Update - Volume 13, Number 11, 2000

Alphabet Soup:

ECPA, PPA and Privacy Protection Issues in Computer Facilitated Child Sexual Exploitation Cases

By Susan S. Kreston¹

With the explosion of computer-facilitated child sexual exploitation, law enforcement and prosecutors are finding it necessary to become experts in areas of law that are evolving at a phenomenal pace.  Computer-facilitated sexual exploitation cases have gained a high profile in areas such as on-line luring and abduction of children, "traveler" cases², and the production and distribution of computerized child pornography on the Internet.  In the quest to get justice for the children who are victimized by these crimes, prosecutors and law enforcement must become aware of some of the lesser known statutes that may come into play.

The Electronic Communications Privacy Act (ECPA) and the Privacy Protection Act (PPA) are two such federal statutes and a basic awareness of their principles and the rights they may afford to suspects and third parties is essential to avoiding unnecessary legal difficulties which might result in suppression of crucial evidence and financial liability.  While these acts are the focus of this discussion, it must be remembered that the Fourth and First Amendments to the Federal Constitution, state constitutions, federal or state acts^3,or recent court decisions may provide additional privacy protections that must be evaluated on a case by case basis.

ECPA - ECPA protects communication based on its form.  It protects wire and electronic communication content from interception during transmission⁴ (e.g., wiretap) or in storage by the provider⁵ (e.g., e-mail).  The focus of this article will be e-mail.  ECPA applies to all parties, private and law enforcement alike.  However, for law enforcement, there are mechanisms for requiring disclosure to the government by public Electronic Communication Service (ECS) providers of information regarding an electronic communication.  The most well known example of an ECS would be an Internet Service Provider (ISP), such as American On Line or Yahoo.

A public ECS is generally prohibited from voluntarily disclosing the content of stored electronic communication.⁶  The three exceptions to this rule are:  (1) where the addressee/sender or subscriber consents to disclosure; (2) when disclosure is necessary to protect the property of the service provider (e.g., when viruses are detected); and (3) when the public ECS inadvertently obtains information that pertains to the commission of a crime.⁷  The mechanisms available to law enforcement to compel disclosure of information are subpoenas, court orders and search warrants.

A subpoena can be used to obtain basic subscriber information.⁸  Basic subscriber information includes the name, address, telephone toll billing records, other subscriber number and identity, telephone number, type of service provided and length of service rendered.  A court order, sometimes referred to as an "articulable facts order,"⁹ may be sought to obtain all additional information except the contents of an e-mail that has been stored for 180 days or less.

To obtain such an order, there must be specific and articulable facts showing that there are reasonable grounds to believe that the specified records are relevant and material to an ongoing criminal investigation.¹⁰  The type of information that could be collected by the order include activity logs, credit card information and billing methods.  

A search warrant is necessary for unopened electronic communications in storage for less than 180 days.¹¹  If the message has been stored for more than 180 days, the government may gain access one of two ways.  Access may be gained, after giving notice to the customer or subscriber, pursuant to an administrative or grand jury subpoena or pursuant to a court order.¹²  Alternatively, access may be gained pursuant to a search warrant.  The notice required for subpoenas and court orders may be delayed for up to 90 days if notice would result in endangering an individual or seriously jeopardizing an investigation.¹³  An extension of an additional 90 days may also be considered by the issuing court.¹⁴

As the level of governmental process escalates from subpoena to court order to warrant, it must be remembered that the information available under the less exacting standard is included at the higher level (i.e., an order will get transactional information and basic subscriber information, a search warrant will get transactional information, basic subscriber information, and content).  Law enforcement can and should talk to the ISP in advance about what types of information are sought and what the ISP may have.  It is possible to request the provider take all steps necessary to preserve records and other evidence in its possession pending the issuance of a court order or other process.¹⁵

Civil damages are the exclusive remedy for violation of the ECPA.¹⁶  These include a minimum damage amount of $1,000, plus costs, punitive damages and attorney fees.  Negligent breaking or destroying of equipment is also actionable.  Additionally, loss of business opportunity may be actionable, particularly if it is brought by an innocent third party.  Disciplinary action may also be taken against law enforcement employees if the violation was willful or intentional.  The good faith defense is complete.¹⁷  The statute of limitations is two years from the first discovery or reasonable opportunity to discover the violation.  Except in cases where the defendant's constitutional rights have been infringed, evidence seized in violation of the statute will not be suppressed.¹⁸  However, the possibility of amending ECPA to grant suppression as a remedy is currently being discussed in Congress.¹⁹

PPA - The PPA²⁰ protects persons who may broadly, but reasonably claim to be publishers.  The PPA establishes safeguards for these "publishers" from governmental search and seizure of materials in their possession.  These materials may be either "work product" (materials created by the author/publisher) or "documentary materials" (any materials that document or support the work product).  Unlike ECPA, the PPA applies only to law enforcement.  If the material is covered by the PPA, law enforcement must serve the target with a subpoena, allowing the target to challenge the subpoena by a motion to quash before complying with it.

