Here it is.
Date: Fri, 24 Sep 1993 16:31:55 -0400 (EDT) From: denning@cs.georgetown.edu (Dorothy Denning) Subject: Wiretap Article To: ssteele@eff.org Cc: denning@guvax.acc.georgetown.edu Errors-To: Postmaster@cs.georgetown.edu Content-Transfer-Encoding: 7BIT
Shari,
The following article on wiretap laws and procedures was written in response to the many questions and misunderstandings that have arisen in the context of escrowed encryption as well as Digital Telephony. I would appreciate it if you would send it out through the eff-news mailing list and archive it in your database of papers.
Thanks, Dorothy -------
WIRETAP LAWS AND PROCEDURES WHAT HAPPENS WHEN THE U.S. GOVERNMENT TAPS A LINE
Donald P. Delaney, Senior Investigator New York State Police
Dorothy E. Denning, Professor and Chair Computer Science Department, Georgetown University
John Kaye, County Prosecutor Monmouth County, New Jersey
Alan R. McDonald, Special Assistant to the Assistant Director Technical Services Division, Federal Bureau of Investigation
September 23, 1993
1. Introduction
Although wiretaps are generally illegal in the United States, the federal government and the governments of thirty seven states have been authorized through federal and state legislation to intercept wire and electronic communications under certain stringent rules which include obtaining a court order. These rules have been designed to ensure the protection of individual privacy and Fourth Amendment rights, while permitting the use of wiretaps for investigations of serious criminal activity and for foreign intelligence.
This article describes the legal requirements for government interceptions of wire and electronic communications and some of the additional procedures and practices followed by federal and state agencies. The legal requirements are rooted in two pieces of federal legislation: the Omnibus Crime Control and Safe Streets Act (Title III of the Act (hereafter "Title III")), passed in 1968, and the Foreign Intelligence Surveillance Act (FISA), passed in 1978. Title III established the basic law for federal and state law enforcement interceptions performed for the purpose of criminal investigations, while FISA established the law for federal-level interceptions performed for intelligence and counterintelligence operations. We will first describe Title III interceptions and then describe FISA interceptions.
2. Title III Interceptions
Title III, as amended (particularly by the Electronic Communications Privacy Act of 1986), is codified at Title 18 USC, Sections 2510-2521. These statutes provide privacy protection for and govern the interception of oral, wire, and electronic communications. Title III covers all telephone communications regardless of the medium, except that it does not cover the radio portion of a cordless telephone communication that is transmitted between the handset and base unit. The law authorizes the interception of oral, wire, and electronic communications by investigative and law enforcement officers conducting criminal investigations pertaining to serious criminal offenses, i.e., felonies, following the issuance of a court order by a judge. The Title III law authorizes the interception of particular criminal communications related to particular criminal offenses. In short, it authorizes the acquisition of evidence of crime. It does not authorize noncriminal intelligence gathering, nor does it authorize interceptions related to social or political views.
Thirty seven states have statutes permitting interceptions by state and local law enforcement officers for certain types of criminal investigations. All of the state statutes are based upon Title III from which they are derivative. These statutes must be at least as restrictive as Title III, and in fact most are more restrictive in their requirements. In describing the legal requirements, we will focus on those of Title III since they define the baseline for all wiretaps performed by federal, state, and local law enforcement agencies.
In recent years, state statutes have been modified to keep pace with rapid technological advances in telecommunications. For example, New Jersey amended its electronic surveillance statute in 1993 to include cellular telephones, cordless telephones, digital display beepers, fax transmissions, computer-to-computer communications, and traces obtained through "caller-ID".
Wiretaps are limited to the crimes specified in Title III and state statutes. In New Jersey, the list includes murder, kidnapping, gambling, robbery, bribery, aggravated assault, wrongful credit practices, terrorist threats, arson, burglary, felony thefts, escape, forgery, narcotics trafficking, firearms trafficking, racketeering, and organized crime.
Most wiretaps are large undertakings, requiring a substantial use of resources. In 1992, the average cost of installing intercept devices and monitoring communications was $46,492. Despite budget constraints and personnel shortages, law enforcement conducts wiretaps as necessary, but obviously, because of staffing and costs, judiciously.
