I took a few minutes (quite a few) and commited this to bidgets. I hope you folks take this as seriously as I do. Cheers. BoardWatch Magazine July 1993 pages 43 - 46 Steve Jackson Games v. US Secret Service by Peter D. Kennedy On March 12, 1993, a federal judge in Austin, Texas decided that the US Secret Service broke the law when it searched Steve Jackson Games Inc., and seized its bulletin board system and other computer equipment. The decision in this case has been long-awaited in the computer world, and most observers have hailed it as a significant victory for computer user's freedom and privacy. I had the fortune to be one of the lawyers representing Steve Jackson and his co-plaintiffs. During the course of the lawsuit, I met many people passionately interested in the issues the case raised. I watched and listened to the discussions and arguments about the case. I've been impressed by the intelligence of the on-line world, and the interest that computer enthusiasts show -- especially computer communications enthusiasts -- in the law. I've also been impressed and distressed at how the Net can spontaneously generate misinformation. Steve Jackson has spent untold hours correcting errors about him, his company, and the case on both the Net and more traditional news media. The decision in the Steve Jackson Games case is clearly a significant victory for computer users, especially BBS operators and subscribers. I hope to give a simple and clear explanation for the intelligent non-lawyer of the legal issues raised by the case, and the significance and limitations of the court's decision. The facts. By now, most people interested in the case are familiar with the basic facts: On March 1, 1990, the Secret Service, in an early-morning raid, searched the offices of Steve Jackson Games. The agents kept the employees out of the offices until the afternoon, and took the company's BBS -- called "Illuminati" -- along with an employee's work computer, other computer equipment, and hundreds and hundreds of floppy disks. They took all the recent versions of a soon-to-be-published game book, "GURPS Cyberpunk," including big parts of the draft which were publicly available on Illuminati. On March 2, Steve Jackson tried to get copies of the seized files back from the Secret Service. He was treated badly, and given only a handful of files from one office computer. He was not allowed to touch the Illuminati computer, or copy any of its files. Steve Jackson Games took a nosedive, and barely avoided going out of business. According to Jackson, eight employees lost their jobs on account of the Secret Service raid, and the company lost many thousands of dollars in sales. It is again a busy enterprise, no thanks to the Secret Service (although they tried to take credit, pointing to the supposedly wonderful publicity their raid produced.) After months of pestering, including pressure by lawyers and Senator Lloyd Bentson (now, as Treasury Secretary, the Secret Service's boss) the Secret Service returned most of the equipment taken, some of it much the worse for wear. By then, Steve Jackson had restarted Illuminati on a different computer. When the old Illuminati computer was finally given back, Jackson turned it one -- and saw that all the electronic mail which had been on the board on March 1 was gone! Wayne Bell, WWIV developer and guru, was called in. He gave us invaluable (and free) help evaluating the condition of the files. He concluded, and testified firmly at trial, that during the week of March 20, 1990, when the Secret Service still had Illuminati, the BBS was run, and every piece of e-mail was individually accessed and deleted. The Illuminati files the Secret Service had returned to Steve Jackson left irrefutable electronic traces of what had been done -- even I could understand how the condition and dates of the e-mail files showed what had happened, and when. The lawsuit. Suing the federal government and its agents is never a simple thing. The United States can only be sued when it consents. Lawsuits against individual agents face big legal hurdles erected to protect government officials from fear off a tidal wave of lawsuits. Amazing as it may sound, you cannot sue the United States (or any federal agency) for money damages for violating your constitutional rights. You can sue individual federal agents, though. If you do, you have to get past a defense called "qualified immunity" which basically means you have to show that the officials violated "clearly established" constitutional law. For reasons I can't explain briefly, "qualified immunity" often creates a vicious circle in civil rights litigation, where the substance of constitutional law is never established because the court never has determine the Constitution's scope, only whether the law was "clearly established" at the time of the violation. The strongest remedies for federal over-stepping are often statutes which allow direct suit against the United States or federal agencies (although these are less dramatic than the Constitution). Fortunately, these statutes were available to Steve Jackson and the three Illuminati users who joined him in his suit against the Secret Service. The legal claims. The Steve Jackson Games case was a lot of things to a lot of people. I saw the case as having two basic goals: (1) to redress the suppression of the public expression embodied in Steve Jackson's publications (including his publication via BBS) and thereby compensate the company for the damage unnecessarily done by the raid, and (2) to redress the violation of the privacy of the BBS users, and the less tangible harm they suffered. The individual government agents involved in the raid were sued for constitutional violations -- the First and Fourth Amendments. The Secret Service was sued under two important laws which embody the same principles as the First and Fourth Amendments -- the Privacy Protection Act of 1980 and provisions of the Electronic Communications Privacy Act of 1986. There were other claims, but these were the core. After the case was pending a year and a half and all discovery completed, the government moved to have thee claims dismissed, claiming qualified immunity. This motion (usually brought early in a