Wiretaps, Computers and Communications

Most of the laws in this lesson were written for telephones and video stores, and courts now apply them to chat apps, cloud storage and tracking code. That mismatch explains why the same act, a website quietly sending what you type to a vendor, can be legal under federal law, a $5,000 claim in California, and a question the Supreme Court is still answering. This lesson covers private and commercial conduct and the statutory rules for government access. The Fourth Amendment side of police surveillance is in Fourth Amendment Basics in the Surveillance and Privacy course, and employer monitoring is in Federal Laws That Reach Your Business in course 73.

ECPA Title I: the Wiretap Act

The Wiretap Act makes it a crime when anyone "intentionally intercepts, endeavors to intercept, or procures any other person to intercept" a wire, oral or electronic communication (18 U.S.C. 2511(1)). The definitions in 2510 do the work:

• Intercept means the "aural or other acquisition of the contents" of a communication using a device.
• Contents means information about the substance, purport or meaning of the communication. Who called whom, when and for how long is not contents.
• Oral communication is spoken words uttered by someone who reasonably expects not to be intercepted. A speech at a public meeting is not protected; a whispered conversation in a closed office is.
• Electronic communication covers almost any transfer of signs, signals, writing, images, sounds or data by wire or radio, minus a few exclusions such as tone-only pagers and tracking devices.

The exceptions that matter

• One-party consent. Under 2511(2)(d), a private person may intercept a communication if he or she is a party to it or one party has consented in advance, unless the purpose is "committing any criminal or tortious act." Government agents get the same rule without the purpose limit under 2511(2)(c).
• Provider exception. Phone and internet companies may intercept in the normal course of business when it is a necessary incident to providing service or protecting their rights or property (2511(2)(a)(i)).
• Readily accessible to the public. Communications made through a system configured so they are "readily accessible to the general public," such as an open public radio channel, are outside the act (2511(2)(g)(i)).
• Ordinary course of business. Equipment a phone company supplies and a business uses in the ordinary course is not an intercepting "device" (2510(5)(a)). This is the hook for many workplace call recording systems.
• Court orders. Police may intercept under an order meeting 18 U.S.C. 2518: probable cause tied to a listed offense, a showing that "normal investigative procedures have been tried and have failed" or would not work, a limit of 30 days per order, and minimization of irrelevant calls.

Penalties

A violation is a felony punishable by up to five years in prison (2511(4)(a)). A person whose communication was intercepted may sue under 18 U.S.C. 2520 for the greater of actual damages plus the violator's profits, or statutory damages of $100 a day for each day of violation or $10,000, plus punitive damages and attorney's fees. Suits must be filed within two years after the person first had a reasonable opportunity to discover the violation. Good-faith reliance on a court order or a lawful request is a complete defense.

ECPA Title II: the Stored Communications Act

The SCA protects communications held by two kinds of providers: an electronic communication service (email, messaging, phone service) and a remote computing service (cloud storage and processing offered to the public). It has three parts.

Unauthorized access. 18 U.S.C. 2701 makes it a crime to intentionally access, without authorization or beyond authorization, a facility through which an electronic communication service is provided and thereby obtain, alter or block access to a stored communication. It is a misdemeanor for a first offense unless done for commercial advantage, malicious damage or a criminal or tortious purpose, which raises it to up to five years. Logging into an ex-spouse's email with a guessed password is the classic case. The provider itself, and a user reading messages sent to that user, are excepted.

Voluntary disclosure by providers. 2702 bars a public provider from knowingly divulging the contents of stored communications to anyone, and from giving customer records to a government entity, except as listed: with consent, to the addressee, as needed to provide the service or protect the provider, in an emergency involving danger of death or serious injury, to the National Center for Missing and Exploited Children, and others. Note the gap in 2702(c)(6): a provider may give non-content records "to any person other than a governmental entity." That gap lets carriers and apps sell or share subscriber metadata with private companies, including data brokers, without violating the SCA. How police then buy that data is covered in Data Brokers and Police Purchases.

Required disclosure to government. 2703 sets a ladder of legal process:

• Subpoena: basic subscriber information under 2703(c)(2), meaning name, address, session times and durations, length and type of service, phone number or network address, and the means of payment, including card or bank numbers. No notice to the subscriber is required.
• 2703(d) court order: other records, on "specific and articulable facts showing that there are reasonable grounds to believe" they are relevant and material to an ongoing criminal investigation.
• Warrant: contents held in electronic storage for 180 days or less require a warrant under 2703(a). Older contents can be reached by the other methods in 2703(b), a gap that critics of the 1986 law have long pointed to.

A provider or user harmed by a knowing or intentional violation may sue under 2707 for actual damages and the violator's profits, with a minimum recovery of $1,000, plus punitive damages for willful violations and fees, within two years of discovery.

Carpenter and cell-site records

The 2703(d) standard ran into the Constitution in Carpenter v. United States (June 22, 2018, 5 to 4, opinion by Chief Justice Roberts). Prosecutors used a 2703(d) order to get 127 days of a robbery suspect's cell-site location records, 12,898 location points, about 101 a day. The Court held that getting historical cell-site location information is a Fourth Amendment search, that a warrant supported by probable cause is generally required, and that a 2703(d) order's "reasonable grounds" fall short. It set the line at seven days or more of records and declined to decide shorter periods. It said nothing about real-time tracking or "tower dumps" and left intact the older rule that records voluntarily given to a business are usually unprotected. Lower courts are still sorting out which other digital records Carpenter reaches.

ECPA Title III: the Pen Register Act

A pen register records outgoing "dialing, routing, addressing, or signaling information"; a trap and trace device captures incoming source information. Neither may capture contents (18 U.S.C. 3127). Under 3121, no one may install or use one without a court order, except providers running and protecting their service or acting with the user's consent. A knowing violation carries up to one year in prison. The government's standard is the lowest on the ladder: under 3123, the court must issue the order if a government attorney certifies the information is "relevant to an ongoing criminal investigation," for up to 60 days at a time. The judge checks the certification, not the evidence.

Part of ECPA	What it covers	Who it binds	Government needs	Private remedy	Criminal penalty
Title I, Wiretap Act, 18 U.S.C. 2510 to 2523	Contents of calls, messages and conversations in transit	Everyone	A 2518 order: probable cause, necessity, 30-day limit, minimization	Greater of actual damages and profits or $100 a day or $10,000; punitive damages	Up to 5 years
Title II, Stored Communications Act, 18 U.S.C. 2701 to 2713	Stored email, messages, cloud files; subscriber records	Public providers (disclosure); everyone (access)	Subpoena for basic subscriber data; 2703(d) order for records; warrant for contents and, after Carpenter, 7+ days of cell location	Actual damages and profits, minimum $1,000; punitive damages	Up to 1 year, or 5 for commercial or malicious purpose (first offense)
Title III, Pen Register Act, 18 U.S.C. 3121 to 3127	Numbers, addresses, routing and signaling data in real time	Everyone except providers in listed cases	Court order on a certification of relevance, 60 days	None in the statute itself	Up to 1 year

Recording calls: one-party and all-party states

Federal law is a floor. States may be stricter, and many are. Idaho follows the federal rule: Idaho Code 18-6702(2)(d) says it is lawful to intercept a communication "when one (1) of the parties to the communication has given prior consent," and 18-6702(2)(e) separately makes it unlawful to intercept for the purpose of committing a criminal act. Willful interception without consent is a felony punishable by up to five years in prison, a fine of up to $5,000, or both. Idaho's full chapter is covered in lesson 10.

The Reporters Committee for Freedom of the Press lists these states as requiring the consent of all parties: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania and Washington. It describes several mixed rules: Connecticut and Nevada require all-party consent for phone calls but not in-person talks; Missouri and Oregon the reverse; Hawaii and Maine only in particularly private places. It says Michigan's rule at least covers recordings by a third party who is not in the conversation, and Vermont has no recording statute, so only federal law applies there.

Two statutes show how the stricter rules work. California Penal Code 632 bars recording a "confidential communication" without the consent of all parties, with a fine of up to $2,500 per violation and up to a year in jail for a first offense; a conversation is not confidential if the parties could reasonably expect to be overheard. Washington's RCW 9.73.030 requires the consent of all participants, and treats consent as given when one party announces the recording to everyone "in any reasonably effective manner," with the announcement itself recorded. That is the legal reason behind every "this call may be recorded" message.

