Warshak v. United States

RECOMMENDED FOR FULL-TEXT PUBLICATION

Pursuant to Sixth Circuit Rule 206

File Name: 07a0225p.06

UNITED STATES COURT OF APPEALS

FOR THE SIXTH CIRCUIT

_________________

X

Plaintiff-Appellee, -

STEVEN WARSHAK,

-

-

-

No. 06-4092

v.

,

>

UNITED STATES OF AMERICA, -

Defendant-Appellant. -

N

Appeal from the United States District Court

for the Southern District of Ohio at Cincinnati.

No. 06-00357—Susan J. Dlott, District Judge.

Argued: April 18, 2007

Decided and Filed: June 18, 2007

Before: MARTIN and DAUGHTREY, Circuit Judges; SCHWARZER, District Judge.*

_________________

COUNSEL

ARGUED: Nathan P. Judish, UNITED STATES DEPARTMENT OF JUSTICE, Washington,

D.C., for Appellant. Martin G. Weinberg, Boston, Massachusetts, for Appellee. ON BRIEF:

Nathan P. Judish, John H. Zacharia, UNITED STATES DEPARTMENT OF JUSTICE, Washington,

D.C., Benjamin C. Glassman, Donetta D. Wiethe, ASSISTANT UNITED STATES ATTORNEYS,

Cincinnati, Ohio, for Appellant. Martin G. Weinberg, Boston, Massachusetts, Martin S. Pinales,

SIRKIN, PINALES & SCHWARTZ, Cincinnati, Ohio, for Appellee. Kevin S. Bankston,

ELECTRONIC FRONTIER FOUNDATION, San Francisco, California, Patricia L. Bellia, NOTRE

DAME LAW SCHOOL, Notre Dame, Indiana, Susan A. Freiwald, UNIVERSITY OF SAN

FRANCISCO SCHOOL OF LAW, San Francisco, California, for Amici Curiae.

_________________

OPINION

_________________

BOYCE F. MARTIN, JR., Circuit Judge. The government appeals the district court’s entry

of a preliminary injunction, prohibiting it from seizing “the contents of any personal e-mail account

maintained by an Internet Service Provider in the name of any resident of the Southern District of

Ohio without providing the relevant account holder or subscriber prior notice and an opportunity

to be heard on any complaint, motion, or other pleading seeking issuance of such an order.” D. Ct.

*

The Honorable William W Schwarzer, United States District Judge for the Northern District of California,

sitting by designation.

1

No. 06-4092 Warshak v. United States Page 2

Op. at 19. For the reasons discussed below, we largely affirm the district court’s decision, requiring

only that the preliminary injunction be slightly modified on remand.

I.

In March 2005, the United States was engaged in a criminal investigation of Plaintiff Steven

Warshak and the company he owned, Berkeley Premium Nutraceuticals, Inc. The investigation

pertained to allegations of mail and wire fraud, money laundering, and related federal offenses. On

May 6, 2005, the government obtained an order from a United States Magistrate Judge in the

Southern District of Ohio directing internet service provider (“ISP”) NuVox Communications to turn

over to government agents information pertaining to Warshak’s e-mail account with NuVox. The

information to be disclosed included (1) customer account information, such as application

information, “account identifiers,” “[b]illing information to include bank account numbers,” contact

information, and “[any] other information pertaining to the customer, including set up,

synchronization, etc.”; (2) “[t]he contents of wire or electronic communications (not in electronic

storage unless greater than 181 days old) that were placed or stored in directories or files owned or

controlled” by Warshak; and (3) “[a]ll Log files and backup tapes.” Joint App’x at 49.

The order stated that it was issued under 18 U.S.C. § 2703, part of the Stored

Communications Act (“SCA”), and that it was based on “specific and articulable facts showing that

there are reasonable grounds to believe that the records or other information sought are relevant and

material to an ongoing criminal investigation.” The order was issued under seal, and prohibited

NuVox from “disclos[ing] the existence of the Application or this Order of the Court, or the

existence of this investigation, to the listed customer or to any person unless and until authorized

to do so by the Court.” The magistrate further ordered that “the notification by the government

otherwise required under 18 U.S.C. § 2703(b)(1)(B) be delayed for ninety days.” On September 12,

2005, the government obtained a nearly identical order pertaining to Yahoo, another ISP, that sought

the same types of information from Warshak’s Yahoo e-mail account and a Yahoo account identified

with another individual named Ron Fricke.

On May 31, 2006, over a year after obtaining the NuVox order, the United States wrote to

Warshak to notify him of both orders and their requirements.1 The magistrate had unsealed both

orders the previous day. Based on this disclosure, Warshak filed suit on June 12, 2006, seeking

declaratory and injunctive relief, and alleging that the compelled disclosure of his e-mails without

a warrant violated the Fourth Amendment and the SCA. After filing the complaint, Warshak’s

counsel sought the government’s assurance that it would not seek additional orders under section

2703(d) directed at his e-mails, at least for some discrete period of time during the pendency of his

civil suit. The government declined to provide any such assurance. In response, Warshak moved

for a temporary restraining order and/or a preliminary injunction prohibiting such future searches.

The district court held a telephonic hearing on the motions, and eventually granted part of the

equitable relief sought by Warshak.

In considering the factors for a preliminary injunction, the district court reasoned that e-mails

held by an ISP were roughly analogous to sealed letters, in which the sender maintains an

expectation of privacy. This privacy interest requires that law enforcement officials obtain a

warrant, based on a showing of probable cause, as a prerequisite to a search of the e-mails. Because

it viewed Warshak’s constitutional claim as meritorious, the district court deemed it unnecessary to

examine his likelihood of success on the SCA claim. It also found that Warshak would suffer

irreparable harm based on any additional constitutional violations, that such harm was imminent in

1

The government has conceded that it violated the statute by waiting for over a year without providing notice

of the e-mail seizures to Warshak or seeking extensions of the delayed notification period, and it appears to have violated

the magistrate’s decision for the same reason.

No. 06-4092 Warshak v. United States Page 3

light of the government’s past violations and its refusal to agree not to conduct similar seizures in

the future, that Warshak lacked an adequate remedy at law to protect his Fourth Amendment rights,

and that the public interest in preventing constitutional violations weighed in favor of the injunction.

The district court also made clear that further factual development would be necessary for a final

disposition, and that the injunction was tailored to protect Warshak from constitutional violations

in the interim.

The district court rejected the full scope of Warshak’s request to enjoin the government from

seizing any of his e-mails in the future. It stated that it was not “presently prepared to hold that 18

U.S.C. § 2703(d) facially violates the Fourth Amendment by simple virtue of the fact that it

authorizes the seizure of personal e-mails from commercial ISPs without a warrant and on less than

a showing of probable cause.” D. Ct. Op. at 16-17. The statute’s authorization of this procedure

based only on the government’s ex parte representations struck the district court as more

problematic, however, and it held that the “combination of a standard of proof less than probable

cause and potentially broad ex parte authorization cannot stand.” Id. at 17. As a result, it deemed

the constitutional flaws of the statute “facial in nature,” and agreed to preliminarily enjoin additional

seizures of e-mails from an ISP account of any resident of the Southern District of Ohio without

notice to the account holder and an opportunity for a hearing.

The gist of this remedy appears to be that when a hearing is required and the e-mail account

holder is given an opportunity in court to resist the disclosure of information, any resulting order is

more like a subpoena than a search warrant. Therefore the standard necessary to obtain an order

under the SCA — that the government introduce “specific and articulable facts showing that there

are reasonable grounds to believe that the contents” of the e-mail to be seized “are relevant and

material to an ongoing criminal investigation” — is permissible as the functional equivalent of a

subpoena given the subject’s ability to contest the order in court. Because this standard is lower than

the probable cause standard necessary to obtain a search warrant, it is sufficient to justify a

warrantless search only in instances where notice is provided to the account holder.

The government appeals from the district court’s ruling.

II.

The SCA, passed by Congress in 1986, is codified at 18 U.S.C. §§ 2701 to 2712, and

contains a number of provisions pertaining to the accessibility of “stored wire and electronic

communications and transactional records.” Portions of the SCA that are not directly at stake here

prohibit unauthorized access of electronic communications (§ 2701) and prohibit a service provider

from divulging the contents of electronic communications that it is storing for a customer with

certain exceptions pertaining to law enforcement needs (§ 2702). At issue in this case is § 2703,

which provides procedures through which a governmental entity can access both user records and

other subscriber information, and the content of electronic messages.

