|
|
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
|
CELLULAR TELECOMMUNICATIONS INDUSTRY ASSOCIATION, et al., and UNITED STATES TELEPHONE ASSOCIATION, Plaintiffs, v. JANET RENO et al., Defendants. |
CIVIL ACTION NO. 1:98CV01036 CIVIL ACTION NO. 1:98CV02010 Consolidated cases Judge Thomas F. Hogan |
MEMORANDUM OF AMICUS CURIAE
CENTER FOR DEMOCRACY AND TECHNOLOGY
IN OPPOSITION TO DEFENDANTS MOTION TO DISMISS OR FOR SUMMARY JUDGMENT AND IN SUPPORT OF PLAINTIFFS CROSS-MOTION FOR SUMMARY JUDGMENT
TABLE OF CONTENTS
INTRODUCTION
STATEMENT OF INTEREST OF AMICUS
PROCEDURAL AND FACTUAL BACKGROUND
ARGUMENT
II. THE NOTICE IS SO AMBIGUOUS AS TO BE MEANINGLESS, DENYING MEMBERS OF THE PUBLIC SUFFICIENT UNDERSTANING OF THE CALEA IMPLEMENTATION PROCESS
III. THE CAPACITY NOTICE GROSSLY AND UNREASONABLY OVERSTATES THE REQUIRED CAPACITY
INTRODUCTION
This is not just a case about cost: it is a case that deeply implicates the privacy and public accountability interests of the American people. To the extent it is about cost, it is not merely about the allocation of costs between the government and telecommunications carriers: regardless of whether costs are borne by the government or by the companies, they are paid ultimately by the same people the members of the public who are both taxpayers and telephone ratepayers.
The FBI's notice of capacity requirements for telephone surveillance does not comply with the Communications Assistance for Law Enforcement Act, because the notice fails to state clearly what the "actual" capacity requirements on carriers are. Under CALEA, the Attorney General has no discretion to issue an ambiguous capacity notice. Clear public notice of the surveillance capacity requirements is a predicate to CALEAs goal of privacy protection, since the public wont even know if its privacy is being infringed unless it knows what surveillance capacity is being imposed on the phone system. Congress clearly intended to bring information about CALEA implementation into the sunshine. The ambiguity of the FBIs notice deprives the public of the information that Congress felt was necessary to ensure that CALEA would be implemented in a balanced manner. The ambiguity of the notice is compounded by the FBIs unreasonable inconsistency in adopting and applying estimates of future capacity -- with the result that the notices requirements are grossly overstated. The notice is thus deficient under the Administrative Procedure Act as arbitrary and capricious, an abuse of discretion and not in accordance with the law.
STATEMENT OF INTEREST OF AMICUS
The Center for Democracy and Technology (CDT) is a non-profit, privacy and civil liberties organization. One of our main priorities is advocating strong privacy protections for new communications technologies. Since our inception, CDT has worked to ensure that the privacy and public accountability interests of the American public are respected in the implementation of CALEA.
CDT filed comments criticizing both the FBIs initial capacity notice and the second capacity notice. CDTs call for greater clarity and reasonableness in the second capacity notice was rejected by the FBI, leading to a final capacity notice that is both ambiguous in meaning and overexpansive in scope, putting at risk the privacy and public accountability interests to which Congress gave weight equal to that accorded to the important law enforcement concerns at stake.
CDT also has filed a petition at the Federal Communications Commission opposing the additional surveillance features sought by the FBI on the capability side of the CALEA debate: in response to CDTs petition and a petition by the FBI/DOJ, the FCC has launched a wide-ranging inquiry into the section 103 requirements of CALEA.
CDT addresses in this memorandum only the FBI's Capacity Notice, Implementation of Section 104 of the Communications Assistance for Law Enforcement Act, 63 Fed. Reg. 12218 (March 12, 1998). By focusing on only the capacity issues, we do not mean to suggest that there are not privacy and public accountability issues implicated in the cost reimbursement regulation.
