Telecom/1996-04-telecom-walnutcreek.iso/legal-fcc/digital.telephony.bill

Internet Message Format | 1994-10-09 | 18KB

Received: from delta.eecs.nwu.edu by MINTAKA.LCS.MIT.EDU id aa17257;
          9 Oct 94 14:29 EDT
Received: by delta.eecs.nwu.edu (4.1/SMI-4.0-proxy)
    id AA11976; Sun, 9 Oct 94 11:05:52 CDT
Return-Path: <telecom>
Received: by delta.eecs.nwu.edu (4.1/SMI-4.0-proxy)
    id AA11967; Sun, 9 Oct 94 11:05:50 CDT
Date: Sun, 9 Oct 94 11:05:50 CDT
From: [e-mail] (TELECOM Digest (Patrick Townson))
Message-Id: <[e-mail]>
To: telecom
Subject: Digital Telephony Act Passes!

I got word over the weekend that the Digital Telephony Act had passed
Congress and is now on its way to President Clinton for his signature.
Here is the special report I received.

PAT

  From: [e-mail] (Stanton McCandlish)
  Subject: EFF Statement on Passage of Digital Telephony Act
  Date: 8 Oct 1994 14:32:28 -0500

EFF Statement on and Analysis of Digital Telephony Act

October 8, 1994


Washington, DC - Congress late Friday (10/7) passed and sent to the
President the Edwards/Leahy Digital Telephony Legislation (HR 4922/S
2375).  The bill places functional design requirements on
telecommunications carriers in order to enable law enforcement to
continue to conduct electronic surveillance pursuant to a court order,
though the bill does not expand law enforcement authority to conduct
wiretaps.  Moreover, the design requirements do not apply to providers
or operators of online services such as the Internet, BBS's,
Compuserve, and others.  The bill also contains significant new
privacy protections, including increased protection for online
personal information, and requirements prohibiting the use of pen
registers to track the physical location of individuals.

Jerry Berman, EFF's Policy Director, said: "Although we remain
unconvinced that this legislation is necessary, the bill draws a hard
line around the Internet and other online networks.  We have carved
cyberspace out of this legislation".

Berman added, "The fact that the Internet, BBS's, Prodigy, and other
online networks are not required to meet the surveillance capability
requirements is a significant victory for all users of this important
communications medium."


Privacy Protections for Online Personal Information Increased

The bill adds a higher standard for law enforcement access to online
transactional information.  For maintenance and billing purposes, most
online communications and information systems create detailed records
of users' communication activities as well as lists of the
information, services, or people that they have accessed or contacted.
Under current law, the government can gain access to such
transactional records with a mere subpoena, which can be obtained
without the intervention of a court.  To address this issue, EFF
pushed for the addition of stronger protections against indiscriminate
access to online transactional records.

Under the new protections, law enforcement must convince a court to
issue an order based on a showing of "specific and articulable facts"
which prove that the information sought would be relevant and material
to an ongoing criminal investigation.

Berman said: "The new legal protections for transactional information
are critical in that they recognize that these records are extremely
sensitive and deserve a high degree of protection from casual law
enforcement access.  With these provisions, we have achieved for all
online systems a significantly greater level of protection than exists
today for any other form of electronic communication, including the
telephone."


EFF to Continue to Monitor Implementation

Berman added: "There are numerous opportunities under this bill for
public oversight and intervention to ensure that privacy is not
short-changed.  EFF will closely monitor the bill's implementation,
and we stand ready to intervene if privacy is threatened."

In the first four years, the government is required to reimburse
carriers for all costs associated with meeting the design requirements
of the bill.  After four years, the government is required to
reimburse carriers for all costs for enhancements that are not
"reasonably achievable", as determined in a proceeding before the FCC.
The FCC will determine who bears the costs in terms of the impact on
privacy, costs to consumers, national security and public safety, the
development of technology, and other factors.  If the FCC determines
that compliance is not reasonably achievable, the government will
either be required to reimburse the carrier or consider it to be in
compliance without modification.

Berman said: "EFF is committed to making a case before the FCC, at the
first possible opportunity, that government reimbursement is an
essential back-stop against unnecessary or unwanted surveillance
capabilities.  If the government pays, it will have an incentive to
prioritize, which will further enhance public accountability and
protect privacy."


EFF Decision to Work on Legislation

Since 1992 EFF, in conjunction with the Digital Privacy and Security
Working Group (a coalition of over 50 computer, communications, and
public interest organizations and associations working on
communications privacy issues, coordinated by EFF) has been successful
at stopping a series of FBI Digital Telephony proposals, which would
have forced communications companies to install wiretap capability
into every communications medium.  However, earlier this year, Senator
Leahy and Rep. Edwards, who have helped to quash previous FBI
proposals, concluded that passage of such a bill this year was
inevitable.  Leahy and Edwards stepped in to draft a narrow bill with
strong privacy protections, and asked for EFF's help in the process.

