In re Application of the U.S. for An Order Pursuant to 18 U.S.C. §2703(d)

Decision Date10 November 2011
Docket NumberMisc. No. 10-GJ-3793,Misc. No. 1:11-DM-3
CourtUnited States District Courts. 4th Circuit. United States District Court (Eastern District of Virginia)
PartiesIN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER PURSUANT TO 18 U.S.C. § 2703(d)

IN RE APPLICATION OF THE UNITED STATES OF AMERICA FOR AN ORDER PURSUANT TO 18 U.S.C. § 2703(d)

Misc. No. 1:11-DM-3
Misc. No. 10-GJ-3793

UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA Alexandria Division

Dated: November 10, 2011


MEMORANDUM OPINION

This matter comes before the Court on Petitioners' Objections to rulings issued by United States Magistrate Judge Theresa Carroll Buchanan regarding an Order issued after application under Title II of the Electronic Communications Privacy Act, known as the Stored Communications Act (SCA), 18 U.S.C. § 2701 et seq. In their Motion to Vacate (Doc. 1) and Motion to Unseal (Doc. 3), Petitioners moved to quash the Order, unseal the application seeking the Order, and publicly docket other related information. Magistrate Judge Buchanan denied the motion to vacate and granted in part and denied in part the motion to unseal, and Petitioners objected. For the reasons stated in this opinion, Petitioners' objections are DENIED.

I. BACKGROUND

As part of an ongoing criminal investigation, Respondent United States of America obtained a court order to turn over information pertaining to Petitioners, who were subscribers and users of certain websites and services of interest to the government. Petitioners Jacob Appelbaum, Rop Gonggrijp, and Birgitta Jonsdottir challenge the order and other rulings as Real Parties in Interest. Mr. Appelbaum is a resident and citizen of the United States and is a computer security expert. Doc. 3 at 10. Mr. Gonggrijp is a Dutch citizen and a computer security expert. Doc. 3 at 11. Birgitta Jonsdottir is a citizen and resident of Iceland, and currently serves as a member of the Parliament of Iceland. Doc. 3 at 10. Each Petitioner used the Internet to

Page 2

communicate with the Twitter social networking service.1

A. Twitter

Petitioners are Twitter subscribers. Twitter is a social networking service that permits users2 to post pithy messages using short communications called "tweets," and to read the tweets of other users.3 Users can monitor, or "follow," other users' tweets, and can permit or forbid access to their own tweets. In addition to posting their own tweets, users may send messages to a single user ("direct messages") or repost other users' tweets ("retweet"). Each Twitter user has a unique username. Mr. Appelbaum, for example, used the moniker ioerror. Mr. Gonggrijp was known as rop_g, and Ms. Jonsdottir used the name birgittaj.

As counsel for Mr. Applebaum stated at the hearing on February 15, 2011, a person signing up for the Twitter service must click on a button below a text box indicating that "[b]y clicking the button, you agree to the terms below," where the "terms" referred to are displayed in the text box. See Doc. 41 at 17; Ex. 1 attached to Decl. of Karen Bringola ("Bringola Decl."), Doc. 45-1 at 5. Those terms are listed in a small text box. See Doc. 45-1 at 5. The terms indicate that users agree to the Twitter Privacy Policy ("Privacy Policy"). See Ex. 3, attached to Bringola Decl. at 22-23; see also Twitter Privacy Policy, http://twitter.com/privacy (last accessed Nov. 9, 2011). Neither party disputes that Twitter users click on a button indicating agreement to the terms, including the Privacy Policy, as a practical condition of creating an account. See Doc. 41

Page 3

at 16-17. At the hearing before Magistrate Judge Buchanan on the motion to vacate, the following discussion took place:

MR. KEKER [arguing the Motion to Vacate on behalf of all parties in interest]: And in a hearing we believe we could show that not nobody, but most people, the vast majority of people have no idea that Twitter collects the information about their whereabouts and--
THE COURT: Well, your clients seem like pretty knowledgeable people, and they did agree to Twitter's privacy policy, did they not?
MR. KEKER: They-- I wouldn't accept that they agreed to Twitter privacy policy. THE COURT: They were informed of it at any rate--
MR. KEKER: They went ahead with Twitter in the face- I have had those things pop up on my screen every time I have gotten a new program. I think their-- I have--THE COURT: So, you don't read them?
MR. KEKER: I have never read the whole thing. So, saying that they agreed to it, it was jammed down their throat. Yes, it appeared on their screen, there is no question about that.
THE COURT: Well, it would be a condition of creating a Twitter account, would it not?
MR. KEKER: Correct, that's true.
THE COURT: Okay. And they agreed to that, correct?
MR. KEKER: They created a Twitter account, that's certainly true.
THE COURT: All right. Subject to that. Okay.
MR. KEKER: And that is one factor, I totally agree, that would be as useful factor for the Government in this hearing where you tried to figure out what a reasonable expectation of privacy is. But I would argue that there would be ways to overcome that.

