Opinion ID: 3153537
Heading Depth: 3
Heading Rank: 1

Heading: Acquisition of “Content”

Text: The District Court dismissed the plaintiffs’ Wiretap Act claim on the basis that the defendants’ alleged conduct did not involve the acquisition of communications “content.” While the plaintiffs allege that the defendants acquired and tracked the URLs they visited, the Act defines “contents” as “any information concerning the substance, purport, or meaning of th[e] communication [at issue].”23 The District Court held that, “[a]s described by their name, ‘Universal Resource Locators,’ . . . . a URL is a location identifier and does not ‘concern [ ] the substance, purport, or meaning’ of an electronic communication.’”24 22 The exception does not apply if “such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” 18 U.S.C. § 2511(2)(d). 23 18 U.S.C. § 2510(8). 24 In re: Google, 988 F. Supp. 2d at 444 (final alteration in original) (quoting 18 U.S.C. § 2510(8)). 17 In Smith v. Maryland, the Supreme Court made clear the important difference between extrinsic information used to route a communication and the communicated content itself.25 In Smith, the Supreme Court found no Fourth Amendment violation from the government’s warrantless use of a pen register.26 Distinguishing its holding in Katz v. United States27 that warrantless wiretapping violated the Fourth Amendment, the Supreme Court explained that “a pen register differs significantly from the listening device employed in Katz, for pen registers do not acquire the contents of communications.”28 Rather, the Court explained, pen registers “disclose only the telephone numbers that have been dialed—a means of establishing communication. Neither the purport of any communication between the caller and the recipient of the call, their identities, nor whether the call was even completed is disclosed by pen registers.”29 Smith’s differentiation between the “means of establishing communication” and the “purport of a[] communication”30 looms large in federal surveillance law. 25 442 U.S. 735 (1979). 26 Id. at 745-46. 27 389 U.S. 347 (1967). 28 Id. at 741 (emphasis in original). 29 Id. (quoting United States v. New York Tel. Co., 434 U.S. 159, 167 (1977)). 30 Id. 18 Whereas the Wiretap Act governs the interception of communications “content[],”31 the separate federal Pen Register Act governs the acquisition of non-content “dialing, routing, addressing, [or] signaling information.”32 As the House of Representatives noted in its Report regarding the enactment of the PATRIOT Act, “the statutorily prescribed line between a communication’s contents and non-content information[] [is] a line identical to the constitutional distinction drawn by the U.S. Supreme Court in Smith v. Maryland.”33 Since Smith, location identifiers have classically been associated with non-content “means of establishing communication.”34 Nevertheless, the District Court’s 31 18 U.S.C. § 2510(4); see also id. § 2511(1)(a). 32 18 U.S.C. §§ 3121(c), 3127(3)-(4). Where surveillance by law enforcement is concerned, “[t]he difference in the standards for court approval of content-capturing wiretaps and non-content-capturing pen registers is dramatic—content information is protected by a ‘super-warrant,’ non-content information by a rubber stamp.” Matthew J. Tokson, The Content/Envelope Distinction in Internet Law, 50 Wm. & Mary L. Rev. 2105, 2120 (2009). 33 Report of the House of Representatives Judiciary Committee, H. Rep. No. 107-236, at 53, available at http://www.gpo.gov/fdsys/pkg/CRPT-107hrpt236/pdf/CRPT107hrpt236-pt1.pdf. 34 Smith, 442 U.S. at 741 (quoting New York Tel. Co., 434 U.S. at 167). 19 categorical assessment that location identifiers never “concern[] the substance, purport, or meaning” of a communication misses the mark.35 Often, a location identifier serves no routing function, but instead comprises part of a communication’s substance.36 As a leading treatise on criminal procedure explains: [T]he line between content and non-content information is inherently relative. If A sends a letter to B, asking him to deliver a package to C at a particular address, the contents of that letter are contents from A to B but mere non-content addressing information with respect to the delivery of the package to C. In the case of e- mail, for example, a list of e-mail addresses sent as an attachment to an e-mail communication from one person to another are contents rather than addressing information. In short, whether an e-mail address is content or non-content information depends entirely on the 37 circumstances. In essence, addresses, phone numbers, and URLs may be dialing, routing, addressing, or signaling information, but only when they are performing such a function. If an address, 35 18 U.S.C. § 2510(8). 36 See generally Orin Kerr, Websurfing and the Wiretap Act, Wash. Post. (June 4, 2015), https://www.washingtonpost.com/news/volokhconspiracy/wp/2015/06/04/websurfing-and-the-wiretap-act/. 37 Wayne R. LaFave, et al., 2 Crim. Proc. § 4.4(d) (3d ed.). 