Last week, on June 23, 2011, the Vermont Supreme Court, in State v. Simmons, --- A.3d ----, 2011 WL 2474275, affirmed a trial court decision that applied the "settled Fourth Amendment precedent" that "internet users have no reasonable expectation of privacy in their subscriber information, the length of their stored files, and other noncontent data to which service providers must have access." In addition to this interpretation of federal law, the Court also agreed with the trial court's conclusion that Vermont's Constitution "affords no privacy protection in an internet service provider's subscriber address or use information disclosing non-content data."
Factual Background and Procedural History
In 2008, two of Graham Simmons's neighbors reported break-ins and stolen property, including two laptops. The police received an anonymous tip that someone named "Graham," who lived on the same street as the victims, had one of the laptops and was using it to access his neighbor's wireless internet network.
During the investigation, a detective searched MySpace and located a profile for a "Graham Simmons" who lived in the relevant neighborhood and whose profile picture resembled a photograph of the defendant on record with the Department of Motor Vehicles. Based on this, the detective subpoenaed MySpace for the account's IP address; the records produced indicated that shortly after the theft of the laptop, defendant had logged into his MySpace account more than 100 times. And, each log originated from the same IP address that, through a subpoena issued to Verizon, the detective was able to determine belonged to the neighbor's wireless network, to which the neighbor had not given Mr. Simmons the username or password that would enable him to access it.
Based on this information, the detective applied for and received a search warrant to search for the stolen laptops at Simmons's residence. The search turned up one of the stolen laptops, other items recently reported by other neighbors as stolen, and a small amount of marijuana. Simmons moved to suppress the evidence, arguing that the IP address was private information and that issuing subpoenas to MySpace and Verizon without probable cause violated the Fourth Amendment to the U.S. Constitution and Article 11 of the Vermont Constitution.
The trial court denied Simmons's motion, finding that he had no reasonable expectation of privacy in the subpoenaed information and neither the Federal Constitution nor the Vermont Constitution prohibited the disclosure of the sought-after information in response to the subpoenas. Simmons appealed.
The Court's Decision
On appeal, Simmons conceded that the Fourth Amendment to the Federal Constitution does not protect "noncontent internet identification and account data." The Court noted that the Vermont Constitution was no different: "Nothing in our Article 11 rulings suggest that an internet subscriber address and frequency of use data, unembellished by any personal information, should be treated as private." The Court continued:
Given the necessary and willing exposure of an internet user's access point identification and frequency of use to a third party internet service provider, such information cannot reasonably be considered confidential, especially when a provider such as MySpace openly declares a policy* of disclosure. The information appears no more private than a phone number and the number of calls made, or a street address or post office box number and volume of mail, neither of which could plausibly be considered private.
The Court concluded that Simmons had presented " no compelling reason" to interpret Article 11 of the Vermont Constitution any differently, or to depart from federal case law as applied by the trial court. The disclosures did not, for example, reveal any "intimate details" of defendant's "personal 'activities, behavior, habits, and lifestyles'." Nor were the akin to a search of his home or mail because "such intrusions are incomparable to requesting and receiving, from a third party service provider, an IP address and the number of times the access was used."
*The MySpace policy referred to by the court was the site's privacy policy, which was "posted online, plainly declar[ing] that its account information could be disclosed as it deemed necessary 'to respond to a subpoena … whether or not a response is required by applicable law'."