IP: Orin Kerr replies to John Gilmore: USA PATRIOT Act not that bad!

[Dave Farber <dave () farber net>]

------ Forwarded Message
From: Declan McCullagh <declan () well com>
Reply-To: declan () well com
Date: Wed, 10 Apr 2002 22:09:11 -0700
To: politech () politechbot com
Cc: okerr () main nlc gwu edu, gnu () toad com
Subject: FC: Orin Kerr replies to John Gilmore: USA PATRIOT Act not that
bad!

[Orin was at the Justice Department until last year and is now a law
professor at George Washington University. Text of final USA PATRIOT Act:
http://www.politechbot.com/docs/usa.act.final.102401.html Also see a note
from Geoff Newbury below. --Declan]

---

From: "Kerr, Orin" <okerr () main nlc gwu edu>
Organization: GW Law School
To: declan () well com
Date: Wed, 10 Apr 2002 11:52:07 -0500
Subject: Re: FC: UK wiretapping "traffic" vs. "contents" a sham, by John
Gilmore
CC: gnu () toad com

Declan,

While I can't fault John Gilmore's technical analysis, I think his
analysis of U.S. law both pre-Patriot and post-Patriot is pretty far
off.  This may not satisfy the Black Helicopters crowd, but at least
some your readers may want to know that things aren't so bad as
Gilmore seems to believe.

To begin with, it is essential to recognize that the federal statutory
privacy laws such as the Wiretap Act (18 USC 2510-22) and the
Pen Register Act (18 USC 3121-27) are not pure grants of
government power.  These laws are privacy laws, that extend privacy
protection above and beyond the Fourth Amendment rules to protect
Internet communications.  These laws have exceptions that allow the
government to collect certain kinds of communications with a court
order (see 18 usc 3123, 18 USC 2518) but the exceptions only
apply if the privacy law applies to that communication in the first
place.  If the privacy law doesn't apply in the first place, then the
communication is totally unprotected by statutory law.  Of course,
the 4th Amendment can still protect it, but that's a question for the
courts to decide, not Congress. (Congress only has the power to
enact prophylactic rules that go beyond 4th Amendment protections;
if a Congressional law violates the Fourth Amendment by offering
less protection than the Fourth Amendment provides, the courts will,
should and must invalidate it.)

John Gilmore suggests that pre-Patriot Act, there was a "clear legal
distinction" between content and other information, but that it has
now been erased in a sinister plot.   The trouble is, the Patriot Act
did not in any way change the statutory definition of "contents"
found in the Wiretap Act at 18 USC 2510(8), so it could not have
changed what is or could be considered "contents."  This definition
has not changed since 1986.  What the Patriot Act did do is expand
the other category of non-content information to make sure that the
Pen Register law broadly protects addressing information of Internet
communications, now dubbed "dialing, routing, addressing, and
signalling information."

While John GIlmore sees an evil government plot, I see the
expansion of a privacy law.  In fact, if the Pen Register law did not
apply to non-content addressing information before the Patriot Act
(a question upon which Magistrate Judges split, but Gilmore insists
was clearly true), that means that absolutely anyone at any time was
free to wiretap the Internet and collect all addressing information
without any court order-- whether it was the FBI, the CIA, the United
Nations, whoever.  It would be Carnivore without a court order, all
perfectly in compliance with U.S. statutory law.  Needless to say,
that would be bad.

As best I can tell, Gilmore doesn't seem to confront this possibility
because he  assumes that anything that doesn't fall into the limited
definition of "pen register" must by default be considered the
"contents" of a communication.  The 1968 Senate Report that
accompanied the original Wiretap Act suggested this, but this
approach was rejected by Congress in 1986 when Congress
enacted ECPA and the Pen Regsiter law and settled upon the more
narrow definition of "contents" that we have today.  The Senate
Report clarifies that "contents" post-1986 refers to "the substance,
purport, or meaning of the communication," as opposed to merely
"the existence of the communication or transactional records about
it."  Courts interpreting  "contents" have taken a similar approach.
See, e.g., Brown v. Waddell, 50 F.3d 285, 294 n.11 (4th Cir. 1995)
(suggesting that contents are "substantive messages").  This means
that pre-Patriot Act, addressing information that was not a
substantive message sent by a person was quite possibly
unprotected by U.S. privacy law.   There was a gap in the privacy
law that the USA Patriot Act filled.

I suspect Gilmore and I would agree that Congress should do more
to protect addressing information.  However, I think that his view that
the Patriot Act lessened legal protections afforded to addressing
information is a bit backwards.

Orin

Orin S. Kerr
Associate Professor
George Washington University Law School
okerr () main nlc gwu edu
(202) 994-4775

---

From: "Newbury" <newbury () mandamus org>
To: "declan () well com" <declan () well com>
Date: Wed, 10 Apr 02 13:01:53 -0500
Reply-To: "Newbury, Geoff" <newbury () mandamus org>

On Wed, 10 Apr 2002 04:59:24 -0700, Declan McCullagh wrote:

Firstly, thanks are due to John for a brilliant exposition of layering
versus legalism.


> From: John Gilmore <gnu () toad com>
> When my ex-girlfriend of years ago phoned me on the night of September
> 11th, the real message wasn't what she said; the real message was that
> when the world looked shaky and strange, she thought to call me.  The
> actual words we exchanged were merely signaling information.

What John has in fact pointed out  is the faulty, in fact devious, logic
underlying the DoJ's efforts to allow 'pen-trace' warrants at a
lower judicial standard.

It is abundantly clear that the DoJ/state AG's etc. (or FBI, RCMP, CSIS
etc.) are only interested in pen trace information, *AS
CONTENT*. They fudge the meaning of 'speech' (which is protected) to
exclude the manner/means/method of that speech.

But if anonymous speech is a protectable entity, should not truly anonymous
methodologies also be protected? I can avoid the
pen-trace by using a randomly chosen pay phone, or calling from some-else's
phone.

Should I have to take active steps, to remain anonymous *from state power*
when no probable cause exists?

It is interesting that the DoJ says, in effect, that 'dialing' is not
'speech' but, it is presented as evidence that *you* must have talked
to 'Mr. X', because *your* phone was used to call *his* phone, and that
*you* therefore communicated with him (possibly multiple
times). As a lawyer, I suspect that it is all too easy for prosecutor to
convince a jury, that that talk, must have had something to do
with the crime.....even though logically it is a post hoc, proctor hoc
conclusion.

The argument that I have a 'lower' expectation of privacy when I dial,
fails to take cognizance of the fact that this too is
communication: communication with the phone company, at the very least.
There is a fundamental disjuncture which the Supremes
will someday likely have to face: they have held that anonymous speech is
protected speech, but they have also seemingly held
that communication, for the purpose of engaging in protected speech, is not
protected speech. These two propositions will meet in
battle I suspect.

(Digression: it is presently impossible to engage in anonymous telephone
speech through relaying: that is generally considered
hacking or theft of telecommunications. The web world has anonymous relays.
These do not exist in telephony to my knowledge.)

The resistance of the EFF to intrusions on constitutional rights by
obscurity is welcome. As a Canadian, my Charter Rights are
'subject to such reasonable limits as are prescribed by law'... Worse yet,
the 'forbidden fruit' concept of evidentiary admissability
has never been the law of Canada. Evidence may be excluded where, to allow
it would bring the administration of justice into
disrepute. These questions have no 'bright line' or sharp edges, just many
shades of grey.

On the other hand, jurisprudence involving section 8 of the Charter,
(unreasonable search or seizure), now contained in seciton 183
of the Criminal Code, makes it clear that  a 'private communication
means...any telecommunication.. in which is it reasonable for the
originator to expect that it will not be intercepted by any person other
than the person intended by the originator to receive it'.
'Intercept' includes 'listen to, record or acquire a communication'. As a
result, even a 'pen-trace' requires a full Section 186
interception warrant. Note that in Canada, the application for a warrant
requires the personal approval of the Solicitor-General of
Canada or of the provincial Attorney-General (or the designated Deputy
Solicitor-General or Deputy Attorney-General).
The requirements are strict and interception by a third party of private
communications is an offence).
So Canada is a little more rigourous at the outset, and maybe less
rigourous further on..

As to Great Britain, not having a written constitution can be dangerous to
your freedoms: viz. the Regulation of Investigatory Powers
which appears to de-regulate any intrusions into telecommunications,
leaving the power of authorization for many data searches with
the chief of the local police. 'Wire-taps' must be authorized by the
Secretary of State, but mnay other searches, including covert and
intrusive surveillance can be authorized by police authorities.

(Check out section 49: it provides for the mandatory disclosure of
encryption keys protecting 'protected data'. The allowable reasons
of requiring mandatory disclosure are much weaker than equivalent
US/Canadian standards. On a quick read, it appears that there
are effectively no limits on interception of communications intended for
transmission to recipients outside the UK (but I may be
reading this wrongly..it is *not* a sterling example (sorry!) of clarity in
legislative drafting).

The R.I.P. Act (2000) can be found through the British and Irish Legal
Information Institute web site  http://www.bailii.org   which has
all Statutes since 1988 on line, plus good databases of Court of Appeal and
House of Lords decisions.

> It is easy to respond to DoJ's points -- but not by acquiescing.  By
> insisting that what they are doing today is utterly illegal, and that
> what they seek under the law (the legalization of what they do today,
> plus wiggle room for more later) is utterly unconstitutional.

For examples of why the DoJ's logical position is wrong, you might take a
look at the Supreme Court of Canada's decisions in R. v.
Wong [1990] 3 S.C.R. 36 re reasonable expectation of privacy and R. v
Duarte [1990] 1 S.C.R. 30 re "the insidious dangers in
allowing the state in its unfettered discretion to record our words".
(These cases may be on-line at www.lexum.umontreal.ca but I cannot confirm
it as that site appears to be down. I *think* that the
Judgments on-line go back to 1990. The Supreme Court is a www.scc-csc.gc.ca
but links to the Lexum site.)

> Let's see:  The response of the federal police force when an emergency
> arises is to IMMEDIATELY BREAK THE LAW AND THE CONSTITUTION in an
> umistakably massive way.>

Succinctly put!

> Not exactly.  In the US, the standard of evidence required by a court
> to grant "pen register" access is substantially lower than that
> required for a "full content" or "Title III" search warrant. ...
>  Because the end point did not identify an
> individual, it was deemed to require a lower standard of protection.

The Canadian Supreme Court has noted that expectations of privacy belong to
people and not to places, but that does not displace
the requirement that there be 'reasonable and probable grounds to believe
that an offence has been or is being committed and that
the authorization sought will afford evidence of that offence'. On that
standard, no 'pen-trace' warrant should ever be issued. If a
warrant were capable of being issued, it would be a full warrant, not a
restricted warrant.

Geoff Newbury
(Who does *not* practice criminal law...

If you practice criminal law, you have to associate with liars, thieves,
cheats and scoundrels...
And the clients are worse!  Anon.


For archives see:
http://www.interesting-people.org/archives/interesting-people/