David Sobel, General Counsel, Electronic Privacy Information Center
I will look at the situation today and share some of the information EPIC has gotten under the Freedom of Information Act. The first government effort to get a handle on the communications medium was in 1991, a proposal to mandate changes in the technical infrastructure and require communications equipment manufacturers to build government backdoors into encryption systems. The proposal was called S256 and was opposed by technical and industry and didn’t go far in the Senate. It was followed by other measures which were discussed at early CFP conferences. Through the FOI, we found out that ‘Operation Root Canal’, was the then legislated strategy for digital telephony. The president in 1992 approved a course of action to move forward on the digital telephony issue and that success would lock in a major objective, we would have a beach head for the cryptography issue. The Digital Telephony Bill was ultimately successful in 1994 which was enacted as the Communications Assistant for Law Enforcement Act (CALEA) which mandated changes to the communications infrastructure for electronic surveillance. Director Freeh complained that the FBI was being impeded in interception efforts. Much was made of the fact that this would not affect the internet which would be allowed to develop unimpeded. The proposal was said to prevent new technologies stopping the FBI doing the interception it had always been able to do but the internet was not captured for interception purposes.
Pen Register Authority is the authority for the government to get information on who calls who. This is an easy power to get, and requires no real judicial discretion. The Supreme Court held in the 1970s that there is no privacy expectation in this data as it is passed to a third, commercial party and does not pertain to content. In 1999, the FCC issued an order requiring that law enforcement must be required with access to packet mode communications under a pen register order. This meant providing law enforcement with both call identifying information and call content even when there had just been a request by law enforcement for the identifying information. It recommended, though, that the measures for interception under CALEA be examined further. FCC underscored that this was not about the internet. In June 2000, the FBI demonstrated the Carnivore system, a pen register device for the Internet, to the Telecoms Industry Association. Carnivore was to separate the content from the traffic data, and law enforcement rather than the service provider would conduct the filtering. An FBI document conceded that Carnivore captured more information than was intended or necessary. It captured information on innocent subscribers as well as those targeted. In 2001, the Patriot Act codified the FBI practice of conducting pen register surveillance on the internet, raising the packet mode issue and further eroding judicial review. Most recently, IP phone data has been included. The Patriot II proposal notes that communications device manufacturers are increasingly producing devices that have multiple functions. The draft law addresses this by saying that the authority to monitor one function of a device automatically gives the authority to monitor any of its functions. In the course of the last decade, there has been a continued expansion of the scope of powers. We have moved very far away from the assurances the FBI gave Congress in 1994 that the emerging internet would not be affected by the mandate sought.
(This presentation was punctuated by a series of slides showing a series of documents received from the FBI and other agencies under FOI – all were blacked out in whole or in part, underlining Sobel’s point that public and oversight is extremely difficult.)
Kate Martin
The millions of non-citizens who live and work in the US are the most vulnerable. The Foreign Intelligence and Surveillance act, FISA, gives the government the power to conduct surveillance and searches on non-US nationals. The law was first passed in 1978 in response to a case on warrantless domestic spying wiretaps on Americans of the 1940s to the 1970s. In 1972, one of those wiretaps came before the US Supreme Court which said it was unconstitutional but said it did not opine on wiretaps of ‘foreign powers and their agents’. In response to that Supreme Court case, Congress did not authorize wiretapping for domestic security purposes, but only national security wiretaps for ‘agents of a foreign power’ including residents of the US and non-residents acting on behalf of a foreign group, with an indication that that group were engaged in sabotage or some such activity. There are three differences. Firstly, with how the warrant is obtained, the warrants under the FISA are issued under the Foreign Intelligence Surveillance Court. All warrants are issued initially in secret. Proving links to terrorism are fairly similar to probable cause under the criminal code. Individuals are not entitled to know they are under surveillance. The second way is that on the few occasions you may be notified that you are the subject of FISA surveillance is if the government brings a criminal indictment. You will be told you are under FISA surveillance but you will not be given access to the warrant or the fruits of the surveillance. The original intent of the FISA was to give the government an intelligence gathering tool, against the Soviet Union or the PLO, for example. It was not intended as a tool to prosecute individuals or to be used in relation to individuals such as regarding criminal prosecutions. Post 9/11, the government has used FISA not to gather information about Al Qaeda but about individuals. We don’t have full information, but we do know that the FISA surveillance warrants issued doubled during the Clinton era. Most seem to have been targeted against pro-Palestinian activists in the US, or against "radical Muslims," whatever that means, citizens and non-citizens. We see from the very beginning that the other constitutional issue in the FISA is regarding protections based on religious and political activity. But those are the criteria being used – pro-Palestinian and pro-radical Muslim seem to be the criteria being used. FBI is up front about who they are targeting and that it is justified.
