Home / Blogs

Law Requiring Sex Offenders to Hand Over All Internet Passwords Going Too Far?

Susan Brenner

Maybe you've seen one of the news stories about the revised Georgia statute (Georgia Code § 41-1-12) that now requires sex offenders to turn their Internet passwords, screen names and email addresses over to authorities. The purpose of the revised statute is to give authorities the ability to track what sex offenders are doing online, to, in the words of one news story, "make sure" they "aren't stalking children online or chatting with them about off-limits topics."

Critics of the law say it goes too far, since it will let law enforcement agents read emails a sex offender sends to anyone, including family and employers. The state senator who wrote and sponsored the legislation revising the statute concedes that it does, at least to some extent, invade the privacy of those to whom it applies. But he also says they have forfeited their privacy rights by having been convicted of a sex crime and argues that the need to protect children outweighs any privacy concerns.

Georgia is apparently one of a very few (two?) states that have expanded their sex offender registry requirements to include passwords, usernames and email addresses. The first state to do this seems to be Utah, which adopted legislation requiring sex offenders to "provide Utah's sex offender registry with all of their internet identifiers and the websites on which they use those identifiers." Doe v. Shurtleff, 2008 WL 4427594 (U.S. District Court for the District of Utah 2008). A man affected by this legislation filed a lawsuit challenging its constitutionality. He argued that it violated his First Amendment right to free speech, which includes a right to be able to speak anonymously.

The Utah statute required that sex offenders provide the following to the Utah Department of Corrections (UDOC):

(i) Internet identifiers and the addresses the offender uses for routing or self-identification in Internet communications or postings; [and]

(j) the name and Internet address of all websites on which the sex offender is registered using an online identifier, including all online identifiers and passwords used to access those websites...

Utah Code§ 77-27-21.5(12). A related statute required them also to give the UDOC "any password required for use with an online identifier." Utah Code § 77-27-21.5(2)(c). It defined "online identifier" as "any electronic mail, chat, instant messenger, social networking, or similar name used for Internet communication."

Doe, who was challenging the Utah statute, made a number of First Amendment arguments, but the federal judge to whom the case was assigned found that his "most compelling" argument was that the Utah statutes abridged his First Amendment right to speak anonymously online. Doe v. Shurtleff, supra. In analyzing this argument, she noted that there were no opinions dealing with this issue; there were, of course, opinions dealing with challenges to different aspects of sex offender registry statutes, but not this particular issue. So the judge was, as she noted, "in wholly untested legal waters." Doe v. Shurtleff, supra.

She therefore relied on Supreme Court dealing generally with the right to anonymous speech, one of which was McIntyre v. Ohio Elections Commission, 514 U.S. 334 (1995). In McIntyre, the Court explained that

[a]nonymity is a shield from the tyranny of the majority. It thus exemplifies the purpose behind the Bill of Rights, and of the First Amendment in particular: to protect unpopular individuals from retaliation-and their ideas from suppression-at the hand of an intolerant society. The right to remain anonymous may be abused when it shields fraudulent conduct. But political speech by its nature will sometimes have unpalatable consequences, and, in general, our society accords greater weight to the value of free speech than to the dangers of its misuse.

The Utah judge noted that the Supreme Court has also recognized "the importance and unique nature of the Internet as a virtual `marketplace of ideas." Doe v. Shurtleff, supra (quoting Reno v. American Civil Liberties Union, 521 U.S. 844 (1997)). And she pointed out, quite correctly, that courts have combined these two principles to hold that the First Amendment protects anonymous online speech. Doe v. Shurtleff, supra.

The defendants in the Utah case (who included the Utah Attorney General) did not

directly challenge the right to anonymous speech online. Instead, they contend that because he is a sex offender, Mr. Doe has relinquished that right. Defendants cite cases in various other contexts that have approved curtailing the constitutional rights of sex offenders and felons. Defendants do not cite any authority, however, supporting the proposition that a sex offender who has completed his prison term and is not on parole or probation gives up First Amendment rights.

