What a comparative Institutional Analysis of Online Surveillance Reveals

Download 203.73 Kb.
Size203.73 Kb.
1   2   3
See Tim Berners-Lee, Weaving the Web (2000) (describing the development of the World Wide Web from the perspective of its inventor).

2 See, e.g., Westin, Privacy and Freedom (1967); see also Paul M. Schwartz, Privacy and Democracy in Cyberspace, 52 Vand. L. Rev. 1610, 1647-59 (1999) (arguing that information privacy on the Internet is critical to citizens’ ability to define themselves and engage in democratic deliberation).

3 See generally, Susan Freiwald, Online Surveillance, Remembering the Lessons of the Wiretap Act, forthcoming Alab. L. Rev. (2004).

4 Katz v. United States, 389 U.S. 347, 351 (1967).

5 See id.

6 Omnibus Crime Control and Safe Streets Act of 1968, Pub. L. No. 90-351, Title III, 82 Stat. 212 (1968) (codified as amended at 18 U.S.C. §§ 2510-2522 (2002)). Commentators use either “Title III” or the more intuitive “Wiretap Act” to refer to the law.

7 See The Communications Act of 1934, Chapter 652, 48 Stat. 1064, 1100, codified at 47 U.S.C. § 605 (1958) (amended in 1968); Freiwald, supra note 3 (reviewing the history of the law).

8 See 18 U.S.C. § 2510(8) (1968). The definition of “contents” was designed to be comprehensive. See S. Rep. No. 90-1097, at 105 (1968), reprinted in U.S.C.C.A.N 2112, 2179 (defining “contents” to include “all aspects of the communication”).

9 See 18 U.S.C. § 2518(3). This is known as the “necessity” requirement. See, e.g., United States v. Lynch, 367 F.3d 1148, 1158 (9th Cir. 2004).

10 See 18 U.S.C. § 2518(5).

11 See id § 2518(3).

12 See id. § 2518 (procedures for granting wiretap orders, extending orders, requiring progress reports, keeping copies or evidence, and giving notice of wiretapping).

13 See 18 U.S.C. § 2518(8) (notice to targets); id.§ 2518(10) (civil damages and suppression remedy).

14 See Smith v. Maryland, 442 U.S. 735 (1979).

15 See id.

16 See Smith, 442 U.S. at 742-43 (“[I]t is too much to believe that telephone subscribers, under these circumstances, harbor any general expectation that the numbers they dial will remain secret.”).

17 See Susan Freiwald, Uncertain Privacy: Communications Attributes After the Digital Telephony Act, 69 S. Cal. L. Rev. 949, 982-89 (1996) (reviewing the evolution of the pen register).

18 See id. at 986-87.

19 See Pub. L. No. 99-508, § 301, 100 Stat. 1848, 1848-73 (1986) (codified as amended at 18 U.S.C. §§ 3121-27 (2000 & Supp. I 2001)).

20 Law enforcement agents who engage in unlawful pen register investigations may be subject to a fine or up to one year in jail. See 18 U.S.C. § 3121(d). There are no reported prosecutions under this provision.

21 See, e.g., United States v. Hallmark, 911 F.2d 399, 402 (10th Cir. 1990) (describing provisions “as intended merely to safeguard against purely random use” of pen registers); In re Order Authorizing Installation of a Pen Register, 846 F. Supp. 1555, 1559 (M.D. Fla 1994) (seeing minimal pen register provisions as designed to “accumulate reliable statistics” for Congressional oversight).

22 For example, the statute defined a pen register as “a device which records or decodes electronic or other impulses which identify the numbers dialed or otherwise transmitted on the telephone line to which such device is attached.” 18 U.S.C. § 3127(3) (2000) (amended 2001) (emphasis added).

23 See, e.g., Orin Kerr,, Internet Surveillance Law After the USA Patriot Act: The Big Brother That Isn’t, 2003 N.W. Law Rev. 607, 645-47.

