• Are E-mail Messages Protected By The Fourth Amendment?
• Who Wants To Sue A Multi-Billionaire: Google's Risky Venture Into YouTube

New technology inevitably throws a wrinkle into the legal industry.  The advent of electronic written communication is revolutionizing several areas of the law.  The ease of quick and efficient interaction with others that is inherent with electronic mail has caused the amount of potential evidence in legal matters to skyrocket.  As a result, access to these potential treasure troves during Government investigations has become an important issue.  It is common knowledge that the Fourth Amendment provides protection against certain searches and seizures.  What protections, however, apply to electronic mail?

Prosecutors have relied on the Electronic Communications Privacy Act (“ECPA”) since its enactment in 1986 to answer this question.  The Sixth Circuit, however, recently issued a decision limiting the Government’s power under a narrow, but important, section of this statute by finding in Warshak v. United States, 2007 U.S. App. LEXIS 14297 (6th Cir. June 18, 2007), that e-mail account holders can possess a reasonable expectation of privacy in the content of their personal e-mail messages.

The issue in Warshak implicated Title II of the ECPA, known as the Stored Communications Act (“SCA”).  The SCA establishes particular procedures that must be followed before a governmental entity may compel an internet service provider (“ISP”) to produce contents of electronic communications that have been “stored.”  If electronic communications have been unopened for 180 days or less, then the SCA requires that the governmental entity obtain a search warrant.  18 U.S.C. S2703(a).   If electronic communications have been unopened for more than 180 days or have been opened, then a more complex, but less onerous, set of rules apply.  In those situations, the Government must use a search warrant, issue an administrative subpoena, or obtain a court order.  18 U.S.C. S2703(b).  The Government must meet the familiar standard of probable cause for search warrants.  In contrast, the Government needs only to meet a general reasonableness standard to pursue a court order under the SCA.  18 U.S.C. S2703(d).

Of great importance is whether or not the account holders of the e-mail messages to be seized are given notice of the Government’s access to these electronic communications.  Under the SCA, an ISP is allowed to notify affected customers that it has received a subpoena or court order.  The Government is normally required to give notice to these customers, though if it proceeds via a court order, it can, under certain circumstances, delay its notice and prohibit the ISP from notifying the affected customers. 18 U.S.C. S 2705.  Prosecutors have historically used the delayed notice provisions of the SCA to their advantage.  The Electronic Frontier Foundation, an organization responsible for one of two amici curiae briefs filed in Warshak, noted in a statement released after the Sixth Circuit’s decision that “[o]ver the last 20 years, the government has routinely used the [SCA] to secretly obtain stored e-mail from e-mail service providers without a warrant.”  See <http://www.eff.org/news/archives/2007_06.php#005321 >.

The delayed notice provision of the SCA, and its tension with the protections guaranteed by the Fourth Amendment, troubled the Sixth Circuit.  In June 2007, the Sixth Circuit issued its landmark decision in Warshak, affirming the entry of a preliminary injunction prohibiting the Government from seizing the contents of personal e-mail accounts maintained by ISPs without providing the affected customer prior notice and an opportunity to be heard.  The Sixth Circuit held that the Government cannot seize the content of e-mail messages maintained by an ISP pursuant to a court order unless it makes a fact-specific showing that the affected customer did not maintain an expectation of privacy with respect to the ISP.

In Warshak, the Government, while conducting a criminal investigation of Warshak and his company, obtained court orders directing two ISPs to disclose Warshak’s e-mail account information, including contents of e-mail messages.  The orders were under seal and prohibited the ISPs from notifying Warshak of the investigation unless authorized by the court.  When the Government finally disclosed the investigation, Warshak sued and alleged that the compelled disclosure of the content of his e-mail messages without a warrant violated his Fourth Amendment rights and the SCA.  When the Government refused to provide assurances that it would not seek additional orders, Warshak moved for a preliminary injunction prohibiting future searches.  The district court found in favor of Warshak and issued a preliminary injunction.  The Government appealed this injunction, challenging the district court’s decision on several grounds, including its finding that e-mail users maintained a reasonable expectation of privacy with regard to the content of their e-mail messages.

