EFF Statement on and Analysis of Digital Telephony Act ------------------------------------------------------ October 8, 1994 Washington, DC - Congress late Friday (10/7) passed and sent to the President the Edwards/Leahy Digital Telephony Legislation (HR 4922/S 2375). The bill places functional design requirements on telecommunications carriers in order to enable law enforcement to continue to conduct electronic surveillance pursuant to a court order, though the bill does not expand law enforcement authority to conduct wiretaps. Moreover, the design requirements do not apply to providers or operators of online services such as the Internet, BBS's, Compuserve, and others. The bill also contains significant new privacy protections, including increased protection for online personal information, and requirements prohibiting the use of pen registers to track the physical location of individuals. Jerry Berman, EFF's Policy Director, said: "Although we remain unconvinced that this legislation is necessary, the bill draws a hard line around the Internet and other online networks. We have carved cyberspace out of this legislation". Berman added, "The fact that the Internet, BBS's, Prodigy, and other online networks are not required to meet the surveillance capability requirements is a significant victory for all users of this important communications medium." Privacy Protections for Online Personal Information Increased ------------------------------------------------------------- The bill adds a higher standard for law enforcement access to online transactional information. For maintenance and billing purposes, most online communications and information systems create detailed records of users' communication activities as well as lists of the information, services, or people that they have accessed or contacted. Under current law, the government can gain access to such transactional records with a mere subpoena, which can be obtained without the intervention of a court. To address this issue, EFF pushed for the addition of stronger protections against indiscriminate access to online transactional records. Under the new protections, law enforcement must convince a court to issue an order based on a showing of "specific and articulable facts" which prove that the information sought would be relevant and material to an ongoing criminal investigation. Berman said: "The new legal protections for transactional information are critical in that they recognize that these records are extremely sensitive and deserve a high degree of protection from casual law enforcement access. With these provisions, we have achieved for all online systems a significantly greater level of protection than exists today for any other form of electronic communication, including the telephone." EFF to Continue to Monitor Implementation ----------------------------------------- Berman added: "There are numerous opportunities under this bill for public oversight and intervention to ensure that privacy is not short-changed. EFF will closely monitor the bill's implementation, and we stand ready to intervene if privacy is threatened." In the first four years, the government is required to reimburse carriers for all costs associated with meeting the design requirements of the bill. After four years, the government is required to reimburse carriers for all costs for enhancements that are not "reasonably achievable", as determined in a proceeding before the FCC. The FCC will determine who bears the costs in terms of the impact on privacy, costs to consumers, national security and public safety, the development of technology, and other factors. If the FCC determines that compliance is not reasonably achievable, the government will either be required to reimburse the carrier or consider it to be in compliance without modification. Berman said: "EFF is committed to making a case before the FCC, at the first possible opportunity, that government reimbursement is an essential back-stop against unnecessary or unwanted surveillance capabilities. If the government pays, it will have an incentive to prioritize, which will further enhance public accountability and protect privacy." EFF Decision to Work on Legislation ----------------------------------- Since 1992 EFF, in conjunction with the Digital Privacy and Security Working Group (a coalition of over 50 computer, communications, and public interest organizations and associations working on communications privacy issues, coordinated by EFF) has been successful at stopping a series of FBI Digital Telephony proposals, which would have forced communications companies to install wiretap capability into every communications medium. However, earlier this year, Senator Leahy and Rep. Edwards, who have helped to quash previous FBI proposals, concluded that passage of such a bill this year was inevitable. Leahy and Edwards stepped in to draft a narrow bill with strong privacy protections, and asked for EFF's help in the process. "By engaging in this process for the last several months," Berman noted, "we have been successful in helping to craft a proposal that is significantly improved over the FBI's original bill in terms of privacy, technology policy, and civil liberties, and have, in the process, added significant new privacy protections for users of communications networks. We commend Representative Edwards, Senator Leahy, and Representatives Boucher and Markey for standing up for civil liberties and pushing for strong privacy protections." The Electronic Frontier