Did the Washington Post Violate the Electronic Communications Privacy Act? (MD4Bush)

NRO ^ | 11/10/05 | Stephen Spruiell

[Republican Red]

Did the Washington Post Violate the Electronic Communications Privacy Act? 11/10 05:24 PM For those of you who have been following the MD4Bush story (if not, click on the links at the bottom of this post to catch up), here's a little breaking news: Free Republic is looking into whether the Washington Post violated the Electronic Communications Privacy Act when Post reporter Matthew Mosk accessed the Free Republic account of MD4Bush.

According to the Post's statement on the matter, Mosk was given MD4Bush's sign-on information by "someone acting on MD4Bush’s behalf." He then used that screen name and password to log into MD4Bush's account and view private e-mails sent between MD4Bush and former Maryland state official Joseph Steffen.

According to the Electronic Communications Privacy Act, anyone who "intentionally accesses without authorization a facility through which an electronic communication service is provided; or... intentionally exceeds an authorization to access that facility" is committing a crime. In this case, the Post claims it had authorization to view the private e-mails because it was given the password by "someone acting on MD4Bush's behalf."

There are two problems with this defense. First, how could the Post have known that this "someone" was really "acting on MD4Bush's behalf"? Free Republic spokesman Kristinn Taylor gave me the following example:

Imagine if I gave you the keys to someone's house and I said, 'If you go in this house, you'll find something newsworthy. Oh and trust me, I know the guy whose house this is, and he wants you to go in there.' Regardless of the legal questions, that certainly wouldn't be ethical. Yet that's exactly what Mosk did when accessed a total stranger's Free Republic account and viewed that account holder's private correspondence. To compound that ethical lapse, Mosk did not report these actions in his stories about Joseph Steffen. He merely alluded to "private e-mails, which were given to The Washington Post."

Second, even if the Post could prove that Mosk had MD4Bush's consent to log into his private account, that wouldn't be enough to exempt the Post from the Electronic Communications Privacy Act. That's because each Free Republic user agrees to terms of use, one of which is that the user will not give out his password. In other words, MD4Bush was not authorized to give Mosk permission to use his password — as the other party to the user agreement, Free Republic's consent was required also.

Taylor told me that Free Republic is looking at its options and considering legal action against the Post. Up until now, Free Republic has not released much information about the identity of MD4Bush, other than to say that his account was associated with the mddems.org web domain (not an mddems.org e-mail address, as this otherwise informative Washington Times piece reported today). But since it's now clear that MD4Bush violated his user agreement, Free Republic is considering whether he forfeited his confidentiality.

That Free Republic might go public with the name has the state Democratic Party on the defensive. This week, WBAL in Baltimore reported that the co-chairman of the Maryland Democrats, Keiffer Mitchell, has called for an investigation into whether the state party was involved in the MD4Bush affair, calling MD4Bush's tricks, "despicable" and saying an investigation was needed to "clear the air."

Unfortunately, the Washington Post has not shown a similar desire to shed light on its own role in assisting MD4Bush in his political hit on the governor of Maryland. The Post maintains that it does not know the identity of MD4Bush, but it has refused to name the "someone" who gave Mosk MD4Bush's sign-on information. In the interest of avoiding a criminal investigation, it might behoove the Post to come clean.

[Woodstock]

I know...I know, "Spell-check is your friend."

[sam_paine]

What do you think the comparison is to Gannon?

Well, I'm lazy, so I gave up trying after not too much searching for old Gannon articles. And I really don't entirely have my hands around this story....

But Gannon was kicked out of the White House press corp because he was not using his real name, and was ostracized by the press for not being a real reporter.

Here we have a real reporter? that used a fake name to affect an election being protected by the press.

Seems to me that someone should be able to find more then a few quips from "highly respected MSM reporters" on that Gannon situation that would be roundly applicable to the md4bush situation. (Or maybe I don't get it.)

My problem, which I think is why this story is precarious in the gen public's mind, is that it's still too esoteric as to what happened. Too hard for Jill 6-pak to understand. A simple "they said X about Gannon, now they say Y about MD4BUSH...."

This story requires reading the FAQ/"primer" to understand it! You didn't need an FAQ to understand Watergate, or even the Gannon thing, even if the Gannon thing was crap. The MSM owned that story and they won it. I'm afraid, lawsuit or not, that the MSM could easily win this with a simplified story.

[The_Victor]

If there is any blowback from that release, I will be happy to testify in court or in deposition that on the circumstances and facts of this situation, that action is legitimate.

The problem though, as I see it, is that FR doesn't have the funds for a legal battle. We have agreed to limit posts from various media outlets, that is clearly within our rights to quote under the "fair use" clause. JimRob has chosen not to take on the legal battle that we would obviously win, simply on the basis of FR's financial status. If MD4Bush sues, he will have the full backing of the demoRAT party. We don't have that kind of money.

[kevkrom]

Hmmmm... the WaPo accessed and reprinted information from this site without authorization. I don't know about the first part of that, but I think there's sufficent precedent for a civil suit on part 2.

[kevkrom]

If I "tell" my neighbor they can read my postal mail, does that make it legal??

This is even worse. This is you telling your neighbor that another neighbor is giving permission to read his mail -- i.e., "Bob, Jim told it me it was OK for you to read his mail".

[tutstar]

It's beyond insane that they can get away with this mess.

