FILED
                                                      United States Court of Appeals
                                                              Tenth Circuit

                                                          December 28, 2012
                                   PUBLISH                Elisabeth A. Shumaker
                                                              Clerk of Court
                  UNITED STATES COURT OF APPEALS

                              TENTH CIRCUIT



KATHLEEN KIRCH; TERRY
KIRCH, individually and on behalf of
themselves and all others similarly
situated,

            Plaintiffs - Appellants,
v.                                                  No. 11-3275
EMBARQ MANAGEMENT CO., a
Delaware corporation; UNITED
TELEPHONE COMPANY OF
EASTERN KANSAS, a Delaware
corporation,

            Defendants - Appellees,

and

DOE DEFENDANTS 1-5,

             Defendants.


        APPEAL FROM THE UNITED STATES DISTRICT COURT
                  FOR THE DISTRICT OF KANSAS
                 (D.C. NO. 2:10-CV-02047-JAR-GLR)


Rahul Ravipudi, Panish, Shea & Boyle, LLP, (Paul A. Traina, Steven J.
Lipscomb, Engstrom, Lipscomb & Lack, with him on the briefs), Los Angeles,
California, for Plaintiffs - Appellants.

Matthew E. Price, Jenner & Block, LLP, Washington, D.C., (David A. Handzo,
Jenner & Block LLP and J. Emmett Logan, Stinson Morrison Hecker LLP, Kansas
City, Missouri, with him on the brief), for Defendants - Appellees.
Before MURPHY, HARTZ, and HOLMES, Circuit Judges.


HARTZ, Circuit Judge.


      Plaintiffs Kathleen and Terry Kirch appeal the district court’s grant of

summary judgment in favor of Defendants United Telephone Company of Eastern

Kansas and Embarq Management Company (collectively “Embarq”) on the

Kirches’ claim that Embarq intercepted their Internet communications in violation

of the Electronic Communications Privacy Act of 1986 (ECPA), Pub. L.

No. 99-508, 100 Stat. 1848. Embarq is an Internet service provider (ISP). The

alleged interceptions occurred when Embarq authorized NebuAd, Inc., an online

advertising company, to conduct a technology test for directing online advertising

to the users most likely to be interested in the ads. Exercising jurisdiction under

28 U.S.C. § 1291, we affirm the district court’s judgment. Although NebuAd

acquired various information about Embarq users during the course of the

technology test, Embarq cannot be liable as an aider and abettor. And it was

undisputed that Embarq’s access to that information was no different from its

access to any other data flowing over its network. Because this access was only

in the ordinary course of providing Internet services as an ISP, this access did not

constitute an interception within the meaning of the statute.

I.    STATUTORY FRAMEWORK


                                         -2-
      The ECPA prohibits the interception of “electronic communication,”

18 U.S.C. § 2511(1), and imposes criminal and civil liability, see id. §§ 2511(4)

(criminal penalties); § 2520 (civil liability for damages). Traffic on the Internet

is electronic communication. See id. § 2510(12) (defining electronic

communication as “any transfer of signs, signals, writing, images, sounds, data, or

intelligence of any nature transmitted in whole or in part by a wire, radio,

electromagnetic, photoelectronic or photooptical system”).

      The statute defines intercept as “the aural or other acquisition of the

contents of any wire, electronic, or oral communication through the use of any

electronic, mechanical, or other device.” Id. § 2510(4) (emphasis added). No

“interception,” and hence no violation of the ECPA, occurs if the contents of a

communication are acquired in the ordinary course of business of an ISP because

the Act’s definition of electronic, mechanical, or other device excludes “any

telephone or telegraph instrument, equipment or facility, or any component

thereof . . . (ii) being used by a provider of wire or electronic communication

service in the ordinary course of its business . . . .” Id. § 2510(5)(a); see Hall v.

Earthlink Network, Inc., 

, 503–05 (2d Cir. 2005). An interception to

which a party to the communication consents also is not prohibited. See id.

§ 2511(2)(d) (“It shall not be unlawful under this chapter for a person . . . to

intercept a wire, oral, or electronic communication . . . where one of the parties to

the communication has given prior consent to such interception . . . .”)