Subsection (a) requires the use of a warrant to access messages that have been in storage for

180 days or less. Subsection (b) provides that to obtain messages that have been stored for over 180

days, the government generally must either (1) obtain a search warrant, (2) use an administrative

subpoena, or (3) obtain a court order. The latter two require prior notice to the subscriber, allowing

the subscriber an opportunity for judicial review before the disclosure:

(b) Contents of wire or electronic communications in a remote computing service.

(1) A governmental entity may require a provider of remote computing service to

disclose the contents of any wire or electronic communication to which this

paragraph is made applicable by paragraph (2) of this subsection--

No. 06-4092 Warshak v. United States Page 4

(A) without required notice to the subscriber or customer, if the governmental

entity obtains a warrant issued using the procedures described in the Federal Rules

of Criminal Procedure by a court with jurisdiction over the offense under

investigation or equivalent State warrant; or

(B) with prior notice from the governmental entity to the subscriber or

customer if the governmental entity--

(i) uses an administrative subpoena authorized by a Federal or State

statute or a Federal or State grand jury or trial subpoena; or

(ii) obtains a court order for such disclosure under subsection (d)

of this section; except that delayed notice may be given pursuant

to section 2705 of this title.

18 U.S.C. 2703(b) (emphasis added). The final subsection cited here contains the exception to the

requirement that the government must either provide notice to the subscriber if seeking either an

SCA order or an administrative subpoena, or must, in the absence of notice, obtain a search warrant.

This exception, which allows for delayed notice under section 2705, is the root of the present

controversy.

Subsection (d), which is referenced in subsection (b), sets forth the procedure and

requirements for obtaining a court order (as opposed to a warrant):

A court order for disclosure under subsection (b) or (c) may be issued by any court

that is a court of competent jurisdiction and shall issue only if the governmental

entity offers specific and articulable facts showing that there are reasonable grounds

to believe that the contents of a wire or electronic communication, or the records or

other information sought, are relevant and material to an ongoing criminal

investigation. In the case of a State governmental authority, such a court order shall

not issue if prohibited by the law of such State. A court issuing an order pursuant to

this section, on a motion made promptly by the service provider, may quash or

modify such order, if the information or records requested are unusually voluminous

in nature or compliance with such order otherwise would cause an undue burden on

such provider.

18 U.S.C. 2703(d). The parties agree that the standard of proof for a court order — “specific and

articulable facts showing that there are reasonable grounds to believe that the contents . . . or records

. . . are relevant and material to an ongoing criminal investigation” — falls short of probable cause.

Section 2705, which provides for delayed notice of a 2703(d) court order, states in relevant

part:

(a) Delay of notification.

(1) A governmental entity acting under section 2703(b) of this title may--

(A) where a court order is sought, include in the application a request, which

the court shall grant, for an order delaying the notification required under section

2703(b) of this title for a period not to exceed ninety days, if the court determines

that there is reason to believe that notification of the existence of the court order may

have an adverse result described in paragraph (2) of this subsection; or

(B) where an administrative subpoena authorized by a Federal or State statute

or a Federal or State grand jury subpoena is obtained, delay the notification required

under section 2703(b) of this title for a period not to exceed ninety days upon the

execution of a written certification of a supervisory official that there is reason to

believe that notification of the existence of the subpoena may have an adverse result

described in paragraph (2) of this subsection.

No. 06-4092 Warshak v. United States Page 5

(2) An adverse result for the purposes of paragraph (1) of this subsection is--

(A) endangering the life or physical safety of an individual;

(B) flight from prosecution;

(C) destruction of or tampering with evidence;

(D) intimidation of potential witnesses; or

(E) otherwise seriously jeopardizing an investigation or unduly delaying a

trial.

* * * * *

(4) Extensions of the delay of notification provided in section 2703 of up to ninety

days each may be granted by the court upon application, or by certification by a

governmental entity, but only in accordance with subsection (b) of this section.

(5) Upon expiration of the period of delay of notification under paragraph (1) or (4)

of this subsection, the governmental entity shall serve upon, or deliver by registered

or first-class mail to, the customer or subscriber a copy of the process or request

together with notice that--

(A) states with reasonable specificity the nature of the law enforcement inquiry;

and

(B) informs such customer or subscriber--

(i) that information maintained for such customer or subscriber by the service

provider named in such process or request was supplied to or requested by that

governmental authority and the date on which the supplying or request took place;

(ii) that notification of such customer or subscriber was delayed;

(iii) what governmental entity or court made the certification or determination

pursuant to which that delay was made; and

(iv) which provision of this chapter allowed such delay.

Subsection (b) of section 2705 similarly allows the government to obtain a court order prohibiting

the ISP from notifying the account holder “of the existence of the warrant, subpoena, or court order,”

when the government is not required to provide him notice. These provisions of sections 2703 and

2705 largely govern the seizures of Warshak’s e-mails.2

The injunctive relief imposed by the district court has a specific narrow application to

portions of the SCA. It would still allow seizures of e-mails pursuant to a warrant or with prior

notice to a subscriber. The portions that it enjoins are the exception provided in section

2703(b)(1)(B)(ii), which allows for a court order with delayed notice to the account holder, and the

2

Although the remaining subsections of 2703 are not directly relevant to Warshak’s present challenge, they are

nevertheless informative. Subsection (c) provides a different and somewhat broader procedure by which the government

may obtain records and other subscriber information, as opposed to the content of electronic messages. In addition to

allowing a governmental entity to obtain such records with a warrant, a court order, or with the subscriber’s consent, the

statute provides for mandatory disclosure of particular subscriber records, such as name, address, telephone connection

records, session times and durations, network identifying information, and means of payment for services. See 18 U.S.C.

§ 2703(c). Also noteworthy is subsection (f), which requires a provider to preserve evidence when requested by a

governmental entity. This mechanism is designed to assist law enforcement in cases where they are required to provide

notice to the subscriber but are concerned that he might destroy evidence prior to its seizure:

(f) Requirement to preserve evidence.

(1) In general. A provider of wire or electronic communication services or a remote computing

service, upon the request of a governmental entity, shall take all necessary steps to preserve records

and other evidence in its possession pending the issuance of a court order or other process.

(2) Period of retention. Records referred to in paragraph (1) shall be retained for a period of 90 days,

which shall be extended for an additional 90-day period upon a renewed request by the governmental

entity.

No. 06-4092 Warshak v. United States Page 6

procedures provided in section 2705, which are incorporated by reference into section

2703(b)(1)(B)(ii).

III.

The government focuses on four issues in challenging the preliminary injunction. First, it

argues that Warshak’s claims are not justiciable in the first instance, based on the doctrines of

standing and ripeness. Second, it contends that the Fourth Amendment’s probable cause standard

is inapplicable in the context of SCA seizures, which it likens to compelled disclosures. This issue

primarily covers Warhsak’s likelihood of success on the merits, the first factor in the preliminary

injunction analysis. Next, it argues that Warshak’s claims are not the proper subject of a facial

challenge to the provisions of the SCA in question. Finally, it challenges the district court’s

balancing of the remaining preliminary injunction factors.

We review a district court’s decision regarding a preliminary injunction for an abuse of

discretion. Overstreet v. Lexington-Fayette Urban County Gov’t, 305 F.3d 566, 573 (6th Cir. 2002).

Four factors must be considered and balanced by the district court in making its determination:

“(1) whether the plaintiff has established a substantial likelihood or probability of success on the

merits; (2) whether there is a threat of irreparable harm to the plaintiff; (3) whether issuance of the

injunction would cause substantial harm to others; and (4) whether the public interest would be

served by granting injunctive relief.” Nightclubs, Inc. v. City of Paducah, 202 F.3d 884, 888 (6th

Cir. 2000) (overruled on other grounds, City of Littleton v. Z. J. Gifts D-4, L.L.C., 541 U.S. 774, 784

(2004)). “‘The district court’s determination will be disturbed only if the district court relied upon

clearly erroneous findings of fact, improperly applied the governing law, or used an erroneous legal

standard.’” Id. (quoting Connection Distrib. Co. v. Reno, 154 F.3d 281, 288 (6th Cir. 1998)).

We review de novo the legal questions of standing and ripeness. See Prime Media v. City

of Brentwood, No. 05-6343, 2007 U.S. App. LEXIS 10862, at *9 (6th Cir. May 8, 2006).

A. Standing and Ripeness

1. Standing

The government first asserts that the district court lacked subject matter jurisdiction to

entertain Warshak’s claims, both because Warshak lacked standing to challenge future searches

under the SCA, and because his claims were not ripe for review. To establish standing, a plaintiff

must allege “(1) an injury that is (2) ‘fairly traceable to the defendant’s allegedly unlawful conduct’

and that is (3) ‘likely to be redressed by the requested relief.’” Id. at *11 (quoting Lujan v.

Defenders of Wildlife, 504 U.S. 555, 560 (1992)). Where a plaintiff seeks injunctive relief, a natural

outgrowth of these factors requires a showing of ongoing injury or an imminent threat of future

injury. See O’Shea v. Littleton, 414 U.S. 488, 495-96 (1974) (“Past exposure to illegal conduct does

not in itself show a present case or controversy regarding injunctive relief . . . if unaccompanied by

any continuing, present adverse effects.”); but see Los Angeles v. Lyons, 461 U.S. 95, 102 (1983)

(“Past wrongs [are] evidence bearing on ‘whether there is a real and immediate threat of repeated

injury.’” (quoting O’Shea, 414 U.S. at 495-96)). Although past harm to a plaintiff seeking

injunctive relief can serve as relevant evidence, he must also show a threat that is “sufficiently real

and immediate” to establish the “prospect of future injury” as part of the standing requirement.

Lyons, 461 U.S. at 102-103 (1983) (citing O’Shea, 414 U.S. at 496-97). The district court found that

Warshak showed a sufficient threat of imminent harm, in light of the past seizures of his e-mails and

the fact that the government “refused to pledge not to obtain or enforce future 2703(d) orders of this

kind against other e-mail accounts of Warshak’s.” D. Ct. Op. at 12.

The government relies primarily upon Lyons to support its contention that Warshak’s claims

are largely hypothetical, and do not support a showing of imminent harm. In Lyons, the plaintiff

No. 06-4092 Warshak v. United States Page 7

sought injunctive relief against the use of chokeholds by Los Angeles police after he had been put

in a chokehold himself. 461 U.S. at 105. The Supreme Court determined that the plaintiff had failed

to demonstrate any future harm upon which he would have standing to seek injunctive relief,

because there was no imminent threat that he would be subjected to a chokehold again. Id. at 107.

Among other things, the plaintiff could not show that the city had a policy authorizing the use of

chokeholds or that all Los Angeles police always used chokeholds, and the Court was unwilling to

assume that the plaintiff would voluntarily break the law again and be involved in a confrontation

with police. Id. at 111 (“The speculative nature of Lyons’ claim of future injury requires a finding

that this prerequisite of equitable relief has not been fulfilled.”).

Warshak’s claims are distinguishable from those in Lyons for several reasons. First, unlike

in Lyons, the government clearly has a policy of seizing e-mails — the very practice that Warshak

alleges is unconstitutional. There is no dispute about the existence of this policy: not only have

Warshak’s e-mails been seized twice pursuant to the policy, and not only has the government

refused to abstain from future seizures, but a statute explicitly authorizes the challenged government

action. The presence of this policy and its applicability to Warshak are likely sufficient on their own

to give Warshak standing to seek equitable relief. See Lyons, 461 U.S. at 105-06 (“In order to

establish an actual controversy in this case, Lyons would have had not only to allege that he would

have another encounter with the police but also to make the incredible assertion either (1) that all

police officers in Los Angeles always choke any citizen with whom they happen to have an

encounter, whether for the purpose of arrest, issuing a citation, or for questioning, or (2) that the

City ordered or authorized police officers to act in such manner.” (emphasis added)); see also

Baur v. Veneman, 352 F.3d 625, 637 (2d Cir. 2003) (citing “alleged risk of harm aris[ing] from an

established government policy” as a “critical factor that weigh[s] in favor of concluding that

standing exists . . . .”); 31 Foster Children v. Bush, 329 F.3d 1255, 1266 (11th Cir. 2003) (“[F]uture

injury that depends on either the random or unauthorized acts of a third party is too speculative to

satisfy standing requirements. However, when the threatened acts that will cause injury are

authorized or part of a policy, it is significantly more likely that the injury will occur again.”).

Further, although Warshak, like Lyons, finds himself in a confrontation with the government

due to allegations of illegal conduct on his part, the nature of the confrontation is very different.

Warshak has been subject to a lengthy, ongoing investigation, and even if it is prompted by

suspicion of illegal conduct on his part, the ongoing nature of the investigation is clearly

distinguishable from the brief encounter at issue in Lyons. Warshak’s fear of the challenged

government conduct need not be premised on a showing that he will resist arrest, attempt to escape

from police custody, or otherwise engage in a physical confrontation with police, as the Lyons

plaintiff would have had to show. Instead, the challenged conduct here involves an investigation

during which the government might seek to seize additional e-mails at any time. Although Warshak

has now been indicted, and the investigation is at a different and less secretive stage, the government

would certainly want to search more of his e-mails if it had reason to believe that they might be

incriminating. The brief and somewhat random nature of the confrontation in Lyons distinguishes

it from the ongoing, targeted confrontation here. The government points out that there is no way

to determine with any degree of certainty that it will seek such seizures in the future, but as Warshak

argues, “[o]ne does not have to await consummation of threatened injury to obtain preventive relief.”

Blum v. Yaretsky, 457 U.S. 991, 1000 (1982).

In light of the past e-mail seizures, the ongoing nature of the investigation against Warshak,

and the government policy of seizing e-mails without a warrant or notice to the account holder, we

agree with the district court that Warhsak has shown a sufficiently imminent threat of future injury

to meet the injury in fact element of standing under Lyons.

As Warshak has shown an imminent threat of injury, this threat would clearly be redressed

by the injunctive relief issued by the district court, because the government would be prohibited

No. 06-4092 Warshak v. United States Page 8

from repeating its allegedly unconstitutional conduct in the future. Although the government argues

that the redressability requirement has not been met, its argument on this issue is subsumed by the

imminent threat of injury inquiry, as it asserts that there is no redressability because there is no

threatened future injury. The redressability requirement does not, therefore, present an independent

basis for us to find a lack of standing.

2. Ripeness

The government also argues that Warshak’s claims are not ripe, as they are too hypothetical

without a pending order directed at his e-mails. The ripeness inquiry focuses on three factors:

(1) the “likelihood that the harm alleged by [the] plaintiffs will ever come to pass”; (2) “whether the

factual record is sufficiently developed to produce a fair adjudication of the merits of the parties’

respective claims”; and (3) “the hardship to the parties if judicial relief is denied at [this] stage in

the proceedings.” Adult Video Ass’n v. United States Dept. of Justice, 71 F.3d 563, 568 (6th Cir.

1995) (internal citations omitted). As this Court has explained, “[t]he ripeness doctrine generally

applies in cases . . . in which a party seeks a declaratory judgment based on pre-enforcement review

of a statute or regulation . . . .” Kardules v. City of Columbus, 95 F.3d 1335, 1343 (6th Cir. 1996).

The government contends that because Warshak challenges future e-mail seizures that he

cannot prove will occur again, his claims are too hypothetical to be ripe. Warshak’s claim is

distinguishable from the typical ripeness case, however, because he has suffered past alleged injuries

from the exact conduct that he seeks to have enjoined, and because the ongoing nature of the

investigation against him raises the likelihood of these harms occurring again. To a large extent, the

first ripeness factor — the likelihood that alleged harm will ever come to pass — is quite similar to

the standing requirement of an imminent threatened injury. Adult Video Ass’n., 71 F.3d at 567

(“[T]he ripeness doctrine not only depends on the finding of a case and controversy and hence

jurisdiction under Article III, but it also requires that the court exercise its discretion to determine

if judicial resolution would be desirable under all of the circumstances.”) (quoting Brown v. Ferro

Corp., 763 F.2d 798, 801 (6th Cir. 1985)). The past alleged injuries and our finding of a continued

threat of injury would suggest that Warshak meets the first ripeness prong.

If the government’s practice was to notify Warshak prior to seeking seizure of his e-mails,

the second and third ripeness factors might support a determination that his claims are not ripe. In

the context of administrative law, for example, a legal challenge is often unripe before a final agency

decision, in part because a better developed legal challenge can be brought at that time. See, e.g.,

Ohio Forestry Ass’n v. Sierra Club, 523 U.S. 726, 734 (1998) (“The Sierra Club thus will have

ample opportunity later to bring its legal challenge at a time when harm is more imminent and more

certain.”). Here, however, the government’s ex parte approach to obtaining Warshak’s e-mails

precludes the possibility of judicial review at a subsequent and more appropriate time. Thus, as

Warshak points out, he will likely suffer the hardship of continuing to have his Fourth Amendment

rights violated with limited legal recourse if his current claims are deemed unripe. Further, with

respect to the second factor, the past seizures of his e-mails present an adequate factual basis on

which to assess the government’s conduct. Although future seizures, and not the past incidents, are

those upon which Warshak’s challenge is focused, the likely similarity renders them a sufficient

backdrop for judicial review.

