Existing Internet Laws Reduce Constitutional Protections

In particular, the Transmission Control Protocol (“TCP”) and the Internet Protocol (“IP”) are required of all Internet communication and oblige all Internet messages to be sent in a specific manner. All computers sending Internet messages must first enclose them in uniquely addressed digital envelopes, then send them to the gateway computer to be handed off to other networks. Each computer handles each Internet message by copying and routing such encapsulated IP packets from network to network.

Historically, the American privacy doctrine is modeled upon real property concepts. Since the Fourth Amendment has been increasingly subject to codification, most modernization of privacy law is a function of legislative action. As a consequence, such changes are dependent upon political, rather than technological, change. No such change has yet been implemented with respect to Internet privacy.

Privacy Interest, Not Right

There is no explicit right to privacy in the United States Constitution. The Supreme Court has found several privacy interests, including:

• The right of association contained in the First Amendment;
• The Third Amendment's privacy right of a home owner by its prohibition against the quartering of soldiers “in any house” in time of peace without the consent of the owner;
• The Fourth Amendment explicitly affirms the privacy right of people with respect to their persons, houses, papers and effects, against unreasonable searches and seizures;
• The Fifth Amendment's zone of privacy which government may not force one to surrender detrimental information; and
• The Fourteenth Amendment's application of privacy rights to the states.

In short, the Supreme Court's findings are protections against all governmental invasions of life's privacies.

Just as there is no explicit constitutional right to privacy, there is no general privacy statute that requires electronic records held by third parties to keep such records private. Rather, the protection of such electronic records may be found due to a particular set of facts.

The Fourth Amendment

Two approaches to Fourth Amendment privacy protection are generally used. One approach equated unlawful requests for information with unlawful search and seizure. The other approach required physical trespass into a zone of privacy. Katz v. United States, 389 U.S. 347 (1967). But the Katz court recognized that the “Fourth Amendment protects people, not places. What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.”

In short, the Supreme Court has found that capacity to claim the protection of the Fourth Amendment depends upon whether the person who claims the protection of the amendment has a legitimate expectation of privacy in the invaded place. See, Rakas v. Illinois, 439 U.S. 128, 143 (1978). However, a subjective expectation of privacy is legitimate if it is one that society is prepared to recognize as reasonable, according to Minnesota v. Olson, 495 U.S. 91 (1990).

Thus the privacy interest one retains in information transmitted to a third party is clear. Courts have found no reasonable expectation of privacy; they have highlighted factors evidencing consent. In Smith v. Maryland, 442 U.S. 735, 742 (1979), the Supreme Court found that there is no such expectation of privacy regarding the numbers dialed on a telephone because the telephone company was expected to access the information. Similarly, in United States v. Simons, 206 F.3d 392 (4th Cir. 2000), the court found that an employee did not have a legitimate expectation of privacy with regard to his employer's record of his Internet usage.

Privacy of the Net

Due to the Internet's system of transmitting data from one relatively available and local computer to another, using a protocol of transmission which requires that content and data be duplicated by third parties all along the way, it may be argued that there is no reasonable expectation of privacy in Internet communications.

At least three courts have attempted to grant some Internet privacy on the grounds that it may be reasonably expected. See, United States v. Maxwell, 45 M.J. 406, 417 (1996), which found that the tenor and content of the
e-mail conversations between appellant and his correspondent suggested that they each had an expectation that the conversations were private. Similarly, in Warshak v. United States, 490 F.3d 455, (6th Cir. 2007), the court found a reasonable expectation of privacy in e-mail communications after narrowing the inquiry to identify the party with whom information was shared or from whom information was shielded, and the precise information actually conveyed. Also, the court in United States v. Heckenkamp, 482 F.3d 1142, 1147 (9th Cir. 2007), found that a student had a reasonable expectation of privacy in information he transmitted over the university's network insofar as there was no announced monitoring policy.

In Berger v. New York, 388 U.S. 41 (1967), the Supreme Court defined the procedural safeguards necessary to protect the privacy interest. In particular, once a user establishes such a reasonable expectation of privacy, the inquiry shifts to whether the statute at issue sufficiently protects that right to privacy. To date, no such shift has occurred.

The Electronic Communications Privacy Act of 1986 (“ECPA”), 18 U.S.C. ”2510-2521, 2701-2711, 3121-3127 (2006), extends government restrictions on wire taps from telephone calls to include transmissions of electronic data by computer. However, the ECPA only protects wire, oral and electronic communications while in transit. Internet communication technology and protocols mandate that Internet messages stop and be stored multiple times en route, thus eliminating the application of ECPA to Internet communication.

