Electronic surveillance in the Internet age: the strange case of pen registers.

I. INTRODUCTION

As technology advances, the ability of the government to monitor electronic communications has become crucial for fighting crime and terrorism. At the same time, serious privacy concerns have led the courts and Congress to place Fourth Amendment and statutory restrictions on such surveillance. (1) The interplay of constitutional and statutory regulation is particularly dynamic in the evolving area of Internet surveillance, where technological advances have tended to outpace the development of regulatory regimes. One particularly controversial dimension of Internet surveillance has been the use of two technologies originally developed to monitor telephones: "pen registers" and "trap and trace devices."

In telephone surveillance, "pen registers" record the telephone numbers of outgoing calls made from a phone line and "trap and trace devices" record the telephone numbers of incoming calls made to a phone line. (2) In 1979, the Supreme Court held in Smith v. Maryland (3) that the use of these devices did not implicate the Fourth Amendment and hence did not require a warrant. (4) Congress responded in 1986 with limited regulations on government use of the two technologies. (5) These regulations, while a step in the right direction, fall far short of requiring the full regular warrants that are needed for the interception of actual telephone communications. (6) As the Internet developed, there was a general assumption that pen registers and trap and trace devices applied to Internet surveillance, but many questions remained. (7)

The USA PATRIOT Act, passed in response to the attacks of September 11, 2001, modified the law of electronic surveillance in a number of important ways. Section 216 of the Act addressed Internet pen registers, and is the first step in a necessary effort to update pen register law for the Internet age. It makes clear that the statute governing traditional pen registers applies to Internet pen registers, (8) but it still leaves many questions unanswered. The new law purports to extend Smith by analogy and divide all electronic communications into "content" (governed by the full warrant standards applicable to general wiretaps) and "dialing, routing, addressing, or signaling information" (governed by pen register law). (9) This Note will explore how this elusive content/routing divide works in theory and in practice.

This Note argues that an analysis of Internet technology, which is often not fully understood by commentators and lawmakers, will show that the actual reasoning behind Smith cannot support a content/routing distinction for the Internet. Nevertheless, such a distinction, with clarification to address technical concerns and increased protection for pen register information, makes sense in today's Internet world. Part II provides a legal background of the pre-Internet Fourth Amendment principles and statutory guidelines relevant to pen registers. Part III explains how the Internet works, how the government performs Internet pen register surveillance, and how the law has evolved (including changes brought by the PATRIOT Act) to deal with Internet pen register surveillance. Part IV explains why Smith's reasoning cannot directly apply to Internet surveillance and then explores the many complexities involved in deciding how a content/routing divide should ideally be applied to the Internet. Part V explores the practical technical difficulties inherent in working with a content/routing divide in light of fast-changing Internet technology. Part VI argues that the current Internet pen register regime relies far too extensively on government good will and competence. Finally, in Part VII, this Note makes several concrete suggestions for ways to improve the administration of Internet pen registers.

II. PRE-INTERNET LEGAL BACKGROUND: THE LAWS OF GENERAL WIRETAPPING, THIRD-PARTY DISCLOSURE, AND PEN REGISTERS

A. General Wiretapping

Electronic surveillance in the United States dates back to at least the Civil War. (10) In 1928, the Supreme Court found in Olmstead v. United States (11) that wiretapping that did not involve a physical invasion of private property was not subject to the Fourth Amendment (12) because it was not a "search." (13) In 1967, however, the Court decided the landmark Katz v. United States, (14) which held the surveillance of a private phone conversation to be unconstitutional and abrogated Olmstead in the now-famous words: "The Fourth Amendment protects people, not places." (15) Justice Harlan's oft-cited concurrence established a two-part objective/subjective test for whether an activity is an invasion of privacy. (16) He required "first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable.'" (17) Largely to conform to Katz, Congress passed Title III of the Omnibus Crime Control and Safe Streets Act of 1968 (18) (generally known as Title III), which established very strict criteria for the issuance of electronic surveillance warrants that intercept the contents of communications. (19) Legislative history suggests that

