Source: http://www.cybertelecom.org/security/ecpanutshell.htm
Timestamp: 2019-02-21 21:46:58
Document Index: 789918046

Matched Legal Cases: ['§ 2510', '§ 2711', '§ 2510', '§ 2711', '§ 2702', '§ 2510', '§ 2510', '§ 2510', '§ 2510', '§ 2510']

Cybertelecom : ECPA Definitions
ECPA Definitions
ECPA applies differently to public ISPs, private networks, remote computer processing services, and a subscriber’s computer. How ECPA applies can be significantly different for a network that only provides private services to a particular company, like a corporate network or university network. ECPA makes a distinction between Electronic Communications Services and Remote Computing Services, and in so doing, according to Prof. Orin Kerr, "adopts these two distinctions, freezing into the law the understandings of computer network use as of 1986" [Kerr p. 8 2004] Neither ECPA's statutory language nor its legislative history make reference to the Internet. [Lupu ¶ 9] [Gellis p 344]
Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ (2009)
An electronic communication service ("ECS") is "any service which provides to users thereof the ability to send or receive wire or electronic communications." 18 USC § 2510(15). See S. Rep. No. 99-541 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3568; Freedman v. America Online, Inc., 325 F. Supp. 2d 638, 643 n.4 (E.D. Va. 2004) (AOL is an ECS). United States v. Councilman, 418 F.3d 67, 81-82 (1st Cir. 2005); Theofel v. Farey-Jones, 359 F.3d 1066, 1075 (9th Cir. 2004); Steve Jackson Games, Inc. v. United States Secret Service, 36 F.3d 457, 462-63 (5th Cir. 1994)
Bohach v. City of Reno, 932 F. Supp. 1232, 1236 (D. Nev. 1996) (city providing pager service to its police officers was a provider of ECS);
Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 114-15 (3d Cir. 2004) (insurance company that provided email service to employees is an ECS)
Pure Power Boot Camp, v. Warrior Fitness Boot , 587 F. Supp. 2d 548, 556 (S.D.N.Y. 2008) (holding that private employer email accounts are electronic communication services).
Quon v. Arch Wireless Operating Co., 529 F.3d 892, 900-03 (9th Cir. 2008)
In re Application of United States, 509 F. Supp. 2d 76, 79 (D. Mass. 2007)
In re Application of United States, 349 F.3d 1132, 1138-41 (9th Cir. 2003), the Ninth Circuit held that a company operating a system that enabled drivers to communicate with designated call centers over a cellular telephone network was an ECS, though it also noted that the situation would have been entirely different "if the Company merely used wire communication as an incident to providing some other service, as is the case with a street-front shop that requires potential customers to speak into an intercom device before permitting entry, or a 'drive-thru' restaurant that allows customers to place orders via a two-way intercom located beside the drive-up lane." Id. at 1141 n.19
Electronic bulletin board host
Kaufman v. Nest Seekers, LLC, 2006 WL 2807177, at *5 (S.D.N.Y. Sept. 26, 2006)
Websites that permit users to send and receive communications
Konop v. Hawaiian Airlines, Inc. , 302 F.3d 868, 880 (9th Cir. 2002) (finding employee’s personal website was an electronic communication service
Becker v. Toca, 2008 WL 4443050, at *4 (E.D. La. Sept. 26, 2008) "an online business or retailer may be considered an electronic communication service provider if the business has a website that offers customers the ability to send messages or communications to third parties."
Crowley v. CyberSource Corp., 166 F. Supp. 2d 1263, 1270 (N.D. Cal. 2001), the plaintiff argued that Amazon.com (to whom plaintiff sent his name, credit card number, and other identification information) was an electronic communications service provider because "without recipients such as Amazon. com, users would have no ability to send electronic information." The court rejected this argument, holding that Amazon was properly characterized as a user rather than a provider of ECS. See id.
United States v. Steiger, 318 F.3d 1039, 1049 (11th Cir. 2003) (a home computer connected to the Internet is not an ECS);
In re Jetblue Airways Corp. Privacy Litigation, 379 F. Supp. 2d 299, 309-10 (E.D.N.Y. 2005) (airline that operated website that enabled it to communicate with customers was not an ECS)
Copeland v. Northwest Airlines Corporation, 2005 WL 2365255 (W.D. Tenn.)
Dyer v. Northwest Airlines Corp., 334 F. Supp. 2d 1196, 1199 (D.N.D. 2004) (ECS "does not encompass businesses selling traditional products or services online");
In re Northwest Airlines Privacy Litigation, 2004 WL 1278459 (D. Minn.)
