The content/envelope distinction in Internet law.

• Author: Tokson, Matthew J.

ABSTRACT

Whether a component of an Internet communication is classified as "content" or "envelope" information determines in large part the privacy protection it receives under constitutional and statutory law. Courts and Internet law scholars have yet to offer a means of determining the content/envelope status of unique aspects of Internet communications--from email subject lines to website URLs. As a result, data with the potential to expose every website, every Internet file downloaded, and every email sent by an Internet user may be unprotected under current law.

This Article develops a legal framework for distinguishing content from envelope information in unique areas of Internet communications. Drawing on a practical analysis of the structure of the Internet and an evaluation of relevant common law and Fourth Amendment doctrines, the Article proposes that electronic information that can reveal the underlying text or subject matter of an Internet communication must be classified as content. The Article identifies several areas in which application of this principle is necessary to resolve difficult questions about the legal status of an Internet communication, and gives, for the first time, a comprehensive account of the content status of Internet communications, from email body text to website IP addresses. The proposed framework provides a judicially manageable and normatively attractive means for courts to deter mine the legal status of novel communications technologies, present and future. Ultimately, resolving the content/envelope distinction has the potential to clarify other unanswered and controversial questions in Fourth Amendment and statutory privacy law.

TABLE OF CONTENTS INTRODUCTION I. THE IMPORTANCE OF THE CONTENT/NONCONTENT DISTINCTION IN INTERNET SURVEILLANCE LAW A. The Content/Noncontent Distinction in the Fourth Amendment Law of Internet Communications B. The Content/Noncontent Distinction in the Electronic Communications Privacy Act 1. The Wiretap Act--Interception of Communication Content 2. The Pen Register Act--Interception of Noncontent Communication Attributes 3. The Stored Communications Act--Retrospective Surveillance of Content and Noncontent Information II. CONTENT AND NONCONTENT IN INTERNET COMMUNICATIONS A. The Body of Email Messages B. Email To/From Information C. Subscriber Information D. Email Size and Text Length E. Email Subject Headers III. SEPARATING CONTENT FROM NONCONTENT IN WEB BROWSING COMMUNICATIONS A. Website Text and Other Data Sent to Users; Data Input by Users and Sent to the Web Host B. URLs Containing Search Terms C. URLs 1. What Standard URLs Reveal 2. Analogous Areas of Content/Noncontent Law 3. The Supreme Court's Fourth Amendment "Content" Jurisprudence D. Website IP Addresses E. Size of Information Accessed or Files Downloaded from Websites F. Summary IV. IMPLICATIONS A. Internet Communications in Constitutional Law 1. Subjective Expectations of Internet Users 2. Objective Reasonableness of the Expectations of Internet Users 3. Disclosure to Automated Systems 4. Four General Options for a Court Applying Smith to Internet Communications Content B. Internet Communications in Statutory Law CONCLUSION APPENDIX A. AJAX Programming B. Encrypted URLs C. Website Frames D. A Note on Dynamic URLs INTRODUCTION

The statutory framework governing the surveillance of electronic communications has been in place since 1986, (1) well before the advent of the World Wide Web and the popularization of the Internet. The relevant constitutional framework was established even earlier, in cases such as Katz v. United States (2) and Smith v. Maryland, (3) which applied the Fourth Amendment to government agents' interceptions of telephone conversations and dialed phone numbers. Meanwhile, web browsing and web-based email have been widely available to computer owners since 1995, (4) and a large proportion of U.S. households has had Internet access since 1997. (5) Both computer crimes (such as "hacking") and crimes involving the use of computers have increasingly become a major concern of law enforcement agencies. (6) Yet, after a decade of widespread Internet use and several years of prosecutions using Internet-based evidence within a structure of well-established law, several fundamental questions regarding government surveillance of the Internet remain unanswered. For instance, the Fourth Amendment status of email content remains ambiguous, while the constitutional and statutory status of web surfing data is entirely unresolved.

