Navigating communications regulation in the wake of 9/11.

• Author: Gorelick, Jamie S.

1. THE GOVERNMENT'S ENHANCED SURVEILLANCE AUTHORITY A. Changes to the Surveillance Statutes 1. Application to New Providers 2. New Classes of Surveillance Targets and Increased Access to Information 3. Lower Thresholds for Authorization 4. Expanded Voluntary Disclosure B. Effects on Communications Providers 1. Practical Consequences of the Government's Enhanced Surveillance Powers 2. Considerations When Responding to Government Surveillance Requests 3. Voluntary Disclosures II. COMMUNICATIONS ASSISTANCE FOR LAW ENFORCEMENT ACT A. Obligations under CALEA B. CALEA Issues Arising after 9/11 1. Expansion of CALEA to New Services 2. New Standards for Broadband Technologies 3. Deadline for Compliance 4. Defining the Meaning of "Call-Identifying Information". 5. Who Bears the Burden of Paying for CALEA Compliance? III. CRITICAL INFRASTRUCTURE INFORMATION A. Critical Infrastructure Initiatives B. Factors to Consider When Disclosing Information IV. APPROVAL OF FOREIGN INVESTMENTS IN U.S. COMMUNICATIONS COMPANIES A. CFIUS Review Process B. FCC Approval of License Transfers C. CFIUS and FCC Approval after 9/11 D. Considerations When Seeking Approval V. ECONOMIC SANCTIONS AND EXPORT CONTROLS A. Taxonomy of Export Control Rules B. The Evolution of Economic Sanctions and Export Control Rules after 9/11 C. Ways To Minimize Potential Liability VI. INTELLIGENCE REFORM AND TERRORISM PREVENTION ACT OF 2004 VII. CONCLUSION In no industry has the impact of the events of September 11, 2001 ("9/11") been felt more strongly than in the communications industry. After 9/11, as the American people demanded a greater sense of security, Congress and the executive branch agencies reacted with new laws, new regulations, and new practices designed to protect our nation's critical communications infrastructure and enhance the ability of law enforcement and intelligence agencies to investigate those who would do us harm.

   The U.S. communications industry has long been a partner of the government in its efforts to carry out appropriate governmental functions, so long as communications providers could do so consistent with their responsibilities to customers and to shareholders. That partnership, based upon rules developed over decades, has been strained by the vast changes since 9/11. In the few years since the attacks of that day, the industry has had to digest innumerable new and untested obligations. At the same time, the government has struggled to develop procedures for addressing the legitimate privacy and other concerns implicated by its new powers. The reach of these changes--from new authorities to demand customer information, to more stringent scrutiny of proposed mergers--has affected nearly every aspect of a communications provider' s daily work. The review that follows attempts to look across the regulatory environment at the scope of these changes to identify the issues that have arisen for both the government and industry participants.

1. THE GOVERNMENT' S ENHANCED SURVEILLANCE AUTHORITY

   Through the Patriot Act (1) and other post-9/11 legislation, Congress substantially expanded the government's powers to conduct electronic surveillance and obtain information about users of communications services. All providers of communications services are receiving requests for assistance, including demands for information about their customers, that are far greater in number and scope than in the past. These changes present burdens as well as questions about the standards that law enforcement agencies must meet in order to demand assistance or information, and about the scope of the information that law enforcement may obtain. And these questions in turn leave communications providers open to possible liability and the risk of harm to their relationships with their customers.

   1. Changes to the Surveillance Statutes

      Title III of the 1968 Omnibus Crime Control and Safe Streets Act ("Title 111") (2) grants the government authority to intercept the content of telephone or electronic communications only in narrowly defined circumstances. The government's fight to obtain addressing and other noncontent information relating to communications subject to Title III is regulated by the Pen Registers and Trap and Trace Devices chapter of Title 18 ("Pen/Trap Statute"). (3) The Electronic Communications Privacy Act ("ECPA") (4) governs disclosure of stored electronic communications. (5) Finally, the Foreign Intelligence Surveillance Act of 1978 ("FISA") (6) governs surveillance for foreign intelligence-gathering purposes.

