Ed Felten and Randy Picker point to an interesting ruling from the 6th Circuit Court of Appeals: Because people have a reasonable expectation of privacy when they communicate over e-mail, the court ruled that the government must obtain a search warrant to get your e-mail from your ISP.
The ruling (PDF) concerned Steven Warshak, peddler of various allegedly scammy dietary supplements that promised to make people thinner, randier, give them better vision at night, keep them awake longer, etc. In the course of the government's investigation of Warshak, it compelled his ISPs -- NuVox and Yahoo -- to turn over his stored e-mail, and barred them from disclosing the search to Warshak. The ISPs complied. Only when a magistrate unsealed the order more than a year later was Warshak notified that his e-mail had been searched. That's when Warshak filed suit, claiming the government had violated his Fourth Amendment rights.
As Felten points out, the key to the court's ruling is the analogy it makes between communicating over e-mail and talking over the phone. In the same way that the phone company can easily eavesdrop on your phone calls, e-mail providers have access to your e-mail -- in many cases, indeed, you even allow your provider to use automated tools to look at your e-mail, whether it's to filter out spam or to dish up "relevant" alongside the messages. Still, despite corporations' access to the wires, you expect that when you pick up the phone, nobody is listening in -- and, in the same way, you expect that when you receive a message, your message remains private. This expectation, the court ruled, matters. It means that if the government wants your e-mail, it has to obtain a search warrant first.
Because the decision hinges on Warshak's "reasonable expectation" of privacy, it may not be completely far-reaching, Felten notes. If you're using GMail or Yahoo for your messages, you can expect that employees there aren't reading your messages -- you know that because the companies say they won't in their privacy notices. But if your ISP is, instead, your employer, you may not have that same expectation. If your boss told you at orientation that the IT department would be sending him all employee messages that contained the keyword "jackass," you can't claim your expectation of privacy was violated.
Another wrinkle: Orin Kerr thinks the ruling will be overturned on procedural grounds. Therefore, savor your e-mail privacy while you can!
