Applying Pen Register and Trap and Trace Devices to Internet Communications

Home , Pen register, Trap and trace device

Vanderbilt Journal of Entertainment & Technology Law

Volume 5 Issue 2 Issue 2 - Spring 2003 Article 11

2003

Rich Haglund

Follow this and additional works at: https://scholarship.law.vanderbilt.edu/jetlaw

Part of the Communications Law Commons, and the Fourth Amendment Commons

Recommended Citation Rich Haglund, Applying Pen Register and Trap and Trace Devices to Internet Communications, 5 Vanderbilt Journal of Entertainment and Technology Law 137 (2020) Available at: https://scholarship.law.vanderbilt.edu/jetlaw/vol5/iss2/11

This Note is brought to you for free and open access by Scholarship@Vanderbilt Law. It has been accepted for inclusion in Vanderbilt Journal of Entertainment & Technology Law by an authorized editor of Scholarship@Vanderbilt Law. For more information, please contact [email protected]. a~~~Oa - a a a

- - a a it - a a a

a a a a a a- a aa - . a- a a- a a. a a%

- a a * a * a a a *a * a a a~aaW4

Asa sa a a va-hanges,a * . a 1.s-C-a- - 0a a *-

- ,a - r- a a F ,-a, a a 1 a.av P ), a0

a,~~ ~ ~ ~ ~- ~~8- a- Ril-- ch, - .. . .*

a-aeB S* * a a - aa a - ......

*4, , a a - a - , a - - a Applying Pen Register and Trap and Trace Devices .o Internet Cormmnunications not exist when the Fourth Amendment was drafted did not mean that telephone conversations could not possibly be protected by the same. 22 Brandeis quoted Boyd v. United A Wiretps States, 116 U.S. 616, 627-630 (1885), in which the history of the Fourth and Fifth Amendments was reviewed: It is not the breaking of his doors, and (1) Supreme Court Decisions the rummaging of his drawers, that consti- on Wiretaps tutes the essence of the offence; but it is the invasion of his indefeasible right of per- Before pen register and trap and trace devices sonal security, personal liberty and private were developed, law enforcement agents used wiretaps to property, where that right has never capture the real-time content of telephone calls. These been forfeited by his conviction of some devices need not be placed inside an individual's home or public offence -- it is the invasion of this office. 0 They may be attached to the telephone line at sacred right which underlies and consti- other points and still provide surveillance officers with the tutes the essence of Lord Camden's judg- ability to hear the actual conversations taking place on the ment. Breaking into a house and opening phones. II boxes and drawers are circumstances of Olmstead v. United States 2 was the first Supreme aggravation; but any forcible and compul- Court case to rule on the constitutionality of obtaining sory extortion of a man's own testimony evidence-without a warrant-via a telephone wiretap. or of his private papers to be used as evi- The wiretapped telephone conversations enabled federal dence of a crime or to forfeit his goods, is agents to identify Olmstead's partners in the (then) unlaw- within the condemnation of that judgment. ful possession, transportation and sale of liquor. "3The wiretaps were placed without physically entering the operation's headquarters. 14 The Olmstead majority held that the Fourth Amendment does not protect telephone calls since overhear- ing them does not disturb or invade the speakers' property.'" "The Amend- ment itself shows that the search is to be of material things -- the person, the house, his papers or his effects. The description of the warrant necessary to make the proceeding lawful, is that it must specify the place to be searched and the person or things to be seized" I6 Sealed mail, the court reasoned, sent under protection of In this regard the Fourth and Fifth Amend- the federal government, is a thing protected by the Fourth ments run almost into each other.23 Amendment from unlawful seizure. '7 A telephone call, Brandeis' dissent laid the foundation for the decision in however, placed "voluntarily" and "overheard", is not simi- Katz v. United States2 4 that eventually overruled Olmstead. larly protected. 8 Mr. Katz was suspected of violating a federal stat- The dissenting opinion, written by Justice Brandeis, ute that prohibited transmitting betting information across focused on whether the wiretapping done by government state lines via telephone.2" To catch him in the act, federal agents constituted an unreasonable search and seizure. Even authorities placed a listening and recording device on top of the government conceded that if wiretapping constituted a a telephone booth from which Katz regularly made calls.26 The search and seizure, wiretapping without a warrant would be device did not intercept telephone conversations; instead, unlawful. '9 Rejecting the government's argument that the it amplified the sounds within the booth and transmitted Fourth Amendment "cannot properly be held to" protect them to officers listening nearby. 27 telephone conversations, 20 Brandeis stressed that "clauses Since by this time the Court had held that oral guaranteeing to the individual protection against specific statements as well as tangible items may be "seized" within abuses of power, must have a similar capacity of adaptation the meaning of the Fourth Amendment, 28 the Court found to a changing world: 2' Simply because the telephone did the eavesdropping methods employed by the government INTERNET without a warrant constituted a search, and that the search issued after an application is submitted that states facts was improper. 29 The Court emphasized that the Fourth showing"probable cause for belief that an individual is com- Amendment protects individuals rather than "protected mitting, has committed, or is about to commit a particular areas:' and declared the "trespass" doctrine of Olmstead offense, ... [and] probable cause for belief that particular no longer controlling. 10 Whether the wall of the telephone communications concerning that offense will be obtained booth was penetrated by the listening device, the Court through such interception." "42 The judge must also deter- 3 explained,"can have no constitutional significance." ' mine, "on the basis of the facts submitted by the applicant," Katz illustrates the Court's ability to rectify rules that alternative means of obtaining the information have that were easily manipulated. Federal agents, attempting been exhausted.43 Court orders identify the specific com- to meet the Olmstead standard, conducted surveillance that munications that law enforcement officers hope to inter- did not involve a physical trespass. 32 The Katz majority cept, the target of their surveillance and the government recognized that the Olmstead "trespass" doctrine had been agency allowed to conduct the surveillance.44 Orders also "eroded," and did not 3 adequately protect individuals. Jus- require the surveillance cease once the described informa- tice Brandeis must have smiled, recognizing that the Court tion has been obtained, 4 and the surveillance cannot last was slowly coming around to the logic of his Olmstead dis- longer than 30 days without specific approval for extension.' sent: "A principle to be vital must be capable of wider application than the mischief which gave it birth."34 Application B. Pen Registers and of constitutional principles, Brandeis insisted, must contem- Trap and Trace Devices plate the past and the future." Otherwise, those princi- (1) Supreme Court Decisions ples defining what constitute Fourth Amendment violations in surveillance "would have little value and be converted on Pen Registers by precedent into impotent and lifeless formulas. Rights and Trap and Trace Devices declared in words might be lost in reality."36 The standard outlined by Justice Harlan in his con- Unlike wiretaps, pen register and trap and trace curring opinion formed the basis for analysis of surveil- mechanisms only capture the telephone numbers an indi- lance activities over the next several decades. It was Justice vidual dials or the number of persons calling the target of Harlan who explained that the Fourth Amendment pro- surveillance. The Supreme Court held in United States tects people, not places, from interference with their rea- v. New York Telephone Co. that pen registers were not cov- sonable expectations of privacy: "My understanding of the ered by Title IIIsince they do not intercept the content rule that has emerged from prior decisions is that there is of communications. 47 Pen register devices (and trap and a twofold requirement, first that a person have exhibited trace devices, since their function is identical for incoming an actual (subjective) expectation of privacy and, second, calls) "disclose only the telephone numbers that have been that the expectation be one that society is prepared to dialed. 48 recognize as 'reasonable."' 7 Conversations conducted in In another case two years later, the Court articu- the presence of others would not be protected from being lated a clear analogy to e-mail addresses and IP addresses. overheard, "for the expectation of privacy under the cir- A pen register was installed on Michael Lee Smith's tele- cumstances would be unreasonable" 38 Applying this stan- phone line as part of the investigation of a robbery.49 The dard to Katz, Harlan said: pen register brought evidence to light that led to a search The critical fact in this case is that "one warrant. 50 The subsequent search uncovered evidence who occupies [a telephone booth] shuts leading to Smith's arrest."' The Supreme Court held that the door behind him, and pays the toll that no reasonable expectation of privacy existed in the num- permits him to place a call is surely entitled bers a person dials on his or her telephone, because that to assume" that his conversation is not information is recorded by telephone companies for busi- being intercepted. The point is not that ness purposes.5 2 The court rejected Smith's claim of expec- the booth is "accessible to the public" at tation of privacy: other times, but that it is a temporarily pri- Pen registers are regularly employed "to vate place whose momentary occupants' determine whether a home phone is being expectations of freedom from intrusion used to conduct a business, to check for a are recognized as reasonable.3 9 defective dial, or to check for overbilling" (2) Federal Legislation on Wiretaps ...Telephone users, in sum, typically know that they must convey numerical informa- UnderTitle III of the Omnibus Crime Control and tion to the phone company; that the phone Safe Streets Act of 1968,40 wiretaps may only be used in company has facilities for recording this investigation of certain offenses. 4' Court orders are only information; and that the phone company Applying Pen Register and Trap and Trace Devices to Internet Communications