Doc. 41 at 16-17. The Privacy Policy informs users about information collected upon registration of an account, as well as additional information collected by Twitter in the course of its operation. Bringola Decl. at 22-23. Twitter collects many types of usage information, including physical location, IP address, browser type, the referring domain, pages visited, search terms, interactions with advertisements, clicks on links, cookies, and other types. Id. The Privacy Policy further states that Twitter may disclose information about an account if Twitter believes it reasonably necessary to comply with a law, regulation or legal request, or to address fraud, security, or technical issues, or protect a person's safety. Bringola Decl. at 23.

Page 4

B. IP Addresses

A computer attached to the Internet uses a unique numerical address called an Internet Protocol address, or IP address, to identify itself to other computers. Nat 7 Cable & Telecomm. Ass'n v. Brand X Internet Svcs., 545 U.S. 967, 987 n.l (2005) ("IP addresses identify computers on the Internet, enabling data packets transmitted from other computers to reach them."); United States v. Yu, 411 Fed. Appx. 559, 560 n.l (4th Cir. 2010) ("Each computer connected to the Internet is assigned a unique numerical address, otherwise known as an Internet protocol or IP address, to identify itself and facilitate the orderly flow of electronic traffic") (quoting Peterson v. Nat 7 Telecomm'n & Info. Admin., 478 F.3d 626, 629 (4th Cir. 2007)). In computer terms, an IP address is a 32-bit integer that can be stamped on network communications or translated into human-readable format. The most basic communication standard underlying the Internet, called the Internet Protocol, uses IP addresses to transmit bundles of data, called "packets," through the network. Amicus Br. of Steven Bellovin, Ph.D., et al. ("Bellovin Br."), Doc. 49 at 5. Each IP address is a numeric address, usually expressed as four numbers separated by periods (such as a.b.c.d, where a, b, c, and d represent numbers from 0 to 255). Bellovin Br. at 5.

Special computers called "routers" communicate packets among themselves through a patchwork of interconnections and maintain a database that specifies how to direct each packet in the proper direction. See Bellovin Br. at 5-6. Each packet is stamped with a source IP address and a destination IP address, and every time a router receives a packet, it examines the destination address, looks up routing information for that address in the database, and forwards the packet toward the right network. Bellovin Br. at 5-6. This process is repeated until the packet reaches a router that can transmit directly to the destination IP address. Clearly, correct IP

Page 5

addressing information is essential to Internet technology.4

A human user may not know the specific IP address assigned to his network connection, or the IP address of a remote computer or website, even though the computer must know those addresses as a prerequisite to Internet communications. Bellovin Br. at 6-7. Nowadays, most Internet users access a system called the Domain Name System, or DNS, that allows persons to use a computer name (such as twitter.com or www.vaed.uscourts.gov) as a substitute for an IP address. Peterson, 478 F.3d at 629. Thus, when a person attempts to access a named computer, the person's computer finds the IP address of the remote site by matching, or "resolving," the name to the proper IP address, then contacts the website over the Internet using that IP address.5

From the perspective of the destination computer, it is an extraordinarily simple task to determine the IP address of the computer seeking to access it. Bellovin Br. at 7; see also United States v. Christie, 624 F.3d558, 563 (3d Cir. 2010) ("IP addresses are also conveyed to websites that an internet user visits, and administrators of websites ... can see the IP addresses of visitors to their sites."). Most websites maintain standard logs of connecting IP addresses, along with date and time information, and may even include information about the user associated with the connection. Bellovin Br. at 7. Such information is routinely gathered to evaluate usage patterns, engage in site marketing analysis, troubleshoot problems, or to gather feedback. Some commercial enterprises even collect IP address information to provide location data associated with particular users, presumably for marketing purposes. Bellovin Br. at 8; see Bringola Decl. at

Page 6

22...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT