1

The Law Enfoicement Suiveillance

Repoiting uap
ChristopherSoghoian
i

[DraftVersion1.1:Pleasesendfeedbacktochris@soghoian.net]
[T]hereareknownknowns;therearethingsweknowweknow.
Wealsoknowthereareknownunknowns;thatistosayweknowtherearesomethingswedo
notknow.

DonaldRumsfeld,UnitedStatesSecretaryofDefense,February12,2002.

SectionI:Introduction

Wiretaps,atleastInHollywood,ofteninvolveFBIagentshidinginanunmarkedvanoutsideasuspects
home,crouchedoverasetofheadphones,astheylistentotelephonecallstakingplaceinside.
1

Similarly,theseizureofdigitalevidenceofteninvolvesapredawnraidbyateamofarmedagents,who

i
GraduateFellow,CenterforAppliedCybersecurityResearch,PhDCandidate,SchoolofInformaticsand
Computing,IndianaUniversity.Email:chris@soghoian.net.Otherresearchpapersavailableat
http://www.dubfire.net.ThankstoKevinBankston,FredCate,CatherineCrump,AlGidari,PaulOhm,Julian
SanchezandPaulSchwartz.
2011ChristopherSoghoian.TheauthorherebypermitstheuseofthisarticleunderthetermsoftheCreative
CommonsAttribution3.0UnitedStateslicense,thefulltermsofwhichareavailableat
http://creativecommons.org/licenses/by/3.0/us/legalcode.
1
WhitfieldDiffie&SusanLandau,Communicationssurveillance:PrivacyandSecurityatRisk,52COMMUNICATIONSOF
THEACM42(2009),(lastvisitedMar6,2011)(Weallknowthescene:Itisthebasementofanapartment
buildingandthelightsaredim.Themaniswearingatrenchcoatandafedorapulleddownlowtohidehisface.
Betweenthehatandthecoatweseeheadphones,andheappearstobelisteningintentlytotheoutputofaset
ofalligatorclipsattachedtoaphoneline.Heisadetectiveeavesdroppingonasuspectsphonecalls.Thisis
wiretappingasitwasinthefilmnoireraof1930sHollywood.Itdoesnthavemuchtodowithmodern
electroniceavesdropping,whichisaboutbits,packets,switches,androuters.)
2

lateremergefromthetargetshomewithcomputers,documentsandvarioustypesofstoragemedia.In
themovies,lawenforcementagentsobtaintheevidencethemselves,usuallyatgreatpersonalrisk.
2

Whiletheseinvestigativemethodslookgreatonthebigscreen,theyarelargelyarelicofthepastfrom
anerabeforemoderntelecommunicationsproviders,cloudcomputingandmobilephones.Thesedays,
thepoliceorFBIcanobtainmostofthedatatheyneedfromthecomfortandsafetyoftheirowndesks,
withafewclicksofamouse,afax,oraphonecalltoatelecommunicationsorInternetserviceprovider.
3

Theactualcollectionofevidenceisnowincreasinglyperformedbythesamecompaniesthatconsumers
relyontotransmitandstoretheirphonecalls,emailsanddocuments.
Considerthefollowingsourcesofinformationthatareusedinmodernlawenforcementinvestigations:
Wiretapsandelectroniccommunicationsintercepts,storedemails,instantmessages,webbrowsing
historyandsearchenginerecords,aswellasgeolocationinformationfrommobilephones,both
historicalandrealtime.Allofthesearedeliveredtothegovernmentbythirdpartyserviceproviders.
Lawenforcementagentsplaylittletonoroleinactuallyacquiringthedata.Theysimplysubmitthe
nameorphonenumberofasuspectandthenwaitforthecompanytodeliveritscustomersprivate
files.
Thirdpartyfacilitatedsurveillancehasbecomearoutinetoolforlawenforcementagencies.
4
Thereare
likelyhundredsofthousandsofsuchrequestsperyear.Unfortunatelytherearefewdetailedstatistics
documentingtheuseofmanymodernsurveillancemethods.Assuch,thetruescaleoflawenforcement
surveillance,althoughwidespread,remainslargelyshieldedfrompublicview.
PriortothewidespreadadoptionoftheInternetandmobilephones,lawenforcementagenciesuseof
thirdpartyfacilitatedelectronicsurveillancewaslargelylimitedtorealtimeinterceptionof
communicationscontent(wiretapping)andnoncontentdata(throughtheuseofpenregisterand
trapandtraceorders).Inordertoincreaseitsabilitytoperformeffectiveoversight,Congress

2
INSOFTLEY,HACKERS(MGM(Video&DVD))(1998)
3
USv.PinedaMoreno,617F.3d1120CourtofAppeals,9thCircuit2010.DissentbyKozinskiat1126(When
requestsforcellphonelocationinformationhavebecomesonumerousthatthetelephonecompanymust
developaselfservicewebsitesothatlawenforcementagentscanretrieveuserdatafromthecomfortoftheir
desks,wecansafelysaythatsuchdragnettypelawenforcementpractices"arealreadyinuse.)
4
See,e.g.,SaulHansel,OnlineTrailCanLeadtoCourt,N.Y.TIMES,Feb.4,2006,atC6(Whoissending
threateningemailtoateenager?WhoissayingdisparagingthingsaboutacompanyonanInternetmessage
board?Whoiscommunicatingonlinewithasuspecteddrugdealer?Thesequestions,andmanymorelike
them,areaskedeverydayofthecompaniesthatprovideInternetserviceandrunWebsites.Andeventhough
thesecompaniespromisetoprotecttheprivacyoftheirusers,theyroutinelyhandoverthemostintimate
informationinresponsetolegaldemandsfromcriminalinvestigatorsandlawyersfightingcivilcases...
RequestsforinformationhavebecomesocommonthatmostbigInternetcompanies,aswellastelephone
companies,haveaformalprocessforwhatisoftencalledsubpoenamanagement.Mostoftheinformation
soughtaboutusersisbasic,butverypersonal:theirnames,wheretheylive,whentheywerelastonlineand,
ifacourtissuesasearchwarrant,whattheyarewritingandreadingintheiremail.).(emphasisadded)
3

mandatedthatannualreportsbecreateddocumentingtheuseofthesesurveillancepowers.These
reportsareintendedtoenablepolicymakersaswellasthegeneralpublictodeterminetheextentto
whichsuchsurveillancemethodsareused,andinthewordsofSenatorPatrickLeahy,provideafar
morereliablebasisthananecdotalevidenceonwhichtoassesslawenforcementneedsandmake
sensiblepolicyinthisarea.
5

Theexistingsurveillancestatisticsmightbesufficientiflawenforcementagenciessurveillanceactivities
werelimitedtowiretapsandpenregisters.However,overthelastdecade,lawenforcementagencies
haveenthusiasticallyembracedmanynewsourcesofinvestigativeandsurveillancedataforwhichthere
arenomandatoryreportingrequirements.Asaresult,mostmodernsurveillancenowtakesplace
entirelyoffthebooksandthetruescaleofsuchactivities,whichvastlyoutnumbertraditionalwiretaps
andpenregisters,remainsunknown.
6

Thisarticlewillproceedasfollows.SectionIIexaminestheexistingelectronicsurveillancereporting
requirementsandthereportsthathavebeencreatedasaresult.Someofthesehavebeenreleasedto
public,butmanyhaveonlycometolightasaresultofFreedomofInformationActrequestsorleaksby
governmentinsiders.SectionIIIexaminesseverallawenforcementsurveillancemethodsforwhichthere
arenoexistinglegallymandatedsurveillancereports.Finally,sectionIVproposesspecificlegislative
reportingrequirementsinordertoenablesomereasonabledegreeofoversightandtransparencyover
allformsoflawenforcementelectronicsurveillance.

5
145Cong.Rec.31,311(1999)(statementofSen.Leahy).
6
AccordingtoalettersentbyaVerizonexecutivetomembersofCongressin2007,thecompanyreceives
approximately90,000requestsfromlawenforcementagencieseachyear.See:RandalS.Milch,Sr.VicePres.,
VerizonBus.,toJohnD.Dingell,EdwardJ.Markey&BartStupak,U.S.Reps(Oct.12,2007),availableat
http://markey.house.gov/docs/telecomm/Verizon_wiretaping_response_101207.pdf.Contrastthistothe
approximately12,500penregisterand11,000trapandtraceordersobtainedin2009byagencieswithinthe
DepartmentofJustice(see:http://files.spyingstats.com/prtt/dojhighlevelprtt2009.pdf)andthe
approximately2300wiretapordersissuednationwidein2009(See:
http://www.uscourts.gov/uscourts/Statistics/WiretapReports/2009/Table2.pdf).
4

TableofContents
SectionI:Introduction..................................................................................................................................1
SectionII:Surveillancemethodsforwhichthereareofficialreports..........................................................5
Electronicintercepts(wiretaps)............................................................................................................5
Analysisofexistingreports...................................................................................................................6
Noncontentintercepts(penregistersandtrapandtracedevices)................................................13
Analysisofexistingreports.................................................................................................................15
Emergencyvoluntarydisclosures...........................................................................................................17
Analysisofexistingreports.................................................................................................................18
SectionIII:Unreportedsurveillancemethods............................................................................................19
Requeststoserviceprovidersforstoredcommunicationsandsubscriberrecords..............................20
Surveillanceofwirelesslocationinformation.........................................................................................22
SectionIV:Closingthesurveillancereportinggap.....................................................................................24
SectionV:Conclusion..................................................................................................................................25

SectionII:Surveillancemethodsforwhichthereareofficialreports

Althoughlawenforcementagencieshavemanyelectronicsurveillancepowers,officialreportsonlyexist
forafewtypes,primarilythosethatrelatetotherealtimeinterceptionofdata.Thissectionwillexplore
eachoftheselawenforcementsurveillancepowersandexaminespecifictrendsdetailedinthereports.

