From: fergp@sytex.com (Paul Ferguson)
Date: Fri, 2 Jul 93 00:13:18 PDT
To: cypherpunks@toad.com
Subject: The last word? (forwarded article)
Message-ID: <6XL26B1w165w@sytex.com>
MIME-Version: 1.0
Content-Type: text/plain


I took a few minutes (quite a few) and commited this to bidgets. I hope 
you folks take this as seriously as I do.
 
Cheers.

BoardWatch Magazine
July 1993
pages 43 - 46
 
Steve Jackson Games v. US Secret Service
 
by Peter D. Kennedy
 
On March 12, 1993, a federal judge in Austin, Texas decided that
the US Secret Service broke the law when it searched Steve
Jackson Games Inc., and seized its bulletin board system and
other computer equipment. The decision in this case has been
long-awaited in the computer world, and most observers have
hailed it as a significant victory for computer user's freedom
and privacy.
 
I had the fortune to be one of the lawyers representing Steve
Jackson and his co-plaintiffs. During the course of the lawsuit, I
met many people passionately interested in the issues the case
raised. I watched and listened to the discussions and arguments
about the case. I've been impressed by the intelligence of the
on-line world, and the interest that computer enthusiasts show --
especially computer communications enthusiasts -- in the law.
I've also been impressed and distressed at how the Net can
spontaneously generate misinformation. Steve Jackson has spent
untold hours correcting errors about him, his company, and the
case on both the Net and more traditional news media.
 
The decision in the Steve Jackson Games case is clearly a
significant victory for computer users, especially BBS operators
and subscribers. I hope to give a simple and clear explanation
for the intelligent non-lawyer of the legal issues raised by the
case, and the significance and limitations of the court's
decision.
 
The facts.
 
By now, most people interested in the case are familiar with the
basic facts: On March 1, 1990, the Secret Service, in an
early-morning raid, searched the offices of Steve Jackson Games.
The agents kept the employees out of the offices until the
afternoon, and took the company's BBS -- called "Illuminati" --
along with an employee's work computer, other computer equipment,
and hundreds and hundreds of floppy disks. They took all the
recent versions of a soon-to-be-published game book, "GURPS
Cyberpunk," including big parts of the draft which were publicly
available on Illuminati.
 
On March 2, Steve Jackson tried to get copies of the seized files
back from the Secret Service. He was treated badly, and given
only a handful of files from one office computer. He was not
allowed to touch the Illuminati computer, or copy any of its
files.
 
Steve Jackson Games took a nosedive, and barely avoided going
out of business. According to Jackson, eight employees lost their
jobs on account of the Secret Service raid, and the company lost
many thousands of dollars in sales. It is again a busy
enterprise, no thanks to the Secret Service (although they tried
to take credit, pointing to the supposedly wonderful publicity
their raid produced.)
 
After months of pestering, including pressure by lawyers and
Senator Lloyd Bentson (now, as Treasury Secretary, the Secret
Service's boss) the Secret Service returned most of the
equipment taken, some of it much the worse for wear.
 
By then, Steve Jackson had restarted Illuminati on a different
computer. When the old Illuminati computer was finally given
back, Jackson turned it one -- and saw that all the electronic
mail which had been on the board on March 1 was gone! Wayne Bell,
WWIV developer and guru, was called in. He gave us invaluable
(and free) help evaluating the condition of the files. He
concluded, and testified firmly at trial, that during the week of
March 20, 1990, when the Secret Service still had Illuminati,
the BBS was run, and every piece of e-mail was individually
accessed and deleted. The Illuminati files the Secret Service had
returned to Steve Jackson left irrefutable electronic traces of
what had been done -- even I could understand how the condition
and dates of the e-mail files showed what had happened, and when.
 
The lawsuit.
 
Suing the federal government and its agents is never a simple
thing. The United States can only be sued when it consents.
Lawsuits against individual agents face big legal hurdles erected
to protect government officials from fear off a tidal wave of
lawsuits.
 
Amazing as it may sound, you cannot sue the United States (or any
federal agency) for money damages for violating your
constitutional rights. You can sue individual federal agents,
though. If you do, you have to get past a defense called
"qualified immunity" which basically means you have to show that
the officials violated "clearly established" constitutional law.
For reasons I can't explain briefly, "qualified immunity" often
creates a vicious circle in civil rights litigation, where the
substance of constitutional law is never established because the
court never has determine the Constitution's scope, only whether
the law was "clearly established" at the time of the violation.
 
The strongest remedies for federal over-stepping are often
statutes which allow direct suit against the United States or
federal agencies (although these are less dramatic than the
Constitution). Fortunately, these statutes were available to
Steve Jackson and the three Illuminati users who joined him in
his suit against the Secret Service.
 
The legal claims.
 
The Steve Jackson Games case was a lot of things to a lot of
people. I saw the case as having two basic goals: (1) to redress
the suppression of the public expression embodied in Steve
Jackson's publications (including his publication via BBS) and
thereby compensate the company for the damage unnecessarily done
by the raid, and (2) to redress the violation of the privacy of
the BBS users, and the less tangible harm they suffered.
 
The individual government agents involved in the raid were sued
for constitutional violations -- the First and Fourth Amendments.
The Secret Service was sued under two important laws which embody
the same principles as the First and Fourth Amendments -- the
Privacy Protection Act of 1980 and provisions of the Electronic
Communications Privacy Act of 1986. There were other claims, but
these were the core.
 
After the case was pending a year and a half and all discovery
completed, the government moved to have thee claims dismissed,
claiming qualified immunity. This motion (usually brought early
in a case) guaranteed that the trail would be delayed by over a
year, because even if the government lost its motion, the
individuals could immediately appeal. In December, 1992, the
tactical decision was made to drop those claims, rather than
suffer the delay, and proceed promptly to trail on the claims
against the Secret Service itself.
 
The Privacy Protection Act of 1980.
 
In the late 1970's the Stanford Daily was subjected to a fishing
expedition by police officers in the Stanford Daily's newsroom.
The police were looking for notes and photos of a demonstration
the newspaper had covered for a story, hoping the newspaper's
files would identify suspects. The Supreme Court held in 1979
that the newspaper had no separate First Amendment right
protecting it from searches and seizures of its reporters notes
and photographs if they were "evidence" of a crime the paper had
covered -- even when the newspaper was not under any suspicion
itself. Congress responded in 1980 with the Privacy Protection
Act, which, until Steve jackson came along, was distinguished
mostly by its lack of interpretation by courts.
 
The Act's wording is rather obtuse, but basically it enacts a
"subpoena only" rule for publishers -- law enforcement officials
are not allowed to search for evidence of crimes in publisher's
offices, or more accurately, they  may not "search for or seize"
publishers' "work product" or "documentary materials",
essentially draft of publications, writer's notes, and such.  To
get such material, the police must subpoena them, not with the
much more disruptive search warrant. Every BBS sysop should read
this act, located at 42 U.S.C. 2000aa in the law books, because I
can't fully explain it here.
 
The Act is quite broad, protecting from searches and seizures
the work product and commentary materials of anyone who has "a
purpose to disseminate to the public a newspaper, book,
broadcast, or other similar form of public communication..." It
also has a big exception -- if the publisher is the person
suspected in the criminal investigation.
 
The Electronic Communications Privacy Act.
 
Two provisions of the Electronic Communications Privacy Act (or
ECPA) were paramount in the suit. The plaintiffs claimed the
Secret Service violated two provisions -- one prohibiting
unjustified "disclosure and use" of e-mail (18 U.S.C. 2703; the
other prohibiting "interception" of e-mail (18 U.S.C. 22511(1)).
 
The parties' positions were fairly simple, and laid out well
before trail. As for the Privacy Protection Act, Steve Jackson
claimed that his company's publication, both in book form and on
Illuminati, were obviously "work product" protected by the Act,
and the government had no right to seize them, and therefore owed
him money for the damages the raid caused his business. The
government replied claiming that (1) Steve Jackson Games'
products are not the type of publications protected by the PPA;
and anyway, (2) the Secret Service didn't know that Steve Jackson
Games was a publisher when it raided its offices; and even then,
(3) the Secret Service didn't mean to take the books, the books
just came along when the computers and disks were taken.
 
