Royal Caribbean offices in Florida. Credit: J. Albert Diaz/ ALM

Royal Caribbean Cruises Ltd. can be classified as an internet service provider that must disclose to prosecutors certain subscriber and transactional records, a federal judge in Washington ruled this month, reviving the U.S. Justice Department's effort to acquire the web data.

U.S. District Judge Beryl Howell's ruling, dated March 8, overturned a federal magistrate decision that had rejected the government's application for the records. Court papers in the case in U.S. District Court for the District of Columbia do not reveal the nature of the criminal investigation. Portions of Howell's ruling were redacted.

A team from Wilmer Cutler Pickering Hale and Dorr represented Royal Caribbean as an interested party. Wilmer partner Jonathan Cedarbaum, a cyber and privacy specialist who represented the cruise line, wasn't immediately reached for comment Wednesday.

Prosecutors in July first sought an order forcing Royal Caribbean to disclose “subscriber and transactional records” tied to web-based money transfers over the span three days on a Florida-based voyage. The requested information included subscriber and usernames, email addresses, credit card and bank numbers and records of web session times.

Royal Caribbean contracts with an internet service provider that provides satellite connectivity to passengers on the vessel. An internal communication network on the ship connects a passenger's mobile device to the web through an antenna on the ship. A private IP address is assigned communication between a device and the ship's internal network. Royal Caribbean charges passengers to access the web.

The case confronted the definition of an “electronic communication service” under the Stored Communications Act, which Congress adopted in 1986 as part of the Electronic Communications Privacy Act. Prosecutors use the law to compel a service provider to turn over customer records and contents of electronic communication.

Magistrate Judge Deborah Robinson in Washington, ruling against the government last year, concluded Royal Caribbean is neither a “provider of electronic communication service” nor a “provider of remote computing service.” Howell overturned that finding, and she granted the government's application for subscriber records.

Miami-based Royal Caribbean, Howell wrote, “provides passengers the ability to access the internet in order to, among other things, effectuate money transfers, thus making the company a provider” of electronic communication services.

Justice Department lawyers, in their objection to Robinson's order, had argued that a company can be considered a “provider” of electronic communication services” regardless of the company's primary business or function.”

Judge Beryl Howell

Howell said Royal Caribbean, and not a financial service provider, “likely is the only entity” from which the government could obtain the requested records. Any government demand for information from a financial services provider “could identify at most the particular ship from the [redacted] acted, not the particular persons who executed the funds transfers in question,” Howell wrote.

Royal Caribbean, according to court records, did not oppose the Justice Department's position that the company was an electronic communication services provider under the Stored Communications Act. The company's lawyers at Wilmer Hale noted the stored communications law contains a “broad definition” of electronic communication services.

The cruise line's attorneys said in a footnote that the company was not taking a position on whether the Stored Communications Act would “would reach records that pertain to a non-U.S.-based guest on a voyage that never entered U.S. territory, including U.S. territorial waters.”

The U.S. Supreme Court this term is exploring the international reach of the Stored Communications Act in the case United States v. Microsoft. A team from Orrick, Herrington & Sutcliffe is arguing against a U.S. warrant targeting records stored on a server in Ireland.

A ruling that Royal Caribbean was not an electronic communication services provider could have compelled prosecutors to obtain subscriber information “as ordinary business records simply using a grand jury subpoena.”

“This is a focused request that does not seek all the records pertaining to any [Royal Caribbean] passenger's use of the Target IP address over the duration of a cruise,” Howell wrote.