The government’s elusive practices have themselves limited Warshak’s abilities to seek

redress for future constitutional violations in any other manner. Further, the past alleged

Constitutional violations have demonstrated that the challenged conduct is at least not hypothetical.

The government has not identified a single case where either standing or ripeness were found

lacking where the plaintiff alleged multiple past constitutional violations, a statute explicitly

condoned similar alleged violations in the near future, the threat of such violations continued in light

of pending charges against the subject of the violation, and the government insisted on its

No. 06-4092 Warshak v. United States Page 9

prerogative to continue the challenged conduct. Nor do we believe that any reading of the

precedents of this Court or the Supreme Court can support such a result. For these reasons, we

affirm the district court’s determination that Warshak’s claims are justiciable, and proceed to

consider them on the merits.

B. Likelihood of Success on the Merits: Probable Cause versus Reasonableness and

Fourth Amendment Implications of SCA Orders

1. Probable Cause versus Reasonableness

With respect to the merits of the preliminary injunction, the government argues that court

orders issued under section 2703 are not searches but rather compelled disclosures, akin to

subpoenas. As a result, according to the government, the more stringent showing of probable cause,

a prerequisite to the issuance of a warrant under the Fourth Amendment, is inapplicable, and an

order under section 2703 need only be supported by a showing of “reasonable relevance.”

The government is correct that “whereas the Fourth Amendment mandates a showing of

probable cause for the issuance of search warrants, subpoenas are analyzed only under the Fourth

Amendment’s general reasonableness standard.” Doe v. United States, 253 F.3d 256, 263-64 (6th

Cir. 2001). As this Court has explained, “[o]ne primary reason for this distinction is that, unlike ‘the

immediacy and intrusiveness of a search and seizure conducted pursuant to a warrant[,]’ the

reasonableness of an administrative subpoena’s command can be contested in federal court before

being enforced.” Id. at 264 (quoting In Re Subpoena Duces Tecum, 228 F.3d 341, 347-49 (4th Cir.

2000)); see also Donovan v. Lone Steer, 464 U.S. 408, 415 (1984). The government is also correct

that this principle extends to subpoenas to third-parties — that is, entities other than the subject of

the investigation, like NuVox and Yahoo in this case. See United States v. Phibbs, 999 F.2d 1053,

1077 (6th Cir. 1993).

Phibbs makes explicit, however, a necessary Fourth Amendment caveat to the rule regarding

third-party subpoenas: the party challenging the subpoena has “standing to dispute [its] issuance

on Fourth Amendment grounds” if he can “demonstrate that he had a legitimate expectation of

privacy attaching to the records obtained.” Id.; see also United States v. Miller, 425 U.S. 435, 444

(1976) (“Since no Fourth Amendment interests of the depositor are implicated here, this case

is governed by the general rule that the issuance of a subpoena to a third party to obtain the records

of that party does not violate the rights of a defendant.” (emphasis added)). This language reflects

the rule that where the party challenging the disclosure has voluntarily disclosed his records to a

third party, he maintains no expectation of privacy in the disclosure vis-a-vis that individual, and

assumes the risk of that person disclosing (or being compelled to disclose) the shared information

to the authorities. See, e.g., United States v. Jacobsen, 466 U.S. 109, 117 (1984) (“[W]hen an

individual reveals private information to another, he assumes the risk that his confidant will reveal

that information to the authorities, and if that occurs the Fourth Amendment does not prohibit

governmental use of that information.”).

Combining this disclosure to a third party with the government’s ability to subpoena the third

party alleviates any need for the third-party subpoena to meet the probable cause requirement, if the

challenger has not maintained an expectation of privacy with respect to the individual being

compelled to make the disclosure. For example, in Phibbs, the documents in question were credit

card and phone records that were “readily accessible to employees during the normal course of

business.” 999 F.2d at 1078. A similar rationale was employed by the Supreme Court in Miller.

425 U.S. at 442 (“The checks are not confidential communications but negotiable instruments to be

used in commercial transactions. All of the documents obtained, including financial statements and

deposit slips, contain only information voluntarily conveyed to the banks and exposed to their

employees in the ordinary course of business.”). See also SEC v. Jerry T. O’Brien, Inc., 467 U.S.

No. 06-4092 Warshak v. United States Page 10

735, 743 (1984) (“When a person communicates information to a third party even on the

understanding that the communication is confidential, he cannot object if the third party conveys that

information or records thereof to law enforcement authorities.”). The government’s compelled

disclosure argument, while relevant, therefore begs the critical question of whether an e-mail user

maintains a reasonable expectation of privacy in his e-mails vis-a-vis the party who is subject to

compelled disclosure — in this instance, the ISPs. If he does not, as in Phibbs or Miller, then the

government must meet only the reasonableness standard applicable to compelled disclosures to

obtain the material. If, on the other hand, the e-mail user does maintain a reasonable expectation

of privacy in the content of the e-mails with respect to the ISP, then the Fourth Amendment’s

probable cause standard controls the e-mail seizure.

2. Reasonable expectation of privacy in e-mail content

Two amici curiae convincingly analogize the privacy interest that e-mail users hold in the

content of their e-mails to the privacy interest in the content of telephone calls, recognized by the

Supreme Court in its line of cases involving government eavesdropping on telephone conversations.

See Smith v. Maryland, 442 U.S. 735 (1979); Katz v. United States, 389 U.S. 347 (1967); Berger v.

New York, 388 U.S. 41 (1967). In Berger and Katz, telephone surveillance that intercepted the

content of a conversation was held to constitute a search, because the caller “is surely entitled to

assume that the words he utters into the mouthpiece will not be broadcast to the world,” and

therefore cannot be said to have forfeited his privacy right in the conversation. Katz, 389 U.S. at

352. This is so even though “[t]he telephone conversation itself must be electronically transmitted

by telephone company equipment, and may be recorded or overheard by the use of other company

equipment.” Smith, 442 U.S. at 746 (Stewart, J., dissenting). On the other hand, in Smith, the Court

ruled that the use of pen register, installed at the phone company’s facility to record the numbers

dialed by the telephone user, did not amount to a search. This distinction was due to the fact that

“a pen register differs significantly from the listening device employed in Katz, for pen registers do

not acquire the contents of communications.” 442 U.S. at 741 (emphasis in original).

The distinction between Katz and Miller makes clear that the reasonable expectation of

privacy inquiry in the context of shared communications must necessarily focus on two narrower

questions than the general fact that the communication was shared with another. First, we must

specifically identify the party with whom the communication is shared, as well as the parties from

whom disclosure is shielded. Clearly, under Katz, the mere fact that a communication is shared with

another person does not entirely erode all expectations of privacy, because otherwise eavesdropping

would never amount to a search. It is true, however, that by sharing communications with someone

else, the speaker or writer assumes the risk that it could be revealed to the government by that

person, or obtained through a subpoena directed to that person. See Miller, 425 U.S. at 443 (“[T]he

Fourth Amendment does not prohibit the obtaining of information revealed to a third party and

conveyed by him to Government authorities.”). The same does not necessarily apply, however, to

an intermediary that merely has the ability to access the information sought by the government.

Otherwise phone conversations would never be protected, merely because the telephone company

can access them; letters would never be protected, by virtue of the Postal Service’s ability to access

them; the contents of shared safe deposit boxes or storage lockers would never be protected, by

virtue of the bank or storage company’s ability to access them.

The second necessary inquiry pertains to the precise information actually conveyed to the

party through whom disclosure is sought or obtained. This distinction provides the obvious crux for

the different results in Katz and Smith, because although the conduct of the telephone user in Smith

“may have been calculated to keep the contents of his conversation private, his conduct was not and

could not have been calculated to preserve the privacy of the number he dialed.” 442 U.S. at 743.

Like the depositor in Miller, the caller in Smith “assumed the risk” of the phone company disclosing

the records that he conveyed to it. Id. Yet this assumption of the risk is limited to the specific

No. 06-4092 Warshak v. United States Page 11

information conveyed to the service provider, which in the telephone context excludes the content

of the conversation. It is apparent, therefore, that although the government can compel disclosure

of a shared communication from the party with whom it was shared, it can only compel disclosure

of the specific information to which the subject of its compulsion has been granted access. It cannot,

on the other hand, bootstrap an intermediary’s limited access to one part of the communication (e.g.

the phone number) to allow it access to another part (the content of the conversation).

