EFF Statement on Passage of Digital Telephony Act

[David Farber <farber () central cis upenn edu>]

EFF Statement on and Analysis of Digital Telephony Act
------------------------------------------------------


October 8, 1994




Washington, DC - Congress late Friday (10/7) passed and sent to the President
the Edwards/Leahy Digital Telephony Legislation (HR 4922/S 2375).  The bill
places functional design requirements on telecommunications carriers in
order to enable law enforcement to continue to conduct electronic
surveillance pursuant to a court order, though the bill does not expand law
enforcement authority to conduct wiretaps.  Moreover, the design
requirements do not apply to providers or operators of online services such
as the Internet, BBS's, Compuserve, and others.  The bill also contains
significant new privacy protections, including increased protection for
online personal information, and requirements prohibiting the use of pen
registers to track the physical location of individuals.


Jerry Berman, EFF's Policy Director, said: "Although we remain unconvinced
that this legislation is necessary, the bill draws a hard line around the
Internet and other online networks.  We have carved cyberspace out of this
legislation".


Berman added, "The fact that the Internet, BBS's, Prodigy, and other online
networks are not required to meet the surveillance capability requirements
is a significant victory for all users of this important communications
medium."




Privacy Protections for Online Personal Information Increased
-------------------------------------------------------------


The bill adds a higher standard for law enforcement access to online
transactional information.  For maintenance and billing purposes, most
online communications and information systems create detailed records of
users' communication activities as well as lists of the information,
services, or people that they have accessed or contacted.  Under current
law, the government can gain access to such transactional records with a
mere subpoena, which can be obtained without the intervention of a court.
To address this issue, EFF pushed for the addition of stronger protections
against indiscriminate access to online transactional records.


Under the new protections, law enforcement must convince a court to issue
an order based on a showing of "specific and articulable facts" which prove
that the information sought would be relevant and material to an ongoing
criminal investigation.


Berman said: "The new legal protections for transactional information are
critical in that they recognize that these records are extremely sensitive
and deserve a high degree of protection from casual law enforcement access.
With these provisions, we have achieved for all online systems a
significantly greater level of protection than exists today for any other
form of electronic communication, including the telephone."




EFF to Continue to Monitor Implementation
-----------------------------------------


Berman added: "There are numerous opportunities under this bill for public
oversight and intervention to ensure that privacy is not short-changed.
EFF will closely monitor the bill's implementation, and we stand ready to
intervene if privacy is threatened."


In the first four years, the government is required to reimburse carriers
for all costs associated with meeting the design requirements of the bill.
After four years, the government is required to reimburse carriers for all
costs for enhancements that are not "reasonably achievable", as determined
in a proceeding before the FCC.  The FCC will determine who bears the costs
in terms of the impact on privacy, costs to consumers, national security
and public safety, the development of technology, and other factors.  If
the FCC determines that compliance is not reasonably achievable, the
government will either be required to reimburse the carrier or consider it
to be in compliance without modification.


Berman said: "EFF is committed to making a case before the FCC, at the
first possible opportunity,  that government reimbursement is an essential
back-stop against unnecessary or unwanted surveillance capabilities.  If
the government pays, it will have an incentive to prioritize, which will
further enhance public accountability and protect privacy."




EFF Decision to Work on Legislation
-----------------------------------


Since 1992 EFF, in conjunction with the Digital Privacy and Security
Working Group (a coalition of over 50 computer, communications, and public
interest organizations and associations working on communications privacy
issues, coordinated by EFF) has been successful at stopping a series of FBI
Digital Telephony proposals, which would have forced communications
companies to install wiretap capability into every communications medium.
However, earlier this year, Senator Leahy and Rep. Edwards, who have helped
to quash previous FBI proposals, concluded that passage of such a bill this
year was inevitable.  Leahy and Edwards stepped in to draft a narrow bill
with strong privacy protections, and asked for EFF's help in the process.


"By engaging in this process for the last several months," Berman noted,
"we have been successful in helping to craft a proposal that is
significantly improved over the FBI's original bill in terms of privacy,
technology policy, and civil liberties, and have, in the process, added
significant new privacy protections for users of communications networks.
We commend  Representative Edwards, Senator Leahy, and Representatives
Boucher and Markey for standing up for civil liberties and pushing for
strong privacy protections."


The Electronic Frontier Foundation (EFF) is a non-profit public interest
organization dedicated to achieving the democratic potential of new
communications technology and works to protect civil liberties in new
digital environments.




