LibriumArcana.Games

A few weeks back, the Ninth Circuit Court of Appeals in San Francisco issued an important ruling about Internet privacy—or lack thereof. Reaction to the case has been mixed; some commentators see it as a logical extension of existing telecommunications policy, while others view it with the same sort of enthusiasm generally reserved for the Four Horsemen of the Apocalypse. Given the importance the case has already taken on, let's take a look back at the decision and at some recent reaction to it.

The court's ruling was essentially a simple one. The government is currently allowed to deploy "pen registers"—devices that can record every telephone number a suspect dials—without a warrant, since a list of telephone numbers is considered only addressing information and not content. This is analogous to the US Postal Service, where anyone can read information on the outside of an envelope but can't look at the contents. The Ninth Circuit ruled that grabbing e-mail addresses and IP addresses without a warrant amounts to the same thing, and is legal. This is the first time that a federal court has ruled on the issue.

The case in question is US v. Forrester (PDF). The government charged two California men with attempting to set up a massive ecstasy lab inside an insulated sea/land container near Escondido. As part of the investigation, the Feds "applied for and received court permission to install a pen register analogue on [one of the defendants'] computer." That device, which despite the court's language was actually installed at the defendant's ISP, captured the defendant's to/from e-mail addresses, the IP addresses of web sites that he visited, and the total volume of information sent from his account.

According to the court, all of this is functionally identical to a traditional pen register that captures only telephone numbers, and the court therefore ruled that it does not even qualify as a "search." This means that the defendant could not challenge the move on Fourth Amendment grounds of unreasonable search or seizure.

"We conclude that these surveillance techniques are constitutionally indistinguishable from the use of the pen register," wrote Judge Raymond Fisher. The data collected "reveal no more about the underlying contents of communication than do phone numbers."

Not everyone agrees. On Thursday, the EFF took issue with the decision, saying that it "relies on a faulty analogy." The way they see it, e-mail addresses (such as "VoteBush@aol.com") and IP addresses do reveal content, not just addressing information. I asked the EFF's Derek Slater how this differed from phone numbers; after all, repeatedly dialing the Aryan Nation might also tell the Feds a few things. "You're right that phone numbers can easily be connected to a 'who' and a 'when' (e.g., Aryans, 8 PM), and so can IP addresses," Slater tells Ars. "But you can't as easily connect a phone number to the 'what' (the content of a conversation), whereas the IP addresses can be linked with other transactional info to do so."

Professor Shaun Martin of the University of San Diego School of Law agrees. Writing recently about the case on his blog, Martin notes, "Once the government records that I'm going to the IP addresses for NAMBLA and High Times and Bondage.com, the fact that they won't (initially) know which particular page of those sites I choose to view hardly matters. They've already invaded my privacy and know a boatload about me that I'd rather not reveal to the government."

But Orin Kerr, a law professor at George Washington University, doesn't see it that way. In a posting on popular legal blog The Volokh Conspiracy, Kerr argued that—so long as the surveillance was done at the ISP's office—"the result in Forrester is clearly correct."

In any event, readers interested in building a $10 million per month drug lab in the backyard should be aware that the government can get a list of all the phone numbers you call, the IP addresses you visit, and the people you e-mail.