Introduction to Government Investigations[1]
In
previous Modules we explored how private sector actors in the U.S. utilize
technology to monitor use of cyberspace.
In Modules IV and V, we turn to the more complex question of government
surveillance of cyberspace. In Module
IV we take as our task the description of the basic constitutional and
statutory rules that govern cyberspace surveillance by the government. In Module V we take up the complicated
question of how the new USA Patriot Act --enacted post-September 11--allows
greatly expanded surveillance of cyberspace.
These two Modules are
substantially more complex than the earlier ones for several reasons--largely
having to do with the fact that the U.S. recognizes multiple sources of
positive law. First, the United States
follows a federal system in which not only Congress, but also most of the 50
individual states has enacted regulations to govern cyberspace. However, because federal statutes are much
more significant, and preempt conflicting state laws, these Modules focus
primarily upon federal legislation and the U.S. Constitution.
Second, as technology has
evolved over time, Congress has enacted many statutes that govern different
aspects of cyberspace. For example, different surveillance rules might apply
depending on whether the target of governmental surveillance accesses
the internet using a cell phone, telephone, or cable modem. Different rules might also apply depending
on whether the type of cyberspace use involves email, instant-messaging,
telephone, or websurfing. A recently-enacted federal statute, known as “USA
Patriot,” attempts to moderate some of these conflicts, but issues linked to
the different technologies remain. In
this Module, we will attempt to set forth the principal federal statutory
frameworks.
Third, different rules apply
depending on the nature of the government’s surveillance. Does the government desire to know the
contents of every email sent to or from a particular computer? Does the government intend to search widely
for communications by a particular author?
Or, does the government merely desire to know the name and email address
of the sender of email to a particular address?
Finally, because all legislation must satisfy judicial interpretations
of the U.S. Constitution, many statutes that appear to authorize certain
surveillance practices might be held to be unconstitutional. Therefore, even a cursory introduction to
government surveillance issues must identify some of the key constitutional
cases that affect the interpretations of the statutes.
I. SUMMARY OF KEY TERMS IN THE AREA OF ELECTRONIC SURVEILLANCE AND
INTERCEPTION
o Wiretaps are used for ongoing surveillance of a telephone line or other electronic communications line. It allows interception of content (i.e. conversations or other data) passed over the line. Note that this is more information than is gathered by a Pen Register or Trap and Trace Orders – neither of these intercept content - rather, they simply collect numbers dialed/received.
B. Four Levels
of Government Search Authority
(1)
Subpoena
The requirements for
obtaining a subpoena are minimal. There is no ‘relevancy standard’ - no
requirement that the information sought be relevant to an ongoing criminal
investigation. Subpoenas can be issued by a prosecutor (sometimes through a
grand jury investigation) without judicial intervention. However, a subpoena
may not be used to obtain information or evidence protected by the Fourth
Amendment unless Fourth Amendment requirements are satisfied.
(2)
Pen Registers and Trap and
Trace Order
A judge who independently
evaluates the request of the government must grant pen Register Orders. The
standard for granting a Pen Register Order is that the order must be relevant
to an ongoing criminal investigation. An order is valid for 60 days and may be
renewed for 60 day increments. The courts have held that the Fourth Amendment
does not apply to Pen Register and Trap and Trace Orders, and therefore the
government need not show “probable cause.”
Title III of the Omnibus
Crime Control and Safe Streets Act of 1968 dictates requirements for Trap and
Trace Orders. For more information about Title III, see below.
(3)
Warrants
A warrant is required if the
target has a reasonable expectation of privacy in the targeted material (Fourth
Amendment requirement; see below). Requirements for obtaining a warrant are
more stringent than those for obtaining a trap/trace order. E.g., the
government must show “probable cause.”
A warrant must describe the place to be searched or thing to be seized
with specificity. See, e.g.,
http://caselaw.lp.findlaw.com/data/constitution/amendment04/02.html#3
(4)
Wiretaps
Title III dictates requirements for wiretaps. Wiretaps are used for ongoing listening and invasion, and require a more comprehensive showing of need than a warrant. Title III also mandates court supervision and minimal intrusion for ongoing wiretaps.
