Are the Phone Companies Gouging Law Enforcement on Wiretap Costs?
To read this "exclusive" report by a news service called GigaOM, one would expect news in the ongoing lawsuit brought by a former New York prosecutor against the major cell phone companies for gouging the FBI, federal and state law enforcement agencies for compliance with wiretap orders.
A former New York prosecutor, John Prather, claims AT&T, Verizon, Qwest and Sprint regularly charged law enforcement agencies 10 times what they should have for routine wiretaps. He’s now suing on behalf of the FBI and state and city police departments to recover many millions of dollars for overcharging that allegedly took place for almost 20 years.
The case provides a window on the evolving world of wiretaps during an era of increasing surveillance. But the case is complicated because Prather stands to get a big chunk of money if the case succeeds and, as the phone companies argue, he may not be a real whistle-blower in the first place.
First, the lawsuit is not new. It was filed almost a year ago. Second, it's a Qui Tam lawsuit which means the prosecutor is essentially a bounty hunter who collects a portion of any proceeds awarded (like a whistleblower), usually about 15 to 25%. [More...]
It is true that law enforcement pays phone companies huge amounts of money to comply with electronic surveillance requests. But Congress authorized payment when it enacted CALEA, which required phone companies to update their infrastructure so wiretap and electronic surveillance could be accomplished in the digital age.
The phone companies are incurring huge expenses not just to switch on a wiretap or fax information, but to ensure that the requests comply with the law.
In May, a Congressional inquiry was launched into law enforcement demands for cell phone information from phone companies. Congressman Ed Markey sent letters to each of the major carriers requesting information. Their responses are here.
As Sprint explains in its letter of May 23, 2012:
Law enforcement is required by statute to compensate carriers for the expenses incurred in responding to law enforcement demand. Section 2518(4) of the Wiretap Act requires that providers be compensated "for reasonable expenses incurred in providing such facilities or assistance" to accomplish any court-ordered interception or wiretap. Section 3124© of the PRJTT Act likewise requires that providers be "reasonably compensated for such reasonable expenses incurred in providing such facilities and assistance" for the installation of a pen register or trap and trace device.
And, Section 2706 of the SCA requires that the government pay "such costs as are reasonably necessary and which have been directly incurred in searching for, assembling, reproducing, or otherwise providing [the contents of communications, records, or other information]." Moreover, the court orders that Sprint receives routinely contain language requiring law enforcement agencies to compensate Sprint for any assistance in complying with the request.
What does Sprint provide for the money it charges law enforcement?
Pursuant to the legal requirements of CALEA, Sprint is required to have a team available 24 hours per day, 7 days per week to respond to demands from law enforcement. 47 C.F.R. $5 64.2100 et seq. (implementing 47 U.S.C. 5 1006).
As a result, Sprint employs a team of 36 analysts who receive court orders for location and installation of wiretaps and pen register/trap and trace devices. This team is responsible for reviewing the language of the order to ensure that the order supports the requested information and then for ensuring that the order is fulfilled appropriately.
In addition to this group, Sprint employs approximately 175 additional analysts to respond to subpoenas and court orders for subscriber information that the company receives from both civil litigants and law enforcement. All of these analysts are supported by 10 managers and supervisors.
It seems the former prosecutor bringing this lawsuit thinks law enforcement should just have to pay for turning on the switch, and would dispense with the phone companies providing qualified personnel to review the court orders and subpoenas to ensure they comply with the laws as written by Congress.
What Sprint pays these people to do:
Typically, if one of Sprint's analysts believes a court order or subpoena is insufficient, that analyst will send a letter back to the requestor explaining why the requested information cannot be provided. Often, the requestor will respond with an explanation of why, in their view, the order provides sufficient authority to obtain the requested information. These discussions can result to an escalation to in-house counsel at Sprint who discusses the issues with the Assistant US Attorney or state attorney and can result in further escalation to Sprint's outside legal counsel to become involved before the court if it is necessary to seek withdrawal of the order or move to quash it.
Deciding whether a subpoena or court order is sufficient or should be challenged is not an easy matter. It's not like a TSA worker examining a bag at airline security. There are different privacy levels for the different type of requests:
The ECPA is comprised of three statutes: the Wiretap Act, 18 U.S.C. S. 2510 et seq., the Pen Register and Trap and Trace Devices Act ("PR/TT Act"), 18 U.S.C. S. 3121, et seq., and the Stored Communications Act ("SCA"), 18 U.S.C. S. 2701 et seq. Together these statutes provide different levels of protection for customer records and information from disclosure to the government. Appropriately, the more customers' privacy rights are implicated, the more stringent the requirement for the government agency seeking disclosure:
(1) Basic subscriber information, which is strictly limited to six specific categories of information (name, address, local long distance records (or records of session times and duration), length/type of service, telephone/subscriber number and means and source of payment), is the only information that can be disclosed to law enforcement pursuant to an administrative, grand jury or trial subpoena. 18 U.S.C. S 2703[c](2).