Electronicintercepts(wiretaps)

In1968,afteraseriesofhighprofileSupremeCourtdecisions,
7
Congressestablishedfederalrules
governingtheuseofrealtimeelectronicintercepts(wiretaps).
8
Thislaw,theOmnibusCrimeControl
andSafeStreetsAct,alsorequiredtheAdministrativeOfficeoftheUSCourtstocompileandsubmitto
Congressdetailedannualreportsontheuseofwiretapsandotherformsofelectronicsurveillanceby
lawenforcementagencies.
9
Thelegislativehistorystatesthat:
[Thewiretapreports]areintendedtoformthebasisforapublicevaluationofitsoperation.The
reportsarenotintendedtoincludeconfidentialmaterial.Theyshouldbestatisticalin
character[they]willassurethecommunitythatthesystemofcourtorderelectronic
surveillanceenvisionedbytheproposedchapterisproperlyadministeredandwillprovidea
basisforevaluatingitsoperation.
10

7
Seegenerally:Bergerv.NewYork,388U.S.41(1967)andKatzv.UnitedStates,389U.S.347(1967).
8
Surveillancestatisticsplayedanimportantroleinthepassageofthisfirstwiretappinglaw.Supportersof
enhancedlawenforcementpowersarguedthatexistingstatewiretappingauthoritywasneitherwidelyusednor
abused.Forexample,thelegislativehistorynotesthat:
Whenthefactsarebroughttolight,statisticsshowthatextremelyfewtelephonesaretappedbylaw
enforcementofficersandthatevenfewerelectronicsurveillancedevicesareinstalledInitsreportthe
[NewYorkStatelegislative]committeeexplicitlydeclaredthatnoabuseswhateverbyanydistrict
attorneyhadbeenfoundintheuseofthewiretappingprivilegeLawenforcementofficerssimplyhave
toomuchtodotobelisteninginonconversationsoflawabidingcitizens.Availablemanpowerjustdoes
notpermitsuchabuse.Itisidletocontendotherwise.(see:S.REP.901097,S.Rep.No.1097,90THCong.,
2NDSess.1968,1968U.S.C.C.A.N.2112,1968WL4956(Leg.Hist.))
9
Theseotherformsofelectronicsurveillanceincludehiddenmicrophones(bugs).Assuchsurveillanceis
performeddirectlybylawenforcementagencieswithouttheassistanceofthirdparties,theyarebeyondthe
scopeofthisarticle.
10
S.REP.901097,S.Rep.No.1097,90THCong.,2NDSess.1968,1968U.S.C.C.A.N.2112,1968WL4956(Leg.Hist.)
6

Thereportsareextremelydetailed,andforeachwiretap,revealsthecityorcounty,thekindof
interception(phone,computer,pager,fax),thenumberofindividualswhosecommunicationswere
intercepted,thenumberofinterceptedmessages,thenumberofarrestsandconvictionsthatresulted
fromtheinterception,aswellasthefinancialcostofthewiretap.
11

Byallindications,theAdministrativeOfficeoftheUSCourtshasdoneagoodjobinmakingsurethatthe
reportsareaccurateandsubmittedtoCongressinatimelymanner,andhasevendrawnpraisefrom
Congressfordoingso.
12
Sinceatleast1998,theAdministrativeOfficehasalsomadecopiesofthese
reportsavailabletothegeneralpublicviaitswebsite.
13
Assuch,thereleaseoftheannualreportusually
leadstomediacoverageregardingtheincreaseduseofwiretaps.
14

Analysisofexistingreports

TheAdministrativeOfficeoftheCourtshaspublishedreportsfortheyears1997tothepresent.
15
By
comparingthesereports,severalinterestingtrendscanbeseenregardingtheuseofthissurveillance
powerbyfederalandstatelawenforcementagencies.

Wiretaprequestsareincreasing,butrarelyrejectedbythecourts

Between1987and2009,lawenforcementagenciesrequestedover30,000wiretaporders.Requests
haveincreasedeachyear:In1987,therewere637wiretapordersrequestednationwide;tenyearslater,
thenumberincreasedto1186;in2009,themostrecentyearforwhichreportsexist,2376wiretaps
wererequested.

11
18U.S.C.2519(2)(3)(2006)(outliningwhattheinterceptedcommunicaonsreportissuedbythe
AdministrativeOfficeoftheUnitedStatesCourtsmustcontain).
12
145Cong.Rec.31,311(1999)(statementofSen.Leahy)(TheAOhasdoneanexcellentjobofpreparingthe
wiretapreports.).
13
http://web.archive.org/web/19981206135425/www.uscourts.gov/wiretap/contents.html
14
NationalNewsBriefs;RecordTotalofWiretapsWasApprovedbyCourts,THENEWYORKTIMES,May.10,1998,
http://www.nytimes.com/1998/05/10/us/nationalnewsbriefsrecordtotalofwiretapswasapprovedby
courts.html(lastvisitedApr3,2011);SusanStellin,CompressedData;WhosWatching?No,Who'sListening
In?,THENEWYORKTIMES,Jun.3,2002,http://www.nytimes.com/2002/06/03/business/compresseddatawhos
watchingnowhoslisteningin.html(lastvisitedApr3,2011);
http://www.wired.com/threatlevel/2010/04/wiretapping/,
15
See:http://www.uscourts.gov/Statistics/WiretapReports.aspx
7

Duringthemorethan20yearsforwhichpublicdataexists,requestsforwiretapordershavebeen
rejectedjust7times,twicein1998,oncein1996,twicein1998,oncein2002andoncein2005.
Similarly,duringthelastdecade,courtsrequiredthat580requestsbemodifiedbeforegrantingthem.
16

Thelownumberofrejectionsisnotparticularlyencouraging,andseemstosuggestthatthecourtsare
essentiallyrubberstampingwiretaporders.Similarly,the2
nd
CircuitCourtofAppealsrecentlycited
thealmost100%approvalrateoftheForeignIntelligenceSurveillanceCourt(FISC)insuggestingthat
thereisinsufficientoversightofsuchsurveillance.
17
Ontheotherhand,anumberofformerfederal
prosecutorsthatIvespokentoclaimthatthehighapprovalratesforwiretapandFISAsurveillancelikely
reflectthevigorousinternalqualitycontrolswithintheDepartmentofJustice.
18
Assumingthatthis
theoryiscorrect(somethingIcannotindependentlyverify),itisunclearifsimilarcontrolsexistwithin
stateattorneysgeneral,eventhoughstatecourtsalsorarelyrejectwiretapapplications.

Wiretapsprimarilytargetmobilephones

Overthepastdecade,thenumberofwiretapsinvolvingfixedlocations(suchashomesorbusinesses)
hasdeclinedinfavorofinterceptsofmobilephones.Forexample,96percent(2,276wiretaps)ofallau
thorizedwiretapfor2009areforportabledevices.
19
Asdescribedearlier,thenumberofwiretapshas

16
Between1997and2001,courtsmodified8interceptorderseachyearbeforegrantingthem.In2002,that
numberincreasedto94,andhasstayedabove45inalloftheyearsthatfollowed.Itisunclearwhathappened
in2002thatresultedinthisexponentialincreaseinmodifiedrequests.
17
AmnestyInternationalUSAv.Clapper,http://www.aclu.org/files/assets/094112_opn.pdfatpage42.(The[FISA
AmendmentsAct]doesnotrequireorevenpermittheFISCtomakeanindependentdeterminationofthe
necessityorjustificationforthesurveillanceEmpiricalevidencesupportsthisexpectation:In2008,the
governmentsought2,082surveillanceorders,andtheFISCapproved2,081ofthem.Wedonotknowhow
manyoftheseapplications,ifany,cameaftertheFAAwasenactedonJuly10,2008.)
18
EmailfromProfessorPaulOhmtoChristopherSoghoian,April8,2011,onfilewithauthor(Yes.Ican'tvouchfor
whathappensatthestatelevel(excepttonotethatinmanystates,wiretapsarerarelyused),butatthe
federallevel,allproposedwiretapordersmustbeapprovedbytheOfficeofEnforcementOperations(OEO)at
MainJusticebeforetheycanbesubmittedtoacourt.Inmyexperience,lineattorneysinthefieldconsiderthe
OEOtobeasignificanthurdle,becausetheyhavelearnedthatOEOwillreturnanyproposedwiretappingorder
thatfailstoscrupulouslyliveuptoTitleIII'sstandards.IbelieveitisroutinetoneedtoreturntoOEOwith
severalsuccessivedraftsofaproposedorder,witheachdraftbearinganarrowerscopethantheonebefore.);
anotherformerfederalprosecutorechoedthesamepoint,butwouldnotgoontherecord.
19
Seehttp://www.uscourts.gov/uscourts/Statistics/WiretapReports/2009/2009Wiretaptext.pdf
8

goneupeachyearoverthepastfewdecades.However,thestatisticssuggestthatthisincreaseis
entirelyduetoincreasesinthenumberofmobiledevicesmonitored.
20

