Please wait while the page is being loaded Skip this advertisement >
Sunday | 23 November, 2008
ARN

Amazon wins battle to protect customer records

But victory narrowed, since prosecutor obtained data through other means
Linda Rosencrance (Computerworld) 30 November, 2007 11:15:41

Amazon.com has successfully fought an attempt by US federal prosecutors to gain access to information about thousands of customers who purchased books online. But the victory was offset by the prosecutor's ability to obtain the data from a suspect's computer.

In August 2006, a US federal grand jury issued a subpoena to Amazon to turn over the records of customers who had purchased some 24,000 books over four years from Robert D'Angelo, according to court records, which have just recently been unsealed. The US Attorney's Office, which had requested the subpoena, ultimately reduced the scope of its subpoena to 120 book buyers, or 30 per year for the four years under investigation.

D'Angelo, who sold used books and CDs on Amazon, was under investigation for tax evasion and mail and wire fraud. The government did not suspect Amazon or its customers of any illegal activity, nor did the government consider the customers victims of any of D'Angelo's schemes, according to court documents.

Amazon and its customers were merely "bricks in the evidentiary wall being erected by the grand jury," said Magistrate Judge Stephen Crocker in his ruling, which was issued on June 26.

On April 25, 2007, Amazon filed a motion in the US District Court for the Western District of Wisconsin to quash the subpoena, saying that identifying any book buyers would violate their First Amendment rights to keep their reading habits private from the government. The reasoning is that people might change their book-buying habits if they thought what they read might put them on the government's "enemies list," the judge said in his ruling.

The judge said the government's subpoena was "troubling because it permits the government to peek into the reading habits of specific individuals without their prior knowledge or permission."

In addition, Crocker said, "If word were to spread over the Net -- and it would -- that the FBI and the IRS had demanded and received Amazon's list of customers and their personal purchases, the chilling effect on expressive e-commerce would frost keyboards across America."

"We have a privacy policy that protects customer privacy," said David Zapolsky, Amazon's vice president of litigation, in an interview. "And we work with law enforcement, and we'll respond to binding subpoenas, but if we have any doubt about whether the request by a law enforcement agency has the potential to violate customers' First Amendment rights, we will scrutinize it closely. And if we can't work around that problem, we'll usually ask a judge to decide whether the government's need is sufficient."

However, Amazon decided to fight the subpoena after it had already given the U.S. Attorney's office the e-mail addresses of D'Angelo's customers, said Assistant U.S. Attorney John Vaudreuil, head of the criminal division of the Madison office. However, Amazon had not given the government the names and addresses of those customers.

In its court filings, the U.S. Attorney Office's said its subpoena had nothing to do with the First Amendment because the government was not seeking the "content of D'Angelo's book sales." The government said it was only interested in proving that D'Angelo sold the books, got paid for them and subsequently mailed the books to the customers. The information the government was seeking "had nothing to do with what the book was about."

When Amazon filed the motion to quash the subpoena in April, it also asked the court to unseal the documents related to the case.

Ultimately, the judge did not grant Amazon's motion to quash the subpoena, but he refused to compel Amazon to disclose its customers' data, Zapolsky said.

Instead, the judge ordered Amazon to communicate with its customers and ask them if they would be willing to participate as witnesses in the case, Zapolsky said. The judge also refused to unseal the court documents until D'Angelo had either been indicted or the case against him had been closed, he said.

But Amazon never had to contact its customers because the government retrieved the information from D'Angelo's personal computer. "While we were putting that communication together, the government withdrew its subpoena, saying they were going to find the information by other means," Zapolsky said.

Related Stories
  • +

    True crime: The botnet barons 04 January, 2008 07:03:57

    Two weeks ago, the feds revealed the names of eight people who had used botnets to engage in nefarious activity. Here are their stories
    When federal agents announced on November 29 that they'd indicted or convicted eight individuals accused of using botnets (networks of computers infected with Trojan horse applications) to engage in criminal activity, the press release barely explained the nature and extent of the men's crimes -- or the investigations that led to arrests in an operation the FBI and other law enforcement agencies have termed Bot Roast II.
  • +

    The 2007 security hall of shame 27 December, 2007 07:47:46

    Bad breaches, ghastly gaffes and five people we'd like to forget
    How bad was 2007 for breaches, vulnerabilities and similar mayhem? On the bright side, it was better than 2008 is forecast to be. With more of every sort of meltdown predicted -- more criminalization of the hacker community, more Web-application attacks, more phishing, more spamming, more zero-day attacks and more virtualization-related threats -- we're happy to tell you that you are likely to look back on 2007 as the peaceful old days.
ARN Directory | Distributors relevant to this article
Additional Resources
ARN Library
Newsletter Subscription
Sign up for our ARN newsletters!
RSS Feeds
Market Place
 
Panel Sessions
  • ARN Panel Sessions: Day 3

    The last of our panel sessions recorded live at CeBIT 2008. Today, the topic is storage. Data is growing at an enormous rate, so what does the future hold?

Play
ARN news
Play
Channel Watch
Play
Business Continuity & Disaster Recovery Zone

When an IT disaster occurs, how handy it would be to push a button and start again as if nothing had happened.
Discover and learn more about CA XOSoft today.
ARN Vendor Directory
ARN Library

Dimension Data, La Trobe University and Windows Server 2008 partner to improve compliance

La Trobe University partnered with Dimension Data to deploy Windows Server 2008 and Network Access Protection technology to improve their existing network security solution.

Sponsored Links