FRAMINGHAM (08/16/2000) - The U.S. Court of Appeals for the District of Columbia ruled yesterday that law enforcement agents seeking to intercept data packets that combine addressing information and the content of communications must meet the higher legal requirements needed for a search warrant.
The decision casts doubts on the legality of the U.S. Federal Bureau of Investigation's (FBI) Carnivore Internet surveillance system, where monitoring is approved under the less demanding standard of what's called a pen register order. The ruling will likely increase the number of cases in which government investigators must obtain search warrants to conduct surveillance activities, especially on the Internet.
"We are happy that the court has imposed strict legal limitations on law enforcement's use of these surveillance capabilities. And in doing so, we think the court has indirectly raised some serious legal questions about Carnivore," said David Sobel, general counsel for the Washington-based Electronic Privacy Information Center (EPIC). "This decision makes it pretty clear that if the FBI were to go to court with material obtained with Carnivore with anything less than a search warrant, that evidence is likely to be thrown out. But beyond that, there are policy and political questions as to whether Carnivore should be continued under just pen register order."
FBI spokesman Paul Bresson declined to comment on the ruling or its potential effect on Carnivore, saying the bureau has not yet had a chance to review the decision.
The decision was issued in response to a challenge brought by EPIC, other privacy advocates and the telecommunications industry, who were seeking to overturn technical standards for surveillance imposed last year by the U.S.
Federal Communications Commission (FCC). The FCC ruling was issued under the 1994 Communications Assistance for Law Enforcement Act (CALEA), which required telephone companies to include law enforcement surveillance capabilities in new digital phone systems while at the same time upholding privacy requirements.
The FBI also sought added surveillance features including the ability to extract dialed digits from a phone call. This could include not only phone numbers, but also bank account and credit card numbers.
The three-judge panel yesterday issued a unanimous opinion that the FCC's requirements for carriers to build extended surveillance capability into their networks was an unsatisfactory response to CALEA's privacy guidelines. The panel also found that the FCC ruling did not adequately address the potential cost of surveillance systems incurred by the telecommunications industry.
The ruling notes that CALEA requires carriers to facilitate authorized communications interceptions and access to call-identifying information in a way that protects the privacy of messages or call-identifying information that is not named in a court order.
When FCC lawyers were asked during oral arguments how the Commission applied CALEA's privacy mandate for "post-cut-through" dialed digits, or digits entered after a call has been connected, the Commission counsel replied that "we addressed ourselves to the privacy questions with a little bit of hand wringing and worrying." Those "post-cut-through" digits can include sensitive information if, say, a caller is conducting telephone banking or other transactions.
In its decision, the court condemned what it viewed as the FCC's cursory consideration of privacy concerns. "Neither hand wringing nor worrying can substitute for reasoned decision-making," the judges wrote. "The Commission spoke of law enforcement's need to obtain post-cut-through dialed digits and of the cost of providing them, but it never explained, as CALEA requires, how its rule will protect the privacy and security of communications not authorized to be intercepted."
The Court did agree with the FCC that carriers should build into their networks the ability to locate signals from wireless phones but limited that requirement to the location of the antenna handling the call. It upheld the FCC's rejection of a claim by the New York City Police Department that would have required triangulating a precise location of the caller based on the signals from multiple cellular antenna towers.
The court also supported the FCC's position that carriers should not be required to separate addressing information from the contents of the message in packet data. However, it rejected the FCC's view that government investigators can intercept both routing information and call content under pen register and "trap and trace" orders. Trap and trace provides the names of senders, while pen register provides the names of people to whom a suspect sends e-mail.
The court ruled that the government must meet the higher standard required for the interception of communications content, despite its claims that it only seeks addressing information. The Carnivore system monitors large numbers of data packets while filtering for the IP addresses of individuals named in a court order.
EPIC and the American Civil Liberties Union filed suit against the FBI earlier this month seeking the immediate disclosure of information concerning the Carnivore surveillance system. The FBI is under court order to reveal its timetable for the release of the requested information today.