Which state's law applies to a call between states is not settled everywhere. The safe practice for anyone recording an interstate call is to follow the strictest state involved, which in practice means announcing the recording.

Rule	States (per the RCFP guide)	What it means for you
All-party consent	California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan (at least for third parties), Montana, New Hampshire, Pennsylvania, Washington	Tell everyone and get agreement, or record the announcement
All-party for phone calls only	Connecticut, Nevada	In-person conversations follow one-party consent
All-party for in-person conversations only	Missouri, Oregon	Phone calls follow one-party consent
All-party only in private places	Hawaii, Maine	One-party elsewhere
No state statute	Vermont	Federal one-party rule
One-party consent	Idaho and the remaining states, plus federal law	You may record a conversation you are part of, unless for a criminal (or under federal law, tortious) purpose

Website tracking and state wiretap laws

In recent years plaintiffs' firms have filed waves of class actions claiming that common website tools are illegal wiretaps or pen registers under state law: chat widgets run by vendors, session replay scripts that record clicks and keystrokes, and ad pixels that send page views to social media companies. California's Invasion of Privacy Act (CIPA) is the favorite because of Penal Code 637.2: a person injured by a violation may recover the greater of $5,000 per violation or three times actual damages, and need not show actual damages. The theories are that a vendor listening in on a chat is an eavesdropping third party under Penal Code 631, and that tracking code that captures a visitor's IP address is a "pen register" under Penal Code 638.51, which bars installing one without a court order.

Two developments in 2025 and 2026 changed the math.

• Standing. In Popa v. Microsoft Corp. (9th Cir. August 26, 2025), the Ninth Circuit affirmed dismissal of a session replay suit under Pennsylvania's wiretap law because the plaintiff identified no embarrassing or private information captured, so she had no concrete injury under TransUnion. It said "there existed no free-roaming privacy right at common law." District courts have since relied on Popa to deny class certification in CIPA cases, Mayer Brown reported in August 2026, noting that hundreds of CIPA class actions were pending.
• SB 690. On September 30, 2026, Governor Newsom signed SB 690, which removes the private right to sue over 638.51 pen register claims based on website, online app or mobile app conduct, leaving those claims to the California Attorney General. It takes effect January 1, 2027 and applies to pending claims in actions filed on or after January 1, 2025. Private wiretap claims under 631 and recording claims under 632 are untouched, and the governor's signing message asked the Legislature to revisit other parts of CIPA.

For an Idaho business, the lesson is practical: if your site has California visitors and uses a vendor's chat, replay or pixel tool, the 631 theory is still live, and getting visitors' consent before the tool loads is the defense these statutes are built around.

The Computer Fraud and Abuse Act

The CFAA, 18 U.S.C. 1030, is the federal anti-hacking law. Its most used provision, 1030(a)(2), punishes anyone who intentionally accesses a computer "without authorization" or "exceeds authorized access" and obtains information from a financial institution, a consumer reporting agency's file, a federal agency, or any "protected computer," which includes any computer used in or affecting interstate commerce. In practice that means nearly every computer connected to the internet.

For years courts split on whether breaking a workplace policy or a website's terms of service "exceeds authorized access." Van Buren v. United States (June 3, 2021, 6 to 3, opinion by Justice Barrett) settled the main question. A Georgia police sergeant ran a license plate search in a police database for about $5,000 in an FBI sting. He was allowed to run plate searches; he was not allowed to sell them. The Court reversed his conviction, adopting a "gates-up-or-down" reading: a person exceeds authorized access by obtaining information from areas of a computer, such as files, folders or databases, that are "off limits" to him. Misusing information you were entitled to see is not a CFAA crime, though it may break other laws.

The Ninth Circuit then applied the reasoning to scraping in hiQ Labs, Inc. v. LinkedIn Corp. (April 18, 2022). It held that when a site makes data publicly available, accessing it is likely not access "without authorization" under the CFAA, because there is no gate to lift. Password-protected areas are different. Scrapers can still face contract, copyright and state law claims.

About a month later, on May 19, 2022, the Justice Department told prosecutors not to charge good-faith security research, defined as accessing a computer solely to test, investigate or fix a security flaw in a way designed to avoid harm, with the results used mainly to improve security. It also listed conduct not worth a federal case: embellishing a dating profile, fake accounts on hiring or housing sites, pseudonyms where a site forbids them, checking sports scores at work, and violating terms of service. The department called the research claim "not a free pass" for extortion.

The CFAA also has a civil side. Under 1030(g), anyone who suffers damage or loss may sue, but only if the conduct involves one of the listed factors, most often a loss aggregating at least $5,000 in one year. "Loss" includes the reasonable cost of responding, such as an investigation and restoring data. Suits must be filed within two years. Companies use the civil CFAA against former employees and competitors, and Van Buren narrowed that use as well.

The Video Privacy Protection Act

Congress passed the VPPA in 1988. 18 U.S.C. 2710 bars a "video tape service provider," a business that rents, sells or delivers "prerecorded video cassette tapes or similar audio visual materials," from knowingly disclosing a consumer's personally identifiable information, meaning information that identifies a person as having requested or obtained specific videos. Consent must be in a separate form and can be withdrawn. Providers must destroy the information within one year after it is no longer needed. A person harmed may sue for actual damages but not less than $2,500 in liquidated damages, plus punitive damages and fees, within two years.

The VPPA came back to life with streaming and ad pixels. Plaintiffs argue that a news or sports site that embeds videos and sends a visitor's video views and social media ID to an ad platform is disclosing what the visitor watched. The fight is over who counts as a consumer, defined as "any renter, purchaser, or subscriber" of the provider's goods or services. The circuits split:

• The Second Circuit in Salazar v. National Basketball Association (2024) and the Seventh Circuit in Gardner v. Me-TV (2025) read it broadly: subscribing to any of the provider's goods or services, such as a free newsletter, can make you a consumer.
• The Sixth Circuit in Salazar v. Paramount Global (2025) and the D.C. Circuit in Pileggi v. Washington Newspaper Publishing Co. (2025) read it narrowly: the subscription has to be to audiovisual goods or services.

The Supreme Court granted review in Salazar v. Paramount Global, No. 25-459, on January 26, 2026, and heard argument on October 14, 2026. As of October 2026 no decision has issued; one is expected by the end of the Court's term in mid-2027. The answer will decide whether thousands of media sites with embedded video face $2,500-per-person claims.

The TCPA: calls and texts

The Telephone Consumer Protection Act, 47 U.S.C. 227, is the law behind most robocall and spam text lawsuits. Its core rules:

• No calls to a cell phone using an automatic telephone dialing system or an artificial or prerecorded voice without the called party's prior express consent, except for emergencies (227(b)(1)(A)). Robotexts are litigated under the same rule.
• No prerecorded or artificial-voice calls to a residential line without prior express consent, with exceptions the FCC sets (227(b)(1)(B)).
• FCC rules require prior express written consent for telemarketing robocalls and texts, and honor the National Do Not Call Registry.
• Caller ID spoofing with intent to defraud or cause harm is illegal, with civil forfeitures and criminal fines up to $10,000 per violation (227(e)).

Damages. Under 227(b)(3), a person may sue for the greater of actual loss or $500 per violation, trebled to as much as $1,500 if the violation was willful or knowing. Under 227(c)(5), a person who gets more than one telemarketing call in 12 months from the same entity in violation of the do-not-call rules may sue for up to $500 per violation, also trebled for willful violations. State attorneys general may sue under 227(g).

Autodialers after Duguid. In Facebook, Inc. v. Duguid (April 1, 2021), the Court held, in an opinion by Justice Sotomayor for eight justices (Justice Alito concurred in the judgment), that a device is an autodialer only if it can use "a random or sequential number generator" to store or produce the numbers it calls. Facebook's login alert texts, sent to stored numbers, did not qualify. The ruling narrowed the autodialer rule to equipment with that capacity, but the prerecorded and artificial voice rule, and the do-not-call rules, still apply regardless of equipment.

AI voices. The FCC's declaratory ruling of February 8, 2024 (FCC 24-17) held that "artificial or prerecorded voice" includes AI technologies that generate human voices, including voice cloning. An AI voice call therefore needs prior express consent, or written consent if it is telemarketing, and must identify the caller.

