Professor Wendy Seltzer, email wendy.seltzer@brooklaw.edu
Privacy from GovernmentOctober 26, 2006
Optional further reading
|
|
The Fourth Amendment anchors our right to privacy from government intrusion:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
The meaning of that guarantee has varied with the state of technology, however.Courts must translate the Constitution's text in application to "search" technology unknown to the Framers.Further, as the technology evolves, so do our understandings of it and the "reasonable expectations of privacy" in technologically mediated activities.
The Supreme Court's decisions in Katz v. United States, Smith v. Maryland, and Kyllo v. United States illustrate some of the back-and-forth tugs of technology and privacy, as well as giving us analytical tools to apply to newer Internet technologies. Along with the sweeping pronouncements of constitutional interpretation, we also face more specific questions of statutory application. Even the most recently updated statutes will rarely be a perfect fit with the technology to which they apply, while older law can look like a square peg to a round hole.
As we saw last week, the electronic age also features a great deal of information collection by private parties. Those collections can be attractive to government, especially since Smith v. Maryland indicated that people have no Fourth Amendment reasonable expectation of privacy in information they give to a third party. Thus the government can buy information from private databanks, such as Axciom and ChoicePoint, or request it from ISPs and telephone companies. In December 2005, the New York Times first reported that the adminstration, through the National Security Agency (NSA), was eavesdropping on United States telephone calls. Several groups filed lawsuits challenging this surveillance, some suing the government, others, like EFF, suing the telephone companies for their assistance. Although the government has moved to have the suits dismissed on the "state secrets doctrine," arguing that the lawsuits cannot proceed without revealing sensitive security information, the courts have so far refused to dismiss the suits. Read the amended complaint in Hepting v. AT&T to understand how private and government surveillance can mix, and assess the likely success of the arguments against it.
The Electronic Communications Privacy Act of 1986 ("ECPA"), Pub. L. No. 99-508, 100 Stat. 1848 (1986), comprised three titles. Title I amended the 1968 federal wiretap statute to cover electronic communications. Title II of ECPA created a new chapter of the criminal code dealing with access to stored communications and transaction records, commonly known as the "Stored Communications Act" or "SCA." Title III of the ECPA covers pen registers and trap/trace devices.
ECPA, Title I, 18 U.S.C. §§ 2510 et seq. ("Wiretap Act") makes it unlawful to listen to or observe the contents of a private communication without the permission of at least one party to the communication and regulates real-time electronic surveillance in federal criminal investigations. 18 U.S.C. §§ 2510-2522 was first passed as Title III of the Omnibus Crime Control and Safe Streets Act of 1968 and is generally (if confusingly) known as "Title III".
ECPA Title II, 18 U.S.C. §§ 2701 et seq. ("Stored Communications Act") generally prohibits the disclosure of the content of electronically stored communications. The Act does not prohibit disclosure of user information to non-government entities.
The Stored Communications Act also strictly limits the information that an electronic communication service may provide to the government. A government entity generally must provide a subpoena, warrant or court order to obtain information about a user that is stored by the communication service provider. The USA PATRIOT Act, see below, amended these provisions to permit disclosure of such information to the government if the service provider has a good faith belief that there is an imminent danger of death or serious physical injury.
The Pen Registers and Trap and Trace Devices chapter of Title 18 ("the Pen/Trap statute"), 18 U.S.C. §§ 3121-3127 governs pen registers and trap and trace devices. A "pen register" is a device that records the numbers dialed for outgoing calls made from the target phone. A trap and trace device captures the numbers of calls made to the target phone.
The Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030 , provides a cause of action against one who, inter alia, "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer if the conduct involved an interstate or foreign communication." 18 U.S.C. § 1030(a)(2)(C), (g).
The civil remedy extends to "[a]ny person who suffers damage or loss by reason of a violation of this section." 18 U.S.C. § 1030(g) (emphasis added). The Homeland Security Act, see below, increased the penalties and prison terms for violations of the CFAA.
Uniting and Strengthening
See also EFF analysis of the provisions of the USA PATRIOT Act.: <http://www.eff.org/Privacy/Surveillance/Terrorism/20011031_eff_usa_patriot_analysis.php>
The Homeland Security Act of 2002, PL 107-296. Provisions of Section 896 and Section 225 ("The Cyber Security Enhancement Act") of the Homeland Security Act increase prison time and penalties for violations of the CFAA, prohibit Internet advertising of illegal surveillance devices, and allow law enforcement agencies to make pen register/trap and trace installations without a court order in the case of "national security interests" or an attack on a protected computer as defined by the CFAA.
The Homeland Security Act Section 225 expanded the power of PATRIOT Section 212 by 1) lowering the relevant standard from "reasonable belief" of a life-threatening emergency to a "good faith belief," 2) allowing communications providers to use the emergency exception to disclose your data to any government entity, not just law enforcement, and 3) dropping the requirement that the threat to life or limb be immediate.
The flip side of privacy concerns is the government worry that the Internet enables criminals to communicate undetected, reducing the effectiveness of offline wiretaps and physical searches.In response, Congress passed the Communications Assistance to Law Enforcement Act ("CALEA") in 1994.CALEA defines the obligation of telecommunications carriers to assist law enforcement in executing electronic surveillance pursuant to court order or other lawful authorization.As the AskCALEA FAQ describes:
Who must be CALEA-compliant?
All telecommunications carriers as defined by Section 102(8) of CALEA. Basically, this includes all entities engaged in the transmission or switching of wire or electronic communications as a common carrier for hire.
What is "call-identifying information?"
Section 102(2) of CALEA defines call-identifying information as "dialing or signaling information that identifies the origin, direction, destination, or termination of each communication generated or received by a subscriber by means of any equipment, facility, or service of a telecommunications carrier."
Defined in 18 U.S.C. 2510(8) it is an intercept "when used with respect to any wire or electronic communications, includes any information concerning the substance, purport, or meaning of that communications."
What is a "safe harbor" under CALEA?
Section 107(a)(2) of CALEA contains a "safe harbor" provision, stating that "[a] telecommunications carrier shall be found to be in compliance with the assistance capability requirements under Section 103, and a manufacturer of telecommunications transmission or switching equipment or a provider of telecommunications support services shall be found to be in compliance with Section 106 if the carrier, manufacturer, or support service provider is in compliance with publicly available technical requirements or standards adopted by an industry association or standard-setting organization, or by the FCC under subsection (b), to meet the requirements of Section 103."
...What are the Punch List technical requirements?
On
1) Provide the content of
subject-initiated conference calls supported by the subject's service (including
the call content of parties on hold).
2) Identify the active parties of a multiparty call.
3) Provide access to all dialing and signaling information available from the
subject including a subject's use of features (such as the use of flash-hook
and other feature keys).
4) Notify the law enforcement agency when a subject's service sends a tone or
other network message to the subject or associate (e.g., notification that a
line is ringing or busy).
5) Provide timing information to correlate call-identifying information with
the call content of a communications interception.
6) Provide digits dialed by a subject after the initial call
"cut-through" is completed to another car
Much current debate centers on the application of CALEA tappability requirements to non-traditional telecommunications carriers such as Voice over Internet Protocol (VoIP) providers whose services may be used to substitute for telephone service. What does it mean to require "VOIP providers" such as Vonage (or Brooklyn Law School) to comply with CALEA?
MR. JUSTICE STEWART delivered the opinion of the Court.
The petitioner was convicted in the
District Court for the Southern District of California under an eight-count
indictment charging him with transmitting wagering information by telephone
from
…The Government stresses the fact that the telephone booth from which the petitioner made his calls was constructed partly of glass, so that he was as visible after he entered it as he would have been if he had remained outside. But what he sought to exclude when he entered the booth was not the intruding eye - it was the uninvited ear. He did not shed his right to do so simply because he made his calls from a place where he might be seen. No less than an individual in a business office, in a friend's apartment, or in a taxicab, a person in a telephone booth may rely upon the protection of the Fourth Amendment. One who occupies it, shuts the door behind him, and pays the toll that permits him to place a call is surely entitled to assume that the words he utters into the mouthpiece will not be broadcast to the world. To read the Constitution more narrowly is to ignore the vital role that the public telephone has come to play in private communication.