does in fact record this information for a variety of legitimate business purposes. Although subjective expectations cannot be scientifically gauged, it is too much to believe that telephone subscribers, under these circumstances, harbor any general A. How Information is Transmitted expectation that the numbers they dial will Via the Internet remain secret. " In other words, since the dialer voluntarily pro- With telephone lines, separating the numbers from vides that information to the telephone company, he or she the content of conversations is relatively easy. Internet cannot expect that it is private information: "Therefore, the communications are transmitted in a way that makes sepa- pen register did not constitute a search and no warrant was rating addressing information from content more difficult. necessary." 14 Information to be sent over the Internet is first broken into in multiple packets, which find their way across the (2) Federal Legislation on Pen Registers Internet.6' These packets contain headers, which use num- and Trap and Trace Devices bers as addresses to identify the sending machine and the machine to which the information is being sent. "Each data Worried about the potential for abuse that the packet consists of two components. One component is the Smith ruling created, Congress increased protection for address information, which appears in the packet's header electronic communications by passing the Electronic Com- and, like an envelope address, ensures that the communica- munications Privacy Act of 1986 (ECPA)," which modified tion arrives at the proper location and is reassembled in the Title Ill, requiring the government to meet higher standards correct sequence. The second component is the body, or before it may conduct electronic surveillance. payload of the communication, which contains the commu- The standard for obtaining pen register or trap nication's content." 62 Assuming that e-mail messages and and trace orders is lower than that for obtaining wiretap Internet addresses ("URLs") are like telephone numbers, it orders. To lawfully use a pen register or trap and trace is obvious that collecting only the "numbers" is more dif- device, law enforcement officers need only certify to the ficult with Internet communications than with telephone court that the information likely to be obtained is relevant communications. Collection must be limited to the infor- to an ongoing criminal investigation. 56 mation in the header. Following the terrorist attacks on the United States B. Monitoring E-mail on September I I, 2001, legislators attached provisions to and several pending anti-terrorist bills that explicitly extended Web Browsing pen register and trap and trace orders to Internet commu- To obtain authorization for a pen register or trap nications. In addition to provisions specifically intended to and trace device on Internet communications, the United aid law enforcement officers in investigating terrorists, the States Attorney or state law enforcement officer must cer- USA PATRIOT Act, passed in October, 200 I17 amended the tify to the court "that the information likely to be obtained pen register and trap and trace statutes to include Inter- by such installation and use is relevant to an ongoing crim- 58 net communications: "[T]he term 'pen register' means a inal investigation"' 63 Only after receiving a court order device or process which records or decodes dialing, routing, must the communication provider assist the law enforce- addressing, or signaling information transmitted by an instru- ment officers in installing the device. 64 The court order ment or facility from which a wire or electronic commu- must specify the owner of the telephone line or"other facil- nication is transmitted." 19 An expanded definition of a ity" (such as a dial-up, DSL or cable connection to an Inter- "trap and trace device" also emerged:"a device or process net Service Provider), the identity of "the person who is the which captures the incoming electronic or other impulses subject of the criminal investigation" the alleged offense to which identify the originating number or other dialing, rout- which the information sought relates, and "the attributes of ing, addressing, and signaling information reasonably likely to the communications to which the order relates:' 65 These identify the source of a wire or electronic communica- "attributes" must include the telephone number "or other tion." 60 The only change to the law was the addition of the identifier" (such as the IP address of the computer sending words "routing, addressing and signaling" In other words, or receiving e-mail). 66 This enables the communication the law does not allow for capture of any content of elec- provider, together with the law enforcement agency, to tronic messages, including e-mail or web browsing. ensure that persons other than those whose communications are to be monitored, do not have their e-mail or IN TNET web surfing monitored. The pen register or trap and trace routers, servers and other machines on Internet networks device can be placed on the smallest subset of the Internet record the IP addresses of the machines sending and receiv- Service Provider's (ISP's) network, and set to monitor only ing information across the Internet. The FBI secures court a single machine.67 The collection must be limited to the orders to wiretap or use a pen register or trap and trace "header" containing the addressing information. Any infor- device to track a specific individual by his or her IP address. mation in the "payload"--the content of the communica- Then FBI technicians would work with ISP staff to make tions-may only be collected with wiretap authorization. sure that the monitoring and interception of communica- The agency conducting pen register or trap and trace sur- tions is done in a manner that reduces the chances of them veillance is required to use available technology that limits also intercepting communications from users not under the gathering of information to the addressing information surveillance.74 of Internet communications, and that specifically does not include the contents of any e-mail or web browsing." (1)Dr. 1 0 (T e k or er Scholars, practitioners and journalists are afraid that, while supposedly only operating a pen register or trap An independent research group, the lIT Research and trace device, the government would employ technol- Institute, evaluated how DCS 1000 operated in full collec- ogy that will gather too much information - an amount tion and pen register mode to determine whether or not of information that violates individual's reasonable expec- it would gather more information than law enforcement tations of privacy and thereby the Fourth Amendment. officers had authorization to collect.7 This test revealed They worry that not only will the FBI find out that an that DCSIOOO did not collect the e-mail subject or con- individual was e-mailing [email protected], but that tents when in pen register mode. 6 When monitoring web in the e-mail message was an invitation for Bob to join in an illegal Internet gaming web site operated from a web site in the Bahamas. In PCWorld,Anne Kandra wrote: "The new law, along with new surveillance tools, will create a dragnet wide enough that anyone's e-mail note, text chat, or search inquiry might be snared' 69 Kandra continues, "When a suspect sends an e-mail message, investigators could discover not only the recipient's identity, but also the subject line and perhaps even the body of the message" 70 Rachel King, the legislative counsel at browsing, DCS1000 only collects the source and destina- the ACLU's national office, also said that the FBI plans to tion information. 7 7 The IP address-e.g., 124.4.24.5-of "get access to [entire e-mail messages] and then separate the web server, which might translate to yahoo.com, would out the content information, which is an unconstitutional be revealed, but the specific Uniform Resource Locator extension of its power." 7 She noted that the government (URL) would not.78 So the FBI might find out that a com- is using surveillance technology for pen register and trap puter had browsed to yahoo.com, but would not know that and trace surveillance that "gives the FBI all the commu- once there, the user had entered "gambling in the Bahamas" nications that run through the system, including those of in a search field, or gone on to cuteboys.yahoo.com. 79 people who are not targets of the search:' 72 The IITRI report left some room for concern, how- 9 Co EYpectatio ns of P 'va ~y 'n h ever. DCS 1000 replaces e-mail header information with "X"s, which would allow those monitoring to determine the size of the header and the message." ° IITRI noted in The FBI developed a tool for surveillance of Inter- its report: "Recording this information might be an issue net traffic called "Carnivore." Carnivore, now known as of over-collecting because the court order only authorizes DCSI000, can function in two modes: full collection, in collecting the IP addresses of web activity, but none of the which all addressing information and the content of elec- information on data size can be collected""1 tronic communications are intercepted, and pen collection mode, in which only the addressing information from e-mail, (2) How DC I o web browsing and file transfers is captured.7 3 Internet users cannot reasonably maintain any This tool, created by the FBI, records information expectation of privacy in non-content information of Inter- that Internet Service Providers are already gathering- net communications, just as users of telephones do not have a reasonable expectation of privacy in the non-con- Applying Pen Regi.se and "Trap and ra tent elements of their telephone communications. Like the Two recent cases, relying on Smith (which relied on situation described in Smith,82 non-content information of New York Telephone), 86 support the notion that users do e-mail and web browsing is available to, and logged by, the not have a reasonable expectation of privacy in the non- Internet Service Provider, in the normal course of business. content portions of Internet activity. In United States v. Users of free and pay services on the Internet have their Hambrick, 87 the defendant sent money to a police officer non-content information collected for the same purposes posing as a young boy in a chat room, so the "boy" could that the telephone company collects telephone numbers get on a bus and run away with Hambrick.88 A subpoena dialed. For example,Yahoo! provides e-mail, chat, web page was obtained and submitted to the ISP, which provided hosting and other services for free. The Terms of Service Hambrick's name, billing address, IP address, credit card and (TOS) require users to agree not to use the service to other information.89 Hambrick contended that the Fourth "harm minors:' "impersonate" other persons, upload con- Amendment protected this information, but the United tent that would infringe copyrights or patents, send com- States Court of Appeals for the Fourth Circuit disagreed."' puter viruses, etc.83 The user agreement further states: The court noted that the ECPA "does not repre- You acknowledge and agree that sent a legislative determination of a reasonable expectation Yahoo may preserve Content and may also of privacy in non-content information released by ISPs;' disclose Content if required to do so by and was therefore inapplicable. It stated, "a person does law or in the good faith belief that such not have an interest in the account information given to the preservation or disclosure is reasonably ISP in order to establish the e-mail account, which is non- necessary to: (a) comply with legal pro- content information" The court found that "when Ham- cess; (b) enforce the TOS; (c) respond to brick entered into a service agreement with MindSpring, claims that any Content violates the rights he knowingly revealed this information to MindSpring and of third-parties; or (d) protect the rights, its employees. The records that the government obtained property, or personal safety of Yahoo, its from MindSpring had been available to MindSpring employ- users and the public.' ees in the normal course of business:' 92 Since Hambrick Comcast, a provider of high-speed cable Internet services, disclosed this information to a third party, any expectation also collects user information: of privacy was destroyed: "an individual has no Fourth Collecting information contained in Amendment privacy interest in information released to a transmissions made by Customer through third party and later conveyed by that third party to a gov- the Service directed at Comcast, its Under- ernmental entity,'even if the information is revealed on the lying Providers, Internet web sites, or other assumption that it will be used only for a limited purpose service providers to which access is pro- and the confidence placed in the third party will not be vided as part of the Service, is necessary betrayed" 93 to provide the Service. Comcast's detailed The court went on to say that even though the business records generally are used to help Internet and the "vast extent of communications it has ini- make sure customers are properly billed; tiated" are "'revolutionary, ... the information at issue in to send customers pertinent information this case is not distinguishable from the materials in Miller about the Service; and for accounting pur- and Smith, as the government merely obtained non-con- poses.8 tent information that was part of MindSpring's business records' " In another case, United States v. Kennedy, 9' an anonymous caller informed an ISP customer service operator that he had viewed files on a subscriber's computer (identified by an IP address) that he believed were child pornography.96 A Road Runner network engineer confirmed that the IP address corresponded to one of Road Runner's subscribers, the defendant Kennedy, and examined files on the hard drive of that computer (he did so believing that the customer service agreement authorized a search for offensive material). 97 A Road Runner INTERNET manager contacted the authorities later that day, after con- ter or trap and trace devices. That argument is not even 98 sulting with the corporate attorney. supported by New York Telephone. In that case, the Court The defendant claimed that his constitutional rights held only that because the identities of the individuals plac- were violated by Road Runner when it passed his sub- ing the calls could not be determined from the number, scriber information to the authorities. " The United States Title III did not cover the pen register device. 105 District Court for the District of Kansas disagreed: "When defendant entered into an agreement with Road Runner fIll. Wh the PAT IOtc for Internet service, he knowingly revealed all information connected to the IP address 24.94.200.54. He cannot now claim to have a Fourth Amendment privacy interest in his subscriber information" 100 The United States Court of Appeals for the Fourth Circuit cited Maxwell and Kennedy in declaring that users who communicate their IP address or other identifying A. Legislative History: information to system operators no longer have a reason- The Purpose of the USA PATRIOT Act able expectation of privacy: Senator Patrick Leahy, one of the PATRIOT Act's Individuals generally lose a reason- sponsors, spoke of three main purposes he hoped to able expectation of privacy in their infor- accomplish with the Act's stipulations regarding pen regis- mation once they reveal it to third parties. ter and trap and trace device laws: A bank customer, for instance, does not I have long supported modernizing the pen regis- have a legitimate expectation of privacy in ter and trap and trace device laws by modifying the the information that he or she has con- statutory language to cover the use of these orders veyed to the bank; by placing the informa- on computer transmissions; to remove the juris- tion under control of a third party, the cus- dictional limits on service of these orders; and to tomer assumes the risk that the bank will update the judicial review procedure, which, unlike convey the information to the government. any other area in criminal procedure, bars the exer- Courts have applied this principle to com- cise of judicial discretion in reviewing the justifica- puter searches and seizures to conclude tion for the order. 106 that computer users do not have a legiti- The statutes, he explained, needed to be updated mate expectation of privacy in their sub- because of the change in modes of communication-simple scriber information because they have con- technological advancement. '07 Nationwide jurisdictional veyed it to another person--the system function of pen register and trap and trace orders was also operator. 101 necessary because of the advancing technology: because Paul Taylor argues that e-mail addresses, unlike tele- Internet communications travel over the networks of vari- phone numbers, are more likely to reveal the identity of ous providers, requiring orders for installation at each pro- the initiator of the communication. 102 Taylor suggests that vider, merely to cover the same communications, would be e-mail addresses should be more protected because they a waste of time and resources. 108 Senator Leahy offered are more likely to contain the name of the sender. 103 The the following illustration: Supreme Court in New York Telephone, Taylor points out, For example, a telephone call may be car- said that pen registers are not an "interception" of com- ried by a competitive local exchange car- munications (which would then make them subject to Title rier, which passes it at a switch to a local Ill) because "[n]either the purport of any communication Bell Operating Company, which passes it between the caller and the recipient of the call, their identi- to a long distance carrier, which hands it to ties, nor whether the call was even completed is disclosed an incumbent local exchange carrier else- by pen registers." 104 Taylor's argument has two major where in the U.S., which in turn may finally flaws, however. First, people can easily make their e-mail hand it to a cellular carrier. If these carriers addresses as anonymous as their telephone number. Noth- do not pass source information with each ing prohibits someone from creating an e-mail address that call, identifying that source may require is completely numeric, or from having it contain a pseud- compelling information from a host of pro- onym. Second, Taylor argues that the likelihood of actual viders located throughout the country. 109 association of the e-mail address with the individual should This kind of analysis of how the law works in reality is best increase the level of protection afforded e-mail addresses. done by the legislature. '0 Applying this line of defense to telephone numbers would Senator Leahy offered two examples from Depart- mean that they should also not be obtainable via pen regis- ment of Justice investigations to illustrate the difficulties Applying Pen Register and Trap and Trace Devices to Internet Communications that limiting jurisdiction on pen register and trap and trace available: allow the courts to handle these situations and devices would create. In the first case, a hacker, based in a let legislation fill in gaps, or quickly pass legislation to fix foreign country, dialed into Harvard University computers the problem. 2' These legislative "quick fixes", she notes, and used them as "an intermediate staging point to conceal are shortsighted and produce long-term damage. 122 Laws his location and identity" "' The local telephone company, passed to deal with issues relating to the Internet have NYNEX, could only tell the investigators that the commu- already been repealed because of their unconstitutionality nications were coming from a long distance carrier, MCI. "12 (such as the Communications Decency Act). 123 Sherry By the time investigators applied for and received an order argues that other laws, though perhaps not unconstitu- to get the information from MCI, the hacker was no longer tional, are clearly shortsighted, such as E-SIGN and the using the connection, and MCI could no longer identify the Anticybersquatting Consumer Protection Act (ACPA). 