24 For example, historically, some Justices had argued that “pen registers” falling outside the statutory definition should be entirely prohibited. See United States v. New York Telephone, 434 U.S. 159, 178-87 (1977) (Stevens, J., dissenting) (opinion joined by Justices Brennan and Marshall). Also, the Court of Appeals of New York held that a pen register-type device with the ability to reveal contents was prohibited under New York Law. See People v. Bialostock, 610 N.E.2d 374 (N.Y. 1993).

25 See Freiwald, supra note 3, at notes 388-92, 432-46 and accompanying text.

26 See 18 U.S.C. § 3127(3) (Supp. I. 2001).

27 See id. § 3123(a) (3).

28 See Beryl A. Howell, Symposium Article, 72 Geo. Wash. Law Rev. (forthcoming summer 2004).

29 See H.R. Rep. No. 106-932 (2000) (describing the proposed Electronic Communications Privacy Act of 2000); H.R. Rep. No. 107-236 (I) (2001) (describing unenacted version of the Patriot Act).

30 See Computer Crime and Intell. Prop. Sec., Crim. Division, U.S. Dep’t of Just., Searching and Seizing Computers and Obtaining Electronic Evidence in Crim. Investigations 59 (2002) [hereinafter DOJ Search Manual].

31 See, e.g., Mark Eckenwiler, U.S. Dep’t of Justice, Field Guidance on New Authorities that Relate to Computer Crime and Electronic Evidence Enacted in the USA PATRIOT Act of 2001, 701 pli/pat 1227, 1234 (2002) (“[P]en register and trap and trace devices may obtain any non-content information.”) [hereinafter DOJ Field Guidance].

32 See, e.g, Antiterrorism Investigations and the Fourth Amendment After September 11, 2001: Hearing Before the Subcomm. On the Constitution of the House Judiciary Committee, 108th Cong., 1st Sess. 63-64 (2003) (printing Department of Justice’s claim that all online information is either “contents” or may be obtained by a pen register) [hereinafter Antiterrorism Hearings]

33 In fact, an important question is what process regulates government access to stored records. The law differentiates between real-time access by pen registers and access to information in electronic storage. While the issue is crucial, it is beyond the scope of this essay. For more on the different categories of the current law, see Patricia L. Bellia, Surveillance Law Through Cyberlaw’s Lens, 72 Geo. Wash. Law Rev. (forthcoming 2004); Freiwald, supra note 3.

34 See United States v. Scarfo, 180 F. Supp. 2d 572 (D.N.J. 2001); see also id (affidavit of Randall S. Murch) (Oct. 4th, 2001) (describing the functionality of key-stroke loggers in general terms).

35 See The “Carnivore” Controversy: Electronic Surveillance and Privacy in a Digital Age: Hearing before the Senate Comm. On the Judiciary, 106th Cong., 1st Sess. (2000) (statement of Donald M. Kerr, Assistant Director, Laboratory Division, Federal Bureau of Investigation); The Fourth Amendment and Carnivore: Hearing before the Subcomm. On the Constitution of the House Judiciary Comm., 106th Cong., 1st Sess. (2000) (statement of Barry Steinhardt, Associate Director of the ACLU) (describing Carnivore as “a black box into which flows all of a service providers communications traffic. The service provider knows what goes in, but it has no way of knowing what the FBI takes out.”); E. Judson Jennings, Carnivore: U.S. Government Surveillance of Internet Transmissions, 6 Va. J. L. & Tech. 10 (2001).

36 See DOJ Field Guidance, supra note 31, at 1234. Curiously, the article directs the inquiring prosecutor to contact the DOJ Section which purports to be the author of publication. See id

37 See, e.g., Howell , supra note 28; 147 Cong. Rec. S10372 (daily ed. Oct. 9, 2001) (statement of Sen. Leahy) (“[T]he FBI and Justice Department are short-sighted in their refusal to define” the terms “content”, “routing”, and “addressing” in the Patriot Act.).

