| Would-be law enforcement monitors are highly interested in this question because the surveillance laws directly impact their work.48 Government investigators comprise a relatively small group, each with a strong interest in the applicable legal rules. They each have high participation benefits, because the rules determine their surveillance practices.
Potential targets, which include citizens who face the possibility of being surveilled, also have a substantial interest.49 Those with the most direct stake are Internet users, who may be targeted by online surveillance. As Internet use increases, and as regular telephone calls increasingly traverse the Internet, most American citizens will soon be potentially subject to online surveillance.50 Though citizens’ overall interest in privacy may well exceed law enforcements’ interest in reducing it, that interest is diffusely spread, with each individual sharing only a small part.51
The actual target group comprises two subgroups: those who know they have been targeted and those who do not. The first subgroup is much smaller than the second because there is no notice requirement for online surveillance of non-contents information. In fact, service providers and others who aid in the surveillance must not disclose it to the targets, and the surveillance records are kept under seal.52 Targets learn of non-contents surveillance either by accident or because law enforcement also conducts a contents interception, for which notice must be provided. In addition to the legal online surveillance that goes unnoticed, one must assume some illegal online surveillance of non-contents information, given the history of illegal surveillance.53 Most of that surveillance would never come to the attention of the target. At the end of the day, we have no idea how many people are targets of online non-contents surveillance, but we do know that the subgroup of targets who are aware of their surveillance is small indeed.
C. Comparative Institutional Analysis and its Implications
The standard comparative institutional inquiry considers the following three major institutions: the market, the congress and the courts. So I will begin with the three traditional institutions, before considering the executive branch.54
1. The Market
It would be difficult for the market to clarify the rules for government surveillance of the Internet. Government investigators do not conduct surveillance pursuant to contracts; citizens may not negotiate their way out of government monitoring. Much debate has focused on the use of private contracting between Internet users and commercial marketers to resolve privacy conflicts,55 but I know of no proposals for market-based solutions to government surveillance.
That is not to say that the market plays no role; it does in at least two ways. First, technology developed for commercial purposes may dramatically affect Internet users’ privacy, vis-B-vis both private and government monitors. For example, government agents conduct surveillance using spying software designed for commercial uses.56 Though law enforcement welcomes such innovations, it has not welcomed the development of commercial encryption products that make electronic information more difficult to decipher.57 Second, private entities, such as Internet service providers, significantly influence the privacy of online communications. In recent years, Congress has viewed third party intermediaries as important protectors of privacy, in part through their contracts with users.58 Whether they actually protect privacy or instead offer an end run around privacy protections is an important public policy question.59
2. The Congress
While market-based transactions may not identify the terms under which law enforcement investigators may obtain private online communications, legislation may. In Congress, citizens face high participation costs. As mentioned, it is challenging to get accurate information about current practices and current law, both of which are remarkably complex. The descriptive question may be harder to grasp, however, than the normative one: what restrictions should there be on the government’s ability to monitor online activities? Further, citizens’ information costs in Congress may be decreasing as information becomes more available. Online activist groups and interested academics have recently published explanations of current law and practice.60
Government investigators should face lower information costs in Congress. As those who enforce the laws, they ought either to understand them or have access to those who do.61 On the other hand the complexity of the current framework seems to vex even those conducting surveillance. Justice Department representatives regularly disclaim awareness of the intricacies of the law and current practices.62 Four years after passage of the ECPA, Secret Service agents did not realize that it applied to the seizure of e-mail records.63 Finally, as mentioned, recently published interpretations claim an aggressive power to conduct surveillance that is not justified by precedents or common sense.64
As for the costs of organization, government representatives have aggressively lobbied for expansive government surveillance powers. Executive branch authorities do not need the consensus of lower level members to represent their interests, so that reduces their organization costs. Citizens have disparate interests and are more difficult to represent. However, online privacy advocacy groups have grown in strength and efficacy over the last ten years. The availability of inexpensive online publishing permits such groups as the Electronic Frontier Foundation, the Electronic Privacy Information Center, the Center for Democracy and Technology, and the ACLU to reach members cheaply.65 Representatives from such groups have testified in Congress to advocate limits on government surveillance capacities.
