United States Court of Appeals
For the First Circuit
No. 23-1565
JAMES HARPER,
Plaintiff, Appellant,
v.
DANIEL I. WERFEL, in his official capacity as Commissioner of
the Internal Revenue Service; INTERNAL REVENUE SERVICE; JOHN DOE
IRS AGENTS 1-10.
Defendants, Appellees.
APPEAL FROM THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF NEW HAMPSHIRE
[Hon. Joseph N. Laplante, U.S. District Judge]
Before
Kayatta, Lipez, and Gelpí,
Circuit Judges
Sheng Tao Li, with whom Richard Abbott Samp and New Civil
Liberties Alliance were on brief, for appellant.
Kathleen E. Lyon, Attorney, Tax Division, Department of
Justice, with whom David A. Hubbert, Deputy Assistant Attorney
General, Francesca Ugolini, and Jennifer Marie Rubin, Attorneys,
were on brief, for appellees.
Rodrigo Seira, Paradigm Operations LP, Omer Tene, Christopher
J.C. Herbert, Andrew Kim, Gabe Maldoff, and Goodwin Procter LLP on
brief for Paradigm Operations LP, amicus curiae.
Edward M. Wenger, John Cycon, and Holtzman Vogel Baran
Torchinsky & Josefiak PLLC on brief for Coin Center, amicus curiae.
J. Abraham Sutherland, Cameron T. Norris, Jeffrey S. Hetzel,
and Consovoy McCarthy PLLC on brief for DeFi Education Fund, amicus
curiae.
Ryan P. Mulvey, Lee A. Steven, and Americans for Prosperity
Foundation on brief for Americans for Prosperity Foundation,
amicus curiae.
Tyler Martinez and National Taxpayers Union Foundation on
brief for National Taxpayers Union Foundation, amicus curiae.
September 24, 2024
LIPEZ, Circuit Judge. This appeal addresses a so-called
"John Doe" summons issued by the Internal Revenue Service ("IRS")
to Coinbase, a cryptocurrency exchange, seeking Coinbase's records
containing information about numerous Coinbase customers,
including appellant James Harper. Harper contends that the IRS's
investigative efforts infringed his privacy and property rights in
contravention of the Fourth and Fifth Amendments. Invoking the
Administrative Procedure Act ("APA"), he also asserts that the
summons did not satisfy statutory requirements for issuing a John
Doe summons. See 26 U.S.C. § 7609(f).
The district court dismissed Harper's complaint,
concluding, as pertinent to his constitutional claims, that he
lacked a reasonable expectation of privacy in his Coinbase account
information, and that Coinbase's records were not his property.
It further concluded that, in any event, the IRS summons was
reasonable, and Harper had received constitutionally adequate
process. The court also rejected Harper's statutory challenge,
dismissing it as an improper collateral attack on prior district
court proceedings enforcing the summons and finding the IRS summons
to satisfy the statutory standard.
We agree that Harper lacks a protectable interest under
the Fourth or Fifth Amendment, and thus affirm on that basis.
Finding that he has not raised a challenge to final agency action,
- 3 -
as required to mount an APA claim, we affirm the dismissal of his
statutory claim as well.
I.
A. Factual Background
Because we review the dismissal of Harper's complaint,
we draw our recitation of the facts from Harper's well-pleaded
allegations, assuming their truth and drawing all reasonable
inferences in Harper's favor. See, e.g., Legal Sea Foods, LLC v.
Strathmore Ins. Co., 36 F.4th 29, 30, 34 (1st Cir. 2022).
Harper opened a Coinbase account in 2013. Coinbase is
a digital currency exchange that facilitates transactions between
accountholders. In 2013 and 2014, Harper made several deposits of
Bitcoin, a popular digital currency, into his Coinbase account.1
In 2015, Harper began liquidating his Bitcoin holdings or
transferring them from Coinbase to a hardware wallet.2 By early
1 Harper primarily received this Bitcoin as income from
consulting work. Harper alleges that he properly reported to the
IRS all Bitcoin he received and properly reported all capital gains
or losses associated with his Bitcoin holdings in the ensuing
years. This appeal does not involve any challenge to those
assertions.
2A hardware wallet is an offline device, often resembling a
USB thumb drive, used to store the "private keys" necessary for a
digital currency user to transact digital currency. See Harper v.
Rettig, 46 F.4th 1, 3 n.3 (1st Cir. 2022) (quoting Virtual Currency
Storage, IRM 5.1.18.20.2 (July 17, 2019)). This "'secure offline'
version of a virtual currency wallet," in comparison to a software
wallet downloaded to a computer or mobile device, is "immune to
computer viruses," does not allow private keys to be transferred
in unencrypted fashion, and "is not open source," thus making the
- 4 -
2016, Harper no longer had any Bitcoin holdings in his Coinbase
account.3
In 2019, Harper received a letter from the IRS informing
him that the agency "ha[s] information that you have or had one or
more accounts containing virtual currency but may not have properly
reported your transactions involving virtual currency." Harper
alleges that the IRS's letter refers to information the agency
obtained via a "John Doe" summons the agency issued to Coinbase in
2016. A John Doe summons is an ex parte third-party summons issued
"where the IRS does not know the identity of the taxpayer[s] under
investigation." Tiffany Fine Arts, Inc. v. United States, 469
U.S. 310, 316 (1985) (emphasis omitted). Such a summons may only
issue following a court proceeding in which the IRS establishes
that certain statutory criteria have been satisfied,4 and the
device a highly secure alternative for transacting digital
currency.
Id.
3 In his amended complaint, Harper also describes Bitcoin
transactions made through two other exchanges, Abra and Uphold.
His association with these two exchanges is not relevant to the
issues in this appeal.
4 These factors are:
(1) the summons relates to the investigation
of a particular person or ascertainable group
or class of persons,
(2) there is a reasonable basis for believing
that such person or group or class of persons
may fail or may have failed to comply with any
provision of any internal revenue law, and
(3) the information sought to be obtained from
the examination of the records or testimony
- 5 -
summons must be "narrowly tailored to information that pertains to
the failure (or potential failure) of the [individuals targeted by
the summons] to comply with [the tax code]." 26 U.S.C. § 7609(f).