38 See, e.g. Orin Kerr, Lifting the “Fog” of Internet Surveillance: How a Suppression Remedy Would Change Computer Law, 54 Hastings L. J. 805 (2003).

39 See Neil K. Komesar, Imperfect Alternatives: Choosing Institutions in Law, Economics, and Public Policy 153-195 (1994) [hereinafter Imperfect Alternatives”].

40 See Susan Freiwald, Comparative Institutional Analysis in Cyberspace: The Case of Intermediary Liability for Defamation, 14 HARV. J. L. TECH. 569 (2001).

41 Professor Komesar discusses “numbers” extensively in his most recent book. Neil K. Komesar, Law’s Limits: The Rule of Law and The Supply and Demand of Rights (2001) [hereinafter Law’s Limits]. “Numbers” elucidate participation costs and benefits. The higher the numbers in a group, ceterus paribus, the higher the costs of organization and the lower the participation benefits. I view the discussion in the text as adequately accounting for the impact of numbers.

42 I derive this approach from Professor Komesar’s book. See Imperfect Alternatives, supra note 39.

43 This simplifies a bit. Many citizens feel ambivalent about surveillance, to the extent that they consider it at all. Also, law enforcement enforces restrictions on private surveillance to protect privacy. See Freiwald, supra note 3.

44 See Bruce Schneier, Beyond Fear: Thinking Sensibly About Security in an Uncertain World 38, 248 (2003) (calling such actions as placing national guardsmen in airports in the wake of 9/11 “security theater” rather than security enhancing); Jeffrey Rosen, The Naked Crowd: Reclaiming Security and Freedom in an Anxious Age 8, 34 (2004) (describing the public’s interest in “feel-good” measures that bring no “demonstrable security benefits”).

45 A common view emerging from analysis of the run-up to September 11 is that government investigators had too much data and too little “human intelligence,” which refers to agents on the ground and translators.

46 See, e.g., Schneier, supra note 44, at 162-63, 243-51 (describing massive data mining schemes as vastly wasteful, unproductive, and threatening to privacy and safety).

47 Many books review this history. See, e.g., James X. Dempsey and David Cole, Terrorism and the Constitution: Sacrificing Civil Liberties in the Name of National Security (2d. ed. 2002); Anthony Summers, Official and Confidential: The Secret Life of J. Edgar Hoover (1993); Samuel Dash, Richard F. Schwartz & Robert E. Knowlton, The Eavesdroppers (photo. reprint 1979) (1959).

48 Federal agents are directly affected by federal law and state agents are indirectly affected because federal law sets the floor under state surveillance laws. See generally Charles H. Kennedy and Peter P. Swire, State Wiretaps and Electronic Surveillance After September 11, 54 Hastings L.J. 971. 983-85 (2003).

49 I focus on citizens here because of the constitutional claims. A significant issue for non-citizens and others targeted by foreign intelligence surveillance is the even looser requirements of those laws. See generally, Peter P. Swire, The System of Foreign Intelligence Surveillance Law, 72 Geo. Wash. Law Rev. (forthcoming 2004).

50 See, e.g., Daniel Roth, Catch Us if You Can, Fortune, Feb. 9, 2004, at 65, 65 (describing current plans to replace all telephone calls with Internet-technology calls).

51 This situation resembles the skewed distribution that Professor Komesar discusses. See Imperfect Alternatives, supra note 39, at 76-79, 130-34. It also raises the difficulty of “balancing” different interests. See, e.g., Edith J. Lapidus, Eavesdropping on Trial 196-98 (1974) (discussing the difficulty of measuring competing interests to apply the balancing metaphor).