Title III was not originally intended to restrict the use of pen registers. (20) B. Third-Party Disclosure

The Fourth Amendment does not protect information that has been disclosed to third parties. In United States v. Miller, (21) decided in 1976, a criminal defendant sought to suppress personal bank records that the government had obtained from Miller's banks (without warrant) by subpoena. (22) The Supreme Court held that Miller did not have a legitimate expectation of privacy in these records because "[a]ll of the documents obtained, including financial statements and deposit slips, contain only information voluntarily conveyed to the banks and exposed to their employees in the ordinary course of business." (23) These records should not be suppressed because:

 
   [T]he Fourth Amendment does not prohibit the obtaining of 
   information revealed to a third party and conveyed by him to 
   Government authorities, even if the information is revealed on the 
   assumption that it will be used only for a limited purpose and the 
   confidence placed in the third party will not be betrayed. (24) 

The expansive Fourth Amendment protections of Katz and the narrow Fourth Amendment protections of Miller would eventually collide in the case of pen registers and trap and trace devices.

C. Pen Registers

1. United States v. New York Telephone Company

The Supreme Court first directly addressed the legality of pen registers in 1977 in United States v. New York Telephone Company. (25) The district court, on showing of probable cause, had ordered New York Telephone Company to assist in the installation of a pen register as part of an investigation into illegal gambling. (26) The company argued that, despite the court order, pen registers could only be authorized by use of the specific procedures set out in Title III for obtaining orders involving the interception of "contents" of communications. (27) These procedures had not been followed in this case. (28) The Court rejected the company's challenge and held that pen registers were not governed by Title III:

 
   Pen registers do not "intercept" because they do not acquire the 
   "contents" of communications as that term is defined by 18 U.S.C. 
   [sub section] 2510(8) [(Title III)]. Indeed, a law enforcement 
   official could not even determine from the use of a pen register 
   whether a communication existed. These devices do not hear sound. 
   They disclose only the telephone numbers that have been dialed--a 
   means of establishing communication. Neither the purport of any 
   communication between the caller and the recipient of the call, 
   their identities, nor whether the call was even completed is 
   disclosed by pen registers. Furthermore, pen registers do not 
   accomplish the "aural acquisition" of anything. They decode outgoing 
   telephone numbers by responding to changes in electrical voltage 
   caused by the turning of the telephone dial (or the pressing of 
   buttons on pushbutton telephones) and present the information in a 
   form to be interpreted by sight rather than by hearing. (29) 

The Court's general understanding of phone technology was correct. (30) Traditionally, pen registers used to monitor telephone service were not capable of picking up phone conversations. (31) With older analog phone technology, signaling data, in the form of pulses and tones, was carried over the same channel as phone conversations. (32) Pen register devices, however, were only capable of picking up these pulses and tones, and did not pick up phone conversations. (33) Even with modern digital phone switching technology, signaling information is placed on a different channel from phone conversations, so a physical barrier prevents pen registers from listening to phone conversations. (34) However, with the advent of the Internet, this physical barrier often no longer exists, as increasing amounts of telephone traffic are being sent over Internet lines through a technology called Voice Over IP. (35)

However, the New York Telephone Court's technical understanding was correct at the time of its ruling.

2. Smith v. Maryland

New York Telephone explicitly avoided addressing the Fourth Amendment implications of the use of pen registers. (36) Less than two years later, however, the Supreme Court in Smith v. Maryland directly addressed the Fourth Amendment issues left open by the earlier decision. (37) A stalker in Baltimore was apprehended with the assistance of a pen register linking threatening and obscene phone calls to his home telephone line. (38) The pen register was installed by the telephone company at police request with no warrant or court order. (39) In addressing the Fourth Amendment issues in this case, the Supreme Court first distinguished the facts here from those in Katz by quoting New York Telephone's analysis that pen registers record only signaling information and not the content of conversations. (40) The Court then applied Justice Harlan's two-part expectation of privacy test to pen registers. (41) First, the Court expressed doubts that Smith had a subjective belief that the numbers he dialed were private, citing the frequent and well-known use of pen registers in billing, administrative and technical support, and resolving complaints of obscene phone calls. (42) The Court went on to hold that even if Smith did have a subjective expectation in the numbers he dialed, "this expectation is not 'one that society is prepared to recognize as reasonable.'" (43) For this proposition, the Court drew extensively from Miller and noted:

