities of a personal nature. Ziegler, who has the burden of establishing a reasonable expectation of privacy, presented no evidence in contradiction of any of these practices. Like Simons, he “does not assert that he was unaware of, or that he had not consented to, the Internet [and computer] policy.” Simons, 206 F.3d at 398 n.8.

There are a bunch of problems in this section. To begin with, this is a very unpersuasive reading of Simons. The court conveniently doesn’t mention this, but in Simons the Fourth Circuit held that the employee did have a reasonable expectation of privacy that was violated by physical entry to the office to get the physical machine. The court only permitted the search of the computer after holding that it was a reasonable search under the “special needs” exception as adopted by O’Connor v. Ortega. The part mentioned above was only about remote monitoring that preceded the physical entry. Here’s what the Simons court said about the phsyical entry to Simons’ office:

Here, Simons has shown that he had an office that he did not share. As noted above, the operational realities of Simons’ workplace may have diminished his legitimate privacy expectations. However, there is no evidence in the record of any workplace practices, procedures, or regulations that had such an effect. [FN: The Internet policy did not render Simons' expectation of privacy in his office unreasonable. * * * ] We therefore conclude that, on this record, Simons possessed a legitimate expectation of privacy in his office.

Simons, 206 F.3d at 399.

The Ziegler court seems to say in a footnote that this case is different because it involved a computer. In footnote 9, the court suggests that entering the office to search a computer is a search of the computer but not a search of the office. (“Although an employee may have a legitimate expectation of privacy in his office, here the Frontline employees did not actually search Ziegler’s office.”) This makes no sense, as everything in an office is an item separate from the office; if this rationale were valid, then you could never search an office, just stuff in an office.

But I digress, so let me get back to the really important stuff. The Ziegler court seems unconcerned that Simons was a government search decided under O’Connor v. Ortega, rather than a private sector search that should be analyzed under Mancusi v. DeForte. So the Court makes its (unpersuasive) analogy to a decision that rested on the framework of government employee rights, apparently applying the low-protection government framework to what used to be the higher-protection private-sector framework. The end-result: the relatively high level of protection that private sector employees have in their computer hard drives are dropped to the low level of protection that government employees have. Not good.

There is one paragraph in the Zeigler opinion that at least suggests an awareness that there might be some difference between public and private employee Fourth Amendment rights. Here it is:

Other courts have scrutinized searches of workplace computers in both the public and private context, and they have consistently held that an employer’s policy of routine monitoring is among the factors that may preclude an objectively reasonable expectation of privacy. See Biby v. Bd. of Regents, 419 F.3d 845, 850-51 (8th Cir. 2005) (holding that no reasonable expectation of privacy existed where a policy reserved the employer’s right to search an employee’s computer for a legitimate reason); United States v. Thorn, 375 F.3d 679, 683 (8th Cir. 2004), cert. granted and judgment vacated on other grounds by 543 U.S. 1112 (2005) (holding that a public agency’s computer-use policy, which prohibited accessing sexual images, expressly denied employees any personal privacy rights in the use of the computer systems, and provided the employer the right to access any computer in order to audit its use, precluded any reasonable expectation of privacy); United States v. Angevine, 281 F.3d 1130, 1133-35 (10th Cir. 2002) (holding that the employer’s computer-use policy, which included monitoring and claimed a right of access to equipment, and the employer’s ownership of the computers defeated any reasonable expectation of privacy); Muick v. Glenayre Electronics, 280 F.3d 741, 743 (7th Cir. 2002) (“Glenayre had announced that it could inspect the laptops that it furnished for the use of its employees, and this destroyed any reasonable expectation of privacy . . . .”); Wasson v. Sonoma County Jr. Coll. Dist., 4 F. Supp. 2d 893, 905-06 (N.D. Cal. 1997) (holding that a policy giving the employer “the right to access all information stored on [the employer’s] computers” defeated an expectation of privacy).

