In a decision announced in Austin, Texas, on March 12, Judge Sam Sparks of the federal district court for the Western District of Texas announced that the case of Steve Jackson Games et al. versus the U.S. Secret Service and the United States Government has been decided for the plaintiffs. The decision in this trial may have critical implications for our online communications.
But first, some background. Many years ago, telephone companies around the country worked with local police and fire departments and hospitals to create a system where telephone users could dial the digits "9-1-1" to report an emergency. The telephone lines used for the 911 system were separate lines, which were not used by the telephone companies to route regular telephone calls, to ensure that the lines were always available during emergencies. Sometime in September of 1988, a computer intruder logged onto a Bell South computer and made a copy of a telephone company document describing how Bell South's emergency 911 system worked. Telephone company personnel became aware of the existence of the unauthorized copy of this proprietary document and called the United States Secret Service to help find the person who had penetrated their computer. The Secret Service agents were concerned that the integrity of the emergency 911 system would be in jeopardy if computer intruders knew how to use the 911 lines, leaving emergency callers with no access to the system when they needed it.
In reality, the document that was copied off the Bell South computer, commonly known as the E911 document, did not contain passwords or any other access descriptions. The document was, rather, a technically written narrative containing information that was readily published and available for sale from Bellcore and other telephone companies.
No matter... the Secret Service was on the case! And with the help of telephone company personnel, the Secret Service attempted to trace the location (or locations, as was the case) of the document. Sometime in February of 1989, the young man who had copied the E911 document from Bell South's computer submitted it for publication to an online newsletter named Phrack. Phrack's editors cut the document down to about half of its original size, taking out all references to telephone company employees, telephone numbers and sensitive information about the system. The E911document was then published in Phrack issue 24, which was electronically distributed for its usual no charge, to various computer users throughout the country—to about 150 sites in all. Phrack issue 24 was distributed on February 25, 1989.
The Secret Service went wild. Copies of what they claimed was a sensitive document had now been passed electronically throughout the country. And on March 1, 1990, the Secret Service raided a fantasy books and games producer named Steve Jackson Games, looking for the document.
The Secret Service didn't actually know whether someone at Steve Jackson Games had received a copy of issue 24 of Phrack. The Service simply knew that one of the employees there had received a copy of the newsletter on his home BBS, and may have been involved with the young man who had originally intruded into Bell South's computer. When the employee's home BBS was no longer accessible to telephone company personnel attempting to log in, a theory apparently arose that the employee's BBS was now being run out of Steve Jackson Games. And, in fact, Steve Jackson Games did run a BBS, called the Illuminati.
The Secret Service, as it would learn later, was wrong. There was no E911document on Illuminati, no issues of Phrack, and no BBS from the employee's home. The Illuminati BBS had been around for years and was set up to be a place for those who enjoyed fantasy games to congregate. The board was setup like most other boards—with bulletin boards, conference areas and e-mail. But now the board was closed down—the Secret Service physically removed it from Steve Jackson Games on March 1, 1990, and did not return it until sometime in the end of June of that year. All in all, the Secret Service seized 3 computers, 5 hard disks and more than 300 floppies from Steve Jackson Games on that fateful day.
No criminal charges were ever brought against Steve Jackson Games. Yet, when the computer equipment was returned more than three months after the raid, it appeared that someone inspecting the disks had read and deleted all of the 162 electronic mail messages contained on the BBS at the time of the raid. Not one of the users of the BBS was even under investigation from the Secret Service.
Steve Jackson, owner of Steve Jackson Games, was angry. During the three months his systems were under Secret Service investigation, he had to layoff nearly half of his work force. Publication of at least one of his games books was delayed, resulting in loss of revenues to the company. He was written up in Business Week magazine as being a computer criminal. Steve Jackson decided to fight back. On May 1, 1991, Steve Jackson, Steve Jackson Games and three users of the Illuminati BBS, with the help of the Electronic Frontier Foundation, filed a civil suit against the United States Secret Service, alleging that the search warrant used during the raid was insufficient, since Steve Jackson Games was a publisher, and that the privacy protections of the Electronic Communications Privacy Act (ECPA)had been violated with regard to the electronic mail on the system.
As I wrote in a previous column, ECPA consists of a series of amendments to the federal wiretap act. It prohibits law enforcement officers from intentionally intercepting, using and/or disclosing the contents of private electronic communications without a warrant. The statute offers the same privacy protection for communications that are stored "incidental to the electronic transmission thereof." The users of the Illuminati board claimed that their unread e-mail was still in transit, and therefore required a warrant specifically describing the messages to be searched. The Secret Service claimed that the mail was no longer in transit, and therefore no special warrant was required under ECPA.
On Tuesday, January 26, 1993, at a little after 1:00 p.m., U.S. District Court Judge Sam Sparks began to hear the trial of Steve Jackson Games v. United States Secret Service. By the third day of the trial, while the judge had not decided the final outcome of the case, he had determined that the raid and the subsequent investigation and non-return of equipment had been inappropriate. While Special Agent Thomas Foley of the Secret Service sat there simply replying, "Yes, sir," the judge barraged him with questions concerning the Secret Service's conduct: [Note: Some of this may be paraphrased.]
"How long would it have taken you to find out what type of business Steve Jackson Games does? One hour?... In any investigation prior to March1st (the day of the raid) was there any evidence that implicated Steve Jackson or Steve Jackson Games, other than [the employee's] presence?...You had a request from the owner to give the computers and disks back. You knew a lawyer was called. Why couldn't a copy of the information contained on the disks be given within a matter of days? . . . How long would it have taken to copy all disks? 24 hours?... Who indicated that Steve Jackson was running some kind of illegal activity?... Since the equipment was not accessed at the Secret Service office in Chicago after March 27, 1990,why wasn't the equipment released on March 28th?... Did you or anyone else do any investigation after March 1st into the nature of Mr. Jackson and his business?... You had the owner standing right in front of you on March 2nd. Is it your testimony that the first time you realized that he was a publisher and had business records on the machine was when this suit was filed?"
And so it went for fifteen minutes straight. The government lawyers were visibly shaken by this interrogation—so much so that they decided not to call any of the other witnesses who had waited for two days to tell their stories. In the closing arguments, the judge repeatedly asked the lawyers what his award of damages should be, since it was apparent he believed that Steve Jackson Games had, in fact, been damaged.
The judge's decision was announced on March 12, 1993. Judge Sparks awarded more than $50,000 in damages to Steve Jackson Games, citing lost profits and violations of the Privacy Protection Act of 1980. In addition, the judge awarded each plaintiff $1,000 under the Electronic Communications Privacy Act for the Secret Service seizure of their stored electronic mail.
The judge also stated that plaintiffs would be reimbursed for their attorneys' fees.
The judge did not find that Secret Service agents had "intercepted" the electronic communications that were captured when agents seized the Illuminati BBS in an early morning raid in the spring of 1990 as part of a computer crime investigation. The judge did find, however, that the ECPA had been violated by the agents' seizure of stored electronic communications on the system. The plaintiffs have decided to appeal the interception claim.
The results of this precedent-setting litigation will clearly have important consequences for users of computer bulletin board systems. And, hopefully, the public reprimand of the United States Secret Service will cause them to step back and think before seizing their next BBS.