|
|
Before the
FCC Washington, D.C. 20554 In the Matter of Communications Assistance for Law Enforcement Act: April 20, 1998 |
|
|
In the Matter of ) Communications Assistance ) CC Docket No. 97-213 For Law Enforcement Act )
James X. Dempsey, Senior Staff Counsel Martin L. Stern Daniel J. Weitzner, Deputy Director Lisa A. Leventhal Center for Democracy and Technology Preston Gates Ellis & Rouvelas 1634 Eye Street, N.W., Suite 1100 Meeds LLP Washington, D.C. 20006 1735 New York Avenue, N.W., Suite 500 (202) 637-9800 Washington, D.C. 20006 (202) 628-1700
Attorneys for Center for Democracy and Technology
Dated: May 20, 1998
SUMMARY
CALEA is but the latest chapter in the 30 year history of the federal wiretap laws, which have always sought to balance constitutional privacy protections and law enforcement interests. CALEA was intended to preserve a minimum law enforcement surveillance capability in the face of technological change. It was not intended to serve as the basis for mandated expansions in that capability. Rather, as was the case with earlier electronic surveillance legislation, Congress crafted a legislative scheme intended to balance the interests of law enforcement and privacy. That balance is reflected in the four assistance requirements set out in Section 103 of the Act.
The industry interim standard already violates the principle of balance by mandating a location tracking capability that Congress did not intend and by failing to require adequate privacy protection in packet networks of call content not authorized to be intercepted. Expansion of the industry standard as the FBI proposes would further upset the balance. Given Congress' particular concern with the expanding sensitivity of signaling information, it is unreasonable to conclude, as the FBI argues, that Congress would pass a law mandating further expansion in the richness of signaling data provided to law enforcement, under a mere pen register standard.
CALEA also went one step further than the previous wiretap statutes, affirmatively requiring the protection of privacy through technological means. Three of CALEA's four capability assistance requirements are intended to preserve law enforcement's surveillance capabilities. But the fourth requires carriers to ensure that their systems are capable of intercepting call content and call-identifying information "in a manner that protects . . . the privacy and security of communications and call-identifying information not authorized to be intercepted." Section 103(a)(4) thus imposes on telecommunications carriers for the first time ever an affirmative obligation to protect the privacy of communications and call-identifying data not authorized to be intercepted. This has direct implications for the packet networks issue.
The Commission has a pivotal role in carrying forward Congress' historical balance between privacy and law enforcement into technologies that form the basis for a wide variety of new communications services. The two aspects of the industry interim standard that CDT's challenge highlights - wireless location information and packet network services - are technologies that are at the very heart of the digital communications revolution. Notably, it is with these two core technologies that CDT believes the industry interim standard gives law enforcement surveillance capabilities that intrude upon privacy contrary to Congress' intent. In this phase of the CALEA proceedings, the Commission is required by CALEA to ensure that the fundamental privacy/law enforcement balance is being adequately maintained for these cutting-edge technologies.
CALEA, however, does not prohibit these surveillance enhancing developments, if they come about as a result of business needs or market forces. If they are available, law enforcement can take advantage of them. But the government cannot mandate them through adoption of a standard that forms the CALEA "safe harbor" standard. It is the Commission's responsibility to narrowly interpret the CALEA requirements and prevent the imposition of capabilities that would upset the fundamental balance at the heart of the Act.
TABLE OF CONTENTS
SUMMARY
INTRODUCTION
DISCUSSION
I. THE COMMISSION'S ROLE IN THE IMPLEMENTATION OF CALEA
II. IN ESTABLISHING A CALEA STANDARD, THE COMMISSION MUST MAINTAIN THE HISTORICAL BALANCE BETWEEN LAW ENFORCEMENT AND PRIVACY CONCERNS
2. The Electronic Communications Privacy Act
3. The Communications Assistance for Law Enforcement Act
(b) No significance can be attached to Congress' replacement of "call set-up information" with "call-identifying information
(c) The words "origin," "direction," "destination" and "termination"
2. The FBI Cannot Now Convert the Explicit Statutory Prohibition Against Providing Location Information Under Pen Register Orders into an Implied Requirement that Location be Provided under a Higher Standard
2. Compliance with Privacy Requirements Calling For Separation of Signaling and Message Content Information Appears Reasonably Achievable in at least some of the Packet Networks Discussed in Section 4.5.2
3. The Commission Should Replace the Current Provisions of Section 4.5.2 With a Requirement that Carriers Must Separate Signaling Information From Message Content
2. CALEA does not Require the Carrier Originating a Call to Provide Post-Cut through Dialed Digits; the FBI Specifically Assured Congress that this was not Covered by CALEA's Call-Identifying Information Requirement
3. The Detailed Signaling Data Sought by the FBI Does Not Fit the Definition of Call-Identifying Information.
Pursuant to the April 20, 1998 Public Notice, DA 98-762, ("Public Notice") in the captioned docket, the Center for Democracy and Technology ("CDT"), by its undersigned attorneys, hereby comments on the scope of the assistance capability requirements necessary to satisfy the obligations imposed by the Communications Assistance for Law Enforcement Act (the "Act" or "CALEA") [1] and the responsibility of the Commission to ensure that the Act is implemented in a way that protects the privacy of the American people.
As CDT will show, there are only three questions presently before the Commission and they are relatively narrow. First, does CALEA require wireless carriers to provide real-time location information? CDT will demonstrate that it does not. Second, does CALEA's requirement to "protect the privacy of communications not authorized to be intercepted" require carriers, where reasonably achievable, to separate addressing information from message content in packet networks? CDT will show that it does. And third, can a mandate for the FBI's punch list items be found in the language or legislative history of Section 103 of the Act? CDT will establish that no such mandate exists.
INTRODUCTION
CALEA is but the latest chapter in the 30 year history of the federal wiretap laws, which have always sought to balance constitutional privacy protections and law enforcement interests. CALEA was intended to preserve a minimum law enforcement surveillance capability in the face of technological change. It was not intended to serve as the basis for mandated expansions in that capability. It was enacted by Congress in response to FBI claims that new technologies would soon make it "virtually impossible" to carry out wiretaps. In the words of FBI Director Freeh, CALEA was intended to preserve the electronic surveillance capability "as it has existed since 1968."
Since 1968, the electronic surveillance capability has always been subject to limitations, both technological and legal. In 1968, and again in 1994 with CALEA, the question for Congress was whether wiretapping should be available to law enforcement at all. Congress in both cases decided that the technique should be available, but it crafted a legislative scheme intended to balance the interests of law enforcement and privacy.
The industry interim standard already violates the principle of balance by mandating a location tracking capability that Congress did not intend and by failing to require adequate privacy protection in packet networks of call content not authorized to be intercepted. Expansion of the industry standard as the FBI proposes would further upset the balance. Given Congress' consistent concerns with the growing intrusiveness of technology, it is impossible to conclude that Congress intended CALEA to expand the surveillance capabilities of telecommunications technology yet further, as the DOJ and FBI now contend.
As Congress has seen the surveillance power of technology grow, it has become especially concerned about the increasingly detailed and revealing nature of transactional or signaling data associated with communications. This concern has grown, from 1968, when government access to signaling data was unregulated, through 1986, when Congress first established statutory rules for access to signaling data, to CALEA, when concerns with signaling information were a central focus of privacy objections to initial versions of the Act. Given Congress' particular concern with the expanding sensitivity of signaling information, it is unreasonable to conclude, as the FBI argues, that Congress would pass a law mandating further expansion in the richness of signaling data provided to law enforcement, under a mere pen register standard.
CALEA went one step further than the previous wiretap statutes, affirmatively requiring the protection of privacy through technological means. Three of CALEA's four capability assistance requirements are intended to preserve law enforcement's surveillance capabilities, but the fourth also mandates protection of privacy. Under Section 103(a)(4), carriers are required to ensure that their systems are capable of intercepting call content and call-identifying information "in a manner that protects . . . the privacy and security of communications and call-identifying information not authorized to be intercepted . . . ." [2] Section 103(a)(4) imposes on telecommunications carriers for the first time ever an affirmative obligation to protect the privacy of communications and call-identifying data not authorized to be intercepted. This has direct implications for the packet network issue.
The Commission has a pivotal role in carrying forward Congress' historical balance between privacy and law enforcement into technologies that form the basis for a wide variety of new communications services. The two aspects of the industry interim standard that CDT's challenge highlights - wireless location information and packet network services - are technologies that are at the very heart of the digital communications revolution. In the case of wireless services, tens of millions of Americans rely on cellular phones and PCS devices for personal and professional communications on a daily basis. The Internet, with its highly efficient packet-based architecture, is credited as the sine qua non of the information revolution and has expanded commercial, political, and educational opportunities for individuals in the United States and around the world.
Notably, it is with these two core technologies that CDT believes the industry interim standard gives law enforcement surveillance capabilities that intrude upon privacy contrary to Congress' intent. In this phase of the CALEA proceedings, the Commission is required by the statute to ensure that the fundamental privacy/law enforcement balance originally struck in 1968 is being adequately maintained for these cutting-edge technologies.
The Commission need not deny law enforcement any advantages of the new technology: it must only recognize that CALEA was intended to preserve a minimum surveillance capability and define what that capability is. To properly interpret CALEA, it is necessary to distinguish between what the statute requires and what law enforcement may take advantage of. CALEA mandated a minimum national baseline for law enforcement surveillance. CALEA cannot be used by the government to require more than the minimum required by the four capability assistance requirements of Section 103(a)(1) - (4).
However, regardless of CALEA, there have been certain expansions in surveillance capability in recent years that came about as a result of business needs or market-driven developments. Location information in wireless systems is one such capability. In the future, there will be others. CALEA does not prohibit these surveillance enhancing developments, if they come about as a result of business needs or market forces. If they are available, law enforcement can take advantage of them. But the government cannot mandate them through adoption of a standard that forms the CALEA "safe harbor" standard. It is the Commission's responsibility to narrowly interpret the CALEA requirements and prevent the imposition of capabilities that would upset the fundamental balance at the heart of the Act.
DISCUSSION
I. THE COMMISSION'S ROLE IN THE IMPLEMENTATION OF CALEA
The CALEA framework seeks to balance three important policy interests:
Given these significant countervailing concerns, Congress did not seek to mandate the inclusion in the nation's telecommunications network of solutions to each and every complication that law enforcement might face when conducting its surveillance activities. Rather, the provisions of CALEA seek to strike the balance between "the legitimate needs of law enforcement and the constitutionally guaranteed rights of privacy of the individual." [4]
Balancing these interests, as described in the Act's legislative history, CALEA sets a floor on the surveillance assistance capabilities that carriers must build into their networks. Thus the Act mandates that carriers include certain enumerated and limited surveillance capabilities - the four items specified in Section 103 of the Act. [5] At the same time, CALEA serves as a ceiling on the surveillance assistance capabilities that carriers must build into their networks, for to require anything more would tilt the critical balance that CALEA struck among privacy, law enforcement, and technological concerns.
CALEA contemplates that if a carrier or manufacturer fails to build the features required by Section 103 into its networks, the Attorney General may bring a civil action in U.S. District Court, seeking an order requiring that the carrier comply with the Act. [6] Such an order, however, cannot go beyond the limited requirements of Section 103, which operate as a bar on the surveillance assistance capabilities that may be imposed on carriers and their suppliers through a CALEA enforcement proceeding. [7]
At the same time, to provide carriers and manufacturers with an appropriate degree of certainty to avoid such enforcement actions, and to ensure CALEA's effective implementation on an industry-wide basis, Congress also established a consultative standards-setting process. [8] Under this process, industry, in consultation with law enforcement, may establish an industry-wide standard designed to ensure compliance with the four minimum assistance capabilities required by Section 103 of the Act. Such a standard would then serve as a "safe harbor," immunizing carriers and manufacturers in compliance with the standard from Section 108 enforcement actions. [9]
Yet, even under this safe harbor procedure, industry and law enforcement are not the final arbiters of what CALEA requires. Rather, that is a responsibility that Congress has placed squarely on this Commission. [10] Thus, where, as here, a government agency or any other person files a petition alleging that the industry standard is deficient, it is the duty of this Commission "to establish, by rule, [the] technical requirements or standards" that CALEA requires. [11]
The Act directs the Commission, in establishing the CALEA standard, to ensure that the Commission's safe harbor not only serves to "meet the assistance capability requirements of Section 103 by cost-effective methods," but that it serves to "protect the privacy and security of communications not authorized to be intercepted." [12] Taken together, the five factors that the Commission must account for in Section 107(b) preclude the Commission from mandating a standard that falls outside the scope of the Act. In this manner, Congress ensured that a Commission-established safe harbor would preserve the critical balance between privacy concerns and law enforcement that formed the basis for Section 103.
Accordingly, the Commission's role in this proceeding is to preserve both the floor and the ceiling of the Act, as mandated by Congress. As further discussed below, Section 103 serves as CALEA's floor, providing for nationwide availability of only certain minimum assistance features. However, Section 103 also serves as CALEA's ceiling, reflecting a balance of technology, cost and privacy concerns with law enforcement interests, in providing that the CALEA standard must meet but cannot exceed the Act's minimum capability requirements. Section 103 thus stands as a bright-line boundary to the assistance capabilities that the industry can be compelled to provide. There is simply no lawful basis for this Commission to include features that go beyond that boundary in establishing under Section 107 what CALEA requires.
II. IN ESTABLISHING A CALEA STANDARD, THE COMMISSION MUST MAINTAIN THE HISTORICAL BALANCE BETWEEN LAW ENFORCEMENT AND PRIVACY CONCERNS
The history of wiretapping laws in the United States, up to and including the enactment of CALEA, exhibits a fundamental tension between law enforcement and privacy interests. While Congress has accepted law enforcement's assertions regarding the value and necessity of wiretapping, at the same time, Congress has been persistently troubled by the significant privacy intrusions caused by the government's surreptitious interception of telephone and other electronic communications. Consequently, Congress' overriding objective when enacting the nation's wiretapping statutes has always been to achieve an appropriate balance between privacy and law enforcement interests. [13] In enacting CALEA, Congress was guided by this very objective and clearly intended to preserve this critical balance.
Over the 30 year history of the nation's wiretapping legislation, Congress has expressed its continued concern over the increasing intrusion of new technologies into the realm of personal privacy. This concern is reflected in each major addition to the wiretapping statutes, and without exception, every such enactment struck a balance between law enforcement interests on the one hand and privacy interests on the other. Moreover, the need to strike an appropriate balance between these competing interests can also be found in Supreme Court cases that predated, and to some degree prompted, the adoption of the first federal wiretap law.
For example, in 1963, the Chief Justice of the Supreme Court warned of how "the fantastic advances in the field of electronic communication constitute a great danger to the privacy of the individual; [and] that indiscriminate use of such devices in law enforcement raises grave constitutional questions under the Fourth and Fifth Amendments . . . ." [14] Again, in 1967, the Supreme Court found, in Berger v. New York, 388 U.S. 41, 63 (1967), that "[f]ew threats to liberty exist which are greater than that posed by the use of eavesdropping devices."
Due to these substantial privacy concerns, which were gaining critical attention in the early 1960s, the enactment of the nation's first comprehensive federal wiretap statute faced multiple obstacles prior to its adoption in 1968. [15] In fact, the first major obstacle was whether wiretapping should be allowed at all. In the years leading up to the enactment of Title III, Congress held numerous hearings that were highly critical of wiretapping. [16] The criticism was so great that widespread private and public concern was generated and, for the first time in Department of Justice history, the Attorney General (Ramsey Clark) opposed governmental wiretapping altogether. The Johnson Administration sent legislation to Congress to outlaw all governmental wiretapping, except for cases involving national security. Only after considerable controversy was Title III passed as part of the Omnibus Crime Control and Safe Streets Act, which was propelled to enactment by election year politics and the assassination of Robert F. Kennedy.
In deciding to authorize limited wiretapping capabilities pursuant to Title III, Congress agreed that changes in technology were eroding individual privacy rights. As evidenced by the Report of the Senate Judiciary Committee on Title III, "[t]he tremendous scientific and technological developments that have taken place in the last century have made possible today the widespread use and abuse of electronic surveillance techniques. As a result of these developments, privacy of communication is seriously jeopardized by these techniques of surveillance." [17]
Accordingly, Congress stated that "Title III has as its dual purpose (1) protecting the privacy of wire and oral communications, and (2) delineating on a uniform basis the circumstances and conditions under which the interception of wire and oral communications may be authorized." [18] The Supreme Court, in its decision upholding Title III, found that "the protection of privacy was an overriding congressional concern." [19]
2. The Electronic Communications Privacy Act
Once again, in 1986, with the enactment of the Electronic Communications Privacy Act (ECPA), Congress took notice of the ever-increasing ability of technology to intrude upon personal privacy. ECPA extended Title III to wireless and non-voice communications and established rules for law enforcement's use of pen registers and trap and trace devices. Pursuant to its enactment, Congress warned of the new threats posed by advances in technology:
ECPA did not signal the end of Congress' concern with the growing intrusiveness of technology. In August 1990, Senator Patrick J. Leahy, Chairman of the Senate Judiciary Subcommittee on Technology and the Law, hosted a hearing that focused on Caller ID technology. At that hearing, Senator Leahy, who was one of the leading sponsors of ECPA, and who would become one of the two primary sponsors of CALEA, concluded that ECPA needed to be reviewed in light of various significant developments in the area of communications technology, to ensure that the privacy protections within the statute had not been mooted by these new technologies. [21]
Consequently, Senator Leahy appointed a private sector task force to study ways in which ECPA might have been superseded by emerging technologies. The task force concluded that "five years after ECPA was enacted, a new array of technologies, which were only on the drawing board in 1986, are in the process of being deployed" and that these technologies "are challenging the existing statutory scheme for communications privacy." [22]
3. The Communications Assistance for Law Enforcement Act
Given this historical context, when Congress began considering the concerns voiced by law enforcement regarding the potential loss of surveillance capabilities due to the advancement of technology, it had already received ample evidence that these new technologies were in some ways enhancing the government's surveillance capabilities at the expense of protected privacy rights. [23] In their report on CALEA, the House and Senate Judiciary Committees specifically cited the report of Leahy's task force, noting, with concern, that "as the potential intrusiveness of technology increases, it is necessary to ensure that government surveillance authority is clearly defined and appropriately limited." [24] The Committees warned of the "ever increasing opportunities for loss of privacy." [25]
Accordingly, when enacting CALEA, Congress reaffirmed that, "[f]or the past quarter century, the law of this nation regarding electronic surveillance has sought to balance the interests of privacy and law enforcement." [26] Clearly, CALEA was intended to preserve this important balance.
