Yup, they had a pen/trap order. The question is whether that was sufficient.

Ok, I'm not a legal person, just a technical person, but the same type of information can be captured prior to it's reception by the user. For example, an organization or ISP sets it's MX record to have mail delivery to a frontend spam prevention device, which inspects EVERY mail item prior to delivery to the intended mail system, a different system alltogether....

This spam prevention device "in theory" can gather the same information the government is looking for....

Pete, an MX record for a hostname points to a device (or set of devices): a mail relay. Not all mail relays filter mail through spam traps. Those that do are not established uniformly. There are many different flavors of mail handling software for mail relays (and many different operating system for mail relays) and many different types of spam traps (some of which may capture information as its scanned, some of which may not). When further considering encryption technologies, the best place for the government to perform surveillance of a person's internet use is at a terminal.

Another Fisher opinion. Judge Fisher is writing MANY very sweeping opinions on electronic privacy, and the result in toto is very unsettling. On the bright side, this seems to be the least unsettling of his opinions. I haven't thought about whether its correct, or have too much time to even read it. I"ll check back in a bit.

I'm also not sure whether I agree with the pen register thing. Normally I'd just flat out disagree - I take a virtual rather than physical view of the 4th Amendment when dealing with electronic privacy - but if there was an ACTUAL physical presence on the person's property - i.e., if they installed a bug - then I'd be a little concerned in any event. Maybe there needs to be a physical AND virtual view - but with a very limited understanding of what physical means?

The original USSC pen register case explained that a person does not have a reasonable expectation of privacy in the numbers dialed from their home telephone. Thus, no 4th Amendment violation if obtained without a warrant.

Shortly afterwards, Congress passed a law prohibiting law enforcement from obtaining this information without a warrant. In other words, Congress seemed to be saying that people do in fact, assume that the phone numbers they dial are private.

If that is the case, I'm curious why the pen register decision has never been reviewed and overturned. I'm going to assume that the "reasonable expectation of privacy" is a fluid concept that can change over time based on current expectations. As the recent HP case made clear, obtaining somebody's phone records is well beyond the scope of what citizens consider to be normal, polite, and ethical behavior. By this point in time, I see no reason why the court can't finally say "yes, you have a reasonable expectation of privacy in the numbers dialed from your phone." Basically what I'm saying is that even if the pen register case was rightly decided 30 years ago, our expectations of behavior have long since questioned that decision.

And, if that's true, the modern equivalent of phone numbers -- IP addresses, etc. -- should be just as protected.

Orin:

Perhaps it's time to rethink the idea that if you entrust information to a 3rd party you have abdicated your privacy w/r/t that information except in some very specific circumstances.

I can't cite this, but in NY, there is supposedly no expectation of privacy in your bank records -- so the police can get them without a warrant. Assuming this is true, doesn't that disturb you? Most people consider their bank records and other financial information to be one of the most private pieces of information they have.

Perhaps it's time to move towards a more sliding scale 4th Amendment jurisprudence that considers more than just a binary yes-it's-private, no-it's-not-private system. The fact is that it's virtually impossible today *not* to entrust certain types of information to others while still living in modern society. Sure, you can keep all your cash under your mattress -- in which case you'll have some privacy in your finances -- but very few people are willing to do that. Perhaps we need to begin considering the context in which people entrust information to others via certain types of business relationships. Phone records, bank records, and ISP records are all the kinds of things which most people would be horrified to find released without their information. The service providers in these cases are "entrusted" with this information in the eyes of most people. (Also, for simplicity, I'm going to limit this suggestion to certain commercial relationships; a secret you tell your best friend shouldn't get protection.)

Would it be a more difficult system than the current yes-no jurisprudence? Absolutely. But it would also more realistically approximate how people view expectations of privacy.

Since Smith v. Maryland indicates the latter is not a search, why should the former be possibly thought of as a search?

Does it really matter that its the same kind of information? Perhaps its more important to consider to what extent the information is disclosed to a third parties.

In the early days of the phone system you had to actually tell a human being who you wanted to call before a call could be connected. Obviously a third party at that point knew who you were calling. The line that courts have drawn between phone numbers and call content seems (and IANAL) to have something to do with the fact that the phone company actually does things with the numbers, such as connecting the call, billing, etc and so some phone company employee might reasonably come across this information in the course of doing his or her job.

This seems to get less and less reasonable the more automated things are. Would an employee at an ISP ever come across the IP addressess you've accessed? Not unless they installed a sniffer, in which case they'd see the content as well. Same thing for email. The To and From addresses are stored in the same file as the content. You open it, you see everything.

So the idea that on the Internet third parties are walking around with this addressing information, and so you've no expectation of privacy in regard to it, but they aren't aware of the content of the communications, so you can consider that private, isn't terribly realistic. IHMO either you've got a natural expectation of privacy in regard to all of it or none of it.