24 source. 113 When faced with changing computer technology In the second instance, Kevin Mitnick hacked into and its legal implications, Sherry suggests that the best computers while "on supervised release for a prior com- approach is to let the courts piece together a coherent puter crime conviction," and eluded investigators by con- response, rather than legislate immediately: "[A]t least in stantly moving around the country and using "cloned cel- the context of new computer technology, allowing time for lular phones and other evasive techniques." 114 Mitnick's incremental judicial responses is often superior to instant "hacking attacks would often pass through one of two cel- legislative solutions of a global nature" 125 One of the lular carriers, a local telephone company, and then two benefits of this approach, Sherry argues, is that even if a Internet service providers." ''5 Only because of Mitnick's few, or several courts "get it wrong," their reach will be persistent hacking were investigators able to trace his activ- limited geographically. 126 The legislature's "mistakes" on ity through "repeated attempts accompanied by an order the other hand, have national, and often global effect. 127 to each service provider." 1 6 As Leahy noted, having to However, the national and global effect of a "mis- obtain separate orders for "each link in the communica- take" by the courts may also be severe. If the Court tions chain" is time consuming. 117 He also pointed out determines that certain communications are not pro- that: tected by the Fourth Amendment, the only way society [Requiring separate orders] serves no has to have their reasonable expectations considered useful purpose since the original court has (when they conflict with the reasonable expectations of already authorized the trace. Moreover, the Supreme Court justices) is to persuade the Court a second or third order addressed to a to overrule itself, or to get a constitutional amendment. particular carrier that carried part of a Senator Patrick Leahy, in his comments to Con- prior communication may prove useless gress, expressed concern about the lack of definitions that during the next attack: in computer intru- may cause problems in the future. Because it does not sion cases, for example, the target may use define terms such as "routing" and "addressing", the Act an entirely different path, i.e., utilize a dif- leaves "the courts with little or no guidance of what is cov- ferent set of intermediate providers, for his ered" by those terms. 28 Leahy also argued that simply or her subsequent activity. 118 saying that the pen register and trap and trace devices cannot intercept "content" was insufficient and short- B. The Danger of Hurried Legislation: sighted. 129 The government and law enforcement agencies then run the risk that a court, forced to rely on its own Is Congress Too Slow to Correct definition of "routing" and "addressing information", may Its Own Mistake? declare all information derived based on the pen register An additional danger exists that because legislation or trap and trace device-including subsequently collected evidence-inadmissible. "3 like the USA PATRIOT Act may be passed as a quick fix to a "new" problem "unique" to the Internet (or passed, as the The application of pen register and trap and trace devices to Internet communications, however, does not PATRIOT Act, in the wake of an emergency), "19it is more as the laws Sherry criticizes. likely to be flawed or quickly outdated. One might argue suffer the same problems This is not a "quick fix" that suffers from constitutional that courts are in a better position-relying on the Consti- surveillance methods have already been tution and precedent-to safeguard the rights of individuals problems. These against unlawful searches and seizures than the legislature found constitutional. Courts developed the law surround- moving is or will be. ing the surveillance of electronic communications, from eavesdropping to wiretaps to pen register and trap Professor Suzanna Sherry argues that courts are and trace devices. At each stage, Congress then filled gaps clearly in a better position to adapt law to changing technol- and/or codified the common law with statutes. Following ogy than the legislature. 120 Sherry explains that when tech- common law analogies and precedent, the PATRIOT Act nology creates "new" legal issues, there are two options applied pen register and trap and trace laws to the Inter- INTERNET net. rent statutory protections or bring about a The PATRIOT Act amendments to the pen register broader interpretation of the Katz privacy and trap and trace device laws were sorely needed. In a doctrine, courts will continue to address comment written before the PATRIOT Act was introduced, challenges involving Internet communica- Graham B. Smith said: tions with judicial precedent and statutes In general, reliance on outmoded statutes to not necessarily written to conform with govern a new electronic medium imposes modern technology. Courts will be forced constitutional threats. Carnivore's exis- to determine the impact of technology like tence confirms Internet users' Orwellian DCS 1000 on privacy rights by applying the fears, and law enforcement agencies are current statutory framework to advancing permitted to exploit loopholes in current technology. To better protect the privacy surveillance law until Congress fortifies rights of individuals in the 21st century, Fourth Amendment privacy rights with Congress must amend existing legislation internet-specific legislation. No other com- to properly address Internet communica- munications technology retains infinite per- tions rather than relying on the judiciary to sonal information through such progres- divine Congress's intent from statutes that sive communications services. Therefore, were drafted before the widespread use of Congress needs to disregard the DOJ's Internet communications. 134 plea for technology-neutral legislation and embark on new surveillance regulations for The modifications of the pen register and trap the Internet. 3 ' and trace laws were also not complete statutes trying to The limited case of applying pen register and trap create a new "law of the Internet." Instead the PATRIOT and trace devices to Internet communications 132 was not Act amendments merely modified an existing statute to the kind of "quick fix" Sherry feared. Outdated statutes enable law enforcement agencies to keep up with changing were constricting courts. Consider the following situation, peer-to-peer communication, in a manner consistent with before the PATRIOT Act amendments to ECPA:A suspect Supreme Court Fourth Amendment jurisprudence. uses e-mail to communicate with a co-conspirator. He uses a dial-up connection to the Internet. The police would be As noted above, the PATRIOT Act does not allow able, via a pen register, to discover the number he dialed untargeted individuals' communications to be monitored. to connect to the Internet. But, they would have had to Contrary to Anna Kandra's comments, 3 the body of collect more than "dialing" information to determine with e-mails and Internet search terms would not be discover- whom the suspect was communicating. The "dialing" infor- able under a pen register order. 136 Additionally, the Act mation would only have led them to the local server that provides for significant reporting, both to the Court issuing 137 1 38 connected the suspect to the Internet. Suppose they used the order, and, on a yearly basis, to Congress for analysis. DCS 1000 to find out the e-mail address. Collection of the e-mail address from the ISP would not have been authorized by the pen register order. So even though the Supreme Court had determined that information "voluntarily" disclosed to third parties was not protected by the Fourth Amendment, 33 it may have suppressed the evidence because of the means used to obtain the e-mail address (at the time, ECPA only allowed the collection of "dialing" A. Reasonable Analogies? How Nine information). As Mark Elmore explained: With the FBI's implementation of DCS 1000, People Can Reduce "Society's" the need for Congress to amend existing Expectations of Privacy statutes becomes increasingly more impor- The Supreme Court, in its own jurisprudence in tant. ... Without uniform changes to stat- surveillance cases, has created a standard that Congress is utes like the ECPA, the FBI may deploy in a better position to apply than the Court itself. In Katz, DCSI000, in varying degrees of threat to the Court set forth two requirements to establish a Fourth privacy rights, depending on a particular Amendment violation: first, the individual must exhibit an court's interpretation of statutes and how expectation of privacy, and second, that expectation must varying forms of electronic communica- be one that society must be ready to recognize as reason- tions fall within them.... able. 139 justice Harlan tried to create a clear standard, Until changes occur which modify the cur- however, the standard outlined may be, and in fact has Applying Pen Register and Trap and Trace Devices to Internet Communications been, easily manipulated. In Smith, Justice Marshall warned to a private conversation, or is it more that "law enforcement officials, simply by announcing their like standing inside the room listening to intent to monitor the content of random samples of first- the conversation? These inquiries become class mail or private phone conversations, could put the less and less relevant (and more and more public on notice of the risks they would thereafter assume metaphysical) as we move further into the 1 40 in such situations" realm of cyber-investigations and the use The legislature can provide protection beyond that of devices that detect information that is required by the Fourth Amendment. Perhaps the Court invisible to the human ear or eye. The recognized that the legislature would be able to take advan- only relevant consideration is the result of tage of the standard it created. And perhaps the Court the surveillance: what information does the created the standard with that end in mind. Ric Simmons government acquire as a result of making notes that ECPA did just that. 14' ECPA has "a low stan- the observations? 149 dard for intercepting the Internet version of pen registers Because Congress does not have to rely on potentially ... [and] trap and trace devices:' but a higher standard for inconsistent analogies to make law, but instead can under- intercepting the Internet version of wiretaps. 142 A pen reg- take exhaustive investigations and studies by experts and ister order, issued on a showing of relevance to an ongo- gather constituent viewpoints, Congress is in the best posi- ing investigation, 141 would be sufficient only for the collection, through statutes, to do just what the Court said was tion of addressing information; but a wiretap authorization, necessary in Katz: protect those expectations of privacy "that society based on a showing of probable cause, '4 would be neces- is prepared to recognize as reasonable" 10 sary to obtain the content of any e-mail or web browsing And when those expectations change, "society" can pass information. 141 legislation through Congress that reflects those changes. Simmons argues that the post-Katz cases strayed "Society" is not in a position, however, to change Supreme from an important part of the standard Justice Harlan Court determinations of reasonableness. emphasized, namely, "that 'physical intrusiveness' should no longer be the controlling factor in determining whether or B. What's a Bootstrap and Can My not a search had occurred." 146 By focusing on the methods Congressman Get Me One? used by the government in cases like Kyllo, 141 the Supreme Why Congressional Action is just Court creates inconsistencies that Simmons suggests, will What the People Ordered only increase "as technologies become more sophisticated and courts struggle to find the correct analogy for any given In a New York Times article discussing the then- surveillance method employed by the government." 148 Sim- pending USA PATRIOT Act, Stewart Baker, who heads the mons outlines the problems courts face relying on analo- technology practice at Steptoe & Johnson, a law firm in gies: Washington, D.C., said: "I think if you asked anyone on the In some cases, courts are forced to choose street:'Which would you rather reveal, the telephone num- between equally plausible analogies in order bers you dialed or a list of all the people you sent e-mail to to determine how the Fourth Amendment and the Web sites you visited?' I think they'd say, 'Go with applies: is thermal imaging analogous to the phone numbers." " Unfortunately for "anyone on the watching snow melt off a roof or is it more street," their opinion doesn't matter to the courts. The like using binoculars? Or perhaps it is most Supreme Court decides, placing itself in the role of "soci- analogous to using a dog to detect the ety", which expectations of privacy are reasonable. 512 This odor of illegal contraband? Is reading the test of "reasonableness" is, of course, problematic. content of an e-mail analogous to wiretap- Erik Luna argues that the reasonableness standard ping a phone, or is it analogous to access- actually provides room for more government surveillance, ing a stored voicemail? Or perhaps reading rather than serving as a high barrier the government must the content of an e-mail is comparable to overcome to legitimize its surveillance of individuals: 153 reading the content of regular mail? And 'Reasonableness' might be the law's great- frequently courts must stack analogy on est waffle word, allowing courts to hedge top of analogy: if reading the content of an their bets or duck principled analysis. In e-mail is analogous to wiretapping a phone, the criminal procedure context, a reason- we need another analogy to determine ableness standard is flexible and simple, whether the founders would think wire- but also manipulable, terribly ambiguous, tapping violates the Fourth Amendment- and subject to inconsistency. The Fourth -is wiretapping a phone the equivalent of Amendment reasonableness test contains standing outside a window and listening the vice of degenerative self-definition, INTERNET with each unimpeded intrusion providing a changed the means by which they communicate or shop, new baseline against which all subsequent those activities should now receive greater protection. In modes of government surveillance will be other words, they are not lamenting a bootstrapping tech- measured. As a test, it provides a near- nique being employed by the Supreme Court, but are claim- perfect bootstrap for incrementally more ing that society's reasonable expectations have changed, intrusive police actions. 114 and should therefore change in the eyes of the Supreme Luna suggests that each time the court approves a Court justices. government intrusion by the Katz reasonableness standard, Examining one of the arguments against applying even by a theory which initially strikes citizens as odd (like the existing pen register and trap and trace statutes to saying that since consumers "voluntarily" report the tele- e-mail reveals how acceptance of them would actually sig- phone numbers they dial to the telephone company, they nificantly undermine the jurisprudence on pen registers can't reasonably expect those numbers to remain private), and trap and trace devices as applied to the telephone. "a new, lower baseline of privacy" is created, "allowing People have expressed concern that separating content gradual deterioration of Fourth Amendment protection." 155 from addressing information in e-mail and Internet com- Luna is concerned by language like that used in Kyllo, where munications is so much more difficult than doing so with the Court noted that a search was unconstitutional "at telephone calls that the same rules should not apply. "59 But, least where (as here) the technology in question is not in since many telephone calls are now being routed via a tech- general public use." 15' So to guarantee that use of certain nology called Voice Over IP (VolP), which sends telephone devices is constitutional, the government could, according calls in packets just like e-mail is sent over the Internet, 160 to the Kyllo case, make sure that devices it wants to use are separating telephone numbers from the content of tele- well publicized and sold to the general public. phone calls will be just as cumbersome and fraught with As Justice Brandeis noted,"Clauses guaranteeing to the same potential for abuse. If pen register and trap and the individual protection against specific abuses of power, trace devices cannot apply to "Internet communications," must have a similar capacity of adaptation to a changing they would not be applicable to telephone calls sent via world" 157 Simply because the telephone did not exist when VoIP either (and these telephone calls may soon constitute the Fourth Amendment was drafted does not mean that a majority of all calls)! telephone conversations cannot possibly be protected by The fear expressed by Brandeis in his Olmstead dis- the same. 158 Advancing technology is allowing the govern- sent, and the concerns raised by commentators like Erik ment to monitor activity it could not previously monitor Luna, are worries that the government will use advancing without invading the home. The constitutional protections technology to intrude upon activities it could not previ- against abuses of power should adapt to this changing envi- ously have monitored without violating the Fourth Amend- ronment. ment. People alarmed by application of pen register and However, the question raised by the debate over trap and trace orders to Internet communications are now application of pen register and trap and trace orders to - whether they realize it or not - arguing that activities Internet communications is whether that adaptation should previously deemed unprotected by the Fourth Amend- go in both directions. Should the government no longer ment, should now be protected from government surveil- be able to monitor certain activities because technology lance. These arguments are legitimate, but the Fourth has allowed individuals to conduct those activities in the Amendment should not, and, based on substantial prece- privacy of their home? Should it matter that government dent, cannot provide those protections. Our current use monitoring of these activities was previously not consid- of the Internet to send mail and conduct other transactions ered a violation of people's reasonable expectations of pri- we used to engage in over the telephone or by going out vacy because they previously had been conducted exclu- to a store should not be grounds for providing protections sively in plain view? Years ago, in order to get the latest no previous generation has enjoyed. Technological changes Cabbage Patch Kid doll, or to view child pornography, or should not be allowed to enable the general public to hide conduct stock fraud, a person would have to go the physi- from the government any more than they should allow cal K-Mart store, visit the neighborhood adult bookstore, the government to abuse our Fourth Amendment rights. make several telephone calls, or send letters through the If people have decided that they want the e-mail and IP mail. Now, all of those things can be done from the privacy addresses of places they visit on the Internet (the equiva- of a person's home. lent of physical, "brick and mortar" stores) to have more In the case of pen register and trap and trace protection than the telephone numbers they dial or the orders being applied to e-mail and Internet communica- addresses of buildings they visit, that is fine. But those tions, however, commentators are making a different argu- protections will have to be provided by Congress, not the ment. In effect, commentators like Stewart Baker, Anne Supreme Court. Kandra and others are complaining that since people have Applying Pen Register and Trap and Trace Devices to Internet Communications 9United States v. Hambrick, 2000 U.S. App. LEXIS 18665, *1 1-12 (4th Cir.Aug.4, 2000).

