State v. Reid

• Court: New Jersey Supreme Court
• Writing for the Court: Rabner
• Citation: State v. Reid, 194 N.J. 386, 945 A.2d 26 (N.J. 2008)
• Decision Date: 21 April 2008
• Docket Number: A-105 September Term 2006
• Parties: STATE of New Jersey, Plaintiff-Appellant v. Shirley REID, Defendant-Respondent.

945 A.2d 26

194 N.J. 386

STATE of New Jersey, Plaintiff-Appellant v. Shirley REID, Defendant-Respondent.

A-105 September Term 2006

Supreme Court of New Jersey.

Argued October 22, 2007.

Decided April 21, 2008.

Steven A. Yomtov, Deputy Attorney General, argued the cause for appellant (Anne Milgram, Attorney General of New Jersey, attorney).

Joseph C. Grassi, Wildwood, argued the cause for respondent (Barry, Corrado, Grassi & Gibson, attorneys; Mr. Grassi and Frank L. Corrado, of counsel and on the briefs).

Rubin M. Sinins, Newark, argued the cause for amicus curiae Association of Criminal Defense Lawyers of New Jersey (Javerbaum Wurgaft Hicks Kahn Wikstrom & Sinins, attorneys).

Grayson Barber, submitted a brief on behalf of amici curiae American Civil Liberties Union of New Jersey, Electronic Frontier Foundation, Electronic Privacy Information Center, Freedom To Read Foundation, Privacy Rights Clearinghouse and New Jersey Library Association (Ms. Barber, attorney; Ms. Barber and Edward L. Barocas, on the brief).

Chief Justice RABNER delivered the opinion of the Court.

Modern technology has raised a number of questions that are intertwined in this case: To what extent can private individuals "surf" the "Web" anonymously? Do Internet subscribers have a reasonable expectation of privacy in their identity while accessing Internet websites? And under what circumstances may the State learn the actual identity of Internet users?

In this case, defendant Shirley Reid allegedly logged onto an Internet website from her home computer. The site belonged to a company that supplied material to her employer's business. While on the supplier's website, Reid allegedly changed her employer's password and shipping address to a non-existent address.

Whenever an individual logs onto an Internet website, that user's identity is revealed only in the form of a unique multi-digit number (an "IP address") assigned by the user's Internet Service Provider ("ISP"). A website may collect that number, but only a service provider can translate it into the name of an actual user or subscriber.

Here, the supplier's website captured a 10-digit IP address, and the supplier told Reid's employer what had occurred. The employer, in turn, reported the IP address to local authorities. They issued a deficient municipal subpoena to Comcast, the service provider, and Comcast revealed that the IP address was assigned to Shirley Reid.

Reid is now under indictment for second-degree computer theft. She successfully moved to suppress the subscriber information obtained via the municipal subpoena.

We now hold that citizens have a reasonable expectation of privacy, protected by Article I, Paragraph 7, of the New Jersey Constitution, in the subscriber information they provide to Internet service providers — just as New Jersey citizens have a privacy interest in their bank records stored by banks and telephone billing records kept by phone companies. Law enforcement officials can satisfy that constitutional protection and obtain subscriber information by serving a grand jury subpoena on an ISP without notice to the subscriber.

Because the police used a deficient municipal subpoena to obtain protected subscriber information in this case, defendant's motion to suppress was properly granted. However, records of the protected subscriber information existed independently of the faulty process the police used, and the conduct of the police did not affect that information. As a result, the State may seek to reacquire the subscriber information with a proper grand jury subpoena.

I.

A.

Some background information about computers and the Internet may assist in evaluating the issues presented. The Internet is a global network of computers that allows for the "sharing" or "networking" of information to and from remote locations. See Harry Newton, Newton's Telecom Dictionary 502 (23rd ed. 2007). Users of the Internet can send electronic mail, share files, and explore or "surf" the World Wide Web ("Web"), a graphical computer-based information network. Id. at 502-03. While surfing the Web, a user can visit and interact with sites maintained by businesses, educational institutions, governments, and individuals, which cover almost every conceivable topic.

An individual customer must select an Internet Service Provider like Comcast, AOL, or Verizon, in order to connect to the Internet. See, e.g., id. at 107. To sign up for service, a customer must disclose personal information including one's name, billing information, phone number, and home address.

