September 18, 2000

Re: H.R. 5018, The Electronic Communications Privacy Act of 2000

Dear Reps. Hyde and Conyers:

On September 19 or 20, the House Judiciary Committee has scheduled a mark up of the Electronic Communications Privacy Act of 2000, H.R. 5018. The bill as reported by the Constitution Subcommittee would make several modest, but important, improvements in the privacy of electronic and voice communications as against intrusion by the federal government. One theme of the bill is to increase judicial supervision of electronic surveillance, a goal we strongly support. We urge you to adopt some modest improvements to the legislation to further its goals, and to reject proposals from the Administration that would severely erode the privacy of electronic and voice communications, and undermine the goals of the legislation. Should the Committee adopt many of the changes proposed by the Administration the ACLU would oppose the bill as an attack on privacy.

The Committee considers this legislation at the same time law enforcement has dramatically increased electronic surveillance. While the Department of Justice has often said that the Internet has posed new challenges to law enforcement, in reality, it has been a boon to surveillance. Last year, state and federal law enforcement obtained more orders for electronic surveillance than in any previous year.¹ The number of federal intercept applications almost doubled between 1989 and 1999, and in 1995 and 1996, for the first time, the federal government obtained more electronic surveillance orders than all of the states combined. Each time an electronic surveillance order is executed, approximately 195 persons' communications are intercepted. Precious few are ever indicted, much less convicted. In each of the last few years, nearly two million innocent communications have been intercepted in law enforcement electronic surveillance. This is a tremendous sacrifice of personal privacy.

The bill the Constitution Subcommittee has reported does not directly address two of the most pressing privacy issues related to electronic communications: (i) law enforcement use of the "Carnivore" eavesdropping device; and (ii) the inadequate standards for law enforcement access to stored electronic communications.² Instead, the bill would marginally increase the privacy of records about the telephone numbers dialed to a person's phone (obtained by law enforcement with a "trap and trace" device) and dialed by the phone (obtained with a "pen register" device). An amendment adopted by the Subcommittee, which we support, adds important new privacy protections for the location of a cellular phone user when the phone is turned on. Finally, we support the provisions of H.R. 5018 that extend some of the reporting requirements for interceptions of communications in current law to access to stored electronic communications, and that would extend the statutory exclusionary rule for interception of voice communications to electronic communications, such as e-mail. Each of these provisions is summarized below.

Pen Register and Trap and Trace Orders. We urge you to support the provision of H.R. 5018 that would require "reasonable suspicion" of crime for pen register and trap and trace orders. Most people believe that the phone numbers of the people who call them, and the phone numbers that they dial on their phones, are private. We share this view, and so do many members of the Committee. The Supreme Court, however, disagreed and determined in Maryland v. Smith, 442 U.S. 735 (1979) that a person has no "reasonable expectation of privacy" in the numbers dialed, and that as a result, the protections of the Fourth Amendment -- including the probable cause standard -- do not apply to law enforcement access to this information. The Court reasoned that since this information did not include the contents of a communication, was generated by phone companies as part of the normal course of their business, does not disclose the identity of the caller or the of the recipient or even whether the call was completed, the probable cause requirement of the Fourth Amendment does not apply.

Federal law allows law enforcement access to this information under an extremely low standard. Under 18 U.S.C. 3123(a), a judge must grant access to this information any time an attorney for the Government or a state law enforcement officer certifies "that the information likely to be obtained by [installation of a pen register or trap and trace device] is relevant to an ongoing criminal investigation," (emphasis supplied).³ Even if the judge disagrees, and finds that only irrelevant information would be generated, or that no investigation is pending, he must issue the order in an ex parte proceeding upon certification by the Government.

H.R. 5018 would raise this standard slightly. Law enforcement would obtain access to the numbers dialed if the court finds that "specific and articulable facts reasonably indicate that a crime has been, is being, or will be committed, and information likely to be obtained by such installation is relevant to the investigation of that crime." This standard is roughly the level of suspicion that the Supreme Court required in Terry v. Ohio, 392 U.S.1 (1968) that would justify a law enforcement stop and demand for ID.⁴

The Department of Justice should have no objection to this standard because its own guidelines prohibit commencement of a full criminal investigation unless the reasonable indication standard is met.⁵ Even under current law, if there is no pending criminal investigation, there can be no certification that there is such an investigation, and the minimal prerequisite for a pen register or trap and trace order would not be met. Indeed, the recent revelation by the Department of Justice that it currently uses pen registers and trap and trace devices in "preliminary inquiries" -- which are commenced under its guidelines without any "reasonable indication of criminality," is further evidence of the need raise the statutory standard for access to this information.⁶ Arguably, the reasonable indication standard, as supported by specific and articulable facts, should already be in use by the DOJ for pen register and trap and trace orders.

