5 B.U. J. SCI. & TECH. L. 5 June 1, 1999 Boston University Journal of Science & Technology Law Article Marginalizing Individual Privacy on the Internet Deborah M. McTigue Table of Contents I. Introduction................................................................................................[1] II. Privacy and the Systems Operator............................................................[5] A. Don’t Ask, Don’t Tell.........................................................................[6] B. Beyond the ECPA — Contracting Privacy.....................................[13] III. E-mail in the Workplace ..........................................................................[17] A. Bohach v. City of Reno....................................................................[19] B. Smyth v. Pillsbury Co. ....................................................................[22] C. Strauss v. Microsoft Corp. ..............................................................[25] IV. Attorney - Client Confidentiality.............................................................[28] V. Congressional and Industrial Developments..........................................[34] VI. Conclusions...............................................................................................[46] Marginalizing Individual Privacy on the Internet* Deborah M. McTigue† I. INTRODUCTION 1. Many Internet users are under the delusion that their Internet conversations are private. While you may that think your computer is “your own private peephole into cyberspace, . [i]t turns out the peephole is a two-way viewer. Some of the Internet’s defining characteristics—high-tech tricks and search methods that make finding information easy—allow others in cyberspace to take a peek at your behavior.”1 2. Users generally access the Internet through an Internet Service Provider (“ISP”), using Netscape Navigator, Microsoft Internet Explorer, or a proprietary browser such as America Online (“AOL”). ISPs generally offer e-mail services and many employers also provide their employees with access to the Internet and e- mail. Like commercial ISPs, employers store employee e-mail on company-owned central computers until users download it to their personal computers. Many corporations and private individuals also publish World Wide Web (“Web”) pages that invite e-mail correspondence, display advertising, or offer online purchasing. 3. When an individual visits a Web site, makes a purchase, or sends e-mail, a stream of personal data may be recorded. Even if a user is careful, “[y]our machine has been spreading information about you and your browsing habits . [b]y sharing cookies.”2 A “cookie” is a file that is downloaded and uploaded from a computer’s hard drive. Cookie files store information about the sites a user visits and may include “your full name, address, telephone number, fax number and e- mail address.”3 Although users can delete cookie files from their computers’ hard drives, ISPs and employers also store cookie files and generally do not permit access to these storage devices. * Copyright 1999 by the Trustees of Boston University. Cite to this Article as 5 B.U. J. SCI. & TECH. L. 5 (1999). Pin cite using the appropriate paragraph number. For example, cite to the first paragraph of this Article as 5 B.U. J. SCI. & TECH. L. 5 para. 1 (1999). † B.A., with honors, University of Florida, 1976; J.D., summa cum laude, valedictorian, Nova Southeastern University, Shepard Broad Law Center, 1998. Ms. McTigue is an associate with the law firm Ruden, McClosky, Smith, Schuster & Russell, P.A. in Fort Lauderdale, Florida. 1 Rebecca Quick, Don’t Expect Your Secrets to Get Kept on the Internet: Privacy Is Always at Risk As You Surf, WALL ST. J., Feb. 6, 1998, at B5. 2 Mike West, Privacy on the Net: Who’s Minding the Cookie Jar?, 6 N.J. LAW.: WKLY. NEWSPAPER 1356, 1356 (1997). 3 Id. 5 B.U. J. SCI. & TECH. L. 5 Individual Privacy on the Internet 4. In addition to deleting cookie files from their personal computers, users may rely on federal statutes, contractual agreements, or common law remedies to defend against invasions of their privacy. Relying on these protections may be insufficient, however, in a computing environment having a multitude of users. To illustrate this problem, this Article discusses various situations that exhibit an increasing trend of marginalization of individual privacy on the Internet. Part II discusses online privacy in relation to ISPs. Part III explores employees’ expectations of privacy in company e-mail and employers’ needs to protect business records, which are discoverable during litigation. Part IV examines the attorney- client privilege in relation to electronic communications. Finally, Part V reviews current congressional and industrial developments aimed at increasing online privacy. II. PRIVACY AND ISP OPERATORS 5. ISPs are central to the issue of Internet privacy. Most individuals send e- mail or access the Internet from their homes via a commercial ISP. ISP operators may only disclose the contents of an electronic communication, a record, or other information pertaining