Harper v. Werfel

118 F.4th 100

Opinion

United States Court of Appeals For the First Circuit

No. 23-1565 JAMES HARPER,

Plaintiff, Appellant,

v.

DANIEL I. WERFEL, in his official capacity as Commissioner of the Internal Revenue Service; INTERNAL REVENUE SERVICE; JOHN DOE IRS AGENTS 1-10.

Defendants, Appellees.

APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE

[Hon. Joseph N. Laplante, U.S. District Judge]

Before

Kayatta, Lipez, and Gelpí, Circuit Judges

Sheng Tao Li, with whom Richard Abbott Samp and New Civil Liberties Alliance were on brief, for appellant.

Kathleen E. Lyon, Attorney, Tax Division, Department of Justice, with whom David A. Hubbert, Deputy Assistant Attorney General, Francesca Ugolini, and Jennifer Marie Rubin, Attorneys, were on brief, for appellees.

Rodrigo Seira, Paradigm Operations LP, Omer Tene, Christopher J.C. Herbert, Andrew Kim, Gabe Maldoff, and Goodwin Procter LLP on brief for Paradigm Operations LP, amicus curiae.

Edward M. Wenger, John Cycon, and Holtzman Vogel Baran Torchinsky & Josefiak PLLC on brief for Coin Center, amicus curiae.

J. Abraham Sutherland, Cameron T. Norris, Jeffrey S. Hetzel, and Consovoy McCarthy PLLC on brief for DeFi Education Fund, amicus curiae.

Ryan P. Mulvey, Lee A. Steven, and Americans for Prosperity Foundation on brief for Americans for Prosperity Foundation, amicus curiae.

Tyler Martinez and National Taxpayers Union Foundation on brief for National Taxpayers Union Foundation, amicus curiae.

September 24, 2024

LIPEZ, Circuit Judge. This appeal addresses a so-called "John Doe" summons issued by the Internal Revenue Service ("IRS") to Coinbase, a cryptocurrency exchange, seeking Coinbase's records containing information about numerous Coinbase customers, including appellant James Harper. Harper contends that the IRS's investigative efforts infringed his privacy and property rights in contravention of the Fourth and Fifth Amendments. Invoking the Administrative Procedure Act ("APA"), he also asserts that the summons did not satisfy statutory requirements for issuing a John Doe summons. See 26 U.S.C. § 7609(f).

The district court dismissed Harper's complaint, concluding, as pertinent to his constitutional claims, that he lacked a reasonable expectation of privacy in his Coinbase account information, and that Coinbase's records were not his property. It further concluded that, in any event, the IRS summons was reasonable, and Harper had received constitutionally adequate process. The court also rejected Harper's statutory challenge, dismissing it as an improper collateral attack on prior district court proceedings enforcing the summons and finding the IRS summons to satisfy the statutory standard.

We agree that Harper lacks a protectable interest under the Fourth or Fifth Amendment, and thus affirm on that basis. Finding that he has not raised a challenge to final agency action,

4

as required to mount an APA claim, we affirm the dismissal of his statutory claim as well.

I.

A. Factual Background Because we review the dismissal of Harper's complaint, we draw our recitation of the facts from Harper's well-pleaded allegations, assuming their truth and drawing all reasonable inferences in Harper's favor. See, e.g., Legal Sea Foods, LLC v. Strathmore Ins. Co., 36 F.4th 29, 30, 34 (1st Cir. 2022).

Harper opened a Coinbase account in 2013. Coinbase is a digital currency exchange that facilitates transactions between accountholders. In 2013 and 2014, Harper made several deposits of Bitcoin, a popular digital currency, into his Coinbase account.1 In 2015, Harper began liquidating his Bitcoin holdings or transferring them from Coinbase to a hardware wallet.2 By early

1 Harper primarily received this Bitcoin as income from consulting work. Harper alleges that he properly reported to the IRS all Bitcoin he received and properly reported all capital gains or losses associated with his Bitcoin holdings in the ensuing years. This appeal does not involve any challenge to those assertions.

2A hardware wallet is an offline device, often resembling a USB thumb drive, used to store the "private keys" necessary for a digital currency user to transact digital currency. See Harper v. Rettig, 46 F.4th 1, 3 n.3 (1st Cir. 2022) (quoting Virtual Currency Storage, IRM 5.1.18.20.2 (July 17, 2019)). This "'secure offline' version of a virtual currency wallet," in comparison to a software wallet downloaded to a computer or mobile device, is "immune to computer viruses," does not allow private keys to be transferred in unencrypted fashion, and "is not open source," thus making the

5

2016, Harper no longer had any Bitcoin holdings in his Coinbase account.3 In 2019, Harper received a letter from the IRS informing him that the agency "ha[s] information that you have or had one or more accounts containing virtual currency but may not have properly reported your transactions involving virtual currency." Harper alleges that the IRS's letter refers to information the agency obtained via a "John Doe" summons the agency issued to Coinbase in 2016. A John Doe summons is an ex parte third-party summons issued "where the IRS does not know the identity of the taxpayer[s] under investigation." Tiffany Fine Arts, Inc. v. United States, 469 U.S. 310, 316 (1985) (emphasis omitted). Such a summons may only issue following a court proceeding in which the IRS establishes that certain statutory criteria have been satisfied,4 and the

device a highly secure alternative for transacting digital currency. Id.

3 In his amended complaint, Harper also describes Bitcoin transactions made through two other exchanges, Abra and Uphold. His association with these two exchanges is not relevant to the issues in this appeal.

4 These factors are:

(1) the summons relates to the investigation of a particular person or ascertainable group or class of persons,

(2) there is a reasonable basis for believing that such person or group or class of persons may fail or may have failed to comply with any provision of any internal revenue law, and (3) the information sought to be obtained from the examination of the records or testimony

6

summons must be "narrowly tailored to information that pertains to the failure (or potential failure) of the [individuals targeted by the summons] to comply with [the tax code]." 26 U.S.C. § 7609(f).

