Surveillance or Security?: The Risks Posed by New Wiretapping Technologies (16 page)

When Government infringes those rights instead of nurturing and protecting them,
the injury spreads far beyond the particular citizens targeted to untold numbers of
other Americans who may be intimidated.

Persons most intimidated may well not be those at the extremes of the political
spectrum, but rather those nearer the middle. Yet voices of moderation are vital to
balance public debate and avoid polarization of our society.69

The committee laid out a series of recommendations to control wiretapping for national-security purposes. Intended to prevent the abuses of the
previous four decades from ever recurring, these were incorporated into
the Foreign Intelligence Surveillance Act (FISA),70 the 1978 law governing
wiretapping for foreign-intelligence purposes.

Under FISA, decisions regarding wiretapping in national-security cases
are made by the Foreign Intelligence Surveillance Court, a court of seven
district court judges appointed from seven of the United States judicial
circuits; amendments in the USA PATRIOT Act changed this to eleven
judges. In contrast to the Title III requirement of probable cause that a
serious crime is being committed or about to be committed, FISA requires
that there be probable cause that the surveillance target is a foreign power,
agent of a foreign power, or terrorist group,71 probable cause that the communications device is being used by the foreign power or its agent, and
probable cause that the purpose of the surveillance is to obtain foreignintelligence information. As in Title III, it must be the case that other forms
of investigation are unlikely to succeed.

FISA's purpose was to regulate foreign-intelligence surveillance carried
out inside the United States against domestic communications as well
as against international communications (communications with one
component in the United States) carried by wire. FISA permitted warrantless wiretapping for up to one year if communications were exclusively
between foreign powers.72 The attorney general could authorize warrantless wiretapping for up to seventy-two hours in an emergency, so long as a
surveillance order was obtained within that period73 (if not, the intercepted
communications may neither be used nor divulged). The law had a specific
First Amendment protection: exercise of such rights by U.S. citizens and
permanent residents cannot be the sole basis for concluding someone is an
agent of a foreign power.74 As with Title III, only high-level officials could
certify a FISA application75 and there were minimization requirements. The
FISA Court hearings and decisions were secret. Unlike Title III, the target
of a FISA wiretap would only be informed if indicted and then only if the
government intended to use the wiretapped evidence in the case. There
was no equivalent of the Wiretap Report; the only public information is an
annual report to Congress on the number of surveillances approved,
denied, and sent back for changes.76

The law did not apply to radio surveillance of satellite transmissions
unless the government was targeting a known, particular citizen or permanent resident alien (known as a U.S. person) in the United States and did
not in any way fetter the surveillance of cables that was carried out in other
nations or in international waters.

Nothing precludes a FISA-based investigation from leading to a criminal
prosecution. Because the law was written to enable intelligence collection,
it was entirely reasonable that its probable-cause standard should be somewhat less stringent than the analogous requirement in Title III; it is nonetheless important that investigators not use FISA interceptions as a way to
avoid the stiffer requirements of Title III wiretap warrants. Until the USA
PATRIOT Act, the way this was handled was that foreign intelligence had
to be the primary purpose of a FISA surveillance.77

Title III and FISA form the basis for U.S. wiretap law. They were written
when electronic communication was the analog circuit-switched PSTN;
digitally switched and packet-based networks provided new challenges to
the government's surveillance efforts.

4.4 Modern Networks

In the early days of the telephone, an operator at the local switchboard
connected callers, affording little privacy to the customers. As communications changed over to automated switches, privacy, or at least its appearance, returned. In fact, because in the United States even local phone
numbers were retained by the local exchange for billing and business purposes, transactional information was never truly private. It was, however,
physically stored within the phone company. Since it was not easy to obtain this information except by going through the telephone company,
the data mostly stayed private. Things began to change as law enforcement
realized the value of the data.

One such case occurred in March 1976, after a Baltimore woman who
had been robbed began receiving calls from a man claiming to be the
thief. When the robbery victim saw a car cruising her neighborhood
that looked like one present during the robbery, she told the police. Sometime later the police discovered the same car and traced it to a "Michael
Smith." Without first obtaining a court order, the police put a pen register,
a device for real-time capture of all numbers called by a specific number,
on Smith's phone line. Smith was indeed calling the woman. With that
information, the police had sufficient evidence for a search warrant, which
they obtained. They searched Smith's house and found evidence of the
theft.

Now the 1970s already had seen a series of cases in which the Supreme
Court considered the privacy status of information being held by a third
party. In United States v. Miller '71 the Court examined bank records subpoenaed after evidence surfaced that the suspect was illegally making alcohol.
The Court wrote that "if we direct our attention to the original checks and
deposit slips, rather than to the microfilm copies actually viewed and
obtained through the subpoena, we perceive no legitimate 'expectation of
privacy' in their contents. 1179

Thus, unlike in the Katz case, no search warrant was required for the
bank data.

In the Baltimore theft case, Smith v. Maryland,80 the Supreme Court
noted that few people "entertain any actual expectation of privacy in the
numbers they dial." Citing Miller, the Court observed, "This Court has held
repeatedly that the Fourth Amendment does not prohibit the obtaining of
information revealed to a third party and conveyed by him to Government
authorities, even if the information is revealed on the assumption that it
will be used only for a limited purpose and the confidence placed in the
third party will not be betrayed."" Just as the depositor had assumed a
certain risk of disclosure of his bank account information, so did the caller
assume a risk of disclosure of his calling information. Smith had no expectation of privacy and no warrant was needed for the search. The Smith
decision was not universally accepted. Some state courts used the privacy
protections of their state constitutions to provide better protection for their
constituents.82

In the 1980s new switching technology made it easy to capture calling
data. Signaling System 7 passes the caller identification information down the switches of the call, changing the effort of determining the number
initiating the call from a procedure taking minutes to one being instantly
available as the call is made. The information used by the police in the
Smith case became easier to access.

Congress responded and in 1986 enacted the Electronic Communications Privacy Act (ECPA)83 to provide certain privacy protections in electronic communications. ECPA defined three types of communication: wire,
consisting of human speech transmitted by wire, cable, or similar connections; oral, consisting of any spoken utterance "carried by sound waves
through the air";84 and electronic, consisting of any electronic communication that was not wire or oral.85 This meant that wiretapping could include
tapping of fax and data (e.g., email). ECPA added various privacy protections to communications depending on how they were being carried.

Under ECPA, cell phone communications were treated as wire communications and were fully protected even when the over-the-air portion was
unencrypted. Other radio communications were electronic.86 If a radio
communication could be easily intercepted-for example, with storebought equipment-then it would not be protected. If, however, such
communications were difficult to intercept (e.g., encrypted), then they
were protected under ECPA. This meant that intentional interception by
private citizens was subject to criminal penalties, while such interception
by government without an intercept order was subject to suppression
in court.

ECPA added protections for stored electronic communications, an issue
that had arisen as a result of ISPs providing such services. Here the law was
surprisingly complicated. Interception by private citizens was prohibited.
Interception by the government required a search warrant for access to
unread mail that had been stored at an ISP for 180 days or less (a search
warrant is easier to obtain than an intercept order). Contents stored for a
longer period and contents stored after having being read were given less
protection.

ECPA also regulated the use of pen registers and trap and trace, the realtime capture of all numbers calling a specific number. In contrast to wiretaps, only a court order was needed for the installation of pen registers and
trap-and-trace devices; it could be applied for by any federal lawyer and
granted by a federal district judge or magistrate. There was no probablecause requirement; law enforcement simply had to state that the information sought was relevant to an ongoing investigation.