One-to-one consent. In December 2023 the FCC ordered that a consumer's consent to robocalls or texts could cover only one seller at a time and only calls logically and topically related to the interaction where consent was given. On January 24, 2025, the Eleventh Circuit vacated that part of the order in a challenge by the Insurance Marketing Coalition, holding that the FCC exceeded its statutory authority because "prior express consent" carries its ordinary meaning.

Revocation. FCC rules in effect since April 11, 2025 require callers to honor an opt-out made by any reasonable means, including replies such as STOP, QUIT or UNSUBSCRIBE, within 10 business days. A further rule making one opt-out apply to all of a sender's robocalls and texts on unrelated topics was delayed to January 31, 2027, Hunton reported.

McLaughlin. In McLaughlin Chiropractic Associates v. McKesson Corp. (June 20, 2025, 6 to 3, opinion by Justice Kavanaugh), a medical practice sued over unsolicited fax ads, including ones received through online fax services. The FCC had said online fax services are not "telephone facsimile machines." Lower courts treated that order as binding under the Hobbs Act. The Supreme Court held that district courts in enforcement suits are not bound by an agency's interpretation and must decide what the statute means for themselves, giving the agency's view appropriate respect. FCC interpretations of the TCPA no longer bind district courts in private enforcement suits.

Campaigns get special attention under the TCPA: political calls are exempt from the do-not-call list, but not from the autodialer and prerecorded voice rules for cell phones. Campaign texting rules are covered in Literature, Signs and Ads and in Digital Campaigning on a Small Budget.

The Do Not Call Registry

The FTC's registry FAQ says registration "will never expire"; numbers drop off only when disconnected and reassigned or at your request. A number usually appears the next day, but telemarketers have up to 31 days to stop calling. The registry does not stop political calls, charitable calls, debt collection, purely informational calls, surveys, or calls from companies you recently did business with or gave written permission. Robocalls that sell something need your written permission whether or not you registered.

CAN-SPAM: commercial email

The CAN-SPAM Act (15 U.S.C. 7701 to 7713) leaves unsolicited commercial email legal and sets rules for sending it. The FTC's compliance guide lists eight: no false or misleading header information; no deceptive subject lines; identify the message as an ad; include a valid physical postal address; give a clear way to opt out; let subscribers and members opt out too; honor opt-outs within 10 business days, with the opt-out mechanism working for at least 30 days after sending; and monitor what others do on your behalf. After an opt-out, a sender may not sell or transfer the address. Messages whose primary purpose is transactional or relationship-based are mostly exempt.

Each separate email in violation can bring a penalty of up to $53,088, the FTC says, the inflation-adjusted figure in 16 CFR 1.98 as of January 17, 2025. Both the company promoted and the company that sends can be liable. Under 15 U.S.C. 7706, enforcement belongs to the FTC and other federal agencies, state attorneys general (up to $250 per message, capped at $2 million for most violations, trebled for willful ones), and internet access providers that are adversely affected (up to $100 per message for header violations and $25 for others). Individual recipients are not on the list.

Law	Covers	Who it binds	Your rights	Enforcer	Penalties
CFAA, 18 U.S.C. 1030	Access to computers without authorization or beyond it	Everyone	Civil suit if loss of at least $5,000 in a year (or other listed harm)	DOJ; private suits	Prison terms by subsection; compensatory damages
VPPA, 18 U.S.C. 2710	Disclosure of what videos a person requested or obtained	Video tape service providers, including streaming and sites with video (scope before the Supreme Court)	Separate written consent; destruction within one year after no longer needed	Private suits	At least $2,500 per person, punitive damages, fees
TCPA, 47 U.S.C. 227	Robocalls, robotexts, autodialers, faxes, do-not-call, spoofing	Callers and senders	Consent before robocalls; opt-out in 10 business days; Do Not Call Registry	FCC, state AGs, private suits	$500 per violation, up to $1,500 if willful; spoofing up to $10,000
CAN-SPAM, 15 U.S.C. 7701 to 7713	Commercial email	Senders and the companies they promote	Opt-out honored in 10 business days	FTC, other agencies, state AGs, ISPs	Up to $53,088 per email (FTC); no individual suits
State all-party recording laws (for example Cal. Penal Code 632, RCW 9.73.030)	Recording private conversations	Everyone	Consent before recording	Prosecutors; private suits	California: $5,000 per violation in civil suits under 637.2

Questions and answers

Can my employer read my work email?