In addition to this historical background, the hearings on CALEA included specific testimony on the growing threat of electronic surveillance and the need to balance the competing interests of law enforcement and privacy. For instance, Jerry Berman, representing the Electronic Frontier Foundation at the time (he now serves as the Executive Director of CDT), opposed earlier drafts of CALEA because they did not adequately address the growing intrusiveness of new technologies. Later, when the legislation had been redrafted and narrowed, Berman praised its sponsors for "recognizing that technology is a two way street" and that
the other side of the technology street is that when technology advances, privacy can also be impaired and undermined and eroded. This legislation, unlike previous drafts, as the FBI Director has pointed out, deals with some of those privacy problems that have been created by the evolving technology . . . . [27]
The FBI's proposed reading of CALEA would have this Commission ignore Congress' longstanding and consistent concern with the impact of electronic surveillance on fundamental privacy interests. Indeed, the FBI has urged the Commission to turn this history, as well as well-established constitutional privacy principles, on their heads, arguing that public safety and national security should now be the paramount considerations in the Commission's interpretation of CALEA. [28] It is this Commission's responsibility to preserve this historical balance by refusing to adopt this one-sided and erroneous view of the Act.
In fact, not only has Congress sought to preserve an appropriate balance in CALEA, in the final analysis, it has placed privacy interests in front of law enforcement. During the CALEA hearings, Senator Arlen Specter stated that "[w]hen the crunch comes, we have always chosen privacy as the superior value in our country, and I think that has to be maintained." [29] The FBI's approach to CALEA would require the exact opposite of what Congress intended.
Throughout this proceeding, the FBI has sought to create the impression that CALEA mandates a 100 percent solution to the difficulties it faces when conducting surveillance activities. The FBI has insisted on identifying all of the permutations an interception might take, all of the contingencies that could occur, and all of the bits of electronic information that it believes would be useful to have. Then, the FBI has tried to mandate in the CALEA standard the inclusion of features to address each and every one of these items. Consequently, while the FBI originally claimed that it was concerned with the total loss of wiretapping capabilities, due to the emergence of new technologies, and that it was only interested in preserving the "status quo," the FBI's most recent actions contravene its earlier representations as to the purpose and scope of CALEA.
The FBI began pushing for adoption of digital telephony legislation in the early 1990s because, as then FBI Director William Sessions stated, new technologies would soon make it "virtually impossible to capture criminal conversations." [30] The Clinton Administration's proposal for digital telephony legislation used the same language, arguing that legislation was necessary to prevent the virtually total loss of the ability to carry out wiretaps.
The Answer: Congress must enact legislation requiring that the new technologies contain capabilities allowing the government to continue using this invaluable tool to safeguard the United States. [31]
Congress was troubled by this impending loss of the wiretapping capability and, thus, it sought to preserve the status quo, as requested by the FBI, with the adoption of CALEA. Congress did not, however, attempt to create a 100 percent solution to each and every difficulty posed by the new technologies. Even the FBI acknowledged that CALEA was intended as a "stay-even proposition," preserving the FBI's "current access," [35] and not as a directive authorizing "totally ubiquitous or penetrating" compliance requiring every piece of a carrier's network to meet the Act's requirements. [36]
Now, however, the FBI is divorcing itself from the rational position that it advocated when CALEA was adopted. Now the FBI is demanding that CALEA is much more than the mere preservation of the status quo, much more than a continuing balance of all competing interests. The FBI is now claiming that CALEA mandates a 100 percent solution to be imposed at the expense of all other concerns. The Commission must not accept, however, the FBI's post hoc characterization of CALEA, as it flatly contradicts the plain language and legislative history of the Act, as well as the FBI's own pronouncements as to what the Act would require and what it was intended to achieve. CALEA requires four minimum surveillance capabilities to be built into the networks of telecommunications carriers, no more and no less.
Accordingly, CDT has petitioned the Commission to intervene in the establishment of a CALEA standard to preserve the longstanding balance between law enforcement and privacy interests. The industry interim standard already violates this balance by mandating a location tracking capability that Congress did not intend to be included within the Act, and by failing to require adequate privacy protections in packet networks. Moreover, expansion of the industry standard as the FBI proposes would further upset the balance.
The Commission's task in this proceeding is, at bottom, a narrow one. Essentially, it must "establish by rule, technical requirements or standards" that "meet the assistance capability requirements of section 103," taking into consideration the privacy, cost, and other factors set forth in Section 107(b). At bottom, then, for a capability to be included in the Commission-approved standard, it must be required by one of the four requirements of Section 103. However, as will be seen, neither the wireless location information standard nor any of the items on the FBI's punch list is mandated by Section 103, and are in fact outside its scope. For these reasons, none of these items may be lawfully included in the resolution of the CALEA standard ultimately adopted by the Commission in this proceeding. Conversely, the standard's treatment of packet networks does not adequately meet the privacy protection requirement of subsection (a)(4) of Section 103.
The call-identifying provision of Section 103 requires telecommunications carriers to ensure that their equipment, facilities or services "are capable of expeditiously isolating and enabling the government, pursuant to a court order or other lawful authorization, to access call-identifying information that is reasonably available to the carrier." [37] The FBI tries to significantly expand the meaning of the term "call-identifying information" to require inclusion in the CALEA mandate of a wireless location function, as well as a number of items on the FBI punchlist.
The plain language of Section 103(a)(2), as well as its legislative history, demonstrates that "call-identifying information" is a precisely defined concept that encompasses only the numbers identifying the calling party, the called party and the duration of a call. Specifically, the Act defines "call-identifying information" as the "dialing or signaling information that identifies the origin, direction, destination, or termination of each communication generated or received by a subscriber by means of any equipment, facility, or service of a telecommunications carrier." [38] The detailed description of "call-identifying information" contained in the section-by-section analysis in the Committee Report leaves little doubt as to the term's meaning:
Thus, the Committee Report makes clear that, while this provision includes the switch-based information equivalent to a seven or ten-digit phone number that directs a call when voice dialing or speed dialing features are used, it does not include location tracking information or any of the items contained in the FBI's punch list. While the Committee Report could not be clearer as to what Congress intended in this provision, the Act and its legislative history provide numerous additional clues indicating that the term cannot reasonably be read in the manner that the FBI urges.
Contrary to the FBI's repeated assertions that CALEA requires carriers to intercept "all communications and call-identifying information that law enforcement is authorized to acquire," [40] Congress decided not to require carriers to deliver all call-identifying information. When the digital telephony bill (H.R. 4922/S. 2375) was introduced in August 1994, it defined call-identifying information as "all dialing or signaling information associated with the origin, direction, destination or termination of each communication." However, when the law was enacted, the word "all" was dropped from the definition. This change shows that the call-identifying requirement does not cover all dialing or signaling information, but only a subcategory of that data - that which identifies the origin, direction, destination or termination of a communication.
The definition of call-identifying information only requires information "that identifies the origin, direction, destination or termination." The legislation, as introduced, used the broader phrase "dialing or signaling information associated with the origin, direction, destination or termination." However, as enacted, the phrase is more limited. Under CALEA, carriers need not implement network capabilities that can deliver all dialing or signaling information associated with the origin, direction, destination, or termination of a communication to law enforcement, but only the capability to deliver dialing or signaling information that identifies a communication's origin, direction, destination or termination.
Furthermore, the limitation beginning with the words "that identifies" applies to both "dialing" and "signaling." Even though "dialing" is a narrow word, Congress wanted to further limit it to exclude dialed number information that was not used for call processing. This was pursuant to the assurances of the FBI that it did not want to obtain with a pen register or trap and trace device the digits entered after call cut-through, and that it would treat as content any dialed number information transmitted after a communication had been established. As the Committees' report expressly states, "Other dialing tones that may be generated by the sender that are used to signal customer premises equipment of the recipient are not to be treated as call-identifying information." [41]
(b) "Signaling" includes nothing beyond "dialing" information and therefore cannot be used to support location information or the punch list
Location information and many of the controversial elements of the FBI's punch list clearly do not fit within the meaning of the word "dialing." Therefore, the FBI's claim must rest solely on the word "signaling." But in this context, the word "signaling" must be read narrowly in conjunction with the word "dialing." Following the legislative history, "signaling" refers to the "messages that identify the numbers dialed or otherwise transmitted for the purpose of routing calls through the telecommunications carriers' network." [42]
It is a well-established rule of statutory construction that, when two words are grouped together in a statute, as these terms are in CALEA, and their meanings are disputed, the meaning of the broader or ambiguous word must be limited by the narrower or more precise term. [43] Accordingly, as the term "dialing" means the mere registering of numbers 0 through 9 on the telephone, and the transmission of those numbers over the line, "signaling" cannot be stretched to include other non-numerical information that the system may generate with or without customer action. The FBI's claim that the meaning of the term "signaling" is broader than that of the term "dialing" cannot be correct as it violates this fundamental concept of statutory interpretation.
This conclusion that "signaling" must be read narrowly in relation to "dialing" is further supported by the FBI's own testimony in connection with the legislation. Time and again, the FBI stated that it only wanted CALEA to preserve access to call content and "dialing information." [44] And in response to a question about "transactional data," FBI Director Freeh assured Congress that the FBI was interested in dialed number information only:
I do not want that access [to transactional data], and I am willing to concede that. What I want with respect to pen registers is the dialing information: telephone numbers which are being called, which I have now under pen register authority. [45]
Moreover, in August 1994, when the legislation was introduced with the term "call-identifying information," the FBI Director testified again and praised the bill as a solution to law enforcement's need for "access to all communications and dialing information." [46]
Significantly, at no point during the legislative proceedings did the Director give any attention to the word "signaling," suggesting that, in his view, it was coextensive with the term "dialing." If the FBI had wanted Congress to treat the word "signaling" as something more, as it claims now, it should have brought such an interpretation to Congress' attention. Yet the FBI never did.
The word "signaling" was included in the statute in order to cover speed-dialing and voice-dialing -- services that allow a subscriber to initiate a call without dialing seven or ten digits. The problem posed by speed dialing is that a pen register on the customer line only picks up the memorized code for a particular phone number (e.g., the digit "1"), while the switch stores the seven or ten digit number that the customer's code signifies. Thus, for example, the customer "dials" a "1;" the switch produces a "signal" that corresponds to the 7 or 10 digit number needed to process the call. Through several references in the hearings, the FBI made clear that it needed a contemporaneous translation of the speed-dialing or voice-dialing commands into the seven or ten digit number; this is undoubtedly one of the problems the legislation was intended to address. The coupling together of the words "dialing or signaling" suggests that Congress intended to cover signaling information that is similar to dialing information; it offers no indication of an intent to include signaling information beyond that which is analogous to dialing information.
Finally, a broad reading of the term "signaling information" is inconsistent with Congress' apparent desire to respond to the fact that, for reasons unrelated to law enforcement's needs, the "signaling" channel was growing richer and richer as a source of personal information. There was great concern on the part of privacy advocates at the time CALEA was being debated that the signaling channel would be exploited by law enforcement based on the minimal pen register/trap and trace standard. [47] It would be inconsistent with the whole tenor of the hearings, especially the concerns expressed by CALEA co-sponsor Sen. Leahy, to conclude that Congress responded to these concerns by mandating an increase in the richness and accessibility of the signaling channel.
(b) No significance can be attached to Congress' replacement of "call set-up information" with "call-identifying information"
The FBI has tried to pin its theory for an expansive reading of the call-identifying requirement on the fact that Congress used the term "call-identifying information" when it enacted CALEA, instead of the term "call set-up information," which had appeared in the draft transmitted to Congress by the Clinton Administration in March 1994. There is no evidence, however, suggesting that the reason for the change was to broaden the reach of the legislation, or that Congress viewed the term "call-identifying information" as defined in the Act as any broader than the term "call set-up information." To the contrary, all of the evidence indicates that Congress saw no difference between the terms.
Congress' intent is manifest in the Report's use of language to describe "call-identifying information" that is virtually identical to (and if anything, somewhat narrower than) the language used by the FBI to describe "call set-up information" when it submitted proposed legislation using the latter term. [48] It is obvious that the Committee Report's description of "call-identifying information" was copied from the FBI's description of "call set-up information," indicating that Congress saw no significant difference between the two terms.
Second, FBI Director Freeh testified as if the new phrase had no significance. In March 1994, when the term "call set-up information" was being used, his prepared statement said that the purpose of the statute was to "ensure that the content of communications and call set-up information (dialing information) can be intercepted." [49] In August, after the legislation was introduced using the term "call-identifying information," Freeh testified the problem to be addressed by the legislation was "the needed access to all communications and dialing information." [50]
Finally, when one defined term supersedes another defined term, it is not necessary to speculate about whether the new term in isolation is broader than the discarded one. It is only necessary to look at the enacted definition, informed by any report language and the legislative history other than the change itself. As explained above, the totality of these references indicates that the meaning of "call-identifying information" as defined by Congress is not significantly broader than the meaning of "call set-up information."
(c) The words "origin," "direction," "destination" and "termination"
The words "origin, "direction," "destination" and "termination" further limit the definition of call-identifying information. The word "origin" is obvious enough: it is the number from which the call began. "Destination" is equally obvious: it is the number to which the call is being made. [51] Indeed, this is where the definition started out in the FBI's first legislative proposal in 1994; termination and direction did not appear in the FBI's April 1994 draft. [52] The original proposal read:
In the course of redrafting, the terms "direction" and "termination" were added. "Direction" was added to acknowledge the difficult call-identifying problem associated with call forwarding. If the surveillance target is making a call to a person with call forwarding, the target's home switch (from which law enforcement obtains its surveillance access) cannot tell where the call will end up (i.e., its "destination"). If a pen register is placed on the target's line, or at the central office switch servicing the target, the pen register will only capture the number dialed or signaled by the target. The call will go to the switch that services that number, but it may be "redirected" to another number, and then another and another. It would not be practical to require the target's home switch to know the final destination of a call. All that the home switch of the target (and each intermediate switch) could provide contemporaneously would be the "direction" of the call as it passed through: the identity of the next number to which it was redirected. On the other hand, if the target is receiving a call that has been forwarded through various other numbers, the target's home switch (the last switch handling the call) may not know the "origin" of the call; it may only know the direction it came from most immediately. Finally, if the one using call forwarding is the surveillance target, the target's home switch will know where the call has been redirected to, which may be the final destination point or may be yet another point from which it is forwarded. To reflect these various permutations of call redirection, Congress used the word "direction," since sometimes "direction" is all that is available to a carrier.
Finally, "termination" refers to the fact that a call (or call attempt) has ended by the surveillance target hanging up. That is, it refers to the duration of a call or call attempt. This information is obtained by a dialed number recorder (DNR), which is similar to a pen register, but also records the duration of calls by marking the time a phone went off-hook and the time it went back on-hook. [54] "Termination" thus means the time when a call ended, not how it ended. While there is little reference in the legislative history to "termination," and no reference could be found to dialed number recorders, the ending of a call by hanging up (off-hook, on-hook readings) is the meaning of the word most consistent with general law enforcement practice, as Congress understood it, especially in light of Congress' injunction that the requirements be interpreted narrowly. [55]
Congress was concerned that the "call-identifying" requirement would impose a burden on carriers, or that it would serve as the vehicle for law enforcement to expand the information content acquired by pen registers. Therefore, Congress limited the call-identifying requirement in a way it did not limit the call content requirement. The section of CALEA that establishes the call-identifying requirement requires carriers only to ensure that their systems are capable of isolating and intercepting call-identifying information "that is reasonably available." This means that even if a data element otherwise falls within the definition of "call-identifying information," carriers are not required to incorporate the capability to provide it to law enforcement unless it is reasonably available.
This is an important limitation on any interpretation of the call-identifying requirement. Certainly, Congress' inclusion of the phrase makes it very difficult for the FBI to contend that CALEA requires carriers to modify their systems to provide government access to signaling information that is not otherwise reasonably available on a contemporaneous basis. Indeed, the report of the Committees explicitly states, "However, if such [call-identifying] information is not reasonably available, the carrier does not have to modify its system to make it available." [56]
The interim industry standard requires cellular and PCS carriers to provide law enforcement agencies with location (cell site) information at the beginning and end of any cellular and PCS communication. Cell site or other location information cannot be found in any of the terms of the call-identifying information requirement. Location simply does not fit within the phrase "dialing or signaling information that identifies the origin, direction, destination, or termination of each communication." Clearly, "location" is not included in this list, and Congress could easily have included it. Each of the four terms in the list has a meaning related to the directory number of the calling or called party or the duration of the call, such that none of them can be stretched to also cover geographical location. Moreover, the location information sought by the FBI identifies the location of the telephone instrument, not the location of a "communication," which is what the Act refers to. [57]
Not only does location information not fit within the definition of call-identifying information, but it was the express intent of Congress, supported by the Director of the FBI on the record in public testimony, that CALEA not include any requirement to provide location or tracking information.
The concern that CALEA would mandate the availability of location information was a major source of privacy objections to the legislation in 1994. At the joint House and Senate hearings on March 18, 1994, FBI Director Freeh expressly testified that "call set-up information" (later changed to "call-identifying information") as a CALEA requirement was not intended to include location information. Director Freeh was very clear in disavowing any interest in covering such information:
Eliminating location information as a CALEA mandate, however, did not solve the question of what to do with the fact that location information was nonetheless already available in some wireless systems and would be available in the future for reasons having nothing to do with CALEA. [60] Privacy advocates expressed concern that this information would be available with a mere pen register. [61] In response, Congress adopted a provision making it clear that if location information is available, it cannot be obtained by the government under a pen register or trap and trace order. (Congress did not specify what standard should be applied.) This provision started out as part of the definition of "call set-up information." When the term "call-identifying information" was adopted, the prohibition against providing location information as part of call-identifying information was moved out of the definition section and into the requirement section for call-identifying information.
After these changes were made, the FBI Director testified in support of the revised legislation, noting its reasonableness and its privacy protections. He never suggested in his testimony or in any other materials submitted for the record that any of the changes was intended to make location information -- one of the most contentious issues in the first hearing -- a CALEA mandate. By the time Freeh testified at the final CALEA hearings in August 1994, he appeared to accept the interpretation of Jerry Berman of the Electronic Frontier Foundation, who said that "[i]t is also important that one of the requirements that the committee has imposed is a requirement not to design ongoing location features into the electronic technology for communications. We do not want to turn our cellular and radio-based communication systems into nationwide tracking systems for persons who may be of interest to law enforcement and who are not subject to a warrant." [62] There was never any suggestion in the record that the assurance given by FBI Director Freeh on March 18 had been abandoned or that Congress intended to make location information a CALEA requirement.
2. The FBI Cannot Now Convert the Explicit Statutory Prohibition Against Providing Location Information Under Pen Register Orders into an Implied Requirement that Location be Provided under a Higher Standard
Since the enactment of CALEA, the FBI has claimed that the prohibition against providing location information under the minimal standard for a pen register or trap and trace device is actually a mandate for location information. The FBI now interprets this prohibition against providing location information in some cases as implying a requirement that location information must be uniformly available in other cases. But the statute does not state when or under what legal standard location information must be made available. An express prohibition against providing location information in some cases cannot be turned into an implied requirement to provide it in other, unspecified cases, especially given the FBI's express and never retracted assurances on the record that location information was not mandated by CALEA and Congress' injunction that the CALEA requirements must be narrowly interpreted.
The industry's decision to yield to the FBI and add location information to the J-STD violated Congress' intent that the capability assistance requirements of CALEA would serve as "both a floor and a ceiling" for government surveillance capabilities. [63] This statement by the Committees goes to the core of the balanced approach Congress intended in CALEA. The statute was intended to create a process for preserving a narrowly focused surveillance capability. It was not intended to afford the FBI leverage to steadily increase its capabilities. Changes in technology will bring ebbs and flows in government surveillance capability. The statute was not intended as a ratchet device to standardize every increase in the surveillance potential of telecommunications technology. By adding location information, carriers standardized a capability that Congress had specifically intended to exclude, violating Congress' ceiling principle.
CDT is not asking the Commission in this proceeding to require carriers to design their systems so they cannot provide location information. Under 18 U.S.C. § 2518(4), location information, if otherwise available, can be obtained under appropriate legal authority (but not under a pen register or trap and trace). But location information is not a CALEA mandate. Location information must be deleted from the CALEA safe harbor, because it goes beyond Congress' intended minimum, as reflected in Section103(a)(1) - (4). As far as CALEA is concerned, carriers should be free in the future, as they have been in the past, to build or not to build systems that generate and collect location information. Keeping it in the standard makes it a minimum requirement, contrary to the FBI's explicit assurances during the hearings, and contrary to Congress' intent that the capability requirements serve as a ceiling.
Telecommunications systems rely increasingly on packet mode data transmission protocols such as those used on the Internet. In a packet network, communications are broken up into individual packets, each of which contains addressing information that helps route the packets to their intended destination, where they are reassembled. Currently utilized primarily on the Internet for data communications, this technology also offers substantial advantages in the voice environment as well, and telecommunications companies are beginning to incorporate it in their systems.
On the apparently untested assumption that it is not feasible to provide signaling information separate from content in a packet switching environment, industry's interim standard (Section 4.5.2) allows companies to deliver the entire packet data stream -- including the content of communications -- when law enforcement is entitled to receive only dialing or signaling information under a pen register order. The proposed CALEA standard relies on the law enforcement officials that conduct the interception to sort out the addressing information from the content, keeping the former but ignoring the latter.
Delivery of both signaling and content where only content is authorized to be intercepted violates Section 103(a)(4)(A) of CALEA, which requires carriers to ensure that their systems "protect[]the privacy and security of communications and call-identifying data not authorized to be intercepted." The Commission should therefore delete Section 4.5.2 from the standard it ultimately establishes and issue guidance indicating how carriers and equipment manufacturers can comply with the CALEA requirement when implementing packet network services.
Section 4.5.2 of the standard allows packet data to be delivered to law enforcement by carriers in the same manner regardless of whether the law enforcement agency is authorized to receive signaling alone or both signaling and content. Under the terms of the standard, the carrier is allowed to provide the entire packet stream regardless of whether a law enforcement is entitled to receive content at all. The language of the standard currently provides:
Packets shall be sent to the Collection Function when they are intercepted. The intercepted packets shall be delivered without interpretation or modification, expect for possible re-framing, segmentation, or enveloping required to transport the information to the Collection Function or except to remove information that is not authorized.
As we understand this provision, separation of signaling from content is allowed, but not required. CDT highlighted the inherent violation of Section 104 of CALEA in its ballot comments on the proposed industry standard. The draft was modified but it still falls short of requiring carriers to separate content from addressing. Instead, it relies on the government to sort out the addressing information from the content. This permissive approach to CALEA compliance, were it followed, could totally obliterate the distinction between call content and call-identifying information that was a core assumption of the Electronic Communications Privacy Act and of CALEA itself.
In the old analog telephone systems, law enforcement agencies authorized to receive dialing information were provided with access to the target's entire line, including content. With subsequent developments in technology, dialing information for call-routing purposes was carried on a channel separate from the call content. In this respect, technology itself can enhance privacy, creating an environment in which a law enforcement agency conducting a pen register would receive only so much as it was entitled to receive, and no more. Absent CALEA, packet networks might have undone that privacy enhancement, for both addressing and content travel together in packet-data systems. But through CALEA, Congress imposed on the telecommunications industry an affirmative obligation to protect communications not authorized to be intercepted. CALEA, Section 103(a)(4).
In a packet network environment, this means that carriers must separate addressing information from content (subject to CALEA's overall reasonably achievable standard). [64] The interim industry standard has failed to implement this requirement.
2. Compliance with Privacy Requirements Calling For Separation of Signaling and Message Content Information Appears Reasonably Achievable in at least some of the Packet Networks Discussed in Section 4.5.2
The standard mentions eight different packet network architectures and purports to be a safe harbor for all of these technologies. Generally available network analysis tools and techniques suggest that it is possible to separate signaling or addressing information from call content in at least some of the major packet network technologies covered by the standard.
X.25 networks, which are connection-oriented, contain separate and distinct call set-up and teardown messages. In this case, the carrier ought to be required to send law enforcement only the call set-up and teardown messages unless a full content interception is obtained. In another important network technology, TCP/IP (Internet) networks, packet headers are always of a fixed length and can therefore be automatically separated from the remaining portion of the packet. In this case, the carrier would send law enforcement the 20-byte IP headers after deleting everything that follows. Existing tools for network performance monitoring generally allow network technicians to copy from a data stream a specific number of bytes of each packet that contain just the protocol headers of interest. Similar network monitoring tools exist for Asynchronous Transfer Mode (ATM) networks as well as others mentioned in Section 4.5.2. Use of these tools would not only minimize the potential privacy invasion, but it would also greatly reduce the volume of data collected. Given that it is clearly reasonably achievable to meet the Section 104 privacy requirement in a number of the major packet networks covered by the standard, this section of the standard fails to meet statutory privacy protection requirements that are part of CALEA.
