Appeals court throws out ISP snooping case

Ruling protects practices such as spam filtering, but critics say decision is dangerous expansion of federal wiretap powers.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
3 min read
A federal appeals court dismissed a case against an e-mail provider who allegedly violated federal wiretapping laws by reading messages meant for customers, a decision critics say could make it easier for police to seek permission to tap Net phone calls.

In a 2-1 ruling Tuesday, the 1st Circuit Court of Appeals upheld a Massachusetts court's decision to throw out a case against Bradford Councilman, formerly vice president of online bookseller Interloc--now part of Alibris.

Interloc provided some of its customers, typically dealers of rare or used books, with e-mail addresses ending in "@interloc.com." Councilman allegedly ordered the creation of a Procmail script, which saved copies of inbound messages from Amazon.com sent to those specialty book dealers, in hopes of gaining commercial intelligence. (Procmail is a popular Unix utility used for sorting and delivering incoming e-mail.)

The majority ruled that federal wiretap laws draw a sharp distinction between intercepting communications that are in transit--such as a telephone call--and those that are stored, even temporarily.

"No intercept occurred in this case, and therefore, the Wiretap Act could not be violated," the court said in an opinion written by Judge Juan Torruella.

Though federal wiretap prohibitions may arguably be "out of step with the technological realities of computer crimes," the court said, making any changes to such prohibitions was up to Congress.

"We're winning the case because this is the way Congress wrote the statute in 1986," said Andrew Good, a partner at Good and Cormier, who is representing Councilman. "You don't commit a federal crime in this country unless Congress says what you're doing is a crime."

Good said if the 1st Circuit had agreed with the Justice Department, Internet service providers could be brought up on charges for reviewing incoming e-mail--during virus and spam checks, for instance.

"In our view, this kind of activity is widespread," Good said. "It's not as if Councilman is the only guy who (allegedly did) this. The statute doesn't distinguish between ISPs you may pay to use, like AOL, and an employer ISP or a school ISP such as harvard.edu. They'd be committing crimes. Many providers in that category surveil e-mail and even intercept it so it's not delivered to the subscribers. It's their system, and they can do with it what they want."

But in a dissent, Judge Kermit Victor Lipez said that his colleagues' "approach to the Wiretap Act would undo decades of practice and precedent regarding the scope of the Wiretap Act and would essentially render the Act irrelevant to the protection of wire and electronic privacy." Congress probably didn't intend to define "electronic communication" so narrowly, Lipez said, and warned that the majority's approach could let the government intercept voice over Internet Protocol (VoIP) conversations by lowering legal hurdles to tapping routers that use temporary storage.

The Electronic Frontier Foundation in San Francisco agreed. "By interpreting the Wiretap Act's privacy protections very narrowly, this court has effectively given Internet communications providers free rein to invade the privacy of their users for any reason and at any time," said EFF attorney Kevin Bankston. "This decision makes clear that the law has failed to adapt to the realities of Internet communications and must be updated to protect online privacy."

Even if federal law does not apply, state laws may restrict unlawful interception. In addition, electronic snooping that causes actual harm can be punished through civil lawsuits.

Councilman did not admit to reading messages sent to booksellers' interloc.com addresses, and the courts did not rule that he did. Councilman was prosecuted by the U.S. Attorney's office in Massachusetts, which could ask the 1st Circuit for a rehearing or seek Supreme Court review of the case.