The Sixth Circuit began its analysis by noting that the primary reason that compelled disclosures, such as subpoenas and court orders under the SCA, are subject to the lower standard of reasonableness is because these disclosures can be contested in court prior to compulsion.  The court cautioned that the owner of an e-mail account who was the subject of a compelled disclosure would have the right to challenge a compelled disclosure only if he or she held a “legitimate expectation of privacy” with regard to the content of the e-mail messages.  As a result, the court explained that it was necessary to determine whether an e-mail account holder possessed an expectation of privacy with respect to the actual entity that was being compelled to produce the content of his or her account.  In Warshak, that entity was Warshak’s ISP.

The Sixth Circuit found that e-mail account holders generally possess a reasonable expectation of privacy with respect to their ISPs.  It noted that a person sending an e-mail message would not have such an expectation as to the recipient of the message because the sender assumes the risk of disclosure by the recipient.  With respect to the ISP, however, a person sending an e-mail message usually expects that the ISP will not access the contents of the e-mail message.  The Court analogized its decision to established forms of communication, reasoning that there was no expectation of privacy when information was disclosed to a recipient of a letter or the person receiving a telephone call, but that there was with regard to employees of the post office or telephone company through which the communication traveled.

The court rejected two key arguments advanced by the Government regarding privacy in e-mail accounts.  It found that general language in ISP user agreements that reserved the right of an ISP to access the content of e-mail messages in limited circumstances did not extinguish a user’s general expectation of privacy.  Further, the Court reasoned that the practice of scanning e-mail messages for viruses or child pornography did not diminish the expectation of privacy because these were automated processes as opposed to human review of the content of e-mail messages.

The Sixth Circuit contrasted Warshak’s situation from prior cases that dealt with electronic documents.  It distinguished Guest v. Leis, 255 F.3d 325 (6th Cir. 2007), which held that users of electronic bulletin boards did not have an expectation of privacy in the material posted on the board.  It also took notice of the Fourth Circuit decision, United States v. Simons, 206 F.3d 392 (4th Cir. 2000), which held that a reasonable expectation of privacy did not exist for an employee’s computer files if the employer had a policy that explicitly notified the employee of its intention to audit, inspect, and monitor computer files.  The Sixth Circuit explained that in the context of e-mail, if an ISP required a user agreement that explicitly provided that e-mail messages would be monitored or audited and the ISP actually performed these actions, then the account holder may not hold a reasonable expectation of privacy.

The court concluded that because an expectation of privacy usually attaches to e-mail messages, notice to account holders that their e-mail messages are being disclosed is essential in protecting their Fourth Amendment rights.  To this effect, it issued an injunction prohibiting the seizure of personal e-mail pursuant to a court order issued under the SCA “without either (1) providing the relevant account holder or subscriber prior notice and an opportunity to be heard, or (2) making a fact-specific showing that the account holder maintained no expectation of privacy with respect to the ISP, in which case only the ISP need be provided prior notice and an opportunity to be heard.”  Warshak, 2007 U.S. App. LEXIS 14297 at *69.

The Warshak decision appears to be the first to address the issue of whether or not e-mail users hold a constitutional right to privacy in the content of their e-mail messages when a court order is issued to an ISP.  Some practitioners have criticized the decision because the Sixth Circuit relied heavily on cases decided under Title I of the ECPA, which deals with communications in transit, as opposed to Title II, which pertains to stored communications.  This distinction may not prove to be meaningful because, ultimately, the Sixth Circuit held that the Constitution afforded protection to e-mail account holders in addition to the protections already in the SCA, even if the targeted e-mail messages are older than 180 days.  As Warshak is grounded in constitutional requirements, the specifics of statutory interpretation are not likely to change its reception.

Warshak’s impact on computer surveillance may be far-reaching, although it remains to be seen how other circuits will react.  Decisions from other courts suggest that Warshak has the potential to fit into the framework regarding discovery of electronic documents.  For example, the Ninth Circuit recently joined other pioneering courts in establishing the constitutional boundaries of computer surveillance techniques.  See United States v. Forrester, 2007 U.S. App. LEXIS 17626 (9th Cir. July 25, 2007).  The Ninth Circuit in Forrester held that “computer surveillance techniques that revealed the to/from address of e-mail messages, the IP addresses of websites visited and the total amount of data transmitted to or from an account” were outside the scope of the Fourth Amendment.  Forrester, 2007 U.S. App. LEXIS 17626 at *18.  The court analogized seizure of this type of information to those of pen registers or examinations of the outside of sealed envelopes.  Id.  The Ninth Circuit made clear that its “holding extend[ed] only to these particular techniques and [did] not imply that more intrusive techniques or techniques that reveal more content information are also constitutionally identical to the use of a pen register.”  Id. at *23 (emphasis added).

Federal courts addressing the privacy interests relevant to electronic mail will continue to flesh out the parameters of the protections afforded to such communications.  The below chart illustrates some of the current boundaries, in light of Warshak and Forrester:

The Warshak decision is important in that it may reflect an acceptance of the common usage of e-mail messages as a private form of communication not subject to external eyes.  Attorneys, and their clients, have witnessed this reality as a result of reviews of employees’ electronic communications necessitated by Government subpoenas or civil discovery requests.  The proliferation and contents of these electronic messages illustrate that people do not expect their e-mail messages to be reviewed by unintended recipients.

The Sixth Circuit’s decision underscores for employers the importance of examining their electronic communications policies.  Employers should evaluate their policies with an eye towards both providing adequate notice to employees regarding limitations on privacy and actually monitoring electronic mail.  These procedures could mitigate against potential privacy lawsuits.  Further, companies need to carefully consider subpoenas and other requests for employees’ electronic communications in light of these pitfalls – it should not be assumed that an employer can produce these without informing employees.

In contrast, commercial ISPs may want to take advantage of the protections afforded by the Warshak ruling.  ISPs could tailor their user agreements to provide the most protection to the privacy expectations of their customers and market this protection. An additional implication is the protection afforded under the attorney-client privilege for e-mail messages sent by attorneys to clients that contain privileged information.  With the Warshak ruling, the recognized privacy expectation likely bolsters the protections of the privilege.  The flip side of this issue, however, is that attorneys need to be careful that they do not send privileged information through an ISP with policies that serve to extinguish any reasonable expectation of privacy.  If the provider is a law firm, then the privilege could reasonably attach to the entire firm.  If the provider is a commercial provider, then the attorney should be mindful of the potential destruction of the privilege.

There is a chance that the Sixth Circuit’s ruling may not stand the test of time in the rapidly evolving digital age.  Other courts may distinguish between electronic mail sent through standard means and electronic mail that is encrypted.  Most people who have used the internet for shopping or financial transactions have been bombarded with warnings that the internet is not secure.  Encryption offers a means to secure electronic communication and send a clear signal that an individual expects privacy.  Such a distinction would be significantly narrower than the holding in Warshak.

These outstanding questions will be the subject of many legal debates, from private client conferences to law school symposia, until additional cases work their way up through the courts.  It remains to be seen whether other courts will follow the Sixth Circuit’s lead.

back to top

Introduction

Shortly before Google bought YouTube for $1.65 billion, Internet entrepreneur Mark Cuban said that only a "moron" would purchase YouTube as he thought it would be "sued into oblivion" because of copyright violations. Cuban felt that the only reason YouTube had not been used by major content providers was because there were no deep pockets to go after. All of that changed when Google stepped up to the plate. Google has acknowledged rumors that it set aside approximately $200 million of the YouTube purchase price to cover legal defenses of the site. The question facing Google is whether that will be enough.

Most content providers have decided to play nice with Google by signing licensing deals to allow their content to be hosted on YouTube in exchange for a share in the revenue generated from ads associated with the content. Yet other major content providers are unable to sue YouTube due to their ownership of sites that do exactly what YouTube is doing, such as News Corp., which owns MySpace. A ruling adverse to YouTube could vastly affect MySpace and numerous other sites which allow users to post content. However, in March 2007, Viacom became the first major content producer to sue YouTube, the second lawsuit filed against the most popular video-sharing site on the web. The first suit, inherited by Google, was filed by Robert Tur of the Los Angeles News Service before the purchase.

Tur v. YouTube

Tur filed suit against YouTube seeking removal of his copyrighted videos of the beating of Reginald Denny and the OJ Simpson car chase. He also sought damages on the ground that YouTube intentionally induces copyright infringement, relying primarily on Supreme Court's decision in Grokster. Metro-Goldwyn-Mayer Studios, Inc. v. Grokster, Ltd., 125 S. Ct. 2764 (2005). In Grokster, the Supreme Court held that if a company distributes a product with the object of promoting its use to infringe copyrights, as shown by clear expression or other affirmative steps taken to foster infringement, then the company can be liable.

Viacom v. YouTube

Viacom sued YouTube after Viacom and YouTube could not come to an agreement over splitting advertising revenues generated from ads posted next to Viacom's content posted by YouTube's users. Viacom then inked a deal with one of YouTube's competitors, Joost, to host Viacom's content. Google's CEO Eric Schmidt has reportedly called the lawsuit a negotiating tactic by Viacom. If this is true, then perhaps the lawsuit will not go to trial. Viacom contends that 150,000 unauthorized clips of its programming from such shows as "South Park," "SpongeBob SquarePants," "The Colbert Report," and "The Daily Show" have been viewed illegally on YouTube no fewer than 1.5 billion times. Viacom's suit seeks $1 billion in damages from YouTube, a staggering amount if Viacom wins. If Viacom does win, then the litigation floodgates will open, making Cuban's "moron" comment a vast understatement from someone who is not generally known for his understatements.

Application of the DMCA

The key issue in both lawsuits is whether YouTube falls under the protection of one of the Digital Millennium Copyright Act's ("DMCA") safe harbors. The safe harbors were enacted to limit the liability of online service providers for copyright infringement. The rationale behind the DMCA safe harbors is to protect online service providers (OSPs) from secondary copyright infringement liability so they do not have to monitor each individual user's expression. For the most part, the DMCA has been successful, allowing sites like Hotmail and Yahoo! to function without having to screen each email sent through their systems. Tur and Viacom are betting that YouTube's actions make it ineligible for safe harbor protection.

To qualify for safe harbor protection, YouTube must jump through certain hoops and comply with requirements set up by the DMCA. 17 U.S.C. S 512(c)(1)(B). First, the safe harbor only provides protection if the content is stored at the direction of a user. As YouTube's content is uploaded by its users, it meets this first requirement.

Second, YouTube must adopt and reasonably implement a policy for terminating users who are repeat infringers. YouTube has such a policy in its terms and conditions. YouTube defines a repeat infringer as a user "who has been notified of infringing activity more than twice and/or has had a user submission removed from the Website more than twice." This policy, however, is not the saving grace it was intended to be for copyright holders. It is easy for savvy Internet users to create numerous (even limitless) additional or anonymous identities to circumvent such policies.

Third, YouTube must designate an agent with the U.S. Copyright Office that will receive the "take down" notices from copyright owners requesting removal of infringing material. YouTube has registered with the U.S. Copyright Office. Upon receiving proper notice of an infringement, YouTube must respond quickly to remove the material, which it does.

Generally, an OSP that complies with the first three requirements can push the burden to police infringements onto the content owners by forcing them to file take down notices. However, Tur and Viacom allege that YouTube is not complying with the remaining portions of the safe harbor requirements: (1) YouTube must not have actual knowledge that the material on its site is infringing, and in the absence of such actual knowledge, YouTube cannot be aware of facts or circumstances from which infringing activity is apparent; and (2) YouTube must not "receive a financial benefit directly attributable to the infringing activity" if it has the right and ability to control such activity.

These last two issues are critical for YouTube. YouTube's position is that it does not monitor what its users post and therefore it cannot have actual knowledge of what is on its system. Generally, YouTube relies on users to police infringements and does not currently have filtering mechanisms to ensure copyrighted materials are not posted. Once YouTube receives actual notice, through the filing of a take down notice, it acts within the DMCA to expeditiously remove the infringing content. YouTube also argues that it does not receive a financial benefit directly attributable to the infringing activity, primarily because its site contains a large amount of content that does not infringe third party rights.

Tur's Position on the DMCA

Tur's lawsuit asserts that YouTube intentionally induces infringement because it derives a substantial benefit from the hosting of numerous copyright infringements. Tur argues that YouTube has actual knowledge of what particular copyrightable material is on its site. Tur further argues that even though YouTube allows for non-infringing uses, it is "intended to promote infringement of copyrighted works" and, paraphrasing the Grokster decision, is aimed at a "known source of demand for copyright infringement, e.g., the market comprised of former Grokster video 'sharers."'

Tur points out that YouTube has not developed or implemented any substantial filtering tools or other mechanisms to diminish the infringing activity. Tur argues that this failure, and its known perception as a "bootleg-heavy site," puts YouTube squarely in the same boat as Grokster. Tur submits that YouTube's advertising sales generate revenue based on infringing activity and relies on infringing material to increase users, which in turn generates greater advertising revenue.

In November 2006, Tur filed a Motion for Summary Judgment on YouTube's First Affirmative Defense that YouTube qualifies for safe harbor protection. Tur's motion argues that, as a matter of law, YouTube receives a financial benefit in the form of banner advertising directly attributable to the infringing video clips. This, coupled with Tur's argument that YouTube admits in effect that it "has the right and ability to control such [infringing] activity" within the meaning of S512(c)(1)(B) by virtue of its online User Agreement, renders YouTube incapable of DMCA safe harbor protection. Tur argues that the functionality of YouTube's service (namely, the manipulation, categorization, sorting, embedding, and promotion of audiovisual clips uploaded by its users) shows the level of control YouTube has over its users' actions.

Viacom's Position on the DMCA

Viacom's lawsuit alleges vicarious infringement, contributory infringement, and liability for the intentional inducement of copyright infringement. Viacom's suit also raises claims of direct infringement by YouTube on the ground that the infringing content resides on YouTube's servers from which users can request, embed, and view the infringing videos, all of which violate Viacom's exclusive rights of public display and reproduction under the Copyright Act. Tur's suit did not raise such a claim. YouTube has been quick to point out that it took down Viacom's materials after Viacom asked it to do so. However, it has been reported that the videos were reposted almost immediately, highlighting Viacom's frustration with the DMCA placing the burden to police the site on the copyright owner and not YouTube.

Like Tur, Viacom argues in its complaint that YouTube is a brazen copyright infringer that it is knowingly "exploiting the infringing potential of digital technology" on a massive scale. Based on the large volume of infringing works, Viacom alleges that there is no way that YouTube cannot be aware that its users violate copyrights through YouTube's service, and that YouTube actually encourages and induces users to do so. Viacom's lawsuit alleges that if "the public knows what's there, then YouTube's management surely does." Thus, YouTube is essentially turning a blind eye to the infringement on its site in an effort to maintain a semblance that its qualifies for DMCA safe harbor protection. This seems like a compelling argument in light of the numerous complaints filed by various rights organizations and companies from around the world. In response to complaints from organizations and companies such as the Japan Society for Rights of Authors, Composers and Publishers, the German Society for Musical Performing and Mechanical Reproduction Rights, Universal, the NFL, among others, YouTube has removed the objectionable material.

Like Tur, Viacom also argues that YouTube receives a direct financial benefit attributable to the infringing activity. The question regarding this issue is the definition of the term "direct." It is unclear how "direct" the financial benefit must be for YouTube to be liable. Similar to the allegations in the Grokster case, Viacom alleges that YouTube uses the infringing content to increase traffic to the site, thereby increasing YouTube's revenue from ads placed next to the infringing videos. Currently, YouTube displays little advertising. However, like much of Google's empire, it plans on pursuing advertising as its business model and is exploring a range of possibilities, including sponsorships, contextual-based advertisements and banner ads. These business plans are likely just what Tur and Viacom are counting on. The more money YouTube pulls in, the easier it may be to pull YouTube from its safe harbor and show that it derives a financial benefit from the infringements.

Further, Viacom alleges that YouTube has the right and ability to control the use of its site, and often does so, when doing so is in the best interest of YouTube. YouTube regulates content on its site by removing pornography and hate content and spam. YouTube has even offered to find infringing content for copyright owners on its servers, but only after content owners sign a licensing deal with YouTube. Based on these activities, Viacom alleges that YouTube is much more of an active site, rather than a passive one, with actual control over its operations such that there is no DMCA protection. Viacom's position is that the DMCA safe harbors were not intended to protect sites with such active control over the content that resides on their systems.

Although YouTube has said it will use fingerprinting technology, which would allow it to identify and remove copyrighted materials, it is unclear how and when YouTube will implement such technology. There are reports that YouTube will not use fingerprinting to block clips from being placed on the site. This is likely because the more control YouTube places on what can and cannot be posted, and how early in the process YouTube steps in to remove content, the more likely that control may be used to show that YouTube has the right and ability to control its users' actions. This Catch-22 paralyzes YouTube and hinders its ability to take proactive steps to curb infringement on the site for fear of losing its DMCA protection. Instead, it is likely that YouTube will only use the fingerprinting technology, or other safeguards, to remove content once copyright owners identify the location of the content on YouTube through take down notices.

However, even if YouTube adopts filtering software at the posting stage, it can easily be circumvented. For example, users can disrupt the audio pattern, which is the basis of most current filtering software, by dropping the sound, clipping the videos, or degrading the quality. It has been reported that in testing on MySpace and other similar sites, Audible Magic's filtering software (which Google is reported to be using), has been more than 99% accurate when it is used to examine clips in which the image and audio quality have not been "degraded" and are more than 20-30 seconds.

Conclusion

Whether Tur's and Viacom's arguments are enough to pull YouTube from its DMCA safe harbor remains to be seen. Moreover, it is unclear whether the DMCA provides immunity for intentional inducement under the Grokster decision. It is possible that the DMCA may extend to such a secondary liability theory due to the fact that the infringement is a result of YouTube's actions as an OSP. On the other hand, if YouTube is found to have intentionally induced infringement, it would seem odd to reward it with safe harbor protection. Intentionally inducing infringement would constitute an overt act by YouTube which is not consistent with the original intention of extending DMCA protection to the more "passive" actions of OSPs.

Nevertheless, even if YouTube fails to qualify for the storage, or any other safe harbor, it is not necessarily liable for copyright infringement. The copyright owner must still demonstrate that YouTube has infringed and YouTube can still use any defenses such as fair use or prior case law (i.e., Sony v. Universal, CoStar Group v. LoopNet, Perfect 10 v. Google, etc.). In addition, it is possible that Congress could step into the fray and amend the DMCA to "clarify" the safe harbor provisions.

At the time this article was written, the judge in the Tur case had denied Tur’s Motion for Summary Judgment on the ground that he had not provided sufficient evidence, despite having the opportunity to do so, that YouTube had the right and ability to control the infringing conduct.  Interestingly enough, the judge denied YouTube’s cross motion for summary judgment on the same issue, indicating in her ruling that the facts had not been developed enough to determine whether YouTube had the right and ability to control the infringing conduct.

In the Viacom case, after several extensions of time, YouTube to filed its Answer on April 30, 2007, denying most of the substantive allegations.  Viacom and YouTube are currently working on a discovery plan for electronically stored information. It is likely that a ruling in either case will not be imminent. In the meantime, YouTube and other similar sites will continue to operate under their current understanding of the DMCA safe harbor provisions. However, as soon as a ruling in either case is rendered, regardless of how preliminary, the rules will change, and both sides of the issue will regroup to decide how to respond to the new landscape of DMCA protection.

back to top

The opinions in the articles contained in this publication are those of the authors only, and not necessarily those of the editors, the Intellectual Property Subcommittee, the Cyberspace Law Committee, or the American Bar Association.