Overall, we have seen much greater participation in Congress by law enforcement than by those advocating online privacy. In the ECPA, the incomplete extension of rights and remedies to electronic communications reflected the desires of law enforcement and substantially limited online privacy. The minimal protections of the pen register provisions reflect law enforcement’s priorities.66 The privacy activists lobbied during consideration of the 1994 amendments, but the gains they achieved were not dramatic.67 The Patriot Act amendments also reflected law enforcement’s interests and did little to improve privacy. It is perhaps not surprising that some have proclaimed that Congress will not draft any law that law enforcement does not fully support.68
History does not suggest that Congress has been well suited to achieve the social policy goal of protecting privacy from unnecessary monitoring. For non-contents information in particular, Congress has seemed to abandon privacy in favor of giving law enforcement whatever tools it wants, necessary or not. Congress seems burdened by the over-representation of law enforcement and the under-representation of privacy interests.
Several factors could improve the efficacy of participation in Congress, however. First, if members of Congress and their constituents overcame their fears and approached online surveillance rationally, that would increase the negotiating leverage of online privacy activists. Second, if executive branch officials continue to seem untrustworthy, as they have in connection with the run-up to the Iraq War, and overreaching, as the Supreme Court viewed them in the cases pertaining to enemy combatants and detainees,69 then their argument that we and our legislators should trust them should weaken. Whether that would be enough to obtain the right balance in Congress and effectuate the social policy goal is another question.
At this point in the analysis, our question remains: will Congress be better than the alternative, the courts, at achieving the social policy goal? The relative nature of the inquiry permits us to sidestep the impossible task of specifying what “appropriate” representation is. We do not have to identify the perfect participation balance, we must merely assess which institution provides less imbalance.
3. The Courts
As for the courts, judges should be less willing to indulge an irrational faith that surveillance protects us. But several lower courts have accepted the executive branches’ extravagant claims to unchecked power to prosecute the “War on Terror.”70 The Supreme Court’s rejection of those claims could have gone much farther;71 the historical record reveals that fear can hold significant sway there.72 In any case, let us consider how participation in the courts varies significantly from participation in Congress.
While all potential victims of unlawful surveillance participate in Congress, only actual victims participate in litigation.73 As discussed, the class of actual targets of surveillance who know they have been monitored is a small subset of those who have actually been monitored. Not only do targets lack awareness of surveillance, but current law provides no remedies for unlawful interception of non-contents information online.74
The only cases so far to consider privacy rights in online non-contents information have been those brought by Internet users seeking to exclude from their criminal trials the subscriber information obtained by the government.75 While their stakes are high, such defendants have not been the best representatives of overall society’s privacy interest. Most of them have been online child pornographers and sexual abusers, who are some of the most heinous criminals in society.76 Because incriminating evidence is such cases may be largely electronic, those defendants have had a lot to gain from the suppression of evidence. Yet citizens and judges are likely to focus on the danger these defendants pose and lose sight of the more abstract question of how government investigators use their surveillance powers. Similarly, law enforcement agents have a strong interest in bringing these defendants to justice, an interest that is widely shared. Average citizens may see their interests as more aligned with the victims than with the defendants. Overall, it should not be surprising that these defendants have lost their claims and, along with them, the opportunity to protect privacy.77
Courts have justified their repeated denial of constitutional claims in some online non-contents information by extending Smith beyond telephone numbers. In fact, Justice Department officials have wrongly characterized Smith as having applied to all non-contents information.78 The contents/non-contents distinction serves law enforcement’s interest in constraining privacy rights, but it ignores history. The Supreme Court in Katz and Congress in the Wiretap Act distinguished protected conversation contents not from unprotected non-contents but rather from tangible items. At the time, questions lingered about whether intangible conversations were protected by the Fourth Amendment, because the literal language did not include them.79 When Congress passed the Wiretap Act, it included all information disclosed by wiretaps.80 After Smith, the ECPA limited the definition of contents, but did not address information that was neither contents nor captured by pen registers.81 Courts that have applied Smith have repeated the Supreme Court’s mistake in that case. They have held Internet users to assume the risk of disclosure of non-contents information, rather than considering, at a normative level, the type of information, and the implications of withholding privacy protection from it.82
As it stands, most potential and actual victims of undue surveillance powers never make it into courts to plead their case. In fact, those who do sue arguably inhibit courts from achieving the social policy goal. While it is possible that courts could become more aware of the broader privacy implications of their decisions, little suggests such a trend.83 Under the current legal framework, Congress seems preferable to the courts as the institution to update the electronic surveillance laws. Instead of hearing from dangerous child predators attempting to escape punishment, Congress can hear from impressive academics and impassioned activists. Though participation in Congress is imperfect, it seems better than the alternative.
