Re: ECPA case

[Dean Anderson <dean@...]

This is interesting, and affords yet another look at Sobol and Dregers
claim about 18 USC 2701(c)(1).  And notice that it also shows the ECPA
does apply to ISP's. (I guess thats a clear ISP precendent, Sobol).

I was looking for information related to worldcom, strangely enough.
Anyway, I came across a case called "Jessup-Morgan v. AOL", in which an
AOL user (Jessup) conducts abuse against another AOL user (Smith). Smiths
attorney obtained a civil subpoena to get the identity of the user
(Jessup) from AOL.

Jessup then sued AOL on several issues, and lost.  However, one of the
issues raised by Jessup was a claim that AOL violated the ECPA by
divulging her identify.  However, the judge noted that 18 USC
2703(C)(1)(A) permits providers to disclose the identify (but not the
contents of a communication) of any user to anyone _other_ than a
governmental entity.

Besides demonstrating that Sobol and Dreger are wrong (ECPA applies, and
AOL was not protected by (c)(1), as they argued previously), (and they
_still_ won't admit they were wrong, I suppose), it taught me something
too:  it appears (and I say _appears_, so don't run out and start doing
this just yet) that it doesn't require a subpoena to get or give this
information.

This could potentially be a windfall for abuse tracking. If there isn't a
restriction on identification, then we could setup a database of people
kicked off of ISP's for abuse, using the identifying information given
(name, address, phone number) On the other hand, no ISP I know of
presently would consider giving out this kind of information without a
subpoena, so there very likely are other statutes that govern, not to
mention it might be risky if you terminate a customer wrongly, and put
their name in this database.  Some consumer protection laws vaguely come
to mind, that govern divulging personal information.  Just because the
ECPA doesn't prohibit it, doesn't mean that something else doesn't.
There have been some consumer protection and privacy laws passed since the
Jessup case in 1998. And there are a slew of state privacy laws that could
apply.

Don't get too exited.  I've forwarded the case to our attorneys for
comment, and I'll pass it by some people I know at Harvard and Columbia.
Its worth looking into.

		--Dean