On the Edge:
Bosses Can't Read Employees' Messages, Court Says

According to the 2007 Electronic Monitoring and Surveillance Survey from the American Management Association and the ePolicy Institute, 43% of organizations surveyed said they monitor employees’ e-mail; 40 percent said they employ an individual responsible for reading and reviewing employees’ e-mail.

Nikki Swartz

On June 18, the Ninth Circuit Court of Appeals in San Francisco handed down a potentially precedent setting decision regarding employees’ privacy expectations in the workplace. In Quon v. Arch Wireless Operating Co. Inc., the court ruled that employers cannot read employees’ textmessages without the employee’s knowledge and consent – even if those messages were sent or received using a company-owned electronic device. In addition, the court determined that absent a search warrant, service providers cannot turn over the contents of employees’ messages to employers – even if an employer pays for the messaging service.

The ruling directly affects those in the Ninth Circuit – Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon, Washington, Guam, and the Northern Mariana Islands – where it is now law, but it could potentially influence the privacy policies of public and, to a lesser extent, private organizations throughout the United States.

At the very least, the case highlights the archaic nature of current laws governing workplace privacy and electronic communications and the complicated issues that arise with new technology. Even if Quon is ultimately overturned, the case is important because the issues it raised aren’t going away any time soon.

Police, Pagers, and Prying Eyes

The Ontario (California) Police Department provided its officers with pagers under a text messaging plan from Arch Wireless that limited the number of characters each officer could send and receive. The department’s written policy banned the personal use of its networks, computers, and communications devices. It stated that the city reserved the right to monitor and log all network activity, including e-mail and Internet use, with or without notice. The policy further stated that users should have no expectation of privacy.

According to court documents, the department later announced that its policies also would apply to the use of its two-way pagers. However, a supervisor told Police Sergeant Jeff Quon and other officers that he would not audit their text messages if they reimbursed the department when they exceeded their 25,000-character limit. Quon paid for overages each time they occurred and avoided audits.

However, when several officers began racking up overage fees, the police chief decided to investigate whether the charges came from work-related or personal use. The department requested records of archived messages sent to and from officers, including Quon. Arch Wireless sent transcripts of Quon’s messages, which revealed mostly personal communication with his wife, including some sexually explicit messages.

In 2002, Quon, his wife, and other officers in the department sued the city, arguing that it had engaged in unlawful search and seizure, and Arch Wireless, contending that it had violated the Stored Communications Act (SCA) by turning text messages over to the department. The lawsuit also named the police department and several supervisors.

Fourth Amendment Protection

In Quon, the Ninth Circuit Court unanimously ruled in favor of Quon and others who argued that by reading their text messages, the city of Ontario violated their rights under the Fourth Amendment, which guarantees a reasonable expectation of privacy. The ruling declared that the officers had a “reasonable expectation of privacy” for text messages handled by Arch Wireless. That means that unless it first obtained the employee’s permission or a valid search warrant, the department had no business reading the messages. The court’s ruling means that Quon’s texts – and by proxy, millions of other messages from millions of other users – are protected from “employers’ prying eyes,” Newsweek said.

In the case, the court determined that the police department’s access is regulated by the Fourth Amendment because it is a public employer. In agreeing with Quon, the court determined that the police chief could have found out how much of the messages were personal by examining numbers or redacted records.

Also, while the court found that the department’s written policy was clear that employees should have no expectation of privacy when using computers and other resources, once Quon’s supervisor told officers that he would not review their messages as long as they paid for overages, the policy was amended, the court said.

The court also said that the department’s informal policy of accepting reimbursement in exchange for not auditing messages gave Quon and other officers a reasonable expectation of privacy, which makes the search and seizure of the message content illegal. According to the court, the department “surreptitiously reviewed messages that all parties reasonably believed were free from third-party review.”

Key among the case’s many issues was whether Arch Wireless violated Quon’s rights by handing over the text messages to his superiors. Typically, employers have the right to access communications sent through their servers, as is usually the case with e-mail. However, according to Newsweek, a user must grant permission for anyone to access electronic communications like text messages that typically are stored only temporarily, for backup purposes, by third-party messaging providers.

The Ninth Circuit Court also ruled that Arch Wireless was subject to the SCA, which prohibits providers from divulging the contents of communications without prior consent from the sender or recipient – even if one of those parties is an employee whose employer provides and pays for the service, InformationWeek said. On this point, the court said that it made no difference whether the employer was private or public.

Quon means that law enforcement in the Ninth Circuit needs a probable cause warrant to access stored copies of an individual’s electronic messages less than 180 days old, regardless of whether they have already been downloaded or read. It also bars employers from accessing the contents of employee e-mails or text messages from a service provider without employee consent.

Quon’s Impact

The court’s determination that text and e-mail messages are protected by the Fourth Amendment is extremely important, but Quon has its limits. For example, it cannot prevent or discourage private employers from snooping in employees’ wireless messages because Fourth Amendment protection against unreasonable search and seizure is mainly limited to the government, according to Gigaom.com, a San Francisco-based blog.

Quon cannot be used against wireless service providers in all cases, either. The Ninth Circuit Court determined that Arch Wireless – now USA Mobility – held customers’ text messages in “electronic storage” under the SCA. As such, the company violated federal law by disclosing transcripts of Quon’s text messages to the Ontario Police Department without his consent. Had the company not stored text messages after they were retrieved by users, experts say there would have been no internal investigation and perhaps no lawsuit.

So, while many legal experts agree that the Quon ruling is significant, it is by no means definitive. John Montaña, J.D., general counsel at The PelliGroup Inc., said it’s worth noting that the decision came from the most liberal federal circuit in the country.

“Courts in the rest of the country may well rule differently, and I would expect many to do so,” he said. “Decisions by the Ninth Circuit Court are regularly overturned by the U.S. Supreme Court because they are so far out of step with the current temperament of the Supreme Court. Further, the SCA, cited as the authority for this ruling, contains an exception for the person or entity providing the service, and other courts have interpreted this as including employers. In particular, if the city stated in a policy or otherwise that it reserved the right to review usage of the devices, including review of voicemail or text messages, there are strong grounds for believing that this ruling will be overturned should it go to the Supreme Court.”

As The Information Management Journal goes to press, it’s unclear whether Arch Wireless and the police department will appeal the Quon decision. An Arch Wireless spokesperson said the case has resulted in “more questions than answers at this point.”

Some experts have opined that Quon could begin a slow shift toward increased privacy protections for employees in the United States. But where laws and policies regarding workplace privacy and electronic communications go from here is anyone’s guess.

“The extent to which the Fourth Amendment provides protection for the contents of electronic communications in the Internet Age is an open question,” Judge Kim McLane Wardlaw wrote for the panel in Quon. “The recently minted standard of electronic communications via e-mails, text messages, and other means opens a new frontier in Fourth Amendment jurisprudence that has been little explored.”

The law governing e-mail communications is still evolving, for example. Generally, courts have found that employers can monitor employees’ e-mail communications on company computers, the New York Times said. But courts have also recognized greater privacy protection for e-mail messages sent using personal, remotely hosted, web-based e-mail accounts such as Hotmail.

In the wake of the Quon ruling, legal experts are advising employers to inform their employees that their electronic messages will be searched. But even so, and especially in the absence of such a policy, employees may have a reasonable expectation of privacy. Going forward, Newsweek said, employers might require workers to sign over permission to access all their messages before they receive a company-issued phone or pager. However, Quon’s lawyer Dieter Dammeier said employers cannot legally force employees to give up their rights under the U.S. Constitution, so policy acknowledgement forms giving consent would not protect them anyway.

Despite Quon’s limited scope, it has created a confusing situation for U.S. employers. Some are now in a situation where they cannot monitor e-mail and text messages in one part of the country but can in other parts.

So, employers in or outside the Ninth Circuit should review their written policy, or create one, spelling out employee privacy rights and expectations regarding their use of company electronic devices – and not deviate from it.

As for employees, Quon will spur new privacy policies in western states, and perhaps even nationwide, but legal experts still warn them against communicating anything via e-mail, phone, or electronic messaging they would not want their grandmothers to read.

Nikki Swartz can be contacted at nikkiswartz@hotmail.com.

From September - October 2008