case) guaranteed that the trail would be delayed by over a year, because even if the government lost its motion, the individuals could immediately appeal. In December, 1992, the tactical decision was made to drop those claims, rather than suffer the delay, and proceed promptly to trail on the claims against the Secret Service itself. The Privacy Protection Act of 1980. In the late 1970's the Stanford Daily was subjected to a fishing expedition by police officers in the Stanford Daily's newsroom. The police were looking for notes and photos of a demonstration the newspaper had covered for a story, hoping the newspaper's files would identify suspects. The Supreme Court held in 1979 that the newspaper had no separate First Amendment right protecting it from searches and seizures of its reporters notes and photographs if they were "evidence" of a crime the paper had covered -- even when the newspaper was not under any suspicion itself. Congress responded in 1980 with the Privacy Protection Act, which, until Steve jackson came along, was distinguished mostly by its lack of interpretation by courts. The Act's wording is rather obtuse, but basically it enacts a "subpoena only" rule for publishers -- law enforcement officials are not allowed to search for evidence of crimes in publisher's offices, or more accurately, they may not "search for or seize" publishers' "work product" or "documentary materials", essentially draft of publications, writer's notes, and such. To get such material, the police must subpoena them, not with the much more disruptive search warrant. Every BBS sysop should read this act, located at 42 U.S.C. 2000aa in the law books, because I can't fully explain it here. The Act is quite broad, protecting from searches and seizures the work product and commentary materials of anyone who has "a purpose to disseminate to the public a newspaper, book, broadcast, or other similar form of public communication..." It also has a big exception -- if the publisher is the person suspected in the criminal investigation. The Electronic Communications Privacy Act. Two provisions of the Electronic Communications Privacy Act (or ECPA) were paramount in the suit. The plaintiffs claimed the Secret Service violated two provisions -- one prohibiting unjustified "disclosure and use" of e-mail (18 U.S.C. 2703; the other prohibiting "interception" of e-mail (18 U.S.C. 22511(1)). The parties' positions were fairly simple, and laid out well before trail. As for the Privacy Protection Act, Steve Jackson claimed that his company's publication, both in book form and on Illuminati, were obviously "work product" protected by the Act, and the government had no right to seize them, and therefore owed him money for the damages the raid caused his business. The government replied claiming that (1) Steve Jackson Games' products are not the type of publications protected by the PPA; and anyway, (2) the Secret Service didn't know that Steve Jackson Games was a publisher when it raided its offices; and even then, (3) the Secret Service didn't mean to take the books, the books just came along when the computers and disks were taken. As for the e-mail, Steve Jackson and the other BBS users claimed that the seizure, disclosure, and deletion of the e-mail was both an unlawful "disclosure and use," and an "interception" of electronic communications in violation of the ECPA. The Secret Service replied that (1) there was no "interception" because the e-mail was just sitting there on the hard drive, not moving; and (2) the Secret Service didn't read the mail, but if it did, it was acting on good faith, because it had a search warrant authorizing it so seize Steve Jackson Games' "computers" and read their contents. The trial. When the individual defendants were dropped, the case quickly went to trail. The plaintiffs opened their case on January 29, 1993. The trail took the better part of four days; the witnesses included now-familiar names: Timothy Foley and Barbara Golden of the Secret Service, William Cook, formerly of the U.S. Attorney's office in Chicago, Henry Kluepfel of Bellcore, Steve Jackson and the BBS users Elizabeth McCoy, Walter Milliken and Steffan O'Sullivan, and WWIV master Wayne Bell. At trail, Judge Sparks was introduced to the labyrinthine E911 investigation. We also set up and ran Illuminati as it looked on March 1, 1990, and Steve Jackson walked Judge Sparks through his BBS, lingering on discussion areas such as "GURPS Old West" to give the Judge a taste of the scope and breadth of BBS publication and communications which the Secret Service had shut down. The judge had appeared upset by the callous and suspicious manner in which the Secret Service had treated Steve Jackson, and with the Service's apparent disregard for the effects the raid might have on the company. The decision. Judge Sparks decided the case in February, 1993, in a long written opinion. The full text of the opinion is available on the Internet at ftp.eff.org, and on Illuminati itself (512-447-7866). I recommend all sysops and BBS users to read it, as it is one of the very few legal rulings specifically addressing bulletin boards and electronic mail. First, the bad news: Judge Sparks accepted the government's argument that the seizure of the BBS was not an "interception" of the e-mail, even mail that had not yet been read. Essentially, he decided that the definition of "interception" implicitly means "contemporaneously with the transmission"; that is, for there to be an interception, the government must position itself in the data stream. like a conventional wiretap. Since the e-mail was temporarily stored on the BBS hard drive, he held there was no contemporaneous interception. Ruling that there was no interception means two things. First, the plaintiffs did not receive the $10,000 minimum damages a violation of the "interception" law provides, even though the judge found the Secret Service had not acted in good faith. More importantly, it lowers the standard for seizing BBS e-mail -- and threatens to lower the standard for the seizure of all electronic communications which reside long enough in computer memory to be seized (which is most all computer communications, as far as I understand it). To "intercept" wire