This focus on the specific information shared with the subject of compelled disclosure

applies with equal force in the e-mail context. Compelled disclosure of subscriber information and

related records through the ISP might not undermine the e-mail subscriber’s Fourth Amendment

interest under Smith, because like the information obtained through the pen register in Smith and like

the bank records in Miller, subscriber information and related records are records of the service

provider as well, and may likely be accessed by ISP employees in the normal course of their

employment. Consequently, the user does not maintain the same expectation of privacy in them vis-

a-vis the service provider, and a third party subpoena to the service provider to access information

that is shared with it likely creates no Fourth Amendment problems.3 The combined precedents of

Katz and Smith, however, recognize a heightened protection for the content of the communications.

Like telephone conversations, simply because the phone company or the ISP could access the

content of e-mails and phone calls, the privacy expectation in the content of either is not diminished,

because there is a societal expectation that the ISP or the phone company will not do so as a matter

of course.4

Similarly, under both Miller and Katz, if the government in this case had received the content

of Warshak’s e-mails by subpoenaing the person with whom Warshak was e-mailing, a Fourth

Amendment challenge brought by Warshak would fail, because he would not have maintained a

reasonable expectation of privacy vis-a-vis his e-mailing partners. See Phibbs, 999 F.2d at 1077.

But this rationale is inapplicable where the party subpoenaed is not expected to access the content

of the documents, much like the phone company in Katz. Thus, as Warshak argues, the government

could not get around the privacy interest attached to a private letter by simply subpoenaing the postal

service with no showing of probable cause, because unlike in Phibbs, postal workers would not be

expected to read the letter in the normal course of business. See Ex Parte Jackson, 96 U.S. 727, 733

(1878) (“No law of Congress can place in the hands of officials connected with the postal service

any authority to invade the secrecy of letters and such sealed packages in the mail; and all

regulations adopted as to mail matter of this kind must be in subordination to the great principle

embodied in the fourth amendment of the Constitution.”). Similarly, a bank customer maintains an

expectation of privacy in a safe deposit box to which the bank lacks access5 (as opposed to bank

records, like checks or account statements) and the government could not compel disclosure of the

contents of the safe deposit box only by subpoenaing the bank.

3

Indeed, the SCA itself largely tracks this distinction by making it easier for the government to obtain records

and subscriber information than to obtain the content of e-mails. Compare 18 U.S.C. § 2703(c)(2) (requiring disclosure

by ISP to government of account holder’s basic identifying information as a matter of course and without notice to

account holder) with 18 U.S.C. § 2703(b) (requiring warrant, subpoena, or court order to obtain “contents of any wire

or electronic communication”).

4

As the Supreme Court explained in Smith, the reasonable expectation of privacy inquiry “embraces two

discrete questions. The first is whether the individual, by his conduct, has exhibited an actual (subjective) expectation

of privacy,— whether, in the words of the Katz majority, the individual has shown that he seeks to preserve [something]

as private. The second question is whether the individual’s subjective expectation of privacy is one that society is

prepared to recognize as reasonable, — whether, in the words of the Katz majority, the individual’s expectation, viewed

objectively, is justifiable under the circumstances.” 442 U.S. at 740 (internal citations and quotation marks omitted).

5

See United States v. Thomas, No. 88-6341, 1989 U.S. App. LEXIS 9628, at *6 (6th Cir. July 5, 1989)

(“Citizens have legitimate expectations of privacy in the contents of their safe deposit boxes.”).

No. 06-4092 Warshak v. United States Page 12

This analysis is consistent with other decisions that have addressed an individual’s

expectation of privacy in particular electronic communications. In Guest v. Leis, 255 F.3d 325, 333

(6th Cir. 2007), we concluded that users of electronic bulletin boards lacked an expectation of

privacy in material posted on the bulletin board, as such materials were “intended for publication

or public posting.” Of course the public disclosure of material to an untold number of readers

distinguishes bulletin board postings from e-mails, which typically have a limited, select number

of recipients. See also Jackson, 96 U.S. at 733 (“[A] distinction is to be made between different

kinds of mail matter, — between what is intended to be kept free from inspection, such as letters,

and sealed packages subject to letter postage; and what is open to inspection, such as newspapers,

magazines, pamphlets, and other printed matter, purposely left in a condition to be examined.”).

Although we stated that an e-mail sender would “lose a legitimate expectation of privacy in an e-

mail that had already reached its recipient,” analogizing such an e-mailer to “a letter-writer,” this

diminished privacy is only relevant with respect to the recipient, as the sender has assumed the risk

of disclosure by or through the recipient. Id. at 333 (citing United States v. King, 55 F.3d 1193,

1196 (6th Cir. 1995)).6 Guest did not hold that the mere use of an intermediary such as an ISP to

send and receive e-mails amounted to a waiver of a legitimate expectation of privacy.

Other courts have addressed analogous situations where electronic communications were

obtained based on the sender’s use of a computer network. In United States v. Simons, the Fourth

Circuit held that a government employee lacked a reasonable expectation of privacy in electronic

files on his office computer, in light of the employer’s policy that explicitly notified the employee

of its intention to “audit, inspect, and monitor,” his computer files. 206 F.3d 392, 398 (4th Cir.

2000). In light of this explicit policy, the employee’s belief that his files were private was not

objectively reasonable. Id. On the other hand, in United States v. Heckenkamp, the Ninth Circuit

held that a university student did have a reasonable expectation of privacy in his computer files even

though he “attached [his computer] to the university network,” because the “university policies do

not eliminate Heckenkamp’s expectation of privacy in his computer.” Nos. 05-10322, 10323, 2007

U.S. App. LEXIS 7806, at *12-13 (9th Cir. Apr. 5, 2007). Although the university did “establish

limited instances in which university administrators may access his computer in order to protect the

university’s systems,” this exception fell far short of a blanket monitoring or auditing policy, and

the Ninth Circuit deemed it insufficient to waive the user’s expectation of privacy.

Heckenkamp and Simons provide useful bookends for the question before us, regarding when

the use of some intermediary provider of computer and e-mail services — be it a commercial ISP,

a university, an employer, or another type of entity — amounts to a waiver of the user’s reasonable

expectation of privacy in the content of the e-mails with respect to that intermediary. In instances

where a user agreement explicitly provides that e-mails and other files will be monitored or audited

as in Simons, the user’s knowledge of this fact may well extinguish his reasonable expectation of

privacy. Without such a statement, however, the service provider’s control over the files and ability

to access them under certain limited circumstances will not be enough to overcome an expectation

of privacy, as in Heckenkamp.

Turning to the instant case, we have little difficulty agreeing with the district court that

individuals maintain a reasonable expectation of privacy in e-mails that are stored with, or sent or

received through, a commercial ISP. The content of e-mail is something that the user “seeks to

preserve as private,” and therefore “may be constitutionally protected.” Katz, 389 U.S. at 351. It

goes without saying that like the telephone earlier in our history, e-mail is an ever-increasing mode

6

Although the Guest panel did not explain the contours of this rule, the rule is apparent from King, the case it

relied upon, in which the defendant’s wife, the recipient of his letters, gave them to another individual who subsequently

turned them over to the government. 55 F.3d at 1195. Because the letters were obtained through the recipient, against

whom the defendant had maintained no privacy interest, we held that he could not raise a Fourth Amendment challenge

to the disclosure. Id. at 1196.

No. 06-4092 Warshak v. United States Page 13

of private communication, and protecting shared communications through this medium is as

important to Fourth Amendment principles today as protecting telephone conversations has been in

the past. See Katz, 389 U.S. at 352 (“To read the Constitution more narrowly is to ignore the vital

role that the public telephone has come to play in private communication.”)

The government asserts that ISPs have the contractual right to access users’ e-mails. The

district court’s ruling was based on its willingness to credit Warshak’s contrary factual argument that

“employees of commercial ISPs [do not] open and read — [nor do] their subscribers reasonably

expect them to open and read — individual subscriber e-mails as a matter of course.” D. Ct. Op. at

10-11. This factual determination tracks the language from Miller and Phibbs that suggests a

privacy interest in records held by a third party is only undermined where the documents are

accessed by the third party or its employees “in the ordinary course of business.” Miller, 425 U.S.

at 442. Moreover, as explained in the Ninth Circuit’s decision in Heckenkamp, mere accessibility

is not enough to waive an expectation of privacy. See Heckenkamp, 2007 U.S. App. LEXIS 7806

at *13 (holding that university policies establishing “limited instances in which university

administrators may access [the user’s] computer in order to protect the university’s systems” was

insufficient to eliminate an expectation of privacy); see also Katz, 389 U.S. at 351 (“[W]hat [a pay

phone user] seeks to preserve as private, even in an area accessible to the public, may be

constitutionally protected.” (emphasis added)). Where a user agreement calls for regular auditing,

inspection, or monitoring of e-mails, the expectation may well be different, as the potential for an

administrator to read the content of e-mails in the account should be apparent to the user. See

Simons, 206 F.3d at 398. Where there is such an arrangement, compelled disclosure by means of

an SCA order directed at the ISP would be akin to the third party subpoena directed at a bank, as in

Miller and Jerry T. O’Brien. In contrast, the terms of service in question here, which the

government has cited to in both the district court and this Court, clearly provide for access only in7

limited circumstances, rather than wholesale inspection, auditing, or monitoring of e-mails.