                                          -3-
      The ECPA imposes civil liability on those who unlawfully intercept

electronic communications. It states:

      Except as provided in section 2511(2)(a)(ii) [relating to the Foreign
      Intelligence Surveillance Act of 1978], any person whose wire, oral
      or electronic communication is intercepted, disclosed, or
      intentionally used in violation of this chapter may in a civil action
      recover from the person or entity, other than the United States, which
      engaged in that violation such relief as may be appropriate.

18 U.S.C. § 2520(a) (emphasis added). This language does not encompass aiders

or abettors. The only persons liable are those who engaged in “that violation.”

And the natural reading of “that violation” is the “intercept[ion], disclos[ure], or

intentional[] use[] . . . in violation of [the statute].” In other words, “the person

or entity . . . which engaged in that violation” is the person or entity that

“intercepted, disclosed, or intentionally used” the communication. The provision

includes no aiding-and-abetting language. As the Supreme Court has said:

      Congress has not enacted a general civil aiding and abetting statute
      . . . . Thus, when Congress enacts a statute under which a person
      may sue and recover damages from a private defendant for the
      defendant’s violation of some statutory norm, there is no general
      presumption that the plaintiff may also sue aiders and abettors.

Cent. Bank of Denver, N.A. v. First Interstate Bank of Denver, N.A., 

, 182 (1994).

      Any temptation to read the statute as imposing aider-and-abettor liability is

overcome by the illuminating statutory history of the civil-liability provision.

The 1968 predecessor to the ECPA imposed both criminal and civil liability for


                                           -4-
those who procured an interception. The criminal provision, codified as 18

U.S.C. § 2511(1)(a) (1968), held responsible “any person who . . . willfully

intercepts, endeavors to intercept, or procures any other person to intercept or

endeavor to intercept, any wire or oral communication.” Pub. L. No. 90-351,

Title III § 802, 82 Stat. 197, 213 (1968) (emphasis added). (Later paragraphs

made it a crime to willfully disclose or use unlawfully intercepted

communications. See 18 U.S.C. § 2511(1)(c), (d) (1968).) Similarly, the civil-

liability provision stated: “Any person whose wire or oral communication is

intercepted, disclosed, or used in violation of this chapter shall . . . have a civil

cause of action against any person who intercepts, discloses, or uses, or procures

any other person to intercept, disclose, or use such communications.” Id., 82 Stat.

at 223 (emphasis added) (enacting former 18 U.S.C. § 2520). When the ECPA

was enacted in 1986, the criminal provision was changed only to replace

“willfully” by “intentionally” and to add “electronic” communications to “wire”

and “oral” ones. See 18 U.S.C. § 2511(1)(a). But the civil provision was altered

in additional ways, including deletion of the “procures” clause. We presume that

this deletion was intended to change the statute’s meaning. See Stone v. INS, 

, 397 (1995); Antonin Scalia & Bryan A. Garner, Reading Law: The

Interpretation of Legal Texts § 40 (2012) (“If the legislature amends or reenacts a

provision other than by way of a consolidating statute or restyling project, a

significant change in language is presumed to entail a change in meaning.”).

                                           -5-
Accordingly, almost all courts to address the issue have held that § 2520 does not

impose civil liability on aiders or abettors. See Peavy v. WFAA-TV, Inc., 

, 169 (5th Cir. 2000); Council on Am.-Islamic Relations Action Network,

Inc. v. Gaubatz, No. 09-02030, 

, *8 (D.D.C. Sept. 17, 2012)

(collecting cases). But see Lonegan v. Hasty, 

, 427–28

(E.D.N.Y 2006).

II.   THE TECHNOLOGY TEST

      In November 2007 Embarq entered into an agreement with NebuAd to

conduct a test of what is referred to as the NebuAd System. The physical

components of the system were an Ultra Transparent Appliance (UTA) and

remote servers (apparently in California) hosted by NebuAd. The system’s

purported purpose was to “allow[] for placement of optimized advertisement on

Trial customers’ internet browser screens.” Aplt. App., Vol. I at 92. The test

began in mid-December 2007 and ended in March 2008. Under the agreement the

UTA was installed in Embarq’s network in Gardner, Kansas, where the Kirches

were customers of Embarq. Embarq’s Gardner users were connected to the UTA,

which was connected to the rest of Embarq’s network. According to the Kirches,

the Internet traffic that passed through the UTA was sent to the NebuAd servers

in its system. NebuAd used the UTA to track what websites an Embarq user

visited, and to deliver online advertising thought likely to interest users who

visited those websites.