After thinking about it, I think the opinion is correct under Orin's hypothetical facts. I'm still concerned about the tresspass, though - I think you need a warrant for any physical tresspass. In the end, I think there is (in a normative sense only) both a physical and virtual view of the 4th Amendment, for pragmatic reasons if nothing else.

Random Friday night curveball:

Would it make a difference if the pen register analogue was remotely installed on the defendant's computer? (e.g. through some kind of remote exploit or Trojan Horse?)

David Huberman's post at 7:16 is correct. Pen registers are not installed on the target's machine. It's roughly equivalent to putting a man at the post office and reading the addresses on the envelopes as they pass by.

I suspect the court's terminology of "a pen register analogue" is being used in a broad sense. I submit you can translate it into layman's language as "A surveillance collection technique that is analogous to pen registers of old was used to collect the data".

This United States v. Forrester opinion shows why that new court rule, Rule 32.1 of the Federal Rules of Appellate Procedure, which allows citation of unpublished opinions in all federal circuits, is a very bad idea. If this published opinion does not clearly describe the case's background, then what is the likelihood that an unpublished opinion will clearly describe the case's background?

Also, I am wondering -- to what extent should an ISP be expected to cooperate with investigators in invading the privacy of a customer?

I would be very interested in what actually happened here. With the rise of DHCP and dynamic port mapping, it has become rather hard to actually tap Internet traffic from some specific person or computer. The problem is that a lot of IP addresses are allocated dynamically. Combine this with dynamic port mapping like that provided by typical firewalls, and it becomes almost impossible to identify a specific computer outside his inner firewall/router.

For example, right now I am within at least three levels of this sort of port and IP address remapping. I have a router about a foot from my laptop here that multiplexes all the ports from the various computers here onto a single IP address. Then, a second router in the basement of the building does the same for the 36 units in the building. And then the ISP sometimes does the same. Probably, more often, the ISP dynamically temporarily allocates an IP address to a user/ computer/ router (in this case, the router in the basement for the 36 units sharing the same DSL connection).

Mention above was made about logical ports. In the case of email, the typically relevant ports are 25 (SMTP) and 110 (POP3). But these are translated and multiplexed by those same firewalls and routers that screwed up the IP addresses, and, indeed, the way that this whole system works is that this translation of logical ports allows routers, etc. to multiplex all the logical ports from multiple IP addresses on a single IP address.

If you want to intercept the incoming mail for someone, the easiest place to do it is at his mail server. His incoming IP address and port are liable to change every time, but his userid (or mailbox name) stays the same. Alternatively, you can tap his email client on his computer. Anything else gets to be pretty messy.

Outgoing mail may be more difficult, depending on the sophistication of the sender. Obviously, again, it can be tapped from his email client, or as noted above, behind the inner firewall/router. If the sender is not overly sophisticated, and is using his mail provider for outgoing mail, then it can be intercepted there again. But that becomes hard if the sender is like me, and runs his own email server, that becomes difficult, since email servers most often connect directly to destination mail servers via SMTP. Of course, in that case, in order to allow for incoming mail, you need to pass SMTP traffic through the routers and firewalls without network address translation (NAT).

But if the police attached the pen register to the computer itself, or put it on the line w/i the house, how did they manage to do so? I think that I would notice new hardware hanging on the line or on my computer, and I am fairly certain that they couldn't sneak software onto my computer w/o my knowing it. If there are back doors to Windows, etc., I think that we would all like to know about them. And the current generation of spyware and virus removal software seems to do a pretty good job at removing Trojans and the like, as suggested above.

I don't really understand the use of a 4th amendment argument, since it would seem that installing software on the computer would be a 5th amendment violation.

Bruce,

Regardless of the aggregation of "internal" addresses via NAT that you speak of, what's hard about monitoring your outgoing IP traffic by inspecting as it arrives from your building's router at the ISP? Yes, the monitor will get the traffic from everyone in the building, but that's only a difference in degree from the fact that even if you had your own, individual connection the monitor would still have to look at every single packet to determine which ones were SMTP or POP3 traffic.

The only hard part is figuring out which dynamic address/port currently belongs to you, but since neither SMTP nor POP3 is encrypted, the solution is left as a fairly simple exercise for the reader...

The only hard part is figuring out which dynamic address/port currently belongs to you, but since neither SMTP nor POP3 is encrypted, the solution is left as a fairly simple exercise for the reader... -- K Parker

In the main you are right. However I would point out that many programs and ISP's provide SMTP that is encrypted via SSL.

Gmail provides SSL access to POP3, SMTP, and HTTP so interception would need to be at the users system, the destination, or at Gmail itself. Most systems and users might as well be sending post cards for all the security they take advantage of currently. I keep hoping spam gets bad enough to encourage the switch to more secure email protocols.

