April 22nd, 2008
NJ court: IP-related info is private
Someone broke into the website of Jersey Diesel, changed the physical address listed on the site to a nonexistent address and changed the login password. Who? Owner Tim Wilson thought he knew. Shirley Read was an employee who had just returned from disability and whom Wilson had just argued with. She was also the only non-IT employee with access to the website password. Wilson notified the local police department.
Open and shut case of computer tampering, no? Not good enough for the Lower Township, NJ, cops. They had a clue that could seal the case – the IP number of whoever made the changes to the site. And they knew who the ISP was that issued the IP – Comcast.
So they went to Comcast and asked to know who was using the IP address that day. Without a subpoena, Comcast refused. Then they got a subpoena – with the caption that it was in the civil case of Wilson v. Read. A case that didn’t exist. Comcast complied. Read moved to suppress the evidence and yesterday the case made its way to a decision of the New Jersey Supreme Court (PDF).
The court ruled that people do actually have a “reasonable expectation of privacy” in the connections between their personal information and the IP addresses they use to access the Internet. At least according to New Jersey law, which is plainly broader than the Fourth Amendment, as interpreted by the Supreme Court.
The court listed a whole slew of federal cases that found no privacy interest in Internet subscriber information and “the logic
of those precedents extends to subscriber information revealed to an ISP.”
New Jersey law “affords our citizens greater protection against unreasonable
searches and seizures” than the Fourth Amendment, the court said.
But despite the New Jersey court’s assumption, it’s “still an open question” as to whether the Supreme Court would recognize the right, Eric Goldman of the Santa Clara U Law School told me.
“The association of IP address and individuals using that IP address might very well be subject to privacy protections. The court made a good set of analogies with telephone service, bank records and utilities – that might be an argument that could be recycled into a federal constitutional analysis.”
One thing about this case: It’s not an unusual situation – at all, Eric said.
“The dominant majority are actually deficient. It’s a real problem for ISPs. All of the incentives are pushing towards complying with the subpoenas. It’s somewhat futile because there are so many bad subpoenas out there, objecting to a few of them is like putting your finger in a dyke,” he said.