                                         -6-
       Embarq asserts that the NebuAd System collected only information about

customer requests for highly trafficked commercial websites, and obtained only

three pieces of information about such requests: the requested Uniform Resource

Locator (URL, known in common parlance as a web page’s “address”), the

“referer URL” (the last URL visited before the request), and an advertising

network cookie. 1 Because cookies are typically encrypted, the NebuAd System

did not extract any information from them. Users’ computers were assigned

identification numbers based on these cookies, and the information about past

Internet usage was associated with a user’s computer only through this number.

The Kirches contend, however, that the UTA “intercepted and analyzed” all

Internet traffic from affected customers, id. at 61, not only their requests for

highly trafficked commercial websites.

III.   PROCEEDINGS IN DISTRICT COURT

       The Kirches sued Embarq in the United States District Court for the

District of Kansas on behalf of themselves and other Embarq customers. They

asserted four claims arising out of the NebuAd test: unlawful interception of

communications in violation of the ECPA; accessing plaintiffs’ computers

without authorization, in violation of the Computer Fraud and Abuse Act, see


       1
       “A cookie is a piece of text, usually encrypted, that is sent to a user’s
computer by a website. When the user later returns to the website, the website
recognizes the cookie and thus is able to track a user’s behavior over time.” Aplt.
App., Vol. II at 278.

                                         -7-
18 U.S.C. § 1030(a), (g); invasion of privacy under Kansas state law; and trespass

to chattels under Kansas state law. The latter three claims were dismissed with

prejudice by joint stipulation of the parties. 2

      Embarq then moved for summary judgment on the unlawful-interception

claim. It argued that (1) the NebuAd System had not intercepted users’

communications, because the limited information it acquired about their Internet

communications did not include the contents of those communications; (2) even if

user communications were intercepted by the NebuAd System, it was not Embarq

that had intercepted the communications, because Embarq did not have access to

the data collected by the NebuAd System or the user profiles that NebuAd

developed; (3) the Kirches had consented to any alleged interception by agreeing

to the terms of Embarq’s privacy policy, which gave users notice that their

Internet communications could be shared with third parties to the extent that the

NebuAd test had done so; and (4) if Embarq had acquired the contents of any of

its users’ communications, it had done so only in the ordinary course of its

business activities as an ISP, and so was not liable under the ECPA.

      The district court granted Embarq’s motion in August 2011. It first ruled

that Embarq had not intercepted the Kirches’ communications. It explained:

            Plaintiffs argue that Embarq intercepted communications by
      routing them to NebuAd’s UTA. The term “intercept” is specifically

      2
       The Kirches sued NebuAd in a separate proceeding. At oral argument we
were informed that the case was settled.

                                           -8-
      defined by the ECPA to mean the “acquisition of the contents” of a
      communication.[] “Contents” is defined to mean “the substance,
      purport, or meaning of that communication.” Although the term
      “acquisition” is not defined by the statute, “to acquire” commonly
      means “to come into possession, control, or power of disposal.”
      Thus, it follows that in order to “intercept” a communication, one
      must come into possession or control of the substance, purport, or
      meaning of that communication. The Court agrees with Embarq that
      regardless of what information the NebuAd System extracted from
      the communications traversing through the UTA, it is undisputed that
      Embarq had no access to that information or to the profiles
      constructed from that information. As plaintiffs’ expert testified,
      Embarq’s role was to install the NebuAd device so as to furnish the
      UTA connection to NebuAd. In other words, the NebuAd device, or
      “box,” goes into place, then all of the raw data that flows through
      Embarq is directed to that device, where NebuAd does the analysis
      and, apparently, separates out the Port 80 traffic [apparently, traffic
      to websites whose addresses begin with “http://”]. Moreover,
      plaintiffs cite no authority that Embarq’s access to the raw data that
      flowed through its network constitutes a violation of the ECPA,
      which requires an entity to actually acquire the contents of those
      communications. There is nothing in the record that Embarq itself
      acquired the contents of any communications as they flowed through
      its network; instead, plaintiffs’ theory rests on the notion that the
      NebuAd System extracted the contents of the communications.
      Plaintiffs’ assertion that Embarq “endeavored to intercept”
      communications falls short of creating civil liability under the ECPA,
      which creates liability for actual interception.

