FC: Debate over warrantless Carnivore bill with Stu Baker

From: Declan McCullagh (declanat_private)
Date: Sat Sep 15 2001 - 09:05:11 PDT

  • Next message: Declan McCullagh: "FC: Frank Sudia's proposal: Let's revive encryption key escrow"

    Stewart Baker is the former general counsel to the National Security Agency 
    and now a partner at the Washington law firm of Steptoe and Johnson:
    http://www.steptoe.com/WebBio.nsf/biographies/Stewart+A.+Baker?OpenDocument
    http://www.mccullagh.org/image/10/stewart-baker.html
    
    Below is a few rounds of a debate we had on Dave Farber's IP list in 
    response to my article ("Senate votes to permit warrantless Net-wiretaps, 
    Carnivore use"):
    http://www.wired.com/news/politics/0,1283,46852,00.html
    
    -Declan
    
    **********
    
    >To: "'farberat_private'" <farberat_private>
    >cc: "Albertazzie, Sally" <SAlbertazzieat_private>
    >Subject: RE: Senate votes to permit warrantless Net-wiretaps, Carnivore
    >  us e
    >Date: Fri, 14 Sep 2001 19:28:17 -0400
    >
    >This seems a bit alarmist.  The FBI has long had the authority to get the
    >phone numbers that are called from or that call to a suspect's phone.  These
    >are trap-and-trace and pen-register orders.  The Justice Department has
    >generally taken the position that the Internet equivalent of such data is
    >the addressing information in emails.  This bill would enshrine the Justice
    >Department position in law -- without changing the warrant requirements or
    >the predicate for getting such Internet pen register data.  It's not that
    >big a change from the status quo.  I would guess that, even without the law,
    >Justice would have about a 60-40 or even 70-30 chance of winning its
    >argument in court.
    >
    >In my view there are some reasons to be uneasy about the bill but not
    >frothing.
    >
    >First, the to and from lines on my emails (plus the URLs I visit) are in
    >fact more intimate information than the phone numbers I call.  What's more,
    >I'm already on notice that the phone numbers aren't all that private --
    >they're used to bill me, after all.  Not true for URLs or "to" lines.  Once
    >that data is gathered by the police(on a very easy standard, I agree), it
    >may never be thrown out, and lots of people can access it.  So extending
    >police authority to such data ought to be the occasion for thinking
    >creatively about how to discipline the use of that authority.  If I were
    >writing the bill, I'd let the police gather such data, but I'd do more to
    >audit the people who access it and require prosecutors to notify people
    >after the fact that they've been targeted for surveillance (unless that
    >would blow an ongoing investigation).  As things stand, the only people who
    >find out about such surveillance and thus get a chance to challenge it are
    >criminal defendants.  Isn't that just backwards?  I mean, who came up with a
    >system in which crooks may go free because their privacy was violated while
    >innocent people who've suffered the same violation never have a remedy?
    >
    >Second, most ISPs would like to see an assurance that Carnivore won't be
    >used if they have their own systems that can accomplish the same thing, or
    >that they'll be indemnified for any damage Carnivore might do to the system.
    >
    >In short, we may be missing some opportunities to improve privacy law, but
    >it's hard to say that the privacy sky is falling.
    >
    >Stewart
    
    **********
    
    To: farberat_private, ip-sub-1at_private
    Subject: Re: IP: RE: Senate votes to permit warrantless Net-wiretaps, 
    Carnivore us e
    Cc: SAlbertazzieat_private, SBakerat_private
    
    Dave,
    I'm glad to see Stu joining the civil libertarian crowd. He's right, of 
    course, that there are reasons to be uneasy about the new "Combating 
    Terrorism Act."
    
