LEGALITY OF INTRUSION-DETECTION SYSTEM TO PROTECT 

UNCLASSIFIED COMPUTER NETWORKS IN THE EXECUTIVE BRANCH 

Operation of the EINSTEIN 2.0 intrusion-detection system complies with the Fourth Amendment 

to the Constitution, title III of the Omnibus Crime Control and Safe Streets Act of 1968, the Foreign 

Intelligence Surveillance Act, the Stored Communications Act, and the pen register and trap and trace 

provisions of chapter 206 of title 18, United States Code, provided that certain log-on banners or 

computer-user agreements are consistently adopted, implemented, and enforced by executive departments 

and agencies using the system. Operation of the EINSTEIN 2.0 system also does not run afoul of state 

wiretapping or communications privacy laws. 

 August 14, 2009 

MEMORANDUM OPINION FOR AN 

ASSOCIATE DEPUTY ATTORNEY GENERAL 

This memorandum briefly summarizes the current views of the Office of Legal Counsel 

on the legality of the EINSTEIN 2.0 intrusion-detection system. This Office previously 

considered the legality of the system in an opinion of January 9, 2009. See Memorandum for 

Fred F. Fielding, Counsel to the President, from Steven G. Bradbury, Principal Deputy Assistant 

Attorney General, Office of Legal Counsel, Re: Legal Issues Relating to the Testing, Use, and 

Deployment of an Intrusion-Detection System (EINSTEIN 2.0) to Protect Unclassified Computer 

Networks in the Executive Branch (Jan. 9, 2009) (“EINSTEIN 2.0 Opinion”). We have reviewed 

that opinion and agree that the operation of the EINSTEIN 2.0 program complies with the Fourth 

Amendment to the United States Constitution, title III of the Omnibus Crime Control and Safe 

Streets Act of 1968, Pub. L. No. 90-351, 82 Stat. 211, 18 U.S.C. § 2510 et seq. (2006), as 

amended (“the Wiretap Act”), the Foreign Intelligence Surveillance Act, Pub. L. No. 95-511, 92 

Stat. 1783, 50 U.S.C. § 1801 et seq. (West Supp. 2009), as amended (“FISA”), the Stored 

Communications Act, Pub. L. No. 99-508, tit. II, 100 Stat. 1848 (1986), 18 U.S.C. § 2701(a)(1) 

(2006), as amended, and the pen register and trap and trace provision of title 18, United States 

Code, 18 U.S.C. § 3121 et seq. (2006), as amended. Accordingly, we have drawn upon the 

analysis in that opinion in preparing this summary, supplementing that material with analysis of 

an additional legal issue. 

We have assumed for purposes of our analysis that computer users generally have a 

legitimate expectation of privacy in the content of Internet communications (such as an e-mail) 

while it is in transmission over the Internet.1

 See, e.g., United States v. Lifshitz, 369 F.3d 173, 

190 (2d Cir. 2004) (analogizing expectation of email user in privacy of email to expectation of 

individuals communicating by regular mail); United States v. Maxwell, 45 M.J. 406, 418 

(C.A.A.F. 1996) (sender of an email generally “enjoys a reasonable expectation that police 

officials will not intercept the transmission without probable cause and a search warrant”); see 

 1

 Computer users do not have an objectively reasonable expectation of privacy in addressing and routing 

information conveyed for the purpose of transmitting Internet communications to or from a user. See Quon v. Arch 

Wireless Operating Co., Inc., 529 F.3d 892, 904-05 (9th Cir. 2008); United States v. Forrester, 512 F.3d 500, 510-

11 (9th Cir. 2008); cf. Smith v. Maryland, 442 U.S. 735, 743-44 (1979) (no legitimate expectation of privacy in 

dialing, routing, addressing, and signaling information transmitted to telephone companies). 
Opinions of the Office of Legal Counsel in Volume 33 

also Quon, 529 F.3d at 905 (“[U]sers do have a reasonable expectation of privacy in the content 

of their text messages vis-a-vis the service provider.”). Even given this assumption, however, we 

believe the deployment, testing, and use of EINSTEIN 2.0 technology complies with the Fourth 

Amendment where each agency participating in the program consistently adopts, implements, 

and enforces the model log-on banner or model computer-user agreements described in this 

Office’s prior opinion, or their substantial equivalents. See EINSTEIN 2.0 Opinion at 5-6. 