Mem. & Order at 13–14 (footnotes omitted), Kirch v. Embarq Mgmt. Co.,

No. 10-2047-JAR (D. Kan. Aug. 19, 2011)(Aplt. Br., Ex. A at 13–14). The court

then rejected the argument that Embarq could be liable on a theory of aiding and

abetting NebuAd. In the alternative, the court ruled that the Kirches had

consented to any interception by agreeing to the terms of Embarq’s privacy

policy.


                                        -9-
IV.   DISCUSSION

      We review de novo the district court’s summary-judgment decision,

evaluating the evidence in the light most favorable to the party opposing summary

judgment. See Vaughn v. Epworth Villa, 

, 1150 (10th Cir. 2008).

A district court can grant summary judgment only if “there is no genuine dispute

as to any material fact” and “the movant is entitled to judgment as a matter of

law.” Fed. R. Civ. P. 56(a).

      Like the district court, we need not address whether NebuAd intercepted

any of the Kirches’ electronic communications. Because the ECPA creates no

aiding-and-abetting civil liability, Embarq is liable only if it itself intercepted

those communications. Also, although the district court relied on consent as an

alternative ground for summary judgment, we need not consider the issue because

we hold that there was no interception.

      We largely agree with the district court’s analysis. As we explain below, it

is undisputed that the only access Embarq had to the data extracted by NebuAd

was in its capacity as an ISP, not because of any special relationship with

NebuAd or the technology test. We need not decide where to draw the line

between access to data and acquisition of data, because Embarq’s access was in

the ordinary course of its core business as an ISP transmitting data over its

equipment. Even if such access might be deemed an acquisition, Embarq did not

engage in an “interception” under the ECPA because of the ordinary-course-of-

                                          -10-
business exclusion from the definition of interception. See 18 U.S.C. §§ 2510(4)

(defining intercept as the “acquisition of the contents of any . . . electronic . . .

communication” by use of an “electronic, mechanical or other device”);

2510(5)(a)(ii) (excluding from the definition of “electronic, mechanical or other

device” any equipment “used by a provider of wire or electronic communication

services in the ordinary course of its business”).

       The relevant facts were established in the summary-judgment proceedings.

In its motion for summary judgment, Embarq asserted that it was undisputed that

“Embarq did not have access to the data collected by the NebuAd System.” Aplt.

App., Vol. II at 280. To support this contention, Embarq cited several statements

in the record: (1) The Kirches’ expert, Alissa Cooper, was asked at her

deposition, “Did the ISP obtain access to raw data from NebuAd in any way other

than an ISP ordinarily has the raw data, which is to say that it flows through the

ISP’s network?” She responded, “I don’t think so.” Id. at 450. (2) The Kirches’

expert Andrew Case said at his deposition that Embarq did not have access to “the

raw data collected by NebuAd.” Id. at 468. And (3) Embarq’s expert Dr. Ellis

Horowitz stated in his report that Embarq “neither purchased, leased, nor paid for

the UTA, which at all times was owned and controlled by NebuAd. The device

was placed on [Embarq’s] network in such a way that all Internet traffic

streaming through [Embarq’s] network would also pass through the UTA.” Id. at

376.

                                           -11-
       In a summary-judgment proceeding a party’s assertion of undisputed facts

is ordinarily credited by the court unless properly disputed by the opposing party.

See Fed. R. Civ. P. 56(e) (“If a party . . . fails to properly address another party’s

assertion of fact . . . , the court may . . . (2) consider the fact undisputed for

purposes of the motion . . . .”); Nahno-Lopez v. Houser, 

, 1283–84

(10th Cir. 2010) (opponent’s response to summary-judgment motion must raise a

factual dispute that is material to the motion); D. Kan. Rule 56.1(b)(1)

(memorandum in opposition to a motion for summary judgment must “contai[n] a

concise statement of material facts as to which the party contends a genuine issue

exists[,] . . . refer[ring] with particularity to those portions of the record upon

which the opposing party relies”); id. at 56.1(e) (“All responses must fairly meet

the substance of the matter asserted.”).

