A Lot More Than a Pen Register, and Less Than a Wiretap
Total Page:16
File Type:pdf, Size:1020Kb
Pell and Soghoian: A Lot More than a Pen Register, and Less than a Wiretap 1 A LOT MORE THAN A PEN REGISTER, AND LESS THAN A WIRETAP: WHAT THE STINGRAY TEACHES US ABOUT HOW CONGRESS SHOULD APPROACH THE REFORM OF LAW ENFORCEMENT SURVEILLANCE 2 AUTHORITIES Stephanie K. Pell* & Christopher Soghoian** 16 YALE J.L. & TECH. 134 (2013) ABSTRACT In June 2013, through an unauthorized disclosure to the media by ex-NSA contractor Edward Snowden, the public learned that the NSA, since 2006, had been collecting nearly all domestic phone call detail records and other telephony metadata pursuant to a controversial, classified interpretation of Section 215 of the USA PATRIOT Act. Prior to the Snowden disclosure, the existence of this intelligence program had been kept secret from the general public, though some members of Congress knew both of its existence and of the statutory interpretation the government was using to justify the bulk collection. Unfortunately, the classified nature of the Section 215 metadata program prevented them from alerting the public directly, so they were left to convey their criticisms of the program directly to certain federal agencies as part of a non-public oversight process. The efficacy of an oversight regime burdened by such strict secrecy is now the subject of justifiably intense debate. In the context of that debate, this Article examines a very different surveillance technology—one that has been used by federal, state and local law enforcement agencies for more than two decades without invoking even the muted scrutiny Congress applied to the Section 215 metadata program. During that time, this technology has steadily and significantly expanded the government’s surveillance capabilities in a manner and to a degree to date largely unnoticed and unregulated. Indeed, it has never been explicitly authorized 1 “A little more than kin, and less than kind.” WILLIAM SHAKESPEARE, HAMLET act 1, sc. 2. 2 The authors would like to thank Susan Freiwald and Jim Green for their feedback and assistance. * Principal, SKP Strategies, LLC; Non-resident Fellow at Stanford Law School’s Center for Internet and Society; former Counsel to the House Judiciary Committee; former Senior Counsel to the Deputy Attorney General, U.S. Department of Justice; former Counsel to the Assistant Attorney General, National Security Division, U.S. Department of Justice; and former Assistant U.S. Attorney, Southern District of Florida. ** Principal Technologist, Speech, Privacy & Technology Project, American Civil Liberties Union; Visiting Fellow, Information Society Project, Yale Law School. The opinions expressed in this article are this author’s alone, and do not reflect the official position of his employer. 134 Published by Yale Law School Legal Scholarship Repository, 2014 1 Yale Journal of Law and Technology, Vol. 16 [2014], Iss. 1, Art. 4 16 YALE J.L. & TECH. 134 (2013) 2013-2014 by Congress for law enforcement use. This technology, commonly called the StingRay, the most well-known brand name of a family of surveillance devices, enables the government, directly and in real-time, to intercept communications data and detailed location information of cellular phones—data that it would otherwise be unable to obtain without the assistance of a wireless carrier. Drawing from the lessons of the StingRay, this Article argues that if statutory authorities regulating law enforcement surveillance technologies and methods are to have any hope of keeping pace with technology, some formalized mechanism must be established through which complete, reliable and timely information about new government surveillance methods and technologies can be brought to the attention of Congress. 135 https://digitalcommons.law.yale.edu/yjolt/vol16/iss1/4 2 Pell and Soghoian: A Lot More than a Pen Register, and Less than a Wiretap A LOT MORE THAN A PEN REGISTER, AND LESS THAN A WIRETAP I. INTRODUCTION ..................................................................................... 136 II. A BRIEF DESCRIPTION OF A STINGRAY AND ITS CAPABILITIES ............ 144 III. IN BETWEEN OR BEYOND THE REACH OF STATUTORY LANGUAGE....... 148 A. Real-time Cell Phone Tracking and Secrecy ................................. 149 B. The StingRay and Secrecy.............................................................. 154 1. The 1995 Digital Analyzer Magistrate Opinion ...................... 157 2. 2012 StingRay Magistrate Opinion.......................................... 160 IV. WARNINGS FOR LEGISLATORS .............................................................. 163 V. SUGGESTIONS FOR REFORM ................................................................. 165 VI. CONCLUSION ........................................................................................ 