"By engaging in this process for the last several months," Berman
noted, "we have been successful in helping to craft a proposal that is
significantly improved over the FBI's original bill in terms of
privacy, technology policy, and civil liberties, and have, in the
process, added significant new privacy protections for users of
communications networks.  We commend Representative Edwards, Senator
Leahy, and Representatives Boucher and Markey for standing up for
civil liberties and pushing for strong privacy protections."

The Electronic Frontier Foundation (EFF) is a non-profit public
interest organization dedicated to achieving the democratic potential
of new communications technology and works to protect civil liberties
in new digital environments.


Other Privacy Protections Added by the Bill

The bill also adds the following new privacy protections

*       The standard for law enforcement access to online transactional
        records is raised to require a court order instead of a mere subpoena.

*       No expansion of law enforcement authority to conduct electronic
        surveillance.

*       The bill recognizes a citizen's right to use encryption.

*       All authorized surveillance must be conducted with the affirmative
        intervention of the telecommunications carrier.  Monitoring
        triggered remotely by law enforcement is prohibited.

*       Privacy advocates will be able to track law enforcement requests
        for surveillance capability, and expenditures for all surveillance
        capability and capacity added under this bill will be open to
        public scrutiny.

*       Privacy protections must be maintained in making new technologies
        conform to the requirements of the bill, and privacy advocates may
        intervene in the administrative standard setting process.

*       Information gleaned from pen register devices is limited to dialed
        number information only.  Law enforcement may not receive location
        information.


Analysis of and comments on major provisions of the bill:

A.      Key new privacy protections

1.      Expanded protection for transactional records sought by law
        enforcement

Senator Leahy and Rep. Edwards have agreed that law enforcement access
to transactional records in online communication systems (everything
from the Internet to AOL to hobbyist BBSs) threatens privacy rights
because the records are personally identifiable, because they reveal
the content of people's communications, and because the compilation of
such records makes it easy for law enforcement to create a detailed
picture of people's lives online. Based on this recognition, the draft
bill contains the following provisions:

i.      Court order required for access to transactional records instead of
        mere subpoena

In order to gain access to transactional records, such as a list of to
whom a subject sent email, which online discussion group one
subscribes to, or which movies you request on a pay-per view channel,
law enforcement will have to prove to a court, by the showing of
"specific and articulable facts" that the records requested are
relevant to an ongoing criminal investigation. This means that the
government may not request volumes of transactional records merely to
see what it can find through traffic analysis. Rather, law enforcement
will have to prove to a court that it has reason to believe that it
will find some specific information that is relevant to an ongoing
criminal investigation in the records that it requests.

With these provisions, we have achieved for all online systems, a
significantly greater level of protection than currently exists for
telephone toll records. The lists of telephone calls that are kept by
local and long distance phone companies are available to law
enforcement without any judicial intervention at all.  Law enforcement
gains access to hundreds of thousands of such telephone records each
year, without a warrant and without even notice to the citizens
involved.  Court order protection will make it much more difficult for
law enforcement to go on "fishing expeditions" through online
transactional records, hoping to find evidence of a crime by accident.

ii.     Standard of proof much greater than for telephone toll records, but
        below that for content

The most important change that these new provisions offer, is that law
enforcement will (a) have to convince a judge that there is reason to
look at a particular set of records, and (b) have to expend the time
and energy necessary to have a US Attorney or DA actually present a
case before a court. However, the burden or proof to be met by the
government in such a proceeding is lower than required for access to
the content of a communication.

2.      New protection for location-specific information available in
        cellular, PCS and other advanced networks

Much of the electronic surveillance conducted by law enforcement today
involves gathering telephone dialing information through a device
known as a pen register. Authority to attach pen registers is obtained
merely by asserting that the information would be relevant to a
criminal investigation. Courts have no authority to deny pen register
requests.  This legislation offers significant new limits on the use
of pen register data.

Under this bill, when law enforcement seeks pen register information
from a carrier, the carrier is forbidden to deliver to law enforcement
any information which would disclose the location or movement of the
calling or called party. Cellular phone networks, PCS systems, and
so-called "follow-me" services all store location information in their
networks.  This new limitation is a major safeguard which will prevent
law enforcement from casually using mobile and intelligent
communications services as nation-wide tracking systems.

i.      New limitations on "pen register" authority

Law enforcement must use "technology reasonably available" to limit
pen registers to the collection of calling number information only.
Currently, law enforcement is able to capture not only the telephone
number dialed, but also any other touch-tone digits dialed which
reflect the user's interaction with an automated information service
on the other end of the line, such as an automatic banking system or a
voice-mail password.