3. The Commission Should Replace the Current Provisions of Section 4.5.2 With a Requirement that Carriers Must Separate Signaling Information From Message Content
Having demonstrated that Section 4.5.2 of the current standard fails to meet the privacy requirements of CALEA Section 103, we believe that the Commission must strike this portion of the standard pursuant to CALEA Section 107. In its place, the Commission ought to rule that Section 103 requires carriers to deploy assistance capabilities along with packet technology in a manner that enables them to separate packet addressing information from message content when responding to court orders authorizing only the deliver of addressing, but not content. Based on this finding, standards-bodies with expertise in the variety of packet network technologies being deployed today can then issue more precise guidance to their members, as they deem appropriate.
The FBI claims that CALEA requires carriers to intercept the ongoing communications of parties on a conference call after the target of the investigation has dropped off the call and gone on to another call. At the time CALEA was enacted, the FBI expressed concern that three-way calling features interfered with its ability to listen to the communications of a target. Now, however, based on an overly-expansive reading of both the electronic surveillance laws and CALEA, the FBI would require carriers to build the capability to monitor all parties to a multi-party call even after the subject of the intercept order is no longer participating in the call. The purpose of CALEA was to follow the target, not to facilitate monitoring of those left behind after the subject of the court order is no longer on the call.
The first thing to note about this punch list item is that the DOJ/FBI plainly admit that this is not a status quo capability. Contrary to all the statements of the FBI at the Congressional hearings that CALEA was intended to preserve the wiretapping technique as it had existed since 1968, and contrary to the clear intent of the Committees that CALEA was intended to maintain the status quo, the FBI admits in its petition that it wants this Commission to interpret CALEA to mandate a capability that has not been traditionally available to law enforcement. [65]
Nor is this punch list item required by the language of the Act. CALEA requires carriers to provide law enforcement with all wire and electronic communications "carried by the carrier to or from equipment, facilities or services of a subscriber." A conference call to which the subscriber is no longer a party is not a communication "carried by the carrier to or from the equipment, facilities or services of the subscriber." Recognizing this, the FBI would change the reading of the Act to "all wire and electronic communications supported by a subscriber's service." [66] This is clearly a broader reading than the words of the statute will sustain. A conference call that the subscriber has dropped off of may still be "supported" by the subscriber's service in some theoretical way, but it is not carried to or from the equipment, facilities or services of the subscriber.
Moreover, the words "equipment, facilities, or services" must be read carefully. "Equipment" is clear enough; it has a physical connotation, referring to a wireless phone, for example. "Facilities" is drawn from Title III. It was adopted in 1968, long before there were wireless phones; it too has a physical connotation. Only the word "services" could possibly support the FBI's conference calling proposal, and it seems that Congress used the term to refer to instances where a targeted subscriber might evade interception of communications to which he or she was a party. It was in this context that FBI Director Freeh in his testimony used the word "services" to refer to services that "undermine the necessity for communications to be transmitted always to the same specific location or through the same wireline loop." [67] The Director was referring to call forwarding or "follow-me-type" services, where the concern was that law enforcement would miss the communication of the subscriber to the service.
The Committees' report confirms this narrow reading, specifically stating that CALEA would require carriers "to ensure that new technologies and services do not hinder law enforcement access to the communications of a subscriber who is the subject of a court order." [68] A conference call to which the subscriber is no longer a party is not a "communication of the subscriber who is the subject of the court order." It is a communication of two or more other people.
In explaining the justification for the three way calling requirement, the DOJ/FBI now posit the following hypothetical:
Under the interim standard, an intercept subject might initiate a conference call with two associates, A and B, then place A and B on hold while answering an incoming call. A and B could continue talking while the subject speaks to the incoming caller on another line. Law enforcement would not receive the content of the conversation between A and B, even though that conversation is being supported by the subscriber's service or carried by the subscriber's facilities, may be legally intercepted under the Title III order, and is pertinent to the criminal activity under investigation. [69]
What the DOJ and the FBI fail to state is that the reason why law enforcement would not receive the conversation between A and B is because the carrier would be intercepting and providing to law enforcement the conversation that the intercept target was having with the new caller. The purpose of CALEA is to ensure that new technologies like call conferencing do not interfere with the interception of calls to the intercept target. Law enforcement would have something to complain about if carriers said that once having established an interception on the conference call, they could not create a new interception on the new call that the intercept target accepts. But that is not what carriers are proposing. They have agreed to provide the capability to intercept the new conversation.
We doubt that the particularity requirement of the Fourth Amendment, reflected in Title III's Section 2518, would support a court order for the communications of presumptively innocent third parties when the targeted party is no longer on the call. As the DOJ/FBI acknowledge, an interception is directed either at a particular person or at particular facilities. Law enforcement may intercept either the named person or anybody using a named facility. It may not intercept an unnamed party using an unnamed facility.
2. CALEA does not Require the Carrier Originating a Call to Provide Post-Cut through Dialed Digits; the FBI Specifically Assured Congress that this was not Covered by CALEA's Call-Identifying Information Requirement
When a person uses a long distance calling card, he or she first dials the 800 or local number that leads to the long distance carrier's system. The local carrier, if served with a pen register order, would be required to intercept the seven digit or 800 access number, but the carrier would then establish a content channel for the calling party and treat the call as connected from its perspective. Then the caller may be prompted by the long distance carrier to dial additional numbers, including the desired ultimate destination of the long-distance toll call. To the system of the local exchange carrier complying with a surveillance order, these digits dialed after call cut-through do not identify a call. By definition, they are "post cut-through." This means that, for the carrier complying with the order, the call has been properly routed and any further dialed digits are treated as indistinguishable from other content. Law enforcement wishing to intercept these post cut-through digits has two choices: serve the first carrier with a content interception order, or serve the long-distance carrier, which does treat the digits as call-routing information, with a pen register order or subpoena. The FBI does not want to make this choice. It wants to interpret CALEA to require the first carrier to provide the post cut-through digits under the much weaker pen register standard.
The issue here, contrary to the claim of DOJ/FBI in their Petition at ¶ 71, is not the loss of post cut-through dialed digits. Law enforcement will still be able to determine the destination of subject-initiated calls. That information is of course available to law enforcement on the content channel with Title III authorization or from the target's long distance carrier with a mere pen register order or subpoena. The issue is whether the FBI can use CALEA to reduce the standard for access to information that carriers treat as content and avoid going to the long distance carrier.
Congress made it clear that CALEA was "not intended to guarantee 'one-stop shopping' for law enforcement." [70] Yet that is precisely what the government wants here.
The legislative history makes it clear that "call-identifying information" does not include dialed numbers after call cut-through. In his initial testimony on CALEA, FBI Director Freeh derided some CALEA critics for raising what Freeh called the "false 'transactional data scare.'" Freeh was very explicit in saying that CALEA was intended to cover only the "dialing information derived from a pen register," as distinguished from the transactional data. Freeh's testimony specifically addressed the situation involving long distance credit card calls:
The dialing information derived from a pen register is obtained by law enforcement and is limited to a specific telephone line and number. On the other hand, transactional billing information is compiled . . . from every telephone a subscriber may use during the billing period, such as credit card calls . . . . [71]
There is another reason why post cut-through dialed digits are not covered: a local carrier will have no way to tell which post-cut through dialed digits are for call-processing purposes and which are content. There are times when post-cut through dialed digits are clearly not call-identifying information. For example, when a person calls her bank-by -phone number and uses an automatic prompt system and the dial pad to access various bank services, those dialed digits are not call-identifying in any way. They are clearly content. On the other hand, when a person using a long-distance calling card calls a local or 800 access number, some of the digits dialed after the prompt are used for call-processing while others are for phone company billing purposes and are not call-identifying information under any reading of the definition.
To do what the FBI asks, the local carrier will inevitably provide content to law enforcement under the lower pen register standard, which is precisely what Congress wanted to avoid. Contrary to the FBI's assertion in its Petition, there is a privacy based constraint that prevents carriers from providing content in response to a pen register.
Finally, even if the post-cut through digits were considered to be call-identifying information, they are mixed in with content and therefore are not "reasonably available" to the local carrier on a signaling channel. Section 103(a)(2) only requires carriers to provide "reasonably available" call-identifying information.