Initially, the 2016 John Doe summons sought information on all United States Coinbase accountholders who conducted digital currency transactions between 2013 and 2015. See United States v. Coinbase, Inc., No. 17-cv-01431, 2017 WL 5890052, at *1 (N.D. Cal. Nov. 28, 2017). The agency requested several categories of documents, including "complete user profiles, know-your-customer due diligence, documents regarding third-party access, transaction logs, records of payments processed, correspondence between Coinbase and Coinbase users, account or invoice statements, records of payments, and exception records produced by Coinbase's AML system." Id. Coinbase opposed the summons, and the IRS filed a petition to enforce the summons in the United States District Court for the Northern District of California. See generally id.

The agency subsequently and voluntarily narrowed the summons to encompass only users who had engaged in $20,000 worth of any one type of digital currency transaction (buying, selling, sending, or receiving) in any one calendar year. Id. at *2. As

(and the identity of the person or persons with respect to whose liability the summons is issued) is not readily available from other sources.

26 U.S.C. § 7609(f).

7

narrowed, the summons targeted 14,355 Coinbase accounts, seeking the following records: (1) registration information "limited to name, address, tax identification number, date of birth, account opening records, copies of passport or driver's license, all wallet addresses, and all public keys for all accounts/wallets/vaults"; (2) know-your-customer due diligence; (3) "[a]greements or instructions granting a third-party access, control, or transaction approval authority"; (4) account "activity including transaction logs or other records identifying the date, amount, and type of transaction (purchase/sale/exchange)," the names of counterparties to the transaction, and certain Coinbase account information of those counterparties; (5) "[c]orrespondence between Coinbase and the user" or authorized third parties; and (6) "[a]ll periodic statements of account or invoices (or the equivalent)." Id.

Coinbase continued to oppose the narrowed summons.5 See id. The court enforced the summons in part, finding the agency was justified, under 26 U.S.C. § 7602(a), which authorizes the IRS to issue summonses to "ascertain[] the correctness of any return,

5 The court allowed a John Doe to intervene in the proceedings,

and it also permitted three amici to file briefs opposing the summons. See Coinbase, 2017 WL 5890052, at *1, *3. Harper participated in the filing of one of these briefs, though he did so in a professional capacity and not, so far as the record reveals, based on a belief that his account information was implicated by the summons.

8

mak[e] a return where none has been made, determin[e] the liability of any person for any internal revenue tax or ... collect[] any such liability," in obtaining the following documents: (1) the taxpayer ID number, (2) name, (3) date of birth, (4) address, (5) "records of account activity including transaction logs or other records identifying the date, amount, and type of transaction (purchase/sale/exchange), the post transaction balance, and the names of counterparties to the transaction," and (6) "all periodic statements of account or invoices (or the equivalent)." Coinbase, 2017 WL 5890052, at *8-9.6 Neither party appealed the court's enforcement order. B. Procedural History After receiving the IRS letter, Harper filed a complaint in the United States District Court for the District of New Hampshire,7 alleging violations of the Fourth and Fifth Amendments and seeking a declaration that the John Doe summons did not satisfy the § 7609(f) factors. As the district court put it, "[a]t its core, Harper's request for declaratory or injunctive relief seeks

6As narrowed by the district court, the summons thus excluded several categories of information originally sought by the IRS, including "[r]ecords of Know-Your-Customer diligence," "[a]greements or instructions granting a third-party access, control, or transaction approval authority," and "[c]orrespondence between Coinbase and the user or any third party." Id. at *7.

7 Harper's amended complaint names as defendants the IRS, the Commissioner of the IRS, and 10 John Doe IRS agents. We refer to these parties collectively as "the IRS."

9

to compel the IRS to return or destroy the records it received from Coinbase relating to his account." Harper v. Rettig, 675 F. Supp. 3d 190, 199 n.18 (D.N.H. 2023). The district court dismissed the complaint, see Harper v. Rettig ("Harper I"), No. 20-cv-771, 2021 WL 1109254, at *3-5 (D.N.H. Mar. 23, 2021), on the ground that it lacked jurisdiction under the Anti-Injunction Act, which provides that "no suit for the purpose of restraining the assessment or collection of any tax shall be maintained in any court by any person," 26 U.S.C. § 7421(a). We vacated that judgment, however, concluding that Harper's contention that "the IRS acquired [and retained his financial information] in violation of the Constitution and 26 U.S.C § 7609(f)" did not relate to the collection or assessment of a tax. Harper v. Rettig ("Harper II"), 46 F.4th 1, 8 (1st Cir. 2022).

The IRS again moved to dismiss, under Federal Rule of Civil Procedure 12(b)(6), arguing that Harper had failed to state a claim for a variety of reasons. The district court agreed. See Harper ("Harper III"), 675 F. Supp. 3d at 213. In dismissing Harper's Fourth Amendment claim, the court held that Harper lacked a reasonable expectation of privacy in information he voluntarily divulged to Coinbase and that Coinbase's records regarding his account activity were Coinbase's property, not Harper's. Id. at 200-04. The court also held, in the alternative, that the summons was reasonable because it complied with the requirements for IRS

10

summonses laid out in United States v. Powell, 379 U.S. 48, 57 (1964).8 See Harper III, 675 F. Supp. 3d at 203-05. The district court rejected Harper's Fifth Amendment claim on largely similar grounds, holding that because Harper lacked a privacy-based or property interest in his Coinbase account information, he had suffered no deprivation giving rise to due process protection. See id. at 206-07. Alternatively, the court found that Harper had received constitutionally adequate process. See id. at 207-08. Finally, the court dismissed Harper's statutory claim, "assum[ing], without deciding," that he was entitled to judicial review under the APA but concluding that his effort was an improper collateral attack on the prior order by the Northern District of California enforcing the summons and holding that the summons

