Court hands at least temporary rebuke to NSA for domestic spying

nsa

NSA (Photo credit: shawnblog)

The New York Times has been highlighting the federal government defeat in the first lawsuit over NSA surveillance of U.S. telephone and internet activity outside the FISA court jurisdiction. The decision in Klayman v. Obama represents a strong rebuke to the NSA. Written in a tone of outrage, the district court decision emphasizes the profound differences that exist in the current NSA surveillance program from the historical precedents upon which the claim of constitutionality is based.

In Smith v. Maryland, 442 U.S. 745 (1979), the Supreme Court held that the use of a “pen register” was not a violation of the Fourth Amendment because the information sent to the telephone company was a business record provided without a reasonable expectation of privacy.[1] The pen register records only the numbers dialed on a telephone. Any expectation of privacy that could exist in the telephone numbers a person dialed was unreasonable.

From the diminutive pen register acorn, a mighty oak has grown to obliterate the sunlight that once shined light on government activities. That oak is the pervasive surveillance program:

[T]he almost–Orwellian technology that enables the Government to store and analyze the phone metadata of every telephone user in the United States is unlike anything that could have been conceived in 1979. … The notion that the Government could collect similar data on hundreds of millions of people and retain that data for a five-year period, updating it with new data every day in perpetuity, was at best, in 1979, the stuff of science fiction. By comparison, the Government has at its disposal today the most advanced twenty-first century tools, allowing it to “store such records and efficiently mine them for information years into the future. … Records that once would have revealed a few scattered tiles of information about a person now reveal an entire vibrant and constantly updating picture of the person’s life.”

Critics of the district court opinion point to the precedent of Smith to suggest that the decision reflects an activist agenda, but proper case analysis requires a judge to look to the facts of a case rather than a simplistic summary of the rule. Factually, the public expects far more privacy in the metadata disclosed on their computers, phones, tablets, and mobile devices than the 1979 consumer expected from the telephone company.

In addition, as the court highlighted, the relationship between the telecommunications companies and the government could be viewed as making the telco’s agents of law enforcement. As agents of the police, the third party doctrine no longer applies.

More importantly, the scale of the surveillance and the mosaic of coverage creates a vastly different experience than that previously adjudicated in Smith or the other decision before the Supreme Court.

In United States v. Jones, 132 S. Ct. 945 (2012), the Supreme Court started to review the potential for wide-scale extensive surveillance. The majority decision demurred on the question, finding a search occurred using common law trespass analogies. But five justices opined that the mosaic of surveillance has a constitutional consequence that will need to be addressed.

Dan Solove has written on both the Klayman decision and the importance of privacy in metadata. His conclusion:

 Smith, and many other Fourth Amendment cases, need to be rethought in light of modern technology where surveillance can be so systematic and pervasive. There is a real difference between being able to engage in a small discrete amount of surveillance and having such broad and sweeping surveillance powers as the NSA is exercising. The challenge is where to draw the lines. This problem exists mainly because Smith still remains viable and must be dealt with. I think it’s time for Smith to be overturned, and so there wouldn’t be such line-drawing challenges.

The Katz approach to expectation of privacy may not be the most useful tool for assessing the scope of pervasive privacy. Despite the coverage of the NSA, I expect that few members of the public can truly comprehend the extent to which the movement of every communication, every Internet-connected device, all information on those devices, the tracking of other objects that are reported to central databases, and photographs and video taken by anyone can be integrated into a pervasive picture of movement. Is this science fiction? Or is it the goal of the NSA five-year strategic plan. Unless the courts or Congress begin to say no to a mosaic of unrelenting surveillance, this plan will be enacted soon. With taxpayer dollars. And without oversight.

The decision is being appealed.


[1] Smith explains the constitutional privacy framework: The Fourth Amendment guarantees “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” In determining whether a particular form of government-initiated electronic surveillance is a “search” within the meaning of the Fourth Amendment, our lodestar is Katz v. United States, 389 U.S. 347 (1967). In Katz, Government agents had intercepted the contents of a telephone conversation by attaching an electronic listening device to the outside of a public phone booth. The Court rejected the argument that a “search” can occur only when there has been a “physical intrusion” into a “constitutionally protected area,” noting that the Fourth Amendment “protects people, not places.” Because the Government’s monitoring of Katz’ conversation “violated the privacy upon which he justifiably relied while using the telephone booth,” the Court held that it “constituted a `search and seizure’ within the meaning of the Fourth Amendment.”

2013 NKU Security Symposium tomorrow, Friday, October 18, 2013

The NKU Chase Law + Informatics Institute, the Center for Applied Informatics, and our event sponsors look forward to the 2013 NKU Security Symposium tomorrow, Friday, October 18, 2013.