3. The Detailed Signaling Data Sought by the FBI Does Not Fit the Definition of Call-Identifying Information.
FBI Director Freeh repeatedly assured the Congress that call-identifying information was limited to dialed number information. "What I want with respect to pen registers is the dialing information: telephone numbers which are being called, which I now have under pen register authority." [72]
In their petition, the DOJ and the FBI now contend that the requirement to provide call-identifying information encompasses a truly dazzling array of signaling information. It is difficult to parse from their Petititon all the specific items of information that the FBI believes are encompassed by the phrase "call-identifying information," but they would include the following (all citations are to the DOJ/FBI petition): [73]
(1) Flash hook messages (¶¶ 58, 61): [74] The FBI claims (¶ 63) that this is necessary "to follow the course of the conversation [and] determine to whom the subject is speaking at any point in the conversation." For this punch list item, as for many of others, the FBI has developed a totally new justification. No longer is the FBI interested in identifying the origin, destination, direction or termination of the call. Instead, the FBI wants (¶ 59) this capability so that it can "identify the parties to the call." This is the exact opposite of the common understanding of the pen register, as outlined by the Supreme Court: "Neither the purport of any communication between the caller and the recipient of the call, their identities, nor whether the call was even completed is disclosed by pen registers." [75]
(2) Party hold, party join, party drop messages (¶¶ 73 - 75): The FBI admits (¶ 77) that party hold and party drop messages were not available with pen registers. This is a case where the FBI is trying to expand its surveillance capabilities beyond the status quo. Party hold, drop and join messages do not identify calls, they identify callers. Again, the FBI bases these punch list items (¶ 75) not on the need to identify communications, as CALEA requires, but to identify parties: "Without these messages, law enforcement would not know who joins or leaves a conference call, whether the subject alternated between calls, or which parties heard or said parts of a conversation." Moreover, the FBI invents a new concept: It argues that CALEA requires carriers to provide call-identifying information for each 'leg' of a call. The concept of "legs" of conversations does not appear anywhere in CALEA.
(3) Access to all network-generated in band and out-of-band signaling: This includes a ringing signal, indicating whether the subject's telephone was alerted by tones, visual indicators or text messages, and a busy signal, including a busy tone, a trunk busy signal, and a stutter tone (¶ 80). It also includes a call waiting tone, (¶¶ 58, 80). The fact that a subscriber has a call waiting does not indicate the origin, direction, destination or termination of a communication. If the subscriber takes the call, certainly the carrier is required to identify its origin. If it is reasonably available, the carrier would also provide the origin of the waiting call even if the subscriber doesn't take it. That would be the equivalent of a call attempt. But indicating that there is a call waiting does not identify the origin, destination direction or termination of the call at all.
(4) Message waiting indicator: This network intelligence does not identify a call and is outside the scope of CALEA. The Committee report states, "The storage of a message in a voice mail or E-mail 'box' is not covered by the bill." [76]
None of these provisions find support in the definition of pen register or trap and trace device. The purpose of the call-identifying requirement as explained to Congress was to preserve access to data that had been acquired by pen registers and trap and trace devices, i.e., to ensure that law enforcement could obtain the phone number of origin of incoming calls and the phone number of destination of outgoing calls, notwithstanding a target's use of services such as speed dialing, voice dialing, or call forwarding. "Such information [dialing type information] is critical to law enforcement and, historically, has been acquired through the use of pen register or trap and trace devices pursuant to court order." [77] These were the problems the FBI talked about and which CALEA's call-identifying provision was intended to address. [78]
Before the Commission are questions regarding the extent to which the Interim Industry Standard complies with the requirements of CALEA to meet law enforcement surveillance needs, protect individual privacy, and guard innovation in the development of new telecommunications technologies. CDT believes that several key provisions of the standard must be deleted because they contravene the explicit dictates of the statute and, as a result, pose grave threats to the privacy rights of Americans. The provisions at issue are: a) requirements that carriers provide real time location information, and b) treatment of private information in packet data networks that would allow for improper disclosure of information to law enforcement. We have also shown that the 'punch list' items requested by the FBI are not required under the statute.
CALEA is but the latest chapter in a long history of Congressional attempts to balance cherished privacy rights with the desire to provide law enforcement limited, but effective, electronic surveillance capabilities. In CALEA, Congress chose to express this delicate balance with a series of specific legislative requirements to be followed by communications carriers and equipment manufacturers.
While the debate over the substance of the statute was long and contentious, Congress had hoped that the implementation process might be more constructive, inasmuch as the industry, in consultation with law enforcement, had only to implement the statutory requirements. However, in the event that the implementation process failed to produce an adequate standard, Congress did provide procedures to resolve disputes and assure that the statutory mandates were realized.
The four requirements at the heart of CALEA are both the "floor and the ceiling" on surveillance capabilities to be implemented under the statute. These requirements are the Congressional expression of the proper balance between law enforcement surveillance power and the privacy rights of all Americans. A standard which goes below this floor would jeopardize law enforcement interests, while one that exceeds this ceiling would pose a threat to privacy and innovation. Regrettably, the interim standard exceeds the ceiling in several critical new areas of communications technology: requiring wireless networks to be turned into real-time tracking systems, and threatening the privacy rights of all who communicate using new packet data networks. We respectfully request that the Commission act to remove the portions of the standard that violate the privacy requirements of CALEA and provide appropriate guidance as to the meaning of the statutory requirements for all carriers and manufacturers who are subject to its dictate. Failure to do so would frustrate the delicate balance struck by Congress and threaten basic Constitutional rights of Americans in the Information Age.
Respectfully submitted,
CENTER FOR DEMOCRACY AND TECHNOLOGY
/s/ /s/James X. Dempsey, Senior Staff Counsel Martin L. Stern
Daniel J. Weitzner, Deputy Director Lisa A. Leventhal
Center for Democracy and Technology Preston Gates Ellis & Rouvelas
1634 Eye Street, N.W., Suite 1100 Meeds LLP
Washington, D.C. 20006 1735 New York Avenue, N.W., Suite 500
(202) 637-9800 Washington, D.C. 20006
(202) 628-1700
FOOTNOTES
1 Pub. L. No. 103-414, 108 Stat. 4279 (1994), codified at 47 U.S.C. §§ 1001-1010 and in various sections of Title 18 and Title 47.
2 47 U.S.C.§ 1002(a)(4) (emphasis added)
3 In the Matter of Communications Assistance for Law Enforcement Act, 13 FCC Rcd. 3149, ¶ 5 (1997)(citing H.R. Rep. No. 103-827, pt. 1, at 13 (1994)).
4 140 Cong. Rec. H10773, H10780 (daily ed. Oct. 4, 1994)(statement of Rep. Markey).
5 The Act also provides that carriers must comply with Section 103's four requirements within four years from the date of enactment, which is October 25, 1998. 47 U.S.C. § 1001(b). The October 1998 compliance date is the subject of the first round of comments submitted to the Commission, where CDT, telecommunications carriers and manufacturers all stated that compliance would be impossible by this date and urged the Commission to grant an industry-wide extension.
6 The order may also direct that the carrier's equipment supplier provides modifications that would allow the carrier to comply. A similar order may be issued by a court issuing a surveillance order. 18 U.S.C. § 2522(a), (b).
7 47 U.S.C. § 1007(a).
8 See 47 U.S.C. § 1006(a).
9 Id. However, the absence of an industry-wide standard does not relieve carriers and manufacturers of their obligations under Section 103 of the Act. 47 U.S.C. § 1006(a)(3). Accordingly, an industry standard is critical if case-by-case, mass adjudications on what the Act requires are to be avoided.
10 This responsibility is, of course, subject to appellate review.
11 47 U.S.C. § 1006(b).
12 Id.
13 These interests have been joined more recently by a third interest, namely encouraging technological innovation and competition in the communications industry.
14 Lopez v. United States, 373 U.S. 427, 441 (1963).
15 This initial federal wiretap law is known as Title III, for it was Title III of the Omnibus Crime Control and Safe Streets Act of 1968.
16 In 1964, the Senate Judiciary Subcommittee, chaired by Senator Edward V. Long, began extensive hearings.
17 S. Rep. No. 1097, at 67 (1968).
18 Id. at 66. Indeed, in recognition of the uniquely intrusive aspects of wiretapping, Congress imposed privacy protections in Title III that actually went beyond those required by the Fourth Amendment. For example, Congress limited the use of wiretapping to a prescribed list of more serious crimes. In addition, Title III required law enforcement to show that other Fourth Amendment techniques had been tried and were unsuccessful or would not be successful. Moreover, Title III required special high level Department of Justice approval to apply for a surveillance order.
