PHOENIX — Arizonans have a constitutional right to online privacy to keep police from snooping around to find out who they are without first getting a warrant, the state Court of Appeals ruled.
In what appears to be the first ruling of its kind in the state, the court said internet users have a “reasonable expectation of privacy” that the information they furnish about themselves to internet providers will be kept secret. That specifically includes who they are and their home address.
That means police and government agencies cannot obtain that information — the gateway to finding out exactly who is posting material —without a search warrant, the court ruled. And getting a search warrant requires a showing of some criminal activity.
The ruling is particularly significant because federal courts have consistently ruled that once people furnish that information to a third party — in this case the company that provides internet service — they have given up any expectation of privacy. And that means the Fourth Amendment protections of the U.S. Constitution against unreasonable search and seizure no longer apply and the government no longer needs a warrant.
But appellate Judge Karl Eppich, writing for the court, said that argument won’t wash in Arizona. And the key is the state constitution.
“No person shall be disturbed in his private affairs, or his home invaded, without authority of law,” the provision reads. By contrast, the U.S. Constitution has no specific right of privacy.
This case involves what essentially amounts to a “sting” operation in Pima County where a police detective investigating child exploitation placed an ad on an internet advertising forum inviting those interested in child pornography and incest to contact him. According to court records, William Mixton responded, sending images of child pornography.
The detective then got federal agents to issue an administrative subpoena to obtain Mixton’s IP address, essentially a number assigned to users connected to the internet so that no two are the same. Those numbers can be either static or random.
With the IP address, the detective was able to identify Mixton’s internet provider, which in turn led to his street address. At that point, with a search warrant, police seized computers with images of child pornography.
He was found guilty of 20 counts of sexual exploitation of a minor younger than 15 and sentenced to 17 years in prison on each, to be served consecutively.
Mixton argued that the police never should have been able to get his IP address in the first place without an actual warrant.
Eppich acknowledged that Mixton has no basis for his contention, at least under the U.S. Constitution, as he had voluntarily provided information to a third party — his internet provider — to get service. But its Arizona counterpart with its specific right of privacy, the judge said, is something quite different.
“In the internet era, the electronic storage capacity of third parties has in many cases replaced the personal desk drawer as the repository of sensitive personal and business information — information that would unquestionably be protected from warrantless government searches if on a paper desk at a home or office,” Eppich wrote.
“The third-party doctrine allows the government a peek at this information in a way that is the 21st century equivalent of a trip through a home to see what books and magazines the residents read, who they correspond with or call, and who they transact with and the nature of those transactions,” the judge said. “We doubt that the framers of our state constitution intended the government to snoop in our private affairs without obtaining a search warrant.”
Eppich specifically rejected arguments by prosecutors that internet users give up their expectation of privacy because they “voluntarily” reveal identity to get service.
“The user provides the information for the limited purpose of obtaining service,” he wrote. “It is entirely reasonable for the user to expect the provider not to exceed that purpose by revealing the user’s identity to authorities in a way that connect it to his or her activities on the internet.”
Eppich warned against giving such broad power, saying it effectively would give the government “unfettered ability to learn the identity behind anonymous speech, even without any showing or even suspicion of unlawful activity.”
And the implications, he said, are broader than that.
“The right of free association, for example, is hollow when the government can identify an association’s members through subscriber information matched with particular internet activity,” Eppich said. “To allow the government to obtain without a warrant information showing who a person communications with and what websites he or she visits may reveal a person’s associations and therefore intrude on a person’s right to privacy in those associations.”
Judge Philip Espinosa, in his dissent, said he does not read the state constitutional protections so broadly. On one hand, he acknowledged the vast amount of data being generated through electronics, with everything from from cellphones, electronic tablets, smart watches and even modern automobiles all subject to “pervasive tracking cookies.”
“Much of the resulting information is, and should be, constitutionally protected,” Espinosa wrote. But he said information like an IP number should not have constitutional protection any more than, for example, a personal telephone number.
Espinosa said the information was legitimately sought by law enforcement solely to reveal the source of suspected child pornography distribution.
And Espinosa said he finds no First Amendment protections at issue, saying this case involves “criminally perverted speech” that is not constitutionally protected.
As it turns out, the appellate court upheld Mixton’s conviction because the police, in the end, eventually had a warrant.