[Chances Are]

Now, maybe Free Republic can be considered an "electronic communication service" and FR's database/server/whatever can be considered a "facility through which an electronic communication service is provided", but I don't see how Freepmail qualifies as being in "electronic storage" (as defined above).

Here, I direct you to:

(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication

You think maybe there are backups made regularly on the FR servers? If so, then under this provision it qualifies.

Further,

Electronic Communication means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce

Unless the offending party is located, for the purposes of this potential legal action, in California, which is where the FR servers are located, it affects interstate commerce. How could it be otherwise?

CA....

[Chances Are]

I'm not sure, that's why I'm asking. The legal definition says, "temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof", meaning the communication gets stored in one location while en route to another location. I'm not certain, but I'm pretty sure that freepmail doesn't go anywhere beyond FR's server. It never gets downloaded from ISPs in the way that regular e-mail gets downloaded. It's just not the type of communication that ECPA was intended to protect. Besides that, I'm not sure that FR even qualifies as an Electronic Communication Service Provider within the meaning of the act at all.

Of course FR FReepmail acts as an intermediary. If, for example, I sent you some FReepmail, it goes to the FR sever, where it is stored temporarily until such time as you read it.

If you don't read it, then, yeah, it doesn't go anywhere beyond FR's servers. If, on the other hand, you do read it, the provisions in the law have been met, as you've "downloaded" my message to your computer.

I could be wrong here, but where is the provision in the act specifying use of an "ISP" for these purposes?

Just wonderin'...

CA....

[conservative in nyc]

I wasn't following the Gannon goings on as closely because they happened around the same time this story first broke. But other than there being two attacks on the new media by the old media, I don't see much parallel. Gannon was a semi-public figure who other White House reporters had seen, even if his real last name was Guckert. NCPAC was a handle used by an anonymous FReeper.

[dalight]

FreeRepublic need not release this person's identity in anyway what would cause blow back. They could simply file a public suit for breach of the rules and subsequent damages to FreeRepublic by loss of revenue and contributors because of worries of loss of confidentiality, and being subjected to this sort of illegal behavior.

This is a public filing and must therefor contain the name of the parties involved, placing that fact in the public record.

[dalight]

Duh... think.. database? Where do you think FreeRepublic lives.. its stored on Hard Drives in the form of files and a database. This is no different than any other mail server with a web interface.

[Eva]

I've been wondering if the WA Post was part of the law suit against FreeRepublic. If they were, they deserve to get sued.

[Sandy]

If you don't read it, then, yeah, it doesn't go anywhere beyond FR's servers. If, on the other hand, you do read it, the provisions in the law have been met, as you've "downloaded" my message to your computer.

But, if JimRob were to delete a Freepmail message on his end, then that message would no longer be available to be read on the recipient's end, even if the recipient had already read that message in the past. That's what I mean when I say that freepmail isn't "downloaded" in the usual sense of the word.

Also--even if I'm wrong about the above--ECPA requires that the intruder access the message at the temporary-intermediate storage location. If the message has already been downloaded, accessing that message from within the recipient's account wouldn't be an ECPA violation. Say you get my Yahoo mail password, access my Yahoo account, and read my messages. That wouldn't be an ECPA violation. Accessing messages located at their endpoint isn't what the law is intended to prevent. The point of the law is to prevent accessing or intercepting messages at a spot other than the endpoint of the route. That's my understanding of ECPA at least. I could be wrong.

where is the provision in the act specifying use of an "ISP" for these purposes?

The facility accessed must be an "electronic communication service provider". That term has a specific legal meaning. It means ISPs, for the most part. Sure there's other things that fall within the definition, but I'm not sure that a web forum does.

[Sandy]

This is no different than any other mail server with a web interface.

I don't think that's right. I can send and receive e-mail to and from anyplace in the world using my web-based mail account. Can't send/receive freepmail anywhere except to/from another freeper.

[dalight]

where are you? I am some place else.. anywhere in the world. Just a limited number of folks. The question was does FreeRepublic meet the criteria of storing this data.. and obviously it does.

Sandy said: but I don't see how Freepmail qualifies as being in "electronic storage" (as defined above).

Electronic storage means—
(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and

The database and files on the FreeRepublic servers facilitate communication between members. This data can be stored just as long as the member chooses, temporary or longer. The data is transmitted when the member checks their mail via the http protocol rather than mail's normal but not exclusive smtp,imap or pop protocol's

(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication;

The databases and files on FreeRepublic's servers meet the test of any storage of such communication by an electronic communication service (FreeRepublic) for the purpose of backup of such communications (I bet my LIFE that JimRob is keeping backups)

[Gondring]

bttt

[Mamzelle]

Fascinating.

Suppose, for instance, on Amazon.com, an individual writes a review of a book under the site's promise of anonymity.

Suppose that review is of a political or controversial book--

Suppose that reviewer or writer comes back later, only to find his personal email addressed posted for all to see? This could not have happened without Amazon deliberately using its own merchant files, which it probably did at the request of the books's publisher or author.

Is that in any way similar to this incident? Seems like privacy was violated...

BTW--I know of this actually happening.

[Mamzelle]

It could be a civil matter. Most crimes can become "intentional torts"--

[SeniorMoment]

"Do you want to go to jail or do you want to go home?" I love that line (Training Day, Denzel Washington)

[Buffettfan]

The OSM (oldstream media) is being dismanted......one brick at a time just like the Berlin wall.