Congress is in a better position to make laws cov- '0Olmstead v. United States, 277 U.S. 438,456-457 (1928). ering the privacy of communications that keep up with changing technology while also protecting Fourth Amend- "Id. ment rights. The USA PATRIOTAct amended existing statutes to explicitly define when and how pen register and Id. at 438. trap and trace orders may be obtained for Internet communications in a manner consistent with Supreme Court 13 Id. at 455-56. Olmstead's operation was significant. The jurisprudence and existing statutes. The application of pen evidence revealed "a conspiracy of amazing magnitude.... register and trap and trace laws to Internet communica- It involved the employment of not less than fifty persons, tions, as amended by the Act, illustrates how Congress is in of two seagoing vessels for the transportation of liquor the best position to protect "society's" reasonable expecta- to British Columbia, of smaller vessels for coastwise trans- tions of privacy as technology changes the way we live our portation to the State of Washington, the purchase and lives. use of a ranch beyond the suburban limits of Seattle, with a large underground cache for storage and a number of ENDNOTES smaller caches in that city, the maintenance of a central office manned with operators, the employment of exec- * 2003; B.A., Boston J.D. candidate, Vanderbilt University, utives, salesmen, deliverymen, dispatchers, scouts, book- University, 1996. The author wishes to thank Professor keepers, collectors and an attorney. In a bad month sales Donald Hall for his insightful critique. amounted to $176,000; the aggregate for a year must have exceeded two millions of dollars." Id. Olmstead took half 'See, e.g., United States v. NewYorkTelephone Co.,434 U.S. the profits for himself and distributed the other half evenly 159 (1977); Smith v. Maryland, 442 U.S. 735 (1979). among the other I I capital contributors. Id.