8 In Powell, the Court held that, under 26 U.S.C. § 7602, "the [IRS] Commissioner need not meet any standard of probable cause to obtain enforcement of his summons . . . . He must show that the investigation will be conducted pursuant to a legitimate purpose, that the inquiry may be relevant to the purpose, that the information sought is not already within the Commissioner's possession, and that the administrative steps required by the Code have been followed." 379 U.S. at 57-58. As Harper notes, Powell thus concerned only the statutory requirements pertaining to IRS summonses and was not a Fourth Amendment case. The district court observed, however, that several circuits have concluded that satisfaction of the Powell requirements is enough to show that the summons was reasonable under the Fourth Amendment. See Harper III, 675 F. Supp. 3d at 204-05 (collecting examples). We have said the same in dicta. See United States v. Allee, 888 F.2d 208, 213 n.3 (1st Cir. 1989). Because Harper lacked an interest protected by the Fourth Amendment, see infra section II.A, we need not determine whether satisfaction of the Powell factors also, by extension, satisfies the Fourth Amendment reasonableness requirement.

11

satisfied the § 7609(f) factors. Id. at 210; see also id. at 209- 13. This timely appeal ensued.

II.

We review de novo the district court's dismissal of all three of Harper's claims. See Legal Sea Foods, 36 F.4th at 34. A. Fourth Amendment The Fourth Amendment protects "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." U.S. Const. amend. IV. A "search," as conceived in the context of the Fourth Amendment, can take two forms: it may be an intrusion upon a person's reasonable expectations of privacy, see, e.g., Katz v. United States, 389 U.S. 347, 351 (1967), or it may involve a "physical[] intru[sion] on a constitutionally protected area," Carpenter v. United States, 585 U.S. 296, 304 (2018) (quoting United States v. Jones, 565 U.S. 400, 405, 406 n.3 (2012)). Harper relies upon both theories in support of his Fourth Amendment claim: he had a reasonable expectation of privacy in his Coinbase account information, and his account records were his personal property, which he had transferred to Coinbase as a "bailment." We address each contention in turn.

1. Reasonable Expectation of Privacy Under a privacy-based theory, "the application of the Fourth Amendment depends on whether the person invoking its

12

protection can claim a justifiable, a reasonable, or a legitimate expectation of privacy that has been invaded by government action." Smith v. Maryland, 442 U.S. 735, 740 (1979) (internal quotation marks omitted) (collecting cases). This "reasonable-expectation- of-privacy" inquiry contains subjective and objective elements: "the individual [must] 'exhibit[] an actual (subjective) expectation of privacy,'" id. (quoting Katz, 389 U.S. at 361 (Harlan, J., concurring)), and "the individual's expectation, viewed objectively, [must be] 'justifiable' under the circumstances," id. (quoting Katz, 389 U.S. at 353). Because Harper's complaint makes clear that he expected his Coinbase account information to remain confidential, his privacy-based theory turns on whether his expectation of privacy was justified under controlling law.

The Supreme Court "consistently has held that a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties." Id. at 743-44 (collecting cases). This principle holds true "even if the information is revealed on the assumption that it will be used only for a limited purpose and the confidence placed in the third party will not be betrayed." Id. at 744 (quoting United States v. Miller, 425 U.S. 435, 443 (1976)). Of particular relevance here, the Court held in Miller that an individual has no legitimate expectation of privacy in "information kept in bank records," as

13

these documents, "including financial statements and deposit slips, contain only information voluntarily conveyed to the banks and exposed to their employees in the ordinary course of business." 425 U.S. at 442; see also id. at 444 (restating its conclusion that "no Fourth Amendment interests of the depositor are implicated here").

We agree with the IRS (and the district court) that the account information obtained by the agency in this case falls squarely within this "third party doctrine" line of precedent. See, e.g., United States v. Gratkowski, 964 F.3d 307, 312 (5th Cir. 2020) (holding, under Miller and Smith, that a Coinbase user lacks a reasonable expectation of privacy in Coinbase account information). All the information revealed to the IRS pursuant to the enforced summons -- personal identifiers such as taxpayer identification number, name, and address; records of account activity such as transaction logs; and statements -- is directly analogous to the bank records at issue in Miller -- checks, deposit slips, and financial statements. See id.; see also Miller, 425 U.S. at 444 (comparing the subpoena in that case to a third-party IRS summons targeting a financial institution's depositors and stating, in dicta, that "an [IRS] summons directed to a third- party bank does not violate the Fourth Amendment rights of a depositor under investigation"); Donaldson v. United States, 400 U.S. 517, 522 (1971) (similar); S.E.C. v. Jerry T. O'Brien, Inc.,

14

467 U.S. 735, 743 (1984) (relying on the third-party doctrine to reject a Fourth Amendment challenge to third-party subpoena of financial records). In fact, Coinbase's terms of service expressly warn accountholders of the possibility of disclosure to law enforcement.

Revealingly, Harper's first line of attack against application of the third-party doctrine here is to invoke sentiment by academics and individual Supreme Court justices that the "doctrine is not only wrong, but horribly wrong." Carpenter, 585 U.S. at 388 (Gorsuch, J., dissenting) (quoting Orin Kerr, The Case for the Third–Party Doctrine, 107 Mich. L. Rev. 561, 563 n.5, 564 (2009)); see also Jones, 565 U.S. at 417 (Sotomayor, J., concurring) ("[The third-party doctrine] is ill suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks."). But, of course, we are bound to faithfully apply Supreme Court precedent notwithstanding the concerns of scholars and some justices.