Exceptions to the PPA are particularly relevant within the scope of child sexual exploitation cases.  Offenses that involve the production, possession, receipt, mailing, sale, distribution, shipment, or transportation of child pornography, the sexual exploitation of children, or the sale or purchase of children under § 2251, 2251A, 2252, or 2252A of title 18, United States Code are specifically exempted from the protections afforded publishers/authors.²¹  Child pornography is contraband and is not protected if it is a fruit or instrumentality of a crime.  The PPA affords no protection to materials that may be evidence of a crime.²²  The PPA also allows immediate seizure of materials when necessary to prevent death or serious bodily injury.²³  The PPA does not require investigators to give the publisher notice when doing so would reasonably result in the destruction, alteration or concealment of the materials.²⁴

The importance of this act to child exploitation prosecutors and investigators lies more in the area of commingled materials.  Where there is child pornography mixed in with protected material, issues concerning the proper scope and execution of search and seizure will arise.  It is recommended that a protocol be in place to address how to attempt to separate these types of materials.²⁵

When commingled materials are discovered, two viable alternatives exist.  First, search the materials on-site and seize only those covered by the warrant and not protected by the PPA.  Second, if the materials are too voluminous to search on-site, seize all items that may reasonably be covered by the warrant, bit-stream image²⁶ the information for analysis, and then return the protected materials as soon as possible after reviewing them off-site.²⁷

Where it is reasonably foreseeable that commingled materials will exist, such as a book publisher's office or a known and acknowledged author's house or business, and that a thorough on-site evaluation is realistically untenable, this possibility should be noted in the warrant application.  The steps that will be employed to minimize intrusion into potentially protected materials and the procedures that will effect this protocol should be discussed.  One approach is to have a "taint team" that will review the potentially protected materials and then be severed from the investigation after that process has been completed.

The remedies available under the PPA are civil action for damages,²⁸ including attorney fees and costs,²⁹ with a statute of limitations of 2 years.  They do not include exclusion of evidence.³⁰  The "good faith" defense is available to law enforcement officers under this statute.³¹  The good faith defense does not extend to governmental entities, except in limited circumstances.³²  Nothing in the PPA prevents the government from seeking forfeiture of computers or CD-ROMs containing commingled mateirals.³³

Conclusion

Computers and electronic communications are an intrinsic part of the new crime scene.  Knowing the laws that protect them must be a priority for the investigators and prosecutors who seek to utilize the best practices in search and seizure of computer evidence, and to minimize the potential personal and departmental liability of the parties involved.³⁴

¹Deputy Director, National Center for Prosecution of Child Abuse.
²A traveler case is one where an adult actively pursues a child on-line with the intent of traveling to meet the child for the purpose of sexual activity.
³E.g., those dealing with the presence of privileged/confidential communications.
⁴See 18 USC § 2510 et seq.
⁵See 18 USC § 2701 et seq.
⁶See 18 USC § 2702 (a).
⁷See 18 USC § 2702 (b).
⁸See 18 USC § 2703 (c).
⁹See 18 USC § 2703 (d).
¹⁰Id.
¹¹See 18 USC § 2703(a).
¹²See 18 USC § 2703(b).
¹³See 18 USC § 2705.
¹⁴See § 2705(a)(4).
¹⁵See 18 USC § 2703(f).
¹⁶See §§ 2707, 2708.
¹⁷See §2707(e)-Defense.  A good faith reliance on -- (1) a court warrant or order, a grand jury subpoena, a legislative authorization, or a statutory question; ... is a complete defense to any civil or criminal action brought under this chapter [18 USCS §§ 2707 et seq.] or any other law.
¹⁸See U.S. v. Kennedy, 81 F. Supp. 2d 1103 (D. Kan. 2000).
¹⁹ H.R. 5018
²⁰See 42 USCS §§ 2000aa et seq.  For a succinct summary of the history of the PPA, see DePugh V. Sutton, 917 F. Supp. 690 (W.D. Mo. 1996), aff'd 104 F.3d 363 (8th Cir. 1996).
²¹ 42 USCS §§ 2000aa(a)(1) and (b)(1).
²² 42 USCS § 2000aa(a)(1).
²³ 42 USCS § 2000aa(a)(2).  An example of this might be when a child has been kidnapped, no body has been found and there is reason to believe the child's still alive, though at risk.
²⁴ 42 USCS § 2000aa(b)(3).
²⁵ See United States v. Hunter, 13 F. Supp. 2d 574 (D.Vt. 1998).
²⁶Bit stream imaging involves the use of hardware or software utilities to create an exact bit by bit copy or "duplicate original" of a disk or volume.
²⁷See Steve Jackson Games, Inc. v. United States Secret Service, 816 F. Supp. 432 (W.D. Tex. 1994), aff'd, 36 F.3d 457 (5th Cir. 1994).
²⁸ 42 USCS § 2000aa-6(a).
²⁹ 42 USCS § 2000aa-6(f).
³⁰ 42 USCS § 2000aa-6(e).
³¹ 42 USCS § 2000aa-6(b).
³² 42 USCS § 2000aa-6(c).
³³ See State v. One (1) Pioneer CD-ROM Changer; 891 P.2d 600,607 (Okla. Ct. App. 1994), cited in Stephan K. Bayens, The Search and Seizure of Computers:  Are We Sacrificing Personal Privacy for the Advancement of Technology?, 48 DRAKE L. REV. 239 (2000).
³⁴ Printouts of the relevant sections of the statutes, charts summarizing the mechanism(s) necessary for obtaining information, and case law dealing with these issues is available from NCPCA.  Please address enquiries and requests to the author at susan.kreston@ndaa-apri.org.