      The Patriot Act and other post-9/11 legislation expanded the government's surveillance powers through amendments to each of these statutes. Those amendments (1) expand the scope of the surveillance statutes to reach new communications providers, (2) enlarge the statutes' coverage to include new surveillance targets, (3) lower the threshold that the government must meet in order to engage in domestic and foreign intelligence surveillance, (4) and allow communications providers to submit voluntarily to government surveillance in limited situations. We discuss each of these developments in turn.

      1. Application to New Providers

         Although the surveillance statutes on their face encompass nearly all forms of wire and electronic communications, (7) before the Patriot Act some cable Internet providers argued that they were barred by the Cable Communications Policy Act ("Cable Act") (8) from cooperating with law enforcement requests for surveillance assistance. (9) In its original form, the Cable Act precluded cable providers from giving the government "personally identifiable information" about cable subscribers except after notice to the subscriber and an opportunity for an in-court adversarial hearing. (10) After 9/11, the Cable Act was amended to clarify that cable providers are subject to the surveillance statutes. (11) In addition to opening cable television and cable Internet providers to surveillance requests, this amendment also brings other communications companies within the scope of the surveillance statutes, including Web TV providers and any other provider that structures its business in such a way as to qualify as a "cable operator" under Title VI of the Communications Act. (12)

      2. New Classes of Surveillance Targets and Increased Access to Information

         Congress coupled its application of the surveillance statutes to new communications providers with an expansion of the substantive reach of those statutes. Recent amendments have expanded the government's power under certain statutory provisions to obtain documents and specific details about a surveillance target's communications. Other statutory changes permit the government to pursue new classes of surveillance targets for both foreign intelligence and domestic law enforcement purposes.

         The post-9/11 amendments clarify that the Pen/Trap Statute applies to a wide range of communications technologies, not just telephone communications. (13) They confirm that the government may intercept addressing information in Internet communications under the same standard that applies to collection of routing information for traditional phone calls. (14) The government now may install software in addition to mechanical pen/trap devices. (15) This permits the government to use "packet sniffer" programs that extract information about a surveillance target's Internet communications. (16)

         The amount of basic subscriber information obtainable through an administrative subpoena under ECPA has expanded. (17) Under prior law, the government could obtain a surveillance target's name, address, telephone billing records, telephone number, and length and type of service. (18) Now it may obtain as well the means and source of payment that a surveillance target uses to pay for an account, including the target's credit card or bank account number. (19) It also may obtain records of the target's session times and durations (20) and any network address temporarily assigned to the target. (21) Similarly, under FISA, the government now may require any person or company to produce "any tangible thing[]," including books, papers, or documents, (22) and is no longer limited to business records held by a small class of companies. (23)

         New categories of surveillance targets also have been added. Title III always has required the government to demonstrate probable cause to believe an individual "is committing, has committed, or is about to commit" one of the predicate felony offenses listed in the statute. (24) Since 9/11, Congress has added many new crimes to the list of predicate offenses, including crimes related to terrorism, (25) computer fraud, (26) and biological weapons. (27) And while FISA still requires the government--when it seeks to obtain "foreign intelligence information" through electronic surveillance or a physical search--to show probable cause to believe that the target of surveillance is a "foreign power or an agent of a foreign power," (28) this phrase now includes so-called lone wolf terrorists. (29) Now, any non-U.S. person who participates in activities related to international terrorism is deemed to be an "agent of a foreign power" under FISA. (30)

      3. Lower Thresholds for Authorization

         Amendments to the surveillance statutes also make it easier for the government to obtain information. Congress has lowered many of the standards that the government must satisfy in order to engage in domestic or foreign intelligence surveillance.

         The government now has a reduced burden when seeking to obtain pen/trap orders under FISA. (31) Law enforcement may obtain an order for a pen/trap device in any investigation to protect against international terrorism or clandestine intelligence activities and may obtain information about the communications of even U.S. citizens so long as the investigation is not conducted solely on the basis of activities that are protected by the First Amendment. (32)

         Two other...