Overcoming Difficulties

To overcome some of the difficulties inherent in Internet communication, both technological and legal options are available. Both options attempt to either limit the amount and change the nature of content and data available to third parties or change the privacy expectation by providing notice.

First, an Internet user may employ legal notices to change the expectation of privacy with respect to the Internet communication. In particular, an Internet user may embed a notice in the communication putting a third-party recipient on notice that the communication is privileged, proprietary or confidential ' and that the third party should treat it as such. Just as it is important to place a notice on a fax cover sheet, it is important to use technology to ensure that the notice appears prior to allowing a third party access to the Internet communication data or content. The use of data formatting to prevent deep linking can be employed to force a third-party reader of an Internet communication to view the beginning of an Internet communication before being able to access any other part.

Next, an Internet user may use technology to limit a third party's access to the content of the communication. For example, a privileged, proprietary or confidential Internet communication may be sent as an attachment. The disclaimer in the body of the e-mail might then read: “The attachment to this e-mail may be privileged, proprietary or confidential. Do not open it. It is intended only for the e-mail recipient noted above. If you are not the intended recipient or a person responsible for delivering this transmission to the intended recipient, you may not disclose, copy or distribute this transmission or take any action in reliance on it.”

Additionally, the communication may be password protected or encrypted. Rather than using exclusively random public Internet communication servers, an Internet message may be sent using some private or specified Internet communication servers.

Since technological developments outpace the rate of legal evolution, digital networks can no longer be wiretapped like analog phone systems. Future legislatures are likely to enact laws that prohibit governmental entities' access in counterintuitive ways, especially where the parties involved, the content and the nature of the communication are unknown. However, such is currently not the case.

Internet communication necessitates sharing content and data with third parties. The voluntary transfer of such content and related data to third-party Internet communication facilitators reduces or eliminates First, Third, Fourth, Fifth and Fourteenth Amendment rights of Internet users. The technology and protocols used to enable Internet communication, as interpreted by existing privacy statutes and case law, further compromises Internet users' privacy and publicity rights. Both legal notices and technological techniques may be used to ameliorate this outcome.

Third Parties Required

While the Internet appears to be complex with a myriad of communication lines, it is not. The Internet is a relatively simple and redundant system that transmits data from one available computer to another using a procedure requiring that content and data be duplicated by third parties all along the way.

In particular, the Transmission Control Protocol (“TCP”) and the Internet Protocol (“IP”) are required of all Internet communication and oblige all Internet messages to be sent in a specific manner. All computers sending Internet messages must first enclose them in uniquely addressed digital envelopes, then send them to the gateway computer to be handed off to other networks. Each computer handles each Internet message by copying and routing such encapsulated IP packets from network to network.

Historically, the American privacy doctrine is modeled upon real property concepts. Since the Fourth Amendment has been increasingly subject to codification, most modernization of privacy law is a function of legislative action. As a consequence, such changes are dependent upon political, rather than technological, change. No such change has yet been implemented with respect to Internet privacy.

Privacy Interest, Not Right

There is no explicit right to privacy in the United States Constitution. The Supreme Court has found several privacy interests, including:

• The right of association contained in the First Amendment;
• The Third Amendment's privacy right of a home owner by its prohibition against the quartering of soldiers “in any house” in time of peace without the consent of the owner;
• The Fourth Amendment explicitly affirms the privacy right of people with respect to their persons, houses, papers and effects, against unreasonable searches and seizures;
• The Fifth Amendment's zone of privacy which government may not force one to surrender detrimental information; and
• The Fourteenth Amendment's application of privacy rights to the states.

In short, the Supreme Court's findings are protections against all governmental invasions of life's privacies.

Just as there is no explicit constitutional right to privacy, there is no general privacy statute that requires electronic records held by third parties to keep such records private. Rather, the protection of such electronic records may be found due to a particular set of facts.

The Fourth Amendment

Two approaches to Fourth Amendment privacy protection are generally used. One approach equated unlawful requests for information with unlawful search and seizure. The other approach required physical trespass into a zone of privacy. Katz v. United States , 389 U.S. 347 (1967). But the Katz court recognized that the “Fourth Amendment protects people, not places. What a person knowingly exposes to the public, even in his own home or office, is not a subject of Fourth Amendment protection. But what he seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.”