This continuing uncertainty is largely the product of the unique characteristics of current electronic communications law. First, the difficulty of applying the Supreme Court's current Fourth Amendment precedents to modern communications technologies has likely motivated courts to avoid deciding such issues whenever possible. (7) Second, questions involving electronic communications statutes are infrequently litigated in criminal cases because the relevant statutes do not provide an exclusionary remedy for illegal government acquisitions of electronic data. (8) Yet, as both Internet use and the government's surveillance of such use become more pervasive, courts have finally been forced to grapple with some of the difficult questions surrounding the legal protection afforded to Internet communications. (9)

Perhaps the most practically significant of these unresolved questions is whether novel categories of Internet communications data, such as email subject lines, (10) website Uniform Resource Locators (URLs), (11) and website IP addresses, (12) should be protected as the contents of electronic communications, or whether they should be treated as noncontent "envelope" information. The question is a profoundly important one because the legal protection afforded the two types of information is dramatically different in both constitutional and statutory law. Further, due in large part to the confusion over content status, electronic data with the potential to expose the websites visited and email messages sent by a web user may be unprotected from private or government intrusion under current law. Although Internet law scholars and commentators have mentioned the importance and the troublesome complexity of the issue, (13) none have put forth a theory as to which aspects of a communication are content and which are not under constitutional or statutory law.

Obviously, simply identifying the nature of this complex and unresolved area of law is not enough. This Article attempts to develop a conceptual framework of electronic communications content that will allow courts to determine whether even the most novel forms of Internet communications information are content or noncontent as a matter of law. Part I of the Article describes the central importance of the content/noncontent distinction in the constitutional and statutory law of Internet surveillance. Part II examines the content status of relatively well-understood Internet communications information such as email addresses and Internet subscriber information. Part III discusses the unresolved content status of novel forms of communications information such as web surfing data and develops a framework for classifying such information as content or noncontent. Part IV analyzes the implications of the proposed content/noncontent framework for the constitutional and statutory protection afforded to new forms of Internet communications content. It then describes how a clearer conception of content in such communications will leave courts in a better position to confront other complex questions of Internet surveillance law.

1. THE IMPORTANCE OF THE CONTENT/NONCONTENT DISTINCTION IN INTERNET SURVEILLANCE LAW

   For over one hundred years, the Supreme Court has held that the Fourth Amendment protects mailed letters and packages from inspection by postal authorities or other government agents. (14) Yet from the start, the Court has distinguished between the content of a letter and the noncontent information disclosed on its envelope. Whereas noncontent envelope information is exposed and can be examined by anyone, the content of a letter is "as fully guarded from examination and inspection" as it would be if the party mailing the letter had retained it in his or her own home. (15)

   The content/noncontent distinction remains important in the constitutional and statutory law governing the inspection of private communications, even as new technologies have dramatically altered the nature of communication itself. Of course, one could question the application of the content/noncontent distinction, which was developed in the unique context of paper mail, to new forms of communications such as the telephone and the Internet. Whether as a normative matter the distinction is insufficiently protective of a privacy interest in the circumstances of one's communications is a question for another day. (16) In any event, the distinction is firmly established in communications surveillance law, and any attempt to dislodge it would likely be quixotic. There is, at least, a good argument that the content/noncontent distinction captures a qualitative difference in the intimacy of different types of communications information: while the lonely traveler might consider the fact that he called his wife at midnight from his hotel to be private, surely it is the conversation itself that he considers most intimate and confidential.

   Indeed, the content of telephone calls is protected by the Fourth Amendment, (17) whereas phone numbers (which are exposed to the phone company and involve only noncontent information) are not. (18) Statutorily, interception of the content of a telephone call is governed by the Wiretap Act, (19) which sets rigorous standards for court orders permitting government wiretaps and provides for the exclusion of evidence derived from communications intercepted in violation of the Act. (20) By contrast...