Doe v. Shurtleff, supra. So they made the same argument the sponsor of the Georgia legislation is making as to why that statute is not unconstitutional.

The judge disagreed. After reviewing cases, she found that

Mr. Doe has not given up his right to anonymous internet speech because of his status as a sex offender. . .  First, the United States Supreme Court has held that even people in custody have First Amendment rights, although restrictions on those rights are scrutinized under a low standard. . . Second, the [U.S. Court of Appeals for the Tenth Circuit] has ruled that a complete, unconditional ban on internet access as a condition of supervised release is overly broad and impermissible.

Doe v. Shurtleff, supra. The Utah judge found that the fact Doe, the plaintiff in the case, retained his First Amendment right to anonymous speech was "bolstered by the fact that Mr. Doe is not on parole or subject to supervised release." Doe v. Shurtleff, supra.

She also found that the Utah statutes infringed on his right to anonymous speech: "If Mr. Doe provides the UDOC with his Internet information and knows that there are no statutory limits on how that information can be used by the UDOC, or others, he is less likely to engage in protected anonymous speech." Doe v. Shurtleff, supra. The judge then had to decide if the infringement violated the First Amendment. Georgia Code § 41-1-12(o). That might open the statute up to a challenge based on the holding in the Doe v. Shurtleff case.

The infringement would NOT violate the First Amendment if (i) it was being imposed to protect a compelling government interest and (ii) it was the least restrictive means available to accomplish that end. Doe v. Shurtleff, supra. The judge found it was not:

Utah undoubtedly has a compelling interest in protecting children from internet predators and investigating online crimes, which are the stated goals of the Registry Statute. The Registry Statute appears to achieve these ends. For example, if the UDOC makes sex offenders' internet information immediately available to investigators, investigations into potential crimes originating online could be hastened. Moreover, knowing that police will have their internet information would probably discourage some sex offenders from using the internet to help them commit crimes.

The only question is whether the Registry Statute's disclosure requirements are the least restrictive means available to meet these goals. They are not. With no restrictions on how the UDOC can use or disseminate registrants' internet information, the Registry Statute implicates protected speech and criminal activity alike. An alternative statute that contained such restrictions would be similarly effective and less threatening to protected anonymous speech.

Doe v. Shurtleff, supra. The defendants asked the judge to interpret the statutes as only letting the UDOC use the Internet information a registrant provided for the purpose of conducting criminal investigations and as barring the UDOC from releasing it to the public. Doe v. Shurtleff, supra. She found that doing this would in effect require her to re-write the statute, which was a job for the Utah legislature. The judge therefore held that the Utah statute violated the First Amendment.

Would a court reach the same conclusion as to the revised Georgia statute? I don't know. The Georgia statute says the information collected pursuant to its requirements "shall be treated as private data" except that it can be disclosed to law enforcement agencies to law enforcement purposes or to agencies conducting background checks. Those don't seem particularly problematic. It also says that the Georgia Bureau of Investigation "or any sheriff maintaining" records under this legislation shall, in addition to informing the public about sex offenders living in their community, "release such other relevant information collected under this section that is necessary to protect the public concerning sexual offenders".

By Susan Brenner, Professor of Law and Technology
Follow CircleID on
Related topics: Cybercrime, Law, Privacy
SHARE THIS POST

If you are pressed for time ...

... this is for you. More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Vinton Cerf, Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Share your comments

Some key differences in the GA statute Suresh Ramasubramanian  –  Jan 27, 2009 7:56 AM PST

One good thing is that information thus gathered is "treated as private data" - and is consistent with sex offender registries. And also granted that there is a much lower bar for privacy wrt child sexual abusers, in the interests of community protection - but they do retain 1st amendment rights.

The statute declares that data collected will be

* Treated as private data

* Released (presumably, in part or as a whole based on need to know principles) to law enforcement for specific investigations, and to agencies conducting background checks.