3.      Bill does not preclude use of encryption

Unlike previous Digital Telephony proposals, this bill places no
obligation on telecommunication carriers to decipher encrypted
messages, unless the carrier actually holds the key.  The bill in no
way prohibits citizens from using encryption.

4.      Automated remote monitoring precluded

Law enforcement is specifically precluded from having automated,
remote surveillance capability.  Any electronic surveillance must be
initiated by an employee of the telecommunications carrier.

5.      Privacy considerations essential to development of new technology

One of the requirements that telecommunications carriers must meet to
be in compliance with the Act is that the wiretap access methods
adopted must protect the privacy and security of each user's
communication.  If this requirement is not met, anyone may petition
the FCC to have the wiretap access service be modified so that network
security is maintained.  So, the technology used to conduct wiretaps
cannot also jeopardize the security of the network as a whole.  If
network-wide security problems arise because of wiretapping standards,
then the standards can be overturned.

6.      Increased Public Accountability

All law enforcement requests for surveillance capability and capacity,
as well as all expenditures paid by law enforcement to
telecommunications carriers and all modifications made by carriers to
comply with this bill, will be accountable to the public.  The
government is also required to pay for all upgrades, in both
capability and capacity, in the first four years, and all costs after
four years for incorporating the capability requirements in the costs
for meeting those requirements are not 'reasonably achievable'.  A
determination of whether compliance after four years is reasonably
achievable will be made by the FCC in an open and public proceeding.
Government reimbursement for compliance costs will permit the public
the opportunity to decide whether additional surveillance capability
is necessary.

In all, the reimbursement requirements combined with the reporting
requirements and the open processes built in to this bill, law
enforcement surveillance capability, capacity, and expenditures will
be more accountable to the public than ever before.

B.      Draconian provisions softened

In addition, the surveillance requirements imposed by the bill are not
as far-reaching as the original FBI version.  A number of procedural
safeguards are added which seek to minimize the threatens to privacy,
security, and innovation.  Though the underlying premise of the Act is
still cause for concern, these new limitations deserve attention:

1.      Narrow Scope

The bill explicitly excludes Internet providers, email systems, BBSs,
and other online services.  Unlike the bills previously proposed by
the FBI, this bill is limited to local and long distance telephone
companies, cellular and PCS providers, and other common carriers.

2.      Open process with public right of intervention

The public will have access to information about the implementation of
the Act, including open access to all standards adopted in compliance
with the Act, the details of how much wiretap capacity the government
demands, and a detailed accounting of all federal money paid to
carriers for modifications to their networks.  Privacy groups,
industry interests, and anyone else has a statutory right under this
bill to challenge implementation steps taken by law enforcement if
they threaten privacy or impede technology advancement.

3.      Technical requirements standards developed by industry instead of
the Attorney General

All surveillance requirements are to be implemented according to
standards developed by industry groups.  The government is
specifically precluded from forcing any particular technical standard,
and all requirements are qualified by notions of economic and
technical reasonableness.

4.      Right to deploy untappable services

Unlike the original FBI proposal, this bill recognizes that there may
be services which are untappable, even with Herculean effort to
accommodate surveillance needs.  In provisions that still require some
strengthening, the bill allows untappable services to be deployed if
redesign is not economically or technically feasible.

Background Information

* The Bill:
ftp.eff.org, /pub/EFF/Policy/Digital_Telephony/digtel94.bill
gopher.eff.org, 1/EFF/Policy/Digital_Telephony, digtel94.bill
http.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94.bill

All other files available from:
ftp.eff.org, /pub/EFF/Policy/Digital_Telephony/Old/
gopher.eff.org, 1/EFF/Policy/Digital_Telephony/Old
http.eff.org/pub/EFF/Policy/Digital_Telephony/Old/

* EFF Analysis of Bill as Introduced: digtel94_analysis.eff
* EFF Statement on Earlier 1994 Draft of Bill: digtel94_old_statement.eff
* EFF Analysis of Earlier 1994 Draft: digtel94_draft_analysis.eff
* EFF Statement on Announcement of 1994 Draft: digtel94.announce
* EFF Statement on Announcement of 1993 Draft: digtel93.announce
* Late 1993/Early 1994 Draft: digtel94_bill.draft
* EFF Statement on 1992 Draft: digtel92_analysis.eff
* EFF Statement on 1992 Draft: digtel92_opposition.announce
* Late 1992 Draft: digtel92_bill.draft
* Original 1992 Draft: digtel92_old_bill.draft


For more information contact:

Jerry Berman    Policy Director         <[e-mail]>
Jonah Seiger    Project Coordinator     <[e-mail]>

[phone] (voice)     [phone] (fax)