Mary Minow is a library law consultant with LibraryLaw.com. She received her B.A. from Brown University, her A.M.L.S. from the University of Michigan, Ann Arbor, and her J.D. from Stanford University. Mary is coauthor with Tomas Lipinski of The Library’s Legal Answer Book (ALA: 2003). Links to Mary’s other articles on LLRX.com are here.

Could your library be sued for turning over an Internet user’s sign-up information to law enforcement? What if you only did so pursuant to a search warrant? Here is a cautionary tale about an Internet service provider, AOL, that turned over subscriber information to local police in response to a search warrant. The subscriber is now suing AOL, and he just might win. It turns out that AOL apparently did not closely examine the search warrant, which was invalid.

Libraries and ISPs need attorneys, now more than ever. If you don’t have an attorney (ideally one with criminal experience) to call on a moment’s notice, today is the day to line one up.

Unlike subpoenas which give time for you to respond (e.g., five days), search warrants can be executed immediately by law enforcement. You should have a lawyer available without delay to examine the scope and validity of the warrant. In person is best, but by phone/fax is better than nothing.

When I give Patriot Act training to librarians, I am amazed at the number of libraries that don’t have an attorney. And some that do neglect to give the attorney’s name and number to all staff who are ever authorized to be “in charge.” They should have this information plus the attorney’s fax number to be able to send a warrant over quickly for remote consultation.

Even orders issued under the authority of the Patriot Act allow a library or ISP to consult with an attorney. There is no requirement, however, for law enforcement to wait for an attorney to arrive, much less wait for a library to find one in the yellow pages. It’s reasonable for the library to request a short delay — libraries and ISPs are “innocent third parties,” not suspected felons. If law enforcement grants a delay, in a library the front-line staff should assemble its team: the library’s director, its IT specialist and its attorney.

While you’re at it, check to see if your policies, procedures and staff training on how to respond to a search warrant are up-to-date. Take a look at sample search warrant procedures at LLRX.com.

The attorney will carefully examine the warrant’s scope and will make sure it has a valid signature by a judge. As Dan Levine wrote in the Hartford Advocate, “Without a judge’s signature, a warrant is nothing more than a neato-toledo looking legal paper, with no power to compel anyone to do anything.”

Don’t let this happen to you: America Online is in court now defending itself for releasing subscriber information even though it did so in accordance with a search warrant. The problem? “At the bottom of each page of the search warrant are three signature lines. Two were signed by police officers as co-affiants. The bottom line is for the judge. It was blank,” says Dan Klau, the attorney representing the plaintiff who is suing AOL.

Here’s the background: On or about March 31, 2003, an anonymous email was sent to members of a local political campaign. The email used the return address [email protected] and stated “The End is Near.” The recipients contacted the police, claiming they’d received harassing email. The police then filled out a search warrant, signed it, and faxed it to AOL. The police had not submitted it to a judge, and AOL did not verify the warrant.

On April 7, 2003, AOL faxed the subscriber information to the officers, showing that the email had been sent from the account of Clifton S. Freedman, along with his address, phone numbers, account status, membership information, software information, billing and account information, and his other AOL screen names. According to Ray B. Burton, Connecticut Law Tribune, the local newspaper obtained a copy of a police report and “the ensuing ruckus” eventually prompted Freedman to withdraw from the school board race and resign from the Republican Town Committee.

Freedman sued the police officers, the town of Fairfield Connecticut, and AOL. The police officers conceded that they had not gone before a judge. The police said that they used the warrant form because “it was a clear and concise format for conveying the facts of the case and the reasons I believed probable cause existed to request the information.” according to Burton. Was it a rookie officer making a mistake? No, it was an officer with 23 years experience.

According to Burton, the town’s attorney defended the officers’ action, saying, “if AOL had said, ‘Get a court order,’ they would have gotten a court order — it’s not hard.” The police didn’t require AOL to release the information under the act, but merely requested its cooperation.

In February 2004, a federal court in Connecticut ruled that the officers violated the Electronic Communications Privacy Act, 18 U.S.C. § 2703(c).

What happened to the suit against AOL? Freedman sued AOL for violation of the Electronic Communications Privacy Act (ECPA), as well as breach of contract and violation of the Connecticut Unfair Trade Practices Act. Depositions are scheduled to take place very soon, and the case is slated to go before the U.S. District Court for Eastern Virginia.

