Surveillance or Security?: The Risks Posed by New Wiretapping Technologies (20 page)

The U.S. Marshals Service, responsible for tracking fugitives, seeks penregister information with the location of the first and last daily cell sites
of the target's phone. These data combined with information about the
fugitive's background has allowed the Marshals Service to cut its average
investigation time from forty-two days to two. The principle is simple: if
the suspect's cell phone registers at the same cell tower each night at 11:00
and again the following morning at 10:00, and this happens to be the
tower serving a friend or relative of the suspect, there is a good chance the
fugitive is sleeping at that friend's or relative's home. Law enforcement's
ability to track is not just to a cell site, but to "phones hidden in an office
building."" Such tracking enabled the arrest of one of the men later convicted in the attempted bombings of the London transit system on July
21, 2005: Hamdi Isaac Adus fled to Rome, but he was tracked to his
brother's apartment through the movements of his cell phone.18

Real-time access to location information can sometimes enable breaking
the case in a matter of hours. In kidnappings where the child has been
taken by a noncustodial parent, there is a known person with a known
cell number. Investigating such cases is a matter of tracking the location
of the parent's phone (or sometimes the child's phone). Cell phone location has also been used to break other kidnapping cases, most often those
when the abduction is unplanned and the victim still has the phone even
if it is off.

Sometimes law enforcement uses pen registers to develop sufficient
information to then apply for a Title III warrant. In such cases the investigation focuses on these questions: Are these two phones in contact?
How often? Is this new person part of the conspiracy? Law enforcement investigators request various types of location information searches, such
as the following:

• All phones at the sites at the time and location of the Washington
sniper.19

• All phones in the vicinity of the Westin Copley Place Boston on the
evening of April 10, 2009, and all phones in the vicinity of the Boston
Marriott Copley Place on the evening of April 14, 2009.20

• All phones registered at a particular tower between 10:00 and 10:30 p.m.

The first search combines both pen-register-real-time-with retrospective
data, while the second and third are retrospective. Such searches may be
used directly to net the criminal-unsuccessful in the first case, successful
in the second-or indirectly, such as in finding witnesses.21 Police map out
the conspiracy based on the accumulated data. This is where things get
complicated for the telephone companies.

While the average time for a Marshals Service pen-register investigation
is at most ten days, the FBI uses the orders for their full period of sixty
days-and even longer. Investigations by the Drug Enforcement Agency
can last up to half a year.22 Law enforcement first seeks the records on
targets, then broadens the search to their associates, then to the associates'
associates, and so on. A pen-register order can be used to apply for information about the calls of one suspect. Then it can be used to return a
day-or a week or a month later-for calls of someone whom the original
suspect called, and so on. The clock starts anew each time the order is
served for a new user, and the list can grow to thousands of people. According to Al Gidari, privacy partner at the law firm of Perkins Coie LLP, a
single pen-register order can effectively be "a daisy chain that never expires
as it is used with successive service providers."23

In France, if police are tracking a suspect, they will scan all cell phones
in a given location.24 If the suspect is a credit-card thief, the police will
correlate those appearances in places where the card is being used.25 Suspects who think they are being clever by using pay phones are fooling
themselves. The French police track the appearance of cell phones-on or
off makes no difference26-in the vicinity of the pay phones, destroying
the anonymity the criminals thought they were achieving.27

Although the Department of Justice is required to report to Congress
annually on its use of pen registers and trap-and trace-devices28 including
what type of crime was involved, the district in which the surveillance
occurred, and so on, the department has fallen far short of doing so.
In 2004 the department filed an aggregate report for 1999-200429 with Congress. From this we learn that in 1999 there were 4,949 federal penregister applications and 1,553 applications for trap and trace; in 2000, the
numbers were 4,210 and 1,869; in 2001, 4,172 and 1,511; in 2002, 4,103
and 1,208; and in 2003, 5,932, and 1,336. The number of investigations,
extensions, and persons whose telephones were affected in each of these
years is also reported.3o