First, we conclude that the adoption, implementation, and enforcement of model log-on 

banners or model computer-user agreements eliminates federal employees’ reasonable 

expectation of privacy in their uses of Government-owned information systems with respect to 

the lawful government purpose of protecting federal systems against network intrusions and 

exploitations. We therefore do not believe that the operation of intrusion-detection sensors as 

part of the EINSTEIN 2.0 program constitutes a “search” for Fourth Amendment purposes. See 

Minnesota v. Carter, 525 U.S. 83, 88 (1998). Whether a Government employee has a legitimate 

expectation of privacy in his use of governmental property at work in particular circumstances is 

determined by “[t]he operational realities of the workplace,” and “by virtue of actual office 

practices and procedures, or by legitimate regulation.” O’Connor v. Ortega, 480 U.S. 709, 717 

(1987) (plurality); see United States v. Simons, 206 F.3d 392, 398 (4th Cir. 2000) (“[O]ffice 

practices, procedures, or regulations may reduce legitimate privacy expectations.”). The 

existence of an expectation of privacy, moreover, may depend on the nature of the intrusion at 

issue. See O’Connor, 480 U.S. at 717-18 (plurality) (suggesting that a government employee’s 

expectation of privacy might be unreasonable “when an intrusion is by a supervisor” but 

reasonable when the intrusion is by a law enforcement official). The model banner and model 

computer-user agreement discussed in our prior opinion are at least as robust as—and we think 

stronger than—similar materials that courts have held eliminated a legitimate government 

employee expectation of privacy in the content of Internet communications sent over government 

systems. See, e.g., Simons, 206 F.3d at 398 (finding no legitimate expectation of privacy in light 

of computer-use policy expressly noting that government agency would “‘audit, inspect, and/or 

monitor’” employees’ use of the Internet, “including all file transfers, all websites visited, and 

all e-mail messages, ‘as deemed appropriate’”) (quoting policy); United States v. Angevine, 281 

F.3d 1130, 1132-33 (10th Cir. 2002) (finding no legitimate expectation of privacy in light of 

computer-use policy stating that university “‘reserves the right to view or scan any file or 

software stored on the computer or passing through the network, and will do so periodically’” 

and has “‘a right of access to the contents of stored computing information at any time for any 

purpose which it has a legitimate need to know’”) (quoting policy); United States v. Thorn, 375 

F.3d 679, 682 (8th Cir. 2004), vacated on other grounds, 543 U.S. 1112 (2005) (finding no 

legitimate expectation of privacy in light of computer-use policy warning that employees “‘do 

not have any personal privacy rights regarding their use of [the employing agency’s] information 

systems and technology,’” and that “‘[a]n employee’s use of [the agency’s] information systems 

and technology indicates that the employee understands and consents to [the agency’s] right to 

inspect and audit all such use as described in this policy’”) (quoting policy). We therefore 

believe that the adoption, implementation, and enforcement of the language in those model 

materials, or their substantial equivalents, by agencies participating in the EINSTEIN 2.0 

program will eliminate federal employees’ legitimate expectations of privacy in their uses of 

2
Legality of Intrusion-Detection System to Protect Unclassified Computer Networks 

in the Executive Branch 

 

Government-owned information systems with respect to the lawful government purpose of 

protecting federal systems against network intrusions and exploitations.2 

We also believe that individuals in the private sector who communicate directly with 

federal employees of agencies participating in the EINSTEIN 2.0 program through Governmentowned information systems do not have a legitimate expectation of privacy in the content of 

those communications provided that model log-on banners or agreements are adopted and 

implemented by the agency. The Supreme Court has repeatedly held that where a person 

“reveals private information to another, he assumes the risk that his confidant will reveal that 

information to the authorities, and if that occurs the Fourth Amendment does not prohibit 

governmental use of that information.” United States v. Jacobsen, 466 U.S. 109, 117 (1984); see 

also United States v. Miller, 425 U.S. 435, 443 (1976) (“[T]he Fourth Amendment does not 

prohibit the obtaining of information revealed to a third party and conveyed by him to 

Government authorities, even if the information is revealed on the assumption that it will be used 

only for a limited purpose and the confidence placed in the third party will not be betrayed.”); 

SEC v. Jerry T. O’Brien, Inc., 467 U.S. 735, 743 (1984) (“[W]hen a person communicates 

information to a third party even on the understanding that the communication is confidential, he 

cannot object if the third party conveys that information or records thereof to law enforcement 

authorities.”); Smith, 442 U.S. at 743-44 (“[A] person has no legitimate expectation of privacy in 

information he voluntarily turns over to third parties.”). We believe this principle also applies to 

a person who emails a federal employee at the employee’s personal email account when that 

employee accesses his or her personal email account through a Government-owned information 

system, when the consent procedures described above are followed. By clicking through the 

model log-on banner or agreeing to the terms of the model computer-user agreement, a federal 

employee gives ex ante permission to the Government to intercept, monitor, and search “any 

communications” and “any data” transiting or stored on a Government-owned information 

system for any “lawful purpose,” including the purpose of protecting federal computer systems 

against malicious network activity. Therefore, an individual who communicates with a federal 

employee who has agreed to permit the Government to intercept, monitor, and search any 

personal use of the employee’s Government-owned information systems has no Fourth 

Amendment right against the Government activity of protecting federal computer systems 

against malicious network activity, as the employee has consented to that activity. See Jerry T. 

O’Brien, Inc., 467 U.S. at 743; Jacobsen, 466 U.S. at 117; Miller, 425 U.S. at 443. 

Under Supreme Court precedent, this principle applies even where, for example, the 

sender of an email to an employee’s personal, Web-based email account (such as Gmail or 

Hotmail) does not know of the recipient’s status as a federal employee or does not anticipate that 

the employee might read, on a federal Government system, an email sent to a personal email 

account at work or that the employee has agreed to Government monitoring of his 

communications on that system. A person communicating with another assumes the risk that the 

person has agreed to permit the Government to monitor the contents of that communication. See,

2

 The use of log-on banners or computer-user agreements may not be sufficient to eliminate an employee’s 

legitimate expectation of privacy if the statements and actions of agency officials contradict these materials. See

Quon, 529 F.3d at 906-07. Management officials of agencies participating in the EINSTEIN 2.0 program therefore 

should ensure that agency practices are consistent with the statements in the model materials. 

3
Opinions of the Office of Legal Counsel in Volume 33 

e.g., United States v. White, 401 U.S. 745, 749-51 (1971) (plurality opinion) (no Fourth 

Amendment protection against government monitoring of communications through transmitter 

worn by undercover operative); Hoffa v. United States, 385 U.S. 293, 300-03 (1966) 

(information disclosed to individual who turns out to be a government informant is not protected 

by the Fourth Amendment); Lopez v. United States, 373 U.S. 427, 439 (1963) (same); cf. 

Rathbun v. United States, 355 U.S. 107, 111 (1957) (“Each party to a telephone conversation 

takes the risk that the other party may have an extension telephone and may allow another to 

overhear the conversation. When such takes place there has been no violation of any privacy of 

which the parties may complain.”). Accordingly, when an employee agrees to let the 

Government intercept, monitor, and search any communication or data sent, received, or stored 

by a Government-owned information system, the Government’s interception of the employee’s 

Internet communications with individuals outside of the relevant agency through a Governmentowned information system does not infringe upon any legitimate expectation of privacy of the 

parties to that communication. 

We also think that, under the Court’s precedents, an individual who submits information 

through the Internet to a federal agency participating in the EINSTEIN 2.0 program does not 

have a legitimate expectation of privacy for Fourth Amendment purposes in the contents of the 

information that he transmits directly to the participating agency. An individual has no 

expectation of privacy in communications he makes to a known representative of the 

Government. See United States v. Caceres, 440 U.S. 741, 750-51 (1979) (individual has no 

reasonable expectation of privacy in communications with IRS agent made in the course of an 

audit). Further, as just discussed, an individual who communicates information to another 

individual who turns out to be an undercover agent of the Government has no legitimate 

expectation of privacy in the content of that information. It follows a fortiori that where an 

individual is communicating directly with a declared agent of the Government, the individual 

does not have a legitimate expectation that his communication would not be monitored or 

acquired by the Government. 

Second, even if EINSTEIN 2.0 operations were to constitute a “search” under the Fourth 

Amendment, we believe that those operations would be consistent with the Amendment’s 

“central requirement” that all searches be reasonable. Illinois v. McArthur, 531 U.S. 326, 330 

(2001) (internal quotation marks omitted). As discussed in the prior opinion of this Office, the 

Government has a lawful, work-related purpose for the use of EINSTEIN 2.0’s intrusiondetection system that brings the EINSTEIN 2.0 program within the “special needs” exception to 

the Fourth Amendment’s warrant and probable cause requirements. See O’Connor, 480 U.S. at 

720 (plurality); see also Nat’l Treasury Employees Union v. Von Raab, 489 U.S. 656, 665-66 

(1989) (warrant and probable cause provisions of the Fourth Amendment are inapplicable to a 

search that “serves special governmental needs, beyond the normal need for law enforcement”); 

Griffin v. Wisconsin, 483 U.S. 868, 872-73 (1987) (special needs doctrine applies in 

circumstances that make the “warrant and probable cause requirement impracticable”); United 

States v. Heckenkamp, 482 F.3d 1142, 1148 (9th Cir. 2007) (preventing misuse of and damage to 

university computer network is a lawful purpose). And, based upon the information available to 

us, and as discussed in the prior opinion of this Office, we believe that the operation of the 

EINSTEIN 2.0 program falls under that exception and is reasonable under the totality of the 

circumstances. See United States v. Knights, 534 U.S. 112, 118-19 (2001) (reasonableness of a 

4
Legality of Intrusion-Detection System to Protect Unclassified Computer Networks 

in the Executive Branch 

search under the Fourth Amendment is measured in light of the “totality of the circumstances,” 

balancing “on the one hand, the degree to which it intrudes upon an individual’s privacy and, on 

the other, the degree to which it is needed for the promotion of legitimate governmental 

interests”) (internal quotation marks omitted; New Jersey v. T.L.O., 469 U.S. 325, 337 (1985) 

(“what is reasonable depends on the context within which a search takes place”); O’Connor, 480 

U.S. at 726 (plurality) (reasonable workplace search must be “justified at its inception” and 

“reasonably related in scope to the circumstances which justified the interference in the first 

place”) (internal quotation marks omitted). In light of that conclusion, we also think that a 

federal employee’s agreement to the terms of the model log-on banner or the model computeruser agreement, or those of a banner of user agreement that are substantially equivalent to those 

models, constitutes valid, voluntary consent to the reasonable scope of EINSTEIN 2.0 

operations. See Schneckloth v. Bustamonte, 412 U.S. 218, 219 (1973) (consent is “one of the 

specifically established exceptions to the requirements of both a warrant and probable cause”); 

United States v. Sihler, 562 F.2d 349 (5th Cir. 1977) (prison employee’s consent to routine 

search of his lunch bag valid); cf. McDonell v. Hunter, 807 F.2d 1302, 1310 (8th Cir. 1987) (“If a 

search is unreasonable, a government employer cannot require that its employees consent to that 

search as a condition of employment.”). 

With respect to statutory issues, we have also concluded that, for the reasons set forth in 

our prior opinion—and so long as participating federal agencies consistently adopt, implement, 

and enforce model computer log-on banners or model computer-user agreements—the 

deployment of the EINSTEIN 2.0 program on federal information systems complies with the 

Wiretap Act, the Foreign Intelligence Surveillance Act, the Stored Communications Act, and the 

pen register and trap and trace provisions of title 18 of the United States Code. We agree with 

the analysis of these issues set forth in our prior opinion, and will not repeat it here. 

Finally, we do not believe the EINSTEIN 2.0 program runs afoul of state wiretapping or 

communication privacy laws. See, e.g,. Fla. Stat. Ann. § 934.03 (West Supp. 2009); 18 Pa. 

Cons. Stat. Ann. § 5704(4) (West Supp. 2009); Md. Code Ann., Cts. & Jud. Proc. § 10-402(c)(3) 

(LexisNexis 2006); Cal. Penal Code 631(a) (West 1999). To the extent that such laws purported 

to apply to the conduct of federal agencies and agents conducting EINSTEIN 2.0 operations and 

imposed requirements that exceeded those imposed by the federal statutes discussed above, they 

would “stand[] as an obstacle to the accomplishment and execution of the full purposes and 

objectives of Congress,” and be unenforceable under the Supremacy Clause. Hines v. 

Davidowitz, 312 U.S. 52, 67 (1941); see also Geier v. American Honda Motor Co., 529 U.S. 861, 

873 (2000) (same); Old Dominion Branch v. Austin, 418 U.S. 264, 273 n.5 (1974) (Executive 

Order “may create rights protected against inconsistent state laws through the Supremacy 

Clause”); Bansal v. Russ, 513 F. Supp. 2d 264, 283 (E.D. Pa. 2007) (concluding that “federal 

officers participating in a federal investigation are not required to follow” state wiretapping law 

containing additional requirements not present in the federal Wiretap Act, because in such 

circumstances, “the state law would stand as an obstacle to federal law enforcement”); Johnson 

v. Maryland, 254 U.S. 51 (1920); cf. United States v. Adams, 694 F.2d 200, 201 (9th Cir. 1980) 

5
Opinions of the Office of Legal Counsel in Volume 33 

(“evidence obtained from a consensual wiretap conforming to 18 U.S.C. § 2511(2)(c) is 

admissible in federal court proceedings without regard to state law”). 

 

 /s/ 

 DAVID J. BARRON 

 Acting Assistant Attorney General 

6