169 I. INTRODUCTION Beginning in June 2013, the details of several National Security Agency (NSA) classified surveillance programs were revealed in a series of articles by journalists who had received documents from ex-NSA contractor Edward Snowden.3 Among the many disclosures and subsequent releases of information by the Administration and Members of Congress was the revelation that, since 2006, the NSA has been collecting domestic call detail records and other domestic telephony metadata4 in bulk, pursuant to a controversial interpretation of Section 215 of the USA PATRIOT Act 3 See Glenn Greenwald, NSA Collecting Phone Records of Millions of Verizon Customers Daily, THE GUARDIAN, June 5, 2013, http://www.theguardian.com/world/2013/jun/06/nsa- phone-records-verizon-court-order (“The National Security Agency is currently collecting the telephone records of millions of US customers of Verizon, one of America’s largest telecoms providers, under a top secret court order issued in April.”); see also Danny Yadron and Evan Perez, T-Mobile, Verizon Wireless Shielded from NSA Sweep, WALL ST. J., June 14, 2013, http://online.wsj.com/article/SB10001424127887324049504578543800240266368.html (explaining that the NSA “doesn't collect information directly from T-Mobile USA and Verizon Wireless . [but the NSA] still capture[s] information, or metadata, on 99% of U.S. phone traffic because nearly all calls eventually travel over networks owned by U.S. companies that work with the NSA”). 4 The Administration defines this telephony metadata as including “information about what telephone numbers were used to make and receive the calls, when the calls took place, and how long the calls lasted. [T]his information does not include any information about the content of those calls—the Government cannot, through this program, listen to or record any telephone conversations.” Administration White Paper: Bulk Collection of Telephony Metadata Under Section 215 of the USA Patriot Act on Section 215, at 2 (Aug. 9, 2013) [hereinafter Administration White Paper on Section 215], http://info.publicintelligence.net/DoJ-NSABulkCollection.pdf. 136 Published by Yale Law School Legal Scholarship Repository, 2014 3 Yale Journal of Law and Technology, Vol. 16 [2014], Iss. 1, Art. 4 16 YALE J.L. & TECH. 134 (2013) 2013-2014 (PATRIOT Act).5 Section 215 is an intelligence collection authority permitting the government to compel “tangible things” from third parties that are “relevant” to an “authorized investigation” in order: (1) “to obtain foreign intelligence information not concerning a United States person”; or (2) to “protect against international terrorism or clandestine intelligence activities.”6 The public has also learned that this massive quantity of data is collected and stored in a centralized database in order to enable future searches by the NSA—that is, if and when there is a reasonable articulable suspicion that an identifier (e.g. a phone number) is associated with a particular foreign terrorist organization7 or with terrorism.8 The goal of the program is “to enable the government to identify communications among known and unknown terrorism suspects, particularly those located inside 9 the United States.” 5 For the most complete factual and legal explanation of the 215 metadata program from the Administration to date, see Administration White Paper on Section 215, supra note 4. Since the time the Administration chose to declassify and disclose the Section 215 White Paper to the public, two different federal district courts have issued dueling opinions on the legality of this intelligence program. See ACLU v. Clapper, No. 13-3994 (WHP) (S.D.N.Y. Dec. 27, 2013) (holding that the 215 bulk collection metadata program is lawful as both a statutory and constitutional matter); Klayman v. Obama, No. 13-0851 (RJL) (D.D.C. Dec. 16, 2013) (finding that the plaintiffs have demonstrated a substantial likelihood of success on a claim that the Section 215 metadata program violates the Fourth Amendment). 6 50 U.S.C. § 1861(a)(1). 7 See Transcript: Newseum Special Program—NSA Surveillance Leaks: Facts and Fiction 8 (June 26, 2013) (statement of Robert Litt, General Counsel of the Office of Director of National Intelligence), http://www.dni.gov/index.php/newsroom/speeches-and- interviews/195-speeches-interviews-2013/887-transcript-newseum-special-program-nsa- surveillance-leaks-facts-and-fiction (“The metadata that is acquired and kept under this program can only be queried when there is reasonable suspicion, based on specific, articulable facts, that a particular telephone number is associated with specified foreign terrorist organizations. And the only purpose for which we can make that query is to identify contacts.”); see also Laura K. Donohue, Bulk Metadata