By Ryan Paul | Published: April 22, 2008 - 09:35AM CT
Here's where it get's interesting(IMHO).
Although precedents set by federal case law indicate that there is no reasonable expectation of privacy for Internet service records, the higher privacy standards in New Jersey's state constitution do not permit disclosure of such information without a grand jury subpoena. This was the conclusion passed down in a unanimous ruling (PDF) yesterday by the New Jersey state supreme court.
When the owner of Jersey Diesel discovered that his company's shipping address and password had been altered without authorization in a supplier's database, he contacted law enforcement and informed them that the only other person who knew the password was his employee, Shirley Reid, with whom he had recently quarreled. The supplier was able to provide the IP address used by the individual who changed the records and, after receiving a subpoena issued by a municipal court, Comcast provided records confirming that Reid's account was using that IP address at the time of the incident.
The initial trial court granted Reid's motion to suppress the evidence on the grounds that the subpoena was improperly issued. This decision was upheld on appeal all the way up through the state supreme court, which has concluded that the informational privacy provision of New Jersey's state constitution extends a reasonable expectation of privacy to Internet subscriber information. Such information can therefore only be obtained from Internet service providers with "a grand jury or trial subpoena or when the State Commission of Investigation issues a subpoena."
The court notes that a grand jury subpoena can be obtained without the knowledge of the suspect, which means that the requirement is not excessively burdensome for law enforcement agencies or disruptive to ongoing investigations. The court also determined that, since the information provided by Comcast exists independently of the faulty subpoena, the records can be used as evidence if the police obtain the information again, but follow the proper procedures by doing so with a grand jury subpoena.
"The State compares IP addresses to the return addresses found on the outside of envelopes, which carry no privacy protection. But there is an important difference: letter writers choose to include their address on an envelope. They may also opt for anonymity and list no return address. Internet users have no such choice because they must have an IP address to access a website. In addition, the string of numbers that comprises an IP address and can be collected by a website is both less revealing and less public than a name or street address posted on an envelope," the judges wrote in the ruling.
The judges also say that, although a reasonable expectation of privacy exists today for IP addresses under the New Jersey state constitution, that could change if the technology ever evolves in a manner that makes it easy for individuals to identify who is associated with an IP address.
"Internet users today enjoy relatively complete IP address anonymity when surfing the Web. Given the current state of technology, the dynamic, temporarily assigned, numerical IP address cannot be matched to an individual user without the help of an ISP. Therefore, we accept as reasonable the expectation that one's identity will not be discovered through a string of numbers left behind on a website," the judges wrote. "Should that reality change over time, the reasonableness of the expectation of privacy in Internet subscriber information might change as well."