The greatest threat is not that there is secret surveillance of individuals without notification, but that the government is using the surveillance to identify and target non-citizens for deportation. They are then picked up on immigration violations. There are over 8 million undocumented workers living and working in this country. They can be arrested in secret, have no right to a court-appointed lawyer or a hearing before a judge, and can be deported from the US. If that is the real use to which FISA is being put, why should the citizen community care? There has been conversation earlier that it will be implied that citizens will be next. There is a more important reason, and it’s an extremely important policy question. When Congress put the brakes on TIA, they drew a line between what is happening to US citizen and others and that line is generally being drawn. The Supreme Court applies to everyone inside the US, not just to citizens. The privacy of anyone is as equally important as anyone else’s. There will be a bill coming to the floor of the Senate in the next few days allowing the government to use surveillance against individuals when there is no evidence of any kind that that individual has any connection to terrorism. The bill will probably pass (only objections were from Kennedy) and this applies to non-citizens but there is another proposal which would apply to everyone. This is the key point.
Ann Beeson
The Patriot Act amends FISA in a number of different ways. It amends the wiretap and secret service provisions. While there are some standards under FISA, they are less onerous than the Fourth Amendment usually requires. Before the Patriot Act, the government had to certify that the key purpose for wiretapping was for foreign intelligence. Under the Patriot Act, the government only has to show that foreign intelligence gathering is a significant purpose. The ACLU and others were worried that this would be used as an end-run around the Fourth Amendment. At the end of August, I found out that the FISA court had made one of its decisions public for the first time, as a result of pressure from the Senate Judiciary Committee, which was worried about abuse. The FISA court revealed that Ashcroft had issued guidelines over this provision in May, and wanted the broadest possible interpretation of this provision. The FISA court rejected this interpretation, and had appealed it. We thought that we could get involved in this litigation, and filed an amicus brief before the FISA court. Because the government had never been turned down in a request for a wiretap, there had never been an opportunity for review. We didn’t even know how to file a brief; we had to call around, and get guidance from the judges on how to file the brief. I got a call in September from someone who called herself her contact with the Secret FISA court; it felt like Deep Throat. We got a decision reversing the court of review, and endorsing this broad interpretation of the Patriot Act. They did say that they were happy to read our brief, even if they completely ignored it. The way that the law is written, if the government’s request for a wiretap is denied, and it goes to the court of review, there is no way to appeal the court’s decision to the Supreme Court. It all seems very problematic from a constitutional point of view, that the Supreme Court can’t be a final arbiter. Some of us got together to file a petition to intervene in the case at the Supreme Court. We didn’t have direct standing; we did it on behalf of the Arab-American Anti-Discrimination Committee, and ACCESS. Many of the members of these groups are being surveilled; the government’s statements make this pretty clear. The FBI was counting mosques, in part to set targets for the number of surveillance orders in a particular area. On behalf of these groups, we filed a petition to intervene; there had been a number of cases where non-parties had filed before. Last week, the Court issued a one-line denial. The only way that this will go up is if FISA evidence is used in criminal proceedings. But only 1% of this data is ever used in a criminal case. There is nothing that the innocent targets can do to challenge the law; the only way we can do it is through a criminal case. We are committed to getting involved in cases, and there are some interesting ones around the country, including this case in FISA. I got a call from the law clerk of the judge in this case, asking for a copy of our petition to intervene.
Shari – Is there any room for optimism after what we’ve heard
David – I don’t think the prospects are particularly good. However, we have seen Congress start to put brakes on some of the proposals. The Homeland Security Act had problems, but contained a provision stopping funding for TIPS. Congress may take a similar approach to CAPPS II. In contrast to the bandwagon that passed the first Patriot Act, Congress is at least willing to ask questions, and put the burden on the executive to justify the powers that they’re asking for. While this hasn’t been extended to FISA, it is promising.
\
? – There is a FISA Overview bill out there, although none of us are very optimistic. But get your Congressman to support it.
Kate – The specter of Big Brother made Congress say no to TIPS. If the community doesn’t come together around the privacy rights of non-citizens, there is no hope. If the privacy coalition is split on this, we’re going to lose. The coalitions have some useful members who are on the right of the political spectrum, who have an anti-immigrant agenda. It’s no small political issue, and we need to grapple with it. We do want to wiretap some people, obviously, and it’s better to wiretap them than to throw them into jail secretly and deport them. But the Fourth Amendment applies to everyone.