    Current law permits specific Justice Department officials to authorize 
    meatspace telephone pen register and trap and trace devices without a court 
    order in two circumstances. Here's an excerpt from the U.S. Code:
    
    http://www4.law.cornell.edu/uscode/18/3125.html
    >an emergency situation exists that involves immediate danger of death or 
    >serious bodily injury to any person [or] conspiratorial activities 
    >characteristic of organized crime
    
    This bill does three things of note:
    
    1. It adds "U.S. Attorney" to the list of officials who can authorize 
    warantless surveillance.
    
    2. It expands the "emergency situation" rule beyond serious bodily 
    injury/organized crime. I described this in my article:
    http://www.wired.com/news/politics/0,1283,46852,00.html
    >Circumstances that don't require court orders include an "immediate threat 
    >to the national security interests of the United States, (an) immediate 
    >threat to public health or safety or an attack on the integrity or 
    >availability of a protected computer." That covers most computer hacking 
    >offenses.
    
    3. It rewrites pen register/trap and trace law and moves it from the 
    telephone world to explicitly cover computer networks as well, which would 
    permit Carnivore's use under this section (when operated in 
    trap-and-trace/pen-register mode). Here are some excerpts from the bill:
    
    http://www.politechbot.com/docs/cta.091401.html
    >The order shall, upon service of the order, apply to any entity providing 
    >wire or electronic communication service in the United States... inserting 
    >``, routing, addressing,'' after ``dialing''... by striking ``call 
    >processing'' and inserting ``the processing and transmitting of wire and 
    >electronic communications''...
    
    Now, whether all this is, as Stu blandly suggests, "a bit alarmist," is up 
    to IPers to decide. But I think Senator Patrick Leahy, the chairman of the 
    Senate Judiciary committee, put it well during the floor debate last night. 
    Here's a quote from the Congressional Record.
    
    http://www.fas.org/sgp/congress/2001/s091301.html
    >LEAHY: Maybe the Senate wants to just go ahead and adopt new abilities to 
    >wiretap our citizens. Maybe they want to adopt new abilities to go into 
    >people's computers. Maybe that will make us feel safer. Maybe. And maybe 
    >what the terrorists have done made us a little bit less safe. Maybe they 
    >have increased Big Brother in this country.
    
    -Declan
    
    **********
    
    From: "Baker, Stewart" <SBakerat_private>
    To: "'Declan McCullagh'" <declanat_private>, farberat_private,
             ip-sub-1at_private
    cc: "Albertazzie, Sally" <SAlbertazzieat_private>,
             "Baker, Stewart" <SBakerat_private>
    Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps,
      Carn ivore us e
    Date: Fri, 14 Sep 2001 20:13:31 -0400
    
    Declan,
    
    I ignored the first two points because I don't think they're that important.
    These "warrantless searches" are emergency orders that have to be followed
    by a court order in 48 hours.  Sometimes courts are closed and the cops need
    data right away.  Tuesday evening would be a good example.  This is not some
    out-of-control police authority.
    
    The people who can ask for emergency orders have to be designated by one of
    several officials at Main Justice.  That's to make sure someone responsible
    ends up with the authority to declare an emergency.  So an assistant US
    attorney could be designated by Main Justice in each district right now.
    What's the big deal with letting the US Attorney for the district do the
    designating instead of Main Justice? Seems to me that the US Attorney
    probably knows more about staff changeovers than Main Justice, so it makes
    sense for the US Attorney to do the designating locally.
    
    Stewart
    
    **********
    
    From: Declan McCullagh <declanat_private>
    Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn 
    ivore us e
    Cc: "Albertazzie, Sally" <SAlbertazzieat_private>
    To: "Baker, Stewart" <SBakerat_private>, farberat_private, 
    ip-sub-1at_private
    Subject: RE: IP: RE: Senate votes to permit warrantless Net-wiretaps, Carn 
    ivore us e
    Cc: "Albertazzie, Sally" <SAlbertazzieat_private>
    
    Stu,
    
    Maybe you're right. Maybe this expansion of warrantless surveillance powers 
    is unobjectionable. Maybe the FBI and the state law enforcement agencies 
    that will be able to legally use Carnivore without a court order in some 
    circumstances will prove entirely trustworthy. Maybe they truly do need 
    this power in emergencies. Maybe it'll even stop some terrorists. Maybe 
    you're correct to say, "What's the big deal?"
    