As for the e-mail, Steve Jackson and the other BBS users claimed
that the seizure, disclosure, and deletion of the e-mail was both
an unlawful "disclosure and use," and an "interception" of
electronic communications in violation of the ECPA. The Secret
Service replied that (1) there was no "interception" because the
e-mail was just sitting there on the hard drive, not moving; and
(2) the Secret Service didn't read the mail, but if it did, it
was acting on good faith, because it had a search warrant
authorizing it so seize Steve Jackson Games' "computers" and read
their contents.
 
The trial.
 
When the individual defendants were dropped, the case quickly
went to trail. The plaintiffs opened their case on January 29,
1993. The trail took the better part of four days; the witnesses
included now-familiar names: Timothy Foley and Barbara Golden of
the Secret Service, William Cook, formerly of the U.S. Attorney's
office in Chicago, Henry Kluepfel of Bellcore, Steve Jackson and
the BBS users Elizabeth McCoy, Walter Milliken and Steffan
O'Sullivan, and WWIV master Wayne Bell.
 
At trail, Judge Sparks was introduced to the labyrinthine E911
investigation. We also set up and ran Illuminati as it looked on
March 1, 1990, and Steve Jackson walked Judge Sparks through his
BBS, lingering on discussion areas such as "GURPS Old West" to
give the Judge a taste of the scope and breadth of BBS
publication and communications which the Secret Service had shut
down. The judge had appeared upset by the callous and suspicious
manner in which the Secret Service had treated Steve Jackson, and
with the Service's apparent disregard for the effects the raid
might have on the company.
 
The decision.
 
Judge Sparks decided the case in February, 1993, in a long
written opinion. The full text of the opinion is available on
the Internet at ftp.eff.org, and on Illuminati itself
(512-447-7866). I recommend all sysops and BBS users to read it,
as it is one of the very few legal rulings specifically
addressing bulletin boards and electronic mail.
 
First, the bad news: Judge Sparks accepted the government's
argument that the seizure of the BBS was not an "interception" of
the e-mail, even mail that had not yet been read. Essentially, he
decided that the definition of "interception" implicitly means
"contemporaneously with the transmission"; that is, for there to
be an interception, the government must position itself in the
data stream. like a conventional wiretap. Since the e-mail was
temporarily stored on the BBS hard drive, he held there was no
contemporaneous interception.
 
Ruling that there was no interception means two things. First,
the plaintiffs did not receive the $10,000 minimum damages a
violation of the "interception" law provides, even though the
judge found the Secret Service had not acted in good faith. More
importantly, it lowers the standard for seizing BBS e-mail -- and
threatens to lower the standard for the seizure of all electronic
communications which reside long enough in computer memory to be
seized (which is most all computer communications, as far as I
understand it).  To "intercept" wire communications you need a
court order, not just a routine search warrant. This ruling
(which technically only applies in Western District of Texas)
means law enforcement is not limited in its seizure of BBSs by
the higher standards required of wire-tapping.
 
Now, the good news: the plaintiffs won the "disclosure and use"
argument under the ECPA, getting back most of what was lost in
the "interception" decision. First, Judge Sparks found the
obvious: that while the Secret Service had Illuminati they or
their agents read and deleted all the e-mail on Illuminati,
including the plaintiffs' mail -- persons the Secret Service
admittedly having no reason at all to suspect of any illegal
activity.
 
Next, he rejected the Secret Service's argument that its agents
were acting in "good faith." While he didn't list all the
reasons, quite a few are supported by the evidence: the Secret
Service's investigation was "sloppy", he said, and there was no
attempt to find out what Steve Jackson Games did as a business;
the Secret Service was told the day of the raid that the company
was a "publisher," and refused to make copies or return files for
months after they were done reviewing them; and the Secret
Service apparently allowed the private mail of dozens of entirely
innocent and unsuspecting people to be read and trashed.
 
The judge ruled that Steve Jackson, his company, and the three
Illuminati users who joined Jackson in the suit were each
entitled to an $1,000 award from the government, as provided by
the ECPA.
 
