NJ SUPREME COURT SAYS SUBPOENA NEEDED FOR INTERNET RECORDS
The New Jersey Supreme Court has given a huge victory to Internet privacy advocates by ruling that the Government needs a valid subpoena before it can get private user information from an Internet Service Provider (“ISP”). The case was, State of New Jersey v. Shirley Reid (A-105-06), and was argued October 22, 2007 and decided April 21, 2008. The case came up on appeal and was argued as an amicus brief with the help of the American Civil Liberties Union, Electronic Frontier Foundation and the Electronic Privacy Information Center, among other groups that filed friend-of-the-court briefs in the controversy. The victors claim it is the first ruling in the U.S. to recognize a “reasonable expectation of privacy for Internet users.”
The case dealt with a business named Jersey Diesel, whose owner became convinced that an unauthorized Internet user had come in and changed the company's website. The owner, Timothy Wilson, found out the mystery user was registered to Comcast. Wilson contacted Comcast and asked for the subscriber information so that he could discover who made the unauthorized changes. But Comcast refused to help without a subpoena. Wilson then reported the incident to the Lower Township Police Department and suggested claimed that Ms. Shirley Reid, a Jersey Diesel employee on disability leave might have made the changes. Reid had come back to work, argued with Wilson, then left. Wilson claimed Reid was the only employee who knew the company's computer password and ID.
Police did obtain the information on who accessed the website, which was the same woman Wilson suspected. They got her identity through her Internet provider, Comcast Corp., by tracing the Internet “fingerprint” that her computer left behind. This fingerprint consists of the Internet protocol address, also known as an IP address, identifiable only by Comcast. While the police obtained a subpoena for the data from a local court, the higher courts ruled a grand jury subpoena was necessary given an indictable offense was claimed. The fight for the ID then moved through the NJ court system.
The court ruled Police need a criminal grand jury subpoena for such information, claiming the woman's 2005 charge for theft by computer would not stand unless prosecutors had enough proof without the evidence. But the evidence from Comcast was suppressed without a subpoena.
The New Jersey Supreme Court based their decision on the fact that the NJ state constitution affords greater protection against unreasonable searches and seizures than the U.S. Constitution, and that Internet providers should therefore not disclose private information to any entity without a subpoena.
Grayson Barber, a lawyer representing the American Civil Liberties Union, Electronic Frontier Foundation and the Electronic Privacy Information Center said it was the first ruling in the nation to find a genuine and defensible expectation of privacy for Internet users. Barber said, "The reality is that people do expect a measure of privacy when they use the Internet."
As to the privacy issue, the court said:
“Both the Fourth Amendment to the United States Constitution and Article I, Paragraph 7, of the New Jersey Constitution protect the right of the people to be secure against unreasonable searches and seizures. Federal case law interpreting the Fourth Amendment has found no expectation of privacy in Internet subscriber information. On multiple occasions, however, this Court has held that the New Jersey Constitution affords greater protection than the Fourth Amendment.
It is well-settled under New Jersey law that disclosure to a third-party provider, as an essential step to obtaining service altogether, does not upend the privacy interest at stake. In order to access the Web, individuals must obtain an IP address from an ISP. Users make disclosures to ISPs for the limited goal of using the technology and not to promote the release of personal information to others. IP address information can be used to track a person's Internet usage, revealing intimate details about his or her personal affairs. Because current technology renders the user's identity anonymous to all except the ISP, users have reason to expect that their actions are confidential when they surf the Web from the privacy of their homes. Therefore, the Court holds that Article I, Paragraph 7, of the New Jersey Constitution protects an individual's privacy interest in the subscriber information that he or she provides to
an ISP. (Pp. 15—21).”
A Washington lawyer who litigates Internet cases, Megan E. Gray, said the ruling "seems to be consistent with a trend nationwide, but not a strong trend. It's contrary to what is happening with rights of privacy at the federal level. But it's all over the board for the states, with a mild trend toward protecting this information."