Other Privacy Protections Added by the Bill
-------------------------------------------


The bill also adds the following new privacy protections


*       The standard for law enforcement access to online transactional records
        is raised to require a court order instead of a mere subpoena.


*       No expansion of law enforcement authority to conduct electronic
        surveillance.


*       The bill recognizes a citizen's right to use encryption.


*       All authorized surveillance must be conducted with the affirmative
        intervention of the telecommunications carrier.  Monitoring
        triggered remotely by law enforcement is prohibited.


*       Privacy advocates will be able to track law enforcement requests
        for surveillance capability, and expenditures for all surveillance
        capability and capacity added under this bill will be open to
        public scrutiny.


*       Privacy protections must be maintained in making new technologies
        conform to the requirements of the bill, and privacy advocates may
        intervene in the administrative standard setting process.


*       Information gleaned from pen register devices is limited to dialed
        number information only.  Law enforcement may not receive location
        information.




Analysis of and comments on major provisions of the bill
--------------------------------------------------------


A.      Key new privacy protections


1.      Expanded protection for transactional records sought by law
        enforcement


Senator Leahy and Rep. Edwards have agreed that law enforcement access to
transactional records in online communication systems (everything from the
Internet to AOL to hobbyist BBSs) threatens privacy rights because the
records are personally identifiable, because they reveal the content of
people's communications, and because the compilation of such records makes
it easy for law enforcement to create a detailed picture of people's lives
online. Based on this recognition, the draft bill contains the following
provisions:


i.      Court order required for access to transactional records instead of
        mere subpoena


In order to gain access to transactional records, such as a list of to whom
a subject sent email, which online discussion group one subscribes to, or
which movies you request on a pay-per view channel, law enforcement will
have to prove to a court, by the showing of "specific and articulable
facts" that the records requested are relevant to an ongoing criminal
investigation. This means that the government may not request volumes of
transactional records merely to see what it can find through traffic
analysis. Rather, law enforcement will have to prove to a court that it has
reason to believe that it will find some specific information that is
relevant to an ongoing criminal investigation in the records that it
requests.


With these provisions, we have achieved for all online systems, a
significantly greater level of protection than currently exists for
telephone toll records. The lists of telephone calls that are kept by local
and long distance phone companies are available to law enforcement without
any judicial intervention at all.  Law enforcement gains access to hundreds
of thousands of such telephone records each year, without a warrant and
without even notice to the citizens involved.  Court order protection will
make it much more difficult for law enforcement to go on "fishing
expeditions" through online transactional records, hoping to find evidence
of a crime by accident.


ii.     Standard of proof much greater than for telephone toll records, but
        below that for content


The most important change that these new provisions offer, is that law
enforcement will (a) have to convince a judge that there is reason to look
at a particular set of records, and (b) have to expend the time and energy
necessary to have a US Attorney or DA actually present a case before a
court. However, the burden or proof to be met by the government in such a
proceeding is lower than required for access to the content of a
communication.


2.      New protection for location-specific information available in
        cellular, PCS and other advanced networks


Much of the electronic surveillance conducted by law enforcement today
involves gathering telephone dialing information through a device known as
a pen register. Authority to attach pen registers is obtained merely by
asserting that the information would be relevant to a criminal
investigation. Courts have no authority to deny pen register requests.
This legislation offers significant new limits on the use of pen register
data.


Under this bill, when law enforcement seeks pen register information from a
carrier, the carrier is forbidden to deliver to law enforcement any
information which would disclose the location or movement of the calling or
called party. Cellular phone networks, PCS systems, and so-called
"follow-me" services all store location information in their networks.
This new limitation is a major safeguard which will prevent law enforcement
from casually using mobile and intelligent communications services as
nation-wide tracking systems.


i.      New limitations on "pen register" authority


Law enforcement must use "technology reasonably available" to limit pen
registers to the collection of calling number information only. Currently,
law enforcement is able to capture not only the telephone number dialed,
but also any other touch-tone digits dialed which reflect the user's
interaction with an automated information service on the other end of the
line, such as an automatic banking system or a voice-mail password.


3.      Bill does not preclude use of encryption


Unlike previous Digital Telephony proposals, this bill places no obligation
on telecommunication carriers to decipher encrypted messages, unless the
carrier actually holds the key.  The bill in no way prohibits citizens from
using encryption.