Though it had gained certain provisions, including the ability to do
roving wiretaps (wiretaps where the address of the tap is not specified because it is believed that the suspect is changing locations to avoid electronic surveillance), law enforcement had opposed the bill. In the end,
privacy protections for the citizenry won out. Part of the reason for this
was lawmakers' belief that such protections were necessary if such technologies as cell phones and email were to be widely adopted.

Law enforcement pressed back. At issue was accommodating law
enforcement wiretaps. In 1970 there had been a conflict between the FBI
and a local telephone company about the amount of assistance the telephone company had to provide in arranging the wiretap. Congress's
response was to add a small section to the wiretap law requiring that the
provider of telephone services supply technical assistance to accomplish
the wiretap and be compensated accordingly.87 The issue of whether the
telephone companies had to design their systems around law enforcement
needs had not arisen previously.88

In 1982, a court-ordered breakup of the AT&T monopoly created a host
of competing service providers, a climate of innovation, and the development of multiple new services. It also created problems for law enforcement. Instead of dealing with a single-and not rapidly innovating-supplier,
the FBI and state law enforcement faced a bewildering array of telephone
companies served by multiple suppliers. Wiretapping grew complicated
and more difficult, and law enforcement sought legislative relief. In 1992
the FBI pressed for the Digital Telephony proposal, which would require
that all digitally switched telephone equipment be built wiretap accessible.
The proposed bill included requirements that all telecommunications providers, including private branch exchanges (the private switching centers
used in large organizations), design their systems to accommodate government wiretapping; the private sector was to bear the cost. There were lots
of objections to the bill-and no support. It went nowhere. Two years later,
the FBI tried again.

The FBI claimed that wiretapping had resulted in over seven thousand
convictions in a six-year period (1985-1991) in bureau-led investigations
alone.89 Officials of the first Bush administration cast doubts on these
numbers.90 The bureau also argued that "hundreds" of wiretap orders had
been thwarted as a result of new communication technologies,91 but these
numbers could not be substantiated.92 The U.S. General Accounting Office
found that while the FBI had been unclear on its electronic surveillance
needs,93 the bureau was indeed encountering technical problems in tapping
new services.94 This included, for example, the fact that in call forwarding,
the call never makes it onto the local loop of the communication and thus
a wiretap misses any calls that have been forwarded. The government report also noted that the telephone companies lacked adequate wiretapping capacity for cellular systems.95

In a last-minute deal between the telephone companies and law enforcement, Congress passed the Communications Assistance for Law Enforcement Act (CALEA).96 CALEA required telecommunication carriers to design
their systems so that they could quickly isolate call content as well as
originating and destination numbers of the communication. In addition,
the companies provide this information to law enforcement in a format
and to a site of law enforcement's choice; see figure 4.1.97

Implementation was to occur after appropriate consultation among law
enforcement, the telephone companies, and representatives of the users.98
The House of Representatives report on the legislative history" stated that
"the telecommunications industry itself shall decide how to implement
law enforcement's It was expected that the standardsetting authority would devolve to the FBI, but the lack of consultation
that followed was unexpected. Implementation was divisive and litigious,
with the FBI consistently setting standards that the communication providers believed extended well beyond CALEA's requirements.

One controversy was over interception capacity. The first time the FBI
did the calculation, the bureau developed a requirement that would have
resulted in the telephone companies having a capability of providing thirty
thousand simultaneous surveillances (where surveillances included wiretap,
electronic, combination, pen register, and trap-and-trace devices). This was
four times the annual number that had been conducted in 1993, the year
used as a baseline.101 When there were objections to this, the FBI tried a
new way of calculating and arrived at a maximum simultaneous surveillance capability of thousand simultaneous interceptions, or eight times
the total number in 1993. The blurring of the line between wiretaps, which
were considered an invasive search, and pen registers and trap-and-trace
devices, which were not considered invasive, meant that the FBI could be
requesting sufficient interception capability to perform thousand simultaneous pen registers-or 57 thousand simultaneous wiretaps."'