The program is free, but you must register. This is your last opportunity.

The Legal Issues in Privacy and Security (Legal Track) will be in Development B of the NKU METS Center in Erlanger, KY.

Legal Track Speakers:

  • John C. (Jack) Greiner, attorney, Graydon Head

  • Scot Ganow, attorney, Faruki Ireland & Cox P.L.L.

  • Jennifer Orr Mitchell, partner, Dinsmore & Shohl LLP

  • Michael G. Carr, JD, CISSP, CIPP, Chief Information Security Officer, University of Kentucky

Click here for the CLE Materials for the maximum of 4.0 general CLE credits approved by KY, OH & IN (new lawyer credits in IN).

  • Jon M. Garon, NKU Chase College of Law

Data Security: Breach Notification Law Issues [pdf]

  • Jennifer Orr Mitchell, Dinsmore & Shohl LLP

Attorneys and Other Contractors – HIPAA Business Associates in 2014 and Beyond [pdf]

For your convenience we have included directions below.

A detailed agenda can be found on the event website at http://cai.nku.edu/security2013/agenda.html

Directions to the NKU METS Center
From Downtown Cincinnati and Northern Kentucky:
I-71/75 South From the South: I-71/75 North … to I-275 West. Take first exit (Exit No. 2 – Mineola Pike). Left turn onto Mineola Pike crossing over I-275. Right turn at second light onto Olympic Blvd. Follow Olympic Blvd. into CIRCLEPORT Business Park past hotels to The METS Center. Parking is FREE in The METS Center’s large lot.

From Indiana:
I-74 to I-275 South into Kentucky. Stay on I-275, which curves East in Kentucky and go about 22 miles all the way past the Greater Cincinnati Airport until you get to Exit No. 2 – Mineola Pike. Right turn onto Mineola Pike. Then right turn at second light onto Olympic Blvd. Follow Olympic Blvd. into CIRCLEPORT Business Park past hotels to The METS Center. Parking is FREE in The METS Center’s large lot.

Special thanks to the sponsors of the legal track:  CincyIP and Frost Brown Todd. 

Wireless Taps lead those actually reported by US Courts

Public disclosures regarding the otherwise secret wiretaps under the Foreign Intelligence Surveillance Act have been the focus of news reports, criminal investigations, and international intrigue in recent weeks. But the Administrative Office of the US Courts annually report the other wiretaps ordered by the federal and state  judiciary.

According to the report, “in calendar year 2012, a total of 3,395 orders authorizing the interception of wire, oral, or electronic communications, or wiretaps, were approved by state and federal judges,” according to the report. Only three percent of the wiretaps involved wires.

For the 2012 reporting period, January 1, 2012 to December 31, 2012, 97 percent of all wiretaps were authorized for “portable devices,” a category that includes cellular telephones and digital pagers. In addition, 87 percent of all 2012 applications for intercepts cited illegal drugs as the most serious offense under investigation.  As of December 31, 2012, a total of 3,743 persons had been arrested and 455 persons had been convicted as a result of interceptions reported as terminated.

The Administrative Office of the Courts points out that it is not authorized – or permitted – to include FISA-approved wiretaps. Equally importantly, the report also reminds the public that non-content data does not need a warrant. Instead pen register data about the nature of the call and the connection to the call requires a much lower legal standard to collect the data. It merely needs to be relevant to the investigation.

A Pen Register records telephone numbers called from a particular phone. The Register also records the date, time, and length of calls. Note that this is information that is already gathered for billing purposes by a communications service provider.

A Trap and Trace Order records the telephone numbers of telephones that are used to place calls to a particular phone. (i.e. Makes a log of incoming phone numbers.) Note that information of this sort is not gathered in the ordinary course of business. – Berkman Center

There is no security reason that these orders are not surveyed. In addition, the report points out that no report from a court to the Administrative Office  is necessary if “an order is issued with the consent of one of the principal parties to the communication.”

The use of wiretaps and the proportion of wiretaps in drug investigations to the exclusion of most other crimes should also raise some provocative public policy questions. Regardless of whether the information  being collected should remain private, there is no question that the information about the process and scope of these investigations should be incorporated into public policy development.

DNA Collection on Warrantless Arrests

DNA Collection on Warrantless Arrests: After Maryland v. King the U.S. Deserves neither Liberty nor Safety

Guest blog by Lindsey L. Jaeger, J.D., S.S.B.B.

Is the collection of DNA the same as collecting fingerprints and photographs, a legitimate police booking procedure under the Fourth Amendment? It is now. Yesterday, in a 5:4 decision the Supreme Court held that it is constitutional to collect DNA when officers make routine warrantless arrests supported by probable cause to hold the suspects for a serious offense.