This result is remarkably contingent. Small changes in the law could switch the institutional preference to courts. For example, if the ECPA permitted generous statutory remedies for victims of unlawful surveillance, then ordinary citizens would be motivated to bring cases, perhaps with the help of activists.84 Courts considering such cases would be better able to assimilate the complicated legal issues than members of Congress, who are susceptible to sound bites.85 Also, such plaintiffs as journalists or political activists who have been harassed by government surveillance would likely enlist the judge’s sympathy. Moreover, if courts understood the need to respect privacy as a normative matter and rejected the assumption of risk, then they could establish a strong constitutional foundation that protected rich online data despite the lack of statutory protection. Finally, another significant terrorist attack could well scare citizens into relinquishing yet more privacy rights to gain a sense of security. In that case, law enforcement may overwhelm its opponents in Congress.86
4. The Executive Branch
In the foregoing analysis, the executive branch did not come to mind as a possible institution to change the online surveillance rules, because law enforcement, which falls within the executive branch, is charged with enforcing those rules. The rules themselves are designed to constrain law enforcement. But arguably the current law, with insufficient proscriptions that are largely unenforceable, has devolved into a set of rules that law enforcement agents interpret themselves. In fact, apologists for the current system argue that law enforcement’s self-restraint obviates the need for change.87
From the perspective of the participation framework, law enforcement would not be the institution to effectuate the social policy goal of protecting privacy from unnecessary surveillance. Law enforcement officers tend to approve of all surveillance powers and to exhibit insufficient concern for privacy.88 Potential targets have a difficult time knowing what current practices are, and actual targets are unlikely to find out if they are victimized by unlawful practices without notice. Whether potential or actual, targets of surveillance have no ability to affect law enforcement’s own choices about how to conduct surveillance, outside of Congress or the courts. Since the party with the least interest in privacy has sole representation in the executive branch, the current system is untenable.
Reformulating the social policy goal – to be giving law enforcement agents the maximum freedom to investigate within constitutional limits -- would significantly change the analysis. First of all, if the courts are correct that there are no constitutional constraints on non-contents information, a position that I reject but the government supports, then the goal becomes maximizing law enforcement’s surveillance power. Surely law enforcement knows best how to maximize its power; it does not need any representation from others to get the “balance” right. Under this approach, permitting law enforcement to interpret the law themselves is exactly right. Not surprisingly, law enforcement representatives have often formulated the social policy goal in exactly this way.89
The discussion so far has suggested how to use comparative institutional analysis to choose an institution to resolve the legal rules that regulate government surveillance of non-contents information online. The answer is remarkably contingent on current conditions. Next I turn to what the case study reveals about comparative institutional analysis generally.
III. Challenges to the Model
A. The Primacy of Social Policy Goals
As we have seen, the way we formulate the social policy goal may virtually determine the comparative institutional analysis. Seemingly minor variations in goals lead to major differences in the analysis. That means that we do not necessarily waste time when we debate goal choice. It also suggests that comparative institutional analysis may contribute most when goals are chosen easily and without contest. For the more common cases of multiple and competing goals, such as in the case study, comparative institutional analysis may do better to guide the strategy of those who agree on goals, rather than appealing as an objective assessment to those whose goals differ.
B. Choosing Institutions
Whatever the social policy goal one chooses for the case study, the executive branch should not be in charge of making the surveillance rules. When law enforcement is in charge it avoids the checks and balances that are essential to our constitutional system; it is like having the fox guard the hen house. But those reasons for criticizing the executive branches’ undue influence on the current rules have little to do with comparative institutional analysis. In fact, as discussed, the participation-centered framework could choose the executive branch under a reformulated social policy goal. This affirms the need to supplement comparative institutional analysis with other tools for choosing institutions. In the case study, insights from the debates over the appropriate roles of each branch, and particularly the division of authority between Congress and the executive, are essential.