 
   [A] person has no legitimate expectation of privacy in information 
   he voluntarily turns over to third parties.... When [petitioner 
   Smith] used his phone, petitioner voluntarily conveyed numerical 
   information to the telephone company and "exposed" that information 
   to its equipment in the ordinary course of business. In so doing, 
   petitioner assumed the risk that the company would reveal to police 
   the numbers he dialed. (44) 

In one of two vigorous dissents, Justices Stewart and Brennan noted that the majority's third party disclosure doctrine was in tension with the still-valid Katz opinion. (45) Phone conversations themselves, exactly like phone numbers dialed, are disclosed to the phone company over its equipment. (46) While Katz clearly protected telephone conversations, the majority denied protection to phone numbers dialed. (47) Additionally, Stewart and Brennan argued that the phone numbers one calls may "reveal the most intimate details of a person's life." (48) In a second dissenting opinion, Justices Marshall and Brennan commented that the idea of assumption of risk makes less sense in the case of telephone calls than in previous precedents because "here, unless a person is prepared to forgo use of what for many has become a personal or professional necessity, he cannot help but accept the risk of surveillance." (49) The arguments advanced by Justices Stewart, Brennan, and Marshall, however, failed to persuade a majority of the Court, which squarely held that the Fourth Amendment does not protect information derived from pen registers.

3. Statutory Response to Smith v. Maryland: Title III Amended to Include Standards For Pen Registers

In 1986, Congress updated electronic surveillance law with the enactment of the Electronic Communications Privacy Act. (50) Part of this law amended Title III to include restrictions on pen registers. (51) These protections are significant but quite limited, especially in comparison to the protections afforded the actual contents of telephone conversations. (52) A law enforcement official must go before a judge to request authorization to use a pen register on a specific target (if known), (53) but there is no judicial discretion because judges "shall" (not "may") approve all pen register installations where the government has certified "that the information likely to be obtained by such installation and use is relevant to an ongoing criminal investigation." (54) This standard, reflecting the non-constitutional nature of pen register law, is dramatically lower than the traditional "probable cause" warrant standard required for content interception under Title III. (55) Furthermore, while the contents of conversations are protected by the exclusionary rule, there is no similar exclusionary remedy for the unlawful use of pen registers. (56) Finally, there is no requirement that the target in a pen register application ever be notified that an application was made or that surveillance was conducted, which is less protection than Title III affords content interception. (57) Despite ECPA's limitations, its restrictions on the use of pen registers highlight the fact that statutory protections are sometimes more important than constitutional constraints in electronic surveillance law. (58)

III. PEN REGISTERS AND INTERNET SURVEILLANCE

The above discussion traces the evolution of the law of pen register surveillance prior to the advent of the Internet. Both surveillance techniques and the law have changed to accommodate the growth of this new technology. The government has developed new tools to monitor Internet traffic. The legal regime surrounding Internet pen registers has also developed, albeit at an uneven pace. Initially, telephone pen register law was simply applied to the Internet with little discussion. More recently, the USA PATRIOT Act updated pen register law so that it now clearly applies to Internet communications.

A. How the Internet Works: A Brief Explanation

A basic understanding of Internet technology is crucial to understanding Internet surveillance. (59) The technology underlying the Internet is different from that of traditional telephones. Telephones require a complete circuit--an uninterrupted connection between the caller and the recipient--that remains unbroken throughout the duration of the phone call as the caller and the …