II. Summary of U.S. Constitutional Requirements
A. The Fourth Amendment to the United States
Constitution
The right of the people to be secure in their persons, houses, papers,
and effects, against unreasonable searches and seizures, shall not be violated,
and no Warrants shall issue, but upon probable cause, supported by Oath or
affirmation, and particularly describing the place to be searched, and the
persons or things to be seized.
http://caselaw.lp.findlaw.com/data/constitution/amendment04/index.html
B. Supreme Court Interpretations of the Fourth Amendment
The U.S. Constitution
ordinarily grants individuals rights against the government (and not private
parties). Since government agents are usually the ones who are engaging in a
claimed invasion, the U.S. legal system relies upon an independent judiciary to
enforce these Constitutional rights.
Often--though not always--such cases arise in the context of a criminal
trial in which a defendant seeks to exclude certain evidence from the trial
record on account the government obtained the information in violation of the
Fourth Amendment.
In early 20th
Century decisions, the U.S. Supreme Court relied on a “property-based”
rationale for interpreting the Fourth Amendment. For example, in Olmstead v. United States[2],
the Court held that wiretapping was not covered by the Amendment because the
government had not physically invaded the defendant's premises. In a 1967 decision, however, Katz v. United States[3],
the Court rejected this approach, holding that the government could not
electronically eavesdrop on a telephone conversation held by a person in a
public telephone booth by attaching a listening device to the outside of the
booth without complying with the Fourth Amendment. The Court rejected the government’s argument that since the
speaker had no property interest in the booth his Fourth Amendment rights
weren’t violated. As the Court said in another case decided the same year:
''The premise that property
interests control the right of the Government to search and seize has been
discredited. . . . We have recognized that the principal object of the Fourth
Amendment is the protection of privacy rather than property, and have
increasingly discarded fictional and procedural barriers rested on property
concepts.'' [4]
Katz concluded in a famous tag
line that the Amendment ''protects people, not places.''[5]
Henceforth, electronic surveillance was made subject to the Amendment's
requirements.
After Katz, the Court developed a
two-pronged test to determine if an individual had a reasonable expectation of
privacy against intrusions by the government that triggered the Fourth
Amendment. First, an individual had
to believe a given communication is private.
This was a subjective test of the individual’s belief. Second, for an expectation of
privacy to be deemed reasonable, a disinterested observer (i.e., a court) would
have to agree that the individual’s expectation of privacy was reasonable. This
is supposedly an objective test. If
these two factors are satisfied, then the government must comply with the
Fourth Amendment. As recently put by
the Court:
"[A] Fourth Amendment search occurs when
the government violates a subjective expectation of privacy that society
recognizes as reasonable." Conversely, "a Fourth Amendment search
does not occur--even in the explicitly protected location of a house-- unless
the individual manifested a subjective expectation of privacy in the object of
the challenged search, and society [is] willing to recognize that expectation
as reasonable."[6]
The two-part test ostensibly
guides the Supreme Court and lower courts in its decisions, but interpreting
such a vague standard leaves substantial room for judgment. The first requirement, the ''subjective
expectation'' of privacy, has in practice eroded as a workable standard,
because, as Justice Harlan concluded in a later case, ''our expectations, and
the risks we assume, are in large part reflections of laws that translate into
rules the customs and values of the past and present.''[7] In short, the Supreme Court sets the
standards, and those standards in turn become the future reference points for
individuals’ “expectations” of privacy against the governmental intrusions.
Accordingly, the second part
of the test, whether one has a ''legitimate'' expectation of privacy that
society finds ''reasonable'' to recognize, has become the default touchstone of
what “privacy” means under the Fourth Amendment. That is, the ''capacity to claim the protection of the Amendment
depends . . . upon whether the area was one in which there was reasonable expectation of freedom from
governmental intrusion.'' (emphasis added) [8] In answering this question, the Court has
said that ''[l]egitimation of expectations of privacy by law must have a source
outside of the Fourth Amendment, either by reference to concepts of real or
personal property law or to understandings that are recognized and permitted by
society.'' [9]
Note that, despite the
rejection of the “property” rationale in Katz,
the Court re-embraces the same concept via a backdoor description of
“expectations.” The problem, of course, is that when these concepts of
realspace are applied to cyberspace (or even telephonic communications) an
individual owns no “property” in the mechanisms of transmission (e.g., the
wires that carry the dataflow) that would support her claim of privacy in the
communication. In sum, although the
Fourth Amendment protects a person’s privacy, not her property, owning the property
in which transmissions occur has become the surest means of protecting privacy.