Harper's arguments against "extending" the third-party doctrine to digital currency exchanges are no more convincing. Harper relies primarily on Carpenter, in which the Supreme Court held that an individual has a reasonable expectation of privacy in cell-site location information ("CSLI"), which is a time-stamped record of a cell phone user's approximate location generated each

15

time the cell phone connects to the wireless network. See 585 U.S. at 300-01, 315-16. Those records typically are created several times every minute, whether or not the cell phone user is even actively using the phone. See id. at 300-01. The CSLI in Carpenter has little in common, however, with Harper's Coinbase account information. An individual's CSLI amounts to a "detailed chronicle of a person's physical presence compiled every day, every moment, over several years," "implicat[ing] privacy concerns far beyond those considered in Smith and Miller." Id. at 315. By contrast, the information contained in financial records like those at issue here, even several years' worth of them, does not paint nearly so detailed a portrait of an individual's daily activity. While such records may capture some intimate information, the same is true of traditional bank records, and yet the Miller Court had no trouble concluding that a subpoena of such records does not impermissibly intrude upon "intimate areas of an individual's personal affairs." 425 U.S. at 444 n.6 (quoting Cal. Bankers Ass'n v. Shultz, 416 U.S. 21, 78 (1974) (Powell, J., concurring)).

Additionally, the Carpenter Court noted that CSLI "is not truly 'shared' as one normally understands the term." Carpenter, 585 U.S. at 315. Carrying a cell phone is "indispensable to participation in modern society," and "a cell phone logs a cell-site record by dint of its operation, without

16

any affirmative act on the part of the user beyond powering up." Id. Plainly, participating in a digital currency exchange is not "indispensable," id., certainly no more so than having a traditional bank account. And transactions on Coinbase occur only when a user opts into that activity, unlike a cellphone automatically pinging a cell site, even while passively sitting in the user's pocket. See Gratkowski, 964 F.3d at 312 (similarly distinguishing Coinbase records from CSLI because "Coinbase records are limited" and "transacting Bitcoin through Coinbase . . . requires an 'affirmative act on [the] part of the user'" (quoting Carpenter, 585 U.S. at 315)).

Harper also cites United States v. Warshak, 631 F.3d 266, 287-88 (6th Cir. 2010), in which the Sixth Circuit held that individuals have a legitimate expectation of privacy in the contents of their emails, notwithstanding the third-party doctrine. In that case, federal agents obtained a criminal defendant's emails via a subpoena served on his internet service provider, which stored the email content in the process of delivering messages sent by or to the defendant, not unlike a mail carrier delivering a letter. Id. The court distinguished Miller because as an "intermediary" of emails, rather than the "intended recipient," the internet service provider holding those emails did not "put th[at] information to use 'in the ordinary course of business'" in the same manner that a financial institution

17

generates and uses its records regarding account activity as a core component of its business model. Id. at 287-88 (quoting Miller, 425 U.S. at 442). Here, by contrast, the IRS summonsed business records much like those in Miller, generated by Coinbase in its "ordinary course of business" as a financial institution and consisting of information "voluntarily conveyed to [Coinbase]." Miller, 425 U.S. at 442; see also id. at 440 (noting that the account information at issue "pertain[ed] to transactions to which the bank was itself a party" (quoting Cal. Bankers Ass'n, 416 U.S. at 52)).

Finally, we disagree with Harper's contention that Miller is distinguishable because "[c]ryptocurrency transactions are confidential by nature" thanks to the anonymity of the blockchain, a pseudonymized public ledger of all Bitcoin transactions.9 We do not doubt that because digital currency

9Several amici elaborate on this concern. As they explain, transactions are registered on the blockchain for all to see, using a pseudonymous "wallet address," derived from a "public key," associated with each party to the transaction. If a person's identity becomes associated with an address or public key, thus piercing the veil of anonymity, anyone aware of that information can easily ascertain all transactions the person has made using that address -- or track future transactions. Though the IRS disputed at oral argument that any wallet addresses or public keys were included in the information the IRS obtained, we agree with Harper and his amici that exposure of this information was a reasonably likely consequence of the IRS summons, either directly or by analyzing the transaction data that was included. Ultimately, however, our agreement with Harper on this point makes no difference in our conclusion that he lacked a reasonable expectation of privacy.

18

transactions are recorded on a public ledger, exposure of a person's identity opens a potentially wide window into that person's financial activity contained on that ledger. But that possibility does not alter our conclusion that the information at risk of exposure -- all concerning financial transactions -- is, fundamentally, much more analogous to the financial information at issue in Miller than to the uniquely comprehensive, locational data at issue in Carpenter.

Indeed, we fail to see how the decision to transmit financial information to the public -- even pseudonymously -- makes the expectation of privacy more reasonable than doing so privately, given the heightened consequences of exposure that Harper identifies. In other words, even if Harper chose to transact Bitcoin because he felt the technology would protect his privacy more than traditional banking (and his complaint does not allege as much), that choice would only inform, subjectively speaking, whether "he [sought] to preserve [something] as private," Katz, 389 U.S. at 351, not whether his expectation of privacy was objectively legitimate. The fact remains that Harper voluntarily divulged information about his Bitcoin transactions to Coinbase. Indeed, Harper could have bypassed a digital currency exchange like Coinbase and conducted his Bitcoin transactions through decentralized, peer-to-peer transactions, which "maintain [the] high level of privacy"

19

associated with the blockchain but require specialized software and greater technical proficiency. Gratkowski, 964 F.3d at 312- 13. Instead, Harper evidently chose "to sacrifice some privacy" in return for use of an intermediary, a more convenient method of transacting Bitcoin that "requires [less] technical expertise." Id.10 Because Harper lacked a reasonable expectation of privacy in his Coinbase account information, we reject his privacy- based theory for his claim of a Fourth Amendment violation.

Harper also argues that Miller and Gratkowski are 10

distinguishable because they involved subpoenas concerning one person, whereas here the IRS's summons concerned numerous Coinbase accounts. But in support of that argument, Harper relies primarily on a pre-Miller case from the Third Circuit that merely states, as a general principle, that the government may not engage in "fishing expedition[s]," United States v. Dauphin Deposit Tr. Co., 385 F.2d 129, 131 (3d Cir. 1967), a protection rooted in the Fourth Amendment's reasonableness requirement and thus irrelevant to the reasonable-expectation-of-privacy inquiry as it pertains to whether Harper, as an individual, reasonably expected his information to remain private. Harper correctly notes in his reply brief that in United States v. Knotts, 460 U.S. 276, 284 (1983), the Supreme Court reserved the question of whether the third-party doctrine applies to "dragnet type law enforcement practices." But the Court never suggested in that case (or in the forty years since) that an individual's expectation of privacy is somehow stronger in cases involving multiple targets, notwithstanding that individual's decision to turn over that information to third parties. Simply put, thus, neither Knotts nor Dauphin provides any reason to disregard our straightforward application of Miller to conclude that Harper lacked a reasonable expectation of privacy in information he voluntarily turned over to Coinbase.

20

2. Property

Harper also argues, in effect, that his Coinbase account records, though in Coinbase's possession, were his "private papers," and thus the IRS's inspection of this information was akin to an intrusion on his personal property, giving rise to Fourth Amendment protections. Harper's novel theory relies heavily on Justice Gorsuch's solo dissenting opinion in Carpenter. See 585 U.S. at 397-406. Though Justice Gorsuch did not agree with the majority that the defendant had a reasonable expectation of privacy in his CSLI notwithstanding the third-party doctrine, Justice Gorsuch argued that he might have had a property interest in his CSLI that could serve as the basis for his Fourth Amendment claim. Id. at 405-06; see also id. at 397-404 (discussing why a property-based approach, rather than a reasonable-expectation-of- privacy standard, is, in Justice Gorsuch's view, a preferable method for resolving Fourth Amendment claims).

Relying on Justice Gorsuch's supposition, Harper argues that he has a property interest in his Coinbase account records. Yet, despite Justice Gorsuch's recognition that any such interest needs to be anchored in law, Harper makes no effort in his opening brief to explain the legal source of the interest he asserts.11

11At oral argument, Harper's counsel did point to references in Coinbase's terms of service to "information about your transactions," "your personal information," and "your account information," arguing that these phrases reflect a contractual

21

See Carpenter, 585 U.S. at 405-06 (Gorsuch, J., dissenting) (concluding, based on an analysis of 47 U.S.C. § 477, that "customers have substantial legal interests in [CSLI], including at least some right to include, exclude, and control its use," that "might even rise to the level of a property right," but adding that the defendant "offered no analysis . . . of what rights state law might provide him"); see also Cahoon v. Shelton, 647 F.3d 18, 28 (1st Cir. 2011) ("A court tasked with determining whether a constitutionally protected property interest exists must look to 'existing rules or understandings that stem from an independent source such as state law.'" (quoting Bd. of Regents of State Colls. v. Roth, 408 U.S. 564, 577 (1972))). Harper simply asserts that the property interest exists because these records are his "papers," but his facile reliance on that word from the text of the Fourth Amendment is inadequate, as "[p]roperty interests . . . are not created by the Constitution." Roth, 408 U.S. at 577; see also Cahoon, 647 F.3d at 29 ("A party's unilateral expectation, in itself, cannot create a constitutionally protected property interest.").

understanding that the information belonged to Harper. Putting aside that arguments made for the first time at oral argument are waived, see, e.g., Guardado v. United States, 76 F.4th 17, 23 n.4 (1st Cir. 2023), we perceive an obvious difference between a reference to "your information," meaning information about Harper, some of which was provided by him but some of which Coinbase collected in the course of his account activity, and the actual records generated and held by Coinbase based on that information.

22

Harper's failure to elaborate on the nature of his purported property right is especially significant because his property-based claim faces significant headwinds in Supreme Court precedent. In Miller, the Court remarked that, with no ability to assert ownership or possession, the respondent could not claim the financial records as his own "private papers." 425 U.S. at 440. They were "[i]nstead . . . the business records of the banks," as "all of the records [which must be retained under the Bank Secrecy Act] pertain[ed] to transactions to which the bank was itself a party." Id. (quoting Ca. Bankers Ass'n, 416 U.S. 21, 52 (1974)); cf. Donaldson, 400 U.S. at 523 (stating that a taxpayer had "no proprietary interest of any kind" in records "owned by [a] third person, which are in [the third person's] hands, and which relate to the third person's business transactions with the taxpayer"). The same logic applies here.

Thus, while Harper asserts that Coinbase is merely a "bailee" of his financial records,12 his allegations tell a different story. Most of the records included in the summons, as ultimately enforced, appear to be documents generated by Coinbase, such as records of transactions that Coinbase facilitated and

12As Justice Gorsuch explained in his Carpenter dissent, "[a]

bailment is the 'delivery of personal property by one person (the bailor) to another (the bailee) who holds the property for a certain purpose.'" 585 U.S. at 399 (emphasis removed) (quoting Black's Law Dictionary 169 (10th ed. 2014)).

23

periodic account statements. Other information obtained -- taxpayer ID number, name, birthdate, address -- appears to simply be basic biographical information necessary to open a Coinbase account. Given the Miller Court's rejection of such financial records as an individual's "private papers" rather than the property of the financial institution, we see no basis to conclude that the IRS intruded upon Harper's protected property rights.

None of the cases Harper cites compels a different result. The decisions in Warshak, 631 F.3d at 287, and United States v. Ackerman, 831 F.3d 1292, 1304 (10th Cir. 2016), both concerning emails, analyzed the Fourth Amendment question under the reasonable-expectation-of-privacy standard, not under a property-based approach. And in Carpenter v. United States, 484 U.S. 19, 26-27 (1987);13 Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1001-04 (1984); and Boyd v. United States, 116 U.S. 616, 638 (1886), all cases recognizing a property interest in business records or personal papers, it was clear, unlike here, that the asserted property belonged to the party claiming the interest.14

Not to be confused with the 2018 Carpenter v. United States 13

cited extensively in our reasonable-expectation-of-privacy analysis.

14Boyd, for instance, concerned the "compulsory production of [the defendant's] private papers," namely, the defendant's personally held records of invoices concerning the importation of several cases of glass. 116 U.S. at 622.

24

Similarly, Jones, 565 U.S. at 404 n.2, 405-11, and Ex Parte Jackson, 96 U.S. 727, 723 (1878), both involved property bailments, whereas here, as explained, Coinbase was not in possession of Harper's property. The summonsed records were its own.

Accordingly, we agree with the district court that Harper lacked a constitutionally protected property interest in Coinbase's records related to his account.

* * *

In sum, Harper had neither a reasonable expectation of privacy in the Coinbase account information nor a cognizable property interest in Coinbase's records. Because Harper's Fourth Amendment claim fails at this threshold, we need not assess whether the summons was reasonable under Fourth Amendment principles. B. Fifth Amendment Harper next argues that the IRS violated his Fifth Amendment right to procedural due process when it used the summons to obtain his Coinbase account records without providing him notice or an opportunity to be heard. See U.S. Const. amend. V ("No person shall . . . be deprived of life, liberty, or property, without due process of law."); Aponte-Rosario v. Acevedo-Vilá, 617 F.3d 1, 9 (1st Cir. 2010) ("[T]he essential requirements of procedural due process include adequate notice and an opportunity to be heard 'at a meaningful time and in a meaningful manner.'"

25

(quoting Amsden v. Moran, 904 F.2d 748, 753 (1st Cir.1990))).15 To establish an entitlement to these procedural protections, Harper must first show that the IRS deprived him of an interest protected by the Due Process Clause, namely, his property or his liberty. See Roe v. Lynch, 997 F.3d 80, 85 (1st Cir. 2021). While Harper argues that the summons deprived him of his property right in his Coinbase account records, he acknowledges that his purported property interest is no different from the one we rejected in connection with his Fourth Amendment claim. We thus limit our discussion to Harper's theory that the IRS deprived him of a protected Fifth Amendment liberty interest in the privacy of his financial information.

In sourcing his claimed right to privacy, Harper relies principally on Whalen v. Roe, 429 U.S. 589, 598-604 (1977), in which the Supreme Court recognized that the Due Process Clause's protection of liberty includes "avoiding disclosure of personal matters," including, to some degree, "disclosures to representatives of the State." Id. at 599, 602. Despite that recognition, the Supreme Court upheld a state statute requiring

15 While many of the precedents we discuss concern the Due Process Clause of the Fourteenth Amendment, "the language and policies of the Due Process Clauses of the Fifth and Fourteenth Amendments are essentially the same," and thus "due process cases decided under the Fourteenth Amendment provide guidance in due process cases arising under the Fifth Amendment." United States v. Neto, 659 F.3d 194, 201 n.7 (1st Cir. 2011) (quoting United States v. Bohn, 281 F. App'x 430, 434 n.4 (6th Cir. 2008)).

26

physicians to disclose to the government the identities of patients to whom they prescribed certain controlled substances, explaining, as most relevant here, that such disclosure was not "meaningfully distinguishable" from other "disclosures of private medical information to doctors, to hospital personnel, to insurance companies, and to public health agencies [that] are often an essential part of modern medical practice" and was thus not "an impermissible invasion of privacy." Id. at 602. Harper also cites Nixon v. Adm'r of Gen. Servs., 433 U.S. 425 (1977), in which the Supreme Court recognized that the president has a "legitimate expectation of privacy" in "matters of personal life unrelated to any [official] acts," although the Court once again rejected the underlying due process claim, finding that privacy interest outweighed by the public interest in archiving the official records with which that private information was intermingled. Id. at 457- 58, 465. We have likewise recognized a due process "right of confidentiality," though we have cautioned that such a right does not "extend[] beyond prohibiting profligate disclosure of medical, financial, and other intimately personal data." Vega-Rodriguez v. P.R. Tel. Co., 110 F.3d 174, 183 (1st Cir. 1997). Thus, in that case, we rejected a due process challenge to a state agency's video surveillance of its employees in the workplace, reasoning that "[a]ny data disclosed . . . ha[d] been revealed knowingly by the [employees] to all observers (including the video cameras)," and

27

therefore "cannot be characterized accurately as 'personal' or 'confidential.'" Id. at 183.

Harper is correct that these cases establish that the substantive component of the Due Process Clause protects a limited liberty interest in the confidentiality of certain intimate information. And we can assume, without deciding, that Harper also is correct that this protectable privacy interest may encompass certain sensitive financial information. Even with that assumption, however, Harper's claim that the IRS deprived him of such a liberty interest nonetheless fails because -- as we already have concluded -- he lacked any reasonable expectation of privacy in the circumstances here. See supra Section II.A.1. In other words, because Harper could not reasonably expect Coinbase, faced with an IRS summons, to withhold the type of financial information he chose to submit to the company (or the related Coinbase records), Harper lacks a cognizable due process interest in the confidentiality of those records.16

The district court held that Harper's assertion of a 16

protected liberty interest failed because there is no liberty interest in the privacy of financial information generated and held by a third-party financial institution like Coinbase. See Harper III, 675 F. Supp. 3d at 206. Our holding is more limited. Starting with the assumption that the Due Process Clause protects some kinds of personal financial information, we conclude only that Harper lacks a Fifth Amendment privacy interest in the specific financial information he voluntarily gave to Coinbase. We do not consider whether individuals would have a due process liberty interest in the same type of information in different circumstances, or whether other types of personal financial

28

While Harper argues that our reasonable-expectation-of-

privacy analysis is inapplicable to the due process context, that assertion is belied by precedent. In Whalen, for example, the Supreme Court found no privacy violation because the information sought by the state was already routinely disclosed to other parties. See 429 U.S. at 878. Similarly, in Nixon, 433 U.S. at 465, the Supreme Court analyzed the president's privacy interest through the prism of his "legitimate expectation of privacy." And in Payne v. Taslimi, 998 F.3d 648, 657 (4th Cir. 2021), and Walls v. City of Petersburg, 895 F.2d 188, 192 (4th Cir. 1990), which concern the disclosure of financial data, and upon which Harper also relies, the first step of the Fourth Circuit's due process inquiry was to determine whether there was a reasonable expectation of privacy. Accordingly, having already concluded that Harper lacked any reasonable expectation of privacy in his Coinbase account information, we cannot say that Harper has been "deprived" of a constitutionally protected privacy interest by the disclosure of that information to the IRS.17

information would be protected by the Fifth Amendment even when voluntarily transferred to a third-party financial institution. Because Harper fails to assert a cognizable liberty interest even with the benefit of our assumption that financial records may give rise to such an interest, we choose to affirm the district court's dismissal of his Fifth Amendment claim without further examining the extent to which the Due Process Clause protects the confidentiality of personal financial information.

17To be sure, Whalen discussed two constitutionally protected forms of confidentiality: nondisclosure to the government and

29

We note, moreover, that the disclosure of Coinbase's transaction logs and account statements to the IRS for investigative purposes, pursuant to a twice-narrowed summons and a judicial enforcement order, would hardly seem to count as "profligate," as we have said it must be to implicate a protected liberty interest in the confidentiality of information. Vega- Rodriguez, 110 F.3d at 182. For this reason as well, we think that Harper has clearly failed to show that the IRS deprived him of any protected liberty interest in the nondisclosure of intimate information.

Finally, though neither the district court nor the IRS relied on this body of law, we must note that Harper's privacy- based reliance on the protections of procedural due process to challenge the IRS's summons appears to suffer from an even more fundamental problem. In SEC v. Jerry T. O'Brien, the Supreme Court

nondisclosure to the public resulting from the government's acquisition of personal information. See 429 U.S. at 591, 600-01 (evaluating a state statute requiring a centralized record of the names and addresses of individuals prescribed certain controlled substances). For the reasons explained above, we think that nondisclosure to the government is sufficiently analogous to privacy as conceptualized in the Fourth Amendment context that our reasonable-expectation-of-privacy analysis compels the rejection of Harper's due process claim. Aside from a passing reference to IRS data breaches in his reply brief, Harper makes no argument about public disclosure. Any such argument about the due process right against public disclosure is thus waived, see, e.g., United States v. Gordon, 954 F.3d 315, 323 n.1 (1st Cir. 2020), and we therefore need not consider whether our analysis regarding Harper's lack of a reasonable expectation of privacy would compel the same result in the context of public disclosure.

30

stated that "the Due Process Clause of the Fifth Amendment . . . is [not] offended when a federal administrative agency, without notifying a person under investigation, uses its subpoena power to gather evidence adverse to him." 467 U.S. at 742. The Court thus rejected the argument that the targets of an SEC investigation had a due process right to notice and opportunity to oppose a subpoena of third parties pursuant to that investigation. Id.; see also Hannah v. Larche, 363 U.S. 420, 442 (1960) (holding that procedural due process rights do not apply "when governmental action does not partake of an adjudication, as for example, when a general fact- finding investigation is being conducted"); Aponte v. Calderón, 284 F.3d 184, 193 (1st Cir. 2002) ("[I]nvestigations conducted by administrative agencies, even when they may lead to criminal prosecutions, do not trigger due process rights.").

This precedent confirms our view that Harper's reliance on his due process right to privacy cannot succeed. Here, just as in Jerry T. O'Brien, the IRS's summons of Coinbase's records was quintessential fact-finding that did not involve any sort of adjudication of Harper's rights or liabilities. Accordingly, Harper lacked any procedural due process right to be notified of the IRS's investigative efforts or to oppose its summons issued to a third party. To be sure, the Supreme Court did not directly consider the protected liberty interest of keeping certain sensitive information confidential. But we discern little

31

difference between Harper's assertion of a right to keep his Coinbase account information private from an IRS summons and the purported right at issue in Jerry T. O'Brien. Indeed, by holding that the Due Process Clause offers no protection from an agency "using its subpoena power to gather evidence adverse to [a person]," 467 U.S. at 742, the Jerry T. O'Brien Court seemed to implicitly recognize that the possibility of an investigation surfacing private information is not enough to entitle an individual to procedural due process protections. Simply put, Harper's effort to keep his Coinbase account information out of the hands of the IRS appears to be no different from the unsuccessful effort in Jerry T. O'Brien to stymie an investigation that likewise implicated potentially sensitive financial information but gave rise to no procedural due process protections.

In sum, the procedural protections of the Due Process Clause are not implicated by the IRS's summons.18 Because Harper's Fifth Amendment claim fails at this threshold step, we need not consider whether he received constitutionally adequate process. C. Statutory Factors Finally, Harper seeks a declaratory judgment that the IRS's summons was not issued in compliance with the factors set

18We note that our discussion here does not speak comprehensively to the rights of the recipient of a subpoena or summons or to the right of a defendant in a criminal case to challenge the basis for issuing such an order.