2.1 Application for a Court Order
All government wiretaps require a court order based upon a detailed showing of probable cause. To obtain a court order, a three-step process is involved. First, the law enforcement officer responsible for the investigation must draw up a detailed affidavit showing that there is probable cause to believe that the target telephone is being used to facilitate a specific, serious, indictable crime.
Second, an attorney for the federal, state, or local government must work with the law enforcement officer to prepare an application for a court order, based upon the officer's affidavit. At the federal level, the application must be approved by the Attorney General, Deputy Attorney General, Associate Attorney General, any Assistant Attorney General, any acting Assistant Attorney General, or any Deputy Assistant Attorney General in the Criminal Division designated by the Attorney General. At the state and local level, the application must be made and approved by the principal prosecuting attorney of the state (State Attorney General) or political subdivision thereof (District Attorney or County Prosecutor). The attorney must be authorized by a statute of that state to make such applications.
Third, the attorney must present the approved application ex parte (without an adversary hearing) to a federal or state judge who is authorized to issue a court order for electronic surveillance. A state or local police officer or federal law enforcement agent cannot make an application for a court order directly to a judge.
Typically, a court order is requested after a lengthy investigation and the use of a "Dialed Number Recorder" (DNR). The DNR is used to track the outgoing calls from the suspect's phone in order to demonstrate that the suspect is communicating with known criminals.
Title III requires that an application for a court order specify:
(a) the investigative or law enforcement officer making the application and the high-level government attorney authorizing the application;
(b) the facts and circumstances of the case justifying the application, including details of the particular offense under investigation, the identity of the person committing it, the type of communications sought, and the nature and location of the communication facilities;
(c) whether or not other investigative procedures have been tried and failed or why they would likely fail or be too dangerous;
(d) the period of time for the interception (at most 30 days - extensions may be permitted upon reapplication);
(e) the facts concerning all previous applications involving any of the same persons or facilities;
(f) where the application is for the extension of an order, the results thus far obtained from the interception.
The process of making an application for a court order is further restricted by internal procedures adopted by law enforcement agencies to ensure that wiretaps conform to the laws and are used only when justified. The following describes the process for the FBI and the New York State Police.
2.1.1 FBI Applications
In order for an FBI agent to conduct an interception, the agent must follow procedures that go well beyond the legal requirements imposed by Title III and which involve extensive internal review. In preparing the affidavit, the FBI agent in the field works with the field office principal legal advisor and also with an attorney in the local U.S. Attorney's Office, revising the documentation to take into account their comments and suggestions. After the documents are approved by field office management, they are submitted to the Department of Justice's Office of Enforcement Operations (OEO) in the Criminal Division and to the FBI Headquarters (HQ). At FBI HQ, the documents go to the Legal Counsel Division (LCD) and the Criminal Investigative Division (CID). Within the CID, they are sent to the program manager of the criminal program unit relating to the type of violation under investigation, e.g., organized crime. The program manager determines whether the subjects of the proposed interception are worthy targets of investigation and whether the interception is worth doing. Attorneys in the FBI's LCD and the DOJ's OEO further refine the documents.
After the documents are approved by the DOJ's OEO and by FBI HQ, they are referred to the Deputy Assistant Attorney General (or above), who reviews the documents and signs off on them. At this point, the DOJ authorizes the local U.S. Attorney's Office to file the final version of the documents (application, affidavit, court order, and service provider order) in court. The U.S. Attorney's Office then submits the documents and the DOJ authorization to a federal judge. The entire process can take as long as a month.
The following summarizes the people and organizations involved in the preparation or approval of the application and the issuance of a court order:
1. FBI agent 2. FBI field office attorney (principal legal advisor) 3. FBI field office management 4. Attorney in local U.S. Attorney's office 5. DOJ Office of Enforcement Operations (OEO) 6. FBI HQ Legal Counsel Division (LCD) 7. FBI HQ Criminal Investigative Division (CID) 8. DOJ Deputy Assistant Attorney General (or higher) 9. Federal District Court judge
2.1.2 New York State Police Applications
Within the New York State Police, electronic surveillance is conducted by Senior Investigators in the Bureau of Criminal Investigation (BCI). In preparing an affidavit, the investigator works with the District Attorney's Office (or, in the case of a federal investigation, the U.S. Attorney's office) and with the BCI Captain of the investigator's troop. (Wiretap applications can be made and approved by the State Attorney General, but this is unusual.) The Captain assesses whether review by Division Headquarters is necessary and confers with the Assistant Deputy Superintendent (ADS) or Headquarters Captain for final determination. If Headquarters review is deemed necessary, then all documentation is sent to the ADS along with a memorandum, endorsed by the Troop Unit Supervisor and the Troop or Detail Commander, requesting approval. If Headquarters review is deemed unnecessary, then the memo is sent without the documentation. Once the ADS and District Attorney (DA) approve the application, the DA submits the application to a judge who grants or denies the court order.
