Harper v. Werfel

118 F.4th 100

• Court: Court of Appeals for the First Circuit
• Decided: September 24, 2024
• Docket: 23-1565
• Status: Published

Opinion

United States Court of Appeals For the First Circuit

No. 23-1565

JAMES HARPER,

Plaintiff, Appellant,

v.

DANIEL I. WERFEL, in his official capacity as Commissioner of the Internal Revenue Service; INTERNAL REVENUE SERVICE; JOHN DOE IRS AGENTS 1-10.

Defendants, Appellees.

APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE

[Hon. Joseph N. Laplante, U.S. District Judge]

Before

Kayatta, Lipez, and Gelpí, Circuit Judges

Sheng Tao Li, with whom Richard Abbott Samp and New Civil Liberties Alliance were on brief, for appellant. Kathleen E. Lyon, Attorney, Tax Division, Department of Justice, with whom David A. Hubbert, Deputy Assistant Attorney General, Francesca Ugolini, and Jennifer Marie Rubin, Attorneys, were on brief, for appellees. Rodrigo Seira, Paradigm Operations LP, Omer Tene, Christopher J.C. Herbert, Andrew Kim, Gabe Maldoff, and Goodwin Procter LLP on brief for Paradigm Operations LP, amicus curiae. Edward M. Wenger, John Cycon, and Holtzman Vogel Baran Torchinsky & Josefiak PLLC on brief for Coin Center, amicus curiae. J. Abraham Sutherland, Cameron T. Norris, Jeffrey S. Hetzel, and Consovoy McCarthy PLLC on brief for DeFi Education Fund, amicus curiae. Ryan P. Mulvey, Lee A. Steven, and Americans for Prosperity Foundation on brief for Americans for Prosperity Foundation, amicus curiae. Tyler Martinez and National Taxpayers Union Foundation on brief for National Taxpayers Union Foundation, amicus curiae.

September 24, 2024 LIPEZ, Circuit Judge. This appeal addresses a so-called

"John Doe" summons issued by the Internal Revenue Service ("IRS")

to Coinbase, a cryptocurrency exchange, seeking Coinbase's records

containing information about numerous Coinbase customers,

including appellant James Harper. Harper contends that the IRS's

investigative efforts infringed his privacy and property rights in

contravention of the Fourth and Fifth Amendments. Invoking the

Administrative Procedure Act ("APA"), he also asserts that the

summons did not satisfy statutory requirements for issuing a John

Doe summons. See 26 U.S.C. § 7609(f).

The district court dismissed Harper's complaint,

concluding, as pertinent to his constitutional claims, that he

lacked a reasonable expectation of privacy in his Coinbase account

information, and that Coinbase's records were not his property.

It further concluded that, in any event, the IRS summons was

reasonable, and Harper had received constitutionally adequate

process. The court also rejected Harper's statutory challenge,

dismissing it as an improper collateral attack on prior district

court proceedings enforcing the summons and finding the IRS summons

to satisfy the statutory standard.

We agree that Harper lacks a protectable interest under

the Fourth or Fifth Amendment, and thus affirm on that basis.

Finding that he has not raised a challenge to final agency action,

- 3 - as required to mount an APA claim, we affirm the dismissal of his

statutory claim as well.

I.

A. Factual Background

Because we review the dismissal of Harper's complaint,

we draw our recitation of the facts from Harper's well-pleaded

allegations, assuming their truth and drawing all reasonable

inferences in Harper's favor. See, e.g., Legal Sea Foods, LLC v.

Strathmore Ins. Co., 36 F.4th 29, 30, 34 (1st Cir. 2022).

Harper opened a Coinbase account in 2013. Coinbase is

a digital currency exchange that facilitates transactions between

accountholders. In 2013 and 2014, Harper made several deposits of

Bitcoin, a popular digital currency, into his Coinbase account.1

In 2015, Harper began liquidating his Bitcoin holdings or

transferring them from Coinbase to a hardware wallet.2 By early

1 Harper primarily received this Bitcoin as income from consulting work. Harper alleges that he properly reported to the IRS all Bitcoin he received and properly reported all capital gains or losses associated with his Bitcoin holdings in the ensuing years. This appeal does not involve any challenge to those assertions. 2A hardware wallet is an offline device, often resembling a USB thumb drive, used to store the "private keys" necessary for a digital currency user to transact digital currency. See Harper v. Rettig, 46 F.4th 1, 3 n.3 (1st Cir. 2022) (quoting Virtual Currency Storage, IRM 5.1.18.20.2 (July 17, 2019)). This "'secure offline' version of a virtual currency wallet," in comparison to a software wallet downloaded to a computer or mobile device, is "immune to computer viruses," does not allow private keys to be transferred in unencrypted fashion, and "is not open source," thus making the

- 4 - 2016, Harper no longer had any Bitcoin holdings in his Coinbase

account.3

In 2019, Harper received a letter from the IRS informing

him that the agency "ha[s] information that you have or had one or

more accounts containing virtual currency but may not have properly

reported your transactions involving virtual currency." Harper

alleges that the IRS's letter refers to information the agency

obtained via a "John Doe" summons the agency issued to Coinbase in

2016. A John Doe summons is an ex parte third-party summons issued

"where the IRS does not know the identity of the taxpayer[s] under

investigation." Tiffany Fine Arts, Inc. v. United States, 469

U.S. 310, 316 (1985) (emphasis omitted). Such a summons may only

issue following a court proceeding in which the IRS establishes

that certain statutory criteria have been satisfied,4 and the

device a highly secure alternative for transacting digital currency. Id. 3 In his amended complaint, Harper also describes Bitcoin transactions made through two other exchanges, Abra and Uphold. His association with these two exchanges is not relevant to the issues in this appeal. 4 These factors are: (1) the summons relates to the investigation of a particular person or ascertainable group or class of persons, (2) there is a reasonable basis for believing that such person or group or class of persons may fail or may have failed to comply with any provision of any internal revenue law, and (3) the information sought to be obtained from the examination of the records or testimony

- 5 - summons must be "narrowly tailored to information that pertains to

the failure (or potential failure) of the [individuals targeted by

the summons] to comply with [the tax code]." 26 U.S.C. § 7609(f).

Initially, the 2016 John Doe summons sought information

on all United States Coinbase accountholders who conducted digital

currency transactions between 2013 and 2015. See United States v.

Coinbase, Inc., No. 17-cv-01431, 2017 WL 5890052, at *1 (N.D. Cal.

Nov. 28, 2017). The agency requested several categories of

documents, including "complete user profiles, know-your-customer

due diligence, documents regarding third-party access, transaction

logs, records of payments processed, correspondence between

Coinbase and Coinbase users, account or invoice statements,

records of payments, and exception records produced by Coinbase's

AML system." Id. Coinbase opposed the summons, and the IRS filed

a petition to enforce the summons in the United States District

Court for the Northern District of California. See generally id.

The agency subsequently and voluntarily narrowed the

summons to encompass only users who had engaged in $20,000 worth

of any one type of digital currency transaction (buying, selling,

sending, or receiving) in any one calendar year. Id. at *2. As

(and the identity of the person or persons with respect to whose liability the summons is issued) is not readily available from other sources.

26 U.S.C. § 7609(f).

- 6 - narrowed, the summons targeted 14,355 Coinbase accounts, seeking

the following records: (1) registration information "limited to

name, address, tax identification number, date of birth, account

opening records, copies of passport or driver's license, all wallet

addresses, and all public keys for all accounts/wallets/vaults";

(2) know-your-customer due diligence; (3) "[a]greements or

instructions granting a third-party access, control, or

transaction approval authority"; (4) account "activity including

transaction logs or other records identifying the date, amount,

and type of transaction (purchase/sale/exchange)," the names of

counterparties to the transaction, and certain Coinbase account

information of those counterparties; (5) "[c]orrespondence between

Coinbase and the user" or authorized third parties; and (6) "[a]ll

periodic statements of account or invoices (or the equivalent)."

Id.

Coinbase continued to oppose the narrowed summons.5 See

id. The court enforced the summons in part, finding the agency

was justified, under 26 U.S.C. § 7602(a), which authorizes the IRS

to issue summonses to "ascertain[] the correctness of any return,

5 The court allowed a John Doe to intervene in the proceedings,

and it also permitted three amici to file briefs opposing the summons. See Coinbase, 2017 WL 5890052, at *1, *3. Harper participated in the filing of one of these briefs, though he did so in a professional capacity and not, so far as the record reveals, based on a belief that his account information was implicated by the summons.

- 7 - mak[e] a return where none has been made, determin[e] the liability

of any person for any internal revenue tax or ... collect[] any

such liability," in obtaining the following documents: (1) the

taxpayer ID number, (2) name, (3) date of birth, (4) address,

(5) "records of account activity including transaction logs or

other records identifying the date, amount, and type of transaction

(purchase/sale/exchange), the post transaction balance, and the

names of counterparties to the transaction," and (6) "all periodic

statements of account or invoices (or the equivalent)." Coinbase,

2017 WL 5890052, at *8-9.6 Neither party appealed the court's

enforcement order.

B. Procedural History

After receiving the IRS letter, Harper filed a complaint

in the United States District Court for the District of New

Hampshire,7 alleging violations of the Fourth and Fifth Amendments

and seeking a declaration that the John Doe summons did not satisfy

the § 7609(f) factors. As the district court put it, "[a]t its

core, Harper's request for declaratory or injunctive relief seeks

6As narrowed by the district court, the summons thus excluded several categories of information originally sought by the IRS, including "[r]ecords of Know-Your-Customer diligence," "[a]greements or instructions granting a third-party access, control, or transaction approval authority," and "[c]orrespondence between Coinbase and the user or any third party." Id. at *7. 7 Harper's amended complaint names as defendants the IRS, the Commissioner of the IRS, and 10 John Doe IRS agents. We refer to these parties collectively as "the IRS."

- 8 - to compel the IRS to return or destroy the records it received

from Coinbase relating to his account." Harper v. Rettig, 675 F.

Supp. 3d 190, 199 n.18 (D.N.H. 2023). The district court dismissed

the complaint, see Harper v. Rettig ("Harper I"), No. 20-cv-771,

2021 WL 1109254, at *3-5 (D.N.H. Mar. 23, 2021), on the ground

that it lacked jurisdiction under the Anti-Injunction Act, which

provides that "no suit for the purpose of restraining the

assessment or collection of any tax shall be maintained in any

court by any person," 26 U.S.C. § 7421(a). We vacated that

judgment, however, concluding that Harper's contention that "the

IRS acquired [and retained his financial information] in violation

of the Constitution and 26 U.S.C § 7609(f)" did not relate to the

collection or assessment of a tax. Harper v. Rettig ("Harper II"),

46 F.4th 1, 8 (1st Cir. 2022).

The IRS again moved to dismiss, under Federal Rule of

Civil Procedure 12(b)(6), arguing that Harper had failed to state

a claim for a variety of reasons. The district court agreed. See

Harper ("Harper III"), 675 F. Supp. 3d at 213. In dismissing

Harper's Fourth Amendment claim, the court held that Harper lacked

a reasonable expectation of privacy in information he voluntarily

divulged to Coinbase and that Coinbase's records regarding his

account activity were Coinbase's property, not Harper's. Id. at

200-04. The court also held, in the alternative, that the summons

was reasonable because it complied with the requirements for IRS

- 9 - summonses laid out in United States v. Powell, 379 U.S. 48, 57

(1964).8 See Harper III, 675 F. Supp. 3d at 203-05. The district

court rejected Harper's Fifth Amendment claim on largely similar

grounds, holding that because Harper lacked a privacy-based or

property interest in his Coinbase account information, he had

suffered no deprivation giving rise to due process protection.

See id. at 206-07. Alternatively, the court found that Harper had

received constitutionally adequate process. See id. at 207-08.

Finally, the court dismissed Harper's statutory claim,

"assum[ing], without deciding," that he was entitled to judicial

review under the APA but concluding that his effort was an improper

collateral attack on the prior order by the Northern District of

California enforcing the summons and holding that the summons

8 In Powell, the Court held that, under 26 U.S.C. § 7602, "the [IRS] Commissioner need not meet any standard of probable cause to obtain enforcement of his summons . . . . He must show that the investigation will be conducted pursuant to a legitimate purpose, that the inquiry may be relevant to the purpose, that the information sought is not already within the Commissioner's possession, and that the administrative steps required by the Code have been followed." 379 U.S. at 57-58. As Harper notes, Powell thus concerned only the statutory requirements pertaining to IRS summonses and was not a Fourth Amendment case. The district court observed, however, that several circuits have concluded that satisfaction of the Powell requirements is enough to show that the summons was reasonable under the Fourth Amendment. See Harper III, 675 F. Supp. 3d at 204-05 (collecting examples). We have said the same in dicta. See United States v. Allee, 888 F.2d 208, 213 n.3 (1st Cir. 1989). Because Harper lacked an interest protected by the Fourth Amendment, see infra section II.A, we need not determine whether satisfaction of the Powell factors also, by extension, satisfies the Fourth Amendment reasonableness requirement.

- 10 - satisfied the § 7609(f) factors. Id. at 210; see also id. at 209-

13. This timely appeal ensued.

II.

We review de novo the district court's dismissal of all

three of Harper's claims. See Legal Sea Foods, 36 F.4th at 34.

A. Fourth Amendment

The Fourth Amendment protects "[t]he right of the people

to be secure in their persons, houses, papers, and effects, against

unreasonable searches and seizures." U.S. Const. amend. IV. A

"search," as conceived in the context of the Fourth Amendment, can

take two forms: it may be an intrusion upon a person's reasonable

expectations of privacy, see, e.g., Katz v. United States, 389

U.S. 347, 351 (1967), or it may involve a "physical[] intru[sion]

on a constitutionally protected area," Carpenter v. United States,

585 U.S. 296, 304 (2018) (quoting United States v. Jones, 565 U.S.

400, 405, 406 n.3 (2012)). Harper relies upon both theories in

support of his Fourth Amendment claim: he had a reasonable

expectation of privacy in his Coinbase account information, and

his account records were his personal property, which he had

transferred to Coinbase as a "bailment." We address each

contention in turn.

1. Reasonable Expectation of Privacy

Under a privacy-based theory, "the application of the

Fourth Amendment depends on whether the person invoking its

- 11 - protection can claim a justifiable, a reasonable, or a legitimate

expectation of privacy that has been invaded by government action."

Smith v. Maryland, 442 U.S. 735, 740 (1979) (internal quotation

marks omitted) (collecting cases). This "reasonable-expectation-

of-privacy" inquiry contains subjective and objective elements:

"the individual [must] 'exhibit[] an actual (subjective)

expectation of privacy,'" id. (quoting Katz, 389 U.S. at 361

(Harlan, J., concurring)), and "the individual's expectation,

viewed objectively, [must be] 'justifiable' under the

circumstances," id. (quoting Katz, 389 U.S. at 353). Because

Harper's complaint makes clear that he expected his Coinbase

account information to remain confidential, his privacy-based

theory turns on whether his expectation of privacy was justified

under controlling law.

The Supreme Court "consistently has held that a person

has no legitimate expectation of privacy in information he

voluntarily turns over to third parties." Id. at 743-44

(collecting cases). This principle holds true "even if the

information is revealed on the assumption that it will be used

only for a limited purpose and the confidence placed in the third

party will not be betrayed." Id. at 744 (quoting United States v.

Miller, 425 U.S. 435, 443 (1976)). Of particular relevance here,

the Court held in Miller that an individual has no legitimate

expectation of privacy in "information kept in bank records," as

- 12 - these documents, "including financial statements and deposit

slips, contain only information voluntarily conveyed to the banks

and exposed to their employees in the ordinary course of business."

425 U.S. at 442; see also id. at 444 (restating its conclusion

that "no Fourth Amendment interests of the depositor are implicated

here").

We agree with the IRS (and the district court) that the

account information obtained by the agency in this case falls

squarely within this "third party doctrine" line of precedent.

See, e.g., United States v. Gratkowski, 964 F.3d 307, 312 (5th

Cir. 2020) (holding, under Miller and Smith, that a Coinbase user

lacks a reasonable expectation of privacy in Coinbase account

information). All the information revealed to the IRS pursuant to

the enforced summons -- personal identifiers such as taxpayer

identification number, name, and address; records of account

activity such as transaction logs; and statements -- is directly

analogous to the bank records at issue in Miller -- checks, deposit

slips, and financial statements. See id.; see also Miller, 425

U.S. at 444 (comparing the subpoena in that case to a third-party

IRS summons targeting a financial institution's depositors and

stating, in dicta, that "an [IRS] summons directed to a third-

party bank does not violate the Fourth Amendment rights of a

depositor under investigation"); Donaldson v. United States, 400

U.S. 517, 522 (1971) (similar); S.E.C. v. Jerry T. O'Brien, Inc.,

- 13 - 467 U.S. 735, 743 (1984) (relying on the third-party doctrine to

reject a Fourth Amendment challenge to third-party subpoena of

financial records). In fact, Coinbase's terms of service expressly

warn accountholders of the possibility of disclosure to law

enforcement.

Revealingly, Harper's first line of attack against

application of the third-party doctrine here is to invoke sentiment

by academics and individual Supreme Court justices that the

"doctrine is not only wrong, but horribly wrong." Carpenter, 585

U.S. at 388 (Gorsuch, J., dissenting) (quoting Orin Kerr, The Case

for the Third–Party Doctrine, 107 Mich. L. Rev. 561, 563 n.5, 564

(2009)); see also Jones, 565 U.S. at 417 (Sotomayor, J.,

concurring) ("[The third-party doctrine] is ill suited to the

digital age, in which people reveal a great deal of information

about themselves to third parties in the course of carrying out

mundane tasks."). But, of course, we are bound to faithfully apply

Supreme Court precedent notwithstanding the concerns of scholars

and some justices.

