THE GEORGE WASHINGTON UNIERSITY LAW SCHOOL PUBLIC LAW AND LEGAL THEORY WORKING PAPER NO 043 INTERNET SURVEILLANCE LAW AFTER THE USA PATRIOT ACT THE BIG BROTHER THAT ISNT Orin s. Kerr This paper can be downloaded without charge from the Social Science Research Network Electronic Paper Collection http://ssrn.com/abstract=317501
THE GEORGE WASHINGTONWASHINGTON UNIVERSITYUNIVERSITY LAW SCHOOL PUBLIC LAW AND LEGAL THEORY WORKING PAPER NO. 043 THE BIG BROTHER THAT ISN’T Orin S. Kerr This paper can be downloaded without charge from the Social Science Research Network Electronic Paper Collection: http://ssrn.com/abstract=317501 INTERNET SURVEILLANCE LAW AFTER THE USA PATRIOT ACT:
night 2003 by Northwestem University School of Law INTERNET SURVEILLANCE LAW AFTER THE USA PATRIOT ACT: THE BIG BROTHER THAT ISNT Orin S. Kerr INTRODUCTION Following the September 1 l terrorist attacks on New York and Wash ington, Congress rushed into action and quickly passed antiterrorism legis lation known as the USA Patriot Act. The Patriot Act has been widely understood as a"sweeping" antiterrorism law that gave the government vast new powers to conduct electronic surveillance over the Internet The Act's surveillance provisions proved so controversial that Congress added a sunset provision that will nullify several of its key provisions after four years, on December 31, 2005. To many legislators, the vast law en- Associate Professor, George Washington University Law School. From the fall of 1998 until the summer of 2001. I was a in the Computer Crime and Intellectual Property Section of DOj's isted before the Patriot Act ence at DOJ included working with the Internet surveillance laws that e> hat influenced portions of what later became the Patriot Act I hope that my familiarity with these laws from my time in government will shed light that outshines the ccasionally myopic effect of personal experience. All of the views expressed in this Article are solely own and do not reflect the positions of the Department of Justice. Thanks to Peter Swire, Steve altzburg, Beryl Howell, Jeffrey Rosen, Dan Solove, Lee Tien, Peter Raven-Hansen, Cynthia Lee, Jon Molot, and Mark Eckenwiler for commenting on earlier drafts. All errors remain my own See Uniting and Strengthening America by Providing Appropriate To Obstruct Terrorism Act (USA Patriot Act)of 2001, Pub. L. No. 107-56, 115 Stat. 272. The formal title is the"Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism(USA Patriot Act) Act of 2001, Id. The awkward name of the USA Patriot Act rives from its legislative history: the Act combines elements of two antiterrorism bills, the Senate's USA Act, Senate Bill 1510, and the House of Representative's Patriot Act, House Bill 2975. The Senate approved the "Uniting and Strengthening America Act "(or"USA"Act) by a vote of 96 to l on October 1, 2001. The House approved the "Provide Appropriate Tools Required to Intercept and obstruct Te orism Act"(or"Patriot "Act), by a vote of 337 to 79 on October 12, 2001. The final bill started with the basic framework of the Senate bill and then added many of the components of the House bill to cre- ate a compromise bill that combined both titles to create the USA Patriot bill. The USA Patriot bill was approved by the House on October 24th by a vote of 356 to 66, passed the Senate on October 25th,a vote of 98 to 1, and was signed by President Bush on October 26th. For simplicity's sake, I will refer t the final enacted law as the "USA Patriot Act, "the Patriot Act, or simply"the Act. 2 Jesse J. Holland, New Powers To Fight New Threat: Bush Vows Stiff Enforcement of Anti Terrorism Las. SEATTLE TIMES. Oct 26. 2001. at Al See Uniting and Strengthening America by Providing Appropriate Tools Required To Intercept and Obstruct Terrorism (USA Patriot Act) Act of 2001, Pub. L No 107-56,$ 224, 115 Stat. 272, 295 607
Copyright 2003 by Northwestern University School of Law Printed in U.S.A. Northwestern University Law Review Vol. 97, No. 2 607 INTERNET SURVEILLANCE LAW AFTER THE USA PATRIOT ACT: THE BIG BROTHER THAT ISN’T Orin S. Kerr∗ INTRODUCTION Following the September 11 terrorist attacks on New York and Washington, Congress rushed into action and quickly passed antiterrorism legislation known as the USA Patriot Act.1 The Patriot Act has been widely understood as a “sweeping”2 antiterrorism law that gave the government “vast new powers”3 to conduct electronic surveillance over the Internet. The Act’s surveillance provisions proved so controversial that Congress added a sunset provision