The Government contends, however, that the activities of its agents in this case should not be tested by Fourth Amendment requirements, for the surveillance technique they employed involved no physical penetration of the telephone booth from which the petitioner placed his calls. It is true that the absence of such penetration was at one time thought to foreclose further Fourth Amendment inquiry, Olmstead v. United States, 277 U.S. 438, 457 , 464, 466; Goldman v. United States, 316 U.S. 129, 134 -136, for that Amendment was thought to limit only searches and seizures of tangible property. But "[t]he premise that property interests control the right of the Government to search and seize has been discredited." Warden v. Hayden, 387 U.S. 294, 304 . Thus, although a closely divided Court supposed in Olmstead that surveillance without any trespass and without the seizure of any material object fell outside the ambit of the Constitution, we have since departed from the narrow view on which that decision rested…. Once this much is acknowledged, and once it is recognized that the Fourth Amendment protects people - and not simply "areas" - against unreasonable searches and seizures, it becomes clear that the reach of that Amendment cannot turn upon the presence or absence of a physical intrusion into any given enclosure.
We conclude that the underpinnings of Olmstead and Goldman have been so eroded by our subsequent decisions that the "trespass" doctrine there enunciated can no longer be regarded as controlling. The Government's activities in electronically listening to and recording the petitioner's words violated the privacy upon which he justifiably relied while using the telephone booth and thus constituted a "search and seizure" within the meaning of the Fourth Amendment. The fact that the electronic device employed to achieve that end did not happen to penetrate the wall of the booth can have no constitutional significance.
...Wherever a man may be, he is entitled to know that he will remain free from unreasonable searches and seizures. The government agents here ignored "the procedure of antecedent justification . . . that is central to the Fourth Amendment," a procedure that we hold to be a constitutional precondition of the kind of electronic surveillance involved in this case. Because the surveillance here failed to meet that condition, and because it led to the petitioner's conviction, the judgment must be reversed.
MR. JUSTICE BLACKMUN delivered the opinion of the Court.
[Petitioner Smith was suspected in
a robbery. Without a warrant, police requested the telephone company to install
a pen register at its central offices to record the numbers dialed from the
telephone at Smith's home. Evidence from the pen register showed a call to the
victim's home, and Smith was tried and convicted. Smith sought to suppress "all fruits
derived from the pen register" on the ground that the police had failed to
secure a warrant prior to its installation.
The
…In determining whether a particular form of government-initiated electronic surveillance is a "search" within the meaning of the Fourth Amendment, our lodestar is Katz v. United States, 389 U.S. 347 (1967). …
Consistently with Katz, this Court uniformly has held that the application of the Fourth Amendment depends on whether the person invoking its protection can claim a "justifiable," a "reasonable," or a "legitimate expectation of privacy" that has been invaded by government action…. This inquiry, as Mr. Justice Harlan aptly noted in his
Katz concurrence, normally embraces two discrete questions. The first is whether the individual, by his conduct, has "exhibited an actual (subjective) expectation of privacy," 389 U.S., at 361 - whether, in the words of the Katz majority, the individual has shown that "he seeks to preserve [something] as private." The second question is whether the individual's subjective expectation of privacy is "one that society is prepared to recognize as `reasonable,'" - whether, in the words of the Katz majority, the individual's expectation, viewed objectively, is "justifiable" under the circumstances. …
[Petitioner claims] that, notwithstanding the absence of a trespass, the State, as did the Government in Katz, infringed a "legitimate expectation of privacy" that petitioner held. Yet a pen register differs significantly from the listening device employed in Katz, for pen registers do not acquire the contents of communications. This Court recently noted:
"Indeed, a law enforcement official could not even determine from the use of a pen register whether a communication existed. These devices do not hear sound. They disclose only the telephone numbers that have been dialed - a means of establishing communication. Neither the purport of any communication between the caller and the recipient of the call, their identities, nor whether the call was even completed is disclosed by pen registers." …
Given a pen register's limited capabilities, therefore, petitioner's argument that its installation and use constituted a "search" necessarily rests upon a claim that he had a "legitimate expectation of privacy" regarding the numbers he dialed on his phone.
This claim must be rejected. First,
we doubt that people in general entertain any actual expectation of privacy in
the numbers they dial. All telephone users realize that they must
"convey" phone numbers to the telephone company, since it is through telephone company switching equipment that their calls are
completed. All subscribers realize, moreover, that the phone company has
facilities for making permanent records of the numbers they dial, for they see
a list of their long-distance (toll) calls on their monthly bills. In fact, pen
registers and similar devices are routinely used by telephone companies
"for the purposes of checking billing operations, detecting fraud, and
preventing violations of law."