32

out in 26 U.S.C. § 7609(f) for a John Doe summons. Harper advances this claim under the APA. The IRS argued in the district court that the summons was not agency action, as required to mount an APA challenge. The district court declined to reach this question, however, "assuming, without deciding," that the summons was challengeable under the APA before rejecting it on other grounds. Harper III, 675 F. Supp. 3d at 210. On appeal, the IRS renews its contention that the APA does not authorize the relief Harper seeks. See United States v. Roman, 942 F.3d 43, 50 (1st Cir. 2019) ("We may affirm 'on any basis apparent in the record.'").19 The APA provides for judicial review of "final agency action for which there is no other adequate remedy in a court." 5 U.S.C. § 704. To be considered "final," the agency action must satisfy two conditions. First, it "must mark the 'consummation' of the agency's decisionmaking process." Bennett v. Spear, 520 U.S. 154, 178 (1997) (quoting Chi. & S. Air Lines, Inc. v. Waterman S.S. Corp., 333 U.S. 103, 113 (1948)). Second, "the action must be one by which 'rights or obligations have been determined,' or from which 'legal consequences will flow.'" Id. (quoting Port of

19 Harper asserts that the IRS has not raised a finality challenge, as it argued in the district court only that the summons was not "agency action," without analyzing whether it was "final." The IRS counters that, by arguing that the summons was not agency action at all, it was, necessarily, also contending that the summons was not final agency action. We agree with the IRS that the question of whether the APA authorizes judicial review of the IRS summons, as final agency action, is properly before us.

33

Bos. Marine Terminal Ass'n v. Rederiaktiebolaget Transatl., 400 U.S. 62, 71 (1970)). Our analysis focuses on the first requirement.

The IRS's summons of Coinbase's records is a preliminary investigative step, far upstream of any potential tax enforcement actions against Coinbase accountholders like Harper or any broader agency action regarding the reporting of digital asset transactions. Cf. United States v. Bisceglia, 420 U.S. 141, 146 (1975) (stating that "[t]he purpose of [the IRS's summons power] is not to accuse, but to inquire" and that "such investigations . . . are essential to our self-reporting system"); Harper II, 46 F.4th at 8 (stating that the scope of the IRS's summonsing authority described under 26 U.S.C. § 7602 "clearly fall[s] within the category of information gathering"). The summons was thus not the "'consummation' of the agency's decisionmaking process," but, rather, was "of a merely tentative or interlocutory nature." Bennett, 520 U.S. at 178. Several of our sister circuits have likewise concluded that investigatory measures are not final agency action. See, e.g., Am. Civil Liberties Union v. Nat'l Sec. Agency, 493 F.3d 644, 679 n.37 (6th Cir. 2007) (concluding that surveillance activities are not final agency action); Univ. of Med. & Dentistry of N.J. v. Corrigan, 347 F.3d 57, 69 (3d Cir. 2003) ("The decision to investigate is normally seen as a preliminary step -- non–final by

34

definition -- leading toward the possibility of a 'final action' in the form of an enforcement or other action."); Reliable Automatic Sprinkler Co. v. Consumer Prod. Safety Comm'n, 324 F.3d 726, 731 (D.C. Cir. 2003) ("The agency's conduct thus far amounts to an investigation . . . . [This] agency activit[y] do[es] not constitute final agency action within the meaning of the APA."); Ass'n of Am. Med. Colls. v. United States, 217 F.3d 770, 780-81 (9th Cir. 2000) ("An investigation, even one conducted with an eye to enforcement, is quintessentially non-final as a form of agency action."); Jobs, Training & Servs., Inc. v. E. Tex. Council of Gov'ts, 50 F.3d 1318, 1324 (5th Cir. 1995) ("[A]n agency's initiation of an investigation does not constitute final agency action." (quoting Veldhoen v. U.S. Coast Guard, 35 F.3d 222, 225 (5th Cir. 1994))); cf. FTC v. Standard Oil Co. of Cal., 449 U.S. 232, 241-42 (1980) (holding that the issuance of an administrative complaint is not final agency action).

Nor are we aware of any judicial decision holding that an agency's issuance of a summons or similar investigatory instrument is final agency action reviewable under the APA. The lone case Harper cites is Sackett v. EPA, 566 U.S. 120, 126 (2012), in which the Supreme Court held that an EPA compliance order which required the petitioners, among other things, to "give the EPA access to their property and to 'records and documentation related to the conditions at the [s]ite,'" was final agency action. Id.

35

Putting aside that this order also imposed a "legal obligation to 'restore' their property according to an Agency-approved Restoration Work Plan," id., the analysis in Sackett pertained to the second finality requirement: that the agency action determine rights and obligations. See Bennett, 520 U.S. at 178. Our analysis, however, pertains to the first requirement: that the action mark "the 'consummation' of the agency's decisionmaking process." Id. (quoting Bennett, 520 U.S. at 178). For the reasons we describe, a summons issued as part of a broader investigation is not such a consummation.

Mindful that early "[j]udicial intervention into the agency process denies the agency an opportunity to correct its own mistakes and to apply its expertise," Standard Oil, 449 U.S. at 242, it strikes us as premature at this point to wade into the IRS's investigation of potential widespread misreporting of income from digital asset transactions. See also id. at 243 (cautioning against premature judicial review as "a means of turning prosecutor into defendant before adjudication concludes"); Univ. of Med. & Dentistry of N.J., 347 F.3d at 69 ("In the ordinary course, an investigation is the beginning of a process that may or may not lead to an ultimate enforcement action."). We thus affirm the district court's dismissal of Harper's statutory claim without needing to address the requirements of § 7609(f).

36

III.

Having rejected all three of Harper's lines of attack, we affirm the district court's dismissal of Harper's complaint for the reasons explained herein.

So ordered.