In short, the Supreme Court has found that capacity to claim the protection of the Fourth Amendment depends upon whether the person who claims the protection of the amendment has a legitimate expectation of privacy in the invaded place. See , Rakas v. Illinois , 439 U.S. 128, 143 (1978). However, a subjective expectation of privacy is legitimate if it is one that society is prepared to recognize as reasonable, according to Minnesota v. Olson , 495 U.S. 91 (1990).

Thus the privacy interest one retains in information transmitted to a third party is clear. Courts have found no reasonable expectation of privacy; they have highlighted factors evidencing consent. In Smith v. Maryland , 442 U.S. 735, 742 (1979), the Supreme Court found that there is no such expectation of privacy regarding the numbers dialed on a telephone because the telephone company was expected to access the information. Similarly, in United States v. Simons , 206 F.3d 392 (4th Cir. 2000), the court found that an employee did not have a legitimate expectation of privacy with regard to his employer's record of his Internet usage.

Privacy of the Net

Due to the Internet's system of transmitting data from one relatively available and local computer to another, using a protocol of transmission which requires that content and data be duplicated by third parties all along the way, it may be argued that there is no reasonable expectation of privacy in Internet communications.

At least three courts have attempted to grant some Internet privacy on the grounds that it may be reasonably expected. See , United States v. Maxwell , 45 M.J. 406, 417 (1996), which found that the tenor and content of the
e-mail conversations between appellant and his correspondent suggested that they each had an expectation that the conversations were private. Similarly, in Warshak v. United States , 490 F.3d 455, (6th Cir. 2007), the court found a reasonable expectation of privacy in e-mail communications after narrowing the inquiry to identify the party with whom information was shared or from whom information was shielded, and the precise information actually conveyed. Also, the court in United States v. Heckenkamp , 482 F.3d 1142, 1147 (9th Cir. 2007), found that a student had a reasonable expectation of privacy in information he transmitted over the university's network insofar as there was no announced monitoring policy.

In Berger v. New York , 388 U.S. 41 (1967), the Supreme Court defined the procedural safeguards necessary to protect the privacy interest. In particular, once a user establishes such a reasonable expectation of privacy, the inquiry shifts to whether the statute at issue sufficiently protects that right to privacy. To date, no such shift has occurred.

The Electronic Communications Privacy Act of 1986 (“ECPA”), 18 U.S.C. ”2510-2521, 2701-2711, 3121-3127 (2006), extends government restrictions on wire taps from telephone calls to include transmissions of electronic data by computer. However, the ECPA only protects wire, oral and electronic communications while in transit. Internet communication technology and protocols mandate that Internet messages stop and be stored multiple times en route, thus eliminating the application of ECPA to Internet communication.

Overcoming Difficulties

To overcome some of the difficulties inherent in Internet communication, both technological and legal options are available. Both options attempt to either limit the amount and change the nature of content and data available to third parties or change the privacy expectation by providing notice.

First, an Internet user may employ legal notices to change the expectation of privacy with respect to the Internet communication. In particular, an Internet user may embed a notice in the communication putting a third-party recipient on notice that the communication is privileged, proprietary or confidential ' and that the third party should treat it as such. Just as it is important to place a notice on a fax cover sheet, it is important to use technology to ensure that the notice appears prior to allowing a third party access to the Internet communication data or content. The use of data formatting to prevent deep linking can be employed to force a third-party reader of an Internet communication to view the beginning of an Internet communication before being able to access any other part.

Next, an Internet user may use technology to limit a third party's access to the content of the communication. For example, a privileged, proprietary or confidential Internet communication may be sent as an attachment. The disclaimer in the body of the e-mail might then read: “The attachment to this e-mail may be privileged, proprietary or confidential. Do not open it. It is intended only for the e-mail recipient noted above. If you are not the intended recipient or a person responsible for delivering this transmission to the intended recipient, you may not disclose, copy or distribute this transmission or take any action in reliance on it.”

Additionally, the communication may be password protected or encrypted. Rather than using exclusively random public Internet communication servers, an Internet message may be sent using some private or specified Internet communication servers.

Since technological developments outpace the rate of legal evolution, digital networks can no longer be wiretapped like analog phone systems. Future legislatures are likely to enact laws that prohibit governmental entities' access in counterintuitive ways, especially where the parties involved, the content and the nature of the communication are unknown. However, such is currently not the case.