Thereareseveralfactorsthatmayexplainthistrend.First,oursocietyhasincreasinglycutthecord
andembracedmobilephones.
21
Itisunderstandablethatlawenforcementagencieshavefollowedtheir
targetstothisnewtechnology.Thistrendisevenstrongeramongyoungpeopleandthepoor,bothof
whomaregenerallymorelikelytobesubjecttoinvestigationbythegovernment.Second,itisfareasier
towiretapmobiledevices.Suchinterceptscanbeperformedfromthecomfortofadesk,ratherthan
requiringthataphonecompanyemployeevisitaremoteofficeorexchangeinordertointerceptthe
line.Thereasonforthisdifferenceisthatamajorityoftraditionalwirelinetelephoneswitchesdonot
supportmoderninterceptiontechnologies,incontrasttowirelessswitches,allofwhichsupportsuch
interceptioncapabilities.
22

Rovingauthorityisrarelyused

Lawenforcementagenciescanobtainspecialrovinginterceptordersiftheycandemonstrate
probablecausetobelievethatthetargetisactivelythwartinginterceptionataspecificlocation,
23
such
asbyusingandabandoninglowcostmobilephones(burners).
24
Althoughgovernmentofficialsoften

20
In1997,thefirstyearthatreportsareavailableontheweb,therewere382residentialwiretaps,78atplacesof
business,185combinationorders(formultiplelocations),and529other(whichpresumablyincludedearly
mobiledevices).By2001,theadministrativeofficeofthecourtscreatedanewseparatecategorytotrack
mobiledevices.Bythattime,therewerejust206residentialwiretaps,60atplacesofbusiness,117
combinationorders,andjust83other.Therewerehowever,1007portabledevicesmonitoredthatyear.
Nearlyadecadelater,in2009,therewerejust19residential,10atplacesofbusiness,55combinationorders
and13other.
21
PewInternetandAmericanLifeProject,ACloserLookatgenerationsandcellphoneownership,February3,
2011,availableathttp://www.pewinternet.org/Infographics/2011/Generationsandcellphones.aspx(85%of
Americansage18orolderownacellphone,makingitbyfarthemostpopulardeviceamongadults.)
22
RyanSingel,DCS3000istheFBIsNewCarnivore,PostingtoThreatLevelBlog,availableat
http://www.wired.com/threatlevel/2006/04/dcs3000_is_the_/(Apr.17,2006,19:04)([S]ome80to90
percentofoldfashionedwirelinephoneswitchesareapparentlynotCALEAcompliant,whichmeansthefeds
stillhavetoperformthosetapstheoldfashionedway.ButeverywirelessswitchinthecountryisCALEAready.
[and][o]ver80percentofinterceptsarenowtargetingwirelessphones).
23
18U.S.C.2518(11)(a)and(b).
24
TheWireEpisode4,season3at00:42:23(Theymakeacoupleofcallswithaburner,throwitaway.Goonto
thenextphone,dothesame.There'smoreofthosethingslayingaroundthestreetsofWestBaltimorethan
emptyvials.Well,howthefuckyousupposedtogetawireuponthat?Yeah,well,firstitwaspayphone
andpagers.Thenitwascellphonesandfacetofacemeets.Nowthis.Themotherfuckersdolearn.Everytime
wecomeatthem,theylearnandadjust.);JimDwyer,ItsNotJustDrugDealersWhoBuyPrepaidPhones,THE
NEWYORKTIMES,May.28,2010,https://www.nytimes.com/2010/05/30/nyregion/30about.html(lastvisitedApr
9

citetheuseofdisposablephonesbydrugdealers,
25
thewiretapreportsrevealthatrovingordersare
rarelysought.Overthepastthirteenyears,justover13rovingordersonaveragehavebeenissued
nationwideeachyear,withahighof27ordersissuedin2000,andalowof1orderissuedin2004.

Surveillanceandthewarondrugs

Thereportsrevealoneofthelesserknownsideeffectsofthewarondrugs:theexpansionofthe
surveillancestate.Thelatestreportrevealsthatmorethan86percentofthe2306wiretaporders
obtainedbyfederalandstatelawenforcementagenciesweresoughtinnarcoticsinvestigations.
26
The
nextlargestcategoriesarehomicide/assault,otherandracketeering,whichwereeachspecifiedin4
percent,3percentand3percent,respectively,ofapplications.Earlierreportsoverthelastdecade
confirmsimilarpercentages.
Thesenumbersarenottoosurprising,giventhattheearliestwiretappingcasesinvolvedgovernment
effortstoinvestigatebootleggers.
27
Whiletheparticulardrughaschanged,lawenforcement
surveillanceresourcesstillseemalmostentirelydedicatedtoenforcingprohibitions.

5,2011)(Lastfall,duringanarcoticsraidonanapartmentinAstoria,theauthoritiesfound22prepaid
cellphones,andplentyofcashtopayforthem:$133,000.AmongthenamespeopleinNewYorkCityhaveused
whenbuyingprepaidcellphonesareLadyGaga,KingKong,SugarLoveandJesusMom,accordingto
investigatorswiththeOfficeoftheSpecialNarcoticsProsecutor.)
25
SpeechbyPresidentGeorgeW.Bush,Buffalo,NY,April20,2004availableat
http://rawstory.com/news/2005/Bush_claimed_taps_required_warrants_in_1220.html(Butarovingwiretap
meansitwasprimarilyusedfordruglords.Aguy,aprettyintelligence[sic]druglordwouldhaveaphone,and
inolddaystheycouldjustgetataponthatphone.Soguesswhathe'ddo?He'dgethimanotherphone,
particularlywiththeadventofthecellphones.Andsohe'dstartchangingcellphones,whichmadeithardfor
ourDEAtypestolisten,torundowntheseguyspollutingourstreets.Andthatchanged,thelawchangedon
rovingwiretapswereavailableforchasingdowndruglords.);
26
See:http://www.uscourts.gov/uscourts/Statistics/WiretapReports/2009/Table3.pdf
27
Olmsteadv.UnitedStates,48S.Ct.564,277U.S.438(1928).
10

Wiretapsofcomputersandemail

Thewiretapreportsincludespecificcategoriesdescribingthelocationandtypeofinterceptorder.One
suchcategoryiscomputeroremail(electronic),whichreferstothoseordersusedtointerceptdatain
transittoacomputer.Thereportsrevealthatsince1997,federallawenforcementagencieshave
obtainedjust67suchinterceptordersand54havebeenissuedtothestatelawenforcementagencies.
Baseduponthesenumbers,itseemsprettyclearthatlawenforcementagenciesrarelyengageinreal
timeinterceptionofInternetcommunications,evenastheycontinuetoincreasetheiruseofmobile
telephonesurveillance.Atfirstblush,thisseemsrathercounterintuitive,giventhedegreetowhichour
societyhasbecomedependentuponemail,instantmessages,socialnetworksandotherInternetbased
communications.However,therearemanywaysforlawenforcementagenciestomonitorinternet
communications,
28
anditisofteneasierandcheapertodoitafterthefactratherthaninrealtime.
29
AsI
willexplainlaterinthisarticle,therearenoofficialstatisticsregardinglawenforcementacquisitionof
storedcommunicationsdata.

Incidentsofcryptographyencounteredincriminalinvestigations

Duringthelate90s,seniorlawenforcementofficialsrepeatedlycomplainedtoCongressthattheywere
goingdarkandlosingtheabilitytointerceptcommunicationsascriminalsembracedencryption
technologies.
30
RespondingtotheseclaimsandareportfromtheU.S.WorkingGrouponOrganized
Crime,
31
Congressamendedtheexistingwiretapreportingstatutein2000toincludestatisticsonthe
numberofinterceptordersinwhichencryptionwasencounteredandwhethersuchencryption
preventedlawenforcementfromobtainingtheplaintextofcommunications.
32
Theseencryption
reports,SenatorLeahyarguedatthetime,wouldbeafarmorereliablebasisthananecdotalevidence
onwhichtoassesslawenforcementneedsandmakesensiblepolicyinthisarea.

28
Thisisbecausenetworkcommunicationsareoftenretainedforlongperiodsoftime.Forexample,ifthepolice
donotwiretapatelephonecall,theywillnotbeabletoaccessitcontentatalaterdate.However,ifthepolice
donotinterceptanemailasitissentoverthenetwork,theycanalwaysgotothesuspectsemailproviderdays
orweekslatertoobtainacopyofit.
29
Regardingease:Interceptinganemailintransitrequiresasuperwarrant,butatmostaprobablecause
warrantonceithasbeenreceivedbytheusersISP.Withregardtocost:Asanexample,considerthatCox
Communicationscharges$2,500forapenregisterand$3,500forawiretap,whereasaccountinformationonly
costs$40.00.see:http://ww2.cox.com/aboutus/policies/leainformation.cox
30
StatementofLouisJ.Freeh,Director,FederalBureauofInvestigation,Beforethe,SenateJudiciaryCommittee,
July9,1997,availableathttp://epic.org/crypto/legislation/freeh_797.html,(Theloomingspectreofthe
11

Accordingtothesereports,duringthelastdecade,therehavebeenatotalof91instancesinwhich
encryptionwasencounteredduringafederalorstatewiretap,andnotasingleinstanceinwhichthe
encryptionpreventedlawenforcementofficialsfromobtainingtheplaintextofcommunications
intercepted.Furthermore,overthepast4years,thenumberofinstancesinwhichencryptionwas
encounteredhasplungedtolessthan2casesperyear.
33
Thesenumbersstronglycontradicttheearlier
claimsbylawenforcementofficialsregardingtheimpactofencryptiontechnology.
34

Year Stateandfederalwiretapsin
whichencryptionwas
encountered
Wiretapswhereencryptionprevented
officialsobtainingplaintextof
communications
2000 22 0
2001 34 0
2002 16 0
2003 1 0
2004 2 0

widespreaduseofrobust,virtuallyuncrackableencryptionisoneofthemostdifficultproblemsconfronting
lawenforcementasthenextcenturyapproaches...Lawenforcementisinunanimousagreementthatthe
widespreaduseofrobustnonkeyrecoveryencryptionultimatelywilldevastateourabilitytofightcrimeand
preventterrorism.Uncrackableencryptionwillallowdruglords,spies,terroristsandevenviolentgangsto
communicateabouttheircrimesandtheirconspiracieswithimpunity.);Seealso
http://www.wired.com/politics/law/news/2001/09/46816(JanetReno,Clinton'sattorneygeneral,saidin
September1999thatthenewregulationsstruckareasonablebalancebetweenprivacyandsecurity.When
stoppingaterroristattackorseekingtorecoverakidnappedchild,encounteringencryptionmaymeanthe
differencebetweensuccessandcatastrophicfailures.)
31
AreportbytheU.S.WorkingGrouponOrganizedCrimetitled,``EncryptionandEvolvingTechnologies:Toolsof
OrganizedCrimeandTerrorism,''releasedin1997,collectedanecdotalcasestudiesontheuseofencryptionin
furtheranceofcriminalactivitiesinordertoestimatethefutureimpactofencryptiononlawenforcement.The
reportnotedtheneedforanongoingstudyoftheeffectofencryptionandotherinformationtechnologieson
investigations,prosecutions,andintelligenceoperations.
32
PublicLaw106197amended18U.S.C.2519(2)(b)in2001torequirethatreportingshouldreflectthenumber
ofwiretapapplicationsgrantedinwhichencryptionwasencounteredandwhethersuchencryptionprevented
lawenforcementofficialsfromobtainingtheplaintextofthecommunicationsinterceptedpursuanttothe
courtorders.
33
See,WiretapReports,AdministrativeOfficeoftheCourts,20002009,availableat
http://www.uscourts.gov/Statistics/WiretapReports.aspx
34
Thisdoesnotmeanthatindividualsinvestigatedbylawenforcementagenciesarenotusingencryption.The
reportingrequirementsonlydocumentinstancesinwhichencryptionisencounteredduringinterceptorders,
not,forexample,duringthesearchofasuspectshome.Asexplainedlaterinthisarticle,lawenforcement
agenciesconductveryfewinterceptsofcomputersorInternettraffic,andsoitisnottoosurprisingthatthey
rarelyencounteringencryption.
12

2005 13 0
2006 0 0
2007 0 0
2008 2 0
2009 1 0

In2010,aspartofanewpushforsurveillancepowersincludingencryptionbackdoors,
35
TheFBItold
oneprivacyadvocatethatthepreviouslypublishedencryptionstatisticsweremistaken.Hewasalso
toldthatthataforthcomingreportwouldconfirmthatencryptionremainsaproblemforlaw
enforcementagencies.
36

Thenumberofwiretapsisincreasing,primarilyamongstatelawenforcementagencies

Overthelastdecade,theuseofelectronicsurveillanceordershasincreasednationwide,althoughthisis
largelyduetoamassiveincreaseinusebythestates.In1987,therewere237wiretapordersobtained
byfederallawenforcementagencies.Onedecadelater,in1997,therewere569,andby2009,thishad
increasedto663.Overthesetwentyyears,thenumberoffederalwiretapsfluctuated,butgenerally
increased.Incontrast,therewere437statewiretapsin1987,whichincreasedto617by1997.Itwasin
thedecadethatfollowedthatstatesreallyembracedthissurveillancemethod,asby2009,thenumber
jumpedto1713.
Whileallstateshaveincreasedtheiruseofwiretapsovertime,Californiahasembracedthistechnique
morethananyotherstate.In1997,Californialawenforcementagenciesrarelyusedwiretapsjust28
inthatyear.By2009,thenumberincreasedto586,whichisnowmorethananyotherstateinthe
country.Incontrast,NewYorklawenforcementagenciesobtained304wiretapordersin1997,which
graduallyincreasedovertheyearsto424ordersin2009.
Thesetwostatesarenowresponsibleforcombined58percentofallstatewiretaporders.Professor
PaulSchwartznotedasimilartrendseveralyearsago,andobservedthat[t]hispatternofuseislikely

35
CharlieSavage,U.S.TriestoMakeItEasiertoWiretaptheInternet,THENEWYORKTIMES,Sep.27,2010,
https://www.nytimes.com/2010/09/27/us/27wiretap.html?_r=1(lastvisitedApr3,2011)(Essentially,officials
wantCongresstorequireallservicesthatenablecommunicationstobetechnicallycapableofcomplyingif
servedwithawiretaporder.Themandatewouldincludebeingabletointerceptandunscrambleencrypted
messages.)
36
http://arstechnica.com/techpolicy/news/2010/09/fbidriveforencryptionbackdoorsisdejavuforsecurity
experts.ars(JimDempsey,theWestCoastdirectoroftheCenterforDemocracyandTechnology,told
Wired.comthattheFBIisnowsayingthatthenumbersaremistakenandthey'llissuenewonesinthe
spring.)
13

independentofcrimepatterns,butratherreflectslocallawenforcementpracticenorms,including
prosecutorialfamiliaritywiththecomplexsetoflegalrequirementsforobtainingwiretaporders.
37

Noncontentintercepts(penregistersandtrapandtracedevices)

Penregisterandtrapandtracedevicesareusedbylawenforcementagenciestoobtainnoncontent
communicationsrecordsinrealtime,suchasphonenumbersdialed,toandfrominformation
associatedwithemailmessagesandtheIPaddressesofcomputerstowhichasuspectconnects.With
thePassageofthePenRegisterActin1986,Congressrequiredthatannualstatisticalreportsontheuse
ofthissurveillancemethodbecompiledandsubmittedbytheAttorneyGeneral.
38
Thesereporting
requirementsweresubsequentlyexpandedin2000.
39
Describinghisreasonsforproposingthebillthat
successfullyexpandedthereportingrequirements,SenatorLeahystatedthat:
AstheoriginalsponsorofECPA,Ibelievedthatadequateoversightofthesurveillanceactivities
offederallawenforcementcouldonlybeaccomplishedwithreportingrequirementssuchasthe
oneincludedinthislaw.
40

ItisunclearfromthelegislativehistorywhyCongressoptedtogivetheAttorneyGeneralthe
responsibilityforcompilingthesereportsandnottheAdministrativeOfficeoftheUSCourts,whichafter
twodecadesofreliablyproducingthewiretapreports,wouldhavebeentheobviouschoicetoproduce
similarreportsforpenregisterandtrapandtracesurveillance.ItisalsounclearwhyCongressoptedto
limitthereportstolawenforcementagencieswithintheDepartmentofJustice.Asaresultofthis
decision,thereportsdonotdetailsurveillanceconductedotherfederallawenforcementagencies,such
astheSecretServiceorbystateandlocallawenforcementagencies.
41

37
PaulM.Schwartz,RevivingTelecommunicationsSurveillanceLaw,75U.Chi.L.Rev.287,292(2008).
38
18U.S.C.3126(2006);
38
S.REP.99541,S.Rep.No.541,99THCong.,2NDSess.1986,1986U.S.C.C.A.N.3555,
1986WL31929(Leg.Hist.)
39
Theexpandedreportsmustinclude(1)Theperiodofinterceptionsauthorizedbyeachorder;(2)thenumberand
durationofanyextensionsoftheorder;(3)theoffensespecifiedintheorderorapplicationorextensionofthe
order;(4)thenumberofinvestigationsinvolved;(5)thenumberandnatureofthefacilitiesaffected;and(6)
theidentity,includingdistrict,oftheapplyinginvestigativeorlawenforcementagencymakingtheapplication
andthepersonauthorizingtheorder.
40
145Cong.Rec.31,311(1999)(statementofSen.Leahy).
41
Notallstateshavewiretapauthority.FIXME.
14

Althoughthepenregisterandtrapandtracereportswereintendedtoinformboththegeneralpublicas
wellasCongressabouttheuseandscaleofthesesurveillancetechniques,
42
ProfessorPaulSchwartz
notesthatthatPenRegisterActreportsarenotpubliclyavailableandgenerallydisappearintoa
congressionalvacuum.
43
WhiletheAdministrativeOfficeoftheUSCourtshasdistributedthewiretap
reportsviaitswebsitesinceatleast1998,copiesofpenregisterreportshaveonlyseenthelightofday
throughtheworkofprivacyadvocates.
44
In2010,theDepartmentofJusticeestablishedapolicyof
proactivelypostingcopiesofthepenregisterreportstoitswebsite.
45

