FC: Debate over warrantless Carnivore bill with Stu Baker

[Declan McCullagh <declan () well com>]

Stewart Baker is the former general counsel to the National Security Agency 
and now a partner at the Washington law firm of Steptoe and Johnson:
http://www.steptoe.com/WebBio.nsf/biographies/Stewart+A.+Baker?OpenDocument
http://www.mccullagh.org/image/10/stewart-baker.html

Below is a few rounds of a debate we had on Dave Farber's IP list in 
response to my article ("Senate votes to permit warrantless Net-wiretaps, 
Carnivore use"):
http://www.wired.com/news/politics/0,1283,46852,00.html

-Declan

**********

> To: "'farber () cis upenn edu'" <farber () cis upenn edu>
> cc: "Albertazzie, Sally" <SAlbertazzie () steptoe com>
> Subject: RE: Senate votes to permit warrantless Net-wiretaps, Carnivore
>  us e
> Date: Fri, 14 Sep 2001 19:28:17 -0400
>
> This seems a bit alarmist.  The FBI has long had the authority to get the
> phone numbers that are called from or that call to a suspect's phone.  These
> are trap-and-trace and pen-register orders.  The Justice Department has
> generally taken the position that the Internet equivalent of such data is
> the addressing information in emails.  This bill would enshrine the Justice
> Department position in law -- without changing the warrant requirements or
> the predicate for getting such Internet pen register data.  It's not that
> big a change from the status quo.  I would guess that, even without the law,
> Justice would have about a 60-40 or even 70-30 chance of winning its
> argument in court.
>
> In my view there are some reasons to be uneasy about the bill but not
> frothing.
>
> First, the to and from lines on my emails (plus the URLs I visit) are in
> fact more intimate information than the phone numbers I call.  What's more,
> I'm already on notice that the phone numbers aren't all that private --
> they're used to bill me, after all.  Not true for URLs or "to" lines.  Once
> that data is gathered by the police(on a very easy standard, I agree), it
> may never be thrown out, and lots of people can access it.  So extending
> police authority to such data ought to be the occasion for thinking
> creatively about how to discipline the use of that authority.  If I were
> writing the bill, I'd let the police gather such data, but I'd do more to
> audit the people who access it and require prosecutors to notify people
> after the fact that they've been targeted for surveillance (unless that
> would blow an ongoing investigation).  As things stand, the only people who
> find out about such surveillance and thus get a chance to challenge it are
> criminal defendants.  Isn't that just backwards?  I mean, who came up with a
> system in which crooks may go free because their privacy was violated while
> innocent people who've suffered the same violation never have a remedy?
>
> Second, most ISPs would like to see an assurance that Carnivore won't be
> used if they have their own systems that can accomplish the same thing, or
> that they'll be indemnified for any damage Carnivore might do to the system.
>
> In short, we may be missing some opportunities to improve privacy law, but
> it's hard to say that the privacy sky is falling.
>
> Stewart

**********

To: farber () cis upenn edu, ip-sub-1 () majordomo pobox com
Subject: Re: IP: RE: Senate votes to permit warrantless Net-wiretaps, 
Carnivore us e
Cc: SAlbertazzie () steptoe com, SBaker () steptoe com

Dave,
I'm glad to see Stu joining the civil libertarian crowd. He's right, of 
course, that there are reasons to be uneasy about the new "Combating 
Terrorism Act."

Current law permits specific Justice Department officials to authorize 
meatspace telephone pen register and trap and trace devices without a court 
order in two circumstances. Here's an excerpt from the U.S. Code:

http://www4.law.cornell.edu/uscode/18/3125.html
> an emergency situation exists that involves immediate danger of death or 
> serious bodily injury to any person [or] conspiratorial activities 
> characteristic of organized crime

This bill does three things of note:

1. It adds "U.S. Attorney" to the list of officials who can authorize 
warantless surveillance.

2. It expands the "emergency situation" rule beyond serious bodily 
injury/organized crime. I described this in my article:
http://www.wired.com/news/politics/0,1283,46852,00.html
> Circumstances that don't require court orders include an "immediate threat 
> to the national security interests of the United States, (an) immediate 
> threat to public health or safety or an attack on the integrity or 
> availability of a protected computer." That covers most computer hacking 
> offenses.

3. It rewrites pen register/trap and trace law and moves it from the 
telephone world to explicitly cover computer networks as well, which would 
permit Carnivore's use under this section (when operated in 
trap-and-trace/pen-register mode). Here are some excerpts from the bill:

http://www.politechbot.com/docs/cta.091401.html
> The order shall, upon service of the order, apply to any entity providing 
> wire or electronic communication service in the United States... inserting 
> ``, routing, addressing,'' after ``dialing''... by striking ``call 
> processing'' and inserting ``the processing and transmitting of wire and 
> electronic communications''...

Now, whether all this is, as Stu blandly suggests, "a bit alarmist," is up 
to IPers to decide. But I think Senator Patrick Leahy, the chairman of the 
Senate Judiciary committee, put it well during the floor debate last night. 
Here's a quote from the Congressional Record.

http://www.fas.org/sgp/congress/2001/s091301.html
> LEAHY: Maybe the Senate wants to just go ahead and adopt new abilities to 
> wiretap our citizens. Maybe they want to adopt new abilities to go into 
> people's computers. Maybe that will make us feel safer. Maybe. And maybe 
> what the terrorists have done made us a little bit less safe. Maybe they 
> have increased Big Brother in this country.

-Declan

**********

From: "Baker, Stewart" <SBaker () steptoe com>
To: "'Declan McCullagh'" <declan () well com>, farber () cis upenn edu,
        ip-sub-1 () majordomo pobox com
cc: "Albertazzie, Sally" <SAlbertazzie () steptoe com>,
        "Baker, Stewart" <SBaker () steptoe com>
Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps,
 Carn ivore us e
Date: Fri, 14 Sep 2001 20:13:31 -0400

Declan,

I ignored the first two points because I don't think they're that important.
These "warrantless searches" are emergency orders that have to be followed
by a court order in 48 hours.  Sometimes courts are closed and the cops need
data right away.  Tuesday evening would be a good example.  This is not some
out-of-control police authority.

The people who can ask for emergency orders have to be designated by one of
several officials at Main Justice.  That's to make sure someone responsible
ends up with the authority to declare an emergency.  So an assistant US
attorney could be designated by Main Justice in each district right now.
What's the big deal with letting the US Attorney for the district do the
designating instead of Main Justice? Seems to me that the US Attorney
probably knows more about staff changeovers than Main Justice, so it makes
sense for the US Attorney to do the designating locally.

Stewart

**********

From: Declan McCullagh <declan () well com>
Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn 
ivore us e
Cc: "Albertazzie, Sally" <SAlbertazzie () steptoe com>
To: "Baker, Stewart" <SBaker () steptoe com>, farber () cis upenn edu, 
ip-sub-1 () majordomo pobox com
Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn 
ivore us e
Cc: "Albertazzie, Sally" <SAlbertazzie () steptoe com>

Stu,

Maybe you're right. Maybe this expansion of warrantless surveillance powers 
is unobjectionable. Maybe the FBI and the state law enforcement agencies 
that will be able to legally use Carnivore without a court order in some 
circumstances will prove entirely trustworthy. Maybe they truly do need 
this power in emergencies. Maybe it'll even stop some terrorists. Maybe 
you're correct to say, "What's the big deal?"

But let's have that discussion in public, during daylight hours, in a 
hearing room where reasoned conversation can take place. Let's ask the FBI 
director and the attorney general to testify, and let's invite 
representatives from groups like the ACLU, CDT and EPIC to join them. Let's 
allow senators to ask the bill's sponsors tough questions about what this 
oddly-written legislation really does. And let's give them as much time as 
they need to answer.

What we shouldn't do is rush substantial rewrites of wiretapping law 
through the Senate in the middle of the night, just two days after the 
worst terrorist attack ever, when the country is in the throes of a 
national emergency. What we shouldn't do is have the legislation's sponsors 
-- and I don't doubt that they have the best of intentions -- hand it to 
their fellow senators just 30 minutes or so before a vote, which is what 
reportedly happened Thursday night.

Stu, you've worked both in the government and in the private sector. You've 
studied wiretap law more closely than nearly anyone else. You know how it 
works. But would most senators know offhand what expanding wiretapping to 
include "any criminal violation of sections 2332, 2332a, 2332b, 2332d, 
2339A, or 2339B" means?

This is what Senator Patrick Leahy of Vermont, the chairman of the 
Judiciary committee and a former prosecutor, said during the floor debate: 
"Do we really show respect to the American people by slapping something 
together, something that nobody on the floor can explain, and say we are 
changing the duties of the Attorney General, the Director of the CIA, the 
U.S. attorneys, we are going to change your rights as Americans, your 
rights to privacy? We are going to do it with no hearings, no debate. We 
are going to do it with numbers on a page that nobody can understand."

Senator Carl Levin of Michigan said he had no time to read what he was 
being asked to vote on, adding that he had been told the bill was merely an 
anti-terrorism measure but it seemed to do far more: "I am trying to 
understand what is in it since it came to me for the first time tonight. I 
want to be very clear, at least the way I read this, that this is not 
something that is just limited to counterterrorism, about which I think all 
of us would have a passion."

The spending bill to which the wiretap legislation ("Combating Terrorism 
Act of 2001") was attached will have to go to conference committee and 
then, probably, both chambers of Congress for another vote. That process 
means the bill won't become law for weeks at best. During that time, 
Congress could have held at least one hearing on the bill; in fact, Leahy 
said he would have done so immediately. If the bill is so vital to our 
national security, couldn't it survive a straight up-or-down floor vote, 
rather than be attached to a massive must-pass appropriations bill for the 
Justice, Commerce, and State departments?

As a side note, even if you believe the language to be unobjectionable, 
Senate Judiciary committee aides told me they believe the wording of the 
bill -- apparently hastily-drafted, complete with typos -- may cover the 
content of communications, not just origin-desination information. If 
they're not sure, and they had a full day to read it by the time I spoke 
with them Friday, how can you be so positive your interpretation is 
correct? Even if you're right, doesn't it make sense to double-check?

During the next few months and years, we may see calls for restricting the 
freedoms Americans have enjoyed as a way to respond to and thwart 
terrorists. Many of these new laws and regulations are unobjectionable; I 
don't mind tighter temporary security around government buildings and 
airports. But others are more deserving of enlightened discussion and 
debate. Let's hope that happens, not in the darkness of midnight votes, but 
in public in the light of day.

-Declan

**********




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
Declan McCullagh's photographs are at http://www.mccullagh.org/
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------