2 Ronald G. Shafer, Washington Wire:A Special Weekly Report 14 Id. at 456-457. Wires were inserted to the office from "the From The Wall Street Journal's Capital Bureau, WALL STREET basement of the large office building. The taps from JOURNAL, Feb. 9, 200 I,A I. house lines were made in the streets near the houses." Id.

I USA PATRIOT Act, § 105 ("Expansion Of National Elec- '1 Id. at 464. tronic Crime Task Force Initiative. The Director of the United States Secret Service shall take appropriate actions 6 Olmstead, 277 U.S. at 464. to develop a national network of electronic crime task forces, based on the New York Electronic Crimes Task 17 Id. Force model, throughout the United States, for the purpose of preventing, detecting, and investigating various forms 18Id. "It is plainly within the words of the [Fourth] Amend- of electronic crimes, including potential terrorist attacks ment to say that the unlawful rifling by a government agent against critical infrastructure and financial payment sys- of a sealed letter is a search and seizure of the sender's tems."). papers or effects. The letter is a paper, an effect, and in the custody of a Government that forbids carriage except 4 See id. § 216 ("Modification Of Authorities RelatingTo Use under its protection."..."The United States takes no such Of Pen Registers And Trap And Trace Devices"). care of telegraph or telephone messages as of mailed sealed letters. The Amendment does not forbid what was done s Id. here. There was no searching. There was no seizure.The evidence was secured by the use of the sense of hearing 6 Katz v. United States, 389 U.S. 347, 361 (1967) (Harlan, J., and that only. There was no entry of the houses or offices concurring). of the defendants."