Foundation (EFF) is a non-profit public interest organization dedicated to achieving the democratic potential of new communications technology and works to protect civil liberties in new digital environments. Other Privacy Protections Added by the Bill ------------------------------------------- The bill also adds the following new privacy protections * The standard for law enforcement access to online transactional records is raised to require a court order instead of a mere subpoena. * No expansion of law enforcement authority to conduct electronic surveillance. * The bill recognizes a citizen's right to use encryption. * All authorized surveillance must be conducted with the affirmative intervention of the telecommunications carrier. Monitoring triggered remotely by law enforcement is prohibited. * Privacy advocates will be able to track law enforcement requests for surveillance capability, and expenditures for all surveillance capability and capacity added under this bill will be open to public scrutiny. * Privacy protections must be maintained in making new technologies conform to the requirements of the bill, and privacy advocates may intervene in the administrative standard setting process. * Information gleaned from pen register devices is limited to dialed number information only. Law enforcement may not receive location information. Analysis of and comments on major provisions of the bill -------------------------------------------------------- A. Key new privacy protections 1. Expanded protection for transactional records sought by law enforcement Senator Leahy and Rep. Edwards have agreed that law enforcement access to transactional records in online communication systems (everything from the Internet to AOL to hobbyist BBSs) threatens privacy rights because the records are personally identifiable, because they reveal the content of people's communications, and because the compilation of such records makes it easy for law enforcement to create a detailed picture of people's lives online. Based on this recognition, the draft bill contains the following provisions: i. Court order required for access to transactional records instead of mere subpoena In order to gain access to transactional records, such as a list of to whom a subject sent email, which online discussion group one subscribes to, or which movies you request on a pay-per view channel, law enforcement will have to prove to a court, by the showing of "specific and articulable facts" that the records requested are relevant to an ongoing criminal investigation. This means that the government may not request volumes of transactional records merely to see what it can find through traffic analysis. Rather, law enforcement will have to prove to a court that it has reason to believe that it will find some specific information that is relevant to an ongoing criminal investigation in the records that it requests. With these provisions, we have achieved for all online systems, a significantly greater level of protection than currently exists for telephone toll records. The lists of telephone calls that are kept by local and long distance phone companies are available to law enforcement without any judicial intervention at all. Law enforcement gains access to hundreds of thousands of such telephone records each year, without a warrant and without even notice to the citizens involved. Court order protection will make it much more difficult for law enforcement to go on "fishing expeditions" through online transactional records, hoping to find evidence of a crime by accident. ii. Standard of proof much greater than for telephone toll records, but below that for content The most important change that these new provisions offer, is that law enforcement will (a) have to convince a judge that there is reason to look at a particular set of records, and (b) have to expend the time and energy necessary to have a US Attorney or DA actually present a case before a court. However, the burden or proof to be met by the government in such a proceeding is lower than required for access to the content of a communication. 2. New protection for location-specific information available in cellular, PCS and other advanced networks Much of the electronic surveillance conducted by law enforcement today involves gathering telephone dialing information through a device known as a pen register. Authority to attach pen registers is obtained merely by asserting that the information would be relevant to a criminal investigation. Courts have no authority to deny pen register requests. This legislation offers significant new limits on the use of pen register data. Under this bill, when law enforcement seeks pen register information from a carrier, the carrier is forbidden to deliver to law enforcement any information which would disclose the location or movement of the calling or called party. Cellular phone networks, PCS systems, and so-called "follow-me" services all store location information in their networks. This new limitation is a major safeguard which will prevent law enforcement from casually using mobile and intelligent communications services as nation-wide tracking systems. i. New limitations on "pen register" authority Law enforcement must use "technology reasonably available" to limit pen registers to the collection of calling number information only. Currently, law enforcement is able to capture not only the telephone number dialed, but also any other touch-tone digits dialed which reflect the user's interaction with an automated information service on the other end of the line, such as an automatic banking system or a voice-mail password. 