Steve Jackson Games v. US Secret Service
The Case and its Outcome
by Peter D. Kennedy
George, Donaldson & Ford, 114 W. 7th Street, Suite 100
Austin, Texas 78701
512-495-1400 - Fax: 512-499-0094 - E-mail: gdf.well.sf.ca.us
(The print version of this article appeared in BOARDWATCH Magazine
in the July 1993 issue.)
On March 12, 1993, a federal judge in Austin, Texas decided
that the US Secret Service broke the law when it searched Steve
Jackson Games Inc., and seized its bulletin board system and other
computer equipment. The decision in this case has been long-
awaited in the computer world, and most observers have hailed it as
a significant victory for computer user's freedom and privacy.
I had the fortune to be one of the lawyers representing Steve
Jackson and his co-plaintiffs. During the course of the lawsuit,
I met many people passionately interested in the issues the case
raised. I watched and listened to the discussions and arguments
about the case. I've been impressed by the intelligence of the on-
line world, and the interest that computer enthusiasts show --
especially computer communication enthusiasts -- in the law. I've
also been impressed and distressed at how the Net can spontaneously
generates misinformation. Steve Jackson has spent untold hours
correcting errors about him, his company, and the case on both the
Net and more traditional news media.
The decision in the Steve Jackson Games case is clearly a
significant victory for computer users, especially BBS operators
and subscribers. I hope to give a simple and clear explanation for
the intelligent non-lawyer of the legal issues raised by the case,
and the significance and limitations of the court's decision.
The facts. By now, most people interested in the case are
familiar with the basic facts: On March 1, 1990, the Secret
Service, in an early-morning raid, searched the offices of Steve
Jackson Games. The agents kept the employees out of the offices
until the afternoon, and took the company's BBS -- called
"Illuminati" -- along with an employee's work computer, other
computer equipment, and hundreds and hundreds of floppy disks.
They took all the recent versions of a soon-to-be-published game
book, "GURPS Cyberpunk," including big parts of the draft which
were publicly available on Illuminati.
On March 2, Steve Jackson tried to get copies of the seized
files back from the Secret Service. He was treated badly, and
given only a handful of files from one office computer. He was not
allowed to touch the Illuminati computer, or copy any of its files.
Steve Jackson Games took a nosedive, and barely avoided going
out of business. According to Jackson, eight employees lost their
jobs on account of the Secret Service raid, and the company lost
many thousands of dollars in sales. It is again a busy enterprise,
no thanks to the Secret Service (although they tried to take
credit, pointing to the supposedly wonderful publicity their raid
produced).
After months of pestering, including pressure by lawyers and
Senator Lloyd Bentsen (now, as Treasury Secretary, the Secret
Service's boss) the Secret Service returned most of the equipment
taken, some of it much the worse for wear.
By then, Steve Jackson had restarted Illuminati on a different
computer. When the old Illuminati computer was finally given back,
Jackson turned it on -- and saw that all the electronic mail which
had been on the board on March 1 was gone! Wayne Bell, WWIV
developer and guru, was called in. He gave us invaluable (and
free) help evaluating the condition of the files. He concluded,
and testified firmly at trial, that during the week of March 20,
1990, when the Secret Service still had Illuminati, the BBS was
run, and every piece of e-mail was individually accessed and
deleted. The Illuminati files the Secret Service had returned to
Steve Jackson left irrefutable electronic traces of what had been
done -- even I could understand how the condition and dates of the
e-mail files showed what had happened, and when.
The Lawsuit
Sueing the federal government and its agents is
never a simple thing. The United States can only be sued when it
consents. Lawsuits against individual agents face big legal
hurdles erected to protect government officials from fear of a
tidal wave of lawsuits.
Amazing as it may sound, you cannot sue the United States (or
any federal agency) for money damages for violating your
constitutional rights. You can sue individual federal agents,
though. If you do, you have to get past a defense called
"qualified immunity" which basically means you have to show that
the officials violated "clearly established" constitutional law.
For reasons I can't explain briefly, "qualified immunity" often
creates a vicious circle in civil rights litigation, where the
substance of constitutional law is never established because the
court never has determine the Constitution's scope, only whether
the law was "clearly established" at the time of the violation.
The strongest remedies for federal overstepping are often
statutes which allow direct suit against the United States or
federal agencies (although these are less dramatic than the
Constitution). Fortunately, these statutes were available to Steve
Jackson and the three Illuminati users who joined him in his suit
against the Secret Service.
The Legal Claims
The Steve Jackson Games case was a lot of
things to a lot of people. I saw the case as having two basic
goals: (1) to redress the suppression of the public expression
embodied in Steve Jackson's publications (including his publication
via BBS) and thereby compensate the company for the damage
unnecessarily done by the raid, and (2) to redress the violation of
the privacy of the BBS users, and the less tangible harm they
suffered.
The individual government agents involved in the raid were
sued for constitutional violations -- the First and Fourth
Amendments. The Secret Service was sued under two important laws
which embody the same principles as the First and Fourth Amendments
-- the Privacy Protection Act of 1980 and provisions of the
Electronic Communications Privacy Act of 1986. There were other
claims, but these were the core.