52 See 18 U.S.C. § 3123(d).

53 See supra note 47; see also In re Order Authorizing Installation of a Pen Register, 846 F. Supp. 1555, 1563-64 (M.D. Fla. 1994) (Exhibit A) (opinion of Magistrate Wilson) (expressing concern that the absence of judicial review in the pen register provisions will lead to government abuse and misuse of pen registers).

54 Although many have recommended that an expert agency get involved, as has the privacy commissioner in Canada, that seems unrealistic at this point. For reasons I get into next, the relationship between would-be government surveillers and targets has to be regulated by statute and the Constitution.

55 See, e.g., Lawrence Lessig, Code and Other Laws of Cyberspace (1999); Marc Rotenberg, Fair Information Practices and the Architecture of Privacy (What Larry Doesn’t Get), 2001 Stan. Tech. L. Rev. 1 (2001).

56 See, e.g. Preston Gralla, How the Internet Works (7th ed. 2004) 316-19 (describing use by government monitors of commercial monitoring tools).

57 See generally Whitfield Diffie and Susan Landau, Privacy on the Line: The Politics of Wiretapping and Encryption (1999).

58 See Freiwald, supra note 17, at 1010-1013 (critiquing the government’s claim that intermediaries protect privacy); But cf. Recording Industry Association of America v. Verizon Internet Services, 351 F. 3d. 1239 (D.C. Cir. 2003) (granting online service provider’s motion to quash subpoenas requesting the identities of subscribers allegedly engaged in file sharing).

59 See, e.g., Bellia, supra note 33, at 84-86.

60 See, e.g., sources cited note 33; www.aclu.org/SafeandFree SafeandFree.cfm?ID=12719&c=207 (containing reports and other information about government surveillance); http://www.eff.org/Privacy/ (containing documents and links relating to online privacy); http://www.epic.org/privacy/internet/ (same).

61 The Department of Justice has published a report for those in the field that purports to explain the online surveillance laws. See DOJ Field Guidance, supra note 31, at 1234; DOJ Search Manual , supra note 30, at 56-58.

62 For example, the Justice Department official in charge of those who conduct Internet Surveillance has repeatedly failed to clarify what the government collects with online “pen registers.” See, e.g., http://cfp2004.org/program/#keynote2 (containing transcripts of speech by Rachel Brand, Principal Deputy Assistant General, U.S. Dep’t of Justice, Office of Legal Policy).

63 Steve Jackson Games, Inc. v. United States Secret Service, 816 F. Supp. 432, 442-44 (W.D. Tex. 1993), aff’d 36 F.3d 457 (5th Cir. 1994) (finding that government agents never contemplated the applicable statute, and recommending more education of such agents).

64 See Freiwald, supra note 3 (discussing current aggressive interpretations by law enforcement representatives).

65 See www.eff.org; www.epic.org; www.cdt.org; www.aclu.org. The author serves on the board of the ACLU of Northern California.

66 See Michael S. Leib, E-Mail and the Wiretap Laws: Why Congress Should Add Electronic Communication to Title III’s Statutory Exclusionary Rule and Expressly Reject a “Good Faith” Exception, 34 Harv. J. on Legis. 393, 409-11 (1997) (describing Justice Department opposition to the suppression remedy and congressional acquiescence due to the need for its support).

67 See generally, Freiwald, supra note 17.

68 See, e.g., Paul Ohm, Symposium Piece, 72 Geo. Wash. Law Rev. (2004) (forthcoming).

69 See Hamdi v. Rumsfeld, 72 U.S.L.W. 4607 (2004); Rasul v. Bush, 72 U.S.L.W. 4596 (2004).

70 See, e.g., Hamdi v. Rumsfeld, 316 F.3d 430 (4th Cir. 2003) (denying relief to “enemy combatant”), reversed by Hamdi v. Rumsfeld; Al Odah v. United States, 321 F. 3d 1134 (D.C. Cir. 2003) (affirming district court’s denial of jurisdiction over Guantanamo detainees, who had to sue in Cuba, if at all), reversed by Rasul v. Bush.

71 For example, the Court failed to rule on Padilla’s claims and left many questions unanswered about exactly what judicial procedures are required for enemy combatants and detainees and what rights they have.

72 See, e.g., Korematsu v. United States, 323 U.S. 214 (1944). Professor Komesar discusses the Korematsu case at some length. See Imperfect Alternatives, supra note 39, at 210-13, 248, 253, 254.

73 This is the shifted distribution that Professor Komesar observed. See Id. at 134-38. Actual victims may participate in Congress as a matter of principle rather than self-interest, since any law passed to protect privacy will likely give no remedy for their past victimization.

74 See supra note 20.

75 In other words, the cases have arisen under the stored records provisions of the ECPA, 18 U.S.C. § 2701, § 2703 and the Constitution, rather than the pen register provisions.

76 See, e.g., United States v. Hambrick, 55 F. Supp. 2d 504, 508 (W.D. Va. 1999), aff’d, 225 F.2d 656 (4th Cir. 2000), cert. den., 531 U.S. 1039 (2001) (denying suppression of e-mail address, name, billing address, credit card number, and IP connection information despite invalid subpoena); United States v. Kennedy, 81 F. Supp. 2d 1103, 1110 (D. Kan. 2000) (denying suppression of subscriber information obtained by invalid court order); Guest v. Leis, 255 F.3d 325, 333, 335-36 (6th Cir. 2001) (denying suppression of passwords, names, addresses, and birthdates because they were provided to a third party in a case involving both obscenity and child pornography).

77 See cases supra note 76.

78 See, e.g. Antiterrorism Hearings, supra note 32, at 7 (“Of course, the Supreme Court has long held that non-content information is not protected by the Fourth Amendment.”) (statement of Viet D. Dinh, Assistant Attorney General, Justice Department).

79 See Katz v. United States, 389 U.S. 347, 364 (1967) (Black, J. dissenting) (arguing that intangibles were not protected).

80 See 18 U.S.C. § 2510(8) (1968) (defining “contents” as “any information concerning the identities of the parties to such communication or the existence, substance, purport, or meaning of that communication”). The definition of contents was designed to be comprehensive. See S. Rep. No. 90-1097, at 105 (1968), reprinted in U.S.C.C.A.N 2112, 2179 (defining “contents” to include “all aspects of the communication”).

81 See 18 U.S.C. § 2510(8) (1986) (redefining the “contents” of a communication to include “any information concerning the substance, purport or meaning of that communication”).

82 See cases supra note 76.

83 For example, the 10th Circuit expressed genuine hostility to the notion of privacy in a recent case. See U.S. West Inc. v. FCC, 182 F.3d 1224, 1234-35 (10th Cir. 1999) (expressing doubt about the value of privacy and cataloguing the harms from keeping information private).

84 Relatedly, Professor Orin Kerr has recommended a statutory exclusionary rule to flesh out the contours of the law See Kerr, supra note 38.

85 In discussions about a narrowly defeated recent bill to make minor changes to Patriot Act provisions to protect privacy, law enforcement advocates engaged in fear mongering. See Eric Lichtblau, Effort to Curb Scope of Antiterrorism Law Falls Short, New York Times (July 9, 2004). Those also tactics preceded passage of the Patriot Act. See Justice: From the Ashes of 9/11: Big Bad John, 35 Nat’l L. J. 4 (Jan. 25, 2003) (reporting that Attorney General Ashcroft assured lawmakers that “blood would be on their hands” if another terrorist attack occurred before they passed the version of the Patriot Act he promoted).

86 At the recent ACLU membership conference, several speakers warned that another terrorist attack could lead us into a police state.

87 For example, the Department of Justice has dismissed concerns about its new Patriot Act powers to acquire library records and the like by arguing that it does not use them. Cf. See Steve Jackson Games, Inc. v. United States Secret Service, 36 F.3d 457 (3d. Cir. 457) (1994) (suggesting that possibility of key-word searching obviates the need to minimize acquisition of stored contents).

88 For a fascinating history of law enforcement’s early abuse of surveillance, see Dash, supra note 47. An interesting exception to this general rule can be found in the Attorney General’s opposition to the Wiretap Act on the grounds that law enforcement did not need surveillance powers. See Lapidus, supra note 51, at 13, 40.

89 See, e.g., Antiterrorism Hearings, supra note 32, at 8 (“I appreciate the opportunity to testify today about the Justice Department’s ongoing efforts to protect the lives of innocent Americans, and our commitment to doing so within the limits of the Fourth Amendment’s guarantee of individual privacy.”) (statement of Viet D. Dinh, Assistant Attorney General, Justice Department).

90 For example, consider the five-part rubric recommended by one expert to assess security proposals. See Schneier, supra note 44. That rubric could be specified in a statute, to be implemented by a court. Or, it could develop through litigation, and then be codified by statute.

91 I attempted to that in a case study concerning online defamation. See Freiwald, supra note 40.

92 In 1968, Congress was spurred to enact the Wiretap Act by the Supreme Court’s finding of constitutional protection for telephone conversations in two cases the prior year. See Katz v. United States, 389 U.S. 347 (1967); Berger v. United States, 388 U.S. 41 (1967) (finding New York eavesdropping statute to violate the Constitution).

93 Book reviewers assumed that Professor Komesar meant judges to be the “meta-institutional” decision makers. See, e.g., Edward L. Rubin, Institutional Analysis and the New Legal Process, 1995 Wis. L. Rev. 463, 476-77 (reviewing Neil K. Komesar, Imperfect Alternatives (1994)); Thomas W. Merrill, Institutional Choice and Political Faith, 22 LAW & SOC. INQUIRY 959, 992 (1997). Language in the most recent book supports this. See LAW’s LIMITS, supra note 41, at 11 (“In one form or another, judges are asked to decide who will decide basic substantive decisions.”). But as Professor Komesar recognizes, judges are substantially overburdened. Moreover, judges may not have all the tools they need to be the meta-choosers. See Imperfect Alternatives, supra note 39, at 192-95.

94 See, e.g., In re Order Authoring Installation of a Pen Register, 846 F. Supp. 1555, 1561 (M. Fla. 1994) (“Absent recognized constitutional considerations, the court should create and implement by decisional law no more extensive restrictions on the use of pen registers than Congress has provided explicitly in the governing statute after consideration in gross of all the pertinent factors, not the least of which is privacy.”); But see id. at 1564 (Exhibit A) (Order of Magistrate Wilson ) (noting that the pen register provisions “provide no protection to the members of the public from abuse of pen registers and leave them worse off than they were under the Pre-Act practice”).

95 See, e.g., United States v. Councilman, 2004 U.S. App. LEXIS 13352, at *18 (1st Cir.) (“[W]hile much of the [ECPA’s] protection may have been eviscerated by the realities of modern technology …. [I]t is not the province of this court to graft meaning onto the statute where Congress has spoken plainly.”); Konop v. Hawaiian Airlines, 302 F.3d 868, 874 (9th Cir. 2002), cert. den., 537 U.S. 1193 (2003) ([U]ntil Congress brings the laws in line with modern technology, protection of the Internet and websites such as Konop’s will remain a confusing and uncertain area of the law.”).

96 Of course there are other good reasons besides impracticability to worry about increasing judicial power.

97 See, e.g., United States Telecom Association v. FCC, 227 F.3d 450 (2000) (discussing how Congress meant to retain the status quo regarding the online surveillance rules in 1994 legislation).

98 Perhaps we should defer to Congress’ balancing when it is the preferred institution, but that seems impractical as well, particularly when it is likely that Congress will never get it just right.

Share with your friends:
1   2   3

The database is protected by copyright ©essaydocs.org 2020
send message

    Main page