that will nullify several of its key provisions after four years, on December 31, 2005.4 To many legislators, the vast law en- ∗ Associate Professor, George Washington University Law School. From the fall of 1998 until the summer of 2001, I was a lawyer in the Computer Crime and Intellectual Property Section of DOJ’s Criminal Division. My experience at DOJ included working with the Internet surveillance laws that existed before the Patriot Act. I also commented on and helped draft the legislative proposals to amend those laws, including some proposals that influenced portions of what later became the Patriot Act. I hope that my familiarity with these laws from my time in government will shed light that outshines the occasionally myopic effect of personal experience. All of the views expressed in this Article are solely my own and do not reflect the positions of the Department of Justice. Thanks to Peter Swire, Steve Saltzburg, Beryl Howell, Jeffrey Rosen, Dan Solove, Lee Tien, Peter Raven-Hansen, Cynthia Lee, Jon Molot, and Mark Eckenwiler for commenting on earlier drafts. All errors remain my own. 1 See Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA Patriot Act) of 2001, Pub. L. No. 107-56, 115 Stat. 272. The formal title is the “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA Patriot Act) Act of 2001.” Id. The awkward name of the USA Patriot Act derives from its legislative history: the Act combines elements of two antiterrorism bills, the Senate’s USA Act, Senate Bill 1510, and the House of Representative’s Patriot Act, House Bill 2975. The Senate approved the “Uniting and Strengthening America Act” (or “USA” Act) by a vote of 96 to 1 on October 11, 2001. The House approved the “Provide Appropriate Tools Required to Intercept and Obstruct Terrorism Act” (or “Patriot” Act), by a vote of 337 to 79 on October 12, 2001. The final bill started with the basic framework of the Senate bill and then added many of the components of the House bill to create a compromise bill that combined both titles to create the USA Patriot bill. The USA Patriot bill was approved by the House on October 24th by a vote of 356 to 66, passed the Senate on October 25th, a vote of 98 to 1, and was signed by President Bush on October 26th. For simplicity’s sake, I will refer to the final enacted law as the “USA Patriot Act,” “the Patriot Act,” or simply “the Act.” 2 Jesse J. Holland, New Powers To Fight New Threat; Bush Vows Stiff Enforcement of AntiTerrorism Laws, SEATTLE TIMES, Oct. 26, 2001, at A1. 3 Id. 4 See Uniting and Strengthening America by Providing Appropriate Tools Required To Intercept and Obstruct Terrorism (USA Patriot Act) Act of 2001, Pub. L. No. 107-56, § 224, 115 Stat. 272, 295
NORTHWESTERN UNIVERSITY LAW REVIEW forcement authorities unleashed by the patriot act seemed too dangerous to extend indefinitely The Patriot Act triggered tremendous anxiety in part because few unde stood exactly what it did. At the time of its passage, even many key legisla- tors seemed to have little idea of the laws governing electronic surveillance, both before the Patriot Act and following it. Did the Act go too far? How much privacy did Internet users have, and how much were they giving away? No one seemed to know, and because the legislation rushed through Congress with remarkable speed, little in the way of Committee reports or other legis- lative history existed to help explain it. 8 Most commentators simply assumed the worst: they sensed that Internet users probably had very little privacy on- line before the Patriot Act, and that the Patriot Act bargained away whatever precious drops of privacy they had left This Article argues that the common wisdom on the USa Patriot Act is incorrect. The Patriot Act did not expand law enforcement powers dramati cally, as its critics have alleged. In fact, the Patriot Act made mostly minor amendments to the electronic surveillance laws. Many of the amendments merely codified preexisting law. Some of the changes expanded law en- forcement powers, but others protected privacy and civil liberties. Several of the most controversial amendments may actually increase privacy pro tections, rather than decrease them. Most importantly, none of the changes altered the basic statutory structure of electronic surveillance law created by the Electronic Communications Privacy Act of 1986. 0 While critics of the Patriot Act have rightly insisted that the government should have no more surveillance power than it needs they have failed to see that the Patriot Act generally offers a balanced approach that in some ways protects civil liber ties more than the laws it replaced The Patriot Act is hardly perfect, but it is not the big brother law that many have portrayed it to be (]his title and the amendments made by this title.. shall cease to have effect on December 31 electronic surveillance: it applies to about half of the provisions. See id (explaining the section 2005.). This so-called sunset does not apply to all of the Patriot Act s amendments involvin which the sunset provision does not apply) See Adam Clymer Robin Toner, A Nation Challenged: The House: Vote Approves New Po e201a准2(mhmh House voted on House Bill 2975 on October 12. 2001."all of members of both parties com- plained they had no idea what they were voting on, were fearful that aspects of the... bill went too far-yet voted for it anyway") The Bush Administration introduced its proposed Anti-Terrorism Act on September 19, 2001, just eight days after the attacks. President Bush signed the Patriot Act on October 26, 2001. See Martha Mendoza, New Anti-Terror Lan Brings Consternation, Security: Oficials and Layers Try To Deci- pher Complex Provisions, Federal Guidance Is in Short Supply, L.A. TIMES, Dec 16, 2001, at A4 House Judiciary Committees Report on House 2975. See H.R. REP. No. 107-236(2001), aailable at ftp: //ftp. loc gov /pub/thomas/cp107/hr236pltxt. Pub.L.No.99-508,§§101-l1,100stat.1848,1848-59 608
N O R T H W E S T E R N U N I V E R S I T Y L A W R E V I E W 608 forcement authorities unleashed by the Patriot Act seemed too dangerous to extend indefinitely.5 The Patriot Act triggered tremendous anxiety in part because few understood exactly what it did. At the time of its passage, even many key legislators seemed to have little idea of the laws governing electronic surveillance, both before the Patriot Act and following it.6 Did the Act go too far? How much privacy did Internet users have, and how much were they giving away? No one seemed to know, and because the legislation rushed through Congress with remarkable speed,7 little in the way of Committee reports or other legislative history existed to help explain it.8 Most commentators simply assumed the worst: they sensed that Internet users probably had very little privacy online before the Patriot Act, and that the Patriot Act bargained away whatever precious drops of privacy they had left.9 This Article argues that the common wisdom on the USA Patriot Act is incorrect. The Patriot Act did not expand law enforcement powers dramatically, as its critics have alleged. In fact, the Patriot Act made mostly minor amendments to the electronic surveillance laws. Many of the amendments merely codified preexisting law. Some of the changes expanded law enforcement powers, but others protected privacy and civil liberties. Several of the most controversial amendments may actually increase privacy protections, rather than decrease them. Most importantly, none of the changes altered the basic statutory structure of electronic surveillance law created by the Electronic Communications Privacy Act of 1986.10 While critics of the Patriot Act have rightly insisted that the government should have no more surveillance power than it needs, they have failed to see that the Patriot Act generally offers a balanced approach that in some ways protects civil liberties more than the laws it replaced. The Patriot Act is hardly perfect, but it is not the Big Brother law that many have portrayed it to be. (“[T]his title and the amendments made by this title . . . shall cease to have effect on December 31, 2005.”). This so-called sunset provision does not apply to all of the Patriot Act’s amendments involving electronic surveillance: it applies to about half of the provisions. See id. (explaining the sections to which the sunset provision does not apply). 5 See Adam Clymer & Robin Toner, A Nation Challenged: The House: Vote Approves New Powers for Antiterror Investigators, N.Y. TIMES, Oct. 18, 2001, at B9. 6 See Editorial, Stampeded in the House, WASH. POST, Oct. 16, 2001, at A22 (noting that when the House voted on House Bill 2975 on October 12, 2001, “all manner of members of both parties complained they had no idea what they were voting on, were fearful that aspects of the . . . bill went too far—yet voted for it anyway”). 7 The Bush Administration introduced its proposed Anti-Terrorism Act on September 19, 2001, just eight days after the attacks. President Bush signed the Patriot Act on October 26, 2001. See Martha Mendoza, New Anti-Terror Law Brings Consternation; Security: Officials and Lawyers Try To Decipher Complex Provisions, Federal Guidance Is in Short Supply, L.A. TIMES, Dec. 16, 2001, at A4. 8 The only existing Committee Report is the House Judiciary Committee’s Report on House Bill 2975. See H.R. REP. NO. 107-236 (2001), available at ftp://ftp.loc.gov /pub/thomas/cp107/hr236p1.txt. 9 See infra notes 68–79. 10 Pub. L. No. 99-508, §§ 101–11, 100 Stat. 1848, 1848–59
