Security and Privacy

September 27, 2000

Summary of H.R. 5018, The Electronic Communications Privacy Act of 2000

I. Overview

By a vote of 20-1, the House Judiciary Committee on September 26 approved H.R. 5018, legislation to strengthen privacy protections governing law enforcement surveillance.

As reported, the bill would

  1. Increase to probable cause the standard for government access to location information on wireless phone users. (Described in more detail below.)

  2. Increase the standard for use of pen registers and trap and trace devices under 18 USC 3123, to require a judge to find that specific and articulable facts reasonably indicate criminal activity and that the information to be collected is relevant to the investigation of such conduct. (Described in more detail below.)

  3. Extend the statutory exclusionary rule of 18 USC 2510 5 to electronic communications, whether seized in real-time or from storage with an ISP. (Described in more detail below.)

  4. Require a warrant for government seizure of read or unread email stored with a service provider for up to one year.

  5. Require annual reports by the federal law enforcement agencies on the seizure of email, similar to but with less detail than the wiretap reports.

  6. Require high level Justice Department approval for applications under Title III to intercept electronic communications, as is currently required for interceptions of wire and oral communications.

  7. Allow ISPs to disclose customer identifying information in emergency situations.

  8. Allow emergency use of pen registers in national security cases and cases involving an ongoing attack against computer system, but require the government to apply for a court order within 48 hours and, if the order is denied, require the government to notify the target that he was the subject of an unauthorized surveillance.

  9. Raise the maximum penalty for certain more serious computer violations to ten years in prison.

  10. Amend the federal sentencing guidelines such that only the most serious computer-related offenses are subject to a mandatory six-month sentence.

  11. Increase the civil penalties for illegally intercepting electronic communications.

The bill does NOT include several controversial provisions sought by the Justice Department:

  1. Nationwide service of trap and trace orders.

  2. Language that would make it clear that the pen register/trap and trace statute applies to Internet communications.

  3. Elimination of the $5,000 loss threshold for certain computer crimes.

CDT strongly supports the bill as reported - it fills many gaps in the law and extends privacy protections that have long needed updating.

II. The New Pen Register Standard

  1. Current Law Judges Rubber Stamp Every Gov't Request

    Most people would assume that the record of the telephone numbers they call and the origin of the calls they receive is protected from government snooping. After all, a complete listing of those you call and who call you gives a pretty clear picture of your personal and professional life.

    But current law sets a very low standard for government agencies to use pen register devices to record the numbers dialed on outgoing calls and trap and trace devices to trace the numbers of incoming calls. Currently, a government official only needs to claim that the use of the surveillance device is "relevant" to an ongoing investigation. The law requires judges to approve every application that is submitted the government does not need to assert any factual basis for its application, and the law says that the judge cannot deny a request claiming relevance. 18 USC 3123

  2. HR 5018 the standard of Reasonable Indication

    HR 5018 will do two things:

    The standard of "specific and articulable facts reasonably indicating criminal conduct" is drawn from the 1968 Supreme Court opinion in the stop and frisk case, Terry v. Ohio: "And in justifying the particular intrusion the police officer must be able to point to specific and articulable facts which, taken together with rational inferences from those facts, reasonably warrant that intrusion." Terry v. Ohio, 392 U.S. 1, 21 (1968). The Supreme Court emphasized, "This demand for specificity in the information upon which police action is predicated is the central teaching of this Court's Fourth Amendment jurisprudence." Id., footnote 18.

    The Terry "reasonable indication" standard governs the actions of all federal, state, and local police in carrying out limited search and seizure procedures like "stop and frisks." It is a relatively low factual standard, substantially lower than probable cause. Also, this is the standard set forth in the Attorney General guidelines as the minimum for opening a federal investigation. So if pen registers are to be used only in valid investigations, and judges are to be given a genuine role in approving or denying pen register applications, it makes sense to use the standard that governs both the opening of investigations and minimal Fourth Amendment intrusions like stop and frisks.

III. Cell Phone Location Information - A Major Privacy Concern

Wireless phones generate information that can be used to physically track the movement of users. Initially limited to cell site antenna location, this tracking data is becoming more and more sophisticated with the introduction of GPS and On-Star technology. This has major privacy implications.

Obviously, people want to be found when they call 911. And the government should have the ability to locate suspected criminals. But there need to be standards, just as there are standards for any government investigative technique. Right now, the law is unclear there is NO clear rule on when the government can collect location information from cell phone companies. The DOJ claims authority to obtain "real time" information about the location of a cellular telephone user under 18 U.S.C. 2703(d). That section provides that a court order for disclosure of records pertaining to a subscriber to an electronic communications service or a remote computing service. Such records may be obtained with a court order based on a finding of "specific and articulable facts showing that there are reasonable grounds to believe that the records or other information sought, are relevant and material to an ongoing criminal investigation."

Over 100 million Americans use wireless phones, and the number grows by about 20% every year. These Americans would be shocked if they knew that the government could use their cell phones to track them without probable cause.

  1. The Probable Cause Standard in HR 5018 A Balanced Approach

    HR 5018 as reported by the Judiciary Committee would make it clear that the government would need probable cause of a crime in order to acquire location information on cell phones.

    The bill has common sense exceptions allowing disclosure of location information without a court order to law enforcement, hospitals, fire departments and others when the user calls 911 for emergency services. It has another exception to inform a user's legal guardian or immediate family or the user's location in an emergency that involves risk of death or serious bodily harm, and where the user or subscriber had expressly consented to disclosure of location information. The exceptions are based on 47 USC 222, which already limits disclosure of cell phone location information for commercial purposes. (47 USC 222 says that cell phone companies cannot disclose customer location information to marketers and other commercial entities without express customer consent or under the other exceptions. 222 did not address disclosures to law enforcement agents armed with a mere subpoena or a court order issued under a minimal standard.) It makes sense to have the same language in both places. Like 47 USC 222, HR 5018 also allows disclosure to contractors who run 911 and other emergency services.

  2. The Pen Register Standard (Relevant to an Investigation) is Not Adequate

    The Justice Department wanted access to location at the revised pen register standard. This is no effective improvement over current law DOJ already claims authority to get location info under the specific and articulable facts standard of 18 USC 2703(d), which is basically the same as the language in the new pen register standard in HR 5018.

    If the pen register standard is raised, given growing sensitivity over the revealing nature of transactional information, then the location standard should be raised too, so that it is higher than ordinary transactional information. Location tracking is one of the major emerging concerns of American citizens, and it would be a grave failure if Congress decided to ratify the current relatively low standard for government access.

    In CALEA, Congress clearly stated that the standard for access to location information had to be HIGHER than the standard for pen registers. CALEA says that "with regard to information acquired solely pursuant to the authority for pen registers and trap and trace devices ... such call-identifying information shall not include any information that may disclose the physical location of the subscriber." 47 USC 1002(a)(2). Congress said that location information is more sensitive than other transactional information. (That is truer today than ever with more precise location information becoming available through GPS.)

IV. The Exclusionary Rule

When Congress adopted the federal wiretap law in 1968, one of the protections it wrote into the law was a provision stating that communications intercepted in violation of the law could not be used as evidence in any trial, civil case, or administrative proceeding. 18 USC 2515. This is called a statutory exclusionary rule. When Congress extended the wiretap law to cover email and other electronic communications, it did not extend the e statutory exclusionary rule of 18 USC 2515 to interception of email or other electronic communications. The rule currently applies only to voice interceptions.

HR 5018 would correct this deficiency. It would extend the exclusionary rule to real-time interception of email and to government seizure of email from an ISP while in storage waiting to be downloaded or read.

  1. Statutory Exclusion Rule Has NOT Been Applied to Minor or Technical Errors

    The Clinton Administration actually supported some extension of the exclusionary rule The Justice Department, however, argued that the exclusionary rule in 18 USC 2515 is too strict. This is not supported by the caselaw, from the Supreme Court on down.

    Courts have held that when there is a violation of Title III that is of a constitutional magnitude, a good faith exception applies. Thus, the good faith exception has been applied to the failure of a judge to sign the wiretap order, US v. Moore, 41 F. 3d 370 (8th Cir. 1994), to inadequacies in the probable cause showing, US v. Millan, 817 F. Supp. 1072, 1078 (S.D. N.Y. 1993), and to other defects. See, e.g., US v. Ferrara, 771 F. Supp. 1266, 1314 (D. Mass 1991).

    Moreover, as to non-constitutional violations of Title III, the Supreme Court has held that evidence cannot be excluded under 2515 for minor or technical violations. The Court held in United States v. Giordano, 416 US 505, 527 (1974) that suppression under 2515 is required only for "failure to satisfy any of those statutory requirements that directly and substantially implement the congressional intention to limit the use of intercept procedures to those situations clearly calling for the employment of this extraordinary investigative technique." In determining whether suppression is warranted, courts must examine whether the violated statutory requirement occupies "a central role in the statutory scheme." Id. at 528. See also US v. Chavez, 416 US 562, 578 (1974).

  2. The Statutory Exclusionary Rule Is Quite Weak

    As one leading treatise says, "many violations of the requirements of Title III will lead to either no suppression or only partial suppression. ... In most jurisdictions there are relatively few violations which will lead to the ultimate and absolute sanction of complete suppression of all surveillance evidence. ... In many instances the government has disregarded procedural protections established by sec. 2518 without affecting the admissibility of the eavesdropping evidence." Carr, The Law of Electronic Surveillance, Sec. 6.3.

    These cases show that Congress should consider strengthening the statutory exclusion rule in light of its erosion by the courts, and certainly show that the Justice Department's opposition is unsupported.