US Sweep Nets Private Email Addresses

Dealing another blow in its fight against WikiLeaks, the US government has obtained secret court orders forcing two companies - Google Inc and California-based Internet provider Sonic.net Inc - to turn over the e-mail contacts of a WikiLeaks volunteer.

The Wall Street Journalreported on Monday that Sonic.net lost its battle with the government and had to turn over the requested records. It's unclear if Google pushed back against the order, although in the past, the company has said that it will only reveal the number of government subpoenas it receives in relation to the disclosure of such information.

Jacob Appelbaum, a US citizen, has been campaigning for the document-sharing organisation for around two years. Applebaum has been the subject of detailed searches upon entering the US from Europe at least twice before.

"It seems that any US citizen who is or has been involved with WikiLeaks must now expect the US government to ride roughshod over their Fourth Amendment rights. The seizure of Jacob Appelbaum's email data is outrageous, but was sadly predictable," said Gus Hosein, executive director of Privacy International, a UK-based privacy advocate group.

"Those who have exchanged emails with him - including members of our own organisation - may well be the subject of similar orders over the next few months, and it is not only Americans who are vulnerable."

A developer for the Tor Project Inc, a nonprofit organisation that provides free tools that help people maintain their anonymity online, Appelbaum (who is also on Privacy International's US advisory board) has a long history of activism, and has been an outspoken supporter of Bradley Manning, the US army private accused of leaking information, such as the controversial Apache Strike video, to WikiLeaks.

In 2010 tech site CNET reported that some of those whose names were on the contact list on Appelbaum's mobile phone have also been targeted by the US government, although many of those investigated on the basis of being in Appelbaum's contact list might never know they were targeted.

The US government has been critical of WikiLeaks since the outfit started leaking sensitive documents on Afghanistan, how the US tacitly sanctioned the use of torture in Iraq, and embarrassing US secret diplomatic dealings with controversial figures such as deposed Tunisian president Zine El Abidine Ben Ali.

The January 4 court order required Google to turn over the IP addresses from which Appelbaum logged into his Gmail account, as well as the IP addresses of those with whom he corresponded as far back as November 1, 2009.

Appelbaum did not repond to requests for an interview.

Constitutionally questionable

Whether the government should be able to have access to a person's private e-mails (and other digital data) is at the centre of a debate which is concerned with defining the legality of a "search" as described under the Fourth Amendment of the US Constitution.

Under the current US code (the Electronic Communications Privacy Act) the government is allowed to demand the records of an electronic service provider, and that it may do so "without required notice to the subscriber".

A 1979 decision by the US Supreme Court holding that phone records are not covered by the Fourth Amendment has been interpreted since to mean that similar electronic records are also unprotected, said Susan Freiwald, a professor of law specialising in surveillance and privacy laws at the University of San Francisco.

"This case illustrates how privacy-invading it is for the government to collect information about where we have been and with whom we have communicated," said Freiwald.

"We need reform of the federal surveillance laws in the United States to provide more protection for such information and to increase the transparency of government investigations."

To say that the legal treatment of electronic communications is merely complicated or vague would be an understatement. There is debate as to whether an e-mail is protected even while temporarily in storage as it makes its way to the recipient, or if it can still be intercepted at that point.

"There are real questions about the constitutionality of such orders, particularly when the government cannot demonstrate probable cause and get a warrant, " said John Verdi, senior counsel at the Electronic Privacy Information Center (EPIC), adding that the US government would question whether a secret order demanding the contents of an individual's contact list constitutes a search at all.

"Because that raises the question of whether or not they need probable cause, whether or not they need a warrant, in order to conduct the search," said Verdi, adding that the government's position is that this is a less intrusive search than a search of the content of e-mails.

However, Verdi said that often times, who a person is corresponding with can be as much - if not more - telling than the contents of any particular e-mail.

"In our view, it's absolutely critical that these searches be held to a Fourth Amendment standard, that they require probable cause standard and that they require independent judicial oversight," said Verdi.

He said that these searches have a place in law enforcement investigations, but that their legitimacy must be dictated by the strictures and boundaries of the constitution.

Uninformed and vulnerable

Appelbaum's privacy is not the only thing that might have been potentially violated in this case, said Freiwald.

"Most importantly, people whose information is exposed should be able to contest whether the exposure was necessary and justified," she said.

"In all but very exceptional cases, they should be given the opportunity to contest disclosure before it happens."

If it seems that the question of whether a US citizen's e-mail contacts fall under Fourth Amendment protection is purely academic, it is not: How the government gets access to such information and what it chooses to do with it can have dire consequences.

"It raises the spectre that individuals on the contact list are going to become wrongful subjects of an additional investigation," said Verdi.

"Those folks did not receive any notice that the government was seeking to access their personal information. They had no opportunity to challenge, in court, the government's access to their information. And they have no way of controlling the uses to which the government is going to put this data after it collects it."

The US Department of Justice did not respond to a query as to whether or not the e-mail addresses of those who are found to have no connections with WikiLeaks will be expunged from government records.

Another rather serious issue is that a number of the people on Appelbaum's contact list might reside outside the US, in countries where abusive law enforcement agencies go unchecked.

"And we don't know what legal standards apply when it comes to interrogating, investigating, and detaining those individuals. Those rules are many, they area varied, and there is a great deal of uncertainty concerning the treatment of suspects in a lot of different countries," said Verdi.

A protracted battle

There have been numerous legal skirmishes over requests of information on individual accounts from telecommunication companies, social networking sites and Internet service provides.

Google, Verizon, Facebook and Twitter are among those who have been hit with subpoenas and orders to hand over user information. In fact, WikiLeaks pushed Google and Facebook to make the content of the US subpoenas public in January, insisting that such requests should be in the public domain.

A secret grand jury in Alexandria, Virginia, has been investigating the possibility of trying WikiLeaks founder Julian Assange on espionage charges since late 2010.

Twitter fought a similar court order to hand over details of the accounts of several WikiLeaks supporters, including Appelbaum, as part of a criminal investigation launched by the Department of Justice into the major leaking of confidential US documents.

At the time, Twitter issued the following statement: "We're not going to comment on specific requests, but, to help users protect their rights, it's our policy to notify users about law enforcement and governmental requests for their information, unless we are prevented by law from doing so."

Twitter has not turned over information from the accounts of the WikiLeaks supporters, although this does not guarantee the security of such data.

"If you use Gmail, Facebook, Twitter or any other US company, your personal information and communications may be seized by American government officials, wherever you are in the world and whatever your citizenship," said Privacy International's Gus Hosein.

As for Sonic.net, it's unclear as to whether or not the request for Appelbaum's contacts was the first or last request the California-based company has received, or if it plans on fighting future requests.

In response to requests for an interview, the company's CEO Dane Jasper simply said that he could not comment as the case was "under seal", meaning that records relating to it must be kept secret.