Although most people may be oblivious to a pen register's esoteric functions, they presumably have some awareness of one common use: to aid in the identification of persons making annoying or obscene calls. … Most phone books tell subscribers, on a page entitled "Consumer Information," that the company "can frequently help in identifying to the authorities the origin of unwelcome and troublesome calls."… Telephone users, in sum, typically know that they must convey numerical information to the phone company; that the phone company has facilities for recording this information; and that the phone company does in fact record this information for a variety of legitimate business purposes. Although subjective expectations cannot be scientifically gauged, it is too much to believe that telephone subscribers, under these circumstances, harbor any general expectation that the numbers they dial will remain secret.
…[E]ven if petitioner did harbor some subjective expectation
that the phone numbers he dialed would remain private, this expectation is not
"one that society is prepared to recognize as `reasonable.'" Katz v.
"The depositor takes the risk,
in revealing his affairs to another, that the information will be conveyed by
that person to the Government. . . . This Court has held repeatedly that the
Fourth Amendment does not prohibit the obtaining of information revealed to a
third party and conveyed by him to Government authorities, even if the
information is revealed on the assumption that it will be used only for a
limited purpose and the confidence placed in the third party will not be
betrayed."
Because the depositor "assumed the risk" of disclosure, the Court held that it would be unreasonable for him to expect his financial records to remain private.
This analysis dictates that petitioner can claim no legitimate expectation of privacy here. When he used his phone, petitioner voluntarily conveyed numerical information to the telephone company and "exposed" that information to its equipment in the ordinary course of business. In so doing, petitioner assumed the risk that the company would reveal to police the numbers he dialed. The switching equipment that processed those numbers is merely the modern counterpart of the operator who, in an earlier day, personally completed calls for the subscriber. Petitioner concedes that if he had placed his calls through an operator, he could claim no legitimate expectation of privacy. We are not inclined to hold that a different constitutional result is required because the telephone company has decided to automate.
…We therefore conclude that petitioner in all probability entertained no actual expectation of privacy in the phone numbers he dialed, and that, even if he did, his expectation was not "legitimate." The installation and use of a pen register, consequently, was not a "search," and no warrant was required. The judgment of the Maryland Court of Appeals is affirmed.
[ Footnote 1 ] "A pen register is a mechanical device
that records the numbers dialed on a telephone by monitoring the electrical
impulses caused when the dial on the telephone is released. It does not
overhear oral communications and does not indicate whether calls are actually
completed."
Mr. JUSTICE STEWART, with whom MR. JUSTICE BRENNAN joins, dissenting.
I am not persuaded that the numbers dialed from a private telephone fall outside the constitutional protection of the Fourth and Fourteenth Amendments.
In Katz v.
Nevertheless, the Court today says that those safeguards do not extend to the numbers dialed from a private telephone, apparently because when a caller dials a number the digits may be recorded by the telephone company for billing purposes. But that observation no more than describes the basic nature of telephone calls. A telephone call simply cannot be made without the use of telephone company property and without payment to the company for the service. The telephone conversation itself must be electronically transmitted by telephone company equipment, and may be recorded or overheard by the use of other company equipment. Yet we have squarely held that the user of even a public telephone is entitled "to assume that the words he utters into the mouthpiece will not be broadcast to the world." Katz v. United States, supra, at 352.
…The numbers dialed from a private telephone - although certainly more prosaic than the conversation itself - are not without "content." Most private telephone subscribers may have their own numbers listed in a publicly distributed directory, but I doubt there are any who would be happy to have broadcast to the world a list of the local or long distance numbers they have called. This is not because such a list might in some sense be incriminating, but because it easily could reveal the identities of the persons and the places called, and thus reveal the most intimate details of a person's life.
Justice SCALIA.
[Petitioner Kyllo sought the exclusion of marijuana plants discovered when thermal imaging technology showed one side of his house to be significantly warmer than the other, consistent with the use of heat lamps to grow marijuana.]
… It would be foolish to contend that the degree of privacy secured to citizens by the Fourth Amendment has been entirely unaffected by the advance of technology. For example, as the cases discussed above make clear, the technology enabling human flight has exposed to public view (and hence, we have said, to official observation) uncovered portions of the house and its curtilage that once were private. See Ciraolo, supra, at 215. The question we confront today is what limits there are upon this power of technology to shrink the realm of guaranteed privacy.
