[Orin was at the Justice Department until last year and is now a law professor at George Washington University. Text of final USA PATRIOT Act: http://www.politechbot.com/docs/usa.act.final.102401.html Also see a note from Geoff Newbury below. --Declan]
--- From: "Kerr, Orin" <[EMAIL PROTECTED]> Organization: GW Law School To: [EMAIL PROTECTED] Date: Wed, 10 Apr 2002 11:52:07 -0500 Subject: Re: FC: UK wiretapping "traffic" vs. "contents" a sham, by John Gilmore CC: [EMAIL PROTECTED] Declan, While I can't fault John Gilmore's technical analysis, I think his analysis of U.S. law both pre-Patriot and post-Patriot is pretty far off. This may not satisfy the Black Helicopters crowd, but at least some your readers may want to know that things aren't so bad as Gilmore seems to believe. To begin with, it is essential to recognize that the federal statutory privacy laws such as the Wiretap Act (18 USC 2510-22) and the Pen Register Act (18 USC 3121-27) are not pure grants of government power. These laws are privacy laws, that extend privacy protection above and beyond the Fourth Amendment rules to protect Internet communications. These laws have exceptions that allow the government to collect certain kinds of communications with a court order (see 18 usc 3123, 18 USC 2518) but the exceptions only apply if the privacy law applies to that communication in the first place. If the privacy law doesn't apply in the first place, then the communication is totally unprotected by statutory law. Of course, the 4th Amendment can still protect it, but that's a question for the courts to decide, not Congress. (Congress only has the power to enact prophylactic rules that go beyond 4th Amendment protections; if a Congressional law violates the Fourth Amendment by offering less protection than the Fourth Amendment provides, the courts will, should and must invalidate it.) John Gilmore suggests that pre-Patriot Act, there was a "clear legal distinction" between content and other information, but that it has now been erased in a sinister plot. The trouble is, the Patriot Act did not in any way change the statutory definition of "contents" found in the Wiretap Act at 18 USC 2510(8), so it could not have changed what is or could be considered "contents." This definition has not changed since 1986. What the Patriot Act did do is expand the other category of non-content information to make sure that the Pen Register law broadly protects addressing information of Internet communications, now dubbed "dialing, routing, addressing, and signalling information." While John GIlmore sees an evil government plot, I see the expansion of a privacy law. In fact, if the Pen Register law did not apply to non-content addressing information before the Patriot Act (a question upon which Magistrate Judges split, but Gilmore insists was clearly true), that means that absolutely anyone at any time was free to wiretap the Internet and collect all addressing information without any court order-- whether it was the FBI, the CIA, the United Nations, whoever. It would be Carnivore without a court order, all perfectly in compliance with U.S. statutory law. Needless to say, that would be bad. As best I can tell, Gilmore doesn't seem to confront this possibility because he assumes that anything that doesn't fall into the limited definition of "pen register" must by default be considered the "contents" of a communication. The 1968 Senate Report that accompanied the original Wiretap Act suggested this, but this approach was rejected by Congress in 1986 when Congress enacted ECPA and the Pen Regsiter law and settled upon the more narrow definition of "contents" that we have today. The Senate Report clarifies that "contents" post-1986 refers to "the substance, purport, or meaning of the communication," as opposed to merely "the existence of the communication or transactional records about it." Courts interpreting "contents" have taken a similar approach. See, e.g., Brown v. Waddell, 50 F.3d 285, 294 n.11 (4th Cir. 1995) (suggesting that contents are "substantive messages"). This means that pre-Patriot Act, addressing information that was not a substantive message sent by a person was quite possibly unprotected by U.S. privacy law. There was a gap in the privacy law that the USA Patriot Act filled. I suspect Gilmore and I would agree that Congress should do more to protect addressing information. However, I think that his view that the Patriot Act lessened legal protections afforded to addressing information is a bit backwards. Orin Orin S. Kerr Associate Professor George Washington University Law School [EMAIL PROTECTED] (202) 994-4775 --- From: "Newbury" <[EMAIL PROTECTED]> To: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> Date: Wed, 10 Apr 02 13:01:53 -0500 Reply-To: "Newbury, Geoff" <[EMAIL PROTECTED]> On Wed, 10 Apr 2002 04:59:24 -0700, Declan McCullagh wrote: Firstly, thanks are due to John for a brilliant exposition of layering versus legalism. >From: John Gilmore <[EMAIL PROTECTED]> >When my ex-girlfriend of years ago phoned me on the night of September >11th, the real message wasn't what she said; the real message was that >when the world looked shaky and strange, she thought to call me. The >actual words we exchanged were merely signaling information. What John has in fact pointed out is the faulty, in fact devious, logic underlying the DoJ's efforts to allow 'pen-trace' warrants at a lower judicial standard. It is abundantly clear that the DoJ/state AG's etc. (or FBI, RCMP, CSIS etc.) are only interested in pen trace information, *AS CONTENT*. They fudge the meaning of 'speech' (which is protected) to exclude the manner/means/method of that speech. But if anonymous speech is a protectable entity, should not truly anonymous methodologies also be protected? I can avoid the pen-trace by using a randomly chosen pay phone, or calling from some-else's phone. Should I have to take active steps, to remain anonymous *from state power* when no probable cause exists? It is interesting that the DoJ says, in effect, that 'dialing' is not 'speech' but, it is presented as evidence that *you* must have talked to 'Mr. X', because *your* phone was used to call *his* phone, and that *you* therefore communicated with him (possibly multiple times). As a lawyer, I suspect that it is all too easy for prosecutor to convince a jury, that that talk, must have had something to do with the crime.....even though logically it is a post hoc, proctor hoc conclusion. The argument that I have a 'lower' expectation of privacy when I dial, fails to take cognizance of the fact that this too is communication: communication with the phone company, at the very least. There is a fundamental disjuncture which the Supremes will someday likely have to face: they have held that anonymous speech is protected speech, but they have also seemingly held that communication, for the purpose of engaging in protected speech, is not protected speech. These two propositions will meet in battle I suspect. (Digression: it is presently impossible to engage in anonymous telephone speech through relaying: that is generally considered hacking or theft of telecommunications. The web world has anonymous relays. These do not exist in telephony to my knowledge.) The resistance of the EFF to intrusions on constitutional rights by obscurity is welcome. As a Canadian, my Charter Rights are 'subject to such reasonable limits as are prescribed by law'... Worse yet, the 'forbidden fruit' concept of evidentiary admissability has never been the law of Canada. Evidence may be excluded where, to allow it would bring the administration of justice into disrepute. These questions have no 'bright line' or sharp edges, just many shades of grey. On the other hand, jurisprudence involving section 8 of the Charter, (unreasonable search or seizure), now contained in seciton 183 of the Criminal Code, makes it clear that a 'private communication means...any telecommunication.. in which is it reasonable for the originator to expect that it will not be intercepted by any person other than the person intended by the originator to receive it'. 'Intercept' includes 'listen to, record or acquire a communication'. As a result, even a 'pen-trace' requires a full Section 186 interception warrant. Note that in Canada, the application for a warrant requires the personal approval of the Solicitor-General of Canada or of the provincial Attorney-General (or the designated Deputy Solicitor-General or Deputy Attorney-General). The requirements are strict and interception by a third party of private communications is an offence). So Canada is a little more rigourous at the outset, and maybe less rigourous further on.. As to Great Britain, not having a written constitution can be dangerous to your freedoms: viz. the Regulation of Investigatory Powers which appears to de-regulate any intrusions into telecommunications, leaving the power of authorization for many data searches with the chief of the local police. 'Wire-taps' must be authorized by the Secretary of State, but mnay other searches, including covert and intrusive surveillance can be authorized by police authorities. (Check out section 49: it provides for the mandatory disclosure of encryption keys protecting 'protected data'. The allowable reasons of requiring mandatory disclosure are much weaker than equivalent US/Canadian standards. On a quick read, it appears that there are effectively no limits on interception of communications intended for transmission to recipients outside the UK (but I may be reading this wrongly..it is *not* a sterling example (sorry!) of clarity in legislative drafting). The R.I.P. Act (2000) can be found through the British and Irish Legal Information Institute web site http://www.bailii.org which has all Statutes since 1988 on line, plus good databases of Court of Appeal and House of Lords decisions. >It is easy to respond to DoJ's points -- but not by acquiescing. By >insisting that what they are doing today is utterly illegal, and that >what they seek under the law (the legalization of what they do today, >plus wiggle room for more later) is utterly unconstitutional. For examples of why the DoJ's logical position is wrong, you might take a look at the Supreme Court of Canada's decisions in R. v. Wong [1990] 3 S.C.R. 36 re reasonable expectation of privacy and R. v Duarte [1990] 1 S.C.R. 30 re "the insidious dangers in allowing the state in its unfettered discretion to record our words". (These cases may be on-line at www.lexum.umontreal.ca but I cannot confirm it as that site appears to be down. I *think* that the Judgments on-line go back to 1990. The Supreme Court is a www.scc-csc.gc.ca but links to the Lexum site.) >Let's see: The response of the federal police force when an emergency >arises is to IMMEDIATELY BREAK THE LAW AND THE CONSTITUTION in an >umistakably massive way.> Succinctly put! >Not exactly. In the US, the standard of evidence required by a court >to grant "pen register" access is substantially lower than that >required for a "full content" or "Title III" search warrant. ... > Because the end point did not identify an >individual, it was deemed to require a lower standard of protection. The Canadian Supreme Court has noted that expectations of privacy belong to people and not to places, but that does not displace the requirement that there be 'reasonable and probable grounds to believe that an offence has been or is being committed and that the authorization sought will afford evidence of that offence'. On that standard, no 'pen-trace' warrant should ever be issued. If a warrant were capable of being issued, it would be a full warrant, not a restricted warrant. Geoff Newbury (Who does *not* practice criminal law... If you practice criminal law, you have to associate with liars, thieves, cheats and scoundrels... And the clients are worse! Anon. ------------------------------------------------------------------------- POLITECH -- Declan McCullagh's politics and technology mailing list You may redistribute this message freely if you include this notice. Declan McCullagh's photographs are at http://www.mccullagh.org/ To subscribe to Politech: http://www.politechbot.com/info/subscribe.html This message is archived at http://www.politechbot.com/ ------------------------------------------------------------------------- Politech dinner in SF on 4/16: http://www.politechbot.com/events/cfp2002/ -------------------------------------------------------------------------
