The Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2510 et seq, places restrictions on the interception of communications contents, in accordance with the basic findings of Katz v. U.S. and some refinement in Smith v. Maryland. In § 2510(8), "contents" is defined as "any information concerning the substance, purport, or meaning of that communication." (emphasis added.)

In electronic communications, what standard must be met for information to concern the substance, purport, or meaning of the communication? That's an excellent question, and it's one I've been trying to answer. (I should probably note that "substance, purport, or meaning" is not the Supreme Court's language; however, the Supreme Court has cited that Congressional language on many occasions without obvious disagreement.)

Email is the context most often considered, especially after the USA PATRIOT Act attempted to make email addresses "communications facilities." The conventional wisdom with respect to email is that only the body of a message and maybe (maybe) the subject header is content. Everything else, the standard argument goes, is non-content. I disagree, and I think on a technical level this position is undermined by finding analogies to clearly protected forms of communications, but specifically telephone communications.

Those of us who understand email also understand that message headers are meaningful. In an age when nearly every message sent on the Internet will face at least one spam or virus filter, those headers lend substance and purport, because they enable a message to be delivered. In this age of massive Bayesian filters, where header tokens can classify a message as spam or not, message headers lend substance and purport.

But message headers do something more. They communicate the sender, as well as the chosen representation of the sender's name and email address. When I see who a message comes from, especially if I am forced to check the headers to see the path, substance and purport are immediately gained. In many cases, I must check those things to know who the sender was.

And where does this leave the telephone analogy? Imagine if oral communications (which have greater statutory protection, but use the same "contents" definition) were recorded, such that the spoken words were obscured, but the tones, inflections, and voices could be heard. What if we could record greetings of phone conversations to understand who the target was?

The government can't, at least not legally, without a warrant. However, the government may collect all of your message headers, intercepting them in bulk, without a warrant.

The big questions, then, are what do we mean by "any"? "Concerning"? "Substance"? "Purport"? "Meaning"? It's not entirely clear, and finding the appropriate law that can shed light on these issues is tough.

This is just the tip of the iceberg. There are, in my opinion, considerably more problems with the current analysis of the protections of electronic communications, and they almost all hinge on clearly broken ideas of how the Internet works.

More to come.