Furthermore,inspiteofalegalrequirementtodoso,theDepartmentofJusticehasrepeatedlyfailedto
submitthepenregisterandtrapandtracereportstoCongressonanannualbasis.In2004,the
DepartmentofJusticesentasingledocumentdumptoCongress,whichincludedreportsfortheyears
1999through2003.
46
TherearenorecordsavailablethatindicatethattheDepartmentofJustice
submittedanymorereportstoCongressuntil2009,whenitsentoveranotherdocumentdump,this
timecontainingthereportsfortheyears2004through2008.
47
However,in2010,aDOJofficialtoldme

42
Inthisway,theCongressandthepublicwillbeinformedofthosejurisdictionsusingthissurveillance
techniqueinformationwhichiscurrentlynotincludedintheAttorneyGeneralsannualreports.145Cong.
Rec.31,311(1999)(statementofSen.Leahy)
43
PaulM.Schwartz,RevivingTelecommunicationsSurveillanceLaw,75U.Chi.L.Rev.287,296(2008).
44
Statisticsfortheyears1994to1998wereobtainedbyastaffattorneyattheElectronicPrivacyInformation
Center(EPIC)withcontactsinCongress.SeeApprovalsforFederalPenRegistersandTrapandTraceDevices
19871998,EPIC,onlineathttp://www.epic.org/privacy/wiretap/stats/penreg.html;TheElectronicFrontier
foundationobtainedcopiesofthereportsfortheyears19992003throughaFreedomofInformationAct
requests.Eventhen,DOJtookoverthreeyearstorespondtothisrequestandreleasethereportsSee:Letterto
KevinBankstonfromRenaY.Kim,Chief,FOIAUnit,OfficeofEnforcementOperations,CriminalDivision,
DepartmentofJustice,June5,2008,availableathttp://files.spyingstats.com/prtt/dojdetailsprtt1999.pdf;I
wasabletoobtaincopiesofthereportsfor20042009throughFreedomofInformationActrequests.
45
EmailfromNancyLibin,ChiefPrivacy&CivilLibertiesOfficer,OfficeoftheDeputyAttorneyGeneral,
DepartmentofJusticetoChristopherSoghoian,Oct.132010,onfilewithauthor(The2008and2009reports
arepostedhereunderFrequentlyRequestedRecords.TheDepartmentwillpostthemhereannuallyasa
matterofcoursewhenevertheybecomeavailable.).
46
PaulM.Schwartz,RevivingTelecommunicationsSurveillanceLaw,75U.Chi.L.Rev.287at297(2008).
47
LetterfromWilliamMoschella,AssistantAttorneyGeneral,toCongressmanJohnConyers,Jr,etal.,Nov.3,2004.
LetterfromRonaldWeich,AssistantAttorneyGeneral,toCongressmanJohnConyers,Jr,etal.,October29,
2009.SeealsoEmailfromNancyLibin,ChiefPrivacy&CivilLibertiesOfficer,OfficeoftheDeputyAttorney
General,DepartmentofJusticetoChristopherSoghoian,Sept.32010,onfilewithauthor(ItistruethatDOJ
didnotproduce[]themannuallybutrathersubmittedtheminbulkin2004andthenagainin2009,asyou
said.).
15

thattheDepartmenthadrecentlyinstitutedpoliciesdesignedtoensurethatthereportswouldbe
submittedinthefuture.
48

Finally,asProfessorSchwartzhasnoted,[t]hereportsalsofailtodetailalloftheinformationthatthe
PenRegisterActrequirestobesharedwithCongress.
49
Thereportsdonotidentifythedistrictor
branchofficeoftheagenciesthatsubmittedthepenregisterandtrapandtracerequests,information
requiredby18U.S.C.3126(8),andsomereportsalsodonotdetailtheoffensesforwhichthepen
registerandtrapandtraceorderswereobtained,asrequiredby18U.S.C.3126(2).
50

Analysisofexistingreports

Asthesereportsdonotincludedataontheuseofnoncontentinterceptsbystateorfederallaw
enforcementagenciesoutsidetheDepartmentofJustice,itisimpossibletodeterminetheirtruescale.
51

Evenwiththesesignificantflaws,thePenRegisterActreportsdorevealsomeinterestinginformation,
suchasthemassivegrowthintheuseofthesesurveillanceorders.
In1987,thefirstyearforwhichdataexists,therewere1682penregisterand97trapandtraceorders
obtainedbyagencieswithintheDepartmentofJustice.
52
Elevenyearslater,thenumberofpenregisters
nearlytripledto4886,andthenumberoftrapandtracesincreasednearly25timesto2437.In1999,
thereportsstartedtoprovidenumbersforspecificfederalagencies,andrevealed,forexample,thatthe
FBIandDEAwereeachresponsibleforapproximatelyhalfofthe4949penregistersobtainedthatyear,
whiletheFBIalonewasresponsibleformorethan84percentofthe1553trapandtracesobtained.

48
LibinemailSept32010(earlierfootnote)(IvecheckedwithleadershipintheOfficeofLegislativeAffairsand
theCriminalDivision.PleasebearinmindthatnewleadershiptookovertheOfficeofLegAffairsin2009and
wasnotresponsibleforthefailuretoproducethereportsin20042008.Theyhaveputinplaceaprocessto
makesurethatthereportsaresubmittedtoCongressannually,asrequiredbystatute.)
49
Schwartzat297.
50
LetterfromMarcRotenbergetaltoSenatorsLeahy,
http://epic.org/privacy/wiretap/ltr_pen_trap_leahy_final.pdfatpage3.
51
Baseduponthelargernumberofstatewiretapsthanfederalwiretapseachyear(1713comparedto663in
2009),itseemsreasonabletoassumethatthereareatleastasmanypenregisterandtrapandtraceorders
obtainedbystatelawenforcementagenciesasthosebyfederalagencies.Itisquitelikelythatthereare
severaltimesmorestaterequests.
52
Theavailablereportscovering1987through1998donotdetailnumbersforparticularagencieswithinthe
DepartmentofJustice.SeeApprovalsforFederalPenRegistersandTrapandTraceDevices19871998,
ElectronicPrivacyInformationCenter,availableathttp://epic.org/privacy/wiretap/stats/penreg.html.
16

Althoughthenumbershavefluctuatedinparticularyears,
53
overtime,thenumberofrequestshas
skyrocketed.By2009,thelatestyearforwhichstatisticsexist,12,444penregistersand11,091trapand
traceorderswereissued.
54
Assuch,thissurveillancemethodvastlyoutnumberswiretapsin2009,
therewere18timesmorepenregistersthanfederalwiretaps.Thisdifferencemightbebecauseeachof
the663Federalinterceptorders(describedassuperwarrantsbysomeexperts
55
)obtainedin2009had
tobethoroughlyevaluatedandthenapprovedbyajudge,whilethe12,444penregistersrequestsonly
receivedacursoryreviewatbest.
56

Itispossibletoobserveafewothertrendsbyanalyzingthereports.
Between19992008,thestatisticsreflectthattheDrugEnforcementAdministration(DEA)requesteda
singleorderforeachpersonwhosetelephonefacilitieswereaffected.
57
However,in2009,theDEA
startedmonitoringmultipleindividualswithasingleorder(obtaining3735penregisterordersfor4527
people,and2995trapandtraceordersfor3434people).Furthermore,between1999and2006,the
DEAgotanorderofmagnitudemorepenregistersthantrapandtracedevices.In2007,something
changedastheDEAstartedtoapplyforsimilarnumbersoforders.Thatyear,thenumberoftrapand
traceorderssoughtbytheDEAjumped1700percentfrom148thepreviousyearto2510.
LiketheDEA,theUSMarshalsServicealsoappearstorequestasingleorderforeachpersonmonitored
(atleastfortheyears20012009).However,thestatisticsalsorevealthattheagencyobtainsidentical
numbersofpenregistersandtrapandtraceorders.Sincethelegalprocessrequiredtoobtainapen
registeristhesameasatrapandtrace,thissuggeststhattheboilerplatelanguageusedbythe
Marshalsrequestsbothasamatterofstandardpolicy.
Startingin2004,thereportsalsoprovidedataontheuseofnoncontentinterceptsforemailand
networktraffic.Thesenumbersremainlow,startingatjust20penregistersin2004(obtainedbythe

53
Oneinterestingtrendworthhighlightingthoughisthatthenumberofpenregistersandtrap&traceorders
wentdownafter9/11(4210penregisterswereusedin2000,4172in2001,and4103in2002),atatimewhen
theFBIandotherpartsofDOJwerepresumablyopeninglargenumbersofnewinvestigations.Onelikely
explanationforthisisthatfederalinvestigatorsswitchedtoothertypesofsurveillanceorders(suchasthose
issuedbytheFISAcourt).
54
See:http://files.spyingstats.com/prtt/DOJpenregisters20042008.pdf
55
http://intelligence.senate.gov/050419/kerr.pdf
56
See18U.S.C.3123(a)(1).SeeInreApplicationofUnitedStates,846F.Supp.1555,1559(M.D.Fla.1994)(The
courtwillnotconductanindependentjudicialinquiryintotheveracityoftheattestedfacts.).SeealsoUnited
Statesv.Fregoso,60F.3d1314,1320(8thCir.1995)("Thejudicialroleinapprovinguseoftrapandtrace
devicesisministerialinnature.")
57
Incontrast,thereportrevealthatFBImonitorsmultipleindividualswitheachpenregisterorder.
17

