Modern Safeguards for Modern Surveillance: An Analysis of Innovations in Communications Surveillance Techniques Gus HoSEIN* & CAROLINE WILSON PALOWt TABLE OF CONTENTS 1. INTRODUCTION ................................ .......... 1071 A. A BriefHistory of CommunicationsSurveillance ... ..... 1073 B. Modern Communications Surveillance Techniques.............. 1080 1. Targeted Use of Offensive Technologies ...... ..... 1080 2. Targeted and Semi-targeted Use of Mobile Phone Surveillance ......................... ..... 1 081 3. Mass Surveillance ofNetwork Activity .................. 1082 II. THE RISKS OF MODERN COMMUNICATIONS SURVEILLANCE........... 1083 A. Secrecy .................................... 1085 B. DirectedSurveillance: The Two-Body Problem... ...... 1085 C. Overbreadth ............................ ..... 1086 D. Applicability of ConstitutionalProtections Against UnreasonableSearch and Seizure .................. 1088 E. Other ConstitutionalConcerns ............... ..... 1089 III. How SHOULD COURTS APPROACH THESE NEW TECHNIQUES? .. .. 1089 A. Offensive Technologies .................... ..... 1093 B. Mobile Monitoring Devices ............... ....... 1097 C. Mass Surveillance of the Network .............. .... 1102 IV. CONCLUSION........................................ 1104 I. INTRODUCTION To understand communications surveillance law is to try to resolve the three-body problem of simultaneously comprehending law, policy, and technology while at least two of the three may be changing at any moment in time. This makes it one of the more exciting domains for scholars, analysts, and technologists, but it is also one of the most challenging. Communications surveillance is a rapidly shifting landscape from the perspectives of policy and technology. Governments across the world are deploying new techniques and technologies with alarming speed. We are achieving new levels of surveillance, quickly approaching what Justice Brandeis warned about when he said that "[s]ubtler and more far-reaching means of invading privacy have become available to the Government," and that * Gus Hosein is the Executive Director of Privacy International. t Caroline Wilson Palow is a Legal Officer at Privacy International. 1072 OHIO STATE LA WJOURNAL [Vol. 74:6 "[d]iscovery and invention have made it possible for the Government, by means far more effective than stretching upon the rack, to obtain disclosure in court of what is whispered in the closet."' There is a rapidly growing market in communications surveillance technologies that can conduct surveillance in ways that just ten years ago were well beyond the limits of our technology and often our imaginations. With widespread innovations in policy and technology across the world, what is most surprising is how old-fashioned our legislation is, and in turn, our safeguards. Many communications surveillance laws were drafted in the 1980s and 1990s, with updates in the 1990s and early 2000s. 2 Many countries across the world are still introducing laws on communications surveillance, but their models are quite old, often borrowing language from laws from the 1990s (in the case of U.S. and UK law) and international conventions such as the Council of Europe Cybercrime Convention of 2001.3 They all ban interception of communications content, grant exceptions to government agencies, permit access to information about the communications (so-called communications metadata), establish authorization and oversight regimes, and permit government to order communications service providers to provide capabilities for lawful intercept and/or access.4 But they are not keeping pace with the new forms of advanced surveillance techniques and policies being deployed. In this Article we will draw out the modern landscape of surveillance policy and technologies (Part I). The deployment of new techniques and technologies is being done without new legal frameworks, and as such, we must resort to relying on older frameworks that may be unable to understand these new IOlmstead v. United States, 277 U.S. 438, 473 (1928) (Brandeis, J., dissenting). 2See, e.g., Electronic Communications Privacy Act (ECPA) of 1986, Pub. L. No. 99- 508, 100 Stat. 1848 (codified as amended in scattered sections of 18 U.S.C.) (amending and updating Title III of the Omnibus Crime Control and Safe Streets Act of 1968, commonly called the Wiretap Act); Communications Assistance for Law Enforcement Act (CALEA) of 1994, Pub. L. No. 103-414, 108 Stat. 4279 (codified at 47 U.S.C. §§ 1001-1010 (2012)) (further amending the Wiretap Act and Stored Communications Act in 1994); Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA PATRIOT ACT) of 2001, Pub. L. No. 107-56, 115 Stat. 272 (codified in scattered sections of the U.S.C.) (further amending the Wiretap Act and Stored Communications Act); Interception of Communications Act (IOCA), 1985, c. 56 (Eng.) (regulating the interception of communications); Regulation of Investigatory Powers Act (RIPA), 2000, c. 23 (Eng.) (replacing IOCA); Telecommunications (Interception Capability) Act 2004 (Act No. 19/2004) (N.Z.); Loi relative Ala protection de la vie priv6e contre les 6coutes, la prise de connaissance et l'enregistrement de communications et de t616communications priv6es of June 30, 1994, MONITEUR BELGE [M.B.] [Official Gazette of Belgium], Jan. 24, 1995, 01542. 3 Council of Europe Convention on Cybercrime, Nov. 23, 2001, E.T.S. No. 185, available at http://conventions.coe.int/Treaty/en/Treaties/Html/185.htm. 4 See, e.g., Wire and Electronic Communications Interception and Interception of Oral Communications (Wiretap Act), 18 U.S.C. §§ 2510-2522 (2012); RIPA, 2000, c. 23; Telecommunications Act, 2004 (N.Z.); Regulation of Interception of Communications and Provision of Communication-Related Information Act 70 of 2002 § 5 (S. Afr.). 2013] MODERN SAFEGUARDS FOR MODERN SUR VEILLANCE 1073 techniques, or constitutional safeguards that have a long and troubled history with innovation (Part II). Using the example of the lack of legislative activity in the United States, we look at how lower courts are trying to resolve the Fourth Amendment concerns inherent in some of these techniques, and make suggestions regarding how we believe current law should be applied (Part III). We are in a moment of great uncertainty characterized by the absence of legislative activity implementing real safeguards, use of new communications surveillance capabilities often in secretive ways, and courts grappling to understand new technologies. Laws, technologies, and the courts have, until now, maintained a delicate balance on communications surveillance; when new technologies posed new threats, often the courts or the legislative bodies would respond. If one branch failed, another would usually pick up the gauntlet. After the U.S. Supreme Court decided that interception of communications did not qualify as a search under the Fourth Amendment in 1928,5 Congress responded in the 1930s with strict controls. 6 In the 1960s the Supreme Court and Congress fed off one another to develop jurisprudence7 and legislation.8 Responding to abuses in the 1970s, Congress enacted new laws, 9 and when the Supreme Court decided against protecting certain metadata,' 0 Congress responded with rules on "trap and trace" and "pen registers."" Unfortunately, we are currently seeing a lack of interest in safeguards from Congress and other legislatures around the world, while technical capabilities are expanding. There is even speculation that the Foreign Intelligence Security Court is being activist in enabling surveillance.12 It is high time to reintroduce safeguards into the conversation, and to apply them against technologies that are increasingly used to conduct directed and mass surveillance of our sensitive information. A. A Brief History of Communications Surveillance Communications surveillance is almost as old as our ability to communicate.13 While our attempts to regulate that surveillance are more recent, they still lag behind the pace of technological innovation. Scholars thus 5 Olmstead, 277 U.S. at 464. 6 See Communications Act of 1934, Pub. L. No. 416, 48 Stat. 1064 (codified as amended in scattered sections of 47 U.S.C.). 7 See, e.g., Katz v. United States, 389 U.S. 347 (1967). 8 See Omnibus Crime Control and Safe Streets Act of 1968, Pub. L. No. 90-351, 82 Stat. 197 (codified as amended at 18 U.S.C. §§ 2510-2522 (2012)) (containing Title III, commonly referred to as the Wiretap Act). 9 See Foreign Intelligence Surveillance Act (FISA) of 1978, Pub. L. No. 95-511, 92 Stat. 1783 (codified as amended in scattered sections of 50 U.S.C.). 10 See Smith v. Maryland, 442 U.S. 735, 745-46 (1979). 11 See ECPA of 1986, Pub. L. No. 99-508, 100 Stat. 1868. 1 2 See Eric Lichtblau, In Secret, Court Vastly Broadens Powers of N.S.A., N.Y. TIMES, July 7, 2013, at Al. 13 For a history of communication surveillance going back to the Egyptians, see generally DAVID KAHN, THE CODEBREAKERS: THE STORY OF SECRET WRITING (1967). 1074 OHIO STATE LAW JOURNAL [Vol. 74:6 struggle to understand how to resolve modem forms of communications surveillance with older legal frameworks. For instance, our abilities to comprehend what a constitutional statement about a right to privacy actually means may be linked with the state of surveillance at the time. Efforts to monitor communications are of course linked to our methods of communicating. With letters and post came the interception of postal communications. With the