After the case was pending a year and a half and all discovery
completed, the government moved to have the claims against the
individual defendants dismissed, claiming qualified immunity. This
motion (usually brought early in a case) guaranteed that the trial
would be delayed by over a year, because even if the government
lost its motion, the individuals could immediately appeal. In
December, 1992, the tactical decision was made to drop those
claims, rather than suffer the delay, and proceed promptly to trial
on the claims against the Secret Service itself.
The Privacy Protection Act of 1980
In the late 1970's the Stanford Daily was subjected to a fishing
expedition conducted by police officers in the Stanford Daily's newsroom.
The police were looking for notes and photos of a demonstration the
newspaper had covered for a story, hoping the newspaper's files would
identify suspects. The Supreme Court held in 1979 that the newspaper had
no separate First Amendment right protecting it from searches and
seizures of its reporters' notes and photographs if they were
"evidence" of a crime the paper had covered -- even when the
newspaper was not under any suspicion itself. Congress responded
in 1980 with the Privacy Protection Act, which, until Steve Jackson
came along, was distinguished mostly by its lack of interpretation
by courts.
The Act's wording is rather obtuse, but basically it enacts a
"subpoena only" rule for publishers -- law enforcement officials
are not allowed to search for evidence of crimes in publishers'
offices, or more accurately, they may not "search for or seize"
publishers' "work product" or "documentary materials", essentially
draft of publications, writers' notes, and such. To get such
material, the police must subpoena them, not with the much more
disruptive search warrant. Every BBS sysop should read this act,
located at 42 U.S.C. 2000aa in the law books, because I can't
fully explain it here.
The Act is quite broad, protecting from searches and seizures
the work product and documentary materials of anyone who has "a
purpose to disseminate to the public a newspaper, book, broadcast,
or other similar form of public communication ..." It also has a
big exception -- if the publisher is the person suspected in the
criminal investigation.
The Electronic Communications Privacy Act
Two provisions of the Electronic Communications Privacy Act (or
ECPA) were paramount in the suit. The plaintiffs claimed the Secret
Service violated two provisions -- one prohibiting unjustified
"disclosure and use" of e-mail (18 U.S.C. Sec. 2703; the other
prohibiting "interception" of e-mail (18 U.S.C. Sec. 2511(1)).
The parties' positions were fairly simple, and laid out well
before trial. As for the Privacy Protection Act, Steve Jackson
claimed that his company's publications, both in book form and on
Illuminati, were obviously "work product" protected by the Act, and
the government had no right to seize them, and therefore owed him
money for the damage the raid caused his business. The government
replied claiming that (1) Steve Jackson Games' products are not the
type of publications protected by the PPA; and anyway, (2) the
Secret Service didn't know that Steve Jackson Games was a publisher
when it raided its offices; and even then, (3) the Secret Service
didn't mean to take the books, the books just came along when the
computers and disks were taken.
As for the e-mail, Steve Jackson and the other BBS users
claimed that the seizure, disclosure, and deletion of the e-mail
was both an unlawful "disclosure and use," and an "interception" of
electronic communications in violation of the ECPA. The Secret
Service replied that (1) there was no "interception" because the e-
mail was just sitting there on the hard drive, not moving; and (2)
the Secret Service didn't read the mail, but if it did, it was
acting in good faith, because it had a search warrant authorizing
it so seize Steve Jackson Games' "computers" and to read their
contents.
The Trial
When the individual defendants were dropped, the
case quickly went to trial. The plaintiffs opened their case on
January 29, 1993. The trial took the better part of four days; the
witnesses included now-familiar names: Timothy Foley and Barbara
Golden of the Secret Service, William Cook, formerly of the U.S.
Attorney's office in Chicago, Henry Kluepfel of Bellcore, Steve
Jackson and the BBS users Elizabeth McCoy, Walter Milliken and
Steffan O'Sullivan, and WWIV master Wayne Bell.
At trial, Judge Sparks was introduced to the labyrinthine E911
investigation. We also set up and ran Illuminati as it looked on
March 1, 1990, and Steve Jackson walked Judge Sparks through his
BBS, lingering on discussion areas such as "GURPS Old West" to give
the Judge a taste of the scope and breadth of BBS publication and
communication which the Secret Service had shut down. The judge
appeared upset by the callous and suspicious manner in which the
Secret Service had treated Steve Jackson, and with the Service's
apparent disregard for the effects the raid might have on the
company.
The Decision
Judge Sparks decided the case in February,
1993, in a long written opinion. The full text of the opinion is
available on the Internet at ftp.eff.org, and on Illuminati itself.
I recommend all sysops and BBS users to read it,
as it is one of the very few legal rulings specifically addressing
bulletin boards and electronic mail.
First, the bad news: Judge Sparks accepted the government's
argument that the seizure of the BBS was not an "interception" of
the e-mail, even mail that had not yet been read. Essentially, he
decided that the definition of "interception" implicitly means
"contemporaneous with the transmission"; that is, for there to be
an interception, the government must position itself in the data
stream, like a conventional wiretap. Since the e-mail was
temporarily stored on the BBS hard drive, he held there was no
contemporaneous interception.
