Friday, March 30, 2012

Subscribers, Co-Occupants and Network Privacy

After law enforcement officials found child pornography on his computer, Edward Hatcher was convicted of sexual exploitation of a child in violation of Georgia Code § 16-12-100 and “sentenced to a term of imprisonment”. Hatcher v. State, __ S.E.2d __, 2012 WL 857294 (Georgia Court of Appeals 2012).

He appealed, arguing, in part, that the trial court “erred when it denied his motion to suppress information obtained from an internet service provider”. Hatcher v. State, supra.

This is how the case, and the motion to suppress, arose:

[A]n investigator with the Cherokee County Sheriff's Office learned that someone was using a computer in Cherokee County to share child pornography on the Internet. The investigator ascertained that the Internet Protocol (IP) address used by the child pornographer was assigned to a customer of Comcast Cable Communications, an internet service provider, and the investigator asked Comcast to provide certain information about the account of that customer.


Comcast did so, disclosing the name of the customer and her billing address, which was a residential address in Cherokee County.


The investigator obtained a warrant to search the residence at the billing address for certain evidence of child pornography, including any computers or electronic data storage devices that he might find there. When the investigator went to the home, he confirmed that it was occupied by a family that subscribed to Comcast internet service.


The investigator learned that the family used a wireless router to access the Internet, and he also discovered that Hatcher lived in the basement of the home and used the same wireless router.

Hatcher v. State, supra.

In a footnote, the opinion points out that

Hatcher apparently had lived in the basement of the family's home for about two months. The record does not reveal the relationship, if any, between Hatcher and the family or whether he was a renter or guest in their home.

Hatcher v. State, supra.

Before his case went to trial, Hatcher moved “to suppress the customer information that the investigator obtained from Comcast”. Hatcher v. State, supra. The opinion notes that he “also moved to suppress any evidence obtained by use of that information, which includes, of course, the evidence later found on his computer.” Hatcher v. State, supra. As noted above, the trial judge denied his motion, and he renewed the arguments he made in favor of suppressing the evidence in his appeal. Hatcher v. State, supra.

More precisely, Hatcher argued that “the request for information amounted to an unreasonable search in violation of the 4th Amendment.” Hatcher v. State, supra. The Court of Appeals began its analysis of his argument by explaining that

When one contends that he was aggrieved by an unreasonable search and seeks to suppress evidence obtained as a result of the search, he must show, among other things, that an agent of the government either trespassed upon his property, see U.S. v. Jones, 132 S.Ct. 945 (2012), or invaded some other place or thing in which he has a reasonable expectation of privacy. See Bond v. U.S., 529 U.S. 334 (2000).


Here, Hatcher cannot seriously claim that a request for information from Comcast was a trespass upon his property, so we consider whether he has a reasonable expectation of privacy in the information disclosed by Comcast.

Hatcher v. State, supra.

The court then pointed out that the

United States Supreme Court `consistently has held that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties.Smith v. Maryland, 442 U.S. 735 (1979). . . .


Consistent with this principle, numerous federal courts have concluded that an internet service customer has no reasonable expectation of privacy in the subscriber information that he gives voluntarily to his internet service provider. See, e.g., U.S. v. Beckett, 369 Fed. Appx. 52 (U.S. Court of Appeals for the 11th Circuit 2010) (`[S]uppression under the 4th Amendment was not required because [the subscriber] did not have a reasonable expectation of privacy with regards to the information transmitted’); U.S. v. Christie, 624 F.3d 558, 573–574(II)(C) (U.S. Court of Appeals for the 3rd Cir. 2010) (no reasonable expectation of privacy in IP address or subscriber information because such information is voluntarily conveyed to third parties). . . .

In light of these decisions, we doubt that an internet service subscriber can have a reasonable expectation of privacy in the subscriber information that he voluntarily conveys to an internet service provider in order to obtain internet service.

Hatcher v. State, supra.

As I’ve noted in earlier posts, the 4th Amendment creates a right to be free from unreasonable “searches” and “seizures.” A “search” violates a “reasonable expectation of privacy” in a place or thing. And the test used to decide if someone had a reasonable expectation of privacy in a place or thing is the test the Supreme Court enunciated in Katz v. U.S., 389 U.S. 347 (1967): The person had a subjective expectation of privacy in the place/thing and society is prepared to regard that subjective expectation of privacy as objectively reasonable. (Actually, as Wikipedia notes, this test comes from Justice Harlan’s concurring opinion in Katz and was later adopted by a majority of the Supreme Court in Smith v. Maryland, 442 U.S. 735 (1979)).

In determining whether someone’s subjective expectation of privacy is objectively “reasonable,” courts apply the “assumption of risk” analysis. In the Katz case, the Supreme Court said that, for the purposes of 4th Amendment privacy analysis, “[w]hat a person knowingly exposes to the public, even in his own home or office, is not a subject of 4th Amendment protection.” Katz v. U.S. supra.

So, when someone “knowingly” exposes information or other evidence to a third party, he or she has assumed the risk that this person will share the information with others, including law enforcement.

The Court applied this assumption of risk analysis in Smith v. Maryland, in which it held that it was not a 4th Amendment search for a telephone company, “at police request,” to install a pen register (a device that recorded the numbers Smith dialed on his home phone) on Smith’s account. Smith v. Maryland, supra. The Smith court explained that

[t]his analysis dictates that [Smith] can claim no legitimate expectation of privacy here. When he used his phone, [he] voluntarily conveyed numerical information to the telephone company and `exposed’ that information to its equipment in the ordinary course of business.

Smith v. Maryland, supra.

The Hatcher court found, though, that it did not need to decide “definitively” whether internet service subscriber has a reasonable expectation of privacy in the subscriber information that he voluntarily conveys to an internet service provider in order to obtain internet service. Hatcher v. State, supra. It decided it did not need to decide the issue

in this case because Hatcher is not the subscriber whose information was requested from Comcast. Instead, he simply used the internet service subscription of another to access the Internet, and the record tells us nothing about his relationship with the subscriber, except that he apparently had lived for two months in her basement.


Even if a subscriber might have a reasonable expectation of privacy in her own account information, we do not understand how anyone else could have a reasonable expectation of privacy in it, especially in the absence of some special relationship between that person and the subscriber.


For this reason, we conclude that Hatcher failed to establish a reasonable expectation of privacy in the information requested from Comcast, and the court below did not err when it denied his motion to suppress.

Hatcher v. State, supra.

In a footnote, the court explained that

[i]n this case, we are dealing only with customer information voluntarily disclosed to an internet service provider to obtain internet service. We do not address whether a customer or user of internet service has a reasonable expectation of privacy in the content of electronic mail and other electronic communications that he transmits across the Internet.

Hatcher v. State, supra.

No comments: