Why Regulations Aimed At Technology Almost Always Suck: Or Why Reading Someone's Gmail Isn't Reading 'Stored Communications'

Privacy

from the don't-let-them-near-technology dept

There have been a couple of stories covering the fact that the South Carolina Supreme Court has ruled that reading someone’s Gmail does not violate the Stored Communications Act, a part of ECPA — a law we’ve written about a number of times for being completely out-of-date. Orin Kerr has a good breakdown of the details, if you want to read them. What struck me most, however, is how this case is a near perfect example of the kind of mess we get into when politicians try to regulate technology. Technology changes much, much, much faster than the law, and because of that, you get very silly results. The key issue here is that the Stored Communications Act is now found in 18 U.S.C. 2701 — and it defines the offense as occurring when someone “obtains, alters or prevents” access to communication “while it is in electronic storage.” Now, for the purpose of the law, “electronic storage” is defined over in 18 U.S.C. 2510, with the relevant definition noting:

“electronic storage” means–
(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and
(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication;

Got that? It must have seemed reasonable at the time it was written, but it makes little sense these days, and is apparently so misaligned with reality today that this one single case interprets that definition in three different ways, and exactly none of those ways agree with a 9th Circuit ruling in Theofel v. Farey-Jones. There’s disagreement over the meaning of “backup” in part (B) in particular. Is that backup for the user? Or for the service provider? And then, how do you figure out what is or what is not backup? If a person reads his or her Gmail account, then the message was copied to his or her local machine inside the browser. Thus, it seems reasonable to argue that the copy that remains on the server is a backup copy. But two of the judges in this case argued that because the recipient had not “downloaded” any other copies of the message to store, then the ones on the server were not “backups.” This makes little sense because copies were downloaded, but many non-technical people don’t understand how browsers really work.

Other judges focus on whether or not your webmail account is really “backup” for the ISP. Either way, the end conclusions: webmail is not considered “electronic storage” under the law for the purpose of the Stored Communications Act. While accessing someone’s email can (and likely does) still violate other laws, the very law that most people would probably think most directly applies, almost certainly does not.

The reality is that, when it was passed, back in 1986, it probably seemed to make sense that “stored communications” would only be done for backup. While there were networked client/server type setups at the time, it’s doubtful that the folks who wrote the law could have fathomed something like webmail or other online forms of communication. If we’re talking about “stored communications” today, it seems ridiculous to have it not cover web-based mail systems or social networks. But the law doesn’t seem to support that view — because the law is incredibly out-of-date. But, of course, the problem with fixing the law is that lawmakers will, again, have trouble figuring out where we’ll be just a few years out, and the law may either fail to cover what it thinks it covers or (perhaps worse) cover stuff that should be perfectly legal.

And this, of course, is what we fear when it comes to politicians meddling in technology. Even when they have the best of intentions, technology changes rapidly — and old and obsolete definitions get left in the law and can create problems or situations that make very little sense. If Congress were able to clean those up quickly, perhaps there wouldn’t be a problem, but Congress isn’t known for fixing real problems quickly. We’ve been hearing talk of fixing ECPA for years, and it seems unlikely to happen for a while.

Filed Under: email, regulations, stored communications, technology