In February 2015, a jury convicted Ross Ulbricht of drug trafficking and other crimes associated with his creation and operation of Silk Road, an online marketplace whose users primarily purchased and sold illegal goods and services. A federal judge in the U.S. District Court for the Southern District of New York then sentenced Ulbricht to life imprisonment.  On Wednesday, the Second Circuit upheld the conviction and sentence “in all respects.”  In affirming the conviction, the appeals court rejected Ulbricht’s claim that much of the evidence against him should have been suppressed because it was obtained in violation of his Fourth Amendment rights.

The Second Circuit rejected Ulbricht’s argument that the pen/trap orders that the government used to monitor IP address traffic to and from his home router violated the Fourth Amendment because the government obtained the orders without a warrant.  The government obtained authorization to use pen registers and trap and trace devices—which collect non-content data related to communications—under the Pen/Trap Act, 18 U.S.C. § 3122, which does not require a search warrant or the kind of showing generally required to obtain such a warrant.

For Ulbricht to mount a successful Fourth Amendment challenge to the pen/trap orders that the government obtained to monitor the IP address traffic to and from the various devices associated with him, he was required to show that he personally has an expectation of privacy in the IP addresses.  Since the Supreme Court’s lodestar 1979 decision in Smith v. Maryland, courts have held that people have no legitimate expectation of privacy in information voluntarily turned over to third parties.  The concept, which has become known as the “third party doctrine,” originated in the context of the telephone, as telephone users voluntarily convey numerical information (i.e., phone numbers)—but not the content of communications (i.e. the content of telephone conversations)—to the telephone company so that it could connect its call.  Courts have since extended the doctrine to e-mail and internet addresses, holding that internet users do not have a legitimate expectation of privacy in information provided to and used by internet service providers for the purpose of directing the routing of information.

The Second Circuit joined the Third, Eighth, and Ninth Circuits in holding that there is no Fourth Amendment protection in IP address information under the third-party doctrine.  The court reasoned that the “recording of IP address information and similar routing data, which reveal the existence of connections between communications devices without disclosing the content of the communications, are precisely analogous to the capture of telephone numbers at issue in Smith.”  The Court rejected the notion that some aspects of modern technology, which entrust great quantities of significant personal information to third party vendors and make extensive government surveillance possible, call for a reevaluation of the third-party doctrine.

The court was careful, however, to confine the scope of its holding.  The court noted that its decision was “narrowly confined to orders that are limited to the capture of IP addresses, TCP connection data, and similar routing information,” and did not “address other, more invasive surveillance techniques that capture more information (such as content),” including historical cell-site location information, which may require a warrant or other court order.

The Second Circuit also rejected Ulbricht’s argument that the warrants authorizing the government to search his laptop as well as his Google and Facebook accounts violated the Fourth Amendment’s particularity requirement.  The court relied principally on the distinction between breadth and particularity:  a warrant may be broad, in that it authorizes the government to search an identified object for a wide range of potentially relevant material—and, incidentally, exposes significant information that is not responsive to the warrant—without violating the particularity requirement.  The court disagreed that a search warrant is insufficiently particular where it fails to specify specific search terms and protocols.  To illustrate its point, the court explained that Ulbricht kept records of certain encrypted chats in a file labeled “mbsobzvkhwx4hmjt.”  The government would not have been able to obtain these responsive files with a pre-planned keyword search.

The court’s decision makes clear that warrants authorizing searches of computers, like all search warrants, do not require such ex ante protocols to be constitutionally particular.