7 See, e.g., Carl S. Kaplan, Concern Over Proposed Changes in 11Olmstead, 277 U.S. at 471-472. Internet Surveillance, N.Y.TIMES, Sept. 21, 200 1. 20 Id. at 472, 464-65. The majority agreed with the gover- 8 See, e.g., Smith v. Maryland, 442 U.S. 735, 742-743 (1979). ment's analysis, noting that "[t]he Amendment itself shows that the search is to be of material things -- the person, INTERNET the house, his papers or his effects. The description of the technical property law.' Silverman v. United States, 365 U.S. warrant necessary to make the proceeding lawful, is that it 505, 51 I. Once this much is acknowledged, and once it is must specify the place to be searched and the person or recognized that the Fourth Amendment protects people -- things to be seized." Also, relying on precedent from Carroll and not simply 'areas' -- against unreasonable searches and v. United States, 267 U.S. 132, 149 (1925), the majority held seizures, it becomes clear that the reach of that Amend- that Fourth Amendment can only "be construed in the light ment cannot turn upon the presence or absence of a physi- of what was deemed an unreasonable search and seizure cal intrusion into any given enclosure." when it was adopted" In other words, since wiretapping wasn't an unreasonable search and seizure at the end of the 29 Id. at 352-353.

I8 th century -- indeed, without the telephone, it couldn't 30Katz, 389 U.S. at 353. possibly be -- it wasn't a violation in the 2 0th.)

21 Id. Brandeis outlined his objection: "When the Fourth 31 Id. and Fifth Amendments were adopted, 'the form that evil had theretofore taken" had been necessarily simple. Force 32 Id. at 348. and violence were then the only means known to man by which a Government could directly effect self-incrimina- 11 Id. at 354. tion. It could compel the individual to testify -- a compul- 34 sion effected, if need be, by torture. It could secure posses- Olmstead, 277 U.S. at 438. Brandeis went on to say, "This sion of his papers and other articles incident to his private is peculiarly true of constitutions. They are not ephemeral life -- a seizure effected, if need be, by breaking and entry. enactments, designed to meet passing occasions. They are, Protection against such invasion of'the sanctities of a man's to use the words of Chief Justice Marshall 'designed to home and the privacies of life' was provided in the Fourth approach immortality as nearly as human institutions can and Fifth Amendments by specific language. Boyd v. United approach it: The future is their care and provision for States, 116 U.S. 616, 630. But 'time works changes, brings events of good and bad tendencies of which no prophecy into existence new conditions and purposes" Subtler and can be made." more far-reaching means of invading privacy have become available to the Government. Discovery and invention have 35Id. made it possible for the Government, by means far more effective than stretching upon the rack, to obtain disclosure 36 Id. in court of what is whispered in the closet." 37 Katz, 389 U.S. at 361 (Harlan,J., concurring). 22 Id. at 472-473. Brandeis quoted Weems v. United States, 217 U.S. 349, 373 (1909): "Legislation, both statutory and 38 Id. constitutional, is enacted, it is true, from an experience of evils, but its general language should not, therefore, be " Id. (internal citations omitted). necessarily confined to the form that evil had theretofore 40 taken:" Title III,Pub. L. No. 90-351,82 Stat. 212 (1968) (codified as amended in 18 U.S.C.S. §§ 25 10 et seq.). 23 Id. at 474-475 (quoting Boyd v. United States, 116 U.S. 616, 627-630 (1885)). 41 See 18 U.S.C.S. §§ 2510-2522 (1994 & Supp. IV 1998).

24 389 U.S. 347 (1967). 42 See 18 U.S.C.S. § 2518(3).

25 Katz, 389 U.S. at 348. 41 Id. ("normal investigative procedures have been tried and have failed or reasonably appear to be unlikely to succeed 26 Id. if tried or to be too dangerous").

27 Id. 44 § 2518(4).

28 Id. at 353. "Indeed, we have expressly held that the 41 § 2518(4)(e). Fourth Amendment governs not only the seizure of tangible items, but extends as well to the recording of oral state- 46 § 2518(5). ments, overheard without any 'technical trespass under ... Applying Pen Register and Trap and Trace Devices to Internet Communications

47 434 U.S. 159, 167 (1977). The case arose when the FBI 63 § 3123(a)(I). ordered the telephone company to install court ordered pen registers being used for illegal gambling activities. The 64 § 3 124. telephone company refused to comply with the order. Id. at 165. 65 § 3123(b).