So far so good.  The potential pitfalls are (and this is also from an enforcement Point of View - not merely from a first amendment perspective, or from the perspective of handling personally identifiable information) -

* Broad and decentralized record keeping - this should be a centralized database and subject to appropriate privacy safeguards, and with access on a need to know basis. Giving every single county sheriff's department a copy of this database carries the same risks that distributing multiple copies of any database at all .. new records may remain unupdated, or old records (say where a conviction for child abuse is overturned on appeal) may not be purged from all extant copies of the database.

* Wording such as "Release such other relevant information necessary to protect the public" is imprecise and ill defined.  And dangerous where PII has to be stored or disclosed. I do understand that disclosure while on need to know principles has to be flexible in the interests of community protection. But this wording is inappropriately vague.

* IM screen names and email addresses are quite easy to create. And internet access including IM and chat is possible from multiple, unsupervised sources (such as from open wireless connections, iphones..).  One option to detect attempts by perverts to circumvent this registry would be to install keyloggers on their PCs and other internet access devices, and work with their ISP / telecom carrier to monitor activity.  But that would certainly infringe the affected person's 1st amendment rights far more than this statute does.

Questions The Famous Brett Watson  –  Jan 27, 2009 6:56 PM PST

Susan, law is not my speciality, so I would like your opinion on a couple of points.

1. Does this requirement potentially fall afoul of constitutional protection against unreasonable search? It is rather analogous to providing law enforcement with a copy of all one's keys. Even law enforcement should face some reasonable barrier to access.

2. If law enforcement holds all the credentials for a particular party, does that not create the risk of contaminated evidence? If a party were to be charged with something on the basis of evidence obtained in this manner, might he be able to plausibly deny performing the act, placing the burden of proof on law enforcement to demonstrate that (a) their copies of his credentials were kept secure, and (b) it was not a frame-up job by over-zealous law enforcement agents?

Aside from the above questions, I would also mention in passing that laws which require offenders to cooperate with law enforcement seem like a recipe for failure.

Still Unconstitutional Nicholas Black  –  Jan 27, 2009 9:45 PM PST

Let it be noted that the judge only ruled on the First Amendment Right to anonymous speech; she did not even address the other constitutional issues raised in the complaint. She only declared them moot due to a finding of unconstitutionality.  Therefore, those issues are still alive and well.

If in fact the State of Utah revised thier statute to limit law enforcements use of the information. I, Mr. Doe, would renew all previously unaddressed issues raised in the Complaint - notably the right to be free from Fourth Amendment Right prohibiting unreasonable/unlawful search and siezure.

Unless the State of Utah, or any other law enforcement agency for that matter, can enter my premisis, or access any password proetected personal papers, for the purposes of a search or to sieze evidence of a crime they must obtain a search warrant.  The Fourth Amendment is very clear about unreasonable search and siezure not commencing without a valid search warrant.

Sorry, however, being listed as a Sex Offender for a non-internet related crime, nor being a sexual offender period, is not sufficient grounds for probable cause allowing the issuance of a search warrant.  More is needed.  I see no judge even intertaining law enofrcements request for a search warrant on a group of people, or persons, based soley on thier status as a Sex Offender without some hard evidence concluding the certain individual is committing, or has committed a new crime.

Nowhere in the Constitution of the United States, nor the Bill of Rights, does the words, "unless you are a sex offender," appear.  All right equally protect all citizens.  The purpose of these laws are not to protect children, especially not from the false and/or over-exagerated threat of online predators.  These laws are specifically desinged to allow the law enforcement to circumvent warrant requirements, and violate the rights of private citizens. 

I will fight this and other aspects of Utah's laws, especially due process protections, for years to come.  It should be noted that prior to filing my law suit I was classified as a 10-year registrant in the State of Utah.  After an assertion of the attorney representing the State of Utah in open court, and now after my successful law suit, I have been reclassified as a lifetime registrant - all without notice, opportunity to be herd, or the right to challenge this determination/change by the State of Utah concerning my military convictions.

This year you will see another lawsuit against the State of Utah for that matter - Violation of retaliation for my seeking redress of grievences against the State of Utah, and thier failure to prolgumate regulations and official procedures for clasifiying offenders convicted outside thier jurisdiction, pursuant to the Utah Adminstrative Rulemaking Act, and the Fourteenth Amendments Due Process Clause.

