FC: Debate over warrantless Carnivore bill with Stu Baker

Stewart Baker is the former general counsel to the National Security Agency and now a partner at the Washington law firm of Steptoe and Johnson: http://www.steptoe.com/WebBio.nsf/biographies/Stewart+A.+Baker?OpenDocument http://www.mccullagh.org/image/10/stewart-baker.html Below is a few rounds of a debate we had on Dave Farber's IP list in response to my article ("Senate votes to permit warrantless Net-wiretaps, Carnivore use"): http://www.wired.com/news/politics/0,1283,46852,00.html -Declan **********

To: "'farber@cis.upenn.edu'" cc: "Albertazzie, Sally" Subject: RE: Senate votes to permit warrantless Net-wiretaps, Carnivore us e Date: Fri, 14 Sep 2001 19:28:17 -0400

This seems a bit alarmist. The FBI has long had the authority to get the phone numbers that are called from or that call to a suspect's phone. These are trap-and-trace and pen-register orders. The Justice Department has generally taken the position that the Internet equivalent of such data is the addressing information in emails. This bill would enshrine the Justice Department position in law -- without changing the warrant requirements or the predicate for getting such Internet pen register data. It's not that big a change from the status quo. I would guess that, even without the law, Justice would have about a 60-40 or even 70-30 chance of winning its argument in court.

In my view there are some reasons to be uneasy about the bill but not frothing.

First, the to and from lines on my emails (plus the URLs I visit) are in fact more intimate information than the phone numbers I call. What's more, I'm already on notice that the phone numbers aren't all that private -- they're used to bill me, after all. Not true for URLs or "to" lines. Once that data is gathered by the police(on a very easy standard, I agree), it may never be thrown out, and lots of people can access it. So extending police authority to such data ought to be the occasion for thinking creatively about how to discipline the use of that authority. If I were writing the bill, I'd let the police gather such data, but I'd do more to audit the people who access it and require prosecutors to notify people after the fact that they've been targeted for surveillance (unless that would blow an ongoing investigation). As things stand, the only people who find out about such surveillance and thus get a chance to challenge it are criminal defendants. Isn't that just backwards? I mean, who came up with a system in which crooks may go free because their privacy was violated while innocent people who've suffered the same violation never have a remedy?

Second, most ISPs would like to see an assurance that Carnivore won't be used if they have their own systems that can accomplish the same thing, or that they'll be indemnified for any damage Carnivore might do to the system.

In short, we may be missing some opportunities to improve privacy law, but it's hard to say that the privacy sky is falling.

Stewart

**********