Initially, the 2016 John Doe summons sought information
on all United States Coinbase accountholders who conducted digital
currency transactions between 2013 and 2015. See United States v.
Coinbase, Inc., No. 17-cv-01431, 2017 WL 5890052, at *1 (N.D. Cal.
Nov. 28, 2017). The agency requested several categories of
documents, including "complete user profiles, know-your-customer
due diligence, documents regarding third-party access, transaction
logs, records of payments processed, correspondence between
Coinbase and Coinbase users, account or invoice statements,
records of payments, and exception records produced by Coinbase's
AML system."
Id. Coinbase opposed the summons, and the IRS filed
a petition to enforce the summons in the United States District
Court for the Northern District of California. See generally
id.
The agency subsequently and voluntarily narrowed the
summons to encompass only users who had engaged in $20,000 worth
of any one type of digital currency transaction (buying, selling,
sending, or receiving) in any one calendar year. Id. at *2. As
(and the identity of the person or persons
with respect to whose liability the summons is
issued) is not readily available from other
sources.
26 U.S.C. § 7609(f).
- 6 -
narrowed, the summons targeted 14,355 Coinbase accounts, seeking
the following records: (1) registration information "limited to
name, address, tax identification number, date of birth, account
opening records, copies of passport or driver's license, all wallet
addresses, and all public keys for all accounts/wallets/vaults";
(2) know-your-customer due diligence; (3) "[a]greements or
instructions granting a third-party access, control, or
transaction approval authority"; (4) account "activity including
transaction logs or other records identifying the date, amount,
and type of transaction (purchase/sale/exchange)," the names of
counterparties to the transaction, and certain Coinbase account
information of those counterparties; (5) "[c]orrespondence between
Coinbase and the user" or authorized third parties; and (6) "[a]ll
periodic statements of account or invoices (or the equivalent)."
Id.
Coinbase continued to oppose the narrowed summons.5 See
id. The court enforced the summons in part, finding the agency
was justified, under
26 U.S.C. § 7602(a), which authorizes the IRS
to issue summonses to "ascertain[] the correctness of any return,
5 The court allowed a John Doe to intervene in the proceedings,
and it also permitted three amici to file briefs opposing the
summons. See Coinbase, 2017 WL 5890052, at *1, *3. Harper
participated in the filing of one of these briefs, though he did
so in a professional capacity and not, so far as the record
reveals, based on a belief that his account information was
implicated by the summons.
- 7 -
mak[e] a return where none has been made, determin[e] the liability
of any person for any internal revenue tax or ... collect[] any
such liability," in obtaining the following documents: (1) the
taxpayer ID number, (2) name, (3) date of birth, (4) address,
(5) "records of account activity including transaction logs or
other records identifying the date, amount, and type of transaction
(purchase/sale/exchange), the post transaction balance, and the
names of counterparties to the transaction," and (6) "all periodic
statements of account or invoices (or the equivalent)." Coinbase,
2017 WL 5890052, at *8-9.6 Neither party appealed the court's
enforcement order.
B. Procedural History
After receiving the IRS letter, Harper filed a complaint
in the United States District Court for the District of New
Hampshire,7 alleging violations of the Fourth and Fifth Amendments
and seeking a declaration that the John Doe summons did not satisfy
the § 7609(f) factors. As the district court put it, "[a]t its
core, Harper's request for declaratory or injunctive relief seeks
6As narrowed by the district court, the summons thus excluded
several categories of information originally sought by the IRS,
including "[r]ecords of Know-Your-Customer diligence,"
"[a]greements or instructions granting a third-party access,
control, or transaction approval authority," and "[c]orrespondence
between Coinbase and the user or any third party." Id. at *7.
7 Harper's amended complaint names as defendants the IRS, the
Commissioner of the IRS, and 10 John Doe IRS agents. We refer to
these parties collectively as "the IRS."
- 8 -
to compel the IRS to return or destroy the records it received
from Coinbase relating to his account." Harper v. Rettig, 675 F.
Supp. 3d 190, 199 n.18 (D.N.H. 2023). The district court dismissed
the complaint, see Harper v. Rettig ("Harper I"), No. 20-cv-771,
2021 WL 1109254, at *3-5 (D.N.H. Mar. 23, 2021), on the ground
that it lacked jurisdiction under the Anti-Injunction Act, which
provides that "no suit for the purpose of restraining the
assessment or collection of any tax shall be maintained in any
court by any person,"
26 U.S.C. § 7421(a). We vacated that
judgment, however, concluding that Harper's contention that "the
IRS acquired [and retained his financial information] in violation
of the Constitution and 26 U.S.C § 7609(f)" did not relate to the
collection or assessment of a tax. Harper v. Rettig ("Harper II"),
46 F.4th 1, 8 (1st Cir. 2022).
The IRS again moved to dismiss, under Federal Rule of
Civil Procedure 12(b)(6), arguing that Harper had failed to state
a claim for a variety of reasons. The district court agreed. See
Harper ("Harper III"), 675 F. Supp. 3d at 213. In dismissing
Harper's Fourth Amendment claim, the court held that Harper lacked
a reasonable expectation of privacy in information he voluntarily
divulged to Coinbase and that Coinbase's records regarding his
account activity were Coinbase's property, not Harper's. Id. at
200-04. The court also held, in the alternative, that the summons
was reasonable because it complied with the requirements for IRS
- 9 -
summonses laid out in United States v. Powell, 379 U.S. 48, 57
(1964).8 See Harper III, 675 F. Supp. 3d at 203-05. The district
court rejected Harper's Fifth Amendment claim on largely similar
grounds, holding that because Harper lacked a privacy-based or
property interest in his Coinbase account information, he had
suffered no deprivation giving rise to due process protection.
See id. at 206-07. Alternatively, the court found that Harper had
received constitutionally adequate process. See id. at 207-08.
