Case o' The Week: Finding Forrester, Fourth Doesn't Protect IP Addresses

Consider as you read this blog that the fact that you visited this IP address isn't protected by the Fourth Amendment -- so says the Ninth in a disappointing cyber law decision. United States v. Forrester, __ F.3d __, Slip. Op. 8069 (9th Cir. July 6, 2007), decision available here. Forrester is another illustration of how bad analogies between old and new technologies are creating a new line of bad Fourth Amendment law.

Players: Judge Fisher authors, bull-dog Ben Coleman and defense counsel Mike Crowley behind yet another creative defense challenge.

Facts: During an Ecstasy investigation, the government received court permission to install a “pen register analogue” on co-defendant Alba’s computer. Slip Op. at 8075. The gadget (or software) captured the “to/from addresses of Alba’s e-mail messages, the IP addresses of the websites that Alba visited and the total volume of information sent to or from his account.” Id. at 8075. This information was used in later search warrant applications. Id. at 8088-89. After a trial, Alba and Forrester were convicted and both got 30 years custody. Id. at 8076.

Issue(s): “Alba contends that the government’s surveillance of his e-mail and Internet activity violated the Fourth Amendment and fell outside the scope of the then-applicable federal pen register statute.” Id. at 8081.

Held: “We hold that the surveillance did not constitute a Fourth Amendment search and thus was not unconstitutional. We also hold that whether or not the computer surveillance was then covered by the then-applicable pen register statute – an issue that we do not decide – Alba is not entitled to the suppression of any evidence (let alone reversals of his convictions) as a consequence.” Id. at 8082.

Of Note: The Ninth is slowly building a body of computer Fourth Amendment law. Ironically (for the Circuit home of Silicon Valley) much of this law is wrong. Here, Judge Fisher analogizes the capture of e-mail addresses, IP addresses of websites visited, and the volume of information transmitted, to old pen register searches (which do not implicate the Fourth because pen registers don’t reveal content). Id. at 8082, 8084. This analogy doesn’t work. For example, call my office from a phone and a pen register would catch you dialing my number – but the feds would have no clue about the content of our discussion. Visit IP address 206.252.132.24, however, and the content viewed in your visit is obvious – any trip to HighTimes.com is a drug trip (pun intended). If you download lots of pages from this IP address (by clinking links), then you’re really interested in 420.

Another way to think about IP addresses is to consider their evidentiary ramifications. It’s a safe bet that the Ninth would allow the content of a web page detected from an IP address as support for probable cause for a search warrant. This inevitable use of IP addresses illustrates that the technology captures far more than mere phone register data. No matter how you slice it, IP addresses aren’t just phone numbers – they are content rich, and are a far cry from simple pen register data. Stanford Cyberlaw Clinic, wake up – here’s a great case for an en banc amicus effort.

How to Use: Thankfully, Forrester doesn’t decide several other digital Fourth abominations: the capture of URL pages, id. at 8084 n.6, or imaging and keystroke captures, id. at 8086. If your case involves computer or internet seizures, hire a consultant-geek. This is an area of evolving (and erroneous) Fourth Amendment law, and simply relying on our understandings of old technologies perpetuates errors the government exploits, and the Ninth adopts.

For Further Reading: This decision quickly caught the attention of the press. See SF Chronicle article here. Combine the fact that the Fourth now doesn’t protect IP addresses, with the feds’ new ISP data retention policies, and we can kiss our privacy rights goodbye. See article here. How is a normal citizen supposed to protect their Fourth Amendment privacy rights in an internet age? Forget the constitution – pony up for a proxy server. See Proxify website here.


Steven Kalar, Senior Litigator N.D. Cal. FPD. Website available at www.ndcalfprd.org


.