Usually, yes. The employer is often the provider of the email system, and the SCA's provider exception and the consent most employers get through written policies cover it. Personal accounts are different: logging into an employee's personal email without permission can violate 2701. The business rules are in course 73.

Can I record a city council member who calls me?

In Idaho, yes, because you are a party, unless the official is in an all-party state at the time. The content of the call may then be news. Recording a call you are not part of, such as one between two council members, is a felony under Idaho Code 18-6702.

Is reading someone's texts on a phone they left open a wiretap?

Probably not a Wiretap Act interception, which requires acquiring contents with a device, and the SCA's access crime is aimed at the facility through which a service is provided, not obviously a personal phone. It may still violate state privacy, computer crime or harassment laws, and the facts matter.

A website's chat box says it uses a vendor. Can I sue under California law?

Only if you are covered by CIPA, and after Popa you must also show a concrete harm, such as private information you typed being captured and shared. Wiretap claims under 631 survive SB 690; pen register claims for online conduct will belong only to the Attorney General after January 1, 2027.

Is scraping public websites legal?

Under the CFAA, hiQ says accessing truly public pages is likely not "without authorization." That does not settle contract claims based on the site's terms, copyright in the content, or state laws on data collection. And scraping personal data can trigger state privacy laws covered in lesson 08.

Are political robocalls legal?

Political calls are exempt from the Do Not Call Registry, but autodialed or prerecorded political calls and texts to cell phones still need prior express consent under 227(b)(1)(A). AI-voice political calls are covered by the FCC's 2024 ruling.

Does unsubscribing from a nonprofit's email list have to be honored?

CAN-SPAM covers commercial messages, whose primary purpose is advertising a product or service. A nonprofit's fundraising appeal may fall outside it, but a nonprofit selling goods by email is covered. Honoring opt-outs is a good practice either way and may be required by state law.

Do I need a warrant to see my own phone records?

No. You can ask your carrier for your own records. The ECPA's limits apply to providers disclosing records to others and to the government obtaining them.

Hard questions

Should every state require all-party consent?

Supporters say no one should have private words captured without knowing, and that recording changes what people say. Journalists, whistleblowers and people documenting abuse or harassment argue that one-party consent lets the weaker party prove what happened, and that requiring permission lets the powerful party say no. Federal law and most states, Idaho among them, have chosen one-party consent; the RCFP's all-party list is California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania and Washington.

Should old wiretap and video rental laws reach website tracking?

Plaintiffs' lawyers and privacy advocates argue that a vendor silently capturing what you type or watch is exactly the eavesdropping the laws were written to stop, and that the statutes' text covers it. Businesses argue that the laws never contemplated analytics, that the suits seek huge statutory damages for no real harm, and that legislatures, not 1960s and 1980s statutes, should set rules for tracking. California's SB 690 split the difference for pen register claims, Popa narrowed standing, and the Supreme Court's Salazar decision will set the VPPA's reach.

Is Carpenter's warrant rule too narrow or too broad?

The majority treated location history as different from ordinary business records because a long record of where a phone has been reveals so much about a person's life. The dissents argued the records belong to the carrier, that Congress set the 2703(d) standard on purpose, and that the new rule would be hard for police to apply. Civil liberties groups argue Carpenter should reach other digital trails, such as search histories and geofence data. Law enforcement groups argue it should be limited to its facts. Lower courts are split, and the Fourth Amendment questions are covered in course 31.

Did Duguid open the door to more robotexts?

Consumer groups argue that by limiting autodialers to random or sequential number generators, the Court exempted most modern mass-texting platforms, which dial from stored lists. The Court read the definition as written and left any update to Congress. Callers still face the prerecorded voice, do-not-call and written consent rules, and states remain free to write their own telemarketing laws.

Should agencies or courts decide what the TCPA means?

McLaughlin lets district courts decide the meaning of the TCPA for themselves in private suits, after the FCC lost the deference that the Hobbs Act once gave its orders. Supporters say that is how statutes should work and that it protects defendants from rules agencies made up. Critics, including the three dissenters, warn of different answers in different courts and less predictability for callers and consumers. The Eleventh Circuit's 2025 ruling striking the one-to-one consent rule shows the same trend from the other side: courts reading the statute's plain words over agency policy.