In the wiretapping legislation it conveyed to Congress in July⁷,the Clinton Administration proposed leaving the statutory standard (mere relevance to an ongoing investigation) unchanged, but allowing the judge to determine whether the standard was met. We regard the mere relevance standard as entirely insufficient. In an ex parte proceeding when law enforcement certifies that it has commenced an investigation, there will likely be no evidence to the contrary for the judge to consider. We urge you to reject any attempt to lower the "reasonable suspicion" standard, or water down the requirement that specific and articulable facts support such a suspicion.

Access to Location Information. We urge you to support the provision of H.R. 5018 that would require "probable cause" of crime for access to location information. Because cellular telephones operate by communicating with strategically located towers, the provider of cellular telephone services knows the approximate location of the cell phone user when the telephone is turned on. Location information is becoming increasingly precise, and some cellular telephone providers are expected to begin marketing that information to users in the near future. Under current law, the provider of cellular telephone services is prohibited from disseminating that information, except in an emergency, or with the express consent of the user. 47 U.S.C.A. 222 (2000).

Though it has no explicit statutory authority to do so, the DOJ currently obtains "real time" information about the location of a cellular telephone user under 18 U.S.C. 2703(d). That section provides that a court order for disclosure of records pertaining to a subscriber to an electronic communications service or a remote computing service. Such records may be obtained with a court order based on a finding of "specific and articulable facts showing that there are reasonable grounds to believe that the … records or other information sought, are relevant and material to an ongoing criminal investigation." This is essentially the standard set forth in H.R. 5018 for pen registers and trap and trace devices. The DOJ asks the Committee to write this low standard into law.

As a result of an amendment offered by Rep. Bob Barr (R-GA) and approved by voice vote at the Subcommittee, H.R. 5018 would correctly raise the level of protection for location information to probable cause. The amendment was based on a provision of the "E-Rights" bill, S. 854, Senator Leahy (D-VT) introduced on April 21, 1999. Under H.R. 5018, a provider of cellular telephone services would be required to provide location information to law enforcement if the Government obtained an order issued upon a finding that there is probable cause to believe that:

1. an individual is committing, has committed, or is about to commit, a felony offense; and
2. the information concerns the location of the suspect or the victim of the offense.

Upon the request of Department of Justice, a requirement that the cell phone be used in connection with the crime was dropped.

The bill provides for an exception from the court order requirement allowing disclosure of location information without a court order to law enforcement, hospitals, fire departments and others when the user calls for emergency services. It provides for another exception from the court order requirement to inform a user's legal guardian or immediate family or the user's location in an emergency that involves risk of death or serious bodily harm. In addition, no court order would be required if the user or subscriber had expressly consented to disclosure of location information. These exceptions are based on 47 U.S.C. Section 222.

We believe that a person has a reasonable expectation of privacy in the location information generated by their cellular telephone, and that as a result, a probable cause standard is warranted. Most people do not believe that their cellular telephones should be converted into "tracking devices." They buy the phones with no idea that their location might be tracked whenever the phone is on. While a person's location might be physically observed by law enforcement acting without probable cause of crime, we submit that the surreptitious monitoring of a person's location, by accessing information provided by their cellular telephone provider, is different altogether, and warrants a higher level of protection. We urge you to support the probable cause standard for location information, and to oppose any attempt to reduce the standard.

Exclusionary Rule and Electronic Communications. We urge you to support the provision of H.R. 5018 that would extend the statutory exclusionary rule in Title III to electronic communications. To encourage law enforcement compliance with the procedures Congress set forth in Title III for interception of voice communications, Congress included a statutory exclusionary rule. Under 18 U.S.C. 2515, an intercepted voice communication can be suppressed at trial, in grand jury proceedings and in administrative proceedings if the communication was intercepted illegally. The statutory exclusionary rule supplements the exclusionary rule the courts have created to encourage law enforcement compliance with the Fourth Amendment. The statutory rule is more protective because it applies in grand jury and administrative proceedings and because it covers violations of Title III, not just constitutional violations.

The courts have read a "good faith" exception into the constitutional exclusionary rule.⁸ While no formal "good faith" exception applies to the statutory exclusionary rule, the Supreme Court has ruled that evidence need not be suppressed under the statutory exclusionary rule if the violation of law was minor or technical.⁹

Only a relative handful of communications are excluded from evidence based on the constitutional or statutory exclusionary rules, belying any claim that the statutory exclusionary rule is a "boon" to criminals. Instead, its effect has been to encourage compliance with Title III.

H.R. 5018 appropriately would extend the statutory exclusionary rule to electronic communications such as e-mail, while they are in transit. This modest improvement would encourage compliance with the Title III not just as it applies to interception of voice communications, but also as it applies to interception of electronic communications. The Administration has proposed a similar expansion of the statutory exclusionary rule.

H.R. 5018 would also extend the statutory exclusionary rule to stored electronic communications. Though the Administration opposes this provision, we believe it important and we urge you to retain it. If the statutory exclusionary rule were extended only to electronic communications in transit, a rogue or negligent agent who sought access to the contents of such a communication in violation of the law, could wait an instant until the e-mail message was stored with an ISP, and avoid the statutory exclusionary rule altogether by seeking access then. Moreover, because law enforcement takes the position that there is no reasonable expectation of privacy in the contents of communications in storage with a third party such as an ISP, if the Administration's position is adopted, then no exclusionary rule at all will apply to stored communications. As a result, law enforcement would have less incentive to comply with the law and with the Constitution.¹⁰

Reporting Disclosure of Stored Communications. We urge you to support and strengthen the reporting requirements in H.R. 5018, and to oppose any attempt to water them down further. To promote compliance with the law, and to keep Congress and public informed to some extent of the nature, prevalence, effectiveness, and costs in terms of privacy of electronic surveillance, Congress required in Title III detailed reporting of the interception of voice communications and electronic communications. Under 18 U.S.C. 2519, law enforcement is required to report:

1. the fact that an intercept order was applied for;
2. the kind of order sought;
3. whether it was granted, denied, or modified;
4. the period of interceptions authorized and the number and duration of extensions;
5. the offense specified in the order;
6. the identity of the law enforcement official applying for the order;
7. the nature of the facilities form which the communications are to be intercepted;
8. a general description of the interceptions made under the order, including the approximate nature of and frequency of incriminating and innocent conversations, the number of persons whose communications are intercepted, and the costs of doing so;
9. the number of resulting arrests;
10. the number of resulting trials;
11. the number of motions to suppress evidence (on account of illegal or unconstitutional eavesdropping) and the number of such motions granted or denied; and
12. the number of convictions, and the offenses for which convictions were obtained, resulting from the eavesdropping.

H.R. 5018 would have extended these reporting requirements to disclosure to law enforcement of stored electronic communications, such as e-mail. Such reporting is desirable because it would give some indication of the prevalence of such disclosure, and whether law enforcement was abusing its authority to seek such disclosure. To accommodate the DOJ, the reporting requirements were substantially scaled back at the Subcommittee mark up. As reported, H.R. 5018 does not require reporting of the number of persons whose communications were disclosed, the costs of seeking such disclosures, the number of trials, arrests and convictions resulting from such disclosures, and the number of convictions resulting from such disclosures. As a result, the reports covering disclosure of stored electronic communications would omit much of the information that makes such reporting useful.

We urge the Committee to amend H.R. 5018 to require reporting of the numbers of convictions and numbers of suppression motions granted with respect to stored communications. Because H.R. 5018 would extend the statutory exclusionary rule to stored communications, it makes sense for Congress to create a reporting requirement that would allow it to assess the impact of that extension. Moreover, because grants of motions to suppress might give Congress and the public some indication of the abuse of law enforcement powers under the statute, it would also be wise to require reporting that would allow assessment of this information. Finally, reporting of convictions would allow Congress and the public to assess the value in law enforcement terms of disclosure of stored electronic communications, the efficiency of such disclosures in generating convictions. We urge you to oppose any effort to further restrict the reporting requirements that H.R. 5018 would impose.

The Administration is seeking a laundry list of amendments to H.R. 5018, most of which would expand electronic surveillance at the expense of privacy. Many of the amendments it seeks would undermine a central theme of the bill: increased judicial supervision of electronic surveillance. Some of the proposed amendments are drawn from the Enhancement of Privacy and Public Safety in Cyberspace legislation the Administration proposed in July. In presenting these ideas, the Administration cited Brandeis, but proposed Hoover. Other amendments the Administration seeks were presented in verbal form only at a meeting on the Friday before mark-up. We urge you to protect privacy by rejecting all of these proposals, except the proposal to limit certain mandatory minimums in current law. The proposed amendments are summarized below.