PROCEDURAL AND FACTUAL BACKGROUND
The Communications Assistance for Law Enforcement Act (CALEA) was enacted in 1994. Pub. L. 103-414, 47 USC 1001 et seq. It was intended to preserve but not expand law enforcement's ability to conduct electronic surveillance in the face of changing technology. The law requires carriers to design their systems: (1) to meet four "assistance capability" requirements; and (2) to provide sufficient capacity to accommodate multiple surveillances at the same time.
This was a truly extraordinary and unprecedented law, mandating for the first time ever in the United States that telecommunications systems be designed and built specifically to accommodate government surveillance. Recognizing the dangers to privacy and technological innovation posed by such a mandate, Congress wove throughout CALEA a series of limitations and established a series of checks and balances, to ensure that law enforcement interests did not dominate the implementation process. See James X. Dempsey, "Communications Privacy in the Digital Age: Revitalizing the Federal Wiretap Laws to Enhance Privacy," 8 ALBANY L.J. SCI. & TECH. 65, 102-04 (1997).
One form that these protections took was public accountability: Congress sought to bring out into the public light the details of how CALEA was being implemented, in the expectation that the attention of the media, advocacy organizations and the public would serve a moderating role. This too was unprecedented, for the details of surveillance had always been kept from the public in the interests of security. But Congress felt it necessary, given the privacy and other risks inherent in CALEA, to bring the implementation process into the sunlight. Therefore, CALEA "capability" standards were to be adopted publicly, through industry standards-setting procedures, which are open to broad participation. CALEA, sec. 107(a)(2), 47 USC 1006(a)(2). (CDT participated in the CALEA standards-setting process, as did the FBI.) Those standards, once adopted by industry bodies, would be subject to challenge at the Federal Communications Commission by "any" person. Id., sec. 107(b), 47 USC 1006(b). (CDT and the FBI have both filed challenges at the FCC.) And capacity requirements were to be stated as an "actual number" adopted through a notice and comment proceeding in the Federal Register. Id., sec. 104(a)(1)(A), 47 USC 1003(a)(1)(A).
Despite this obvious Congressional desire for accountability, the FBI has tried ever since CALEA was enacted to avoid the balance among law enforcement, privacy and industry interests that Congress procedural requirements were intended to promote. Instead, the FBI has sought to interpret the law in a way that would reserve unto itself a discretionary control over the design of the Nations telecommunications system contrary to that which Congress was comfortable vesting in a law enforcement agency. Consequently, the legislation is mired in controversy on several fronts, and fulfillment of its law enforcement objectives has been delayed by a number of years.
Capacity Requirements
CALEA requires telecommunications carriers to ensure that they have sufficient capacity to accommodate multiple simultaneous law enforcement surveillance orders. To give carriers a "safe harbor," and to give the public knowledge of what type of surveillance capacity is being built into the Nation's telecommunications systems, CALEA requires the Attorney General to publish in the Federal Register, pursuant to notice and comment, the "actual number" of surveillances that she estimates government agencies may conduct in the future, specific to geographic area. CALEA, sec. 104(a), 47 USC 1003(a).
Part of the CALEA compromise was that carriers would be reimbursed by the government in perpetuity for capacity they added to accommodate the government. Once "actual" numbers are issued, CALEA requires a carrier to submit to the Attorney General a statement "identifying any of its systems or services that do not have the capacity to accommodate simultaneously the number of interceptions, pen registers, and trap and trace devices set forth in the notice." Id., sec 104(d), 47 USC 1003(d). The Attorney General may agree to reimburse a carrier for costs directly associated with modifications to attain such capacity requirement; if the Attorney General decides not to reimburse the carrier, the carrier shall be considered to be in compliance with the capacity notice. Id., sec. 104(e), 47 USC 1003(e).