By the same token, debates over whether the legislature or the judiciary is best situated to adapt the law to cyberspace have focused on issues of institutional competence rather than the comparative institutional inquiry. Commentators have questioned whether courts can devise rules of sufficient scope and whether Congress can devise rules with sufficient speed. Commentators raise concerns about the technical expertise demanded to address cyberspace law, but it is unclear which branch is at a greater disadvantage. In fact, questions of expertise may be seen as participation questions. Experts are more likely to participate in congressional hearings than in courts, although litigating parties may hire them and judges may appoint them.
Whatever methods are used to select an institution, however, the analysis cannot stop there. Our legal institutions react to each other and no one institution has the last word.90 Comparative institutional analysis must take account of the iterative nature of the law, and anticipate the reactions by the other institutions.91 This suggests the need for multi-institutional recommendations, which will make predictions more difficult but prescriptions more sophisticated. For example, in the case study, it seems clear that Congress could improve participation in the courts by adding statutory remedies for victims of unlawful surveillance. At the same time, courts could spur Congress to action by establishing firm constitutional protection for non-contents information online.92
By the same token, it is not altogether clear what to do with the comparative institutional result. Commentators have noted the absence of a meta-level institution qualified to choose the institution to make the legal change.93 Perhaps the analyst is the chooser, and makes arguments in each institution accordingly. For example, if Congress is the preferred institution, the analyst should try to impress members that they are the best choice and so must act. Failing that, the analyst could try to convince courts that they must act since Congress will not. Or the analyst could counsel courts not to act if it seems likely that Congress will. The aim would be to bring the results of comparative institutional analysis to the institutions themselves and use those results to persuade institutions to do the right thing. Ultimately, comparative institutional analysis promises to bring a more rational approach to decision making that can benefit any institutional process.
Though it may be supplemented, the participation-centered approach adds an essential element to the mix. It pressures institutions to reflect the paradigms that justify their power. By basing institutional choice on participation, we encourage institutions to realize healthier forms of participation. Incorporating the participation-centered framework into discussions of institutional choice means that we prefer markets that are made up of interested and informed parties who freely negotiate and make choices among competing options. We prefer legislatures that have fully considered and weighed all views and then engaged in careful deliberation. We prefer courts that have been presented with the relevant information by parties who have been able to bear the costs of bringing or defending a case. The participation-centered framework encourages us to view deviations from these ideals as reasons not to entrust these institutions to resolve particular legal conflicts.
The fact that these ideals remain unrealized raises another question. How much should comparative institutional analysis reflect practical reality? The analysis cannot be too realistic, lest it generate mere reports rather than prescriptive analyses. But how far should it push the envelope?
For example, judges have expressed an unwillingness to go beyond their perceived role as interpreters of the law and to “legislate” by aggressively interpreting the ECPA.94 Typically against strong dissents, such judges have valued their own restraint more than a privacy statute that makes sense and protects privacy. According to such judges, only Congress can update the ECPA.95 If this view persists, it will doom to failure any comparative institutional analysis that pushes courts to be activist in their interpretations.96 That means that, outside of constitutional issues, there may be few ways for judges to implement meaningful change even if they are the preferred institution.
Congress, on the other hand, may well hesitate to shape the contours of constitutional questions without explicit guidance from the courts. Instead, legislatures endeavor to maintain the status quo, even when the status quo makes no sense.97 If Congress does try to account for all relevant interests, it will be hard to say when it has done it right. It is not clear if we judge adequate balancing based on the procedures used or the outcome generated.98 We will likely need to refer back to the social policy goal, which again demonstrates the importance of that choice.
Comparative institutional analysis offers tremendous value in getting us to think about who participates in changing the law, and in reminding us that the question of institutional performance must be a relative one. At the same time, using comparative institutional analysis to devise resilient answers to the questions of institutional choice can be quite a challenge. It is difficult to agree on a social policy goal, to determine how realistic to be and how far forward to project. It is also clear that concerns about participation must be supplemented with other factors that influence institutional choice. Finally, it is not clear that institutions are ready to use comparative institutional analysis to guide their own choices, and their hesitation should remind us to consider the possibility of unintended consequences.