DEA),andeventuallyincreasingto258penregistersand50trapandtraceordersobtainedbyfour
differentfederallawenforcementagenciesin2009.
58

Emergencyvoluntarydisclosures

WhenCongresspassedtheElectronicCommunicationsPrivacyActin1986,itpermittedlaw
enforcementagenciestoobtainstoredcommunicationsandcustomerrecordsinemergencieswithout
theneedforacourtorder.
Insuchscenarios,acarriercan(butisnotrequiredto)disclosetherequestedinformationifit,ingood
faith,believesthatanemergencyinvolvingdangerofdeathorseriousphysicalinjurytoanyperson
requiresdisclosurewithoutdelayofcommunicationsrelatingtotheemergency.
59
Typically,belief
meansthatapoliceofficerstatesthatanemergencyexists.
60

WiththepassageoftheUSAPATRIOTImprovementandReauthorizationActof2005,Congresscreated
specificstatisticalreportingrequirementsforthevoluntarydisclosureofthecontentsofsubscriber
communicationsinemergencysituations.Indescribinghismotivationforintroducingtherequirement,
SenatorLungrenstatedthat:
Ifeltthatsomeaccountabilityisnecessarytoensurethatthisauthorityisnotbeingabused
Thisinformation[containedinthereports]Ibelieveshouldbehighlybeneficialtothe
Committee,fulfillingouroversightresponsibilityinthefuturethisisthebestwayforusto
haveareadymanneroflookingatthisparticularsection.Inthehearingsthatwehad,Ifoundno

58
TheDEAobtained20email/networkpenregistersin2004,and24in2005,37in2006,84in2007,59in2008,
and56in2009.TheDEAalsoobtained47trapandtraceordersin2009.TheUSMSobtained61penregistersin
2007,79in2008,and140in2009.TheATFobtained5penregistersand3trapandtraceordersin2009.
Finally,theFBIobtained59penregistersand45trapandtraceordersin2008,and57penregistersand52trap
andtraceordersin2009.
59
See:18U.S.C.2702(b)(8)and18U.S.C.2702(c)(4)(discussingtheproductionofinformationinemergency
situations).
60
See,e.g.,SethRosenbloom,CryingWolfintheDigitalAge:VoluntaryDisclosureundertheStored
CommunicationsAct,39COLUM.HUM.RTS.LREV529,559561(2008);Seealso,DEPTOFJUSTICE,A
REVIEWOFTHEFEDERALBUREAUOFINVESTIGATIONSUSEOFEXIGENTLETTERSANDOTHERINFORMAL
REQUESTSFORTELEPHONERECORDS,261n.272(Jan.2010)(quotingH.R.RepNo.107497,at1213(2002)),
availableathttp://www.justice.gov/oig/special/s1001r.pdf(Thelegislativehistoryofasimilaramendmentto
Section2702(b)semergencyvoluntarydisclosureprovisionforcontentinformationsuggeststhatthebelief
standardwasrelaxedbecausecommunicationsserviceprovidersexpressedconcerntotheCommitteethatthe
[reasonablybelieves]standardwastoodifficultforthemtomeet,andthatasaresult,providersmaynot
discloseinformationrelatingtoemergencies.).
18

basisforclaimingthattherehasbeenabuseofthissection.Idon'tbelieveonitsfaceitisan
abusivesection.ButIdobelievethatitcouldbesubjecttoabuseinthefutureand,therefore,
thisallowsusasMembersofCongresstohaveanabilitytotrackthisonaregularbasis.
61

AswiththePenRegisterActreports,theemergencyrequestreportsarecompiledandsubmittedbythe
AttorneyGeneral,andonlyapplytodisclosuresmadetolawenforcementagencieswithinthe
DepartmentofJustice.Assuch,therearenostatisticsforemergencydisclosuresmadetootherfederal
lawenforcementagencies,suchastheSecretService,aswellasthosemadetostateandlocallaw
enforcementagencies.
Furthermore,although18USC2702permitsboththedisclosureofthecontentofcommunications,as
wellasnoncontentrecordsassociatedwithsubscribersandtheircommunications,Congressonly
requiredthatstatisticsbecompiledforthedisclosureofcommunicationscontent.Itisnotclearwhy
Congresslimitedthereportsinthisway.

Analysisofexistingreports

Becausethereportingrequirementsdonotapplytodisclosuresmadetolawenforcementagencies
outsidetheDepartmentofJustice,anddonotincludethedisclosureofnoncontentcommunications
dataandothersubscriberrecords,thereportsrevealaverylimitedportionofthescaleofvoluntary
disclosurestolawenforcementagencies.
Furthermore,althoughCongressintendedforthesereportstoassistwithpublicoversightofthe
emergencydisclosureauthority,theDepartmentofJusticehasnotproactivelymadethesereports
availabletothegeneralpublic.InspiteofthislackoftransparencybyDOJ,threeyearsofreportshave
beenobtainedbyprivacyadvocates,andplacedonline.
62

61
http://www.gpo.gov/fdsys/pkg/CRPT109hrpt174/pdf/CRPT109hrpt174pt1.pdfavailableat;
http://thomas.loc.gov/cgi
bin/cpquery/2?&sid=cp109EDBl7&refer=&r_n=hr174p1.109&db_id=109&item=2&&sid=cp109EDBl7&r_n=hr17
4p1.109&dbname=cp109&hd_count=2&item=2&&sel=TOC_247686&(Toaddressconcernsthat[the
voluntaryemergencydisclosure]authority,incertaincircumstances,isnotsubjecttoadequatecongressional,
judicialorpublicoversightTheCommitteebelievesthiswouldstrengthenoversightontheuseofthis
authoritywithoutunderminingimportantlawenforcementprerogatives,andwithouttippingoffperpetrators
whilesimultaneouslypreservingthevitalityofthislifesavingauthority.)
62
ThereportswereprovidedtomebysomeonewithconnectionsinCongress.Theyhavebeenplacedonlineat
http://www.spyingstats.com.
19

AlettersubmittedbyVerizontoCongressionalcommitteesin2007revealedthatthecompanyhad
received25,000emergencyrequestsduringthepreviousyear.
63
Ofthese25,000emergencyrequests,
just300requestswerefromthefederallawenforcementagencies.Incontrast,thereportssubmitted
toCongressbytheAttorneyGeneralreveallessthan20disclosuresperyear.
64
Eventhoughnoother
serviceproviderhasdisclosedsimilarnumbersregardingemergencydisclosures,itisquiteclearthatthe
DepartmentofJusticestatisticsarenotadequatelyreportingthescaleofthisformofsurveillance.In
fact,theyunderreportthesedisclosuresbyseveralordersofmagnitude.
SectionIII:Unreportedsurveillancemethods

Theprevioussectionanalyzedtheuseofelectronicsurveillanceasdocumentedinofficialgovernment
reports.Thereareseveralotherformsofelectronicsurveillanceforwhichnoofficialreportsexist.As
such,thelittleavailabledatalargelycomesfromthecompaniesthemselves.Unfortunately,many
companies,particularlythosewiththeclosetiestothegovernment,willnotdiscusstheirdisclosureof
userdatatolawenforcementagencies.Thereasonforthiswidespreadsecrecyappearstobeafearthat
suchinformationmayscareusersandgivethemreasontofearthattheirprivateinformationisnot
safe.
65

63
LetterfromRandalS.Milch,Sr.VicePres.,VerizonBus.,toJohnD.Dingell,EdwardJ.Markey&BartStupak,U.S.
Reps(Oct.12,2007),availableat
http://markey.house.gov/docs/telecomm/Verizon_wiretaping_response_101207.pdf
64
TheDOJreceivedvoluntarydisclosuresfrom17accountsin2006,9accountsin2007,andfrom17accountsin
2008.LetterfromRichardHertling,ActingAssistantAttorneyGeneral,toSenatorPatrickLeahy,April9,2007,
availableathttp://files.spyingstats.com/exigentrequests/doj2702report2007.pdf.LetterfromBrianA.
Benczkowski,PrincipalDeputyAssistantAttorneyGeneral,toSenatorPatrickLeahy,April24,2008,availableat
http://files.spyingstats.com/exigentrequests/doj2702report2008.pdf.LetterfromRonaldReich,Assistant
AttorneyGeneral,toSenatorPatrickLeahy,July24,2009,availableathttp://files.spyingstats.com/exigent
requests/doj2702report2009.pdf.
65
RyanSingel,Google,MicrosoftPushFedstoFixPrivacyLaws,WIRED(Mar.30,2010,4:38PM),availableat
http://www.wired.com/threatlevel/2010/03/googlemicrosoftecpa
(We[Microsoft]wouldliketoseemoretransparencyacrosstheindustryButnoonecompanywantstostick
itsheaduptotalkaboutnumbers.);LetterfromMichaelT.Gershberg,CounseltoYahoo!Inc,toWilliam
Bordley,U.S.MarshalsService(Sept.15,2009),availableathttp://files.cloudprivacy.net/yahoopricelist
letter.PDF.([Surveillancepricing]information,ifdisclosed,wouldbeusedtoshameYahoo!andother
companiesandtoshocktheircustomers.Therefore,releaseofYahoo!sinformationisreasonablylikelyto
leadtoimpairmentofitsreputationforprotectionofuserprivacyandsecurity,whichisacompetitive
disadvantagefortechnologycompanies.)
20