Of course, we all want to live in a safer society. There is no doubt that DNA “may significantly improve the criminal justice system and police investigative practices…” District Attorney’s Office for Third Judicial Dist. v. Osborne, 557 U.S. 52, 55.

The Fourth Amendment provides that “[t]he right of the people to be secure in their persons…against unreasonable searches and seizures, shall not be violated.” The question is whether it is reasonable to make these intrusions. The Court seems satisfied that the Maryland DNA Collection Act meets this standard, because it takes the decision to collect DNA out of the hands of a magistrate or officer and instead requires all arrestees charged with serious crimes to be swabbed, and because the Act serves a number of legitimate governmental interests.

However, the Dissent penned by Justice Scalia, focuses on the unconstitutionality of suspicionless searches for the purpose of investigating crimes.  Justice Scalia provided a synopsis of the papers of the Founding Fathers and case history to support his point that “[n]o matter the degree of invasiveness, suspicionless searches are never allowed if their principal end is ordinary crime-solving.” See slip opinion page 36-37. “The Court’s assertion that DNA is being taken, not to solve crimes, but to identify those in the State’s custody, taxes the credibility of the credulous.” Id.at page 33.

All fifty states permit the collection of DNA from felony convicts.  Now, DNA samples are permitted to be taken after an arrest without a warrant. Obviously, an arrest does not equate to a conviction.

The Dissent doesn’t delve too deep into the invasion of privacy that a DNA test represents. Is there anything more personal than our DNA? The Electronic Frontier Foundation wrote in its amicus curiae in support of King:

Our DNA contains our entire genetic makeup – our most private information about who we are, where we come from and who we will be. DNA can be used to identify us in the narrow and proper sense of that word – “who is that?” – but it also tells the world who we are related to, what we look like, and how likely we are to get specific diseases.

Fortunately for Marylanders, the Act requires either consent or arraignment of the arrested individual before DNA can be processed or placed into a database. On its face, the Act also has a few other privacy saving graces, including a requirement that DNA samples be destroyed if there isn’t a conviction, or if the conviction is reversed or vacated and no new trial is permitted, or if the individual is granted an unconditional pardon. And fortunately for the rest of us, the Court’s holding limited the decoding of the DNA samples to identification purposes and any information collected about genetic traits are to be disregarded if discovered.

But do we trust that this is the main purpose of the Act?  Justice Scalia showed that “the entire point of [checking the DNA sample against the FBI’s] DNA database is to check crime scene evidence against the profiles of arrestees and convicts as they come in.”  After all, King was arrested in 2009 for “menacing a group of people with a shotgun”, but convicted of a rape that occurred in 2003 after his DNA matched the crime scene evidence from the John Doe aggressor. If King’s DNA was, in fact, to be used to protect the staff and the other detainees, then they would have rushed to identify King with his DNA as soon as possible, but as the Dissent points out under Maryland law, DNA cannot be processed until arraignment, which in King’s case was three days after his arrest.

So, how do you unring a bell? Can the government be trusted to destroy valuable information when it has significant interests in using it against the individual or in the aggregate against us all? We did just recently enact the Affordable Care Act. Do we have such a short memory that we don’t recall that free populaces once elected known supporters of eugenics? After Maryland v. King, we are just upstream of a “Gattaca”.

Benjamin Franklin once said, “Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety.” The pendulum hasn’t just swung; it has swung off its axis.

So What is Law & Informatics and Why Study it in Law School?

On November 4th the NKU Chase Law & Informatics Institute held our opening reception at the beautiful, new LEED certified Griffin Hall, host to the NKU College of Informatics. Well over one hundred attorneys, business leaders, faculty and students attended, including representatives of NKU and many other Tri-State universities.

Among the presentations made by NKU President, Dr. James Votruba, deans Dennis Honabach (Law) and Kevin Kirby (Informatics) was a short video directed by Informatics undergraduate student Kyle Breitenstein.

You can see the video here:

We are very grateful for the time and effort from everyone who worked on the event and attended the event.

As you watch the short video, I hope you find the answers to the questions of this post. Please let me know.

What is Law & Informatics? Visit YouTube to learn more: http://www.youtube.com/watch?v=Muk5n1aDX0k

Supreme Court to Visit Role of GPS Tracking for Warrantless Searches

In the upcoming Supreme Court docket, one of the most significant decisions will involve the role of judicial oversight in the use of GPS tracking devices. Specifically, in U.S. v. Jones, 131 S. Ct. 3064 (2011) the Court will decide  “[w]hether the government violated respondent’s Fourth Amendment rights by installing the GPS tracking device on his vehicle without a valid warrant and without his consent.”

