Porn-possessing employee needed expert to prove screen-capture software was ‘interception’ under ECPA

By Joy P. Waltemath, J.D.

Expert testimony was necessary to establish whether a fired employee could show a contemporaneous interception of an electronic communication under the Electronic Communications Privacy Act (ECPA) had occurred when his employer installed screenshot-capturing software on his computer after it discovered evidence he was viewing child pornography on the job. Agreeing with the district court, the First Circuit reasoned that although the majority of lay persons likely would understand both email and the concept of screenshot capturing, to prove an ECPA contemporaneous “interception” would require expert testimony explaining what the screenshot-capturing software actually did when it captured a screenshot, the timing of it, what a web browser’s progress bar actually indicates, and how exactly the email system the employee was using auto-saves emails as a user drafts them. Because the employee lacked this expert testimony, the appeals court agreed that his claims against his employer failed (Boudreau v. Lussier, August 21, 2018, Torruella, J.).

Possessing child pornography at work. The employee had worked for two years for Automated Temperature Controls, Inc., (ATC) when his employer came to suspect, based on files that its IT manager inadvertently recovered while assisting the employee in recovering some work emails, that he was viewing child pornography at work. After covertly installing screenshot-capturing software on the employee’s work computer, his employer confirmed these suspicions. It then contacted law enforcement, and this eventually culminated in the employee’s arrest and plea of nolo contendere in state court to one count of possession of child pornography. Even before his plea, the employee brought claims under 42 U.S.C. § 1983 and the Electronic Communications Privacy Act against individuals who participated in the events leading up to and following his arrest, including ATC’s corporate president, its co-owner, and its IT manager (as well as several police officers and the city itself). The district court granted summary judgment to the defendants on all of the employee’s claims. The employee appealed, and the First Circuit affirmed.

ECPA claim on appeal. Although his complaint alleged that the ATC defendants illegally searched his office and office computer, as well as that they (along with several police officers) illegally seized and searched his two vehicles, on appeal his employment-related argument addressed only the district court’s holding that he had not presented sufficient evidence that his employer had violated the ECPA.

What did the employer do? When the IT manager was helping the employee recover emails on his work computer, he captured a list of “recoverable” files that had been deleted from that computer, a list that included a number of pornographic movies and photos. The IT manager told the company president, who directed him to install the screen-capture software System Surveillance Pro (SSP) on the employee’s work computer, without the employee’s knowledge. The appeals court explained that “SSP captures and saves screenshots of whatever is being displayed on the monitor of the computer on which it is installed.” The IT manager configured the software to take screenshots whenever the user of this computer typed certain keywords and arranged for SSP to send these screenshots to an email account that he had set up for that purpose.

Contemporaneous interception under the ECPA. Interception under the ECPA is “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” Every circuit court that has considered the issue has concluded that, to constitute an “intercept” within the meaning of ECPA, “the acquisition of a communication must be contemporaneous with its transmission.” The employee argued, however, for the appeals court here to adopt a “functional approach” to contemporaneity, meaning that the contemporaneity requirement would be satisfied “where the defendant used technology linked to the fleeting moment in which the victim sent the electronic communication . . . even when the transmission and acquisition might have occurred moments or even hours apart.” Examining cases from the Sixth and Seventh Circuits that the employee claimed supported this approach, the First Circuit pointed out that no, actually, they didn’t.

Must be contemporaneous. And neither would the First Circuit accept that interpretation, finding it in tension with ECPA’s definition of intercept, which includes the “acquisition of any . . . electronic . . . communication,” but does not mention “electronic storage.” Plus, Congress addressed the acquisition of no-longer-in-transit, stored communications in the Stored Communications Act. Given that ECPA does require that communications be intercepted contemporaneously, the court discussed whether the employee had sufficient evidence of contemporaneity for his complaint to survive summary judgment.

Was expert evidence necessary? The employee contended that the SSP-captured screenshots depicting the contents of his “Yahoo! Mail” inbox, opened emails from others, and emails that he had been drafting, some of which showed the web browser’s “progress bar” indicating it was loading, and some screenshots with timestamps matching the time the employee’s desktop clock had displayed, were enough to avoid summary judgment on “contemporaneity.” The district court did not agree, saying expert evidence was necessary to determine whether these screenshots showed that SSP had intercepted the employee’s communications contemporaneously.

Lay understanding of email, screenshots. On appeal, the employee argued that lay jurors, without the aid of expert testimony, “would have been well equipped to review the key evidence in this case [and] infer that SSP intercepted electronic communications”; and that screen-capture and webmail technology are commonplace and fall within “knowledge of the average lay person.” But the appeals court disagreed, reasoning that while maybe most people are familiar with email and perhaps understand the concept of capturing a screenshot that was not the inquiry here. Instead, the question was whether the employee could show that SSP contemporaneously intercepted his electronic communications relying entirely on evidence not “based on scientific, technical, or other specialized knowledge.”

There’s more to prove. The First Circuit said no, because determining whether SSP contemporaneously intercepted his communications requires more than a lay understanding of email and the concept of capturing a screenshot. A partially loaded status bar and a timestamp do not “necessarily evince contemporaneous interception,” reasoned the court. Making this determination would require “an understanding of, for example, among other things, what SSP actually does (and on what sort of time-scale it does it) when it captures a screenshot, what a web browser’s progress bar actually indicates, and how exactly Yahoo! Mail auto-saves emails as a user drafts them. That level of knowledge, we feel comfortable holding, is beyond that of lay jurors.” And the court cited ample precedent holding the same way. As such, it agreed with the district court that for the employee’s ECPA claim to survive summary judgment, he needed expert evidence concerning SSP’s purported interception of his communications.

Source:: http://www.employmentlawdaily.com/index.php/news/porn-possessing-employee-needed-expert-to-prove-screen-capture-software-was-interception-under-ecpa/