In Smith v. Maryland the court ruled that the numbers you dial from your phone and the times you call them are equivalent to the address you put on a letter and the date on the postmark.

Both sets of information were ruled to be public because both are required by the carrier in question to perform the service contracted, multiple persons associated with the carrier have to be able to access and evaluate that information in order to do their jobs under the contract, and persons not under the direct control of the carrier cannot be reasonably barred from being able to access this information.

That last one is a bit complicated but it basically boils down to the fact that the mail carrier has to be able to read the address of a letter in order to place it in the correct box and a hypothetical bystander could easily read it over his shoulder.

The Ninth Circuit’s ruling in The United States v. Forrester has expanded this view of public access to address data for private communications to include internet connection and e-mail address data as well as phone numbers.

I believe this is a problematic ruling. While TCP/IP address recorders and E-mail header recorders at the Internet Service Provider would obviously fall under an expanded Smith v. Maryland, they are not the only ways of obtaining this information.


It is possible to put “internet pen registers” on a subject’s personal computer. These computer resident pen registers can easily be installed on the target computer directly from the internet by using a specially constructed computer virus or Trojan Horse program. These methods do not require physical access to the computer or physical intrusion to 4th Amendment protected space.

These computer resident pen registers have some unique advantages over ISP resident pen registers; anytime the computer is on they are active and can record connection data no matter which Internet Service Provider the computer is connected to. When the subject’s computer is a laptop, a computer resident pen register can record data no matter where the computer is taken and no matter what legal jurisdiction it is in. A computer resident pen register can also record data when stored documents such as archived emails or saved internet files are accessed. Even more problematic, data collected from stored documents may predate the installation of the resident pen register on the subject’s personal computer.

I don’t think the 9th Circuit has sufficiently evaluated the extra possibilities for intrusion that computer resident pen registers give law enforcement authorities.

otpu

otpu writes:

A computer resident pen register can also record data when stored documents such as archived emails or saved internet files are accessed. Even more problematic, data collected from stored documents may predate the installation of the resident pen register on the subject’s personal computer.

... except that what you're describing isn't a "pen register" as that term is used in federal law. Acquiring "data collected from stored documents" is a search of the computer, not the collection of "dialing, routing, addressing, or signaling information" associated with a "wire communication" or "electronic communication."

Ned Ulbricht wrote at 7.7.2007 10:51am:

At least one multinational corporation in the IT field performs routine sweeps for keylogging devices attached between the keyboard and the box. It's presumed that neither developers and testers nor administrative and management staff will notice these devices, as they typically are fairly small. This particular corporation does perform classified government work—but I'm talking solely about the computers used for unclassified and non-government work. This sweep requires manpower and costs money—this corporation's security management presumably thinks it's worth paying for.

For individuals wouldn't it be much cheaper to buy two keyboards? Leave one attached to your computer in your absence. Never let the "clean" one out of your sight, and attach it before using the computer.

For individuals wouldn't it be much cheaper to buy two keyboards? Leave one attached to your computer in your absence.

It's a trade-off between the resources expended on counter-measures and the likely attacks. The presumption is that a device can be quickly attached between a keyboard and box by a guest or someone with a limited time unobserved in the area. An attacker with more time (and sufficent resources) will presumably hide the device better.

Likewise, while the sweeps are "routine", there's still a window of vulnerability between sweeps, so there's a deterrent logic in making the counter-measure somewhat known.

For an individual, the risk assessment is probably totally different. Do you have to worry about industrial espionage? State-sanctioned industrial espionage?

Professor Kerr, from your description of the Smith opinion... sounds like you'd agree with the proposition that things would be better if the Marshall dissent had been the majority opinion.

Steve2 writes:

Professor Kerr, from your description of the Smith opinion... sounds like you'd agree with the proposition that things would be better if the Marshall dissent had been the majority opinion.

Nope. Marshall's opinion would have made it essentially impossible for the government to investigate network crimes. The government would need probable cause to do anything, which would make it very difficult to conduct investigations. I think the ultimate goal is to have a set of network rules that roughly recreate the rules for the physical world; Marshall's approach would essentially treat *all* information over a computer network as if it were protected space such as the inside of a home.

I looked to Lafave on this subject: The most recent version of his Search and Seizure treatise (available on Westlaw) quotes the following article when discussing third party records:

Link to article

Lafave endorses the author's idea that "privity" analysis (a proposed term combining notions of confidentiality and standing), rather than "privacy" analysis, is what courts should engage in when deciding these cases. This seems to be what techielaw is getting at in his above post. The article also discusses the differences between Smith (involving voluntary disclosure without a subpoena) and Miller (involving compelled disclosure). And the article proposes a four-pronged test that seems to address Orin's concern about collecting otherwise unprotected information by unreasonable means. I'd imagine this area of the law will become more settled over the next decade.

Thanks for the link. The article cleared up many of my questions.