At base, the court held that a demand for an IP address must be connected with some sort of judicial proceeding, and not a simple subpoena issued by a court without any kind of review. The court stated that the demand for the IP address must “bear some possible relationship†to an investigation. That relationship can be demonstrated by requiring that the subpoena be issued as part of the grand jury process, rather than through a process in which a subpoena may be issued without any demonstration of relevance. The court refused to go further, and require that a subpoena be issued by a grand jury only upon demonstration of probable cause (the standard necessary to issue a warrant).
This decision shows the difference in privacy rights that is developing between state constitutions and the U.S. constitution. Federal courts have routinely held that there is no Constitutionally based expectation of privacy in IP addresses, while state courts are increasingly interpreting their constitutions the opposite way. Like many similar state vs. Federal issues, these different interpretations are ironic since most state constitutions are based on the Federal constitution. However state courts have a long history of interpreting their constitutions differently than the U.S. constitution.
For hosts, this decision reinforces the need to require some sort of service of process prior to disclosing information about your customers. It’s important to note that the ISP in this case, Comcast, was not a party to the suit, and not held to be liable for its response to the defective subpoena. However, what this case does illustrate is the growing body of law supporting customer’s expectation of privacy in information generated by their use of technology.