       The Kirches’ response did not adequately dispute Embarq’s assertion. It

stated only: “Undisputed that Embarq did not have access to the data after it was

collected by NebuAd servers. However, Embarq did have access to the raw data

when it flowed through their network.” Aplt. App., Vol. I at 64. In support, the

Kirches cited only the following exchange in the Cooper deposition:

       Q: Did the ISP get any of the raw data that NebuAd may have
       looked at?

       A: I don’t know.

       Q: Do you have any reason to think that it did?


                                           -12-
      A: Well, the raw data is just flowing over its network, so it has
      access to the raw data.

Id., Vol. II at 450. Thus, the Kirches’ only qualification to their acceptance of the

alleged undisputed fact was that Embarq had access to users’ data that it

necessarily had as an ISP.

      In other words, the undisputed facts establish that NebuAd’s use of the

UTA gave Embarq access to no more of its users’ electronic communications than

it had in the ordinary course of its business as an ISP. Embarq is therefore

protected from liability by the statutory exemption for activities conducted in the

ordinary course of a service provider’s business. See 18 U.S.C. § 2510(5)(a)(ii).

      Supporting our conclusion is the Second Circuit’s decision in Hall v.

Earthlink Network, Inc., 

 (2005). Hall used Earthlink as his ISP.

See id. at 502. Later his account was closed, but several hundred emails were

sent to his Earthlink address after the closure and stored in Earthlink servers. See

id. Hall sued, claiming that Earthlink had unlawfully intercepted this mail “by

intentionally continuing to receive messages sent [to his closed email address]

after the termination of his account.” Id. The court held that Earthlink was not

liable. It explained that “Earthlink acquired the contents of electronic

communications but did so in the ordinary course of business,” so there was no

“interception” within the statutory definition. Id. at 504–05. 3

      3
          The court said that “[i]f ISPs were not covered by the ordinary course of
                                                                           (continued...)

                                         -13-
      The Kirches seek to escape the import of the undisputed facts by asserting

that Embarq had “control and possession of the UTA” during the time it was

installed on Embarq’s network. Aplt. Br. at 16. But control and possession of the

device is not the test. If such control or possession gave Embarq access to the

contents of communications beyond what it acquired in the ordinary course of

business, the Kirches needed to provide evidence of such access in response to

Embarq’s assertion of undisputed fact.

      The Kirches also point to two letters to Congress submitted by Embarq in

July 2008, describing the NebuAd technology test and Embarq’s role in the test.

These letters asserted that the test had not captured users’ confidential

information and stated that the test was conducted in accordance with Embarq’s

privacy policies, industry standards, and agency guidance. The Kirches rely on

portions of the letters (1) stating that “Embarq conducted a brief, small-scale test

of customer preference advertising utilizing a new technology,” Aplt. App., Vol. I

at 111; (2) referring to “our consumer preference marketing test,” id. at 115; and


      3
          (...continued)
business exception, ISPs would constantly be intercepting communications under
ECPA because their basic services involve the ‘acquisition of the contents’ of
electronic communication.” Hall, 396 F.3d at 505. As we stated above, however,
we need not decide where to draw the line between access and acquisition of data.
       The Hall court’s statement was made during its explanation of its holding
that the course-of-business exception applies not only to telephone or telegraph
equipment used by an ISP, but also to any other equipment used by an ISP. See
id. at 504–05. That issue has not been raised in this appeal, so we need not
address it.

                                         -14-
(3) stating that “we have no plans for more tests or for general deployment of this

technology,” id. at 118. The Kirches characterize these statements as a “clear

party admission” that it was Embarq, not NebuAd, that used the UTA and thereby

intercepted its users’ communications. Aplt. Br. at 17. We disagree. The

Kirches read too much into the letters. The letters did not attempt to delineate the

division of responsibility between Embarq and NebuAd. Indeed, they never

mention NebuAd. The letters were in response to Congressional inquiries about

the type of advertising examined in the technology test. The concern was about

the nature of the technology and the conduct of the test. There was no need or

reason for Embarq’s letters to be lengthened by a description of who was

responsible for what. The letters are consistent with Embarq’s account of the

technology test in the district court and do not contradict the undisputed fact that

Embarq’s only access to data collected by the UTA was in the ordinary course of

its business as an ISP.

V.    CONCLUSION

      We AFFIRM the judgment of the district court.




                                         -15-