Harper's arguments against "extending" the third-party

doctrine to digital currency exchanges are no more convincing.

Harper relies primarily on Carpenter, in which the Supreme Court

held that an individual has a reasonable expectation of privacy in

cell-site location information ("CSLI"), which is a time-stamped

record of a cell phone user's approximate location generated each

- 14 - time the cell phone connects to the wireless network. See 585

U.S. at 300-01, 315-16. Those records typically are created

several times every minute, whether or not the cell phone user is

even actively using the phone. See id. at 300-01. The CSLI in

Carpenter has little in common, however, with Harper's Coinbase

account information. An individual's CSLI amounts to a "detailed

chronicle of a person's physical presence compiled every day, every

moment, over several years," "implicat[ing] privacy concerns far

beyond those considered in Smith and Miller." Id. at 315. By

contrast, the information contained in financial records like

those at issue here, even several years' worth of them, does not

paint nearly so detailed a portrait of an individual's daily

activity. While such records may capture some intimate

information, the same is true of traditional bank records, and yet

the Miller Court had no trouble concluding that a subpoena of such

records does not impermissibly intrude upon "intimate areas of an

individual's personal affairs." 425 U.S. at 444 n.6 (quoting Cal.

Bankers Ass'n v. Shultz, 416 U.S. 21, 78 (1974) (Powell, J.,

concurring)).

Additionally, the Carpenter Court noted that CSLI "is

not truly 'shared' as one normally understands the term."

Carpenter, 585 U.S. at 315. Carrying a cell phone is

"indispensable to participation in modern society," and "a cell

phone logs a cell-site record by dint of its operation, without

- 15 - any affirmative act on the part of the user beyond powering up."

Id. Plainly, participating in a digital currency exchange is not

"indispensable," id., certainly no more so than having a

traditional bank account. And transactions on Coinbase occur only

when a user opts into that activity, unlike a cellphone

automatically pinging a cell site, even while passively sitting in

the user's pocket. See Gratkowski, 964 F.3d at 312 (similarly

distinguishing Coinbase records from CSLI because "Coinbase

records are limited" and "transacting Bitcoin through

Coinbase . . . requires an 'affirmative act on [the] part of the

user'" (quoting Carpenter, 585 U.S. at 315)).

Harper also cites United States v. Warshak, 631 F.3d

266, 287-88 (6th Cir. 2010), in which the Sixth Circuit held that

individuals have a legitimate expectation of privacy in the

contents of their emails, notwithstanding the third-party

doctrine. In that case, federal agents obtained a criminal

defendant's emails via a subpoena served on his internet service

provider, which stored the email content in the process of

delivering messages sent by or to the defendant, not unlike a mail

carrier delivering a letter. Id. The court distinguished Miller

because as an "intermediary" of emails, rather than the "intended

recipient," the internet service provider holding those emails did

not "put th[at] information to use 'in the ordinary course of

business'" in the same manner that a financial institution

- 16 - generates and uses its records regarding account activity as a

core component of its business model. Id. at 287-88 (quoting

Miller, 425 U.S. at 442). Here, by contrast, the IRS summonsed

business records much like those in Miller, generated by Coinbase

in its "ordinary course of business" as a financial institution

and consisting of information "voluntarily conveyed to

[Coinbase]." Miller, 425 U.S. at 442; see also id. at 440 (noting

that the account information at issue "pertain[ed] to transactions

to which the bank was itself a party" (quoting Cal. Bankers Ass'n,

416 U.S. at 52)).

Finally, we disagree with Harper's contention that

Miller is distinguishable because "[c]ryptocurrency transactions

are confidential by nature" thanks to the anonymity of the

blockchain, a pseudonymized public ledger of all Bitcoin

transactions.9 We do not doubt that because digital currency

9Several amici elaborate on this concern. As they explain, transactions are registered on the blockchain for all to see, using a pseudonymous "wallet address," derived from a "public key," associated with each party to the transaction. If a person's identity becomes associated with an address or public key, thus piercing the veil of anonymity, anyone aware of that information can easily ascertain all transactions the person has made using that address -- or track future transactions. Though the IRS disputed at oral argument that any wallet addresses or public keys were included in the information the IRS obtained, we agree with Harper and his amici that exposure of this information was a reasonably likely consequence of the IRS summons, either directly or by analyzing the transaction data that was included. Ultimately, however, our agreement with Harper on this point makes no difference in our conclusion that he lacked a reasonable expectation of privacy.

- 17 - transactions are recorded on a public ledger, exposure of a

person's identity opens a potentially wide window into that

person's financial activity contained on that ledger. But that

possibility does not alter our conclusion that the information at

risk of exposure -- all concerning financial transactions -- is,

fundamentally, much more analogous to the financial information at

issue in Miller than to the uniquely comprehensive, locational

data at issue in Carpenter.

Indeed, we fail to see how the decision to transmit

financial information to the public -- even

pseudonymously -- makes the expectation of privacy more reasonable

than doing so privately, given the heightened consequences of

exposure that Harper identifies. In other words, even if Harper

chose to transact Bitcoin because he felt the technology would

protect his privacy more than traditional banking (and his

complaint does not allege as much), that choice would only inform,

subjectively speaking, whether "he [sought] to preserve

[something] as private," Katz, 389 U.S. at 351, not whether his

expectation of privacy was objectively legitimate. The fact

remains that Harper voluntarily divulged information about his

Bitcoin transactions to Coinbase. Indeed, Harper could have

bypassed a digital currency exchange like Coinbase and conducted

his Bitcoin transactions through decentralized, peer-to-peer

transactions, which "maintain [the] high level of privacy"

- 18 - associated with the blockchain but require specialized software

and greater technical proficiency. Gratkowski, 964 F.3d at 312-

13. Instead, Harper evidently chose "to sacrifice some privacy"

in return for use of an intermediary, a more convenient method of

transacting Bitcoin that "requires [less] technical expertise."

Id.10

Because Harper lacked a reasonable expectation of

privacy in his Coinbase account information, we reject his privacy-

based theory for his claim of a Fourth Amendment violation.

Harper also argues that Miller and Gratkowski are 10

distinguishable because they involved subpoenas concerning one person, whereas here the IRS's summons concerned numerous Coinbase accounts. But in support of that argument, Harper relies primarily on a pre-Miller case from the Third Circuit that merely states, as a general principle, that the government may not engage in "fishing expedition[s]," United States v. Dauphin Deposit Tr. Co., 385 F.2d 129, 131 (3d Cir. 1967), a protection rooted in the Fourth Amendment's reasonableness requirement and thus irrelevant to the reasonable-expectation-of-privacy inquiry as it pertains to whether Harper, as an individual, reasonably expected his information to remain private. Harper correctly notes in his reply brief that in United States v. Knotts, 460 U.S. 276, 284 (1983), the Supreme Court reserved the question of whether the third-party doctrine applies to "dragnet type law enforcement practices." But the Court never suggested in that case (or in the forty years since) that an individual's expectation of privacy is somehow stronger in cases involving multiple targets, notwithstanding that individual's decision to turn over that information to third parties. Simply put, thus, neither Knotts nor Dauphin provides any reason to disregard our straightforward application of Miller to conclude that Harper lacked a reasonable expectation of privacy in information he voluntarily turned over to Coinbase.

- 19 - 2. Property

Harper also argues, in effect, that his Coinbase account

records, though in Coinbase's possession, were his "private

papers," and thus the IRS's inspection of this information was

akin to an intrusion on his personal property, giving rise to

Fourth Amendment protections. Harper's novel theory relies

heavily on Justice Gorsuch's solo dissenting opinion in Carpenter.

See 585 U.S. at 397-406. Though Justice Gorsuch did not agree

with the majority that the defendant had a reasonable expectation

of privacy in his CSLI notwithstanding the third-party doctrine,

Justice Gorsuch argued that he might have had a property interest

in his CSLI that could serve as the basis for his Fourth Amendment

claim. Id. at 405-06; see also id. at 397-404 (discussing why a

property-based approach, rather than a reasonable-expectation-of-

privacy standard, is, in Justice Gorsuch's view, a preferable

method for resolving Fourth Amendment claims).

Relying on Justice Gorsuch's supposition, Harper argues

that he has a property interest in his Coinbase account records.

Yet, despite Justice Gorsuch's recognition that any such interest

needs to be anchored in law, Harper makes no effort in his opening

brief to explain the legal source of the interest he asserts.11

11At oral argument, Harper's counsel did point to references in Coinbase's terms of service to "information about your transactions," "your personal information," and "your account information," arguing that these phrases reflect a contractual

- 20 - See Carpenter, 585 U.S. at 405-06 (Gorsuch, J., dissenting)

(concluding, based on an analysis of 47 U.S.C. § 477, that

"customers have substantial legal interests in [CSLI], including

at least some right to include, exclude, and control its use,"

that "might even rise to the level of a property right," but adding

that the defendant "offered no analysis . . . of what rights state

law might provide him"); see also Cahoon v. Shelton, 647 F.3d 18,

28 (1st Cir. 2011) ("A court tasked with determining whether a

constitutionally protected property interest exists must look to

'existing rules or understandings that stem from an independent

source such as state law.'" (quoting Bd. of Regents of State

Colls. v. Roth, 408 U.S. 564, 577 (1972))). Harper simply asserts

that the property interest exists because these records are his

"papers," but his facile reliance on that word from the text of

the Fourth Amendment is inadequate, as "[p]roperty

interests . . . are not created by the Constitution." Roth, 408

U.S. at 577; see also Cahoon, 647 F.3d at 29 ("A party's unilateral

expectation, in itself, cannot create a constitutionally protected

property interest.").

understanding that the information belonged to Harper. Putting aside that arguments made for the first time at oral argument are waived, see, e.g., Guardado v. United States, 76 F.4th 17, 23 n.4 (1st Cir. 2023), we perceive an obvious difference between a reference to "your information," meaning information about Harper, some of which was provided by him but some of which Coinbase collected in the course of his account activity, and the actual records generated and held by Coinbase based on that information.

- 21 - Harper's failure to elaborate on the nature of his

purported property right is especially significant because his

property-based claim faces significant headwinds in Supreme Court

precedent. In Miller, the Court remarked that, with no ability to

assert ownership or possession, the respondent could not claim the

financial records as his own "private papers." 425 U.S. at 440.

They were "[i]nstead . . . the business records of the banks," as

"all of the records [which must be retained under the Bank Secrecy

Act] pertain[ed] to transactions to which the bank was itself a

party." Id. (quoting Ca. Bankers Ass'n, 416 U.S. 21, 52 (1974));

cf. Donaldson, 400 U.S. at 523 (stating that a taxpayer had "no

proprietary interest of any kind" in records "owned by [a] third

person, which are in [the third person's] hands, and which relate

to the third person's business transactions with the taxpayer").

The same logic applies here.

Thus, while Harper asserts that Coinbase is merely a

"bailee" of his financial records,12 his allegations tell a

different story. Most of the records included in the summons, as

ultimately enforced, appear to be documents generated by Coinbase,

such as records of transactions that Coinbase facilitated and

12As Justice Gorsuch explained in his Carpenter dissent, "[a] bailment is the 'delivery of personal property by one person (the bailor) to another (the bailee) who holds the property for a certain purpose.'" 585 U.S. at 399 (emphasis removed) (quoting Black's Law Dictionary 169 (10th ed. 2014)).

- 22 - periodic account statements. Other information

obtained -- taxpayer ID number, name, birthdate,

address -- appears to simply be basic biographical information

necessary to open a Coinbase account. Given the Miller Court's

rejection of such financial records as an individual's "private

papers" rather than the property of the financial institution, we

see no basis to conclude that the IRS intruded upon Harper's

protected property rights.

None of the cases Harper cites compels a different

result. The decisions in Warshak, 631 F.3d at 287, and United

States v. Ackerman, 831 F.3d 1292, 1304 (10th Cir. 2016), both

concerning emails, analyzed the Fourth Amendment question under

the reasonable-expectation-of-privacy standard, not under a

property-based approach. And in Carpenter v. United States, 484

U.S. 19, 26-27 (1987);13 Ruckelshaus v. Monsanto Co., 467 U.S. 986,

1001-04 (1984); and Boyd v. United States, 116 U.S. 616, 638

(1886), all cases recognizing a property interest in business

records or personal papers, it was clear, unlike here, that the

asserted property belonged to the party claiming the interest.14

Not to be confused with the 2018 Carpenter v. United States 13

cited extensively in our reasonable-expectation-of-privacy analysis. 14Boyd, for instance, concerned the "compulsory production of [the defendant's] private papers," namely, the defendant's personally held records of invoices concerning the importation of several cases of glass. 116 U.S. at 622.

- 23 - Similarly, Jones, 565 U.S. at 404 n.2, 405-11, and Ex Parte

Jackson, 96 U.S. 727, 723 (1878), both involved property bailments,

whereas here, as explained, Coinbase was not in possession of

Harper's property. The summonsed records were its own.

Accordingly, we agree with the district court that

Harper lacked a constitutionally protected property interest in

Coinbase's records related to his account.

* * *

In sum, Harper had neither a reasonable expectation of

privacy in the Coinbase account information nor a cognizable

property interest in Coinbase's records. Because Harper's Fourth

Amendment claim fails at this threshold, we need not assess whether

the summons was reasonable under Fourth Amendment principles.

B. Fifth Amendment

Harper next argues that the IRS violated his Fifth

Amendment right to procedural due process when it used the summons

to obtain his Coinbase account records without providing him notice

or an opportunity to be heard. See U.S. Const. amend. V ("No

person shall . . . be deprived of life, liberty, or property,

without due process of law."); Aponte-Rosario v. Acevedo-Vilá, 617

F.3d 1, 9 (1st Cir. 2010) ("[T]he essential requirements of

procedural due process include adequate notice and an opportunity

to be heard 'at a meaningful time and in a meaningful manner.'"

- 24 - (quoting Amsden v. Moran, 904 F.2d 748, 753 (1st Cir.1990))).15 To

establish an entitlement to these procedural protections, Harper

must first show that the IRS deprived him of an interest protected

by the Due Process Clause, namely, his property or his liberty.

See Roe v. Lynch, 997 F.3d 80, 85 (1st Cir. 2021). While Harper

argues that the summons deprived him of his property right in his

Coinbase account records, he acknowledges that his purported

property interest is no different from the one we rejected in

connection with his Fourth Amendment claim. We thus limit our

discussion to Harper's theory that the IRS deprived him of a

protected Fifth Amendment liberty interest in the privacy of his

financial information.

In sourcing his claimed right to privacy, Harper relies

principally on Whalen v. Roe, 429 U.S. 589, 598-604 (1977), in

which the Supreme Court recognized that the Due Process Clause's

protection of liberty includes "avoiding disclosure of personal

matters," including, to some degree, "disclosures to

representatives of the State." Id. at 599, 602. Despite that

recognition, the Supreme Court upheld a state statute requiring

15 While many of the precedents we discuss concern the Due Process Clause of the Fourteenth Amendment, "the language and policies of the Due Process Clauses of the Fifth and Fourteenth Amendments are essentially the same," and thus "due process cases decided under the Fourteenth Amendment provide guidance in due process cases arising under the Fifth Amendment." United States v. Neto, 659 F.3d 194, 201 n.7 (1st Cir. 2011) (quoting United States v. Bohn, 281 F. App'x 430, 434 n.4 (6th Cir. 2008)).

- 25 - physicians to disclose to the government the identities of patients

to whom they prescribed certain controlled substances, explaining,

as most relevant here, that such disclosure was not "meaningfully

distinguishable" from other "disclosures of private medical

information to doctors, to hospital personnel, to insurance

companies, and to public health agencies [that] are often an

essential part of modern medical practice" and was thus not "an

impermissible invasion of privacy." Id. at 602. Harper also cites

Nixon v. Adm'r of Gen. Servs., 433 U.S. 425 (1977), in which the

Supreme Court recognized that the president has a "legitimate

expectation of privacy" in "matters of personal life unrelated to

any [official] acts," although the Court once again rejected the

underlying due process claim, finding that privacy interest

outweighed by the public interest in archiving the official records

with which that private information was intermingled. Id. at 457-

58, 465. We have likewise recognized a due process "right of

confidentiality," though we have cautioned that such a right does

not "extend[] beyond prohibiting profligate disclosure of medical,

financial, and other intimately personal data." Vega-Rodriguez v.

P.R. Tel. Co., 110 F.3d 174, 183 (1st Cir. 1997). Thus, in that

case, we rejected a due process challenge to a state agency's video

surveillance of its employees in the workplace, reasoning that

"[a]ny data disclosed . . . ha[d] been revealed knowingly by the

[employees] to all observers (including the video cameras)," and

- 26 - therefore "cannot be characterized accurately as 'personal' or

'confidential.'" Id. at 183.