48 Id. Pen registers decode the numbers by "responding to 66 Id. changes in electrical voltage caused" by the individual dialing numbers on a telephone. 67 A cable Internet network, for example, has several individual users in a small geographic area using their modems 41 Smith v. Maryland, 442 U.S. 735, 737 (1979). to connect to a shared router. Each home or business user's cable modem has an Internet Protocol (IP) address. 50 Id. This four part number (e.g., 128.128.128.2) can be entered into the trap and trace device which can be put in between 51 Id. the shared router and the ISP's servers. It would then monitor only the packets of electronic information going 52 Id. at 742. to (trap and trace) or from (pen register) the identified IP address. Users of dial-up modems or Digital Subscriber 13 Id. at 742-743 (citations omitted). The court also said Line (DSL) Internet connections would also not have to that whether the telephone call was made from a home worry about their communications being intercepted. Since or business or public telephone booth was "immaterial." each user uses a specific telephone line and number to con- Id. at 743. "Regardless of his location, petitioner had to nect to the Internet, the pen register or trap and trace convey that number to the telephone company in precisely device can be configured to monitor only that specific line. the same way if he wished to complete his call.The fact that Notice also that these requirements are in line with the he dialed the number on his home phone rather than on Olmstead rule: "The description of the warrant necessary some other phone could make no conceivable difference, to make the proceeding lawful, is that it must specify the nor could any subscriber rationally think that it would." Id. place to be searched and the person or things to be seized.' Olmstead, 277 U.S. at 464. 54 Id. at 745-746. 68 18 U.S.C.S. § 3121 (c). A government agency authorized to " Electronic Communications Privacy Act of 1986, 18 use a pen register or trap and trace device "shall use tech- U.S.C.S. § 2510-2522 (2002). Oct. 21, 1986, P.L. 99-508. nology reasonably available to it that restricts the recording or decoding of electronic or other impulses to the dial- 56 18 U.S.C.S. § 3123(a)(1) (2001). ing, routing, addressing, and signaling information utilized in the processing and transmitting of wire or electronic com- s7 Uniting and Strengthening America by Providing Appro- munications so as not to include the contents of any wire priateTools Required to Intercept and ObstructTerrorism or electronic communications." Id. Speaking in support of (USA PATRIOT) Act of 2001,107 RL. 56, 115 Stat. 272 (cod- the Act, Senator Orrin Hatch said: "Importantly, reform of ified Oct. 26, 2001). the pen register law does not allow -- as has sometimes been misreported in the press -- for law enforcement s8 Id. § 216. agents to view the content of any e-mail messages -- not even the subject line of e-mails. In addition, this legislation 59 18 U.S.C.S. § 3 127(3) (200 1) (emphasis added). we are about to vote upon makes it explicit that content can not be collected through such pen register orders.' 107 60 § 3127(4) (emphasis added). CONG. REC. S10547 (daily ed. Oct. II, 2001) (statement of Sen. Hatch). 61 See generally, TCP/IP, available at http:// searchNetwodng.techtargecom/sDefinition/0,,sid7_gci214173,00. 69 Anne Kandra, National Security vs. Online Privacy: The new html (last visited Mar. 13, 2003). antiterrorism law steps up electronic surveillance of the Internet; Consumer Watch, PC WORLD, Jan. I, 2002, at 4. 62 Johnny Gilman, Comment: Carnivore: The Uneasy Relation- 70 at ship Between the Fourth Amendment and Electronic Surveil- Id. 5. lance of Internet Communications, 9 CoMMLAw CONSPECTUS 111, 120 (2001). 7 Rachel King, Symposium: Is Congress giving too much surveil- INTERNET lance power to federal law enforcement?, INSIGHT ON THE NEWS, 84 Id. Jan. 14, 2002, at 40. 85 Comcast High-Speed Internet Service Subscriber 72 Id. Agreement, available at http://www.comcast.net/terms/ subscriber.jsp (last accessed Mar. 14, 2003). 7' See ITT Research Institute, Independent Review of Car- nivore System -- Final Report, at viii (2000) [hereinafter 86 See Smith, 442 U.S. 735, 741-742 (1979). "IITRI Report"], available at http://www.usdoj.gov:80/jmd/ publications/carniv final.pdf (last viewed Mar. 14, 2003); 87 United States v. Hambrick, 2000 U.S. App. LEXIS 18665 Federal Bureau of Investigation, FBI Programs and Initia- (4th Cir.Aug. 4, 2000). tives -- Carnivore Diagnostic Tool 1-3 hereinafter Carni- vore DiagnosticTool, at http://www.fbi.gov/hq/lab/carnivore/ 88 Id. at *3. carnivore2.htm (last viewed Mar. 14, 2003). 89 Id. at *4. 7 See IITRI Report, supra note 73, at 3-9 to 3-10. This would be done by putting the machine doing the surveil- 90 Id. at * I 1-12. lance on the smallest available subset of the network. For example, in a cable Internet environment, the FBI would 9' Id. (citing Smith, 442 U.S. at 74 1). place the monitoring machine at the router closest to the suspect's home. This router might serve several neighbors, 92 Id. at *1 I. and their communications would also be intercepted. But, the FBI technicians can also set the software to only moni- 93 Hambrick, 2000 U.S. App. LEXIS, at * 12 (quoting United tor traffic coming from or going to the specific IP address States v. Miller, 425 U.S. 435,443 (1976)). of the suspect's machine(s). 94 Id. at * 13, n. 4. 71 Id. at 3-23 to 3-28, C- I to C-32. IITRI conducted the following tests: (I) Non-content E-mail Collection, (2) Non- 9' United States v. Michael Kennedy, 81 F. Supp. 2d 1103 content Web Browsing Collection, (3) Non-content File (2000). Transfer Activity Collection; (4) Full Collection on a Fixed 96 IPAddress, (5) E-mail Content Collection, (6) Alias E-mail Id. at 1106. Collection, (7) Filtering Text String on Web Activity Col- lection, (8) Power Failure and Restoration, (9) Full Mode 97 Id. Collection for All TCP Ports, (10) Collect from a DHCP Assigned IPAddress, (II) Filtering on Text String for E-mail 98Id. Collection, (12) Filtering on Text String and E-mail Address or E-mail UserlD for E-mail Collection, (13) Filtering on 99 Id. at II10. Text String for FTP Collection. 100 Id. at I110. The court also pointed out that Kennedy 76 Id. at 3-24. had file sharing turned on, thereby allowing any Internet user to access his hard drive. The court's discussion did not 77 Id. at C-4. suggest, however, that having file sharing enabled was necessary for a finding that Kennedy had voluntarily disclosed his 78 Id. at C-5. subscriber information to Road Runner.

'0' Guest v. Leis, 255 F.3d 325, 335-336 (2001).

80 Id. 102 Paul Taylor, Issues Raised by the Application of the Pen Reg- ister Statutes to Authorize Government Collection of Informa- 8) See IITRI Report, supra note 73, at C-5. tion on Packet-Switched Networks, 6 VA. J.L. & TECH. 4 (Spring 2001). 82 See Smith, 442 U.S. 735 (1979). 103 Id. 83Yahoo! Terms of Service, available at http://docs.yahoo.com/ info/terms/ (last accessed Mar. 14, 2003). 104 Id. (quoting United States v. New York Telephone Com- Applying Pen Register and Trap and Trace Devices to Internet Communications pany, 434 U.S. 159, 167 (1977)) (emphasis added). 122 Id.

105NewYorkTelephone, 434 U.S. at 167. 123 Id. at 310.