The data are missing required information, such as crime involved and
district in which the interception occurred. This makes it impossible to
connect a surveillance to a particular crime and leaves no way to determine
the effectiveness of the pen registers and trap and traces that the DoJ has
been increasingly performing. The incomplete data prevents oversight.
Even worse, the numbers appear incorrect. While historical data from the
1990s shows that the total of pen registers and trap-and-trace orders was
somewhere between ten and fifty times the number of Title III warrants,31
the recent numbers released to Congress show a sharp break from that
pattern with much lower numbers of pen registers and trap and traces than
expected. In addition to pure pen register and trap and trace, law enforcement has also been using "hybrid" orders combining past and future user
locations in a single request.32 In 2009, the four major wireless carriers have
been receiving roughly twenty thousand orders annually for such hybrid
data.33 Thus it is likely that underreporting has been occurring.

In fact there is already clear evidence of this. An email released under
a Freedom of Information request reveals one of the FBI agents commenting as follows:

We deal mostly with the Fugitive squad here and, like in many other offices, these
guys have a reputation for cutting corners (I'm not bashing them; it's the way they
do business). Getting a court order is absolutely the last step, if they have to. Before
I had a blow-up with a particular Agent almost exactly one year ago, we were
constantly asked to call our contacts at service providers to see if we could get
various information without having to get a court order.... Doing this once or
twice to help turns into SOP [Standard Operating Procedure].. . . I also had a
problem with the Fugitive guys calling the service providers and telling them it
was I who was calling.... We also had an Agent try to knowingly pass a bad court
order to us.34

It is clear why law enforcement would choose this way to conduct an
investigation if possible. Use of the telephone company's location information, both real time and in the CDRs, represents a major cost savings
for police. One former investigator observed that subpoenaed phone
records provide the same information as thirty days of covering a suspect
with a five-person surveillance team-at a fraction of the cost (at least to law enforcement). But accessing this information is not free; ultimately
someone pays. The burden on the carriers in the longer investigations "can
be enormous," according to Gidari. The search for cell phone records for
the Washington sniper was expensive in other ways as well: the AT&T
wireless system crashed, while Verizon ran into problems.

There has been concern that NSLs were being overused, and in 2009,
eight senators introduced a bill to place safeguards on the use of National
Security Letters,35 namely, that NSLs were to be issued for phone records
only when they "pertained to a suspected agent of a foreign power, an
individual who is the subject of an ongoing and authorized national security investigationi36 and related instances.37 The lack of oversight has led
to abuses. It may also create security risks when the wrong people illegally
use the system.

It is not always necessary to access the phone company's records in
order to track users. The FBI uses technology developed by the Harris Corporation: Triggerfish, which employs the target's phone, an antenna, and
a laptop to determine a cell phone user's location. Whenever a cell phone
is on, the phone registers with the nearest cell tower. The Triggerfish
antenna intercepts the signals,38 and by analyzing direction and signal
strength from the targeted phone, Triggerfish determines the cell phone's
location.39 Although the telephone company is out of the loop, a court
order (pen register or trap-and-trace order) must still be obtained by law
enforcement before the system can be employed.40 The system is expensive, running upward of $50 thousand, which keeps use limited.

The near ubiquitous use of cell phones means that the ability to track
users is available to others than law enforcement. Google, of course, offers
such tracking as an opt-in service (Latitude). A U.K. company, Path Intelligence Ltd., has gone one step further and markets such services to third
parties. Path Intelligence offers tracking to within a couple of meters of a
person's location, which means that the system knows not only which
store the individual is in, but where the person is within the store-which
counter-and whether they are looking at Prada handbags or something
much cheaper.41 Path Intelligence does this through devices planted
throughout the mall that monitor the user's phone signal. Currently the
company advertises the ability to collect aggregate statistics: how much
traffic passed a store, how much traffic is in the mall at a particular time
of day or in response to a special event, but the company proposes following individuals. The imagination shudders at the highly targeted advertising that is likely to result: "Buying Merlot again? Why not a good Scotch
instead?" In the United States such tracking by a private entity would not be permitted. It would violate the pen-register statute, which permits
tracking only by law enforcement, and only with a court order.