communications you need a court order, not just a routine search warrant. This ruling (which technically only applies in Western District of Texas) means law enforcement is not limited in its seizure of BBSs by the higher standards required of wire-tapping. Now, the good news: the plaintiffs won the "disclosure and use" argument under the ECPA, getting back most of what was lost in the "interception" decision. First, Judge Sparks found the obvious: that while the Secret Service had Illuminati they or their agents read and deleted all the e-mail on Illuminati, including the plaintiffs' mail -- persons the Secret Service admittedly having no reason at all to suspect of any illegal activity. Next, he rejected the Secret Service's argument that its agents were acting in "good faith." While he didn't list all the reasons, quite a few are supported by the evidence: the Secret Service's investigation was "sloppy", he said, and there was no attempt to find out what Steve Jackson Games did as a business; the Secret Service was told the day of the raid that the company was a "publisher," and refused to make copies or return files for months after they were done reviewing them; and the Secret Service apparently allowed the private mail of dozens of entirely innocent and unsuspecting people to be read and trashed. The judge ruled that Steve Jackson, his company, and the three Illuminati users who joined Jackson in the suit were each entitled to an $1,000 award from the government, as provided by the ECPA. The Privacy Protection Act was pretty much a clean sweep. While the judge and Steve Jackson still differ over how much money the raid cost the company, the court's ruling was squarely in Jackson's favor on the law. Although unconventional, the court found that Steve Jackson Games' publications were clearly covered by the Act, should not have been seized, and should have been promptly returned. At trail, the Secret Service agents had freely admitted they knew nothing about the Act. Former U.S. Attorney William Cook claimed he knew about it before the raid, but decided (without any investigation) that Steve Jackson Games wasn't covered. The Privacy Protection Act (unlike the ECPA) allows no "good faith" excuses, anyway, and since the Secret Service was repeatedly told on March 1 and afterwards that the company was a publishing business there was no defense for the seizure of "GURPS Cyberpunk" or the other book drafts. Most of the over $50,000 awarded in damages was due to the violation of the Privacy Protection Act. Steve Jackson Games publishes traditional books and magazines, with printed paper pages. Is the BBS operator who publishes only on-line articles protected, too? It's a question Judge Sparks did not need to address directly, but his opinion can and should be read to include the on-line publisher. The court's opinion includes the BBS files as material improperly seized, and the Act specifically includes work product in electronic form. Publishing via BBSs has become just like publishing a "newspaper, book, or other form of publication..." -- the only source of news many people get. If the Privacy Protection Act is broadly understood to encompass electronic publishing (as it should) it should provide meaningful protection to innocent sysops whose boards may be used by some for illegal purposes. It should prevent the "preventative detention" of BBSs -- where boards are seized in investigations and held indefinitely -- which seems to be one crude means used to attack suspected criminal activity without bothering to actually prosecute a case. It should also force law enforcement to consider who the actual suspect is -- for instance, in the recent spate of seizures of BBSs for suspected copyright violations. The Privacy Protection Act should prevent law enforcement from seizing a sysop's board who is not suspect in engaging or condoning illegal activity. Those of you who have followed this case will note how little significance I've given to the "Phrack" investigation and the overvaluation of the E911 document. Of course the Secret Service misunderstood or exaggerated the importance of the purloined E911 document, and were chasing imaginary goblins. The real significance of the Steve Jackson Games case, however, was not knocking holes in that one investigation (the Neidorf trail effectively did that), but taking a solid step to set firm, discernible limits for criminal investigations involving computer communication. To focus on the specific foibles of the E911 investigation is to miss the importance of what the Secret Service really did wrong. Out of ignorance or callousness, they ignored the legal rights of people not even suspected of crimes; people who simple shared common electronic space. There are and will continue to be legitimate computer-crime investigations. The closeness that people live in Cyberspace, though, means the government must learn ways to conduct investigations without violating the rights of all the innocent members of the on-line community. In March 1990, the Privacy Protection Act said that Steve Jackson could write and publish his books without having them seized; the Secret Service didn't know that. In 1990, the Illuminati users had the right not to have their e-mail seized and read without at least being suspected of a crime; the Secret Service apparently didn't know that, either. Now they do, and hopefully the word will spread to other government agencies, too. (As of this writing, there is still no decision whether the Secret Service (or Steve Jackson, for that matter) will appeal Judge Spark's decision.) [Peter D. Kennedy is an associate with the Austin, Texas law firm of George, Donaldson & Ford, specializing in civil litigation. George, Donaldson & Ford represents national media, technology and other corporate and individual clients in a variety of civil litigation, including libel and invasion of privacy defense, constitutional law, intellectual property, commercial and employment litigation. George, Donaldson & Ford, 114 W. 7th Street, Suite 100, Austin, Texas 787001; (512) 495-1400 voice; (512) 499-0094 fax; E-mail: gdf.well.sf.ca.us] Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp@sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes?