Are Privacy Laws Good or Bad for ISPs?

The ECPA defines ISPs' rights and obligations concerning privacy issues, the Internet, the Web, and other electronic communications. We provide an overview.

by Patricia Fusco ISP-Planet Managing Editor [March 17, 2000]

[ed. note: The author, Patricia Fusco, is a journalist, not a lawyer, and this article does not constitute legal advice. It is news. Obtain the advice of a qualified lawyer before acting on information in this article. Also see a similar disclaimer on one lawyer's site.]

Many layers of law watch over ISPs.

First, there are the lawmakers at federal, state and local levels that have addressed consumer choice of carriers, online privacy, children's, rural and inner-city Web access, pornography, spam, and e-taxes.

Next is a collection of regulators at federal, state and local levels. This group includes the Federal Communications Commission, Federal Trade Commission, state better business bureaus, and state or local public utility commissioners. These regulatory agencies deal with many important issues including tariffs, spectrum and cable licensing, mergers and acquisitions, Internet stock fraud, and consumer complaints.

Third are the enforcers in federal, state and local courtrooms. Enforcers include judges appointed or elected to local, district, state, federal, appellate, circuit and supreme courts, as well as state attorney generals, local and state police agencies, the Federal Bureau of Investigation and the Justice Department.

So what are your rights, as an Internet Service Provider, when an agent comes knocking on your door demanding a user's real name or access to a user's private e-mail?

According to San Francisco-based Attorney Jennifer S. Granick, the Electronic Communications Privacy Act of 1986 (18 USC 2510, 2710 et seq.) governs the general rules that apply to an ISP's rights and responsibilities concerning the interception of electronic communications.

The ECPA began as an "anti-wiretapping" act to combat eavesdropping excesses that came to light in the late 1960s during the Watergate scandal. In its original form, the federal statute prohibited government eavesdropping on telephone discussions without consent from those involved in the conversation.

The act required government agents to procure a warrant before they could intercept discussions. Congress eventually increased the scope of the anti-wiretapping laws to deal with all forms of digital communications, including transmissions of text and digitized images, in addition to voice communications on the telephone.

Granick said the law now prohibits unauthorized eavesdropping by all persons and businesses, not only the government.

In terms of obtaining information from an ISP, Christian Genetski, Department of Justice (DOJ) Computer Criminal and Intellectual Property Section trial attorney, said it's important that an ISP understand its obligation to comply with the ECPA.

A government agent must obtain a warrant in order to read an e-mail message that is unopened or stored for less 180-days in an online system. If a message has been opened or stored for more than 180 days, the agent must obtain an administrative subpoena, rather than court order, to view data.

In essence, the ECPA prohibits unauthorized access to messages in storage on a computer system, and unauthorized interception of messages in transmission. But Genetski said it's a very complicated law and ISPs need to understand that there are limits to what information they can voluntarily disclose to law enforcement officials.

Go to page 2