David - Kate is right – the power of these measures is focused on certain groups. But the implementation of these powers is not necessarily so limited, as we saw in the Carnivore investigation of the Al Qaeda person. The investigation was targeted on a foreign person, but other people’s emails were led. The implications of applying pen register authority to the Internet are complex. When you applied it to telephony, it wouldn’t implicate anyone else – it would be data about me and my phone number. There was a direct relationship to me and my transactions; I am the locus. When you apply this in a packet-mode environment, suddenly law enforcement gets information related to me, but also about every other user of that system. At this point we have to trust that law enforcement is going to ignore this. We’ve seen that Carnivore doesn’t necessarily succeed in doing that. This requires more public and Congressional oversight, not less. If someone using your ISP is the subject of a pen register, your packets are getting caught up in that as well.
Audience – The danger is that pen registers simply give transaction information on telephony, but on the Internet it gives a whole lot more.
David – packets give the content of the email information as well. It’s a much broader category of information. There’s also the URL issue – it may be true that a domain name - www.epic.org - is the equivalent of the phone number of the EPIC office, but the full URL tells you what specific pages I’ve visited. The FBI has been careful not to say that it won’t look at the specific pages. It’s important to understand that there’s a whole new can of worms when you apply these traditional authorities to a new technical environment.
Audience – Johnson claimed he didn’t want to sign the wiretap law. We didn’t have video-cameras, which captured Timothy McVeigh on his rented van, we didn’t have credit card records. The FBI has new tools – we should ask them why do they need these new tools.
Panelist – The law won’t protect our privacy because the technological possibilities are too great.
Audience – FISA information has been used extra-judicially, as in the couple accused in spying for East Germany. The FBI found that one member of the couple was in an extra-marital affair, and then used the information to get the other member to turn state’s evidence. I’m now involved with another client whose attorney gave a press conference in violation of the applicable rules. The attorney didn’t use this to send secret messages; she’s now being prosecuted by Ashcroft as a major terrorist threat, because this was inconvenient for Egypt, an US client state. There are massive extra-judicial things going on.
Panel – there are all these wiretaps on people speaking Arabic, but no-one who can translate what they’re saying.
Panel – you don’t build a bigger haystack to find a needle; it defies common sense.
Audience – I’m concerned about the citizen/non-citizen distinction in FISA. It’s now being used for Internet communication. The same may happen with FISA – it may start to be used against US citizens too.
Panel- There’s a historical example. Internment in WWII started with Japanese and German agents. But many agents had family, so that it was extended to individuals of Japanese descent more generally.
Panel – FISA has always applied to both citizens and non-citizens. We need to be clear that the primary focus of discrimination is national origin and religion, not whether you’re a citizen or non-citizen.
Stephanie Perrin (audience) – I’m interested in the nexus of the loss of Fourth Amendment rights and free trade. You have thousands of people entering the US to engage in trade; if they use communications here, how much information are they generating. What is the threshold for FISA surveillance – is it enough to be a rabid privacy activist?
Panel – It is not enough. You have to be associated with a group that the US considers to be a pro-terrorist group.
Stephanie – What if you’re a peace activist?
Panel – Maybe if you’re a peace activist associated with a terrorist supporting group.
David Sobel – The FBI has generic warrants following people around. If a person with that warrant comes into this room and uses the wireless network, then the FBI can gather the information.
Audience – Most surveillance of the Internet does not meet the constitutional test.
David – That’s a great argument. Another argument I made against Carnivore is relevant. The FBI would go to the ISP and ask for the information on a person’s account, the ISP said we can’t access to it, so the FBI would then install Carnivore. This means that Carnivore doesn’t meet the test either (complex legal argument that I can’t summarize). Most of us assumed that at this stage there would be some challenge to the application of Carnivore and pen register; someone would have a case. For whatever reason, this hasn’t happened yet. My suspicion is that the defense bar isn’t sufficiently attuned to these issues, and there have been uses of Carnivore that have gone over the heads of defense attorneys, who didn’t realize that there are some interesting issues.
Audience – what about Earthlink?
David – Earthlink was asked to install Carnivore, and tried to fight this, by saying they would be violating the privacy of their other providers. That was the issue that Earthlink raised, and the California Court rejected it. It’s not a criminal case, and was on different issues.
Audience – There is a group called Reclaim the Streets which has no links to foreign groups. But it has been labeled a terrorist organization too.
very interesting article
Posted by: tom at January 29, 2004 03:53 PM