1 ISPs and Federal Privacy Law: Everything You Need to Know About the Electronic Communications Privacy Act (ECPA) Mark Eckenwiler Computer Crime and Intellectual Property Section U.S. Department of Justice

2 The Computer Crime and Intellectual Property Section n Founded in 1991 as Computer Crime Unit n Current staff of 22 attorneys n Mission of CCIPS –Combat computer crime and IP crimes –Develop enforcement policy –Train agents and prosecutors –Contribute to public awareness of the issues –Promote international cooperation –Propose and comment on federal legislation

3 Why You Might Care About ECPA n Comprehensive privacy framework for communications providers n Regulates conduct between –different users –provider and customer –government and provider n Civil and criminal penalties for violations n Note: state laws may impose additional restrictions/obligations

4 Why ECPA Matters to Law Enforcement n As people take their lives online, crime follows; no different from the real world n Online records are often the key to investigating and prosecuting criminal activity –“cyber” crimes (network intrusions) –traditional crimes (threats, fraud, etc.) n ECPA says how and when government can (and cannot) obtain those records

5 Substantive Provisions of ECPA Or, Everything you know is wrong

6 ECPA & The Courts: A Love Affair n “famous (if not infamous) for its lack of clarity” –Steve Jackson Games v. United States Secret Service, 36 F.3d 457, 462 (5th Cir. 1994) n “fraught with trip wires” –Forsyth v. Barr, 19 F.3d 1527, 1543 (5th Cir. 1994) n “a fog of inclusions and exclusions” –Briggs v. American Air Filter, 630 F.2d 414, 415 (5th Cir. 1980)

7 The Matrix

8 Real-Time Acquisition of Communications (Interception) n The default rule under § 2511(1): do not –eavesdrop on others’ communications –use or disclose illegally intercepted contents n Applies to oral/wire/electronic comms. n Violations may lead to –criminal penalties (5-year felony) [§ 2511(4)] »exception for first offense, wireless comms. –civil damages of $10,000 per violation –suppression

9 Relevance to Computer Networks n Makes it illegal to install an unauthorized packet sniffer n In several recent federal prosecutions, defendants have pled guilty to interception violations –e.g., Cloverdale minors

10 Exceptions to the General Prohibition n Publicly accessible system [§ 2511(2)(g)(i)] –open chat room/IRC channel n Consent of a party n System provider privileges n Court-authorized intercepts

11 Consent of a Party n May be implied through –login banner –terms of service n Implied consent may give an ISP authority to pass information to law enforcement and other officials

12 System Operator Privileges n Provider may monitor private real-time communications to protect its rights or property [§ 2511(2)(a)(i)] –e.g., logging every keystroke typed by a suspected intruder –phone companies more restricted than ISPs n Under same subsection, a provider may also intercept communications if inherently necessary to providing the service

13 Court-Authorized Monitoring n Requires a kind of “super-warrant” –a/k/a “Title III order” (or T-3) –§ 2518 n Good for 30 days maximum n Necessity, minimization requirements n Ten-day reporting n Sealing

14 Types of Wiretap Orders You May Encounter n Keystroking –common in network intrusion cases n Cloning an account

15 The Matrix

16 Real-Time Transactional Records n The pen register/trap and trace statute (same as for telephones) applies n Law enforcement may obtain a court order to gather prospective non-content information about a user, such as –addresses on in/outbound –inbound FTP connections –where remote user is logging in from (dialup? remote IP address?)

17 The Matrix

18 Stored Communications and Historical Records

19 Dichotomies ‘R’ Us n Permissive disclosure vs. mandatory –“may” vs. “must” n Content of communications vs. non-content –content »unopened vs. opened –non-content »transactional records vs. subscriber information n Basic rule: content receives more protection

20 Penalties for Stored Records & Communications Violations n Civil remedies [18 U.S.C. § 2707] –$1,000 minimum per violation –attorneys’ fees n Criminal remedies [§ 2701] –only for accessing stored communications without authorization (e.g., one user snooping in another’s inbox) –inapplicable to the provider [§ 2701(c)(3)]

21 Subscriber Content and the System Provider n Any provider may freely read stored or files of its customers –Bohach v. City of Reno, 932 F. Supp (D. Nev. 1996) (pager messages) n While ECPA imposes no prohibition, contractual agreement with customer may limit right of access

22 Public Providers and Permissive Disclosure n General rule: a public provider (e.g., an ISP) may not freely disclose customer content to others [18 U.S.C. § 2702] n Exceptions include –subscriber consent –necessary to protect rights or property of service provider –to law enforcement if contents inadvertently obtained, pertains to the commission of a crime

23 Government Access to Stored Communications Content n For unretrieved < 181 days old stored on a provider’s system, government must obtain a search warrant [18 U.S.C. § 2703(a)] –Warrant operates like a subpoena

24 Government Access to Stored Communications Content n For opened (or other stored files), government may send provider a subpoena and notify subscriber in advance [18 U.S.C. § 2703(b)] –government may delay notice 90 days in certain cases (§ 2705(a)) –no notice to subscriber required if not a provider “to the public”

25 The Matrix

26 Permissive Disclosure and Non- Content Subscriber Information n Rule is short and sweet n Provider may disclose non-content records to anyone except a governmental entity n Government needs –appropriate legal process –or consent of subscriber

27 The Two Categories of Non-Content Information n Basic subscriber information –§2703(c)(1)(C) n Transactional records –§ 2703(c)(1)(B)

28 Basic Subscriber Information n Can be obtained through subpoena n Provider must give government –name of subscriber –address –local and LD telephone toll billing records –telephone number or other account identifier –type of service provided –length of service rendered

29 Transactional Records n Not content, not basic subscriber info n Everything in between –past audit trails/logs –addresses of past correspondents n Government may compel via a “section 2703(d) court order”

30 Section 2703(d) Court Orders n a/k/a “articulable facts” order –“specific and articulable facts showing that there are reasonable grounds to believe that [the specified records] are relevant and material to an ongoing criminal investigation” n A lower standard than probable cause n Like warrant (& unlike subpoena), requires judicial oversight & factfinding

31 The Matrix

32 Summary: Legal Process & ECPA n Warrant –unopened n Court order under § 2703(d) –transactional records n Subpoena –opened , unopened >180 days old, or stored files –basic subscriber info n Higher-order process always valid –e.g., warrant can compel transactional logs

33 ECPA In Practice: A Scenario n A victim reports a threat of physical injury via from n To determine StalkNU’s identity, gov’t would serve a on isp.com n For the target’s login records, gov’t serves a _______ on isp.com n To obtain all the (opened and unopened) in target’s account, gov’t serves a ________

34 Preclusion of Notice n In criminal investigations, general policy is to avoid tipping off target n Under ECPA, government may ask a court to prohibit ISP from notifying subscriber that records have been requested from ISP [§ 2705(b)]

35 § 2703(f) Requests to Preserve n Government can ask for any existing records (content or non-content) to be preserved –no court order required –does not apply prospectively n Government must still satisfy the usual standards if it wants to receive the preserved data

36 Summary n For better or worse, ECPA shapes your destiny n Benefits of understanding (and complying with) the statute include –avoiding civil & criminal liability –smoother relations with law enforcement

37 Where To Get More Information n Computer Crime Section’s phone number: n Computer Crime Section’s home page: