Internet Privacy and the Fourth Amendment: Web Host Required to Turn Over Data
Lauren Mullin*
In the modern internet era, the judiciary must decide how the Constitution applies to internet usage and what constitutional protections it gives to the privacy of personal information obtained through internet accounts. A recently decided federal case implicated these exact issues arising from the internet and Fourth Amendment privacy rights. See Tiffany Hsu, DreamHost Ordered to Release Some Trump Protest Website Data to U.S., N.Y. Times (Aug. 25, 2017), https://www.nytimes.com/2017/08/25/business/dreamhost-trump-doj-privacy-ddos-dailystormer.html?mcubz=3.
On August 24, 2017, a District of Columbia Superior Court judge ruled that DreamHost was required to provide the United States Government with data from disruptj20.org, a website it hosts, which helped organizers plan protests against President Trump on Inauguration Day. Id.; see also In re DreamHost, No. 2017 CSW 003438, 2017 WL 4169713, at *1 (D.C. Super. Ct. Sept. 15, 2017) (discussing the August 24, 2017, hearing and order).
Following the protests, about 200 individuals were arrested on various charges. Hsu, supra. The Government executed a search warrant on DreamHost in an attempt to collect information related to the arrested individuals. Robert Iafolla, D.C. Judge Approves Government Warrant for Data from Anti-Trump Website, Reuters (Aug. 24, 2017, 11:57 AM), https://www.reuters.com/article/us-usa-court-dreamhost-idUSKCN1B41ZC. DreamHost argued that the warrant, which required, inter alia, a visitor’s IP address, the pages that visitor viewed, and private email information, was overbroad and violated users’ rights. Laurel Wamsley, DOJ Demands Files on Anti-Trump Activists, and a Web Hosting Company Resists, NPR (Aug. 15, 2017, 9:10 PM), http://www.npr.org/sections/thetwo-way/2017/08/15/543782396/doj-demands-files-on-anti-trump-activists-and-a-web-hosting-company-resists. Although the Government eventually narrowed its request to exclude the IP addresses of website visitors, it still included emails and mailing lists. See, e.g., Hsu, supra; Iafolla, supra.
Nevertheless, the court ruled that DreamHost needed to turn over information in compliance with the more limited search warrant. In re DreamHost, 2017 WL 4169713, at *3; Iafolla, supra. However, in his Order, the judge limited what the Government could do with the information and decided to oversee the Government’s examination of such information. In re DreamHost, 2017 WL 4169713, at *3–4. Pursuant to the ruling, the Government was permitted to sort through information that may be unnecessary to the investigation of the arrested protestors. See id. Although several media outlets have focused on the First Amendment implications of the case, the DreamHost issue presents Fourth Amendment concerns relating to internet privacy and the protection of personal information stored on the internet. See, e.g., Hsu, supra; Wamsley, supra.
On October 10, 2017, the court ordered the Government to adhere to specific “safeguards” in order to protect the identities of innocent persons. In re http://www.disruptj20.org, No. 17 CSW 3438, 2017 WL 4569548, at *1 (D.C. Super. Ct. Oct. 10, 2017). The judge acknowledged the Fourth and First Amendment concerns and explained that the Government has a right to execute its warrant, but that “it does not have the right to rummage” through information provided by the individuals who did not participate in the criminal activity being prosecuted, or the “non-subscribers” as they are referred to in the Order. Id. The court ordered that the Government must adhere to the following procedures:
(1) [F]ile a report with the Court explaining the government’s intended search protocol and review procedures designed to minimize access to data and information not covered by the Warrant; (2) if the Court approves the report, the government may only conduct its search on a redacted data set that omits non-subscriber identifying information; (3) upon completion of review, the government must file an itemized list of the materials it seeks to retain with the Court, and explain how such materials are relevant to its investigation and its basis for removing any redactions; and (4) only upon a finding by the Court that the requested information is evidence of criminal activity, as described in the Warrant for which this Court has found probable cause, may the government obtain any un-redacted information, such as the identity of the user.
Id. The Order spelled out the redactions that DreamHost was required to comply with and mandated that the Government shall permanently delete any information that does not fall within the scope of the warrant. Id. at *2, *5.
Fourth Amendment Supreme Court Cases
Although there is not an abundance of recent Fourth Amendment case law relating to the Government seizing personal data from the internet, several older Fourth Amendment cases are instructive on the DreamHost issue. See Orin S. Kerr, The Effect of Legislation on Fourth Amendment Protection, 115 Mich. L. Rev. 1117, 1148–49 (2017) (“Fourth Amendment cases are sparse because the technology is so new.”). The Supreme Court has established a “reasonable expectation of privacy” rule, which Justice Harlan articulated to be a “twofold requirement”: “first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as ‘reasonable.’” Katz v. United States, 389 U.S. 347, 360–61 (1967) (Harlan, J., concurring). In California v. Greenwood, the Supreme Court noted that Fourth Amendment protections extend to individuals who “manifest[] a subjective expectation of privacy . . . that society accepts as objectively reasonable.” 486 U.S. 35, 39 (1988). Potential explorations of future courts, in relation to this case, include what society currently “accepts as objectively reasonable” in the digital age. Id.
Kyllo v. United States made clear that the Supreme Court is highly aware of the continuing pressure that modern technology has put on Fourth Amendment rights. 533 U.S. 27, 33–34 (2001). In the context of thermodynamic technology, the Court explored how technology has affected the “degree of privacy secured to citizens by the Fourth Amendment” and addressed the question of “what limits there are upon this power of technology to shrink the realm of guaranteed privacy.” Id.
More recently, in his concurring opinion in United States v. Jones, Justice Alito addressed the Katz test and the difficulty of determining reasonable privacy expectations when technology can change those expectations. 565 U.S. 400, 427 (2012) (Alito, J., concurring). He discussed the tradeoff between the “convenience or security” of new technology “at the expense of privacy,” and explained that “many people may find the tradeoff worthwhile.” Id. Justice Sotomayor, also in a concurring opinion, discussed the potential implications of allowing the Government to access GPS surveillance monitoring. Id. at 416 (Sotomayor, J., concurring). Justice Sotomayor posed the following question: “I would ask whether people reasonably expect that their movements will be recorded and aggregated in a manner that enables the Government to ascertain, more or less at will, their political and religious beliefs, sexual habits, and so on.” Id.
The DreamHost case poses a similar question as the one presented in United States v. Jones; the information obtained from DreamHost’s website does include personally sensitive information, even from individuals who did not participate in the violence that the government is prosecuting. See In re http://www.disruptj20.org, 2017 WL 4569548, at *1.
An Alternative
Conversely, courts have the option of leaving technology and privacy decisions to the legislature. See Ryan C. Chapman, The Outer Limits: IMSI-Catchers, Technology, and the Future of the Fourth Amendment, 44 Pepp. L. Rev. 841, 876–78 (2017). In Riley v. California, Justice Alito, again in a concurring opinion, highlighted potential issues stemming from judicial activism that creates privacy protections for citizens. 134 S. Ct. 2473, 2497–98 (2014) (Alito, J., concurring). He argued that legislatures are better suited to address these issues and respond to the changes of technology. Id. Legislatures may be able to provide solutions in relation to rapidly changing technology faster than the courts. Chapman, supra, at 876–77.
Conclusion
Although the October 10, 2017, DreamHost Order addresses First and Fourth Amendment concerns, it seems that some private information belonging to innocent individuals may still slip through the cracks due to the sheer mass of data that is involved in the case. See In re http://www.disruptj20.org, 2017 WL 4569548, at *1. However, the court appropriately took action to curtail the risk that the Government will just sort through and keep innocent individuals’ personal information. See id. at *4–5. If faced with similar questions, other courts around the country should look to this Order as a model for detailed safeguards that help protect individuals’ Fourth Amendment rights. While the Supreme Court has not made it clear how far Fourth Amendment rights will extend in the realm of growing technology, the DreamHost issue is one that will only continue to develop in the digital age.
*Lauren Mullin is a second-year law student at the University of Baltimore School of Law, where she serves as a staff editor for Law Review and a research assistant for Professor Charles Tiefer. In the Summer of 2017, Lauren interned with the Honorable Stuart R. Berger on the Maryland Court of Special Appeals and the Honorable Michael A. DiPietro on the Circuit Court for Baltimore City. This upcoming summer, Lauren will join Eccleston and Wolf, P.C. as a Law Clerk.
University of Baltimore Law Review 