Nationwide Pen Register and Trap and Trace Orders. We urge you to oppose the Administration’s proposal for nationwide pen register and trap and trace orders. This proposal would gut the most important provision in H.R. 5018, and if it is added to H.R. 5018 as proposed by the Administration, ACLU will oppose the entire bill. What the Administration seeks in reality is not nationwide service, but the equivalent of a blank warrant in which the places to be searched are filled in later, by law enforcement, without judicial supervision. This flies in the face of the specificity requirement of the Fourth Amendment. In the physical world, it would be the equivalent of a warrant giving law enforcement the power to search any building for the thing specified in the order, any time law enforcement asserted without judicial supervision that the thing it seeks might be in this or that building. Instead, law enforcement is required to get a new warrant to search the next building, and a judge decides whether there is sufficient evidence to support the warrant application. This model should be applied.

Under current law, a court is empowered to issue a pen register or trap and trace order only within the jurisdiction of the court, and only to obtain numbers dialed. Though it has no statutory authority to do so, DOJ applies the pen register statute to obtain information about electronic communications such as information about who has e-mailed a particular person, and to whom he has sent e-mail communications. DOJ argues that when a person hacks into a computer, it is often necessary to trace back the electronic communication, using the pen register statute, through various jumps from computer to computer, and through different judicial jurisdictions, to the source of the communication. As a result, it needs a new pen register order from a new judge each time the communication is traced back to a new judicial jurisdiction. To get the order, it must work through a new prosecutorial office in the new jurisdiction.

The answer to this problem should not compromise privacy interests. Even a statutory scheme we have considered, in which a judge would issue orders that could be served nationwide but would in each case specify the name of the ISP upon which the order could be served, is not sufficient. Though this model would provide more judicial oversight than the Administration’s proposal, it would be impractical for ISPs and would upset a delicate balance between law enforcement and privacy interests that is now in the statue. For example, an ISP in California might be served with a pen register or trap and trace order issued by a judge or a magistrate in New York. If the order is overbroad, unclear, or not technically feasible to execute, or if law enforcement misinterprets the order and seeks access to content, the ISP would have to travel across the continent to challenge the order or law enforcement’s interpretation of the order. This would not be practical for small ISP’s. It might influence some to rely on the safe harbor in section 3124(d), and provide content information to which law enforcement is not entitled.

Use of "Technology Neutral" Language. The Administration also seeks an amendment that would explicitly extend the pen register statute to electronic communications, and may extend it to the contents of some electronic communications. This amendment is ill advised. First, it is not at all clear that the pen register statute, which allows for disclosure to law enforcement based on a showing of less than probable cause, is appropriate for electronic communications such as e-mail addresses. They can be far more revealing than "numbers dialed." For example, an e-mail address often contains a person's name and the name of the person's employer. In contrast, one reason the Court in Maryland v. Smith determined that numbers dialed do not have Fourth Amendment protection is that they do not reveal the identity of the person placing the call. The Smith court also relied upon the fact that numbers dialed do not indicate whether the call was completed; information about electronic communications that the Administration seeks under a pen register order, in contrast, provides such information. Finally, the formulation proposed by the Administration, "dialing, routing, addressing and signaling" information may be interpreted to cover Internet addresses ("http://" information). Information about the pages on a web site that a person visits should be afforded full Fourth Amendment protection, not the limited protections of the pen register statute. As this is an extremely complex area, we urge the Committee to consider this proposal next year.

Expanding Access to Pen Register Information without a prior court order. We urge you to oppose the Administration’s proposal to create new "emergency" exceptions to the requirement for a prior court order authorizing pen register and trap and trace devices. Currently, law enforcement is entitled to place an "emergency" pen register or trap and trace device in connection with a criminal investigation whenever there is an emergency that involves an immediate danger of serious bodily injury to a person or conspiratorial activities characteristic of organized crime. The law requires that law enforcement apply for an order authorizing the pen register or trap and trace device.

The Administration has proposed two broad, additional exceptions to the requirement that law enforcement obtain a court order before it places a pen register or trap and trace device. It seeks an exception to the requirement of a prior court order when there is an immediate threat to a national security interest and when there is an attack on a computer.