3. Bill does not preclude use of encryption Unlike previous Digital Telephony proposals, this bill places no obligation on telecommunication carriers to decipher encrypted messages, unless the carrier actually holds the key. The bill in no way prohibits citizens from using encryption. 4. Automated remote monitoring precluded Law enforcement is specifically precluded from having automated, remote surveillance capability. Any electronic surveillance must be initiated by an employee of the telecommunications carrier. 5. Privacy considerations essential to development of new technology One of the requirements that telecommunications carriers must meet to be in compliance with the Act is that the wiretap access methods adopted must protect the privacy and security of each user's communication. If this requirement is not met, anyone may petition the FCC to have the wiretap access service be modified so that network security is maintained. So, the technology used to conduct wiretaps cannot also jeopardize the security of the network as a whole. If network-wide security problems arise because of wiretapping standards, then the standards can be overturned. 6. Increased Public Accountability All law enforcement requests for surveillance capability and capacity, as well as all expenditures paid by law enforcement to telecommunications carriers and all modifications made by carriers to comply with this bill, will be accountable to the public. The government is also required to pay for all upgrades, in both capability and capacity, in the first four years, and all costs after four years for incorporating the capability requirements in the costs for meeting those requirements are not 'reasonably achievable'. A determination of whether compliance after four years is reasonably achievable will be made by the FCC in an open and public proceeding. Government reimbursement for compliance costs will permit the public the opportunity to decide whether additional surveillance capability is necessary. In all, the reimbursement requirements combined with the reporting requirements and the open processes built in to this bill, law enforcement surveillance capability, capacity, and expenditures will be more accountable to the public than ever before. B. Draconian provisions softened In addition, the surveillance requirements imposed by the bill are not as far-reaching as the original FBI version. A number of procedural safeguards are added which seek to minimize the threatens to privacy, security, and innovation. Though the underlying premise of the Act is still cause for concern, these new limitations deserve attention: 1. Narrow Scope The bill explicitly excludes Internet providers, email systems, BBSs, and other online services. Unlike the bills previously proposed by the FBI, this bill is limited to local and long distance telephone companies, cellular and PCS providers, and other common carriers. 2. Open process with public right of intervention The public will have access to information about the implementation of the Act, including open access to all standards adopted in compliance with the Act, the details of how much wiretap capacity the government demands, and a detailed accounting of all federal money paid to carriers for modifications to their networks. Privacy groups, industry interests, and anyone else has a statutory right under this bill to challenge implementation steps taken by law enforcement if they threaten privacy or impede technology advancement. 3. Technical requirements standards developed by industry instead of the Attorney General All surveillance requirements are to be implemented according to standards developed by industry groups. The government is specifically precluded from forcing any particular technical standard, and all requirements are qualified by notions of economic and technical reasonableness. 4. Right to deploy untappable services Unlike the original FBI proposal, this bill recognizes that there may be services which are untappable, even with Herculean effort to accommodate surveillance needs. In provisions that still require some strengthening, the bill allows untappable services to be deployed if redesign is not economically or technically feasible. Background Information ---------------------- * The Bill: ftp.eff.org, /pub/EFF/Policy/Digital_Telephony/digtel94.bill gopher.eff.org, 1/EFF/Policy/Digital_Telephony, digtel94.bill http.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94.bill All other files available from ftp.eff.org, /pub/EFF/Policy/Digital_Telephony/Old/ gopher.eff.org, 1/EFF/Policy/Digital_Telephony/Old http.eff.org/pub/EFF/Policy/Digital_Telephony/Old/ * EFF Analysis of Bill as Introduced: digtel94_analysis.eff * EFF Statement on Earlier 1994 Draft of Bill: digtel94_old_statement.eff * EFF Analysis of Earlier 1994 Draft: digtel94_draft_analysis.eff * EFF Statement on Announcement of 1994 Draft: digtel94.announce * EFF Statement on Announcement of 1993 Draft: digtel93.announce * Late 1993/Early 1994 Draft: digtel94_bill.draft * EFF Statement on 1992 Draft: digtel92_analysis.eff * EFF Statement on 1992 Draft: digtel92_opposition.announce * Late 1992 Draft: digtel92_bill.draft * Original 1992 Draft: digtel92_old_bill.draft For more information Contact ---------------------------- Jerry Berman Policy Director Jonah Seiger Project Coordinator +1 202 347 5400 (voice) +1 202 393 5509 (fax)