The FBI was late in publishing its first proposed notice of capacity requirements. When it did so, the notice proposed requiring carriers in major urban areas to install a maximum surveillance capacity of 1% of "engineered capacity," equal to one out of every one hundred phone lines. 60 Fed. Reg. 53643 (Oct. 16, 1995). The proposal produced a firestorm of controversy, starting with a front page story in the New York Times. John Markoff, "F.B.I. Wants Advanced System to Vastly Increase Wiretapping," NEW YORK TIMES, Nov. 2 1995, p. A1. Immediately, in letters to Capitol Hill and to the Times, the FBI denied that that was the intent of the notice. The FBI Director wrote, "There is no intention to expand the number of wiretaps or the extent of wiretapping." Letter to the Editor, "F.B.I. Isnt Trying to Increase Wiretaps," NEW YORK TIMES, Nov. 3, 1995. The first notice fell into limbo and was effectively withdrawn.
Over a year later, the FBI published a second, quite different capacity notice, one that appeared on its surface to provide the "actual numbers" called for by CALEA. 62 Fed. Reg. 1902 (Jan. 14, 1997). However, on closer analysis, it became clear that the notice was fraught with ambiguity and that the FBIs methodology had overstated the historical baseline and projections for the future. CDT filed comments noting that one potential reading of the notice would require just one of the wireline carriers in Los Angeles to install the capacity to perform 136,000 simultaneous intercepts. CDT pointed out that the FBIs aggregation of surveillances switch-by-switch over a 24 hour period and then county-by-county over a 26 month period produced unreasonably high numbers. The lumping together of call content interceptions, pen registers and trap and traces exacerbated the privacy concerns. These problems were so profound, CDT concluded, that the FBI should issue "for further public comment an unambiguous notice with reasonable requirements."
A year after that, nearly two and a half years after Congress had expected, the FBI published a final notice, rejecting CDTs points. 63 Fed. Reg. 12218 (March 12, 1998).
Six days later, the Attorney General personally admitted that the final notice was ambiguous. In a memorandum addressed to telephone industry representatives, she stated: "Because there has been confusion about law enforcements overall requirements, both the Department and the FBI would be happy to discuss any issues related to the final Notice of Capacity and its implication on the carriers network." Attachment A. Rather than issue a clarification in the Federal Register, where it would be available to members of the American public, the Attorney General offered to engage in a "continuing constructive dialogue with the industrys working group." Id. Since then, all discussions of the meaning of the capacity notice have taken place off the public record, until this lawsuit was filed. [ 1 ]
ARGUMENT
By its ambiguous capacity notice, the FBI is seeking to exercise a discretionary control over the design of the Nations telecommunications systems that Congress did not intend to permit it, and one that in fact violates Congress clearly stated desire for public accountability and industry "safe harbors." Despite 92 pages of Federal Register-size print, including 4 appendices of region-by-region numbers and mathematical formulas yielding growth factors expressed in thousandths, it is impossible for members of the public to tell what capacity their telephone companies will be building in response to CALEA (just as it is impossible for those companies to tell what is required of them). A major reconfiguration of the Nations telecommunications system is being proposed and the public (like the carriers themselves) cannot tell what impact it will have on privacy. Throughout the notice, every time the FBI seems on the verge of giving a clear explanation of what is required, it clouds the discussion with an ambiguous statement like "Each carriers deployment strategy must ensure that, if needed, the estimated actual and maximum capacity requirements set forth for the applicable geographic area can be met." 63 Fed. Reg. at 12231. Basically, the FBIs message to carriers is: "We wont tell you how to interpret these numbers, but dont get it wrong."