4.      Automated remote monitoring precluded


Law enforcement is specifically precluded from having automated, remote
surveillance capability.  Any electronic surveillance must be initiated by
an employee of the telecommunications carrier.


5.      Privacy considerations essential to development of new technology


One of the requirements that telecommunications carriers must meet to be in
compliance with the Act is that the wiretap access methods adopted must
protect the privacy and security of each user's communication.  If this
requirement is not met, anyone may petition the FCC to have the wiretap
access service be modified so that network security is maintained.  So, the
technology used to conduct wiretaps cannot also jeopardize the security of
the network as a whole.  If network-wide security problems arise because of
wiretapping standards, then the standards can be overturned.


6.      Increased Public Accountability


All law enforcement requests for surveillance capability and capacity, as
well as all expenditures paid by law enforcement to telecommunications
carriers and all modifications made by carriers to comply with this bill,
will be accountable to the public.  The government is also required to pay
for all upgrades, in both capability and capacity, in the first four years,
and all costs after four years for incorporating the capability
requirements in the costs for meeting those requirements are not
'reasonably achievable'.  A determination of whether compliance after four
years is reasonably achievable will be made by the FCC in an open and
public proceeding.   Government reimbursement for compliance costs will
permit the public the opportunity to decide whether additional surveillance
capability is necessary.


In all, the reimbursement requirements combined with the reporting
requirements and the open processes built in to this bill, law enforcement
surveillance capability, capacity, and expenditures will be more
accountable to the public than ever before.


B.      Draconian provisions softened


In addition, the surveillance requirements imposed by the bill are not as
far-reaching as the original FBI version.  A number of procedural
safeguards are added which seek to minimize the threatens to privacy,
security, and innovation.  Though the underlying premise of the Act is
still cause for concern, these new limitations deserve attention:


1.      Narrow Scope


The bill explicitly excludes Internet providers, email systems, BBSs,  and
other online services.  Unlike the bills previously proposed by the FBI,
this bill is limited to local and long distance telephone companies,
cellular and PCS providers, and other common carriers.


2.      Open process with public right of intervention


The public will have access to information about the implementation of the
Act, including open access to all standards adopted in compliance with the
Act, the details of how much wiretap capacity the government demands, and a
detailed accounting of all federal money paid to carriers for modifications
to their networks.  Privacy groups, industry interests, and anyone else has
a statutory right under this bill to challenge implementation steps taken
by law enforcement if they threaten privacy or impede technology
advancement.


3.      Technical requirements standards developed by industry instead of
the Attorney General


All surveillance requirements are to be implemented according to standards
developed by industry groups.  The government is specifically precluded
from forcing any particular technical standard, and all requirements are
qualified by notions of economic and technical reasonableness.


4.      Right to deploy untappable services


Unlike the original FBI proposal, this bill recognizes that there may be
services which are untappable, even with Herculean effort to accommodate
surveillance needs.  In provisions that still require some strengthening,
the bill allows untappable services to be deployed if redesign is not
economically or technically feasible.


Background Information
----------------------


* The Bill:
ftp.eff.org, /pub/EFF/Policy/Digital_Telephony/digtel94.bill
gopher.eff.org, 1/EFF/Policy/Digital_Telephony, digtel94.bill
http.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94.bill


All other files available from
ftp.eff.org, /pub/EFF/Policy/Digital_Telephony/Old/
gopher.eff.org, 1/EFF/Policy/Digital_Telephony/Old
http.eff.org/pub/EFF/Policy/Digital_Telephony/Old/


* EFF Analysis of Bill as Introduced: digtel94_analysis.eff
* EFF Statement on Earlier 1994 Draft of Bill: digtel94_old_statement.eff
* EFF Analysis of Earlier 1994 Draft: digtel94_draft_analysis.eff
* EFF Statement on Announcement of 1994 Draft: digtel94.announce
* EFF Statement on Announcement of 1993 Draft: digtel93.announce
* Late 1993/Early 1994 Draft: digtel94_bill.draft
* EFF Statement on 1992 Draft: digtel92_analysis.eff
* EFF Statement on 1992 Draft: digtel92_opposition.announce
* Late 1992 Draft: digtel92_bill.draft
* Original 1992 Draft: digtel92_old_bill.draft




For more information Contact
----------------------------


Jerry Berman    Policy Director         <jberman () eff org>
Jonah Seiger    Project Coordinator     <jseiger () eff org>


+1 202 347 5400 (voice)
+1 202 393 5509 (fax)