Finally, the court dismissed Harper's statutory claim,
"assum[ing], without deciding," that he was entitled to judicial
review under the APA but concluding that his effort was an improper
collateral attack on the prior order by the Northern District of
California enforcing the summons and holding that the summons
8 In Powell, the Court held that, under 26 U.S.C. § 7602, "the
[IRS] Commissioner need not meet any standard of probable cause to
obtain enforcement of his summons . . . . He must show that the
investigation will be conducted pursuant to a legitimate purpose,
that the inquiry may be relevant to the purpose, that the
information sought is not already within the Commissioner's
possession, and that the administrative steps required by the Code
have been followed."
379 U.S. at 57-58. As Harper notes, Powell
thus concerned only the statutory requirements pertaining to IRS
summonses and was not a Fourth Amendment case. The district
court observed, however, that several circuits have concluded that
satisfaction of the Powell requirements is enough to show that the
summons was reasonable under the Fourth Amendment. See Harper
III, 675 F. Supp. 3d at 204-05 (collecting examples). We have
said the same in dicta. See United States v. Allee,
888 F.2d 208,
213 n.3 (1st Cir. 1989). Because Harper lacked an interest
protected by the Fourth Amendment, see infra section II.A, we need
not determine whether satisfaction of the Powell factors also, by
extension, satisfies the Fourth Amendment reasonableness
requirement.
- 10 -
satisfied the § 7609(f) factors. Id. at 210; see also id. at 209-
13. This timely appeal ensued.
II.
We review de novo the district court's dismissal of all
three of Harper's claims. See Legal Sea Foods, 36 F.4th at 34.
A. Fourth Amendment
The Fourth Amendment protects "[t]he right of the people
to be secure in their persons, houses, papers, and effects, against
unreasonable searches and seizures." U.S. Const. amend. IV. A
"search," as conceived in the context of the Fourth Amendment, can
take two forms: it may be an intrusion upon a person's reasonable
expectations of privacy, see, e.g., Katz v. United States, 389
U.S. 347, 351 (1967), or it may involve a "physical[] intru[sion]
on a constitutionally protected area," Carpenter v. United States,
585 U.S. 296, 304 (2018) (quoting United States v. Jones,
565 U.S.
400, 405, 406 n.3 (2012)). Harper relies upon both theories in
support of his Fourth Amendment claim: he had a reasonable
expectation of privacy in his Coinbase account information, and
his account records were his personal property, which he had
transferred to Coinbase as a "bailment." We address each
contention in turn.
1. Reasonable Expectation of Privacy
Under a privacy-based theory, "the application of the
Fourth Amendment depends on whether the person invoking its
- 11 -
protection can claim a justifiable, a reasonable, or a legitimate
expectation of privacy that has been invaded by government action."
Smith v. Maryland, 442 U.S. 735, 740 (1979) (internal quotation
marks omitted) (collecting cases). This "reasonable-expectation-
of-privacy" inquiry contains subjective and objective elements:
"the individual [must] 'exhibit[] an actual (subjective)
expectation of privacy,'"
id. (quoting Katz,
389 U.S. at 361
(Harlan, J., concurring)), and "the individual's expectation,
viewed objectively, [must be] 'justifiable' under the
circumstances,"
id. (quoting Katz,
389 U.S. at 353). Because
Harper's complaint makes clear that he expected his Coinbase
account information to remain confidential, his privacy-based
theory turns on whether his expectation of privacy was justified
under controlling law.
The Supreme Court "consistently has held that a person
has no legitimate expectation of privacy in information he
voluntarily turns over to third parties." Id. at 743-44
(collecting cases). This principle holds true "even if the
information is revealed on the assumption that it will be used
only for a limited purpose and the confidence placed in the third
party will not be betrayed." Id. at 744 (quoting United States v.
Miller, 425 U.S. 435, 443 (1976)). Of particular relevance here,
the Court held in Miller that an individual has no legitimate
expectation of privacy in "information kept in bank records," as
- 12 -
these documents, "including financial statements and deposit
slips, contain only information voluntarily conveyed to the banks
and exposed to their employees in the ordinary course of business."
425 U.S. at 442; see also
id. at 444 (restating its conclusion
that "no Fourth Amendment interests of the depositor are implicated
here").
We agree with the IRS (and the district court) that the
account information obtained by the agency in this case falls
squarely within this "third party doctrine" line of precedent.
See, e.g., United States v. Gratkowski, 964 F.3d 307, 312 (5th
Cir. 2020) (holding, under Miller and Smith, that a Coinbase user
lacks a reasonable expectation of privacy in Coinbase account
information). All the information revealed to the IRS pursuant to
the enforced summons -- personal identifiers such as taxpayer
identification number, name, and address; records of account
activity such as transaction logs; and statements -- is directly
analogous to the bank records at issue in Miller -- checks, deposit
slips, and financial statements. See id.; see also Miller,
425
U.S. at 444 (comparing the subpoena in that case to a third-party
IRS summons targeting a financial institution's depositors and
stating, in dicta, that "an [IRS] summons directed to a third-
party bank does not violate the Fourth Amendment rights of a
depositor under investigation"); Donaldson v. United States,
400
U.S. 517, 522 (1971) (similar); S.E.C. v. Jerry T. O'Brien, Inc.,
- 13 -
467 U.S. 735, 743 (1984) (relying on the third-party doctrine to
reject a Fourth Amendment challenge to third-party subpoena of
financial records). In fact, Coinbase's terms of service expressly
warn accountholders of the possibility of disclosure to law
enforcement.
Revealingly, Harper's first line of attack against
application of the third-party doctrine here is to invoke sentiment
by academics and individual Supreme Court justices that the
"doctrine is not only wrong, but horribly wrong." Carpenter, 585
U.S. at 388 (Gorsuch, J., dissenting) (quoting Orin Kerr, The Case
for the Third–Party Doctrine,
107 Mich. L. Rev. 561, 563 n.5, 564
(2009)); see also Jones,
565 U.S. at 417 (Sotomayor, J.,
concurring) ("[The third-party doctrine] is ill suited to the
digital age, in which people reveal a great deal of information
about themselves to third parties in the course of carrying out
mundane tasks."). But, of course, we are bound to faithfully apply
Supreme Court precedent notwithstanding the concerns of scholars
and some justices.