The FBI builds its discretion on a methodology that grossly and unreasonably overstates the amount of capacity required. Each element of the methodology may seem reasonable in isolation, but each one serves as a multiplier. Cumulatively, they produce unreasonably high requirements, ones higher even that the 1 in 100 phone lines requirement in the FBIs first, discredited notice. In Los Angeles, for example, the notice seems to require one carrier to have available the capacity to conduct 46,100 simultaneous interceptions. [ 2 ]
The notice violates CALEA and the APA because its numbers do not represent the "actual number" of surveillances that any carrier will be required to install. It turns out that the FBIs "unprecedented" collection of data, its complicated methodology, and the resulting overstatement of capacity requirements, are merely the prelude to a non-public reimbursement process in which the FBI will decide what the capacity requirements really are carrier-by-carrier. Under the Act, carriers submitted last September "Carrier Statements" indicating whether they could meet the requirements in the capacity notice. According to the notice, the confidentiality of these statements "will be protected." 63 Fed. Reg. at 12234. After reviewing the statements, the Attorney General may reimburse carriers. Those she chooses not to reimburse, or to only partially reimburse, are otherwise deemed in compliance. According to the government, this will not be a "negotiation." In terms of how the Attorney General will decide what capacity to reimburse and what to forego, the notice offers no information. It merely states: "Decisions to enter into cost reimbursement agreements will be based on law enforcement prioritization factors." Id. What those factors are is nowhere publicly stated.
With this one sentence, all of the governments complicated defense of the methodology behind the notice is rendered irrelevant. In essence, the DOJ/FBI have taken all of the superficial certainty that the charts in the notice offer and cloaked it in the uncertainty of the reimbursement process. This vitiates Congress intent to provide public accountability to the CALEA implementation process as one means of ensuring that the statute is implemented in a balanced manner that protected privacy on a par with industry and law enforcement interests.
There is no need to cast aspersions or impute bad faith to the FBI in order to find that its actions fall short of the laws requirements in this case. It is understandable, all things being equal, that the DOJ/FBI, given their weighty responsibilities and limited financial resources, would try to preserve their options, to delay making decisions about surveillance capacity until the carriers submit the statements required under sec. 104(d). But Congress did not intend to grant the DOJ/FBI this kind of flexibility. The high stakes of CALEA in terms of privacy and economic impact on the telecommunications industry require public disclosure of "actual" numbers, not ambiguous statements subject to multiple interpretations that serve as the starting point for closed-door reimbursement decisions.
Under step one of the Chevron test, the Attorney General and her delegatee, the FBI Director, have no discretion to ignore the clearly expressed intent of Congress. Chevron USA, Inc. v. Natural Resources Defense Council, 467 U.S. 837 (1984). In this case, it was Congress clearly expressed intent that unambiguous capacity requirements would be set forth in the Federal Register, containing the "actual number" of interceptions and geographic specificity. The DOJ/FBI have some discretion (not as much as they claim) in how to estimate these numbers and the form of stating them, but they have no discretion to issue an ambiguous notice. Any flexibility granted the government under CALEA does not include the flexibility to be confusing.
The DOJ/FBI in their supplemental memorandum lay claim to a broad discretion. They state that "CALEA gives the Attorney General wide flexibility" in determining how to go about setting the [capacity] requirements," Govt Supp. Memo, p. 5, citing to the House Judiciary Committee report. [ 3 ] In fact, the statement in the Congressional report is quite different:
"The Attorney General is given flexibility in determining the form of the notice. For example, the notices may be in the form of a specific number for a particular geographic area, or a generally applicable formula based on the number of subscribers served by a carrier. However, the notices must identify, to the maximum extent possible, the capacity required at specific geographic locations, including carrier office locations." H. Rpt. 103-827 at p. 25, reprinted in 1994 U.S.C.A.A.N. at 3505 (emphasis added).
At the time CALEA was under consideration in Congress, both the FBI and privacy advocates emphasized the certainty of the capacity process. FBI Director Freeh testified:
"Because telecommunications industry representatives have expressed a concern that the administrations proposal did not specifically address the capacities requirements that would be placed on each carrier, we developed, and the legislation includes, provisions which clearly place an affirmative responsibility on the Attorney General to advise carriers of law enforcements specific capacity requirements within the first year after enactment of the legislation." Digital Telephony and Law Enforcement Access to Advanced Telecommunications Technologies and Services: Joint Hearings before Subcommittees of the House and Senate Judiciary Committees, 103rd Cong., S. Hrg 103-1022 (1994) ("Hearings"), p. 116 (emphasis added).
