The 9th Circuit Just Breezily Said Your Internet Data Has No 4th Amendment Protections

Privacy

from the that's-not-good dept

Earlier this week, law professor Orin Kerr raised an alert. The 9th Circuit appeals court had come out with a ruling in a case regarding the question of whether or not preservation requests counted as a seizure under the 4th Amendment, and basically said “nope.” As Kerr notes, this ruling effectively could allow the government to get all sorts of your data… on the basis of nothing at all.

As Kerr lays out, this could have massive ramifications, and it seems pretty clear that the three judge panel on the 9th Circuit didn’t quite realize what sort of precedent they were setting in the case.

To explain it, first it helps to understand what a preservation order is — and it’s basically what it sounds like. Law enforcement, as part of an investigation, can request preservation of any information held by an internet website — and the request basically requires the website to make sure that data is not deleted, and can be accessed if necessary. Law enforcement does this quite frequently, even if they never actually request the content itself (as you may recall, last year we received one such preservation letter in regards to an investigation into one of our comments).

In a law journal article in 2020, Kerr had actually put together a thorough explanation for why such preservation orders are covered by the 4th Amendment, and that “imposes significant limits” on such demands. In it, he laid out why ignoring the 4th Amendment for preservations is a big, big deal, and could easily lead to abuse:

Imagine you are an FBI agent. One day you receive an anonymous tip that a particular person has committed a crime. You go online and search for the person’s name, and your search reveals that, like most American adults, the person has a Facebook account. At this point, you only have an unverified tip. You lack reasonable suspicion, much less probable cause, to believe a crime was committed. And you have no particular reason to think the Facebook account was involved. But imagine federal law gave you the power to preserve and set aside the suspect’s entire Facebook account now—including every private message and every saved photo—just in case you later had the probable cause needed to access it.

Let me explain how this hypothetical law would work. At any time, you could command any Internet provider to save all of the contents of any account for up to 180 days. In response to your command, the provider would copy the entire account and set aside the copy for you without notifying the account holder. You would be unable to see the contents of the account unless you eventually develop probable cause and obtain a warrant. But you would have 180 days to develop probable cause. If no probable cause emerged, the preservation would end, and the provider would delete the saved copy without notifying the suspect. And if you developed probable cause during the 180-day period, you could get a warrant and compel the provider to hand over the contents of the account that had been previously preserved.

This hypothetical law would have obvious appeal for government investigators. A lot can happen in 180 days. The suspect might delete incriminating files. The suspect might get wise to the investigation and delete his online accounts to prevent the government from accessing them. By saving accounts at the beginning of a case, investigators could ensure that every record in existence at the outset is available if probable cause later develops. And it would all happen behind the scenes, as the provider would not disclose the preservation to the account holder. Even if the government eventually obtained a warrant and filed criminal charges, the preservation would not be disclosed during routine discovery. The entire process would remain secret.

Now back to this case at hand. The details are already gnarly. It involves the defendant Carsten Igor Rosenow, aka Carlos Senta, who was arrested, convicted, and sentenced to 25 years in prison for “engaging in sex tourism involving minors.” But, even such people have basic constitutional rights, and his lawyers argued that some of the data that law enforcement collected from Yahoo and Facebook was done without a warrant and violated the 4th Amendment.

There were a number of issues raised in the case, and the one that Kerr highlights appears to have been breezed over by everyone: both the lawyers and the judges. And that resulted in this line which appears kind of as an offhand or “obviously” kind of line:

A “seizure” of property requires “some meaningful interference [by the government,] with an individual’s possessory interests in [his] property.” Jacobsen, 466 U.S. at 113. Here, the preservation requests themselves, which applied only retrospectively, did not meaningfully interfere with Rosenow’s possessory interests in his digital data because they did not prevent Rosenow from accessing his account. Nor did they provide the government with access to any of Rosenow’s digital information without further legal process. It also is worth noting that Rosenow consented to the ESPs honoring preservation requests from law enforcement under the ESPs’ terms of use. Thus, we agree with the district court that these requests did not amount to an unreasonable seizure in violation of the Fourth Amendment.

As Kerr notes, this opinion states this in a matter of fact manner, with no analysis, no citations, no discussion at all. But it means that, if the government wants, it can simply order that everyone’s internet account be copied and held for future spelunking with absolutely no cause at all.

And you can argue that preservation is no big deal. By itself, that doesn’t give the government access to your data. But it’s not at all difficult to see how it gets out of hand. Beyond just the “preserve anything in case we need to sort through someone’s data at some later date” horror hypothetical, Kerr points out that this is now “the most important sentence in federal law on whether copying data is a seizure, holding that it isn’t.”

In other words, this no citation, no analysis paragraph is going to get cited a lot in ways that may create a powerful tool for the government to insist that it doesn’t need a warrant to get copies of your data.

And it gets worse. Because at the end of that paragraph the court effectively takes the already extremely problematic third party doctrine concept and extends it massively, by basically saying once you’ve signed a terms of service with a website you’ve effectively given up any privacy claim over any internet data.

At the very least, it seems like these issues could become precedent without any serious discussion or analysis. Unless the 9th Circuit reconsiders this and recognizes that maybe it was a little hasty, and a little overly broad, it seems like our “expectation of privacy” in regards to our data has suddenly changed.

Filed Under: 4th amendment, 9th circuit, orin kerr, preservation, surveillance, third party doctrine