(2) All non-content records or other information pertaining to a subscriber (including basic subscriber information) can be disclosed to law enforcement pursuant to a court order based on "specific and articulable facts showing that there are reasonable grounds to believe that . . . the records or other information sought, are relevant and material to an ongoing criminal
investigation." 18 U.S.C. S. 2703(d).
(3) The stored content of a customer's communications (e.g., text messages), can only be disclosed to law enforcement pursuant to a warrant or court order based on probable cause. 18 U.S.C. S. 2703(a) and (b).
(4) A wiretap can only be established pursuant to a court order based on probable cause. 18 U.S.C. S. 2702(b)(2) & 18 U.S.C. S. 2518(3).
Importantly, each of these demands for customer information has repercussions for Sprint if it fails to provide the requested information. If Sprint fails to comply with a subpoena for basic subscriber information, the government can seek to compel its production via a court order and can impose costs and other fines on Sprint. If Sprint fails to comply with a valid court order, the company can be found in contempt of court and subject to fines and other penalties. Moreover, if Sprint fails in its obligations to abide by the ECPA, the company can face civil penalties for violation of the statute. 18 U.S.C. S. 2707.
When Sprint responds to demands from law enforcement, it is not cooperating in some surreptitious fashion but instead is complying with the law that Congress established to permit disclosures of our customers' information to law enforcement under certain limited circumstance.
Not only that, the courts don't always agree on what kind of process or order is required to provide different types of information, as is the case with cell cite locator information.
What is outrageous here is not the amounts the cell phone companies are charging law enforcement (much of which is for the benefit of its customers whose records, location and calls are demanded, unbeknownst to them) but the number of requests law enforcement makes.
In its letter, Sprint says that last year alone, it received 500,000 subpoenas for subscriber information. Over the past 5 years, it received "52,029 court orders for wiretaps; 773,119 court orders for installation of a pen register/trap and trace device; and 196,434 court orders for location information."
On the last page of its letter, Sprint provides the schedule of what it charges law enforcement.
AT&T does the same in its response to the Congressional inquiry. (pp 7-8). AT&T says it rejected 18 wiretap/pen register requests a week last year. It has more than 100 full time employees reviewing law enforcement submissions.
Metro PCS says in its response to Congress that it responds to 12,000 requests a month. It provides its fee schedule on page 5. It has a compliance group with 16 people, including 12 compliance analysts, reviewing the requests.
From Verizon's response:
In 2011, Verizon Wireless received approximately 260,000 requests for customer information from law enforcement. About half of these requests were subpoenas; generally speaking, law enforcement can only seek subscriber or call detail records (the type of information on a phone bill) through a subpoena. See 18 U.S.C. S. 2703[c](2)(A)(F). The other half were warrants and orders (generally for phone bill information, wiretaps, pen registers, traps and traces, text message information and location information) or emergency requests. Over the past five years, the number of requests has grown an average of about 15% each year.
It has a "group dedicated to reviewing only subpoenas and team members that specialize in responding to warrants and orders.... We will not release information if the legal process from law enforcement facially fails to comply with the law (e.g., is not signed or a subpoena is used when different legal process is required)".
The phone companies are not gouging law enforcement. Law enforcement is gouging taxpayers with its excessive demands. As Sprint says:
Sprint is not marketing these services, but providing appropriate information to law enforcement consistent with our legal obligations and duties.
Sprint, like the other companies, provide their fee schedule in advance.
Sprint provides law enforcement with its policies and procedures so they have information on how to contact Sprint for processing of their legal demands. As stated above, Sprint also provides a fee schedule to law enforcement so that they are informed about the rates they will be charged by Sprint for responding to their legal demands.
I hope the lawsuit gets tossed. The only reason it is worth mentioning is to wake people up to the excessive and ever-increasing infringement of our privacy rights resulting from the power Congress gave law enforcement. That is what needs to be recouped, not the money law enforcement paid the phone companies. At least a portion of the fees the phone company charges goes towards compliance efforts to verify the demands are lawful.
Chrisopher Soghoian, the Principal Technologist and Senior Policy Analyst for the ACLU today tweeted:
The lawsuit against telcos "gouging" on surveillance is total crap. Suit is by former NY prosecutor seeking money
|< Brass: Cheney "Offended" By Obama On Intelligence Briefings | US Ambassador To Libya Killed >|