20 phone number, or URL is instead part of the substantive information conveyed to the recipient, then by definition it is “content.” The different ways that an address can be used means, as Professor Orin Kerr puts it, that “the line between contents and metadata is not abstract but contextual with respect to each communication.”38 Thus, there is no general answer to the question of whether locational information is content. Rather, a “content” inquiry is a case-specific one turning on the role the location identifier played in the “intercepted” communication. Here, the complaint does not make clear whether the tracked URLs were acquired by the defendants from communications in which those URLs played a routing function. This is not, however, fatal to the plaintiffs’ claim. In a declassified opinion analyzing whether there was statutory authority for a National Security Agency surveillance program, the Foreign Intelligence Surveillance Court observed that the government possessed trap and trace authority over “dialing, routing, addressing, and signaling information . . . provided, however, that such information shall not include the contents of any information.”39 The 38 Kerr, Websurfing and the Wiretap Act. 39 [Redacted], No. PR/TT [Redacted] (FISA Ct. 2010), available at http://www.dni.gov/files/documents/1118/CLEANEDPRTT%2 02.pdf at 26 (quoting 18 U.S.C. § 3127(4)). 21 Surveillance Court read this to mean that, for purposes of federal surveillance law, information may well serve both a routing function and a content function. Noting the breadth of the statutory descriptions of routing information and “content,” the Surveillance Court concluded that routing information and “content” are not mutually exclusive categories, but rather ones that Congress expressly contemplated to be occasionally coextensive.40 Proceeding to identify exemplary areas where routing information and “content” overlap, the Surveillance Court pointed, “in particular,” to URL queries that involve reproduction of a search phrase entered by a user into a search engine.41 Quoting the District of Massachusetts, the Surveillance Court explained that, “if a user runs a search using an [i]nternet search engine, the ‘search phrase would appear in the URL after the first forward slash’ as part of the addressing information, but would also reveal contents, i.e., the ‘“substance” and “meaning” of the communication . . . that the user is conducting a search for information on a particular topic.’”42 For an example from another context, the court pointed to post-cut-through digits in the phone context “as 40 Id. at 31. 41 Id. at 32. 42 Id. at 32 (final alteration in original) (quoting In re Application of the U.S., 396 F. Supp. 2d 45, 49 (D. Mass. 2005)). 22 dialing information, some of which also constitutes contents.”43 The decision of the Surveillance Court is instructive in several ways relevant to our analysis here. The first of these is that, to the extent that the statutory definitions and conceptual categories of content and routing information overlap, Congress expressly contemplated the possibility of such an overlap. For the reasons stated by the Surveillance Court, we are persuaded that, under the surveillance laws, “dialing, routing, addressing, and signaling information” may also be “content.” Second, the Surveillance Court takes the position that queried URLs can be content as well as routing information, for instance in the case of URLs that reproduce search engine inquiries. Though some district courts have held that a URL is never content, the Surveillance Court decision is part of a growing chorus that some, if not most, queried URLs do contain content. In In re Zynga Privacy Litigation, the Ninth Circuit took the position that queried URLs are content if, but only if, they reproduce words from a search engine query.44 43 Id. at 33. As the Southern District of Texas has explained, “‘[p]ost-cut-through dialed digits’ are any numbers dialed from a telephone after the call is initially setup or ‘cutthrough.’” In re Application of the U.S., 441 F. Supp. 2d 816, 818 (S.D. Tex. 2006). “Sometimes these digits transmit real information, such as bank account numbers, Social Security numbers, prescription numbers, and the like.” Id. 44 750 F.3d 1098, 1108-09 (9th Cir. 2014) (“[A] user’s request to a search engine for specific information could 23 In United States v. Forrester, meanwhile, a different panel of the Ninth Circuit noted that warrantless capture of URLs generally “might be more constitutionally problematic” than warrantless capture of IP addresses.45 The Forrester court explained that “[a] URL, unlike an IP address, identifies the particular document within a website that a person views and thus reveals much more information about the person’s [i]nternet activity.”46 Akin to Forrester is the stance taken by the House Judiciary Committee in its PATRIOT Act report, which stated that a pen register order “could not be used to collect information other than ‘dialing, routing, addressing, and signaling’ information, such as the portion of a URL (Uniform Resource Locator) specifying Web search terms or constitute a communication such that divulging a URL containing that search term to a third party could amount to disclosure of the contents of a communication. But the referrer header information at issue here includes only basic identification and address information, not a search term or similar communication made by the user, and therefore does not constitute the contents of a communication.”). 45 512 F.3d 500, 510 n.6 (9th Cir. 2008). An “IP address” is “[t]he 10-digit identification tag used by computers to locate specific websites.” Black’s Law Dictionary (10th ed. 2014) (“Internet-protocol address”). 