To defend itself, AOL is likely to look to the law’s exceptions that allow disclosure of customer records. AOL might argue that it disclosed the records under the emergency section of the law. May a library or ISP ever voluntarily give user records to law enforcement? Yes, but only if it believes, in good faith, there is an emergency involving danger of death or serious physical injury, requiring disclosure without delay. 18 U.S.C. § 2702(b)(7).

However, if the initial request is from law enforcement, it must follow proper legal process. In the February 2004 federal district court opinion, the judge pointed to the legislative history of the sections of the USA Patriot Act that amended the ECPA. The history shows Congress’ intent that the government must strictly abide by the prescribed legal process to receive subscriber information when invoking the emergency exception:

Current law does not expressly authorize the ISP to voluntarily provide law enforcement with the identity, home address, and other subscriber information of the user making the threat. See 18 U.S.C. section 2703(c)(1)(B),(C), permitting disclosure to government entities only in response to legal process. 147 CONG. REC. S. 10365 (2001).

Essentially, this protects ISPs (including libraries) from being coerced by law enforcement to “voluntarily” disclose. The cited section requires either a court order or consent by the individual. The court declined to speculate whether it would ever be appropriate, under exigent circumstances, for the government to notify the ISP of an emergency and receive subscriber information without meeting the ECPA’s requirements.

In any event it will be tough for AOL to win using the emergency defense. No evidence was offered by the police to show such an emergency. In fact, AOL took six days to respond.

Could a library get sued if it complies with an invalid warrant? Yes. Public libraries that offer the Internet are subject to the ECPA, (see 18 USC § 2711 that defines “remote computing service” broadly as one that provides computer processing services to the public by means of an electronic communications system).

Additionally, state laws protect librar
y patron records, a result of dedicated librarians who have lobbied for these laws to guard user privacy. Without the right to privacy, with the specter of the government looking over our shoulders, our freedoms to read and to speak are compromised.

The definitions of patron records and the scope of protection differ by state and can be viewed at the American Library Association website. Some states require only subpoenas; others require court orders such as search warrants. State laws requiring court orders mean that the orders must be signed by a judge. Search warrants are one example of court orders.

With no evidence to the contrary, Freedman engaged in constitutionally protected, anonymous speech. If there is probable cause to believe there was a true threat, the police can get a search warrant signed by a judge.

Resources

American Library Association, State Privacy Laws Regarding Library Records at http://tinyurl.com/2bb6x

Ray B. Burton, Conn. Judge Finds Against Police in E-Privacy Suit, The Connecticut Law Tribune (February 24, 2004) at http://tinyurl.com/3eqpq

Cyberslapp.org. Case briefs filed where Internet speakers were sued for their online speech, or where the identities of Internet speakers were sought by subpoena. http://www.cyberslapp.org/litigation/briefs/

Electronic Privacy Information Center (EPIC), for background on Internet anonymity at http://www.epic.org/privacy/anonymity/

Freedman v. AOL., the Town of Fairfield and Detectives William Young and David Bensley, 2004 U.S. Dist. LEXIS 1548 (D. Conn. Jan. 4, 2004), amended by and reprinted at Freedman v. AOL., the Town of Fairfield and Detectives William Young and David Bensley, 2004 U.S. Dist. LEXIS 1722 (D. Conn. Feb 4, 2004). Police officers violated the Electronic Communications Privacy Act, 18 U.S.C. § 2703(c) when they used a search warrant to get subscriber information from AOL without getting a judge to sign it. At http://www.cyberslapp.org/litigation/briefs/FreedmanSJRuling.pdf

Freedman v. AOL, the Town of Fairfield and Detectives William Young and David Bensley, 294 F. Supp. 2d 238; 2003 U.S. Dist. LEXIS 22019 (2003). Dismisses AOL from suit filed in federal court in Connecticut due to AOL subscriber contract clause that requires plaintiff to sue it in Virginia. The suit has been re-filed in federal court in Virginia.

Daniel J. Klau, privacy law attorney, Pepe & Hazard, Personal Interview, April 1, 2004. Mr. Klau represents Clifton S. Freedman.

Dan Levine, You’ve Been Sued! AOL faces litigation for turning over private information of a Connecticut man, The Hartford Advocate (December 25, 2003) at http://www.hartfordadvocate.com/gbase/News/content?oid=oid:47678

Mary Minow, Sample of Search Warrant Procedures for Libraries, LLRX.com (May 19, 2003) at //www.llrx.com/features/draftsearch.htm