ECPA: Enforcement

Go Directly To Jail ?

The right of protection against undue search and seizure is fundamental in the U.S. Constitution. Generally, violations of constitutional rights are not looked upon kindly and the penalties can be severe.

• Penalties: Bad people who illegally intercept communications face
• criminal penalties of up to 5 years in jail, or
• civil damages up to $10,000 per violation.

18 U.S.C. § 2511(4).

• Recovery: Individuals whose communication has been intercepted, disclosed, or intentionally used in violation of law may seek civil relief against any person or entity – but not against the sovereign United States (you may be able to sue the law enforcement officer him or her self, but not the US Government). This relief includes
• Injunctive relief,
• Damages up to $10,000 plus punitive damages, and
• Attorney’s fees.

18 U.S.C. § 2520 (provision sunsets on December 31, 2005). Actions must be initiated within 2 years of the infraction. 18 U.S.C. § 2520(e). US Government officials found to have violated the law can also be subject to administrative discipline. 18 U.S.C. § 2520(f) (provision sunsets on December 31, 2005).

• Recovery: Service providers, subscribers, or other individuals aggrieved by any knowing or intentional violation of the stored communications rules may recover from the person or entity engaged in the violation – but not against the United States (see Suing the Sovereign). This relief includes
• Injunctive relief,
• Damages of $1,000 per violation plus attorney’s fees, and
• Punitive damages for willful or intentional violations.

18 U.S.C. § 2701, 18 U.S.C. § 2707 (provision sunsets on December 31, 2005). US Government officials found to have violated the law can also be subject to administrative discipline. 18 U.S.C. § 2707(d), 18 U.S.C. § 2712(c) (provision sunsets on December 31, 2005). Actions must be initiated within 2 years after the date upon which the claimant first discovered or had a reasonable opportunity to discover the violation. 18 U.S.C. § 2707(f).

• Penalties: Violators of the Pen Register / Trap and Trace provisions may be fined or imprisoned not more than one year. 18 U.S.C. § 3121(d).

Suppression of Evidence

The suppression of evidence remedy under the Wiretap Act is provided pursuant to 18 U.S.C. § 2515

Whenever any wire or oral communication has been intercepted, no part of the contents of such communication and no evidence derived there from may be received in evidence in any trial, hearing, or other proceeding in or before any court, grand jury, department, officer, agency, regulatory body, legislative committee, or other authority of the United States, a State, or a political subdivision thereof if the disclosure of that information would be in violation of this chapter.

One question is whether the remedy of the suppression of evidence is available in instances of violations of ECPA (recall that ECPA specifically deals with the interception of electronic transmission, as opposed to access to stored communications). In the Timothy McVeigh case, the court suppressed the evidence. Other federal circuits have found, however, that the remedy is unavailable, noting that ECPA did not amend Sec. 2515 to cover “electronic communications.” [Steiger] [Jones] [USDOJ Search and Seizure Manual, Sec. III.H.1.] [Smith 1056] [Kennedy 1110] [Hambrick 507] [Charles 21] [Reyes 837-38]

Bad Fruit: Where evidence illicitly gathered may be suppressed, everything that resulted from the discovery of that evidence can be suppressed. This is known as the Bad Fruit Doctrine; if the tree is bad, then so is all the fruit. In the example of Timothy McVeigh, the Navy’s entire case was built upon the initial illegal search of the AOL records. Anything that McVeigh subsequently said in the court room was suppressed as well.

Suing the Sovereign

“Suits against the United States may be brought under 18 U.S.C. § 2712 for willful violations of ECPA, Title III, or specified sections of the Foreign Intelligence Surveillance Act of 1978, 50 U.S.C. § 1801. This section authorizes courts to award actual damages or $10,000, whichever is greater, and reasonable litigation costs. Section 2712 also defines procedures for suits against the United States and a process for staying proceedings when civil litigation would interfere with a related investigation or criminal prosecution. See 18 U.S.C. § 2712(b), (e). Unless extended, § 2712 will sunset on December 31, 2005.” [USDOJ, Search and Seizure Manual, Sec. III.H.2.]

ISP Liability and Immunity

ISPs who rely in good faith upon a court order, warrant, a section 2518(7) emergency certification, or grand jury subpoena are not liable - even where the court order might prove invalid. 18 U.S.C. § 2511(2)(a)(ii), § 2520(d), § 2703(3), & § 2707(e), § 3124(d)&(e). [Davis 1484]

Conversely, ISPs who failed to comply with authorized interceptions or searches may be liable up to $10,000 per day. 18 U.S.C. § 2522; § 3124(d), (e).

Cost Recovery

Service providers are eligible to receive “reimbursement for such costs as are reasonably necessary and which have been directly incurred in searching for, assembling, reproducing, or otherwise providing such information.” 18 U.S.C. § 2706 (stored communications and transactional records). See also 18 U.S.C. § 3124(c) (pen register / trap and trace). For stored communications and transactional records, the service provider and the law enforcement official get to come to mutual agreement as to what that reasonable amount should be. If they can’t, the court issuing the order shall facilitate their coming to mutual agreement.

This provision for cost recover does not apply to common carriers who basically must comply with CALEA.