Harper's arguments against "extending" the third-party
doctrine to digital currency exchanges are no more convincing.
Harper relies primarily on Carpenter, in which the Supreme Court
held that an individual has a reasonable expectation of privacy in
cell-site location information ("CSLI"), which is a time-stamped
record of a cell phone user's approximate location generated each
- 14 -
time the cell phone connects to the wireless network. See 585
U.S. at 300-01, 315-16. Those records typically are created
several times every minute, whether or not the cell phone user is
even actively using the phone. See
id. at 300-01. The CSLI in
Carpenter has little in common, however, with Harper's Coinbase
account information. An individual's CSLI amounts to a "detailed
chronicle of a person's physical presence compiled every day, every
moment, over several years," "implicat[ing] privacy concerns far
beyond those considered in Smith and Miller."
Id. at 315. By
contrast, the information contained in financial records like
those at issue here, even several years' worth of them, does not
paint nearly so detailed a portrait of an individual's daily
activity. While such records may capture some intimate
information, the same is true of traditional bank records, and yet
the Miller Court had no trouble concluding that a subpoena of such
records does not impermissibly intrude upon "intimate areas of an
individual's personal affairs."
425 U.S. at 444 n.6 (quoting Cal.
Bankers Ass'n v. Shultz,
416 U.S. 21, 78 (1974) (Powell, J.,
concurring)).
Additionally, the Carpenter Court noted that CSLI "is
not truly 'shared' as one normally understands the term."
Carpenter, 585 U.S. at 315. Carrying a cell phone is
"indispensable to participation in modern society," and "a cell
phone logs a cell-site record by dint of its operation, without
- 15 -
any affirmative act on the part of the user beyond powering up."
Id. Plainly, participating in a digital currency exchange is not
"indispensable,"
id., certainly no more so than having a
traditional bank account. And transactions on Coinbase occur only
when a user opts into that activity, unlike a cellphone
automatically pinging a cell site, even while passively sitting in
the user's pocket. See Gratkowski,
964 F.3d at 312 (similarly
distinguishing Coinbase records from CSLI because "Coinbase
records are limited" and "transacting Bitcoin through
Coinbase . . . requires an 'affirmative act on [the] part of the
user'" (quoting Carpenter,
585 U.S. at 315)).
Harper also cites United States v. Warshak, 631 F.3d
266, 287-88 (6th Cir. 2010), in which the Sixth Circuit held that
individuals have a legitimate expectation of privacy in the
contents of their emails, notwithstanding the third-party
doctrine. In that case, federal agents obtained a criminal
defendant's emails via a subpoena served on his internet service
provider, which stored the email content in the process of
delivering messages sent by or to the defendant, not unlike a mail
carrier delivering a letter.
Id. The court distinguished Miller
because as an "intermediary" of emails, rather than the "intended
recipient," the internet service provider holding those emails did
not "put th[at] information to use 'in the ordinary course of
business'" in the same manner that a financial institution
- 16 -
generates and uses its records regarding account activity as a
core component of its business model. Id. at 287-88 (quoting
Miller,
425 U.S. at 442). Here, by contrast, the IRS summonsed
business records much like those in Miller, generated by Coinbase
in its "ordinary course of business" as a financial institution
and consisting of information "voluntarily conveyed to
[Coinbase]." Miller,
425 U.S. at 442; see also
id. at 440 (noting
that the account information at issue "pertain[ed] to transactions
to which the bank was itself a party" (quoting Cal. Bankers Ass'n,
416 U.S. at 52)).
Finally, we disagree with Harper's contention that
Miller is distinguishable because "[c]ryptocurrency transactions
are confidential by nature" thanks to the anonymity of the
blockchain, a pseudonymized public ledger of all Bitcoin
transactions.9 We do not doubt that because digital currency
9Several amici elaborate on this concern. As they explain,
transactions are registered on the blockchain for all to see, using
a pseudonymous "wallet address," derived from a "public key,"
associated with each party to the transaction. If a person's
identity becomes associated with an address or public key, thus
piercing the veil of anonymity, anyone aware of that information
can easily ascertain all transactions the person has made using
that address -- or track future transactions. Though the IRS
disputed at oral argument that any wallet addresses or public keys
were included in the information the IRS obtained, we agree with
Harper and his amici that exposure of this information was a
reasonably likely consequence of the IRS summons, either directly
or by analyzing the transaction data that was included.
Ultimately, however, our agreement with Harper on this point makes
no difference in our conclusion that he lacked a reasonable
expectation of privacy.
- 17 -
transactions are recorded on a public ledger, exposure of a
person's identity opens a potentially wide window into that
person's financial activity contained on that ledger. But that
possibility does not alter our conclusion that the information at
risk of exposure -- all concerning financial transactions -- is,
fundamentally, much more analogous to the financial information at
issue in Miller than to the uniquely comprehensive, locational
data at issue in Carpenter.
Indeed, we fail to see how the decision to transmit
financial information to the public -- even
pseudonymously -- makes the expectation of privacy more reasonable
than doing so privately, given the heightened consequences of
exposure that Harper identifies. In other words, even if Harper
chose to transact Bitcoin because he felt the technology would
protect his privacy more than traditional banking (and his
complaint does not allege as much), that choice would only inform,
subjectively speaking, whether "he [sought] to preserve
[something] as private," Katz, 389 U.S. at 351, not whether his
expectation of privacy was objectively legitimate. The fact
remains that Harper voluntarily divulged information about his
Bitcoin transactions to Coinbase. Indeed, Harper could have
bypassed a digital currency exchange like Coinbase and conducted
his Bitcoin transactions through decentralized, peer-to-peer
transactions, which "maintain [the] high level of privacy"
- 18 -
associated with the blockchain but require specialized software
and greater technical proficiency. Gratkowski, 964 F.3d at 312-
13. Instead, Harper evidently chose "to sacrifice some privacy"
in return for use of an intermediary, a more convenient method of
transacting Bitcoin that "requires [less] technical expertise."
Id.10
Because Harper lacked a reasonable expectation of
privacy in his Coinbase account information, we reject his privacy-
based theory for his claim of a Fourth Amendment violation.
Harper also argues that Miller and Gratkowski are
10
distinguishable because they involved subpoenas concerning one
person, whereas here the IRS's summons concerned numerous Coinbase
accounts. But in support of that argument, Harper relies primarily
on a pre-Miller case from the Third Circuit that merely states, as
a general principle, that the government may not engage in "fishing
expedition[s]," United States v. Dauphin Deposit Tr. Co., 385 F.2d
129, 131 (3d Cir. 1967), a protection rooted in the Fourth
Amendment's reasonableness requirement and thus irrelevant to the
reasonable-expectation-of-privacy inquiry as it pertains to
whether Harper, as an individual, reasonably expected his
information to remain private. Harper correctly notes in his reply
brief that in United States v. Knotts,
460 U.S. 276, 284 (1983),
the Supreme Court reserved the question of whether the third-party
doctrine applies to "dragnet type law enforcement practices." But
the Court never suggested in that case (or in the forty years
since) that an individual's expectation of privacy is somehow
stronger in cases involving multiple targets, notwithstanding that
individual's decision to turn over that information to third
parties. Simply put, thus, neither Knotts nor Dauphin provides
any reason to disregard our straightforward application of Miller
to conclude that Harper lacked a reasonable expectation of privacy
in information he voluntarily turned over to Coinbase.
- 19 -
2. Property
Harper also argues, in effect, that his Coinbase account
records, though in Coinbase's possession, were his "private
papers," and thus the IRS's inspection of this information was
akin to an intrusion on his personal property, giving rise to
Fourth Amendment protections. Harper's novel theory relies
heavily on Justice Gorsuch's solo dissenting opinion in Carpenter.
See 585 U.S. at 397-406. Though Justice Gorsuch did not agree
with the majority that the defendant had a reasonable expectation
of privacy in his CSLI notwithstanding the third-party doctrine,
Justice Gorsuch argued that he might have had a property interest
in his CSLI that could serve as the basis for his Fourth Amendment
claim.
Id. at 405-06; see also
id. at 397-404 (discussing why a
property-based approach, rather than a reasonable-expectation-of-
privacy standard, is, in Justice Gorsuch's view, a preferable
method for resolving Fourth Amendment claims).
Relying on Justice Gorsuch's supposition, Harper argues
that he has a property interest in his Coinbase account records.
Yet, despite Justice Gorsuch's recognition that any such interest
needs to be anchored in law, Harper makes no effort in his opening
brief to explain the legal source of the interest he asserts.11
11At oral argument, Harper's counsel did point to references
in Coinbase's terms of service to "information about your
transactions," "your personal information," and "your account
information," arguing that these phrases reflect a contractual
- 20 -
See Carpenter, 585 U.S. at 405-06 (Gorsuch, J., dissenting)
(concluding, based on an analysis of
47 U.S.C. § 477, that
"customers have substantial legal interests in [CSLI], including
at least some right to include, exclude, and control its use,"
that "might even rise to the level of a property right," but adding
that the defendant "offered no analysis . . . of what rights state
law might provide him"); see also Cahoon v. Shelton,
647 F.3d 18,
28 (1st Cir. 2011) ("A court tasked with determining whether a
constitutionally protected property interest exists must look to
'existing rules or understandings that stem from an independent
source such as state law.'" (quoting Bd. of Regents of State
Colls. v. Roth, 408 U.S. 564, 577 (1972))). Harper simply asserts
that the property interest exists because these records are his
"papers," but his facile reliance on that word from the text of
the Fourth Amendment is inadequate, as "[p]roperty
interests . . . are not created by the Constitution." Roth,
408
U.S. at 577; see also Cahoon,
647 F.3d at 29 ("A party's unilateral
expectation, in itself, cannot create a constitutionally protected
property interest.").
understanding that the information belonged to Harper. Putting
aside that arguments made for the first time at oral argument are
waived, see, e.g., Guardado v. United States, 76 F.4th 17, 23 n.4
(1st Cir. 2023), we perceive an obvious difference between a
reference to "your information," meaning information about Harper,
some of which was provided by him but some of which Coinbase
collected in the course of his account activity, and the actual
records generated and held by Coinbase based on that information.
- 21 -
Harper's failure to elaborate on the nature of his
purported property right is especially significant because his
property-based claim faces significant headwinds in Supreme Court
precedent. In Miller, the Court remarked that, with no ability to
assert ownership or possession, the respondent could not claim the
financial records as his own "private papers." 425 U.S. at 440.
They were "[i]nstead . . . the business records of the banks," as
"all of the records [which must be retained under the Bank Secrecy
Act] pertain[ed] to transactions to which the bank was itself a
party."
Id. (quoting Ca. Bankers Ass'n,
416 U.S. 21, 52 (1974));
cf. Donaldson,
400 U.S. at 523 (stating that a taxpayer had "no
proprietary interest of any kind" in records "owned by [a] third
person, which are in [the third person's] hands, and which relate
to the third person's business transactions with the taxpayer").
The same logic applies here.
Thus, while Harper asserts that Coinbase is merely a
"bailee" of his financial records,12 his allegations tell a
different story. Most of the records included in the summons, as
ultimately enforced, appear to be documents generated by Coinbase,
such as records of transactions that Coinbase facilitated and
12As Justice Gorsuch explained in his Carpenter dissent, "[a]
bailment is the 'delivery of personal property by one person (the
bailor) to another (the bailee) who holds the property for a
certain purpose.'" 585 U.S. at 399 (emphasis removed) (quoting
Black's Law Dictionary 169 (10th ed. 2014)).
- 22 -
periodic account statements. Other information
obtained -- taxpayer ID number, name, birthdate,
address -- appears to simply be basic biographical information
necessary to open a Coinbase account. Given the Miller Court's
rejection of such financial records as an individual's "private
papers" rather than the property of the financial institution, we
see no basis to conclude that the IRS intruded upon Harper's
protected property rights.
None of the cases Harper cites compels a different
result. The decisions in Warshak, 631 F.3d at 287, and United
States v. Ackerman,
831 F.3d 1292, 1304 (10th Cir. 2016), both
concerning emails, analyzed the Fourth Amendment question under
the reasonable-expectation-of-privacy standard, not under a
property-based approach. And in Carpenter v. United States,
484
U.S. 19, 26-27 (1987);13 Ruckelshaus v. Monsanto Co.,
467 U.S. 986,
1001-04 (1984); and Boyd v. United States,
116 U.S. 616, 638
(1886), all cases recognizing a property interest in business
records or personal papers, it was clear, unlike here, that the
asserted property belonged to the party claiming the interest.14
Not to be confused with the 2018 Carpenter v. United States
13
cited extensively in our reasonable-expectation-of-privacy
analysis.
14Boyd, for instance, concerned the "compulsory production
of [the defendant's] private papers," namely, the defendant's
personally held records of invoices concerning the importation of
several cases of glass. 116 U.S. at 622.
- 23 -
Similarly, Jones, 565 U.S. at 404 n.2, 405-11, and Ex Parte
Jackson,
96 U.S. 727, 723 (1878), both involved property bailments,
whereas here, as explained, Coinbase was not in possession of
Harper's property. The summonsed records were its own.
Accordingly, we agree with the district court that
Harper lacked a constitutionally protected property interest in
Coinbase's records related to his account.
…
In sum, Harper had neither a reasonable expectation of
privacy in the Coinbase account information nor a cognizable
property interest in Coinbase's records. Because Harper's Fourth
Amendment claim fails at this threshold, we need not assess whether
the summons was reasonable under Fourth Amendment principles.
B. Fifth Amendment
Harper next argues that the IRS violated his Fifth
Amendment right to procedural due process when it used the summons
to obtain his Coinbase account records without providing him notice
or an opportunity to be heard. See U.S. Const. amend. V ("No
person shall . . . be deprived of life, liberty, or property,
without due process of law."); Aponte-Rosario v. Acevedo-Vilá, 617
F.3d 1, 9 (1st Cir. 2010) ("[T]he essential requirements of
procedural due process include adequate notice and an opportunity
to be heard 'at a meaningful time and in a meaningful manner.'"
- 24 -
(quoting Amsden v. Moran, 904 F.2d 748, 753 (1st Cir.1990))).15 To
establish an entitlement to these procedural protections, Harper
must first show that the IRS deprived him of an interest protected
by the Due Process Clause, namely, his property or his liberty.
See Roe v. Lynch,
997 F.3d 80, 85 (1st Cir. 2021). While Harper
argues that the summons deprived him of his property right in his
Coinbase account records, he acknowledges that his purported
property interest is no different from the one we rejected in
connection with his Fourth Amendment claim. We thus limit our
discussion to Harper's theory that the IRS deprived him of a
protected Fifth Amendment liberty interest in the privacy of his
financial information.
In sourcing his claimed right to privacy, Harper relies
principally on Whalen v. Roe, 429 U.S. 589, 598-604 (1977), in
which the Supreme Court recognized that the Due Process Clause's
protection of liberty includes "avoiding disclosure of personal
matters," including, to some degree, "disclosures to
representatives of the State."
Id. at 599, 602. Despite that
recognition, the Supreme Court upheld a state statute requiring
15 While many of the precedents we discuss concern the Due
Process Clause of the Fourteenth Amendment, "the language and
policies of the Due Process Clauses of the Fifth and Fourteenth
Amendments are essentially the same," and thus "due process cases
decided under the Fourteenth Amendment provide guidance in due
process cases arising under the Fifth Amendment." United States
v. Neto, 659 F.3d 194, 201 n.7 (1st Cir. 2011) (quoting United
States v. Bohn,
281 F. App'x 430, 434 n.4 (6th Cir. 2008)).
- 25 -
physicians to disclose to the government the identities of patients
to whom they prescribed certain controlled substances, explaining,
as most relevant here, that such disclosure was not "meaningfully
distinguishable" from other "disclosures of private medical
information to doctors, to hospital personnel, to insurance
companies, and to public health agencies [that] are often an
essential part of modern medical practice" and was thus not "an
impermissible invasion of privacy." Id. at 602. Harper also cites
Nixon v. Adm'r of Gen. Servs., 433 U.S. 425 (1977), in which the
Supreme Court recognized that the president has a "legitimate
expectation of privacy" in "matters of personal life unrelated to
any [official] acts," although the Court once again rejected the
underlying due process claim, finding that privacy interest
outweighed by the public interest in archiving the official records
with which that private information was intermingled.
Id. at 457-
58, 465. We have likewise recognized a due process "right of
confidentiality," though we have cautioned that such a right does
not "extend[] beyond prohibiting profligate disclosure of medical,
financial, and other intimately personal data." Vega-Rodriguez v.
P.R. Tel. Co.,
110 F.3d 174, 183 (1st Cir. 1997). Thus, in that
case, we rejected a due process challenge to a state agency's video
surveillance of its employees in the workplace, reasoning that
"[a]ny data disclosed . . . ha[d] been revealed knowingly by the
[employees] to all observers (including the video cameras)," and
- 26 -
therefore "cannot be characterized accurately as 'personal' or
'confidential.'" Id. at 183.
Harper is correct that these cases establish that the
substantive component of the Due Process Clause protects a limited
liberty interest in the confidentiality of certain intimate
information. And we can assume, without deciding, that Harper
also is correct that this protectable privacy interest may
encompass certain sensitive financial information. Even with that
assumption, however, Harper's claim that the IRS deprived him of
such a liberty interest nonetheless fails because -- as we already
have concluded -- he lacked any reasonable expectation of privacy
in the circumstances here. See supra Section II.A.1. In other
words, because Harper could not reasonably expect Coinbase, faced
with an IRS summons, to withhold the type of financial information
he chose to submit to the company (or the related Coinbase
records), Harper lacks a cognizable due process interest in the
confidentiality of those records.16
The district court held that Harper's assertion of a
16
protected liberty interest failed because there is no liberty
interest in the privacy of financial information generated and
held by a third-party financial institution like Coinbase. See
Harper III, 675 F. Supp. 3d at 206. Our holding is more limited.
Starting with the assumption that the Due Process Clause protects
some kinds of personal financial information, we conclude only
that Harper lacks a Fifth Amendment privacy interest in the
specific financial information he voluntarily gave to Coinbase.
We do not consider whether individuals would have a due process
liberty interest in the same type of information in different
circumstances, or whether other types of personal financial
- 27 -
While Harper argues that our reasonable-expectation-of-
privacy analysis is inapplicable to the due process context, that
assertion is belied by precedent. In Whalen, for example, the
Supreme Court found no privacy violation because the information
sought by the state was already routinely disclosed to other
parties. See 429 U.S. at 878. Similarly, in Nixon,
433 U.S. at
465, the Supreme Court analyzed the president's privacy interest
through the prism of his "legitimate expectation of privacy." And
in Payne v. Taslimi,
998 F.3d 648, 657 (4th Cir. 2021), and Walls
v. City of Petersburg,
895 F.2d 188, 192 (4th Cir. 1990), which
concern the disclosure of financial data, and upon which Harper
also relies, the first step of the Fourth Circuit's due process
inquiry was to determine whether there was a reasonable expectation
of privacy. Accordingly, having already concluded that Harper
lacked any reasonable expectation of privacy in his Coinbase
account information, we cannot say that Harper has been "deprived"
of a constitutionally protected privacy interest by the disclosure
of that information to the IRS.17
information would be protected by the Fifth Amendment even when
voluntarily transferred to a third-party financial institution.
Because Harper fails to assert a cognizable liberty interest even
with the benefit of our assumption that financial records may give
rise to such an interest, we choose to affirm the district court's
dismissal of his Fifth Amendment claim without further examining
the extent to which the Due Process Clause protects the
confidentiality of personal financial information.
17To be sure, Whalen discussed two constitutionally protected
forms of confidentiality: nondisclosure to the government and
- 28 -
We note, moreover, that the disclosure of Coinbase's
transaction logs and account statements to the IRS for
investigative purposes, pursuant to a twice-narrowed summons and
a judicial enforcement order, would hardly seem to count as
"profligate," as we have said it must be to implicate a protected
liberty interest in the confidentiality of information. Vega-
Rodriguez, 110 F.3d at 182. For this reason as well, we think
that Harper has clearly failed to show that the IRS deprived him
of any protected liberty interest in the nondisclosure of intimate
information.
Finally, though neither the district court nor the IRS
relied on this body of law, we must note that Harper's privacy-
based reliance on the protections of procedural due process to
challenge the IRS's summons appears to suffer from an even more
fundamental problem. In SEC v. Jerry T. O'Brien, the Supreme Court
nondisclosure to the public resulting from the government's
acquisition of personal information. See 429 U.S. at 591, 600-01
(evaluating a state statute requiring a centralized record of the
names and addresses of individuals prescribed certain controlled
substances). For the reasons explained above, we think that
nondisclosure to the government is sufficiently analogous to
privacy as conceptualized in the Fourth Amendment context that our
reasonable-expectation-of-privacy analysis compels the rejection
of Harper's due process claim. Aside from a passing reference to
IRS data breaches in his reply brief, Harper makes no argument
about public disclosure. Any such argument about the due process
right against public disclosure is thus waived, see, e.g., United
States v. Gordon,
954 F.3d 315, 323 n.1 (1st Cir. 2020), and we
therefore need not consider whether our analysis regarding
Harper's lack of a reasonable expectation of privacy would compel
the same result in the context of public disclosure.
- 29 -
stated that "the Due Process Clause of the Fifth Amendment . . . is
[not] offended when a federal administrative agency, without
notifying a person under investigation, uses its subpoena power to
gather evidence adverse to him." 467 U.S. at 742. The Court thus
rejected the argument that the targets of an SEC investigation had
a due process right to notice and opportunity to oppose a subpoena
of third parties pursuant to that investigation. Id.; see also
Hannah v. Larche, 363 U.S. 420, 442 (1960) (holding that procedural
due process rights do not apply "when governmental action does not
partake of an adjudication, as for example, when a general fact-
finding investigation is being conducted"); Aponte v. Calderón,
284 F.3d 184, 193 (1st Cir. 2002) ("[I]nvestigations conducted by
administrative agencies, even when they may lead to criminal
prosecutions, do not trigger due process rights.").
This precedent confirms our view that Harper's reliance
on his due process right to privacy cannot succeed. Here, just as
in Jerry T. O'Brien, the IRS's summons of Coinbase's records was
quintessential fact-finding that did not involve any sort of
adjudication of Harper's rights or liabilities. Accordingly,
Harper lacked any procedural due process right to be notified of
the IRS's investigative efforts or to oppose its summons issued to
a third party. To be sure, the Supreme Court did not directly
consider the protected liberty interest of keeping certain
sensitive information confidential. But we discern little
- 30 -
difference between Harper's assertion of a right to keep his
Coinbase account information private from an IRS summons and the
purported right at issue in Jerry T. O'Brien. Indeed, by holding
that the Due Process Clause offers no protection from an agency
"using its subpoena power to gather evidence adverse to [a
person]," 467 U.S. at 742, the Jerry T. O'Brien Court seemed to
implicitly recognize that the possibility of an investigation
surfacing private information is not enough to entitle an
individual to procedural due process protections. Simply put,
Harper's effort to keep his Coinbase account information out of
the hands of the IRS appears to be no different from the
unsuccessful effort in Jerry T. O'Brien to stymie an investigation
that likewise implicated potentially sensitive financial
information but gave rise to no procedural due process protections.
In sum, the procedural protections of the Due Process
Clause are not implicated by the IRS's summons.18 Because Harper's
Fifth Amendment claim fails at this threshold step, we need not
consider whether he received constitutionally adequate process.
C. Statutory Factors
Finally, Harper seeks a declaratory judgment that the
IRS's summons was not issued in compliance with the factors set
18We note that our discussion here does not speak
comprehensively to the rights of the recipient of a subpoena or
summons or to the right of a defendant in a criminal case to
challenge the basis for issuing such an order.