5.2 How Effective Is Wiretapping in Criminal Cases?

Effective police work rests on acquiring information. In preventive police
work, such as community policing, the information might be innocuous:
which shopkeeper is off on vacation, whose daughter is getting married.
Or it might be of a more interesting variety: which young people are spending time with the more unsavory characters in the neighborhood, who
seems to have a lot of cash lately. Central to police work, of course, is
information about criminals' plans.

Sometimes this can be obtained through the observations of others, but
the most useful acquisition of information occurs if law enforcement can
overhear criminals discussing their plans. If police listen in through bugs
or wiretaps when criminals talk among themselves, the eavesdropping
requires a warrant. Sometimes, however, a criminal will talk with someone
who might share information with the police. This could be an informant,
including one who is wired.42 Such taping of conversations does not need
a wiretap warrant.

In some cases, evidence may not be as easy to produce. This is especially
true in cases where the victims may find it difficult to testify (as in a 2001
investigation into telemarketing fraud that targeted older victims,43 or in
a "victimless" crime such as gambling and prostitution). Wiretap evidence
can be particularly valuable in such situations. Wiretapping is also extremely
useful in investigating corruption cases, where penetrating into the conspiracy, whether it is a case of bribery, insider trading, price fixing, and so
on, is difficult.

The 1967 commission on crime recommended the use of wiretaps
because of their value in cracking conspiracy cases. Wiretaps may have the
subject himself saying what he is doing, when, how, and where he is doing
it, sometimes even why the act is occurring. A Schenectady County, New
York, district attorney observed of a 1998 gambling investigation, "When
the targets heard their own voices on the tapes, the impact [was] obvious."44
That case resulted in eight arrests and five convictions. With such cases, it
is no wonder that government agents have fought so hard to keep this
surveillance tool alive in the face of changing communication technologies. The reality of the tool is, however, a little different.

The Wiretap Report tells how many arrests and convictions there are
in each Title III wiretap case, but the real issue is whether the wiretap played a significant role in the conviction. In some sense, that is impossible
to tell, for the Wiretap Report does not include the court hearings and
what swayed the jury or judge. This lack of hard evidence on the efficacy
of wiretaps has been a concern since at least the passage of Title III;
in 1972 Schwartz looked at four-and-a-half years' of Title III wiretaps. He
found:

In United States versus Poeta, the US Court of Appeals opened its opinion by observing that the tap-derived evidence was unnecessary to the conviction; in another
case, Uniformed Sanitation Men versus Commission of Sanitation, the Court made the
same observation. In a 1971 report, a Nevada prosecutor reported two indictments
in a kidnapping case in which wiretapping was used ... but candidly added that
the indictments were "not as a result of the interception.""

In 1975 in testimony to a federal commission examining wiretapping,
Schwartz noted:

There is an assumption which the Administrative Office [of the U.S. Courts] does
not sufficiently dispel, that the arrests and convictions that are reported are a result
of the installations involved. I think that should be dispelled.

Indeed, I found, curiously once, a prosecutor from Arizona wrote in, "We got one
conviction, but it had nothing to do with the tap. 1146 .. .

The picture as to convictions purportedly resulting from electronic eavesdropping in those jurisdictions which do wiretap is still not complete. . . . Moreover,
there is a very difficult question of causality: even where wiretapping was used in a
case, how closely related was it to whatever results were achieved? In more than a
few cases, courts and prosecutors have commented on the irrelevance of the wiretap
evidence.... In many cases involving the disclosure of illegal taps, federal prosecutors have argued that whatever wiretapping was done did not produce any of the
evidence used at the trial."