97607(2003) Internet Surveillance Law After the Usa Patriot Act This Article will explain how and why the conventional wisdom about the Patriot Act misses the mark. It begins by explaining what Internet sur- veillance is and how it works, which provides some guidance for unde standing how Congress has decided to regulate it. It then applies this framework to study three of the major criticisms of the Patriot Act. This pproach unfortunately sacrifices breadth for depth, but it allows us to see ow misconceptions about both the law and technology of the Internet has led to significant misunderstandings about Internet surveillance law and the effect of the USA Patriot Act The argument proceeds in four Parts. Part I explains the basic frame- work of network surveillance law that governs any communications net work. It classifies the types of laws employed to govern the surveillance of communications networks such as the postal system, the telephone, and the Internet using a series of dichotomies. Once a framework has been devel oped, it is then possible to articulate an entire set of surveillance laws for each network and make comparisons across different technologies. This Part also explains how Internet surveillance includes both email and packet- level surveillance, and how laws that govern Internet surveillance must grapple with both levels of surveillance Part II considers the highly controversial pen register amendments the Patriot Act. These amendments apply a privacy law originally designed for the telephone to the Internet. The amendments have been widely criti- cized on the ground that they granted the government sweeping powers to investigate crime involving the Internet. After explaining why Internet sur- veillance is primarily governed by statutory law, rather than the constitu- tional protections of the Fourth Amendment, Part II argues that the criticisms of the pen register amendments are unfounded. The pen register amendments merely reaffirmed preexisting practice, and if anything proba- bly increased privacy protections afforded to Internet communications, rather than decreased them Part Ill studies the Patriot Acts impact on the fBI Internet surveillance tool popularly known as"Carnivore. The Patriot Act has received broad criticism for expanding the use of Carnivore, which itself has been por trayed as a dangerous tool that enables the Fbi to invade privacy online This Part argues that the public understanding of Carnivore has it largely backwards. The analysis explains how surveillance tools such as Carnivore work, and how Carnivore was itself designed to protect privacy and to en- sure compliance with court orders, not invade privacy in an effort to cir- cumvent judicial review. The Part explains that the Patriot Act did not expand the use of Carnivore, but rather added new regulations on its use Part Iv analyzes the new computer trespasser exception to the wire tap Act. The trespasser exception has drawn criticism for weakening th retap Acts privacy protections in cyberspace. The analysis explains ow the Wiretap Act applies to the Internet, and how the application of this law designed for the telephone to the Internet creates the need for a tres- 609
97:607 (2003) Internet Surveillance Law After the USA Patriot Act 609 This Article will explain how and why the conventional wisdom about the Patriot Act misses the mark. It begins by explaining what Internet surveillance is and how it works, which provides some guidance for understanding how Congress has decided to regulate it. It then applies this framework to study three of the major criticisms of the Patriot Act. This approach unfortunately sacrifices breadth for depth, but it allows us to see how misconceptions about both the law and technology of the Internet has led to significant misunderstandings about Internet surveillance law and the effect of the USA Patriot Act. The argument proceeds in four Parts. Part I explains the basic framework of network surveillance law that governs any communications network. It classifies the types of laws employed to govern the surveillance of