Civil Liability and the Wiretap Act: Online Service Intercepts and Stores Emails Without Authorization

The Court of Appeals for the Sixth Circuit held that a web-based service and software provider, defendant Awareness, may violate portions of the Federal Wiretap Act, 18 U.S.C. § 2511 and 2512(1)(b) by actively manufacturing, marketing, and selling a “device,” when Awareness provides software and online data storage and retrieval services which surreptitiously intercepts, without the authorization of the plaintiff-communicating party, plaintiffs’ emails, instant messages, and other communications.  Luis v Zang, Case No. 14-3601 (6th Cir. Aug. 16, 2016) (Available Here).  The lower district court had dismissed Awareness as a party defendant, but the Sixth Circuit reversed that dismissal, when plaintiff’s complaint asserted that Awareness intentionally intercepted Luis’s electronic communications, in violation of 18 U.S.C. § 2511 (part of the federal Wiretap Act). The complaint further alleged that Awareness violated 18 U.S.C. § 2512 (another part of the federal Wiretap Act) by manufacturing, marketing, selling, and operating a device that Awareness knew or had reason to know was to be used primarily for the surreptitious interception of electronic communications.  The Sixth Circuit held that Awareness may be subject to a private suit under § 2520.  “We today hold that a defendant such as Awareness – which allegedly violates § 2512(1)(b) by manufacturing, marketing, and selling a violative device – is subject to a private suit under § 2520 only when that defendant also plays an active role in the use of the relevant device to intercept, disclose, or intentionally use a plaintiff’s electronic communications.”

Awareness is the manufacturer of Web Watcher software which surreptitiously intercepts emails, instant messages, and other communications.  The complaint asserts that Awareness intentionally intercepted Juan Luis’s electronic communications, in violation of the Wiretap Act. Javier Luis (“Luis”), a resident of Florida, developed an online personal relationship with Ohio resident Catherine Zang (“Catherine”).  Catherine’s husband secretly install a product known as WebWatcher on the computer used by Catherine.  Awareness Technologies, Inc., surreptitiously intercepted the emails, instant messages, and other communications. Luis filed suit against Joseph Zang (“Joseph”) and Awareness.  

The WebWatcher program contemporaneously forwards the intercepted communications (emails, instant messages, etc.) to servers maintained by Awareness in California, where the communications are stored for later review. A WebWatcher user such as Joseph may then access the servers and peruse copies.  The program allegedly records all PC activity including emails, websites visited, web searches, Facebook/MySpace activity, and anything typed in real time (keyboard sniffer software).

The complaint asserts that Awareness intentionally intercepted Luis’s electronic communications, in violation of 18 U.S.C. § 2511 (part of the federal Wiretap Act). The complaint next alleges that Awareness violated 18 U.S.C. § 2512 (another part of the federal Wiretap Act) by manufacturing, marketing, selling, and operating a device that Awareness knew or had reason to know was to be used primarily for the surreptitious interception of electronic communications. Finally, the complaint asserts that Awareness violated Ohio state law by (1) intercepting and using his electronic communications within the meaning of Ohio’s Wiretap Act, and (2) invading his privacy within the meaning of the common-law tort.  The Federal Wiretap Act provides: “(1) Except as otherwise specifically provided in this chapter[,] any person who(a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication . . . shall be punished [by a fine or by imprisonment.]” 18 U.S.C. § 2511(1)(a).  However, civil action recovery is only permitted under 18 U.S.C. § 2520(a) of the Act.

Awareness asserts that the term “intercept” applies only to situations in which a device captures a communication “either before [the communication] reaches the intended recipient or contemporaneous with the transmission[,] but not after it reaches the destination where it is placed in electronic storage.” It contends that WebWatcher does not satisfy this contemporaneity requirement because the device ostensibly offers only the ability to “record[] various activities that occur” on a computer and then “review [those records] at a later date.”

An “intercept” for purposes of the Wiretap Act is defined as “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” 18 U.S.C. § 2510(4).  Courts interpreting this language have uniformly concluded that an intercept requires contemporaneity. See, e.g., Fraser v. Nationwide Mut. Ins. Co., 352 F.3d 107, 113 (3d Cir. 2003), as amended (Jan. 20, 2004).

Congress then passed the Electronic Communications Privacy Act (ECPA) in 1986, in which the Wiretap Act was amended to cover “electronic communications.” In doing so, Congress drew a distinction between “electronic communications” and “electronic storage.” The former term is defined as “any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system.” 18 U.S.C. § 2510(12). In contrast, “electronic storage” is defined as “(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof,” and “(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.” § 2510(17).  The term “intercept,” as noted above, applies only to electronic communications, not to electronic storage. See § 2510(4).

Section 2512(1)(b) of the Act reads as follows: “Except as otherwise specifically provided in this chapter, any person who intentionally … (b) manufactures, assembles, possesses, or sells any electronic, mechanical, or other device, knowing or having reason to know that the design of such device renders it primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications . . . shall be fined under this title or imprisoned not more than five years, or both.”

First, Luis claims that Awareness is the manufacturer of WebWatcher, a device specifically designed to surreptitiously “intercept[] communications” such as those that were electronically transmitted between Luis and Catherine.  “This leads to the question whether Luis can sue for that violation. Section 2512(1)(b) itself does not allow for such a suit because it provides only that the violator will be ‘fined … or imprisoned.’ Luis’s private cause of action for such a violation thus depends on the proper interpretation of 18 U.S.C. § 2520.”

The Sixth Circuit followed the Eleventh Circuit and other courts that adopted a narrow reading of § 2520.   Per the Appeals Court:

The phrase “engaged in that violation” plainly refers back to the earlier clause defining the “violation” as an “intercept[], disclos[ure], or intentional[] use[].” See 18 U.S.C. § 2520. The earlier clause thus defines the scope of the phrase “engaged in that violation,” with the implication that a court should not read the latter phrase as imposing liability for violations such as simple possession of a wiretapping device. See Treworgy, 373 F.3d at 1127 (“As explained by one district court, as a matter of grammar and sentence structure, the phrase ‘that violation’ refers to the interception, disclosure, or intentional use of communications mentioned earlier in the sentence, and not to the possession of prohibited devices.” (citation, emphasis, and internal quotation marks omitted)).  End of quote from Luis v. Zang, Case No. 14-3601 (6th Cir. Aug. 16, 2016).

The Sixth Circuit held that a defendant such as Awareness – which allegedly violates § 2512(1)(b) by manufacturing, marketing, and selling a violative device – is subject to a private suit under § 2520 only when that defendant also plays an active role in the use of the relevant device to intercept, disclose, or intentionally use a plaintiff’s electronic communications.  “Put differently, the active operation of the device establishes that a defendant who has manufactured, marketed, and sold the device at issue (in violation of§ 2512) has in fact participated in the intercept, disclosure, or use of a plaintiff’s communications to such a degree that the defendant has ‘engaged in’ the underlying violation. Manufacturing, marketing, and selling the device is thus a necessary prerequisite for a civil suit for a violation of § 2512; and, when that prerequisite is combined with the defendant’s active operation of the device at issue, the defendant’s conduct suffices to satisfy the ‘engaged in’ standard of§ 2520.”

Related Posts