The Katz test--whether the individual has an expectation of privacy that society is prepared to recognize as reasonable--has often been criticized as circular, and hence subjective and unpredictable. See 1 W. LaFave, Search and Seizure §2.1(d), pp. 393-394 (3d ed. 1996); Posner, The Uncertain Protection of Privacy by the Supreme Court, 1979 S. Ct. Rev. 173, 188; Carter, supra, at 97 (Scalia, J., concurring). But see Rakas, supra, at 143-144, n. 12. While it may be difficult to refine Katz when the search of areas such as telephone booths, automobiles, or even the curtilage and uncovered portions of residences are at issue, in the case of the search of the interior of homes--the prototypical and hence most commonly litigated area of protected privacy--there is a ready criterion, with roots deep in the common law, of the minimal expectation of privacy that exists, and that is acknowledged to be reasonable. To withdraw protection of this minimum expectation would be to permit police technology to erode the privacy guaranteed by the Fourth Amendment. We think that obtaining by sense-enhancing technology any information regarding the interior of the home that could not otherwise have been obtained without physical "intrusion into a constitutionally protected area," Silverman, 365 U. S., at 512, constitutes a search--at least where (as here) the technology in question is not in general public use. This assures preservation of that degree of privacy against government that existed when the Fourth Amendment was adopted. On the basis of this criterion, the information obtained by the thermal imager in this case was the product of a search.
The Government maintains, however, that the thermal imaging must be upheld because it detected "only heat radiating from the external surface of the house."… But just as a thermal imager captures only heat emanating from a house, so also a powerful directional microphone picks up only sound emanating from a house-and a satellite capable of scanning from many miles away would pick up only visible light emanating from a house. We rejected such a mechanical interpretation of the Fourth Amendment in Katz, where the eavesdropping device picked up only sound waves that reached the exterior of the phone booth. Reversing that approach would leave the homeowner at the mercy of advancing technology--including imaging technology that could discern all human activity in the home. While the technology used in the present case was relatively crude, the rule we adopt must take account of more sophisticated systems that are already in use or in development. …
…Limiting the prohibition of thermal imaging to "intimate details" would not only be wrong in principle; it would be impractical in application, failing to provide "a workable accommodation between the needs of law enforcement and the interests protected by the Fourth Amendment," Oliver v. United States, 466 U. S. 170, 181 (1984). To begin with, there is no necessary connection between the sophistication of the surveillance equipment and the "intimacy" of the details that it observes--which means that one cannot say (and the police cannot be assured) that use of the relatively crude equipment at issue here will always be lawful. The Agema Thermovision 210 might disclose, for example, at what hour each night the lady of the house takes her daily sauna and bath--a detail that many would consider "intimate"; and a much more sophisticated system might detect nothing more intimate than the fact that someone left a closet light on. We could not, in other words, develop a rule approving only that through-the-wall surveillance which identifies objects no smaller than 36 by 36 inches, but would have to develop a jurisprudence specifying which home activities are "intimate" and which are not. And even when (if ever) that jurisprudence were fully developed, no police officer would be able to know in advance whether his through-the-wall surveillance picks up "intimate" details--and thus would be unable to know in advance whether it is constitutional.
…We have said that the Fourth Amendment draws "a firm line at the entrance to the house," Payton, 445 U. S., at 590. That line, we think, must be not only firm but also bright--which requires clear specification of those methods of surveillance that require a warrant. While it is certainly possible to conclude from the videotape of the thermal imaging that occurred in this case that no "significant" compromise of the homeowner's privacy has occurred, we must take the long view, from the original meaning of the Fourth Amendment forward.
"The Fourth Amendment is to be
construed in the light of what was deemed an unreasonable search and seizure
when it was adopted, and in a manner which will conserve public interests as
well as the interests and rights of individual citizens." Carroll v.
Where, as here, the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a "search" and is presumptively unreasonable without a warrant.
Since we hold the Thermovision
imaging to have been an unlawful search, it will remain for the District Court
to determine whether, without the evidence it provided, the search warrant
issued in this case was supported by probable cause--and if not, whether there
is any other basis for supporting admission of the evidence that the search
pursuant to the warrant produced.