communications networks such as the postal system, the telephone, and the Internet using a series of dichotomies. Once a framework has been developed, it is then possible to articulate an entire set of surveillance laws for each network and make comparisons across different technologies. This Part also explains how Internet surveillance includes both email and packetlevel surveillance, and how laws that govern Internet surveillance must grapple with both levels of surveillance. Part II considers the highly controversial pen register amendments to the Patriot Act. These amendments apply a privacy law originally designed for the telephone to the Internet. The amendments have been widely criticized on the ground that they granted the government sweeping powers to investigate crime involving the Internet. After explaining why Internet surveillance is primarily governed by statutory law, rather than the constitutional protections of the Fourth Amendment, Part II argues that the criticisms of the pen register amendments are unfounded. The pen register amendments merely reaffirmed preexisting practice, and if anything probably increased privacy protections afforded to Internet communications, rather than decreased them. Part III studies the Patriot Act’s impact on the FBI Internet surveillance tool popularly known as “Carnivore.” The Patriot Act has received broad criticism for expanding the use of Carnivore, which itself has been portrayed as a dangerous tool that enables the FBI to invade privacy online. This Part argues that the public understanding of Carnivore has it largely backwards. The analysis explains how surveillance tools such as Carnivore work, and how Carnivore was itself designed to protect privacy and to ensure compliance with court orders, not invade privacy in an effort to circumvent judicial review. The Part explains that the Patriot Act did not expand the use of Carnivore, but rather added new regulations on its use. Part IV analyzes the new “computer trespasser” exception to the Wiretap Act. The trespasser exception has drawn criticism for weakening the Wiretap Act’s privacy protections in cyberspace. The analysis explains how the Wiretap Act applies to the Internet, and how the application of this law designed for the telephone to the Internet creates the need for a tres-
NORTHWESTERN UNIVERSITY LAW REVIEW asser exception. The Part also explains how the trespasser exception probably expands Internet privacy protections, rather than reduces them, by implicitly minimizing the scope of other exceptions to the wiretap Act tha otherwise could have been read to eviscerate privacy protections online . A GENERAL FRAMEWORK OF NETWORK SURVEILLANCE LAW Communications networks are a defining feature of modern life. I1 Hundreds of millions of Americans use the postal system, the telephone network. and the Internet to communicate with each other. 12 Although these technologies differ from each other in important ways, they share a common function: they are all global communications networks that allow users to send receive and store information Unfortunately, communications networks also provide a stage for the commission of criminal acts. 3 Networks can be used by criminals to con other conspirators, deliver threats, further frauds, or engage in countless tact co- iminal activities 14 When communications networks are used to fur- ther crimes, the network itself becomes a crime scene. Telephone records, stored emails, and undelivered packages can contain important clues for law enforcement. Much like a physical neighborhood, the networks themselves become surveillance zones, complete with criminals seeking to evade detec tion and police trying to catch them The goal of this Part is to offer a taxonomy of network surveillance law. A basic framework is necessary to understand the legal rules that ap ply to the surveillance of communications networks such as the Internet, the postal network, or the telephone network. The framework allows us to ap preciate the relationship between the different types of surveillance that can occur in a network, as well as to compare how the rules differ across differ See generally MANUEL CASTELLS, THE RISE OF THE NETWORK SOCIETY (2000); FRANCES CAIRNCROSS. THE DEATH OF DISTANCE: HOW THE COMMUNICATIONS REVOLUTION WILL CHANGE See CASTELLS, supra note 11, at 6-10 13 See Michael Edmund O Neill, Old Crimes in New Bottles: Sanctioning Cybercrime, 9 GEO MASON L REV. 237, 242-52(2000)(reviewing different types of Internet crimes). For more specific amples of