In specific terms, the Court
has given the most protection to an individual’s home[10],
while other “places” an individual frequents (e.g., automobile[11])
or information about his activities are given little protection. Revealing
information about one’s activities to another person has become a surefire road
to the no privacy destination. In United States v. Miller, for example, the Court gave a restrictive reading to “reasonable
expectations” in a case involving a bank depositor who claimed the government
was required to satisfy Fourth Amendment standards in order to obtain his
financial records from his bank. The Miller
Court held that the depositor had no "legitimate 'expectation of privacy'
in financial information "voluntarily conveyed to . . . banks and exposed
to their employees in the ordinary course of business."[12]
Similarly, in a key case posing the question of whether
the government was required to obtain a warrant before installing a pen
register, the Supreme Court held that an
individual targeted in pen register monitoring does not have a reasonable
expectation of privacy in the telephone numbers dialed from his home telephone.
According to Smith v.
Maryland, an individual is assumed to know that in dialing, he
"convey[s] numerical information to the phone company” and that the phone company “record[s] this
information for a variety of legitimate business purposes." The Court rejected strong dissents that argued
that the numbers dialed consisted of communication “content”. Therefore, the Court held that the
installation and use of a pen register "was not a 'search,' and no warrant
was required."[13]
The Court has not yet held that the content of those
communications may be revealed without violating the Fourth Amendment. One could imagine, for example, an extension
of the Smith rationale that the user
knows when he dials he “conveys numerical information to the phone company”
because he is using the phone company’s switching systems. Presumably, the user also knows that when he
speaks, he is using the phone company’s lines and switching stations since the
user must speak using the communication devices of his telephone service
provider. However, The key distinction
between (1) the “content” of the communication and (2) the telephone numbers
dialed, time, length and date of call, has led one commentator to coin the
phrase “communication attributes” to describe the latter.[14] We will rely on this distinction as we
consider the treatment of cyberspace communications.
As a general matter, without
necessarily intending to do so, the Court has developed a balancing approach to
the question of what constitutes an individual’s “reasonable expectations” under
the Fourth Amendment. This approach
assesses “the nature of a particular practice and the likely extent of its
impact on the individual's sense of security balanced against the utility of
the conduct as a technique of law enforcement.'' [15]
What are the factors that
guide the “balance?” That a person has
taken precautions to maintain her privacy, that is, precautions customarily
taken by those seeking to exclude others, is usually a significant factor in
determining legitimacy of expectation. As indicated above, property interests
in the thing or information are also relevant, and in the recent Kyllo[16]
case, apparently determinative.
However, because the “needs” of law enforcement are weighed against these
interests, it is difficult to determine in advance how much weight a court will
give to any factor.[17]
III. Key Statutes: Title III of
the Omnibus Crime Control and Safe Streets Act of 1968. and the Electronic Communications Privacy Act of 1986
(ECPA)
Title
III of the Omnibus Crime Control and Safe Streets Act of 1968[18]
attempted to codify the Fourth Amendment principles set forth by Katz. Title III proscribes the
interception of oral and wire communications, "while making provision for
law enforcement to intercept these communications for use in criminal
investigations."[19]
The
Electronic Communications Privacy Act of 1986 ("ECPA") amended Title
III when it became clear that Title III was not adequate to deal with
developing technologies in the field of electronic communication. The ECPA was designed to align Title III with
new innovations such as "cellular telephones, computer-to-computer
transmissions, and electronic mail systems . . . ."[20]
Title I of the ECPA
prohibits unauthorized interception of electronic communications.[21] “Unauthorized” includes communications obtained
without the authority of an appropriate court order. Title
II proscribes the unauthorized access to stored wire and electronic
communications.[22] However, although the ECPA was designed to update
Title III, it did not resolve conflicting understandings of what would be
protected under the “reasonable expectation of privacy” standard. While the privacy standard still governs
communications obtained by the government, the standard is difficult to apply
because it is not obvious whether a user’s hope of privacy is one a court will
protect as “reasonable.”
Note: A detailed summary of
Title III of the Omnibus Crime Control and Safe Streets Act of 1968 and the Electronic Communications
Privacy Act of 1986 (ECPA) will be found in the Statutory Assignment following
the Introduction. Follow the link below
to the Module IV Homepage.
[return to Module IV
Homepage]
[1] This Introduction and Module draws upon research papers authored by Cory Bragar (HLS 2002) and Emily Terrell (Loyola Law School, Los Angeles, 2004).
[2] 277 U.S. 438 (1928). See also Goldman v. United States, 316 U.S. 129 (1942) (detector placed against wall of adjoining room; no search and seizure); Silverman v. United States, 365 U.S. 505 (1961) (spike mike pushed through a party wall until it hit a heating duct).
[3] Katz v. United States, 389 U.S. 347, 353 (1967). Justice Harlan, concurring, 389 U.S. at 353, authored what became the two pronged test for determining whether the Fourth Amendment protects a given privacy interest: ''first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable.''' Id. at 361.
[4] Warden v. Hayden, 387 U.S. 294, 304 (1967).
[5] Katz, 389 U.S. at 351.
[6] Kyllo v.United States, 121 S. CT. 2038, 2042 (2001).
[7] United States v. White, 401 U.S. 745, 786 (1971). See also Smith v. Maryland, 442 U.S. 735, 740 n.5 (1979) (government could not establish ''subjective expectations'' by announcing that henceforth all homes would be subject to warrantless entry, and thus destroy the ''legitimate expectation of privacy'').
[8] Mancusi v. DeForte, 392 U.S. 364, 368 (1968) (official had a reasonable expectation of privacy in an office he shared with others, although he owned neither the premises nor the papers seized).
[9] Rakas v. Illinois, 439 U.S. 128, 144 n.12 (1978).
[10] E.g., Kyllo v.United States, 121 S. CT. 2038 (2001)(where government used a thermal imaging device pointed at home to detect pattern of heat, “the surveillance is a 'search' and is presumptively unreasonable without a warrant"); Payton v. New York, 445 U.S. 573 (1980). 468 U.S. 705, 708-10 (1984). In United States v. Karo, a beeper signal was used to determine if a container holding a radio-controlled “beeper” was still in a house. The Court found the intrusion required compliance with the Fourth Amendment. "(P)rivate residences are places in which the individual normally expects privacy free of governmental intrusion not authorized by a warrant, and that expectation is plainly one that society is prepared to recognize as justifiable." In contrast, the Court in United States v. Knotts, 460 U.S. 276 (1983), agents installed a beeper in a container of chloroform and followed the beeper signal as the container was transported. The Court found that the beeper had been monitored while on public streets, and thus no search had resulted because there could be no legitimate expectation of privacy on public streets.
[11] One has a diminished expectation of privacy in automobiles. E.g., United States v. Ross, 456 U.S. 798 (1982); Arkansas v. Sanders, 442 U.S. 753, 761 (1979) (collecting cases). See also Rakas v. Illinois, 439 U.S. 128 (1978) (passengers in automobile passengers who had no legitimate expectation of privacy in areas searched).
[14] Susan Freiwald, Uncertain Privacy: Communication Attributes After the Digital Telephony Act, 69 S. CAL. L. REV. 949 (1996).
[15] United States v. White, 401 U.S. 745, 786-87 (1971) (Justice Harlan dissenting).
[16] See Note 9.
[17] E.g., United States v. Miller, 425 U.S. 435 (1976) (no warrant required to obtain bank records from bank); Smith v. Maryland, 442 U.S. 735 (1979) (Fourth Amendment doesn’t protect numbers dialed from one's telephone); Hudson v. Palmer, 468 U.S. 517 (1984) (prison cell); Illinois v. Andreas, 463 U.S. 765 (1983) (shipping container opened and inspected by customs agents and resealed and delivered to the addressee); California v. Greenwood, 486 U.S. 35 (1988) (individual held to have abandoned privacy interest in papers placed in sealed plastic bags left at curb for garbage collection).
[20] Michelle Skatoff-Gee, Changing
Techologies and the Expectation of Privacy: A Modern Dilemma, 28 Loy. U. Chi.
L.J. 189, 201 (1996).
[21]
18
U.S.C. § § 2701-2711
(1994). Section 2701(a) provides:
“[W]hoever (1) intentionally accesses
without authorization a facility through which an electronic communication
service is provided; or (2) intentionally exceeds an authorization to access
that facility; and thereby obtains, alters, or prevents authorized access to a
wire or electronic communication while it is in electronic storage in such
system shall be punished …”
[22] See 18 U.S.C. § § 2510-2521.