US court says PSN data doesn’t get Fourth Amendment protection

In child porn case, Sony could hand info to the police without a warrant.

If you have any legally incriminating information sitting in your PSN account, don't count on the Fourth Amendment to protect it from "unreasonable search and seizure" by Sony without a warrant. A district court judge in Kansas has ruled in a recent case that information Sony finds has been downloaded to a PlayStation 3 or a PSN account is not subject to the "reasonable expectation of privacy" that usually protects evidence obtained without a warrant.

The case involves Michael Stratton, who went by the handle Susan_14 on PSN. According to Sony, Stratton was reported to PSN multiple times for sending spam messages asking about interest in child pornography. After reviewing the Susan_14 account in response to these complaints, Sony found that several images containing child porn had been downloaded by and uploaded to the account.

Sony shared information about the Susan_14 account and the images with the National Center for Missing and Exploited Children. The NCMEC then coordinated with the FBI to get additional information about Susan_14's e-mail address and IP address from Google and CenturyLink via subpoena. This action led to a warrant on Stratton's Kansas home, the discovery of child pornography stored on his PS3, and his arrest.

At trial, the defense tried to argue that Stratton had a "reasonable expectation of privacy" for the images on his PSN account and that Sony therefore couldn't share those with authorities absent a subpoena or warrant. In this case, the court ruled that Sony's PSN terms of service "explicitly nullified its users reasonable expectation of privacy." Those terms state explicitly that Sony reserves the right to monitor PSN activity and that Sony may turn over evidence of illegal activity to the authorities.

(The defense also made the related argument that Sony's terms of service were an adhesion contract that put an "unconscionable" and "patently unfairly... take-it-or-leave-it" burden on Stratton. The defense didn't provide enough evidence to demonstrate that claim, according to the court.)

Separately, the defense argued that Sony was acting as a "government agent" when it searched Stratton's PSN account, and, therefore, any evidence obtained needed to be subject to a warrant. This argument hinges in part on the federal "Failure to Report Child Abuse" statute, which requires those that learn of child abuse to "make a timely report" or suffer jail time or fines. Through this law, the defense argued, Sony was essentially being recruited to search for child pornography at the government's request and without any warrant.

But the court found that Sony was not working at the government's behest and instead "monitors its users’ accounts to protect its own interests in a safe online gaming community." Basically, the law doesn't require Sony to monitor its network for child pornography but only forces the company to report such content if it finds it. Since Sony was monitoring Stratton's account for its own benefit and in response to a use complaint, the court found that Sony was not "act[ing] on behalf of the government or subject to its control." Therefore, Sony was a private party whose search was not subject to the Fourth Amendment.
The case is not all that different from other cases in which online service providers have worked with law enforcement to report child pornography when found on their services or devices. The main difference here is that the circuit court has found that these same legal arguments apply to the tightly controlled world of the PlayStation 3 and the attached PlayStation Network and not just the more "open" world of personal computers.