19 Gelbard v. United States, 408 U.S. 41, 48 (1972).
20 S. Rep. No. 99-541, at 3, 5 (1986).
21 See Digital Telephony and Law Enforcement Access to Advanced Telecommunications Technologies and Services: Joint Hearings on H.R. 4922 and S. 2375 Before the Subcomm. on Tech. and the Law of the Senate Comm. on the Judiciary and the Subcomm. on Civil and Constitutional Rights of the House Comm. on the Judiciary, 103d Cong., S. Hrg. 103-1022 (1994) ("Hearings"), at 179.
22 Id. at 180.
23 In fact, the Leahy task force report was incorporated into the hearing record for CALEA. Id. at 179.
24 H.R. Rep. No. 103-827, pt.1, at 17 (1994)("House Report"). The Senate Judiciary Committee report is identical to the House Report being cited. S. Rep. No. 103-402 (1994). No other committees filed reports. Thus, although some sections of the legislation changed after the Judiciary Committees acted, the Judiciary Committee reports remain the best legislative history. Many provisions ultimately enacted were unchanged from the version reported by these Committees.
25 House Report at 12.
26 Id. at 11.
27 Hearings at 158.
28 In its comments in the related proceeding on CALEA security, the FBI incorrectly states that "[t]hese goals are to be achieved through whatever technical modifications are necessary." FBI Comments at ¶ 18. The FBI also incorrectly states that CALEA requires carriers offering calling features "to make all necessary network modifications to comply with CALEA." FBI Comments at ¶ 30. To the contrary, CALEA only requires carriers to make changes that are reasonably achievable and also makes clear that law enforcement cannot require carriers to build additional assistance requirements into their telecommunications networks. Indeed, Section 103(b) specifically states that CALEA does not authorize any law enforcement agency "to require any specific design" of telecommunications equipment, facilities or services. 47 U.S.C. § 1002(b)(1)(a).
29 Hearings at 82.
30 "Advances in telecommunications technology promise to deprive Federal, state and local law enforcement officers and the public of the incalculable benefits that can be obtained only by court authorized wiretapping.***As in 1968, [Congress] must decide if law enforcement should have this valuable tool available." William S. Sessions, Keeping an Ear on Crime: The FBI Needs Industry's Help, N.Y. Times, Mar. 27, 1992, at A35 (emphasis added).
31 Hearings at 259.
32 Freeh stated that "[t]he purpose of this legislation, quite simply, is to maintain technological capabilities commensurate with existing statutory authority -- that is, to prevent advanced telecommunications technology from repealing, de facto, statutory authority now existing and conferred to us by the Congress." Id. at 7.
33 Id. at 9.
34 Id. at 127.
35 FBI Oversight and Authorization, Fiscal Year 1993, Hearings Before The Subcomm. on Civil and Constitutional Rights of the House Judiciary Committee, 102nd Cong., 2d Sess., 9, 13, 49, 78 (1992).
36 Hearings at 203. Further indication that Freeh was not striving for a 100 percent solution can be found in his recognition that a number of constraints limited the FBI's abilities under the statute. Freeh stated that, if sufficient funds were not appropriated, then law enforcement would be satisfied with a partial solution: "I would still be in a better place if I could have access to half of the criminal conversations than none of the criminal conversations." Id. at 197. Freeh also admitted that some surveillance targets would surely take steps to evade detection and that the legislation could not prevent such evasion. Id. He admitted that there would be technological impediments to surveillance: "There is always going to be and perhaps increasing because of the technology developments, a range of criminal activity and a particular type of criminal actor who will be immune from the best-designed and best-built system." Id. at 200.
37 47 U.S.C. § 1002(a)(2).
38 47 U.S.C. § 1001(2).
39 House Report at 21. As noted below, this is largely identical to (if anything slightly narrower than) the description used by the FBI for "call set-up information." Hearings at 277-78.
40 FBI/DOJ Petition at 1. See also FBI/DOJ Petition at 2, 41.
41 House Report at 21.
42 Id.
43 "If the legislative intent or meaning of a statute is not clear, the meaning of doubtful words may be determined by reference to their relationship with other associated words or phrases. Thus, when two or more words are grouped together, and ordinarily have a similar meaning, but are not equally comprehensive, the general word will be limited and qualified by the special word." Singer, Sutherland's Statutory Construction, § 47.16, 183 (5th ed. 1992) (footnotes omitted).
44 When FBI Director Freeh appeared before a joint hearing of the House and Senate Judiciary subcommittees in March 1994, he said that the legislation would ensure "that the content of communications and call set-up information (dialing information) can be intercepted." Hearings at 27. Furthermore, in his prepared testimony on March 18, 1994, Freeh stated at least ten times that the legislation encompassed "communications and dialing information." Id. at 24 (two references to "dialing information"); 27 (four references); 28 (four references). Later, when the FBI submitted a list of the problems that justified enactment of CALEA, the second most frequent problem (after cellular port capacity) was the "[i]nability to capture dialed digits contemporaneous with audio." The third most common was "speed dialing/ voice dialing/ call waiting," where the problem was the unavailability of information identifying the phone number to which a call was being made. Id. at 121.
45 Id. at 50.
46 Id. at 115.
47 Jerry Berman of the Electronic Frontier Foundation raised the problem at the first CALEA hearing. Id. at 65.
48 Compare House Report at 21(quoted above) with Hearings at 277-78, the section-by-section analysis that accompanied the FBI's draft including the phrase "call set-up information." It is interesting to note that the Committees' section-by-section description of "call-identifying information" is also very similar to the definition of "call set-up information" used by the FBI in the "Law Enforcement Requirements" document. Hearings at 290.
49 Id. at 27.
50 Id. at 115.
51 The section-by-section analysis prepared by the FBI in the fall of 1992 to accompany an earlier version of the digital telephony legislation stated:
Similarly, certain speed dialing features that mask the telephone called by the target must be identified for criminal law enforcement investigations. The ability to consistently determine the destination of calls is critical to minimizing the monitoring of innocent calls.
Linking "destination" to the problem of speed dialing indicates that the FBI wanted the 7 or 10 digits that were "masked" by speed dialing, not cell site or other physical location information and not status messages.
52 Hearings at 267-68.
53 Id.
54 Although similar in function to the pen register, a DNR has the additional feature of recording the duration of all calls on the target phone, whether incoming or outgoing.
55 The legislative history contains one reference in FBI Director Freeh's prepared testimony to "information generated by a caller which identifies the origin, duration, and destination" of a communication. Hearings at 33. This language was being used to describe "call set-up information;" when "call-identifying information" was adopted, the word "termination" was added to make it clear that duration was also covered.
56 House Report at p. 22.
57 The difficulty of fitting location information into the statutory definition is highlighted by a scenario in which both ends of a communication are mobile: what is the location of a "communication" when both the calling and the called parties are mobile.
58 Hearings at 29, 33.
59 House Report at 15.
60 Director Freeh stated in his testimony, "[s]ome cellular carriers do acquire information relating to the general location of a cellular telephone for call distribution analysis purposes." Hearings at 33. The Committee remained mindful of this; the Judiciary Committee report notes, "[c]urrently, in some cellular systems, transactional data that could be obtained by a pen register may include location information." House Report at 17.
61 Hearings at 161.
62 Id. at 158.
63 House Report at 22.
64 We recognize that there are substantial open questions about the application of traditional pen register authority to new packet data networks, but the Commission need not resolve that question here. It is clear that the pen register statute could not, no matter what the technological context, grant law enforcement access to message content. So, though it may not be clear what information law enforcement is able to access under pen register authority, it is certainly clear that content is not included. Therefore the Section 104 requirement to protect the privacy of content during access to signaling alone applies.
65 See DOJ/FBI Petition at ¶ 51.
66 Id. at ¶ 55.
67 Hearings at 24.
68 House Report at 16 (emphasis added.)
69 FBI/DOJ Petition at ¶ 52.
70 House Report at 22.
71 Hearings at 32 (emphasis in original).
72 Id. at 50.
73 This list shows that the FBI's "punch list" is not limited to eleven items, as the FBI claimed last year, or nine, but is a list of items within items, each of which can be expanded at the FBI's whim, making it impossible for carriers or subscribers to ever know with certainty what surveillance capabilities are required of the American phone system.
74 See also DOJ/FBI Petition at ¶¶58, 61 (transfer key message).
75 United States v. New York Tel. Co., 434 U.S. 159, 167 (1977) (emphasis added).
76 House Report at 23.
77 Hearings at 33.
78 According to the definitions of pen register and trap and trace device, this is what CALEA was intended to preserve:
the term 'pen register' means a device which records or decodes electronic or other impulses which identify the numbers dialed or otherwise transmitted on the telephone line to which such device is attached . . .;
the term 'trap and trace device' means a device which captures the incoming electronic or other impulses which identify the originating number of an instrument or device from which a wire or electronic communication is transmitted . . . .
Both pen registers and trap and trace devices identify "numbers." This alone eliminates many of the punch-list items.