Jerry Berman, then director of policy for the Electronic Frontier Foundation and now executive director of CDT, cited the open process for setting capacity requirements as one of the key positive elements of the statute: "The public will have access to information about the implementation of the Act, including . . . the details of how much wiretap capacity the government demands . . . ." Hearings, p. 162 (emphasis added).
While the DOJ/FBI brief would lead the Court to believe that law enforcement interests are paramount under CALEA, in fact CALEA is a statute that was intended to balance competing interests. As Congress stated in its report:
"Therefore, the bill seeks to balance three key policies: (1) to preserve a narrowly focused capability for law enforcement agencies to carry out properly authorized intercepts; (2) to protect privacy in the face of increasingly powerful and personally revealing technologies; and (3) to avoid impeding the development of new communications services and technologies." H. Rpt. 103-827, p. 13
CALEA balances these competing interests by a variety of substantive and procedural checks on the Attorney General and the FBI. One of the ways Congress circumscribed the discretion of the Attorney General was to require that the capacity requirements be published in the Federal Register through a notice and comment rulemaking. The Judiciary Committees emphasized that this was one of the "accountability" measures intended to ensure public oversight of the highly sensitive process required by CALEA: "Finally the bill has a number of mechanisms that will allow for Congressional and public oversight. The bill requires the government to estimate its capacity needs and publish them in the Federal Register." H. Rpt. 103-827, p. 19. The report went on to state: "Section 2603, entitled Notices of capacity requirements, places the burden on the government to estimate its capacity needs and to do so in a cost-conscious manner, while also providing carriers with a safe harbor for capacity." Id. at 25.
The government hangs a great deal of its defense on the word "may" in the statutory provision requiring the Attorney General to publish "notice of the actual number of communications interceptions . . . that the Attorney General estimates that government agencies . . . may conduct and use simultaneously by the date that is 4 years after the date of enactment." CALEA, sec. 104(a)(1)(A), 47 USC 1003(a)(1)(A) (emphasis added). The DOJ/FBI read this word "may" to mean "may or may not" conduct. "It should be understood that the projections for the number of potential future court orders do not mean that they are the numbers of orders that law enforcement will in fact obtain or intends to obtain." 63 Fed. Reg. at 12226. They give it such a hypothetical meaning as to render the capacity notice meaningless.
Read in conjunction with the requirement for the Attorney General to specify the "actual number" of intercepts, it is not reasonable to conclude that the word "may" gives the Attorney General the broad discretion now claimed. Indeed, the legislative history confirms that Congress did not intend to place much weight on the word "may," for the word does not appear in the Committees description of the capacity notice provision:
"Subsection (a) requires the Attorney General, within one year of enactment, to publish in the Federal Register . . . notices of both the maximum capacity and the initial capacity required to accommodate all intercepts, pen registers, and trap and trace devices the government (including Federal, State and local law enforcement) expects to operate simultaneously. . . .
The initial capacity relates to the number of intercepts the government will need to operate upon the date that is four years after enactment." H. Rpt. 103-827, p. 25.
Further evidence that Congress intended the capacity requirements to represent real limitations is found in the fact that CALEA requires the Attorney General to publish both an "actual" capacity and a "maximum" capacity. CALEA, sec. 104(a)(1)(A) and (B), 47 USC 1003104(a)(1)(A) and (B). The concept of maximum capacity indicates Congress understanding and intent that there might be some scenarios in which a carrier did not have the capacity to meet all of law enforcements requirements. [ 4 ]
So Congress intended to impose a maximum ceiling on law enforcements demands, even those that would be fully reimbursed by government. This point is important because the DOJ/FBI suggests in their brief that the FBI built into the notice a "margin of error" since it was eager to ensure that not a single investigation would ever be jeopardized by a lack of surveillance capacity. Govt Supp. Memo. at 10. This is an understandable approach from the perspective of the FBI, but it is one that Congress rejected. By setting a maximum cap on surveillance capacity, Congress recognized and accepted that there might be some situations where carriers could not accommodate all law enforcement surveillance requests. It shows that Congress intended the capacity numbers issued by the Attorney General to be "real" numbers, both as a floor and as a ceiling.