2.2 Issuance of a Court Order
Not all judges have the authority to grant court orders for wiretaps. In New Jersey, for example, only eight judges are designated as "wiretap judges" for the entire state. These judges are given special training to be sensitive to personal rights of privacy and to recognize the importance of telephone intercepts for law enforcement.
Before a judge can approve an application for electronic surveillance and issue a court order, the judge must determine that:
(a) there is probable cause for belief that an individual is committing, has committed, or is about to commit an offense covered by the law;
(b) there is probable cause for belief that particular communications concerning that offense will be obtained through such interception;
(c) normal investigative procedures have been tried and have failed or reasonably appear unlikely to succeed or to be too dangerous;
(d) there is probable cause for belief that the facilities from which, or the place where the communications are to be intercepted are being used, or are about to be used, in connection with the commission of such offense, or are leased to, listed in the name of, or commonly used by such person.
In addition to showing probable cause, one of the main criterion for determining whether a court order should be issued is whether normal investigative techniques have been or are likely to be unsuccessful (criterion (c) above). Electronic surveillance is a tool of last resort and cannot be used if other methods of investigation could reasonably be used instead. Such normal investigative methods usually include visual surveillance, interviewing subjects, the use of informers, telephone record analysis, and DNRs. However, these techniques often have limited impact on an investigation. Continuous surveillance by police can create suspicion and therefore be hazardous; further, it cannot disclose the contents of telephone conversations. Questioning identified suspects or executing search warrants at their residence can substantially jeopardize an investigation before the full scope of the operation is revealed, and information can be lost through interpretation. Informants are useful and sought out by police, but the information they provide does not always reveal all of the players or the extent of an operation, and great care must be taken to ensure that the informants are protected. Moreover, because informants are often criminals themselves, they may not be believed in court. Telephone record analysis and DNRs are helpful, but do not reveal the contents of conversations or the identities of parties. Other methods of investigation that may be tried include undercover operations and stings. But while effective in some cases, undercover operations are difficult and dangerous, and stings do not always work.
If the judge approves the application, then a court order is issued specifying the relevant information given in the application, namely, the identity of the person (if known) whose communications are to be intercepted, the nature and location of the communication facilities, the type of communication to be intercepted and the offense to which it relates, the agency authorized to perform the interception and the person authorizing the application, and the period of time during which such interception is authorized. A court order may also require that interim status reports be made to the issuing judge while the wiretap is in progress.
2.3 Emergencies
In an emergency situation where there is immediate danger of death or serious physical injury to any person, or conspiratorial activities threatening national security or characteristic of organized crime, Title III permits any investigative or law enforcement officer specially designated by the Attorney General, the Deputy Attorney General, or the Associate Attorney General, or by the principal prosecuting attorney of any state or subdivision thereof, to intercept communications provided an application for a court order is made within 48 hours. In the event a court order is not issued, the contents of any intercepted communication is treated as having been obtained in violation of Title III.
In New York State, even an emergency situation requires a court order from a judge. However, the judge may grant a temporary court order based on an oral application from the District Attorney. The oral communication must be recorded and transcribed, and must be followed by a written application within 24 hours. The duration of a temporary warrant cannot exceed 24 hours and cannot be renewed except through a written application.
2.4 Execution of a Court Order
2.4.1 Installation of a Wiretap
To execute a court order for a wiretap, the investigative or law enforcement officer takes the court order or emergency provision to the communications service provider. Normally, the service provider is the local exchange carrier. When served with a court order, the service provider (or landlord, custodian, or other person named) is mandated under Title III to assist in the execution of the interception by providing all necessary information, facilities, and technical assistance. The service provider is compensated for reasonable expenses incurred. In light of rapid technological developments including cellular telephones and integrated computer networks, the New Jersey statute also requires the service provider to give technical assistance and equipment to fulfill the court order. This requirement has not yet been tested in court.