Notably, however, almost all of the cases in this strong cite are public sector cases, not private sector cases. The one private sector case on the list is Judge Posner’s opinion in Muick v. Glenayre Electronics. But Muick is a bit of an analytical disaster. Here is an excerpt from a case summary I wrote on the case soon after it came out:

With all due repect to Judge Posner, his breezy opinion largely ignores the applicable law on several fronts, and although he reaches the right result, he does so for the wrong reasons. First, Posner gets the agency inquiry pretty clearly wrong. The FBI’s request for the store to hold the computer on its behalf almost certainly makes the store a state actor for 4th Amendment purposes: the fact that the employer was acting “selfishly” doesn’t mean it wasn’t acting at the FBI’s behest.

Second, Posner ignores the fact that all of the cases he relies on for his third rationale are government employment cases, and that the store was not a government employer. The Supreme Court in O’Connor v. Ortega created a special 4th Amendment standard for the government workplace, and under that standard notice alone can eliminate a “reasonable expectation of privacy.” However, these cases aren’t applicable to private employers such as the store, so notice alone should not be enough to eliminate privacy rights there.

* * * [T]he court should have stopped after the first rationale and not offered confusing and misleading alternative holdings on the Fourth Amendment when it didn’t need to do so to resolve the case.

Finally, just to add to the confusion here, the Ziegler court has a long discussion analyzing and ultimately endorsing a California appellate court decision, TBG Ins. Services Corp. v. Superior Court, 117 Cal. Rptr.2d 155, 96 Cal.App. 4th 443 (Cal. Ct. App.2002), which had a long involved discussion of expectations of privacy and social norms in computers. But the Ziegler opinion once again seems not to notice a doctrinal category error: the TBG Ins. Services Corp. case is not a Fourth Amendment opinion. Rather, it is a decision under Article I, section I, of the California Constitution, which provides: “All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” It turns out that the California courts use the “reasonable expectation of privacy” framework in that context, too, but it seems to have a different meaning than the same phrase has in the Fourth Amendment context. (This is not uncommon, actually. The phrase “reasonable expectation of privacy” is used in the context of privacy torts, as well as in the legal ethics area in the context of attorney-client privilege, and it has a different meaning in each context. As a result, you can’t lift the interpretation of “reasonable expectation of priuvacy” from one context and use it in another context.)

Okay, so by now you’re wondering, what difference does it make? If you analyze this case under the private-sector framework, you still will reach the same result because the employer had “common authority” to search the computer, right? Off the top of my head, yes, I think that’s right. But the framework announced in Ziegler will still make an enormous difference in lots of other cases. Under the Fourth Amendment, private-sector employees have traditionally enjoyed Fourth Amendment protection in the contents of their offices, including in their office computers. The police can’t just barge in to your office and rifle through your desktop computer. Instead, the police need either to get a warrant or to go your employer and ask for the employer’s permission to conduct the search. But if private-sector employees have no reasonable expectation of privacy in the hard drives of their office computers, it means that the police don’t need to get the boss’s permission first. The police can pick an office known to have a computer access policy and simply barge in and grab any computers they want. And they can do this even over the objection of all the employees and the boss. The boss might have a civil claim against the government, but the employee won’t have any rights at all; under the Ziegler opinion, the employee has no reasonable expectation of privacy in the contents of his computer.

The Supreme Court created a special framework for public-sector searches because in that context there’s no Fourth Amendment difference between the boss and the police: they’re all “the government” for Fourth Amendment purposes. But I think it’s important not to let that different framework created for the specific needs of public-sector workplaces bleed over into the private sector. As tricky as these doctrinal distinctions are (and they really are pretty tricky, I think), a great deal of privacy protection hinges on keeping them straight.

Senator Specter’s bill on the NSA domestic surveillance program has been much in the news lately, but there is a very important part of the bill that hasn’t been covered much: the bill’s changes to the definition of the key terms in FISA. Based on my study of the bill, it seems that the Specter bill would bring changes to several of the basic principles of FISA that would considerably alter the law’s scope. In this post, I’d like to review some of those changes I’ve found and suggest what they might mean for the scope of government surveillance powers in national security cases.