The governments reliance on the word "may" as a source of discretion undercuts its defense of the notice in a more profound way. If the numbers in the notice represent what the government may or may not do in the future, they become drained of all meaning, other than as a starting point for reimbursement decisions made by the Attorney General behind closed doors. Throughout the notice, the FBI stressed that the estimates therein "should not be interpreted as constituting the number of interceptions that law enforcement intends to, or is planning to, conduct." 63 Fed. Reg. at 12218. See also 63 Fed. Reg. at 12226 (estimates "do not mean that they are the numbers of orders that law enforcement will in fact obtain or intends to obtain"). For purposes of complying with CALEA, these are devastating admissions, for the Act requires the Attorney General to give notice of the "actual number" of communications interceptions that the Attorney General estimates that government agencies may conduct and use simultaneously in the future.
Throughout the notice and in its brief, the government says, in essence, "We cant tell you how to do it, but dont get it wrong." For example, the government argues in its brief that, once the notices of possible future capacity needs are published, CALEA leaves it to the "genius of the marketplace" to determine the most practical and efficient way to meet them. Govt Supp. Memo. at p. 4. The notice states, "as long as carriers can accommodate the interception capacity required when needed," it is up to the carrier what form that capacity exists. 63 Fed. Reg. at 12232. The problem with this approach is that the notice never makes it clear what is "the interception capacity required."
One illustration of the notices ambiguity is the long-running dispute over whether a carrier must be able to satisfy the county-wide or service area-wide capacity requirement on each switch in the county or service area, or whether the carrier can distribute the number over the switches serving the county or service area. The question is important, for requiring each switch to meet the stated capacity requirement would multiply the requirement by the number of switches in a county or service area, which could be a factor of as much as 100. This issue was raised by multiple commentators on the second notice, but still the government has failed to answer it. On the one hand, the notice states "The capacity numbers set forth are for a geographic area and are not switch-specific requirements." 63 Fed. Reg. at 12231. The notice suggests that carriers may choose to spread the requirement across a county or service area. But in the same paragraph, the notice also warns that "Each carriers deployment strategy must ensure that, if needed, the estimated actual and maximum capacity requirements set forth for the applicable geographic areas can be met." Id. Can be met where? This leaves open the possibility that a carrier may be required to meet a countys entire capacity requirement on a single switch. This in effect forces a carrier to provide that capacity on every switch. This is certainly the implication also of the "high-end switch capacity" section of the notice, id., which indicates that carrier must meet on every switch in the 17 covered counties at least the high end switch capacity, which multiplied out across switches yields a capacity many times that of the county-wide number.
Another illustration of the notices ambiguity comes in the DOJ/FBI claim that the Director made a "deliberate decision to estimate capacity needs not in terms of a projection of the number of interceptions that law enforcement intends to, or is planning to conduct," but rather "in terms of a capacity ceiling that was sufficiently high to provide room for accommodating future interception related worst case scenarios and serious unpredictable emergencies requiring unusual levels of interception." Govt Supp. Memo. at p. 10. This suggests that the FBI increased the numbers that would otherwise be produced from the historical data in order to deal with unforeseen crises. ( But at the same time, the government argues that "deliberate manipulation of the historical data so as to inflate capacity estimates would only undermine the interests of the Federal Government." Id. at 20 (emphasis in original).) If the FBI estimated capacity to account for unforeseen emergencies, what is the margin of error it used? Is it the aggregation of surveillance in a 24 hour period? Is it the "sum-of-the-single-day-switch" rule? Is it rule barring allocation of capacity among carriers serving the same county? Is it found in the growth factors? Each of these factors the DOJ/FBI defend on their own merits, without claiming that any of them provides the margin of error. The fact that the government claims to have relied on a crisis margin of error that it is impossible to identify or quantify is further evidence of how ambiguous the notice is, despite its detail and superficial precision.
Much of the ambiguity in the notice is introduced in the name of preserving the carriers option to minimize costs. Indeed, the government suggests that it is the responsibility of carriers to comply in a cost-conscious manner. This is an exact reversal of the burdens Congress intended to impose. As the legislative history makes clear, the obligation to control costs falls in the first instance on the government:
"Section 2603, entitled Notices of capacity requirements, places the burden on the government to estimate its capacity needs and to do so in a cost-conscious manner, while also providing carriers with a safe harbor for capacity." H. Rpt. 103-827, p. 25 (emphasis added).
The ambiguity in the notice is compounded by the gross overstatement of the requirements. It is the overstatement of needs beyond any historical reality that opens up such an unacceptably wide scope for the secret reimbursement process.
The FBI went through a complicated process for setting capacity, one that is spelled out in great detail in the notice and in the governments Supplemental Memorandum. But what is relevant for purposes of the Courts APA review is not the complexity of the methodology. Nor is it necessary for the Court to find unreasonable the individual choices made by the FBI (even though some of them seem quite unreasonable even in isolation). What is relevant is that the methodology was not applied in a reasonably consistent manner, or one that was intended to produce a reasonable estimate of the "actual number" of surveillances that government agencies might conduct in the future.
Therefore, the flaw in the FBIs methodology is not so much in the choice of counties as the basis for stating wireline requirements, as it is in the FBIs failure to adhere consistently to the county or any other given measure. Throughout the estimation process, the FBI constantly shifted its focal point, sometimes using a switch-based analysis, sometimes a county-wide analysis. In one respect, the FBI even used a nation-wide analysis. Sometimes the FBI distinguished between call content interceptions and interceptions of call-identifying information, other times it lumped them together. Sometimes, the FBI treated as simultaneous events occurring on the same day, other times it treated as simultaneous events occurring over a 26 month period. As it constructed its estimates, there was no consistency to the choices made by the FBI, except that it almost always chose the approach that made the numbers bigger. Thus, the application of the methodology does not meet even the minimal reasonableness standard applicable to those decisions within the discretion of an agency implementing a statute.
(1) First, the FBI took all surveillance activity occurring within each 24 hour period and lumped it together as if it had been "simultaneous." In the past, when wiretaps and other interceptions were physical attachments to wire lines, this may have been reasonable: an interception, once installed, remained physically in place. But, in the advanced systems to which the capacity notice applies, interception is effected not on wires but deep in the software of a computerized switch, and surveillance resources are assigned not permanently but dynamically, only when the targeted facilities are in use. If a target is not making the call, there is no bridge or other surveillance "equipment" attached to that subscribers line. By ignoring this development here (while capitalizing on it in the separate development of the CALEA capability standard), the FBI started the process by attributing to each switch a level of surveillance capacity higher than that required by the advanced equipment for which these requirements were being developed.
(2) Second, for wireline systems, the FBI took each of the highest peaks of surveillance activity occurring on each switch throughout a county over a 26 month period and lumped them together as if they had occurred on the same day. In other words, the FBI defined the term "simultaneously" to mean anytime within a 26 month period. Rather than remaining consistent with the county-wide methodology, which would have entailed identifying the peak day for each county in the 26 month period, the FBI took the peak day for each switch within each county and totaled them up.
This is one clear example of how the government failed to be reasonably consistent in the application of its methodology The DOJ/FBI argue that geographic area (county or service area) is the only viable basis for estimating need. But the FBI did not adhere consistently to this approach, using sometimes a switch-based analysis, when it increased the numbers.
The government claims that using counties avoids the problems caused by "the fluid nature of interceptions conducted over time." But the switch peak method does not take account of the fluid nature of investigations over time: to the contrary, it locks in each peak. If interceptions moved from switch #1 to switch # 2 to switch #3 over time, the FBI disregarded this. Instead, it took the peak of switch #1, the peak of switch #2 and the speak of switch #3 and totaled them up. As the focus of criminal activity shifted, and as law enforcement needs shifted, the FBIs methodology did not shift it stayed with the past peaks.
(3) Third, the final notice states that each and every carrier serving a particular area would have to install capacity sufficient to meet the total surveillance needs for that region, even if the carrier only served a portion of the customers in the area. 63 Fed. Reg. at 12230, 12236. This means that in an area where there are two wireless carriers (which is the case in much of the country), the capacity is doubled, since each carrier is provisioning the full requirement as if the other did not have a portion of the market.
(4) Fourth, the FBI has given an even broader interpretation of the notice, stating that carriers will have to install in each switch a capacity sufficient to meet the requirements projected for the entire county or multi-county service area. To take an extreme example, this interpretation of the notice would require just one of the wireline carriers in Los Angeles to install the capacity to perform 46,100 simultaneous intercepts.
(5) Fifth, the final notice draws no distinction between the capacity required to intercept call content and the capacity required to access dialed number information through pen registers or trap and trace devices, even though the FBI collected the data separately, and CALEA refers to the various types of surveillances separately. Again, the choice to aggregate call content and call-identifying information intercepts may have been reasonable were it not for the fact that the capacity required to intercept call content is more onerous than the capacity required to intercept call-identifying data. In fact, it is possible for carriers to place all of their call-identifying interceptions on a single delivery channel, while each call content interception may require five delivery channels.
Again, the government claims that it is allowing carriers flexibility, when in fact it takes the flexibility away in the same breath. The government claims, "Nothing in the final notice of capacity requires carriers to assume that all interceptions will be of the type that requires the greatest capacity to accommodate. On the contrary, it states that [a]ny solution developed by the industry must account for the significant variance in the distribution of types of interceptions." Yet the notice does tell carriers to assume that all interceptions may be of the type that requires the greatest capacity to accommodate: the notice expressly states that "The variance for historical switch-specific data is from zero percent communications content interceptions up to 100 percent communications content interceptions from area to area." 63 Fed. Reg. at 12235-36. If carriers must, in the words of the government, "account for the significant variance," then carriers must account for the possibility that their region is one of the regions where 100% of the interceptions were call content interceptions, the type requiring the greatest capacity to accommodate. Carriers and members of the public have no way of knowing what these regions are, since the FBI did not release that data.
CONCLUSION
The American people are entitled to know what surveillance capacity is being built into their telephone systems. If they know what is being required, they can determine if the cost is reasonable and if there is an infringement on their privacy. But until the public knows what is being required, they cannot begin to assert their privacy interests. Congress intended for this information to be laid out in the Federal Register. The capacity notice is ambiguous as the Attorney General has admitted -- and fails to satisfy CALEAs public accountability purpose. At the same time, the FBIs notice unreasonably overstates the amount of capacity to the detriment of the taxpayers or telephone ratepayers who will bear the cost. The DOJ/FBI have told carriers that the Attorney General will decide the details based upon submissions by individual companies. CALEA was intended to preclude such secret decisionmaking about the design of the Nations telecommunications system. The Court should remand the capacity notice for further rulemaking, pursuant to notice and comment.
Respectfully submitted,
_______________________________
James X. Dempsey (D.C. Bar # 289918)
Senior Staff Counsel
Center for Democracy and Technology
1634 I Street, N.W. Suite 1100
Washington, D.C. 20006
(202) 637-9800
January 8, 1999
|
The Center For Democracy & Technology 1634 Eye Street NW, Suite 1100 Washington, DC 20006 (v) 202.637.9800 (f) 202.637.0968 Contact CDT Copyright © 2005 by Center for Democracy and Technology. |