106 107 CONG. REC. S 10365 (daily ed. Oct. 9, 200 1) (state- 124Id. at 311. ment of Sen. Leahy). 125 Id. 107 Id. 126 Sherry, supra note 120, at 31 I. 108 Id. 127 Id. 109 Id. 128 CONGRESSIONAL RECORD -- SENATE, Oct. 9,2001

10 Certainly, in other situations, like what happens to pris- 107th Congress, Ist Session, 147 CONG REC. S 10365. oners during a "war on terror," should be determined by the courts. This note is not attempting to determine the 129 Id. constitutionality of other elements of the USA PATRIOT Act, like those applying to detention of suspected terror- 130 Id. ists, etc. 131 Graham B. Smith, A Constitutional Critique Of Carnivore, ''' Id. The hacker thus makes the packets of information Federal Law Enforcement's Newest Electronic Surveillance Strat- he is using appear to be coming from Harvard University egy, 21 Lo. L.A. ENT. L. REV. 481, 513 (2001). computers instead of from his own computer, thus thwart- ing investigators' attempts to trace the messages. 132 In other sections of the Act, Congress seemed to be acting in a less, rather than more, protective way than the 112 107 CONG. REC. S10365 (daily ed. Oct. 9, 2001) (state- courts could be expected to have acted (such as section ment of Sen. Leahy). 203, authorizing the sharing of grand jury information with other agencies upon approval by a court or when the mat- 113 Id. ters concern foreign intelligence). This note does not suggest that Congress always acts in a more protective manner 114 Id. than the courts with regard to Fourth Amendment protections, but only that Congress can do more to protect "s Id. society's reasonable expectations of privacy in the face of changing technology. 116 Id. I" Smith, 442 U.S. at 742-43. 117 Id. 114 Mark Elmore, Big Brother Where Art Thou, Electronic Surveil- '8 107 CONG. REC. S10365 (daily ed. Oct. 9, 2001) (state- lance And The Internet: Carving Away Fourth Amendment Privacy ment of Sen. Leahy). Protections, 32 TEX.TECH L.REV. 1053, 1083 (2001).

.9The PATRIOT Act was passed with only one dissent -- 135 Kandra, supra note 69, at 4. surely an alarming statistic given the breadth of the legislation. However, as revealed by the legislative history and 136 See 18 U.S.C.S. § 3 121 (c), supra note 68. prior cases examining disclosure of non-content information in Internet communications, discussed above, suggest 137 18 U.S.C.S. § 3 121(3) ("The agency shall ensure that a that this amendment satisfied a long-felt need and would record will be maintained which will identify -- have passed on its own. (i) any officer or officers who installed the device and any officer or officers who accessed the device to 120 Suzanna Sherry, Haste Makes Waste: Congress and the obtain information from the network; Common Law in Cyberspace, 55 VANDERBILT L. R. 309, 317 (ii) the date and time the device was installed, the (Mar. 2002). date and time the device was uninstalled, and the date, time, and duration of each time the device is accessed to obtain 121 Id. at 31 I. information; INTERNET (iii) the configuration of the device at the time of its content of the e-mail itself. The ECPA quite sensibly treats installation and any subsequent modification thereof; and the 'To' and 'From' lines differently than the 'Subject' line (iv) any information which has been collected by -- even though they are intercepted at the same time and the device. under Smith the sender has no reasonable expectation of To the extent that the pen register or trap and privacy in any of them (or in the rest of the message, for trace device can be set automatically to record this informa- that matter). In order to receive an order authorizing a tion electronically, the record shall be maintained electroni- 'pen/trap' device for monitoring the 'To' and 'From' lines cally throughout the installation and use of such device. of electronic transmissions, government agents need only (B) The record maintained under subparagraph (A) certify that the information that is likely to be obtained is shall be provided ex parte and under seal to the court relevant to an ongoing criminal investigation. By contrast, in which entered the ex parte order authorizing the installa- order to read the 'Subject' line, a government agent would tion and use of the device within 30 days after termination have to obtain aTitle IIIorder" Id. (internal citations omit- of the order (including any extensions thereof)."). ted).

131 § 3126 ("Reports concerning pen registers and trap 146 Simmons, supra note 14 1,at 1318. and trace devices. The Attorney General shall annually report to Congress on the number of pen register orders 147Kyllo v. U.S., 533 U.S. 27 (2001) (In a case involving police and orders for trap and trace devices applied for by law use of thermal imaging devices to detect heat from mari- enforcement agencies of the Department of Justice, which juana grow lamps emanating from a home, the Supreme report shall include information concerning -- Court focused on the Fourth Amendment protection tradi- (I) the period of interceptions authorized by the tionally afforded the home and found a constitutional viola- order, and the number and duration of any extensions of tion.). the order; (2) the offense specified in the order or application, 148 Simmons, supra note 141 at 1322. or extension of an order; (3) the number of investigations involved; 141Id. at 1322-23. (4) the number and nature of the facilities affected; (5) the identity, including district, of the applying 10 Katz, 389 U.S. at 361. Of course, Congress is subject investigative or law enforcement agency making the applica- to other political pressures, by mega-coporations that want tion and the person authorizing the order."). easy access to individual's financial and other information. Congress may also be pressured to give less protection 139Katz, 389 U.S. at 361. to certain groups of people, like traffickers in illegal drugs. However, if "society" determines that drug pushers should 140 Smith v. Maryland, 442 U.S. 735, 750 (1979) (Marshall, J. get less protection than others, and that it is willing to take dissenting). the risk that innocent individuals may have some of their information revealed in the war on drugs, then it can pass 141Ric Simmons, From Katz to Kyllo:A Blueprint for Adapting legislation to that effect through Congress. And, if "soci- the Fourth Amendment to Twenty-First Century Technologies, 53 ety" changes its mind about that determination years later, HASTINGS L.J.1303, 1342 (Aug. 2002). it can repeal the legislation. It cannot, however, overturn Supreme Court decisions. 142 Id. at 1342-43. ...Carl S. Kaplan, Concern Over Proposed Changes in Internet 143 18 U.S.C.S. § 3123(a)(I). Surveillance, N.Y.TIMES, Sept. 21, 2001.

144 18 U.S.C.S. § 25 18(3). 112 Erik G. Luna, Sovereignty and Suspicion, 48 DUKE L. J. 787 (Feb. 1999). 141Simmons, supra note 14 1,at 1342-43. "The ECPA tacitly acknowledges the anomalous outcome of Smith's reason- 113 Id. at 793-794. "Beginning with the 1967 decision in Katz ing by setting a low standard for intercepting the Internet v.United States, the Supreme Court moved from a property- version of pen registers (as well as devices that record the based conception of the Fourth Amendment to a privacy- identity of incoming calls or messages, known as 'trap and based interpretation, holding that 'the Fourth Amendment trace' devices in the phone context). The 'header' of an protects people, not places" The new touchstone of search e-mail will not only acquire information about the identity and seizure analysis safeguards conversations whispered in of the sender and receiver, but also information about the the public cafe but not words screamed out the bedroom Applying Pen Register and Trap and Trace Devices to Internet Communications window. In particular, the Fourth Amendment protects'an expectation of privacy that society is prepared to consider reasonable! According to this interpretation, like the dis- junctive interpretation, warrantless surveillance should be judged under the mantra of reasonableness. "The Katz formula was clearly intended to provide individuals with a high level of protection against governmental surveillance. But in an ironic twist, Katz has been used to constrict Fourth Amendment rights rather than expand them." Id. at 793-794 (citations omitted).

114 Id. at 794-795 (citations omitted).

155 Luna, supra note , at 826.

156 Id.

117 Olmstead, 277 U.S. at 438.

18 Id. at 472-473. Brandeis quoted Weems v. United States, 217 U.S. 349, 373 (1909): "Legislation, both statutory and constitutional, is enacted, it is true, from an experience of evils, but its general language should not, therefore, be necessarily confined to the form that evil had theretofore taken"

19 Kandra, supra note 69, at 4.

160 See generally, Voice Over IP: A Networking Definition, available at http://searchnetworking.techtarget.com/sDefinition/ 0,,sid7_gci214148,00.html (last viewed Mar. 14, 2003). And, it is likely that more and more telephone calls will be routed in this manner, making the amended pen register and trap and trace laws necessary even for the legal use of those devices to obtain telephone numbers.