to a subscriber in accordance with the Electronic Communications Privacy Act (“ECPA”).4 The ECPA protects subscribers’ privacy rights against unauthorized governmental intrusion or ISP disclosures.5 In spite of this statutory protection and the contractual agreements that subscribers and ISPs may enter into, a subscriber’s reasonable expectation of privacy may be based on a false perception of security and cyberspace anonymity. A. Don’t Ask, Don’t Tell 6. Unlike the convicted Oklahoma City bomber who happens to share his name, retired officer Timothy McVeigh “is a highly decorated seventeen-year veteran of the United States Navy who has served honorably and continuously since he was nineteen years old.”6 McVeigh’s career spiraled downward, however, when the Navy sought to discharge him under the statutory policy known as “Don’t Ask, 4 Electronic Communications Privacy Act of 1986, Pub. L. No. 99-508, 100 Stat. 1848 (codified as amended in scattered sections of 18 U.S.C. §§ 2510-21, 2701-10, 3121-26 (1994)). This Article focuses primarily on Title II - Stored Wire and Electronic Communications and Transactional Records Access, 18 U.S.C. §§ 2701-10. 5 See LANCE ROSE, NETLAW: YOUR RIGHTS IN THE ONLINE WORLD 170-71 (1995). 6 McVeigh v. Cohen, 983 F. Supp. 215, 217 (D.D.C. 1998) (“At the time of the Navy’s decision to discharge him, he was the senior-most enlisted man aboard the United States nuclear submarine U.S.S. Chicago”). 5 B.U. J. SCI. & TECH. L. 5 Individual Privacy on the Internet Don’t Tell, Don’t Pursue.”7 Under this policy, the military may discharge service persons that say they are gay, engage in homosexual conduct, or try to marry someone of the same sex.8 7. McVeigh came to the Navy’s attention when a civilian Navy volunteer received an e-mail message from the AOL screen name “boysrch.”9 The volunteer used the AOL member profile directory and found out that the sender was another AOL subscriber named “Tim,” who worked in the military and identified himself as gay.10 The profile included hobbies such as “collecting pics of other young studs” and “boy watching.”11 The profile did not include specific information, however, such as a last name, address, or telephone number, that could directly link McVeigh to the message.12 Despite the anonymous nature of the profile, the volunteer suspected that McVeigh authored the message,13 so she forwarded the information to personnel aboard McVeigh’s submarine.14 8. A member of the Navy’s Judge Advocate General asked a paralegal to contact AOL and find information about “Tim” without a warrant or court order.15 The paralegal called AOL and pretended that he had received a fax from an unknown source.16 An AOL representative disclosed that McVeigh was the customer behind the message.17 Initially, AOL personnel denied the disclosure, stating that “there are so many levels to safeguard privacy that the conversation the Navy describes could not have taken place — and there is no evidence that it 7 See id. at 217-18 (citing 10 U.S.C. § 654(b)(2) (1994) (“A member of the armed forces shall be separated from the armed forces under regulations prescribed by the Secretary of Defense if . the member has stated that he or she is a homosexual or bisexual, or words to that effect . .”)). 8 See Morning Edition (NPR radio broadcast, Jan. 13, 1998), available in 1998 WL 3306037; see also 10 U.S.C. § 654(b)(2). 9 See McVeigh, 983 F. Supp. at 217. 10 See id. 11 Id. 12 See id. 13 See id. (stating that McVeigh’s message concerned a toy-drive the volunteer was coordinating, about which she had previously corresponded with McVeigh). 14 See id. 15 See id. 16 See id. 17 See id. 5 B.U. J. SCI. & TECH. L. 5 Individual Privacy on the Internet did.”18 Following an investigation, the Navy told McVeigh that he was “‘suspected of sodomy and indecent acts.’”19 Although McVeigh argued that the word “gay” in his profile was insufficient to prove the Navy’s allegations, he was separated based on his “propensity to engage in homosexual conduct.”20 At a subsequent administrative discharge hearing, the Navy ruled against McVeigh, finding that his online profile violated the Navy’s policy on homosexuality.21 9. To stay his pending discharge, McVeigh sought a preliminary injunction in federal court.22 McVeigh asked the court to find that he had not violated the “Don’t Ask, Don’t Tell, Don’t Pursue” policy because he did not “tell.”23 Additionally, McVeigh claimed that the Navy impermissibly “asked and zealously pursued” confidential information stored in AOL customer files.24 The court found McVeigh’s argument persuasive and held that his e-mail did not amount to a statutory violation of the Navy’s policy.25 The court stated that “[s]uggestions of sexual orientation in a private, anonymous email account did not give the Navy a sufficient reason to investigate to determine whether to commence discharge proceedings.”26 The court also noted that “in the context of cyberspace, a medium of ‘virtual reality’ that invites fantasy and affords anonymity, the comments attributed to McVeigh do not by definition amount to a declaration of homosexuality.”27 10.