    But let's have that discussion in public, during daylight hours, in a 
    hearing room where reasoned conversation can take place. Let's ask the FBI 
    director and the attorney general to testify, and let's invite 
    representatives from groups like the ACLU, CDT and EPIC to join them. Let's 
    allow senators to ask the bill's sponsors tough questions about what this 
    oddly-written legislation really does. And let's give them as much time as 
    they need to answer.
    
    What we shouldn't do is rush substantial rewrites of wiretapping law 
    through the Senate in the middle of the night, just two days after the 
    worst terrorist attack ever, when the country is in the throes of a 
    national emergency. What we shouldn't do is have the legislation's sponsors 
    -- and I don't doubt that they have the best of intentions -- hand it to 
    their fellow senators just 30 minutes or so before a vote, which is what 
    reportedly happened Thursday night.
    
    Stu, you've worked both in the government and in the private sector. You've 
    studied wiretap law more closely than nearly anyone else. You know how it 
    works. But would most senators know offhand what expanding wiretapping to 
    include "any criminal violation of sections 2332, 2332a, 2332b, 2332d, 
    2339A, or 2339B" means?
    
    This is what Senator Patrick Leahy of Vermont, the chairman of the 
    Judiciary committee and a former prosecutor, said during the floor debate: 
    "Do we really show respect to the American people by slapping something 
    together, something that nobody on the floor can explain, and say we are 
    changing the duties of the Attorney General, the Director of the CIA, the 
    U.S. attorneys, we are going to change your rights as Americans, your 
    rights to privacy? We are going to do it with no hearings, no debate. We 
    are going to do it with numbers on a page that nobody can understand."
    
    Senator Carl Levin of Michigan said he had no time to read what he was 
    being asked to vote on, adding that he had been told the bill was merely an 
    anti-terrorism measure but it seemed to do far more: "I am trying to 
    understand what is in it since it came to me for the first time tonight. I 
    want to be very clear, at least the way I read this, that this is not 
    something that is just limited to counterterrorism, about which I think all 
    of us would have a passion."
    
    The spending bill to which the wiretap legislation ("Combating Terrorism 
    Act of 2001") was attached will have to go to conference committee and 
    then, probably, both chambers of Congress for another vote. That process 
    means the bill won't become law for weeks at best. During that time, 
    Congress could have held at least one hearing on the bill; in fact, Leahy 
    said he would have done so immediately. If the bill is so vital to our 
    national security, couldn't it survive a straight up-or-down floor vote, 
    rather than be attached to a massive must-pass appropriations bill for the 
    Justice, Commerce, and State departments?
    
    As a side note, even if you believe the language to be unobjectionable, 
    Senate Judiciary committee aides told me they believe the wording of the 
    bill -- apparently hastily-drafted, complete with typos -- may cover the 
    content of communications, not just origin-desination information. If 
    they're not sure, and they had a full day to read it by the time I spoke 
    with them Friday, how can you be so positive your interpretation is 
    correct? Even if you're right, doesn't it make sense to double-check?
    
    During the next few months and years, we may see calls for restricting the 
    freedoms Americans have enjoyed as a way to respond to and thwart 
    terrorists. Many of these new laws and regulations are unobjectionable; I 
    don't mind tighter temporary security around government buildings and 
    airports. But others are more deserving of enlightened discussion and 
    debate. Let's hope that happens, not in the darkness of midnight votes, but 
    in public in the light of day.
    
    -Declan
    
    **********
    
    
    
    
    -------------------------------------------------------------------------
    POLITECH -- Declan McCullagh's politics and technology mailing list
    You may redistribute this message freely if you include this notice.
    Declan McCullagh's photographs are at http://www.mccullagh.org/
    To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
    This message is archived at http://www.politechbot.com/
    -------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Sat Sep 15 2001 - 09:28:48 PDT