Ruling that there was no interception means two things.
First, the plaintiffs did not receive the $10,000 minimum damages
a violation of the "interception" law provides, even though the
judge found the Secret Service had not acted in good faith. More
importantly, it lowers the standard for seizing BBS e-mail -- and
threatens to lower the standard for the seizure of all electronic
communications which reside long enough in computer memory to be
seized (which is most all computer communications, as far as I
understand it). To "intercept" wire communications you need a
court order, not just a routine search warrant. This ruling (which
technically only applies in the Western District of Texas) means
law enforcement is not limited in its seizure of BBSs by the higher
standards required of wiretapping.
Now, the good news: the plaintiffs won the "disclosure and
use" argument under the ECPA, getting back most of what was lost in
the "interception" decision. First, Judge Sparks found the
obvious: that while the Secret Service had Illuminati they or
their agents read and deleted all the e-mail on Illuminati,
including the plaintiffs' mail -- persons the Secret Service
admittedly having no reason at all to suspect of any illegal
activity.
Next, he rejected the Secret Service's argument that its
agents were acting in "good faith." While he didn't list all the
reasons, quite a few are supported by the evidence: the Secret
Service's investigation was "sloppy", he said, and there was no
attempt to find out what Steve Jackson Games did as a business; the
Secret Service was told the day of the raid that the company was a
"publisher," and refused to make copies or return the files for
months after they were done reviewing them; and the Secret Service
apparently allowed the private mail of dozens of entirely innocent
and unsuspecting people to be read and trashed.
The judge ruled that Steve Jackson, his company, and the three
Illuminati users who joined Jackson in the suit were each entitled
to an $1,000 award from the government, as provided by the ECPA.
The Privacy Protection Act was pretty much a clean sweep.
While the judge and Steve Jackson still differ over how much money
the raid cost the company, the court's ruling was squarely in
Jackson's favor on the law. Although unconventional, the court
found that Steve Jackson Games' publications were clearly covered
by the Act, should not have been seized, and should have been
promptly returned.
At trial, the Secret Service agents had freely admitted they
knew nothing about the Act. Former U.S. Attorney William Cook
claimed he knew about it before the raid, but decided (without any
investigation) that Steve Jackson Games wasn't covered. The
Privacy Protection Act (unlike the ECPA) allows no "good faith"
excuses, anyway, and since the Secret Service was repeatedly told
on March 1 and afterwards that the company was a publishing
business there was no defense for the seizure of "GURPS Cyberpunk"
or the other book drafts. Most of the over $50,000 awarded in
damages was due to the violation of the Privacy Protection Act.
Steve Jackson Games publishes traditional books and magazines,
with printed paper pages. Is the BBS operator who publishes only
on-line articles protected, too? It's a question Judge Sparks did
not need to address directly, but his opinion can and should be
read to include the on-line publisher. The court's opinion
includes the BBS files as material improperly seized, and the Act
specifically includes work product in electronic form. Publishing
via BBSs has become just like publishing a "newspaper, book, or
other form of publication..." -- the only source of news many
people get.
If the Privacy Protection Act is broadly understood to
encompass electronic publishing (as it should) it should provide
meaningful protection to innocent sysops whose boards may be used
by some for illegal purposes. It should prevent the "preventative
detention" of BBSs -- where boards are seized in investigations and
held indefinitely -- which seems to be one crude means used to
attack suspected criminal activity without bothering to actually
prosecute a case. It should also force law enforcement to consider
who the actual suspect is -- for instance, in the recent spate of
seizures of BBSs for suspected copyright violations. The Privacy
Protection Act should prevent law enforcement from seizing a
sysop's board who is not suspected in engaging or condoning illegal
activity.
Those of you who have followed this case will note how little
significance I've given the "Phrack" investigation and the
overvaluation of the E911 document. Of course the Secret Service
misunderstood or exaggerated the importance of the purloined E911
document, and were chasing imaginary goblins.
The real significance of the Steve Jackson Games case,
however, was not knocking holes in that one investigation (the
Neidorf trial effectively did that), but taking a solid step to set
firm, discernable limits for criminal investigations involving
computer communication. To focus on the specific foibles of the
E911 investigation is to miss the importance of what the Secret
Service really did wrong. Out of ignorance or callousness, they
ignored the legal rights of people not even suspected of crimes;
people who simply shared common electronic space. There are and
will continue to be legitimate computer-crime investigations. The
closeness that people live in Cyberspace, though, means the
government must learn ways to conduct investigations without
violating the rights of all the innocent members of the on-line
community. In March 1990, the Privacy Protection Act said that
Steve Jackson could write and publish his books without having them
seized; the Secret Service didn't know that. In 1990, the
Illuminati users had the right not to have their e-mail seized and
read without at least being suspected of a crime; the Secret
Service apparently didn't know that, either. Now they do, and
hopefully the word will spread to other government agencies, too.
(As of this writing, there is still no decision whether the
Secret Service (or Steve Jackson, for that matter) will appeal
Judge Spark's decision.)
Steve Jackson Games | SJ Games vs. the Secret Service