how computer networks can be used to commit crimes, see Gretchen Morgenson, S.E.C. Says Teenager Had After-School Hobby: Online Stock Fraud, N.Y. TIMES, Sept. 21, 2000, at Al(usin computer networks to commit securities fraud): CYBERSTALKING: A NEW CHALLENGE FOR LAW ENFORCEMENT AND INDUSTRY (1999)(use of computer networks to engage in stalking available ar http://www.usdojgov/criminal/cybercrime/cyberstalking.htm(lastmodifiedOct.18,1999) e. g, United States v. Cohen, 260 F3d 68(2d Cir, 2001)(use of the Internet to gamble on events), PHILIP JENKINS, BEYOND TOLERANCE: CHILD PORNOGRAPHY ON THE INTERNET(200 the Internet to collect child pornography) See generally Scott Charney Kent Alexander, Computer Crime, 45 EMORY L.J. 931(1996) 15 See U.S. DEPT OF JUSTICE, SEARCHING AND SEIZING COMPUTERS AND OBTAINING EVIDENCE IN CRIMINAL INVESTIGATIONS, at vil(2001)[hereinafter CCIPS MANUAL]("The dramatic increase in mputer-related crime requires prosecutors and law enforcement agents to understand how to obtain lectronicevidencestoredincomputers"),availableatwww.cybercrimegov/searchmanual.wpd 610
N O R T H W E S T E R N U N I V E R S I T Y L A W R E V I E W 610 passer exception. The Part also explains how the trespasser exception probably expands Internet privacy protections, rather than reduces them, by implicitly minimizing the scope of other exceptions to the Wiretap Act that otherwise could have been read to eviscerate privacy protections online. I. A GENERAL FRAMEWORK OF NETWORK SURVEILLANCE LAW Communications networks are a defining feature of modern life.11 Hundreds of millions of Americans use the postal system, the telephone network, and the Internet to communicate with each other.12 Although these technologies differ from each other in important ways, they share a common function: they are all global communications networks that allow users to send, receive, and store information. Unfortunately, communications networks also provide a stage for the commission of criminal acts.13 Networks can be used by criminals to contact co-conspirators, deliver threats, further frauds, or engage in countless other criminal activities.14 When communications networks are used to further crimes, the network itself becomes a crime scene.15 Telephone records, stored emails, and undelivered packages can contain important clues for law enforcement. Much like a physical neighborhood, the networks themselves become surveillance zones, complete with criminals seeking to evade detection and police trying to catch them. The goal of this Part is to offer a taxonomy of network surveillance law. A basic framework is necessary to understand the legal rules that apply to the surveillance of communications networks such as the Internet, the postal network, or the telephone network. The framework allows us to appreciate the relationship between the different types of surveillance that can occur in a network, as well as to compare how the rules differ across differ- 11 See generally MANUEL CASTELLS, THE RISE OF THE NETWORK SOCIETY (2000); FRANCES CAIRNCROSS, THE DEATH OF DISTANCE: HOW THE COMMUNICATIONS REVOLUTION WILL CHANGE OUR LIVES (1997). 12 See CASTELLS, supra note 11, at 6–10. 13 See Michael Edmund O’Neill, Old Crimes in New Bottles: Sanctioning Cybercrime, 9 GEO. MASON L. REV. 237, 242–52 (2000) (reviewing different types of Internet crimes). For more specific examples of how computer networks can be used to commit crimes, see Gretchen Morgenson, S.E.C. Says Teenager Had After-School Hobby: Online Stock Fraud, N.Y. TIMES, Sept. 21, 2000, at A1 (using computer networks to commit securities fraud); CYBERSTALKING: A NEW CHALLENGE FOR LAW ENFORCEMENT AND INDUSTRY (1999) (use of computer networks to engage in stalking), available at http://www.usdoj.gov/criminal/cybercrime/cyberstalking.htm (last modified Oct. 18, 1999); see also, e.g., United States v. Cohen, 260 F.3d 68 (2d Cir. 2001) (use of the Internet to gamble on sporting events); PHILIP JENKINS, BEYOND TOLERANCE: CHILD PORNOGRAPHY ON THE INTERNET (2001) (use of the Internet to collect child pornography). 14 See generally Scott Charney & Kent Alexander, Computer Crime, 45 EMORY L.J. 931 (1996). 15 See U.S. DEP’T OF JUSTICE, SEARCHING AND SEIZING COMPUTERS AND OBTAINING EVIDENCE IN CRIMINAL INVESTIGATIONS, at vii (2001) [hereinafter CCIPS MANUAL] (“The dramatic increase in computer-related crime requires prosecutors and law enforcement agents to understand how to obtain electronic evidence stored in computers.”), available at www.cybercrime.gov/searchmanual.wpd