Mr. John Doe, Utah

Georgia not keen on the Constitution Derek Logue  –  Jan 28, 2009 11:45 PM PST

As someone who has followed sex offender laws for years, I can assure you Georgia will do everything in its power to enforce this law regardless of legal precedent. After all, Georgia's Supreme Court struck down residency laws as over-broad, punishment, exiles sex offenders from Georgia in Mann v. Georgia Dept. of Corrections, Case # S07A1043 (GA Sup Ct 2007), only to have the next legislature find a way to reinstate the same law struck down by their High Court.

I have addressed many issues specific to this issue here (I hope its okay to post a link to my site here: http://www.oncefallen.com/InternetLaws.html

But if my link is not allowed here, then I'll post my synopsis of the constitutional issues below.

First Amendment: Freedom of Speech, Assembly/ Petition, Association

Violates freedom of speech and freedom of assembly. As previously noted, the predecessors of the KIDS Act were struck down on free speech issues. In regards to the right to assembly, it can be argued that the Internet has become the primary source of information in the former offender community; without the Internet, our movement would be greatly hampered. As noted on my links page, there are numerous websites, blogs, and forums for former offenders to seek help. It is also necessary because many of the features of Internet usage is becoming the preferred method of conducting many business or even governmental transactions, from Social Security benefits to banking to buying and selling products. Also, anyone who has registered at multiple websites knows how difficult it is to keep the same screen name when 27,000 other people share variations of your screen name. Thus, the laws prevent you from actively participating in a new forum because you would have to notify law enforcement of the new changes.

Fourth Amendment: Protection against unreasonable searches and seizures.

E-Advocate makes a good argument regarding how email addresses are a part of your physical computer, and thus a warrant would be needed(http://sexoffenderresearch.blogspot.com/2008/05/folly-of-s-431-kids-
act-of-2008-part-4.html). I wish to take that analogy a step further. How about a PO Box or a safety deposit box? When we use certain services, we are renting space. The Internet is no different: we rent space on a server to collect electronic mail. Any case which upholds the need for a warrant in any other form of communication applies here as well. The Georgia law is more blatantly unconstitutional because by turning over passwords, we are doing the equivalent of handing over our PO Box and Safety Deposit Box keys without a warrant. It may be necessary in arguing the Fourth Amendment here, you may have to explain how the Internet works.

Fifth Amendment: Violates the right against self-incrimination.

There is actually a rather large debate regarding whether passwords or encrypted files fall under the Fourth or Fifth Amendment. I would argue both to cover both arguments. The debate is whether a password is like a physical key (thus a fourth amendment case) or communication (Fifth Amendment). In a way, it is both.

In Re Boucher, Case 2:06-mj-00091-jjn [US Dist. Ct. Vt. (Nov.29, 2007)]: Held that forcing a man to unlock encrypted files compels one to incriminate himself in a criminal case, thus it violates the Fifth Amendment.

Fourteenth Amendment: Due Process

The Due Process clause actually absorbs many of the points associated with the First Amendment, such as freedom of speech and right of assembly; many of the cases fall under both categories. In regards to the “right of travel,” it could be argued that the Internet is a form of “travel,” allowing us to meet in a virtual meeting place instead of in person, noting similar in form and function to telephone conferencing or conversing by postal letter.

A full list of cases to validate my argument is at my Internet Laws fact page at www.oncefallen.com.

I believe it will take a lot of convincing for Georgia to honor the Constitution.

Utah Passwords Nicholas Black  –  Feb 07, 2009 2:20 PM PST

The State of Utah House Judiciary Committee voyed and passed a bill this session to do away with the password requirements; as a result of Doe v Shurtleff.  As it stands, Georgia will be alone in this fight.

To post comments, please login or create an account.

Related

Topics

Cybersecurity

Sponsored byVerisign

DNS Security

Sponsored byAfilias

Domain Names

Sponsored byVerisign

New TLDs

Sponsored byAfilias

IP Addressing

Sponsored byAvenue4 LLC