Requeststoserviceprovidersforstoredcommunicationsandsubscriber
records

TheStoredCommunicationsActenableslawenforcementagenciestoobtainstoredcommunications
andsubscriberrecords.Thisincludesstoredemails,instantmessages,webbrowsinghistory,search
enginerecordsaswellasdocumentsstoredinthecloud.Therenoofficialstatisticsregardingsuch
requests,althoughbasedonpubliclyavailableinformation,theylikelynumberinthetensofthousands
peryear.
AOLwasthefirstcompanytovoluntarilydisclosestatistics,revealingtotheNewYorkTimesin2006that
itreceived1000requestspermonth.
66
In2009,arepresentativefromFacebooktoldNewsweekthatit
wasreceivingbetweententotwentyrequestsfrompoliceperday.
67
Inresponsetoacopyrightlawsuit
in2010,TimeWarnerrevealedthatitreceivedapproximately500IPaddresslookuprequestsfor
associatedwithitscablecustomersonaveragepermonth,nearlyallofwhichcamefromlaw
enforcement.
InApril2010,Googlestartedpublishingstatisticsregardingthenumberofrequestsforuserdatathe
companyreceivesfromgovernmentsaroundtheworld.Accordingtothosereports,thecompany
received4287requestsforuserdatabetweenJanuary2010toJune2010,and3580requestsbetween
July2009andDecember2009.Thecompanyhasnotbrokendownthesenumbersintothevarioustypes
ofrequestsitreceives.
68

66
Hansel,supranoteFIXME(AOL,forexample,hasmorethanadozenpeople,includingseveralformer
prosecutors,handlingthenearly1,000requestsitreceiveseachmonthforinformationincriminalandcivil
cases....AOLsaysthatonly30ofthe1,000monthlyrequestsitreceivesareforcivilcases,andthatitinitially
rejectsabout90percentofthose,arguingthattheyareoverlybroadorthatthelitigantslackproper
jurisdiction.Abouthalfofthoserejectedareresubmitted,onnarrowergrounds.).
67
NickSummers,WalkingtheCyberbeat,NEWSWEEK,May18,2009,availableat
http://www.newsweek.com/id/195621([Facebook]saysittendstocooperatefullyand,forthemostpart,
usersarentawareofthe10to20policerequeststhesitegetseachday.).However,considerthatFacebook
had200millionusersin2009,andnowhasmorethan600million.Assuch,itisprobablyreasonabletoassume
thatitprobablynowreceivesmanymorerequests.
68
http://www.google.com/transparencyreport/faq/#removalrequests(Thenumberofrequestswereceivefor
useraccountinformationaspartofcriminalinvestigationshasincreasedyearafteryear.Theincreaseisnt
surprising,sinceeachyearweoffermoreproductsandservices,andwehavealargernumberofusersAta
timewhenincreasingnumbersofgovernmentsaretryingtoregulatethefreeflowofinformationonthe
Internet,wehopethistoolwillshinesomelightonthescaleandscopeofgovernmentrequeststoobtain
userdataaroundtheglobeandwewelcomeexternaldebatesabouttheseissuesthatwegrapplewith
internallyonadailybasis.)
21

In2010,Congressheldseveralhearingstoexaminethe20yearoldElectronicCommunicationsPrivacy
Act.RepublicanSenatorsdismissedentirelythepleasofbothcompaniesandprivacyadvocatesto
protectcommunicationscontentstoredinthecloud,byarguing,anecdotally,thatthevastmajorityof
requestsforstoredcontentareforchildpornographyinvestigations.
69
Theseclaimswerestatedina
minoritystaffreport,byananonymousformerfederalprosecutor,citinghisownexperienceatthe
DepartmentofJustice.Becausenoofficialstatisticsexist,thereisnowaytoverifythisclaim.However,
itisworthnotingthatthemajorityuseofmostotherformsofsurveillanceistoinvestigatedrugs,not
childpornography.

69
MemorandumtotheSJCMinorityStaff,TheElectronicCommunicationsPrivacyAct:PromotingSecurityand
ProtectingPrivacyintheDigitalAge,Sept17,2010atpage8(Asnotedabove,anecdotally,asubstantial
majorityofECPAordersareusedinchildexploitationcases,meaningthattheprimarydirectbeneficiaryofthe
changesproposedbyDigitalDueProcesswillbethisclassofoffenders.Inthesecases,prosecutorsarenot
usuallyinterestedinthecontentofcommunications;theyareinterestedinquicklylocatingoffendersinorder
toapprehendthemtoprotectchildren.)availableathttp://www.scribd.com/doc/38407733/Republican
Senatememoagainstprivacyandcloudcomputingreform
22

Surveillanceoflocationinformation

Lawenforcementrequestsforlocationinformationfromwirelesscarriers,bothhistoricalandrealtime
(prospective)havebecomeroutine.
70
Eachwirelesscarrierreportedlyreceivesthousandsof
requestspermonth,anamountthathasgrown"exponentially"overthepastfewyears.
71
Accordingto
9
th
CircuitChiefJudgeAlexKozinski,[t]hevolumeofrequests[receivedbywirelesscarrierSprint
Nextel]grewsolargethatthe110memberelectronicsurveillanceteamcouldn'tkeepup,so[in2008,]
Sprintautomatedtheprocessbydevelopingawebinterfacethatgivesagentsdirectaccesstousers'
locationdata.
72
ThatwebsitewasusedbylawenforcementagentstopingSprintusersover8million
timesinasingleyear.
73

Inadditiontorequestingthisdatafromwirelesscarriers,lawenforcementagenciesarealsoableto
directlycollectprospectivephonelocationdatausingspecializedequipmentknownasacellsite
simulatorortriggerfish.
74
Justaswithrequeststocarriersforlocationdata,nostatisticsexist
regardingtheuseofthiscovertlocationtrackingtechnique.

70
EllenNakashima,CellphoneTrackingPowersonRequest,TheWashingtonPost,November23,2007.("Federal
officialsareroutinelyaskingcourtstoordercellphonecompaniestofurnishrealtimetrackingdatasotheycan
pinpointthewhereaboutsofdrugtraffickers,fugitivesandothercriminalsuspects,accordingtojudgesand
industrylawyers.");ChristopherGuttmanMcCabe,vicepresidentofregulatoryaffairsforCTIAtheWireless
Association,inaJuly2007commenttotheFederalCommunicationsCommission("Lawenforcementroutinely
nowrequestscarrierstocontinuously'ping'wirelessdevicesofsuspectstolocatethemwhenacallisnotbeing
made...solawenforcementcantriangulatethepreciselocationofadeviceand[seek]thelocationofall
associatescommunicatingwithatarget.");DeclanMcCullagh,Fedspushfortrackingcellphones,CNETNews,
Feb.11,2010,availableathttp://news.cnet.com/830113578_31045151838.html(Obtaininglocation
detailsisnow"commonplace,saysAlGidari,apartnerintheSeattleofficesofPerkinsCoiewhorepresents
wirelesscarriers.It'sineverypenregisterorderthesedays).
71
MichaelIsikoff,TheSnitchinYourPocket,NEWSWEEK,Feb.19,2010,availableat
http://www.newsweek.com/2010/02/18/thesnitchinyourpocket.html(telecomlawyerAlGidaridescribing
thescaleoflocationrequestsreceivedbywirelesscarriers).
72
USv.PinedaMoreno,617F.3d1120CourtofAppeals,9thCircuit2010dissentbyKozinskiat1125
73
ChristopherSoghoian,8MillionReasonsforRealSurveillanceOversight,SLIGHTPARANOIA(Dec1,2009)
availableathttp://paranoia.dubfire.net/2009/12/8millionreasonsforrealsurveillance.html.
74
USABook>ElectronicSurveillance>CellSiteSimulators,Triggerfish,Cellphones.Page18,availableat,
http://www.aclu.org/pdfs/freespeech/cellfoia_release_074130_20080812.pdf(Triggerfishcanbedeployed
withouttheuserknowingaboutit,andwithoutinvolvingthecellphoneprovider.);JulianSanchez,FOIAdocs
showfedscanlojackmobileswithouttelcohelp,ARSTECHNICA,November16,2008,availableat
http://arstechnica.com/techpolicy/news/2008/11/foiadocsshowfedscanlojackmobileswithouttelco
help.ars(TheJusticeDepartment'selectronicsurveillancemanualexplicitlysuggeststhattriggerfishmaybe
usedtoavoidrestrictionsinstatuteslikeCALEAthatbartheuseofpenregisterortrapandtracedevices
23