46 512 F.3d at 510 n.6; see also Tokson, The Content/Envelope Distinction in Internet Law, 50 Wm. & Mary L. Rev. at 2136 (“[S]tandard URLs . . . reveal every bit as much content as do URLs containing search terms.”). 24 the name of a requested file or article.”47 Though none of these authorities offer detailed reasoning on why they draw the “content” line where they do, what they have in common is that they assess whether a URL involves “contents” based on how much information would be revealed by disclosure of the URL. Third, the Surveillance Court’s example of post-cutthrough digits in the telephone context—i.e. numbers dialed from a telephone after a call is already setup or “cutthrough”—hints at a different reason why queried URLs might be considered content. A number of courts apart from the Surveillance Court—most prominently the D.C. Circuit— have found such digits to comprise communications content beyond the permissible scope of a pen register.48 URL queries 47 See H. Rep. No. 107-36, at 53. 48 See U.S. Telecom Ass’n v. F.C.C., 227 F.3d 450, 462 (D.C. Cir. 2000) (“Post-cut-through dialed digits can . . . represent call content. For example, subjects calling automated banking services enter account numbers. When calling voicemail systems, they enter passwords. When calling pagers, they dial digits that convey actual messages. And when calling pharmacies to renew prescriptions, they enter prescription numbers.”); In re Applications of the U.S., 515 F. Supp. 2d 325, 339 (E.D.N.Y. 2007) (“[T]he “Government’s request for access to all post-cut-through dialed digits is not clearly authorized by the Pen/Trap Statute, and . . . granting such a request would violate the Fourth Amendment . . . .”); In re Application of the U.S., 441 F. Supp. 2d at 827 (“Post-cutthrough dialed digits . . . are not available to law enforcement under the Pen/Trap Statute.”). 25 bear functional analogues to this process, in that different portions of a queried URL may serve to convey different messages to different audiences. For instance, the domain name portion of the URL—everything before the “.com”— instructs a centralized web server to direct the user to a particular website, but post-domain name portions of the URL are designed to communicate to the visited website which webpage content to send the user.49 As stated above, we agree with the Surveillance Court that routing information and content are not mutually exclusive categories. And between the information revealed by highly detailed URLs and their functional parallels to postcut-through digits, we are persuaded that—at a minimum— some queried URLs qualify as content.50 Indeed, the 49 See generally Jonathan Mayer, Web Browsing (Under the Pen Register Act and Wiretap Act), (Nov. 28, 2014). https://www.youtube.com/watch?v=7vFha-af7GE 50 We need not make a global determination as to what is content, and why, in the context of queried URLs. Lack of consensus, the complexity and rapid pace of change associated with the delivery of modern communications, and the facileness of direct analogy to mail and telephone cases counsel the utmost care in considering what is, and what is not, “content” in the context of web queries. Indeed, when it comes to differentiating content from non-content, Professor Kerr describes queried URLs as “the most difficult and discussed case.” Orin S. Kerr, Applying the Fourth Amendment to the Internet: A General Approach, 62 Stan. L. Rev. 1005, 1030 n. 93 (2010); see also Orin S. Kerr, Internet Surveillance Law after the USA Patriot Act: The Big Brother that Isn’t, 97 Nw. U. L. Rev. 607, 644-48 (2003); cf. Tokson, 26 defendants’ counsel acknowledged as much at argument.51 Because the complaint pleads a broad scheme in which the defendants generally acquired and tracked the plaintiffs’ internet usage, we are satisfied that this scheme, if it operated as alleged, involved the collection of at least some “content” within the meaning of the Wiretap Act.52 The Content/Envelope Distinction in Internet Law, 50 Wm. & Mary L. Rev. at 2136 (“Perhaps because it is so intuitive that search terms in a URL should be considered content, the treatment of content-revealing communications data is undertheorized in computer surveillance scholarship.”). 51 Oral Arg. Tr. at 44 (“We acknowledge that there may be URLs that could constitute content.”). 52 Because the URL information acquired and tracked by the defendants is “content” for purposes of the plaintiffs’ Wiretap Act claim, we need not consider whether the defendants acquired and/or tracked other “content” from the electronic transmissions at issue. Our understanding of the factual position of the defendants is that their cookies operate by adding a unique sequence of letters and/or numbers to any GET request transmitted from the user browser hosting the cookie to the advertiser server that set the cookie. See Oral Arg. Tr. at 25 (“The cookie doesn’t acquire anything. . . . The cookie doesn’t look for anything. It just sits on the browser and gets sent along with information that would otherwise be sent.”); id. at 26 (“Maybe it’s sort of like a bookmark. Information gets sent anyway every day, all the time. And then a cookie is placed. And thereafter the same information is sent, except that the cookie is there, too. It’s unique. It’s not personally identifying. It has nothing to do with the actual 27