First, some background. The basic idea of FISA is that it requires the Executive Branch to get a warrant to conduct “electronic surveillance,” and permits the government to get a long-term, lower-threshold monitoring order when it is monitoring “an agent of a foreign power” (such as a foreign spy). So the most basic questions under FISA are what is “electronic surveillance,” and who is an “agent of a foreign power”? These definitions are found in Section 101 of FISA, codified at 50 U.S.C. 1801.

Under the current version of FISA, “electronic surveillance” is quite broad, and “agent of a foriegn power” is relatively narrow. As a result, FISA imposes a fairly comprehensive regulatory scheme over national security surveillance.

It’s kind of hard to explain this without some details, so here are the details. (If you want to skip to the punchline, scroll down a bit.) Here is the statutory definition of electronic surveillance:

“Electronic surveillance” means—
(1) the acquisition by an electronic, mechanical, or other surveillance device of the contents of any wire or radio communication sent by or intended to be received by a particular, known United States person who is in the United States, if the contents are acquired by intentionally targeting that United States person, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes;
(2) the acquisition by an electronic, mechanical, or other surveillance device of the contents of any wire communication to or from a person in the United States, without the consent of any party thereto, if such acquisition occurs in the United States, but does not include the acquisition of those communications of computer trespassers that would be permissible under [the Wiretap Act]
(3)the intentional acquisition by an electronic, mechanical, or other surveillance device of the contents of any radio communication, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes, and if both the sender and all intended recipients are located within the United States; or (4)the installation or use of an electronic, mechanical, or other surveillance device in the United States for monitoring to acquire information, other than from a wire or radio communication, under circumstances in which a person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes.

“Contents” are in turn defined as “any information concerning the identity of the parties to such communication or the existence, substance, purport, or meaning of that communication.”

An “agent of a foreign power” is defined as follows:

“Agent of a foreign power” means—

(1) any person other than a United States person, who— (a) acts in the United States as an officer or employee of a foreign power, or as a member of a foreign power as defined in subsection (a)(4) of this section; (B) acts for or on behalf of a foreign power which engages in clandestine intelligence activities in the United States contrary to the interests of the United States, when the circumstances of such person’s presence in the United States indicate that such person may engage in such activities in the United States, or when such person knowingly aids or abets any person in the conduct of such activities or knowingly conspires with any person to engage in such activities; or

(2) any person who— (A) knowingly engages in clandestine intelligence gathering activities for or on behalf of a foreign power, which activities involve or may involve a violation of the criminal statutes of the United States;
(B) pursuant to the direction of an intelligence service or network of a foreign power, knowingly engages in any other clandestine intelligence activities for or on behalf of such foreign power, which activities involve or are about to involve a violation of the criminal statutes of the United States ;
(C) knowingly engages in sabotage or international terrorism, or activities that are in preparation therefor, for or on behalf of a foreign power;
(D) knowingly enters the United States under a false or fraudulent identity for or on behalf of a foreign power or, while in the United States, knowingly assumes a false or fraudulent identity for or on behalf of a foreign power; or
(E) knowingly aids or abets any person in the conduct of activities described in subparagraph (A), (B), or (C) or knowingly conspires with any person to engage in activities described in subparagraph (A), (B), or (C).

So what does this all mean, in plain English? Well, the basic idea is that the government can’t monitor content or non-content information about people in the U.S. without a court order, and it can only get a long-term monitoring order to monitor people if there’s probable cause to beliebve they are spies or members of terrorist groups.

That’s the current law, at least, which is pretty much what we’ve had for the last 30 years or so. But check out what the Specter bill would do to the basic definitions of FISA. The changes appear at page 25, the beginning of Section 9 of the latest draft. First, the existing 4-part definition of “electronic surveillance” is eliminated, and replaced with this shorter and also narrower definition:

(f) electronic surveillance means –
(1) the installation or use of an electronic, mechanical, or other surveillance device for the intentional collection of information concerning a particular known person who is reasonably believed to be in the United States by intentionally targeting that person under circumstances in which that person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes; or
(2) the intentional acquisition of the contents of any communication under circumstances in which that person has a reasonable expectation of privacy and a warrant would be required for law enforcement purposes, and if both the sender and all intended recipients are located within the United States.