Because the ISPs right to access e-mails under these user agreements is reserved for extraordinary

circumstances, much like the university policy in Heckenkamp, it is similarly insufficient to

undermine a user’s expectation of privacy. For now, the government has made no showing that e-

mail content is regularly accessed by ISPs, or that users are aware of such access of content.

The government also insists that ISPs regularly screen users’ e-mails for viruses, spam, and

child pornography. Even assuming that this is true, however, such a process does not waive an

expectation of privacy in the content of e-mails sent through the ISP, for the same reasons that the

terms of service are insufficient to waive privacy expectations. The government states that ISPs “are

developing technology that will enable them to scan user images” for child pornography and viruses.

The government’s statement that this process involves “technology,” rather than manual, human

review, suggests that it involves a computer searching for particular terms, types of images, or

similar indicia of wrongdoing that would not disclose the content of the e-mail to any person at the

ISP or elsewhere, aside from the recipient. But the reasonable expectation of privacy of an e-mail

user goes to the content of the e-mail message. The fact that a computer scans millions of e-mails

for signs of pornography or a virus does not invade an individual’s content-based privacy interest

in the e-mails and has little bearing on his expectation of privacy in the content. In fact, these

screening processes are analogous to the post office screening packages for evidence of drugs or

explosives, which does not expose the content of written documents enclosed in the packages. The

7

See Gov’t Br. at 34 (citing Yahoo terms of service which allow access where “reasonably necessary to:

(a) comply with legal process; (b) enforce the [Terms of Service]; (c) respond to claims that any Content violates the

rights of third parties; (d) respond to your requests for customer service; or (e) protect the rights, property or personal

safety of Yahoo!, its users and the public.”). As amicus Electronic Frontier Foundation points out, each instance involves

outside prompting for an ISP to review content, and does not occur in the normal course of business. This type of

accessibility by the service provider was rejected as diminishing the expectation of privacy in Katz, as well as in

Heckenkamp.

No. 06-4092 Warshak v. United States Page 14

fact that such screening occurs as a general matter does not diminish the well-established reasonable

expectation of privacy that users of the mail maintain in the packages they send.

It is also worth noting that other portions of the SCA itself strongly support an e-mail user’s

reasonable expectation of privacy in the content of his e-mails. Section 2701 prohibits unauthorized

users from accessing e-mails. Section 2702 generally prohibits an ISP from disclosing e-mail

content without the permission of the user. Further, section 2703 makes it easier for the government

to get an order requiring the disclosure of records and subscriber information, in which the user does

not maintain a privacy interest vis-a-vis the ISP, than to obtain an order requiring the disclosure of

content. The statute also requires a warrant to search the content of e-mails that have been stored

for 180 days or less. 18 U.S.C. 1703(a). Thus, even though the contested exception in section

2703(b) creates tension with the Fourth Amendment’s requirements for a warrant, independent

provisions support the proposition that a user maintains a reasonable expectation of privacy in the

content of his e-mails.

The government’s compelled disclosure argument is initially on point, but fails to address

adequately the caveat relating to a party’s maintenance of a reasonable expectation of privacy in

documents in the custody of a third party. A warrant based on probable cause would not have been

necessary had the government subpoenaed Warshak or given him prior notice of its intent to seek

an SCA order, because the need for this higher showing would be offset by his ability to obtain

judicial review before producing any e-mails. See Phibbs, 999 F.2d at 1077 (“The subpoena has to

be ‘sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance

[would] not be unreasonable.’ If it is a subpoena duces tecum, the government does not have to

secure a judicial warrant before service is effectuated. Nonetheless, ‘the subpoenaed party [must be

able to] obtain judicial review of the reasonableness of the demand prior to suffering penalties for

refusing to comply.’” (citing See v. City of Seattle, 387 U.S. 541, 544 (1967)). The same rationale

would apply if the government subpoenaed a third party that had access to the content of the e-mails,

and against whom Warshak had no claim of privacy, such as the recipient of one of his e-mails. By

the same token, an SCA order that provided notice to the ISP alone, and not to the user, would be

appropriate in the limited instances where the user had waived his expectation of privacy with

respect to the ISP, such as where the government can show that auditing, monitoring, or inspection

are expressly provided for in the terms of service, or where the user has e-mailed content directly

to the ISP. Where the third party is not expected to access the e-mails in the normal course of

business, however, the party maintains a reasonable expectation of privacy, and subpoenaing the

entity with mere custody over the documents is insufficient to trump the Fourth Amendment warrant

requirement.

The district court enjoined the United States “from seizing, pursuant to court order under 18

U.S.C. § 2703(d), the contents of any personal e-mail account maintained by an Internet Service

Provider in the name of any resident of the Southern District of Ohio without providing the relevant

account holder or subscriber prior notice and an opportunity to be heard . . . .” D. Ct. Op. at 19. Our

discussion above necessitates one modification to this injunction, which counsel for Warshak agreed

at oral argument would be appropriate. If the government can show, based on specific facts, that

an e-mail account holder has waived his expectation of privacy vis-a-vis the ISP, compelled

disclosure of e-mails through notice to the ISP alone would be appropriate. This is a narrow

modification, however, as a right to access e-mails in an account only in certain limited

circumstances would not be sufficient. Rather, the government must show that the ISP or other

intermediary clearly established and utilized the right to inspect, monitor, or audit the content of e-

mails, or otherwise had content revealed to it. In such cases the SCA order will operate as the

functional equivalent of a third party subpoena, allowing disclosure through a party that has total

access to the documents in question. On remand, therefore, the preliminary injunction shall allow

seizures of e-mail in three situations: (1) if the government obtains a search warrant under the

Fourth Amendment, based on probable cause and in compliance with the particularity requirement;

No. 06-4092 Warshak v. United States Page 15

(2) if the government provides notice to the account holder in seeking an SCA order, according him

the same judicial review he would be allowed were he to be subpoenaed; or (3) if the government

can show specific, articulable facts, demonstrating that an ISP or other entity has complete access

to the e-mails in question and that it actually relies on and utilizes this access in the normal course

of business, sufficient to establish that the user has waived his expectation of privacy with respect

to that entity, in which case compelled disclosure may occur if that entity is afforded notice and an

opportunity to be heard.8

C. Was Warshak’s claim appropriately upheld as a facial challenge?

The government argues that under United States v. Salerno, Warshak must prove that the

challenged portion of the statute can never be constitutionally applied in order for the facial

challenge to be upheld. 481 U.S. 739, 745-46 (1987) (“A facial challenge to a legislative Act is, of

course, the most difficult challenge to mount successfully, since the challenger must establish that

no set of circumstances exists under which the Act would be valid.”). It specifically contends that,

assuming some ISP e-mail account holders maintain a reasonable expectation of privacy in the

content of their e-mails, there still are likely to be others who do not. Because the statute would be

constitutional with respect to these account holders, the government argues that it should not be

facially invalidated. It also identifies several hypothetical scenarios in which it contends the account

holder’s reasonable expectation of privacy could be maintained.

Warshak and amici initially counter that the statement from Salerno relied upon by the

government in fact overstates the requirement for facially enjoining a statute. In a separately written

concurrence in a denial of a petition of certiorari, Justice Stevens has pointed out that the “rigid and

unwise dictum” from Salerno upon which the government now relies was neither an accurate

statement of the law nor, more importantly, an accurate description of the Supreme Court’s practice

with respect to facial challenges. Janklow v. Planned Parenthood, Sioux Falls Clinic, 517 U.S. 1174

n.1 (1996) (Stevens, J., concurring in dissent from denial of certiorari). Justice Stevens catalogued

several opinions that he claimed demonstrated the Court has effectively, if not explicitly, rejected

the Salerno dictum.

There are a few well-known exceptions to the “no circumstances” test for facial validity. For

example, in the First Amendment context, an overbreadth challenge allows a plaintiff to facially

challenge a statute that can be constitutionally applied to his own conduct so as to protect the speech

of others from any chilling effect the statute might have. See, e.g., Prime Media, 2007 U.S. App.