Defendant Antoine Jones was convicted of conspiracy to sell cocaine based, in part, on the use of a GPS tracking device placed on his car. The police then monitored Jones’ movements for a month. The D.C. Circuit reversed the conviction on the basis of the warrantless GPS tracking.

Jones argued the use of the GPS device violated his “reasonable expectation of privacy,” U.S. v. Katz, 389 U.S. 347, 360–61 (1967) (Harlan, J., concurring). The Katz test focuses on “whether the individual has an expectation of privacy that society is prepared to recognize as reasonable.” The judiciary provides a normative interpretation of society to determine how best to extend the obligation for warrants to situations that arise because of new technologies and new social circumstances.

Here, the Circuit Court was concerned about the 24/7 surveillance afforded to the police through the GPS tracking device. It found the constant surveillance to be different in type than the mere placing of a beeper used to follow a particular vehicle a single time, as was the case in U.S. v. Knotts, 460 U.S. 276 (1983).

Knotts is often quoted for the proposition that “[a] person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another.” Knotts, 460 U.S. at 281. But the DC Circuit rejected the analogy to tracking automobiles in public, instead choosing to analogize to the pervasiveness of an ongoing, permanent surveillance.

Other appellate courts had less concern about the GPS devices.

In U.S. v. Pineda-Moreno, 591 F.3d 1212 (9th Cir. 2010) the Ninth Circuit upheld the use of devices when used on seven different occasions. The case did not address the length of any particular tracking episode, but instead found that the undercarriage of a car was not an area with a protected zone of privacy and neither was the place where the device was affixed – in parking lots, streets, and the defendant’s driveway. The Eighth Circuit has suggested a similar outcome. U.S. v. Marquez, 605 F.3d 604 (8th Cir. 2010).

Similarly, in U.S. v. Garcia, 474 F.3d 994 (7th Cir. 2007), the court found the use of such devices unobjectionable. Judge Posner focused on the challenge of extending the law of Fourth Amendment Privacy by analogy:

If a listening device is attached to a person’s phone, or to the phone line outside the premises on which the phone is located, and phone conversations are recorded, there is a search (and it is irrelevant that there is a trespass in the first case but not the second), and a warrant is required. But if police follow a car around, or observe its route by means of cameras mounted on lampposts or of satellite imaging as in Google Earth, there is no search. Well, but the tracking in this case was by satellite. Instead of transmitting images, the satellite transmitted geophysical coordinates. The only difference is that in the imaging case nothing touches the vehicle, while in the case at hand the tracking device does. But it is a distinction without any practical difference.

U.S. v. Garcia, 474 F.3d at 997. Looking at the conduct rather than the technology, Judge Posner stated “[t]he substitute here is for an activity, namely following a car on a public street, that is unequivocally not a search within the meaning of the amendment.”

This analogy was rejected by the D.C. Circuit. There the opinion emphasized the practical limitations. “Continuous human surveillance for a week would require all the time and expense of several police officers, while comparable photographic surveillance would require a net of video cameras so dense and so widespread as to catch a person’s every movement, plus the manpower to piece the photographs together.” At the same time, however, the court recognized the disappearance of technological barriers to tracking, noting that “the marginal cost of an additional day — or week, or month — of GPS monitoring is effectively zero. Nor, apparently, is the fixed cost of installing a GPS device significant; the Los Angeles Police Department can now affix a GPS device to a passing car simply by launching a GPS-enabled dart.”

The opinions have all avoided the next question – whether similar tracking using satellites and public cameras to pervasively track a vehicle or a person in public constitutes a search.

In November, the oral arguments before the Supreme Court will provide an indication of the direction the Court is leaning. The Court did not grant certiorari for those cases upholding the searches as lawful, but that is not a particularly strong indicator. On the other hand, a decision that this particular technology requires a search warrant merely begs the question for RFID chip readers, tracking data in toll-paying devices, tracking data stored in cell phones, and tracing movement using facial recognition software on cameras installed in public places.

The ironic result of decisions invoking Katz is that the Court does not have the ability to learn what the public’s expectation of privacy is nearly as much as it has the power to inform the public what expectation of privacy it now should have.

Hopefully, the Court will move beyond the discussion of how the GPS device was attached to the car to focus on the question of pervasive tracking of citizens by the police. To analogize from the beeper in Knotts is unhelpful. Instead the Court should – and likely will – return to the first principles of Katz regarding the public’s reasonable expectation of privacy.

Undoubtedly technology will only make it easier to track individuals and record their behavior. The Court’s decision will set the agenda for discussion of privacy policy and inevitably shape the norms for our privacy expectations.