In2000,theRepublicancontrolledHouseofRepresentativesconsideredlegislationthatwouldsetclear
standardsgoverningrequestsforlocationdata.Thesamebillincludedarequirementthatstatistical
reportsbecreatedforlocationdataandrequeststointernetserviceproviders.TheDepartmentof
Justiceopposedthebill,statingthattheadditionalreportingrequirementswouldconsumescarce
resourcesandthreaten[ed]toturncrimefightersintobookkeepers.
75
Ultimately,thebilldidnotmake
itoutofcommittee.
Adecadelater,whentheHouseagainlookedintothetopicofgovernmentrequestsforlocationdata,
therewerestillnostatisticsrelatedtothistechnique.Becauseitdidntpassanylegislationmandating
reportingofsuchrequests,Congressin2010knewjustaslittleasitdidin2000.

whichallowtrackingofincomingandoutgoingcallsfromaphonesubjecttomuchlessstringentevidentiary
standardstogatherlocationdata.).
75
PREPAREDSTATEMENTOFKEVINDIGREGORY,DEPUTYASSOCIATEATTORNEYGENERAL,DEPARTMENTOF
JUSTICE,HearingonELECTRONICCOMMUNICATIONSPRIVACYACTOF2000,DIGITALPRIVACYACTOF2000
ANDNOTICEOFELECTRONICMONITORINGACT,September6,2000,
http://commdocs.house.gov/committees/judiciary/hju67343.000/hju67343_0f.htm(theimpositionofsuch
extensivereportingrequirementsforcybercrimeinvestigatorswouldcomeatatimewhenlawenforcement
authoritiesarestrappedforresourcestofightcybercrime.Thereportingrequirementsforwiretaps,while
extensive,arelessonerousbecauselawenforcementappliesforsuchordersrelativelyrarely.Extendingsuch
requirementstoordersusedtoobtainmeretransactionaldatawoulddramaticallyhindereffortstofightcyber
crime,suchasthedistributionofchildpornographyandInternetfraud.)
24

SectionIV:Closingthesurveillancereportinggap

Evenwithoutcompletestatistics,itisquiteclearthatmanylawenforcementagencieshave
enthusiasticallyembracedsurveillanceofstoredcommunicationsandtransactionalrecords.While
wiretaps,themostcarefullyregulatedandreportedonareaoftelecommunicationssurveillance
76
are
usedjustafewthousandtimesperyear,lawenforcementagenciesnowmaketens(ifnothundreds)of
thousandsofrequestsperyearforsubscriberrecords,storedcommunicationsandlocationdata.
Unfortunately,Congresslacksanystatisticaldataregardingmanyoftheserequests,andsoislargely
unabletoperformeffectiveoversightoverthissurveillancepower.
77

In2008,ProfessorPaulSchwartzsuggestedthatCongresscreateanannualtelecommunications
surveillanceindex(asurveillancereportcard),insteadofthebitsandpiecesofscatteredreports
releasedeachyear.
78
Thatsuggestionremainsavalidandusefulone,butevenifCongressdoesnot
createasingleresourceforsurveillancestatistics,thereareseveralwaysinwhichitcansignificantly
enhanceitsownandthegeneralpublicsawarenessofmodernelectronicsurveillance.
First,thePenRegisterActshouldbeamendedsoreportingunderitismadetotheAdministrativeOffice
ofthecourts,ratherthantheDepartmentofJustice.Sincejudgeshavetoapprovepenregisterorders,it
shouldbesimpleenoughforclerkstosendthisinformationtotheAdministrativeOffice,justasthey
alreadydoforwiretaporders.ThePenRegisterActshouldalsobeamendedsothatthereporting
requirementsapplytoalllawenforcementagencies,andnotjustthosefederalagencieswithinthe
DepartmentofJustice.Forexample,iftheSecretServiceorLosAngelesPoliceDepartmentobtainsa
penregisterorder,itshouldbereported.
Second,theemergencydisclosurereports,likethePenRegisterActreports,shouldbeexpandedto
includedisclosuresmadetoalllawenforcementagencies,andnotjustthosefederalagencieswithinthe
DepartmentofJustice.ThesereportsshouldbesentdirectlytotheAdministrativeOfficeoftheCourts,
whichcanthencompilethemandsendthemontoCongressaspartofabroadersurveillancereport.The
emergencydisclosurereportsshouldalsobebroadenedtoincludeemergencydisclosuresofnon
contentdataandcustomerrecords.
Third,detailedstatisticsshouldbecreatedregardingrequestsmadetoserviceprovidersforstored
communicationsandsubscriberdataundertheStoredCommunicationsAct.Whensuchdisclosuresare
madepursuanttoacourtorder,thecourtsshouldcompileandtransmittheinformationtothe
AdministrativeOffice.However,becausesuchdisclosurescanandareregularlymadeinresponsetoa

76
Schwartzat310.
77
ElectronicCommunicationsPrivacyActof2000,HRRepNo106932,106thCong,2dSess10(2000)(lamenting
thattherewaslittledatawithwhichtounderstandtheeffectsoftheElectronicCommunicationsPrivacyActof
1986).
78
Schwartzat313.
25

subpoena,additionalreportswillbenecessary.Ratherthanrequiringeverylawenforcementagencyin
thecountrytosendreportstotheAdministrativeOffice,IproposethatInternetServiceProviders
shouldberequiredtocreateandsubmitannualreportstotheAdministrativeOffice,whichcanthen
stripouttheprovidersidentifyinginformation,andcompilereportsthatsummarizetheproviderdata.
79

Fourth,Congressshouldcreatespecificreportingrequirementsregardingthecollectionofhistoricaland
prospectivelocationinformation,detailingthenumberofrequests,thetypeofinformationrequested,
andthenumberofindividualswhoseinformationwasobtained.
ThesereportingrequirementswouldprovideCongresswiththeinformationnecessarytomakesound
policyintheareaofelectronicsurveillance,yetbecausemostoftheresponsibilityforactuallycreating
andcompilingthereportsfallsuponthecourtsandthecompaniesthemselves,lawenforcement
agencieswouldnotbeabletocomplain,astheydidin2000,thattherequirementswouldoverburden
them.
80

InDecember2010,astafferworkingfortheHouseSubcommitteeontheConstitution,CivilRights,and
CivilLibertiescirculatedadraftdiscussionbillthatincludedallfouroftheserecommendations.
Unfortunately,thatbillwasneverformallyintroduced.
SectionV:Conclusion

LawenforcementagencieshavehadtheabilitytocovertlymonitorthecommunicationsofAmericans
fornearlyacentury.Inordertoperformeffectiveoversightoverthesepowers,Congressrequiredthe
creationofsurveillancereportsthatdocumenttheuseofwiretapsandlaterpenregisters.However,as
AmericanshaveincreasinglyembracedmoderntechnologiessuchasmobilephonesandtheInternet,
lawenforcementagencieshavefollowed.Unfortunately,therearenoreportingrequirementsforthe
modernsurveillancemethodsthatmakeupthemajorityoflawenforcementrequeststoservice
providersandtelephonecompanies.Assuch,thissurveillancelargelyoccursoffthebooks,withnoway
forCongressorthegeneralpublictoknowthetruescaleofsuchactivities.

79
Itwouldbewisetoincludesomedeminimisrule,sothatsmallprovidersthatdonotreceivelargenumbersof
requestswouldnotbeburdenedwiththisrequirement.Furthermore,sinceproviderswillincurcosts
associatedwithcreatingandsubmittingthesereports,Isuggestthattheybepermittedtoseekreasonable
compensationfromtheAdministrativeOfficefordoingso.
80
PREPAREDSTATEMENTOFKEVINDIGREGORY,DEPUTYASSOCIATEATTORNEYGENERAL,DEPARTMENTOF
JUSTICE,HearingonELECTRONICCOMMUNICATIONSPRIVACYACTOF2000,DIGITALPRIVACYACTOF2000
ANDNOTICEOFELECTRONICMONITORINGACT,September6,2000
http://commdocs.house.gov/committees/judiciary/hju67343.000/hju67343_0f.htm(Thereporting
requirementscreateasignificantburdenforlawenforcementauthorities.Theimpositionofsuchextensive
reportingrequirementsforcybercrimeinvestigatorsatatimewhenlawenforcementauthoritiesarestrapped
forresourcestofightcybercrimewouldhinderoureffortstofightcybercrime.)
26

Inwritingthisarticle,Ihavetriedtocollectallpubliclyavailableinformation(aswellassomenot
previouslyavailable)inordertopresentascompleteapictureaspossibleregardingthecurrentstateof
electronicsurveillance.Evenso,Congressshouldnothavetorelyontheworkofagraduatestudentin
ordertokeeptabsonthisincreasinglyimportantissue.Asdemonstratedbythefewpagesof
informationpresentedinSectionIII,verylittleisknownaboutthetruescaleofrequestsforstored
communicationsorlocationdata,althoughtheylikelynumberinthetensorhundredsofthousandsper
year.
In2000,Congressconsideredlegislationthatwouldhavesignificantlyenhancedthesurveillance
reportingrequirements.Itfailedtopassthatbill.Thisyear,Congressisagainconsideringupdatingthe
agingElectronicCommunicationsPrivacyActinordertobetterprotectlocationdataaswellasdata
storedinthecloud.Unfortunately,Congresslacksindependent,highqualitydatauponwhichto
evaluatelawenforcementuseofitsexistingsurveillancepowers.
IfCongresspuntsoncomprehensiveprivacyreform,asithasdonesoseveraltimesinthepast,Ihope
thatitatleastmandatesthecreationofnewsurveillancestatistics.Doingsowillensurethatafuture
Congresswillatleastbeequippedwithusefuldata.