LEXIS 10862, at *10-11. In the abortion context, the “undue burden” test has a similar effect, as

an abortion statute can be facially invalid even if, in some instances, its prohibition of certain

abortions would be constitutional. See Casey, 505 U.S. at 895. We have noted that “[a]lthough

8

Because our opinion speaks to the appropriate remedy in this case, we note one other important principle that

applies both to e-mail seizures pursuant to a warrant supported by probable cause, and to compelled disclosure through

a process akin to that involved with subpoenas. In neither instance is the government necessarily entitled to every e-mail

stored with the ISP, many of which are likely to be entirely unrelated to its specific investigation. If the e-mails are

seized pursuant to a warrant, the Fourth Amendment’s particularity requirement would necessitate that the scope of the

search somehow be designed to target e-mails that could reasonably be believed to have some connection to the alleged

crime being investigated. See United States v. Logan, 250 F.3d 350, 364-65 (6th Cir. 2001) (“The purpose of this

particularity requirement is to prevent the use of general warrants authorizing wide-ranging rummaging searches in

violation of the Constitution’s proscription against unreasonable searches and seizures.”). Similarly, where a subpoena

or an SCA order compels the disclosure of e-mails, the demand must be reasonable in scope and relevance. Doe v.

United States (In re Admin. Subpoena), 253 F.3d 256, 263 (6th Cir. 2001). Both of these requirements are fact specific.

See Logan, 250 F.3d at 365 (“A description contained in a warrant is sufficiently particular if it is as specific as the

circumstances and the nature of the alleged crime permit.”). In either instance, a district court should consider whether

the search could be narrowed by parameters such as the sender, recipient, date, relevant attachments, or keywords. We

need not address these requirements in depth here, as the district courts are well suited to incorporate them on a case-by-

case basis. We only reiterate them lest our opinion be read to somehow circumvent them.

No. 06-4092 Warshak v. United States Page 16

Casey does not expressly purport to overrule Salerno [in the abortion context], in effect it does.”

Women’s Medical Professional Corp. v. Voinovich, 130 F.3d 187, 194 (6th Cir. 1997). Although

these exceptions pertain to specific subject matters that are not applicable here, they do demonstrate

that the “no circumstances” standard is less sacrosanct than the government suggests.

The fact that there are exceptions to Salerno and that members of the Supreme Court have

quibbled in the public record about its ongoing validity does not demonstrate its invalidity as a

general principle pertaining to facial challenges. A more convincing argument about why Salerno

does not apply in the Fourth Amendment context is the Supreme Court’s decision in Berger, a case

that is particularly analogous to this one. In Berger, the Court facially invalidated a New York

statute that provided for court ordered wiretaps of telephone conversations on a showing of less than

probable cause. 388 U.S. at 54. The Court explicitly stated that by allowing such a procedure, the

statute violated the Warrant Clause by endorsing searches without a showing of probable cause.

“The purpose of the probable-cause requirement of the Fourth Amendment, to keep the state out of

constitutionally protected areas until it has reason to believe that a specific crime has been or is

being committed, is thereby wholly aborted.” Id. at 59. The Court acknowledged that it had “in the

past, under specific conditions and circumstances, sustained the use of eavesdropping devices.” Id.

at 63. Under the government’s present Salerno argument, this fact would have precluded facial

invalidation of the statute in Berger as well. Yet the prospect of a constitutional application of the

statute, either where a court order was supported by probable cause, or where the participants in the

conversation lacked a reasonable expectation of privacy, did not prevent facial invalidation in

Berger.

Under Berger, facial invalidation is justified where the statute, on its face, endorses

procedures to authorize a search that clearly do not comport with the Fourth Amendment. A seizure

of e-mails from an ISP, without either a warrant supported by probable cause, notice to the account

holder to render the intrusion the functional equivalent of a subpoena, or a showing that the user

maintained no expectation of privacy in the e-mail, amounts to exactly this. Therefore the district

court’s injunction was appropriate under Berger, regardless of the ongoing validity of the statement

from Salerno on which the government relies.

Even if the stringent Salerno standard did govern the claim here, the government has not

shown that the challenged application of the statute can be constitutionally applied. The government

attempts to argue that under several scenarios, an e-mail user will not maintain a reasonable

expectation of privacy in his e-mail account and, therefore a court order under section 2703 would

not raise any Constitutional problems. First, the government points to certain user-provider

relationships that could diminish the subscriber’s expectation of privacy. These include an employer

that issues e-mail accounts to its employees and requires them to waive any expectation of privacy

in the account, and ISPs with similar requirements in their terms of service. As discussed above,

we reject the argument that the user agreements in this case have such an effect. In some situations,

like that in Simons, the user agreement might indicate that the user lacks a privacy interest vis-a-vis

the employer or other relevant e-mail provider. This possibility does not diminish a privacy right

with respect to the entire outside world, however. It would be proper in this situation for the

government to seek disclosure with notice to an employer or provider who has access to the content

of the e-mail, but this is an exception that our modification of the injunction adequately accounts

for and does not defeat the validity of a facial challenge altogether.

The government also argues that by reserving the right to screen e-mails, the ISPs diminish

any expectation of privacy their subscribers might have. Again, it is entirely possible, if not likely,

that this process occurs without ever having a human being read the content of subscribers’ e-mails.

Where total access is the norm, we hold that the government may show as much and then may

compel disclosure through the ISP. Less in-depth screening, however, is insufficient to diminish

the privacy interest in an e-mail account.

No. 06-4092 Warshak v. United States Page 17

As another example, the government contends that when an e-mail account is abandoned,

as could occur with ISPs that require payment which the user fails to remit, the account holder

maintains no reasonable expectation of privacy. The government analogizes this situation to a hotel

room, in which the guest has an expectation of privacy, but abandons it when he leaves the room or

is evicted by management. See, e.g., United States v. Allen, 106 F.3d 695, 699 (6th Cir. 1997). This

analogy lacks any connection to the actual practices of commercial ISPs. When a hotel guest checks

out of his room, another person will occupy it, access every part of it in which he might have

maintained any privacy interest, put his underwear in the same drawer, and otherwise extinguish any

privacy interest to the fullest extent. Dominion and control over the hotel room is entirely

surrendered to the hotel management, which in turn passes it on to the next guest who occupies the

room. On the other hand, when an e-mail user stops using an e-mail address that is tied to his

personal identity, he would certainly not expect that somebody else could come along, sign up for

the same account, and not only send e-mails in his name, but read every past e-mail that he had

failed to delete from the account or sent to someone else. There is no reason to believe that

dominion or control over the contents of the account is yielded to the ISP or another user. This

analogy is entirely inapposite.

Finally, the government points to “e-mail accounts that are procured through fraudulent

means” as situations where an account holder has no reasonable expectation of privacy. This

argument is another red herring, primarily because it cannot account for the majority of commercial

e-mail services that offer their services for free. This obviously begs the question of why someone

would have to commit fraud to get an account. Yet even if a hypothetical user wanted to conceal

his identity or address from the ISP, the provision of misinformation would not bear in any way

upon the privacy of the content of the user’s e-mails. Further, the government suggests that a

“hacker” who obtains “Internet services and e-mail accounts using stolen credit cards” would lack

an expectation of privacy in the account he purchases, citing to a case where the thief of a stolen

laptop did not have an expectation of privacy in material on the computer’s hard drive. See United

States v. Caymen, 404 F.3d 1196, 1201 (9th Cir. 2005). Where a thief steals someone else’s

property, it is true that he lacks an expectation of privacy in that property, such as the laptop

computer at issue in Caymen. The government’s hypothetical thief in this case would clearly not

have an expectation of privacy in the victim’s credit card account, which he illegally accessed. Why

this person would lack a reasonable expectation of privacy in the contents of an e-mail account,

however, is far from clear.9 Because the government’s hypothetical “hackers” cannot be said to

“steal” the contents of the e-mails in the account, or an entire ISP server for that matter, this example

is also unhelpful.

In light of our minor modification of the district court’s injunction, we hold that narrow,

facial invalidation of the statute is justified. See Ayotte v. Planned Parenthood, 546 U.S. 320, 328-

329 (2006) (“Generally speaking, when confronting a constitutional flaw in a statute, we try to limit

the solution to the problem. We prefer, for example, to enjoin only the unconstitutional applications

of a statute while leaving other applications in force, or to sever its problematic portions while

leaving the remainder intact.” (citing United States v. Raines, 362 U.S. 17, 20-22 (1960) and United

States v. Booker, 543 U.S. 220, 227-229 (2005))).10 The government has not accounted in any way

9

Of course if there were reason to suspect this individual of identity theft or credit card fraud, and some nexus

to the use of the e-mail account, the government may well have reason to search it. This possibility has no bearing,

however, on the entirely separate question of whether the user maintains a reasonable expectation of privacy that would

require a warrant to authorize the search.

10

Ayotte seems to counsel against the extreme reading of Salerno that the government advances here. The case

involved a New Hampshire statute that prohibited minors from receiving an abortion until 48 hours after their parents

or guardians had received written notice of the planned procedure. The Court accepted the fact that in a “small

percentage” of cases, the statute would present a serious health risk to the pregnant minor, but otherwise deemed it to

No. 06-4092 Warshak v. United States Page 18

for the privacy of shared communications, which since Katz have been protected from disclosure

without either a warrant, the consent of one of the parties to the conversation, or compelled

disclosure accompanied by an opportunity for judicial review. Our order sufficiently narrows the

facial attack on the statute so that only its unconstitutional applications are enjoined, thereby

obviating any problems under Salerno.

D. Balancing of Preliminary Injunction Factors

In addition to its argument pertaining to Warshak’s likelihood of success on the merits, the

government contends that other preliminary injunction factors — irreparable harm and balancing

of the interests of the public and the parties — do not support the injunction here. The district court

determined that Warshak would be irreparably harmed by future intrusions into his private e-mails,

and that money damages cannot compensate him for this harm. With regard to the balancing of

interests, the district court noted that “it is always in the public interest to prevent violation of a

party’s constitutional rights.” D. Ct. Op. at 15 (citing Deja Vu of Nashville, Inc. v. Metro. Gov’t of

Nashville & Davidson County, 274 F.3d 377, 400 (6th Cir. 2001)). The district court also stated that

its order would not unduly inhibit law enforcement, as the preliminary injunction would still permit

e-mail seizures pursuant to a warrant or after the provision of notice to the account holder, and that

law enforcement interests cannot trump the Fourth Amendment concerns raised by the government’s

conduct. It therefore concluded that “all four factors weigh in favor of granting preliminary

injunctive relief to Warshak.” Id. at 15-16. This balancing determination is reviewed for an abuse

of discretion, under which this Court “accords great deference to the decision of the district court.

The district court’s determination will be disturbed only if the district court relied upon clearly

erroneous findings of fact, improperly applied the governing law, or used an erroneous legal

standard.” Blue Cross & Blue Shield Mut. v. Blue Cross & Blue Shield Ass’n, 110 F.3d 318, 322

(6th Cir. 1997).

On appeal, the government contends that Warshak will not suffer irreparable harm, relying

again on its argument that Warshak cannot show an imminent threat of future seizures, and also

contending that he can recover money damages for any future violations of the SCA, that he would

receive notice of future seizures of his e-mails now that he has been indicted and there would be no

reason to hide the investigation, and that a motion to suppress in his criminal trial represents another

adequate remedy for Warshak’s fear of future seizures.

Initially, for similar reasons to our determination that Warshak has standing to bring suit, we

conclude that Warshak has shown imminent threat of harm in the form of continued11invasions of his

Fourth Amendment rights. This determination is based on the past e-mail seizures, which violated

the SCA itself as well as the Fourth Amendment, the government’s ongoing investigation of

Warshak, and the government’s clear policy of seizing e-mails without a warrant or notice to the

account holder. Further, the government’s contention that it would have no reason to seek future

be a valid regulation. 546 U.S. at 327. The Court indicated that partial invalidation of the statute was the preferred

remedy, in light of the prospect of mixed constitutional and unconstitutional applications. Id. at 329. (“[T]he ‘normal

rule’ is that ‘partial, rather than facial, invalidation is the required course,’ such that a ‘statute may . . . be declared invalid

to the extent that it reaches too far, but otherwise left intact.’”(citing Brockett v. Spokane Arcades, Inc., 472 U.S. 491,

504 (1985)). Although the Court distinguished between partial and facial invalidation, it certainly did not state that

existence of valid, constitutional applications in some situations precluded the use of a facial challenge altogether,

calling instead for the case to continue after remand for reconsideration of the appropriate remedy. Ayotte suggests that

the narrow injunctive relief we endorse today avoids any potential Salerno problems. Nor, unlike Casey, can we read

this portion of Ayotte to be limited to the abortion context, as it describes a general approach to remedies without

focusing on the underlying subject matter, and relies on cases that have nothing to do with abortion.

11

See, e.g., Lyons, 461 U.S. at 102 (“Past wrongs [are] evidence bearing on ‘whether there is a real and

immediate threat of repeated injury.’”).

No. 06-4092 Warshak v. United States Page 19

disclosures without providing notice to Warshak seems at odds with its refusal to give him any

assurance that this would be the case. Although it appears that Warshak made a general request that

the government stop seeking court ordered seizures of his e-mails, rather than requesting notice

pursuant to the statute, the government could have simply offered to provide notification under the

statute, rather than replying with a blanket rejection. It also seems that the government would have

reason not to provide Warshak with advance notice of any future searches of his e-mails. Although

he has been indicted, and is obviously now aware of the investigation against him, it does not appear

that Warshak is in custody, and thus he could have as much opportunity and incentive to destroy

evidence now as he would have at any other time. Ultimately, the government’s prior conduct

renders it difficult for us to believe that Warshak’s privacy interests can simply be trusted to the

government’s alleged “lack of interest” in future searches without prior notice.

The government’s remaining arguments regarding alternative remedies would not protect

the privacy interest that Warshak is seeking to uphold. His privacy interest in his e-mail

conversations goes beyond not wanting to be incriminated by his e-mails, which is the only potential

remedy from a suppression motion in his criminal case. Further, although money damages might

be available to Warshak for the violations,12 they similarly would not necessarily provide an

adequate remedy. Warshak is seeking to protect the privacy of his communications, guaranteed to

him by the Fourth Amendment, rather than merely seeking not to be incriminated by the content of

his e-mails or to be compensated for the privacy violations he has suffered. We cannot conclude that

the district court abused its discretion in finding that irreparable harm to Warshak supported the

issuance of the preliminary injunction.

The district court’s decision also appears to be supported by the balancing of the interests

of Warshak, the government, and the public. Although the government claims that its investigative

abilities will be unduly hampered by the injunction, it still can search e-mails stored with ISPs either

through obtaining a warrant, by notifying the account holder, or, in light of our modification to the

injunction, by making a fact specific showing that the account holder has waived his expectation of

privacy with respect to the ISP. Further, under section 2703(f), it can require an ISP to preserve

evidence “pending the issuance of a court order or other process,” ameliorating any concerns about

the destruction of evidence. This provision would seemingly address the government’s concerns

about destruction of evidence, as it could order the ISP to preserve evidence at the same time it

provides Warshak notice of its intent to compel disclosure. To the extent that the government seeks

to search e-mails covertly without a warrant, this interest is simply incompatible with the Fourth

Amendment, and provides no basis for overturning the injunction. See Almeida-Sanchez v. United

States, 413 U.S. 266, 273 (1973) (“The needs of law enforcement stand in constant tension with the

Constitution’s protections of the individual against certain exercises of official power. It is precisely

the predictability of these pressures that counsels a resolute loyalty to constitutional safeguards.”).

Further, because “it is always in the public interest to prevent violation of a party’s constitutional

rights,” this desire to conduct ex parte e-mail searches without notice to the account holder indicates

that the public interest counsels in favor of the preliminary injunction. It goes without saying that

Warshak’s constitutional privacy interest is also advanced by the injunction.

For these reasons, we agree with the district court that the other preliminary injunction

factors support the injunctive relief it issued. At a minimum, we would be hard-pressed to believe

that they show in any way that the district court abused its discretion, particularly in light of the

narrowed scope of the preliminary injunction that our added modification has imposed.

12

18 U.S.C. § 2712 provides for monetary relief against the United States for violations of the SCA. Warshak’s

constitutional claims go beyond violations of the statute, however. Even so, he would still potentially have a cause of

action under 42 U.S.C. § 1983, although one would have to imagine that he would face viable defenses of qualified

immunity were he inclined to seek money damages.

No. 06-4092 Warshak v. United States Page 20

IV.

The district court correctly determined that e-mail users maintain a reasonable expectation

of privacy in the content of their e-mails, and we agree that the injunctive relief it crafted was largely

appropriate, although we find necessary one modification. On remand, the preliminary injunction

should be modified to prohibit the United States from seizing the contents of a personal e-mail

account maintained by an ISP in the name of any resident of the Southern District of Ohio, pursuant

to a court order issued under 18 U.S.C. § 2703(d), without either (1) providing the relevant account

holder or subscriber prior notice and an opportunity to be heard, or (2) making a fact-specific

showing that the account holder maintained no expectation of privacy with respect to the ISP, in

which case only the ISP need be provided prior notice and an opportunity to be heard.