Harper is correct that these cases establish that the

substantive component of the Due Process Clause protects a limited

liberty interest in the confidentiality of certain intimate

information. And we can assume, without deciding, that Harper

also is correct that this protectable privacy interest may

encompass certain sensitive financial information. Even with that

assumption, however, Harper's claim that the IRS deprived him of

such a liberty interest nonetheless fails because -- as we already

have concluded -- he lacked any reasonable expectation of privacy

in the circumstances here. See supra Section II.A.1. In other

words, because Harper could not reasonably expect Coinbase, faced

with an IRS summons, to withhold the type of financial information

he chose to submit to the company (or the related Coinbase

records), Harper lacks a cognizable due process interest in the

confidentiality of those records.16

The district court held that Harper's assertion of a 16

protected liberty interest failed because there is no liberty interest in the privacy of financial information generated and held by a third-party financial institution like Coinbase. See Harper III, 675 F. Supp. 3d at 206. Our holding is more limited. Starting with the assumption that the Due Process Clause protects some kinds of personal financial information, we conclude only that Harper lacks a Fifth Amendment privacy interest in the specific financial information he voluntarily gave to Coinbase. We do not consider whether individuals would have a due process liberty interest in the same type of information in different circumstances, or whether other types of personal financial

- 27 - While Harper argues that our reasonable-expectation-of-

privacy analysis is inapplicable to the due process context, that

assertion is belied by precedent. In Whalen, for example, the

Supreme Court found no privacy violation because the information

sought by the state was already routinely disclosed to other

parties. See 429 U.S. at 878. Similarly, in Nixon, 433 U.S. at

465, the Supreme Court analyzed the president's privacy interest

through the prism of his "legitimate expectation of privacy." And

in Payne v. Taslimi, 998 F.3d 648, 657 (4th Cir. 2021), and Walls

v. City of Petersburg, 895 F.2d 188, 192 (4th Cir. 1990), which

concern the disclosure of financial data, and upon which Harper

also relies, the first step of the Fourth Circuit's due process

inquiry was to determine whether there was a reasonable expectation

of privacy. Accordingly, having already concluded that Harper

lacked any reasonable expectation of privacy in his Coinbase

account information, we cannot say that Harper has been "deprived"

of a constitutionally protected privacy interest by the disclosure

of that information to the IRS.17

information would be protected by the Fifth Amendment even when voluntarily transferred to a third-party financial institution. Because Harper fails to assert a cognizable liberty interest even with the benefit of our assumption that financial records may give rise to such an interest, we choose to affirm the district court's dismissal of his Fifth Amendment claim without further examining the extent to which the Due Process Clause protects the confidentiality of personal financial information. 17To be sure, Whalen discussed two constitutionally protected forms of confidentiality: nondisclosure to the government and

- 28 - We note, moreover, that the disclosure of Coinbase's

transaction logs and account statements to the IRS for

investigative purposes, pursuant to a twice-narrowed summons and

a judicial enforcement order, would hardly seem to count as

"profligate," as we have said it must be to implicate a protected

liberty interest in the confidentiality of information. Vega-

Rodriguez, 110 F.3d at 182. For this reason as well, we think

that Harper has clearly failed to show that the IRS deprived him

of any protected liberty interest in the nondisclosure of intimate

information.

Finally, though neither the district court nor the IRS

relied on this body of law, we must note that Harper's privacy-

based reliance on the protections of procedural due process to

challenge the IRS's summons appears to suffer from an even more

fundamental problem. In SEC v. Jerry T. O'Brien, the Supreme Court

nondisclosure to the public resulting from the government's acquisition of personal information. See 429 U.S. at 591, 600-01 (evaluating a state statute requiring a centralized record of the names and addresses of individuals prescribed certain controlled substances). For the reasons explained above, we think that nondisclosure to the government is sufficiently analogous to privacy as conceptualized in the Fourth Amendment context that our reasonable-expectation-of-privacy analysis compels the rejection of Harper's due process claim. Aside from a passing reference to IRS data breaches in his reply brief, Harper makes no argument about public disclosure. Any such argument about the due process right against public disclosure is thus waived, see, e.g., United States v. Gordon, 954 F.3d 315, 323 n.1 (1st Cir. 2020), and we therefore need not consider whether our analysis regarding Harper's lack of a reasonable expectation of privacy would compel the same result in the context of public disclosure.

- 29 - stated that "the Due Process Clause of the Fifth Amendment . . . is

[not] offended when a federal administrative agency, without

notifying a person under investigation, uses its subpoena power to

gather evidence adverse to him." 467 U.S. at 742. The Court thus

rejected the argument that the targets of an SEC investigation had

a due process right to notice and opportunity to oppose a subpoena

of third parties pursuant to that investigation. Id.; see also

Hannah v. Larche, 363 U.S. 420, 442 (1960) (holding that procedural

due process rights do not apply "when governmental action does not

partake of an adjudication, as for example, when a general fact-

finding investigation is being conducted"); Aponte v. Calderón,

284 F.3d 184, 193 (1st Cir. 2002) ("[I]nvestigations conducted by

administrative agencies, even when they may lead to criminal

prosecutions, do not trigger due process rights.").

This precedent confirms our view that Harper's reliance

on his due process right to privacy cannot succeed. Here, just as

in Jerry T. O'Brien, the IRS's summons of Coinbase's records was

quintessential fact-finding that did not involve any sort of

adjudication of Harper's rights or liabilities. Accordingly,

Harper lacked any procedural due process right to be notified of

the IRS's investigative efforts or to oppose its summons issued to

a third party. To be sure, the Supreme Court did not directly

consider the protected liberty interest of keeping certain

sensitive information confidential. But we discern little

- 30 - difference between Harper's assertion of a right to keep his

Coinbase account information private from an IRS summons and the

purported right at issue in Jerry T. O'Brien. Indeed, by holding

that the Due Process Clause offers no protection from an agency

"using its subpoena power to gather evidence adverse to [a

person]," 467 U.S. at 742, the Jerry T. O'Brien Court seemed to

implicitly recognize that the possibility of an investigation

surfacing private information is not enough to entitle an

individual to procedural due process protections. Simply put,

Harper's effort to keep his Coinbase account information out of

the hands of the IRS appears to be no different from the

unsuccessful effort in Jerry T. O'Brien to stymie an investigation

that likewise implicated potentially sensitive financial

information but gave rise to no procedural due process protections.

In sum, the procedural protections of the Due Process

Clause are not implicated by the IRS's summons.18 Because Harper's

Fifth Amendment claim fails at this threshold step, we need not

consider whether he received constitutionally adequate process.

C. Statutory Factors

Finally, Harper seeks a declaratory judgment that the

IRS's summons was not issued in compliance with the factors set

18We note that our discussion here does not speak comprehensively to the rights of the recipient of a subpoena or summons or to the right of a defendant in a criminal case to challenge the basis for issuing such an order.