(Note that all of the definitions of the Specter bill are as transcribed my me as the version of the latest text has cut-and-paste functions disabled. So errors in transcription are possible.)

The definition of contents is changed, as well: instead of “any information concerning the identity of the parties to such communication or the existence, substance, purport, or meaning of that communication,” the Specter bill would borrow the Wiretap Act’s definition, “any information concerning the substance, purport, or meaning of that communication,” excluding information that merely contains the identity of the parties and the existence of the communication.

Finally, the definition of “agent of a foreign power” is amended, too, so that it includes a non-U.S. person — that is, someone other than a U.S. citizen or permanent resident alien — who “otherwise possesses or is expected to transmit or receive foreign intelligence information inside the United States.”

So what does this all mean? Well, to me it says that these are some pretty important changes. Start with the change in the definition of “agent of a foreign power.” That used to mean a spy or terrorist, and the government needed probable cause to believe that the bad guy was in cahoots with a foreign government or terrorist organization to get the monitoring order. The Specter bill would bring a much broader approach: as long as the person is not a U.S. citizen or permanent resident alien, the fact that some one is expected to receive foreign intelligence info — that is, info about national security threats or about foreign governments — would be enough to treat them as agents of a foreign power. You can see why this would make an enormous difference in an era of easily-forwarded Internet communications: the government could follow the trail of data, and could start monitoring the folks who were along the trail so long as they were not U.S. citizens or permanent resident aliens. Maybe this is a good idea, and maybe it’s a bad idea. Either way, it strikes me as a pretty important change.

The changes to the definition of “electronic surveillance” are even more important. Part of the changes are presumably needed to authorize the NSA program; much of the program would seem to be excluded from the definition of “electronic surveillance.” But more broadly, note that under the new definition, monitoring does not constitute electronic surveillance if a) the person monitored has no Fourth Amendment “reasonable expectation of privacy” or b) no warrant would be required to conduct that monitoring in the criminal context.

This explicit incorporation of Fourth Amendment law as the sole test of the statute is troubling, I think, because the Fourth Amendment standards for electronic surveillance are tremendously murky right now. For example, courts have held that you don’t have a reasonable expectation of privacy in calls to or from cordless phones, and they have used reasoning that would also appear to apply as well to cell phone calls. (You have statutory privacy protection, which is much stronger than constitutional protection, but not constitutional protections.) If you don’t have a reasonable expectation of privacy in your cell phone calls, which those cases suggest is the case, Specter’s bill would mean that the NSA can tap every cell phone in the country of every US citizen, for entirely domestic calls, all without a warrant. This monitoring wouldn’t be “electronic surveillance” because (based on the cordless phone cases) the Fourth Amendment doesn’t apply.

Similarly, right now it’s really uncertain whether one can have a reasonable expectation of privacy in your e-mail, and if so, when such protection exists. (Again, there is statutory protection, but constitutional protection is really uncertain.) Some scholars suggest that there is such protection, others suggest there isn’t; as a matter of doctrine, the answer is essentially unknown. But if the statutory standard hinges on constitutional protection, and it may be that there isn’t any constitutional protection at all, then it may be that there is no statutory protection either. And since the government’s applications are secret, we wouldn’t know it.

What would happen, I would assume, is that DOJ and the FISA court judges would reach some kind of understanding about how the Fourth Amendment applies to these new technologies. But no one else would get to know what that understanding is, and as a result no one else would know how the law actually would apply. (Some of this presumably happens now, as parts 1, 3, and 4 of the current definition incorporate this approach: but under current law, part 2 is the broader definition, and does not incorporate the Fourth Amendment standard.)

In sum, my sense is that the Specter bill would make some pretty significant changes to some of the basic principles of FISA. Some of the changes may be good, others bad, and some are just quite uncertain (a constant problem with FISA, as it’s hard for outsiders to get an accurate feel for the impact of specific legislative reforms on secret monitoring). But however you look at it, it’s pretty clear that the Specter bill does a lot more than just subject the NSA program to constitutional review. That’s my sense of it, at least; if you think my analysis is off, please let me know.

(cross posted at the Volokh Conspiracy)