- 31 -
out in 26 U.S.C. § 7609(f) for a John Doe summons. Harper advances
this claim under the APA. The IRS argued in the district court
that the summons was not agency action, as required to mount an
APA challenge. The district court declined to reach this question,
however, "assuming, without deciding," that the summons was
challengeable under the APA before rejecting it on other grounds.
Harper III, 675 F. Supp. 3d at 210. On appeal, the IRS renews its
contention that the APA does not authorize the relief Harper seeks.
See United States v. Roman,
942 F.3d 43, 50 (1st Cir. 2019) ("We
may affirm 'on any basis apparent in the record.'").19
The APA provides for judicial review of "final agency
action for which there is no other adequate remedy in a court." 5
U.S.C. § 704. To be considered "final," the agency action must
satisfy two conditions. First, it "must mark the 'consummation'
of the agency's decisionmaking process." Bennett v. Spear,
520
U.S. 154, 178 (1997) (quoting Chi. & S. Air Lines, Inc. v. Waterman
S.S. Corp.,
333 U.S. 103, 113 (1948)). Second, "the action must
be one by which 'rights or obligations have been determined,' or
from which 'legal consequences will flow.'"
Id. (quoting Port of
19 Harper asserts that the IRS has not raised a finality
challenge, as it argued in the district court only that the summons
was not "agency action," without analyzing whether it was "final."
The IRS counters that, by arguing that the summons was not agency
action at all, it was, necessarily, also contending that the
summons was not final agency action. We agree with the IRS that
the question of whether the APA authorizes judicial review of the
IRS summons, as final agency action, is properly before us.
- 32 -
Bos. Marine Terminal Ass'n v. Rederiaktiebolaget Transatl., 400
U.S. 62, 71 (1970)). Our analysis focuses on the first
requirement.
The IRS's summons of Coinbase's records is a preliminary
investigative step, far upstream of any potential tax enforcement
actions against Coinbase accountholders like Harper or any broader
agency action regarding the reporting of digital asset
transactions. Cf. United States v. Bisceglia, 420 U.S. 141, 146
(1975) (stating that "[t]he purpose of [the IRS's summons power]
is not to accuse, but to inquire" and that "such
investigations . . . are essential to our self-reporting system");
Harper II,
46 F.4th at 8 (stating that the scope of the IRS's
summonsing authority described under
26 U.S.C. § 7602 "clearly
fall[s] within the category of information gathering"). The
summons was thus not the "'consummation' of the agency's
decisionmaking process," but, rather, was "of a merely tentative
or interlocutory nature." Bennett,
520 U.S. at 178. Several of
our sister circuits have likewise concluded that investigatory
measures are not final agency action. See, e.g., Am. Civil
Liberties Union v. Nat'l Sec. Agency,
493 F.3d 644, 679 n.37 (6th
Cir. 2007) (concluding that surveillance activities are not final
agency action); Univ. of Med. & Dentistry of N.J. v. Corrigan,
347
F.3d 57, 69 (3d Cir. 2003) ("The decision to investigate is
normally seen as a preliminary step -- non–final by
- 33 -
definition -- leading toward the possibility of a 'final action'
in the form of an enforcement or other action."); Reliable
Automatic Sprinkler Co. v. Consumer Prod. Safety Comm'n, 324 F.3d
726, 731 (D.C. Cir. 2003) ("The agency's conduct thus far amounts
to an investigation . . . . [This] agency activit[y] do[es] not
constitute final agency action within the meaning of the APA.");
Ass'n of Am. Med. Colls. v. United States, 217 F.3d 770, 780-81
(9th Cir. 2000) ("An investigation, even one conducted with an eye
to enforcement, is quintessentially non-final as a form of agency
action."); Jobs, Training & Servs., Inc. v. E. Tex. Council of
Gov'ts, 50 F.3d 1318, 1324 (5th Cir. 1995) ("[A]n agency's
initiation of an investigation does not constitute final agency
action." (quoting Veldhoen v. U.S. Coast Guard, 35 F.3d 222, 225
(5th Cir. 1994))); cf. FTC v. Standard Oil Co. of Cal.,
449 U.S.
232, 241-42 (1980) (holding that the issuance of an administrative
complaint is not final agency action).
Nor are we aware of any judicial decision holding that
an agency's issuance of a summons or similar investigatory
instrument is final agency action reviewable under the APA. The
lone case Harper cites is Sackett v. EPA, 566 U.S. 120, 126 (2012),
in which the Supreme Court held that an EPA compliance order which
required the petitioners, among other things, to "give the EPA
access to their property and to 'records and documentation related
to the conditions at the [s]ite,'" was final agency action.
Id.
- 34 -
Putting aside that this order also imposed a "legal obligation to
'restore' their property according to an Agency-approved
Restoration Work Plan," id., the analysis in Sackett pertained to
the second finality requirement: that the agency action determine
rights and obligations. See Bennett,
520 U.S. at 178. Our
analysis, however, pertains to the first requirement: that the
action mark "the 'consummation' of the agency's decisionmaking
process."
Id. (quoting Bennett,
520 U.S. at 178). For the reasons
we describe, a summons issued as part of a broader investigation
is not such a consummation.
Mindful that early "[j]udicial intervention into the
agency process denies the agency an opportunity to correct its own
mistakes and to apply its expertise," Standard Oil, 449 U.S. at
242, it strikes us as premature at this point to wade into the
IRS's investigation of potential widespread misreporting of income
from digital asset transactions. See also
id. at 243 (cautioning
against premature judicial review as "a means of turning prosecutor
into defendant before adjudication concludes"); Univ. of Med. &
Dentistry of N.J., 347 F.3d at 69 ("In the ordinary course, an
investigation is the beginning of a process that may or may not
lead to an ultimate enforcement action."). We thus affirm the
district court's dismissal of Harper's statutory claim without
needing to address the requirements of § 7609(f).
- 35 -
III.
Having rejected all three of Harper's lines of attack,
we affirm the district court's dismissal of Harper's complaint for
the reasons explained herein.
So ordered.
- 36 -