To interact with other computers also attached to the Internet, a computer must be assigned an Internet Protocol address, or IP address. Id. at 342. An IP address is a string of up to twelve numbers separated by dots — for example, 123.45.67.89. Ibid. In certain situations, a computer is assigned a permanent IP address, called a static IP address. Ibid. Most often, when an individual connects to the Internet, his or her Internet Service Provider dynamically assigns an IP address to the computer, which can change every time the user accesses the Internet. Ibid. In other words, the "dynamic" IP address assigned to the computer can be different for each Internet session. Ibid.

The American Registry for Internet Numbers (ARIN) is in charge of assigning IP addresses within North America. See http://www.arin.net/index.shtml. Anyone acquiring an IP address must register and provide ARIN certain contact information, which ARIN makes publicly available. Ibid. However, most Internet users do not obtain IP addresses directly from ARIN; they instead "lease" an IP address from a service provider like Comcast, which is the actual, named registrant. See RIR Comparative Policy Overview (2008), http://www.nro.net/documents/nro47.html (last visited April 16, 2008) (linked to ARIN website).

When an Internet user surfs the Web, sends e-mail, or shares a file, any site the user connects to can collect certain information, including the user's IP address. See Newton, supra, at 506. However, the sites ordinarily cannot identify the name of an individual user. Only the ISP can match the name of the customer to a dynamic IP address.

Recently, IP Address Locator Websites have become available to the general public.¹ Such websites operate similarly to a reverse phone directory: they permit a person to type in an IP address and obtain the name and location of the registrant for that address. Once again, because most Internet users access the Internet via third-party service providers like AOL, Comcast, Yahoo, and others, Address Locator Websites typically reveal the name and location of the service provider — such as Comcast — but not information about the individual user.

Thus, even with the advent of IP Address Locator Websites, most users continue to enjoy relatively complete IP address anonymity when surfing the Web.

B.

The facts of this case are not in dispute. On August 27, 2004, Timothy Wilson, the owner of Jersey Diesel, reported to the Lower Township Police Department that someone had used a computer to change his company's shipping address and password for its suppliers. The shipping address was changed to a non-existent address.

In response to a question by the police, Wilson explained that Shirley Reid, an employee who had been on disability leave, could have made the changes. Reid returned to work on the morning of August 24, had an argument with Wilson about her temporary light duty assignment, and left. According to Wilson, Reid was the only employee who knew the company's computer password and ID.

Wilson learned of the changes through one of his suppliers, Donaldson Company, Inc. Both the password and shipping address for Jersey Diesel had been changed on Donaldson's website on August 24, 2004. According to an information technology specialist at Donaldson, someone accessed their website and used Jersey Diesel's username and password to sign on at 9:57 a.m. The individual changed the password and Jersey Diesel's shipping address and then completed the requests at 10:07 a.m.

Donaldson's website captured the user's IP address, 68.32.145.220, which was registered to Comcast. When Wilson contacted Comcast and asked for subscriber information associated with that address — so that he could identify the person who made the unauthorized changes — Comcast declined to respond without a subpoena.

On September 7, 2004, a subpoena duces tecum issued by the Lower Township Municipal Court was served on Comcast. The subpoena sought "[a]ny and all information pertaining to IP Address information belonging to IP address: 68.32.145.220, which occurred on 08/24/04 between 8:00 a.m. and 11:00 a.m. EST." The subpoena was captioned "Timothy C. Wilson, Plaintiff, vs. Shirley Reed [sic], Defendant," although no such case was pending.

Comcast responded on September 16, 2004 and identified Reid as the subscriber of the IP address. In addition, Comcast provided the following information: Reid's address, telephone number, type of service provided, IP assignment (dynamic), account number, e-mail address, and method of payment.

An arrest warrant was issued on September 29, 2004, and Reid was arrested ten days later. On February 22, 2005, the Cape May County Grand Jury returned an indictment charging Reid with second-degree computer theft, in violation of N.J.S.A. 2C:20-25(b).

Reid moved to suppress the evidence obtained via the municipal court subpoena. On September 22, 2005, the trial court granted Reid's motion. The court identified various flaws with the municipal court subpoena and noted that the procedure followed by the police was "unauthorized in its entirety." The court also concluded that Reid had an expectation of privacy in her Internet subscriber information on file with Comcast. Therefore, the trial court held that the subpoena violated Reid's "right to be free from unreasonable searches and seizures" and was unconstitutional.

...