In re Doubleclick Inc. Privacy Litigation, 154 F. Supp. 2d 497, 508-09 (S.D.N.Y. 2001) (distinguishing ISPs that provide ECS from websites that are users of ECS).
United States v. Mullins, 992 F.2d 1472, 1478 (9th Cir. 1993) (airline that provides travel agents with computerized travel reservation system accessed through separate computer terminals can be a provider of ECS).
A provider cannot provide ECS with respect to a communication if the service did not provide the ability to send or receive that communication.
Sega Enterprises Ltd. v. MAPHIA, 948 F. Supp. 923, 930-31 (N.D. Cal. 1996) (video game manufacturer that accessed private email of users of another company's bulletin board service was not a provider of electronic communication service);
State Wide Photocopy, Corp. v. Tokai Fin. Servs., Inc., 909 F. Supp. 137, 145 (S.D.N.Y. 1995) (financing company that used fax machines and computers but did not provide the ability to send or receive communications was not provider of electronic communication service).
A mere user of ECS provided by another is not a provider of ECS.
The term “remote computing service” (“RCS”) is defined by 18 U.S.C. § 2711(2) as “the provision to the public of computer storage or processing services by means of an electronic communications system.” An “electronic communications system” is “any wire, radio, electromagnetic, photooptical or photoelectronic facilities for the transmission of wire or electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications.” 18 U.S.C. § 2510(14).
Roughly speaking, a remote computing service is provided by an off-site computer that stores or processes data for a customer. See S. Rep. No. 99-541 (1986), reprinted in 1986 U.S.C.C.A.N. 3555, 3564-65. For example, a service provider that allows customers to use its computing facilities in "essentially a time-sharing arrangement" provides an RCS. H.R. Rep. No. 99-647, at 23 (1986). A server that allows users to store data for future retrieval also provides an RCS. See Steve Jackson Games, Inc. v. United States Secret Service, 816 F. Supp. 432, 442-43 (W.D. Tex. 1993) (provider of bulletin board services was a remote computing service), aff'd on other grounds, 36 F.3d 457 (5th Cir. 1994). Importantly, an entity that operates a website and its associated servers is not an RCS, unless of course the entity offers a storage or processing service through the website. For example, an airline may compile and store passenger information and itineraries through its website, but these functions are incidental to providing airline reservation service, not data storage and processing service; they do not convert the airline into an RCS. See In re Jetblue Airways Corp. Privacy Litigation, 379 F. Supp. 2d at 310; see also United States v. Standefer, 2007 WL 2301760, at *5 (S.D. Cal. Aug. 8, 2007) (holding that e-gold payment website was not an RCS because e-gold customers did not use the website "to simply store electronic data" or to "outsource tasks," but instead used e-gold "to transfer gold ownership to other users").
Under the definition provided by § 2711(2), a service can only be a "remote computing service" if it is available "to the public." Services are available to the public if they are available to any member of the general population who complies with the requisite procedures and pays any requisite fees. For example, Verizon is a provider to the public: anyone can obtain a Verizon account. (It may seem odd at first that a service can charge a fee but still be considered available "to the public," but this approach mirrors commercial relationships in the physical world. For example, movie theaters are open "to the public" because anyone can buy a ticket and see a show, even though tickets are not free.) In contrast, providers whose services are available only to those with a special relationship with the provider do not provide service to the public. For example, an employer that provides email accounts to its employees will not be an RCS with respect to those employees, because such email accounts are not available to the public. See Andersen Consulting LLP v. UOP, 991 F. Supp. 1041, 1043 (N.D. Ill. 1998) (interpreting the "to the public" clause in § 2702(a) to exclude an internal email system that was made available to a hired contractor but was not available to "any member of the community at large").
In Quon v. Arch Wireless Operating Co., the Ninth Circuit held that a text messaging service provider was an ECS and therefore not an RCS. See Quon, 529 F.3d at 902-03. However, this "either/or" approach to ECS and RCS is contrary to the language of the statute and its legislative history. The definitions of ECS and RCS are independent of each other, and therefore nothing prevents a service provider from providing both forms of service to a single customer. In addition, an email service provider is certainly an ECS, but the House report on the SCA also stated that an email stored after transmission would be protected by a provision of the SCA that protects contents of communications stored by an RCS. See H.R. Rep. No. 99-647, at 65 (1986). One subsequent court has rejected the Ninth Circuit's analysis in Quon and stated that a provider "may be deemed to provide both an ECS and an RCS to the same customer." Flagg, v. City of Detroit, 252 F.R.D. 346, 362 (E.D. Mich. 2008). The key to determining whether the provider is an ECS or RCS is to ask what role the provider has played and is playing with respect to the communication in question.
More Definitions (please check primary source for amendments)
18 USC § 2510(1) "wire communication" means any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception (including the use of such connection in a switching station) furnished or operated by any person engaged in providing or operating such facilities for the transmission of interstate or foreign communications or communications affecting interstate or foreign commerce;
18 USC § 2510(2) "oral communication" means any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation, but such term does not include any electronic communication;
18 USC § 2510(12) "electronic communication" means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce, but does not include-
Derived From: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Computer Crime and Intellectual Property Section, Criminal Division, DOJ p 164 (2009) (Remember: This is a rendition of the state of the law from law enforcement and reflects their views)
As the definition suggests, "electronic communication" is a broad, catch-all category. See United States v. Herring, 993 F.2d 784, 787 (11th Cir. 1993). "As a rule, a communication is an electronic communication if it is neither carried by sound waves nor can fairly be characterized as one containing the human voice (carried in part by wire)." H.R. Rep. No. 99-647, at 35 (1986). Most electric or electronic signals that do not fit the definition of wire communications qualify as electronic communications. For example, almost all Internet communications qualify as electronic communications. See, e.g., Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 876 (9th Cir. 2002) ("document" transmitted from web server); In re Application of United States, 416 F. Supp. 2d 13, 16 (D.D.C. 2006) ("there can be no doubt that [§ 2510(12)] is broad enough to encompass email communications and other similar signals transmitted over the Internet").
However, at least one district court has held that transmissions that occur within a single computer-such as the transmission of keystrokes from the keyboard to the central processing unit-are not "electronic communications" within the meaning of Title III. See United States v. Ropp, 347 F. Supp. 2d 831 (C.D. Cal. 2004). In Ropp, the defendant placed a piece of hardware between the victim's computer and her keyboard that recorded the signals transmitted between the two. Id. at 831. The court found that the acquired communications were not "electronic communications" because "the communications in question involved preparation of emails and other communications, but were not themselves emails or any other communication at the time of the interception." Id. at 835 n.1. Because the court found that the typing was a communication within the victim's own computer, it reasoned that "[a]t the time of interception, [the communications] no more affected interstate commerce than a letter, placed in a stamped envelope, that has not yet been mailed." Id. The court further stated that the acquired keystrokes could not be an "electronic communication" under Title III because these transmissions were not made by a "system that affects interstate or foreign commerce." Id. at 837. In the court's view, a computer is not a "system that affects interstate or foreign commerce" simply by virtue of the fact that it is connected to the Internet or to another external network at the time of the electronic transmission; rather, the relevant inquiry is whether the computer's network connection was involved in the transmission. See id. at 837-38. At least one court has criticized Ropp on the ground that it "seems to read the statute as requiring the communication to be traveling in interstate commerce, rather than merely 'affecting' interstate commerce." Potter v. Havlicek, 2007 WL 539534, at *8 (S.D. Ohio Feb. 14, 2007). The court explained that "keystrokes that send a message off into interstate commerce 'affect' interstate commerce." Id.
Notwithstanding the Ropp decision, investigators should use caution whenever they acquire the contents of communications on computers or internal networks in real time. []
18 USC § 2510 (16) "readily accessible to the general public" means, with respect to a radio communication, that such communication is not-
Caselaw: A federal court in the northern district of California [in re Google NDCA 2011], in examining whether "radio communication" applies to all wireless communications including Wifi, or more narrowly to radio broadcast, has found that the definition of "radio communication"
does not have a plain meaning as provided by Congress within the text,
While it does not necessarily preclude WiFi, " references to "radio communication" throughout the Act predominantly pertain to and are drafted for the particular design of radio broadcast technologies, and do not address other communications technologies that transmit using radio waves "
Dictionaries' definitions are inconclusive
"Although the ECPA never explicitly defines "radio communication," what the legislative history and the context of the term's use in Section 2510(16) make clear is that Congress intended "radio communication" to include "traditional radio services," such that public-directed radio broadcast communication, as the technology was understood at the time, would be clearly excluded from liability under the Act."
It can be anticipated that the NDCA court decision will be appealed; NDCA seems to conclude that whatever ECPA may mean, it can only be meaningful in the context of the year it was enacted, 1986. Since WiFi did not exist then, the Court was unwilling to interpret radio communications to include it. While the Court attempts to point out one absurd result including WiFi might result it, the reality is that ECPA is so convoluted that any outcome is likely to result in an absurd result. In other words, it will be interesting to see if this stands.
Notice that 2510(16) does not limit itself only to "radio communications." 2510(16) simply defines "readily accessible to the public" as it applies to "radio communications;" meaning it could apply to other things as well (there is no exclusive or limiting language here).