Normally, the government leases a line from the service provider and the intercepted communications are transmitted to a remote government monitoring facility over that line. In many cases, the bridging connection is made within the service provider's central office facility. Alternatively, a law enforcement agency may request the service provider to give the "pairs and appearances" (a place to connect to the suspect's line) in the "local loop" for the suspect's phone. A law enforcement technician then makes the connection.
When a suspect's telephone is subject to change (e.g., because the person is attempting to evade or thwart interception), then a "roving" wiretap, which suspends the specification of the telephone, may be used. In this case, prior to intercepting communications, the officer must use some other method of surveillance in order to determine the exact location and/or telephone number of the facility being used. Once determined, the location or telephone number is given to the service provider for coordination and prompt assistance. The officer may not intercept communications randomly in order to track a person (random or mass surveillance is not permitted under any circumstances).
2.4.2 Minimization
Once any electronic surveillance begins, the law enforcement officer must "minimize" -- that is, attempt to limit the interception of communications to the specified offenses in the court order. Prior to the surveillance, a federal or state attorney holds a "minimization meeting" with the investigators who will be participating in the case to ensure that the rules are followed.
Minimization is normally accomplished by turning off the intercept and then performing a spot check every few minutes to determine if the conversation has turned to the subject of the court order. This avoids picking up family gossip. Special problems may arise where criminals communicate in codes that are designed to conceal criminal activity in what sounds like mundane household discussion. If an intercepted communication is in a code or foreign language, and if someone is not reasonably available to interpret the code or foreign language, then the conversation can be recorded and minimization deferred until an expert in that code or language is available to interpret the communication. Should a wiretap fail to meet the minimization parameters, all of the evidence obtained from the wiretap could be inadmissible.
2.4.3 Recording
All intercepted communications are to be recorded when possible. As a practical mater, law enforcement officers make working copies of the original tapes. In many instances at the state and local level, the originals are delivered to the prosecutor's office and maintained in the prosecutor's custody. The copies are screened by the case officer for pertinent conversations (e.g., "I'll deliver the dope at 8:00 pm."). A compilation of the relevant conversations, together with the corroboratory surveillances often provides the probable cause for search warrants and/or arrest warrants.
2.4.4 Termination of Electronic Surveillance
Electronic surveillance must terminate upon attainment of the objectives, or in any event within 30 days. To continue an interception beyond 30 days, the officer, through a government attorney, must apply for and be granted an extension based upon a new application and court order.
When the period of a court order, or extension thereof, expires, the original tapes must be made available to the issuing judge and sealed under court supervision. The tapes must be maintained in such fashion for 10 years.
2.5 Notification and Use of Intercepted Communications as Evidence
Upon termination of an interception, the judge who issued the court order must notify the persons named in the order that the interception took place. Normally, this must be done within 90 days, but it may be postponed upon showing of good cause. If the judge determines that it would be in the interest of justice to make portions of the intercepted communications available to the subjects, the judge may do so.
The contents of the communications may not be used as evidence in any trial or hearing unless each party has received a copy of the application and court order at least 10 days in advance of the trial, and has been given the opportunity to move to suppress the evidence. A motion to suppress the evidence may be made on the grounds that it was not obtained in complete conformance with the laws.
2.6 Reports
Within 30 days after the expiration or denial of a court order, Title III requires that the judge provide information about the order to the Administrative Office of the United States Courts (AO). Each year the Attorney General (or a designated Assistant Attorney General) must report, on behalf of the federal government, to the AO a summary of all orders and interceptions for the year; reports for state and local jurisdictions are made by the principal prosecuting attorney of the jurisdiction. The AO then integrates these summaries into an annual report: "Report on Applications for Orders Authorizing or Approving the Interception of Wire, Oral, or Electronic Communications (Wiretap Report)" covering all federal and state electronic surveillance, including wiretaps. The 1992 report is about 200 pages and includes information about each interception authorized in 1992, update information for interceptions authorized in 1982-1991, and summary statistics. The summary statistics include the following data (numbers in parenthesis are the 1992 figures):
(1) number of interceptions authorized (919), denied (0), and installed (846)
(2) average duration (in days) of original authorization (28) and extensions (30)
(3) the place/facility where authorized (303 single family dwelling, 135 apartment, 3 multi-dwelling, 119 business, 4 roving, 66