We urge you to reject both, and to adopt the position that an emergency occurs when there is an immediate danger of serious bodily injury to a person. Law enforcement can already quickly obtain an order authorizing a pen register or trap and trace device. The statute requires that the application be in writing and made under oath, but this can be done quickly. The national security exception is overly broad because the term "national security" is not narrowly defined. For example, many of the activities associated with the Watergate scandal were alleged to be necessary to protect "national security." Just a few months ago, this Committee conducted a hearing on H.R. 2121, the Secret Evidence Repeal Act, at which the meaning of the term was discussed and left unresolved. Moreover, there is already a broad authorization for an emergency pen register or trap and trace order in foreign intelligence investigations to obtain foreign intelligence information, or information concerning international terrorism (50 U.S.C. 1843). The proposed emergency exception for computer hacking relates to a property crime, and if adopted, would represent the first step down the slippery slope of creating new exceptions from the prior court order requirement for other property crimes.

Amendments To the Computer Fraud Statute. The Administration has also proposed a series of amendments to 18 U.S.C. 1030, the computer fraud statute, which we urge you to oppose. Though it is not possible to discuss all of them here, we highlight two. The Administration would allow civil asset forfeiture of real or personal property used in connection with an offense under 18 U.S.C. Section 1030. As a result, if a child uses the family computer to commit an offense under Section 1030, both the computer, and the family house, could be made subject to forfeiture. The amendment would also penalize adults for incidents in which they were adjudicated delinquent as children. Juvenile adjudications often involve no trial, no counsel for the accused, and no adversarial process. Children are often told that the adjudication will be kept secret, and this encourages them to admit responsibility. As a result, it would be unfair to regard such juvenile adjudications as "convictions" under Section 1030, with the attendant increase in penalties, as the Administration has proposed.

CONCLUSION

The Committee has an opportunity to report a bill that would enhance privacy. We urge you to do that, and to reject Administration proposals that would gut the privacy protections in the bill, and result in more surveillance of innocent communications.

Sincerely,

Laura W. Murphy, Director
Gregory T. Nojeim, Legislative Counsel

cc: Members of the House Judiciary Committee

Endnotes:

1). 1999 Wiretap Report, published annually by the Administrative Office of the United States Courts. Unless otherwise indicated, the other statistical information in this paragraph is gleaned from that annual report.

2). Each of these issues is explored in testimony ACLU submitted this year to the Subcommittee on the Constitution. That testimony is available on our website, http://www.aclu.org/.

3). The crime under investigation need not be a felony.

4). The Terry court also allows the officer to conduct a limited pat down for weapons, but only to ensure officer safety -- a circumstance inapplicable to the electronic surveillance in this context.

5). Section II(C)(1) of The Attorney General's Guidelines on General Crimes, Racketeering Enterprise and Domestic Security/Terrorism Investigations provides in relevant part: "A general crimes investigation may be initiated by the FBI when facts or circumstances reasonably indicate that a federal crime has been, is being, or will be committed."

6).Under Section II(B)(1) of the Attorney General Guidelines, a preliminary inquiry of up to 90 days (renewable indefinitely) can be commenced when "there is not yet a 'reasonable indication' of criminal activities," but the FBI has received information or an allegation "whose responsible handling requires some further scrutiny..." to determine whether a full investigation is warranted. The Guidelines continue, "In such circumstances, though the factual predicate for an investigation has not been met, the FBI may initiate an 'inquiry' involving some measured review, contact, or observation activities in response to the allegation or information indicating the possibility of criminal activity." When the Department uses pen register and trap and trace devices in preliminary inquiries, which by definition are not full investigations under the Guidelines, we believe the DOJ violates the spirit, if not the letter, of 18 U.S.C. 3123.

7). The Administration's proposed bill is called the "Enhancement of Privacy and Public Safety in Cyberspace Act." To date, it has not been introduced in either the House or the Senate.

8). U.S. v Leon, 468 U.S. 897 (1984).

9). In U.S. v. Giordino, 416 U.S. 505 (1994), the Court ruled that suppression under the statutory exclusionary rule is mandated only for "failure to satisfy any of those statutory requirements that directly and substantially implement the congressional intention to limit use of intercept procedures to those situations clearly calling for the employment of this extraordinary investigative technique." Id. at 527. The Court found that the portion of the statute violated must play "a central role in the statutory scheme." Id. at 528.

10). Section 2703, which governs law enforcement access to stored electronic communications, is substantially less complicated than Title III. As a result, compliance with the statute is easier, and the possibility of an unintentional mis-step that would result in suppression is less.