- 31 - out in 26 U.S.C. § 7609(f) for a John Doe summons. Harper advances

this claim under the APA. The IRS argued in the district court

that the summons was not agency action, as required to mount an

APA challenge. The district court declined to reach this question,

however, "assuming, without deciding," that the summons was

challengeable under the APA before rejecting it on other grounds.

Harper III, 675 F. Supp. 3d at 210. On appeal, the IRS renews its

contention that the APA does not authorize the relief Harper seeks.

See United States v. Roman, 942 F.3d 43, 50 (1st Cir. 2019) ("We

may affirm 'on any basis apparent in the record.'").19

The APA provides for judicial review of "final agency

action for which there is no other adequate remedy in a court." 5

U.S.C. § 704. To be considered "final," the agency action must

satisfy two conditions. First, it "must mark the 'consummation'

of the agency's decisionmaking process." Bennett v. Spear, 520

U.S. 154, 178 (1997) (quoting Chi. & S. Air Lines, Inc. v. Waterman

S.S. Corp., 333 U.S. 103, 113 (1948)). Second, "the action must

be one by which 'rights or obligations have been determined,' or

from which 'legal consequences will flow.'" Id. (quoting Port of

19 Harper asserts that the IRS has not raised a finality challenge, as it argued in the district court only that the summons was not "agency action," without analyzing whether it was "final." The IRS counters that, by arguing that the summons was not agency action at all, it was, necessarily, also contending that the summons was not final agency action. We agree with the IRS that the question of whether the APA authorizes judicial review of the IRS summons, as final agency action, is properly before us.

- 32 - Bos. Marine Terminal Ass'n v. Rederiaktiebolaget Transatl., 400

U.S. 62, 71 (1970)). Our analysis focuses on the first

requirement.

The IRS's summons of Coinbase's records is a preliminary

investigative step, far upstream of any potential tax enforcement

actions against Coinbase accountholders like Harper or any broader

agency action regarding the reporting of digital asset

transactions. Cf. United States v. Bisceglia, 420 U.S. 141, 146

(1975) (stating that "[t]he purpose of [the IRS's summons power]

is not to accuse, but to inquire" and that "such

investigations . . . are essential to our self-reporting system");

Harper II, 46 F.4th at 8 (stating that the scope of the IRS's

summonsing authority described under 26 U.S.C. § 7602 "clearly

fall[s] within the category of information gathering"). The

summons was thus not the "'consummation' of the agency's

decisionmaking process," but, rather, was "of a merely tentative

or interlocutory nature." Bennett, 520 U.S. at 178. Several of

our sister circuits have likewise concluded that investigatory

measures are not final agency action. See, e.g., Am. Civil

Liberties Union v. Nat'l Sec. Agency, 493 F.3d 644, 679 n.37 (6th

Cir. 2007) (concluding that surveillance activities are not final

agency action); Univ. of Med. & Dentistry of N.J. v. Corrigan, 347

F.3d 57, 69 (3d Cir. 2003) ("The decision to investigate is

normally seen as a preliminary step -- non–final by

- 33 - definition -- leading toward the possibility of a 'final action'

in the form of an enforcement or other action."); Reliable

Automatic Sprinkler Co. v. Consumer Prod. Safety Comm'n, 324 F.3d

726, 731 (D.C. Cir. 2003) ("The agency's conduct thus far amounts

to an investigation . . . . [This] agency activit[y] do[es] not

constitute final agency action within the meaning of the APA.");

Ass'n of Am. Med. Colls. v. United States, 217 F.3d 770, 780-81

(9th Cir. 2000) ("An investigation, even one conducted with an eye

to enforcement, is quintessentially non-final as a form of agency

action."); Jobs, Training & Servs., Inc. v. E. Tex. Council of

Gov'ts, 50 F.3d 1318, 1324 (5th Cir. 1995) ("[A]n agency's

initiation of an investigation does not constitute final agency

action." (quoting Veldhoen v. U.S. Coast Guard, 35 F.3d 222, 225

(5th Cir. 1994))); cf. FTC v. Standard Oil Co. of Cal., 449 U.S.

232, 241-42 (1980) (holding that the issuance of an administrative

complaint is not final agency action).

Nor are we aware of any judicial decision holding that

an agency's issuance of a summons or similar investigatory

instrument is final agency action reviewable under the APA. The

lone case Harper cites is Sackett v. EPA, 566 U.S. 120, 126 (2012),

in which the Supreme Court held that an EPA compliance order which

required the petitioners, among other things, to "give the EPA

access to their property and to 'records and documentation related

to the conditions at the [s]ite,'" was final agency action. Id.

- 34 - Putting aside that this order also imposed a "legal obligation to

'restore' their property according to an Agency-approved

Restoration Work Plan," id., the analysis in Sackett pertained to

the second finality requirement: that the agency action determine

rights and obligations. See Bennett, 520 U.S. at 178. Our

analysis, however, pertains to the first requirement: that the

action mark "the 'consummation' of the agency's decisionmaking

process." Id. (quoting Bennett, 520 U.S. at 178). For the reasons

we describe, a summons issued as part of a broader investigation

is not such a consummation.

Mindful that early "[j]udicial intervention into the

agency process denies the agency an opportunity to correct its own

mistakes and to apply its expertise," Standard Oil, 449 U.S. at

242, it strikes us as premature at this point to wade into the

IRS's investigation of potential widespread misreporting of income

from digital asset transactions. See also id. at 243 (cautioning

against premature judicial review as "a means of turning prosecutor

into defendant before adjudication concludes"); Univ. of Med. &

Dentistry of N.J., 347 F.3d at 69 ("In the ordinary course, an

investigation is the beginning of a process that may or may not

lead to an ultimate enforcement action."). We thus affirm the

district court's dismissal of Harper's statutory claim without

needing to address the requirements of § 7609(f).

- 35 - III.

Having rejected all three of Harper's lines of attack,

we affirm the district court's dismissal of Harper's complaint for

the reasons explained herein.

So ordered.

- 36 -