The Privacy Protection Act was pretty much a clean sweep. While
the judge and Steve Jackson still differ over how much money the
raid cost the company, the court's ruling was squarely in
Jackson's favor on the law. Although unconventional, the court
found that Steve Jackson Games' publications were clearly
covered by the Act, should not have been seized, and should have
been promptly returned. At trail, the Secret Service agents had
freely admitted they knew nothing about the Act. Former U.S.
Attorney William Cook claimed he knew about it before the raid,
but decided (without any investigation) that Steve Jackson Games
wasn't covered. The Privacy Protection Act (unlike the ECPA)
allows no "good faith" excuses, anyway, and since the Secret
Service was repeatedly told on March 1 and afterwards that the
company was a publishing business there was no defense for the
seizure of "GURPS Cyberpunk" or the other book drafts. Most of
the over $50,000 awarded in damages was due to the violation of
the Privacy Protection Act.
 
Steve Jackson Games publishes traditional books and magazines,
with printed paper pages. Is the BBS operator who publishes only
on-line articles protected, too? It's a question Judge Sparks did
not need to address directly, but his opinion can and should be
read to include the on-line publisher. The court's opinion
includes the BBS files as material improperly seized, and the Act
specifically includes work product in electronic form. Publishing
via BBSs has become just like publishing a "newspaper, book, or
other form of publication..." -- the only source of news many
people get.
 
If the Privacy Protection Act is broadly understood to encompass
electronic publishing (as it should) it should provide
meaningful protection to innocent sysops whose boards may be
used by some for illegal purposes. It should prevent the
"preventative detention" of BBSs -- where boards are seized in
investigations and held indefinitely -- which seems to be one
crude means used to attack suspected criminal activity without
bothering to actually prosecute a case. It should also force law
enforcement to consider who the actual suspect is -- for
instance, in the recent spate of seizures of BBSs for suspected
copyright violations. The Privacy Protection Act should prevent
law enforcement from seizing a sysop's board who is not suspect
in engaging or condoning illegal activity.
 
Those of you who have followed this case will note how little
significance I've given to the "Phrack" investigation and the
overvaluation of the E911 document. Of course the Secret Service
misunderstood or exaggerated the importance of the purloined E911
document, and were chasing imaginary goblins.
 
The real significance of the Steve Jackson Games case, however,
was not knocking holes in that one investigation (the Neidorf
trail effectively did that), but taking a solid step to set firm,
discernible limits for criminal investigations involving computer
communication. To focus on the specific foibles of the E911
investigation is to miss the importance of what the Secret
Service really did wrong. Out of ignorance or callousness, they
ignored the legal rights of people not even suspected of crimes;
people who simple shared common electronic space. There are and
will continue to be legitimate computer-crime investigations. The
closeness that people live in Cyberspace, though, means the
government must learn ways to conduct investigations without
violating the rights of all the innocent members of the on-line
community. In March 1990, the Privacy Protection Act said that
Steve Jackson could write and publish his books without having
them seized; the Secret Service didn't know that. In 1990, the
Illuminati users had the right not to have their e-mail seized
and read without at least being suspected of a crime; the Secret
Service apparently didn't know that, either. Now they do, and
hopefully the word will spread to other government agencies,
too.
 
(As of this writing, there is still no decision whether the
Secret Service (or Steve Jackson, for that matter) will appeal
Judge Spark's decision.)
 
[Peter D. Kennedy is an associate with the Austin, Texas law firm
of George, Donaldson & Ford, specializing in civil litigation.
George, Donaldson & Ford represents national media, technology
and other corporate and individual clients in a variety of civil
litigation, including libel and invasion of privacy defense,
constitutional law, intellectual property, commercial and
employment litigation. George, Donaldson & Ford, 114 W. 7th
Street, Suite 100, Austin, Texas 787001; (512) 495-1400 voice;
(512) 499-0094 fax; E-mail: gdf.well.sf.ca.us]
 

Paul Ferguson               |  "Confidence is the feeling you get
Network Integrator          |   just before you fully understand
Centreville, Virginia USA   |   the problem."
fergp@sytex.com             |      - Murphy's 7th Law of Computing
 
               Quis Custodiet Ipsos Custodes?