CALEA is a “signal”, Crawford describes, that the “FCC may take the view that permission will be needed from government authorities when designing a wide variety of services, computers, and web sites that use the Internet protocol. . . . I nformation flow membranes will be governmentally mandated as part of the design process for online products and services.[8]” That hint has continued: In August 2005, the Federal Communications Commission (FCC) ruled that Voice-over-IP services “must be designed so as to make government wiretapping easier.”[9]
Of course, regulating the architecture of the network was not the only means that Congress had. Congress could have compensated for any loss in crime prevention that resulted from the decreased ability to wiretap by increasing criminal punishments.[10] Or Congress could have increased the resources devoted to criminal investigation. Both of these changes would have altered the incentives that criminals face without using the network’s potential to help track and convict criminals. But instead, Congress acted to change the architecture of the telephone networks, thus using the networks directly to change the incentives of criminals indirectly.
This is law regulating code. Its indirect effect is to improve law enforcement, and it does so by modifying code-based constraints on law enforcement.
Regulation like this works well with telephone companies. There are few companies, and the regulation is relatively easy to verify. Telephone companies are thus regulable intermediaries: Rules directed against them are likely to be enforced.
But what about when telephone service (or rather “telephone service”) begins to be carried across the Internet? Vonage, or Skype, rather than Bell South? Are these entities similarly regulable?[11]
The answer is that they are, though for different reasons. Skype and Vonage, as well as many other VOIP providers, seek to maximize their value as corporations. That value comes in part from demonstrating reliably regulable behavior. Failing to comply with the rules of the United States government is not a foundation upon which to build a healthy, profitable company. That’s as true for General Motors as it is for eBay.
Telephones: Part 2
Four years after Congress enacted CALEA, the FBI petitioned the Federal Communications Commission to enhance even further government’s power to regulate. Among the amendments the FBI proposed was a regulation designed to require disclosure of the locations of individuals using cellular phones by requiring the phone companies to report the cell tower from which the call was served.[12] Cellular phone systems need this data to ensure seamless switching between transmitters. But beyond this and billing, the phone companies have no further need for this information.
The FBI, however, has interests beyond those of the companies. It would like that data made available whenever it has a “legitimate law enforcement reason” for requesting it. The proposed amendment to CALEA would require the cellular company to provide this information, which is a way of indirectly requiring that it write its code to make the information retrievable.[13]
The original motivation for this requirement was reasonable enough: Emergency service providers needed a simple way to determine where an emergency cellular phone call was coming from. Thus, revealing location data was necessary, at least in those cases. But the FBI was keen to extend the reach of location data beyond cases where someone was calling 911, so they pushed to require the collection of this information whenever a call is made.
So far, the FBI has been successful in its requests with the regulators but less so with courts. But the limits the courts have imposed simply require the FBI to meet a high burden of proof to get access to the data. Whatever the standard, the effect of the regulation has been to force cell phone companies to build their systems to collect and preserve a kind of data that only aids the government.
Data Retention
Computers gather data about how they’re used. These data are collected in logs. The logs can be verbose or not — meaning they might gather lots of data, or little. And the more they gather, the easier it will be to trace who did what.
Governments are beginning to recognize this. And some are making sure they can take advantage of it. The United States is beginning to “mull”[14], and the European Union has adopted, legislation to regulate “data generated or processed in connection with the provision of publicly available electronic communications, ” by requiring that providers retain specified data to better enable law enforcement. This includes data to determine the source, destination, time, duration, type, and equipment used in a given communication.[15] Rules such as this will build a layer of traceability into the platform of electronic communication, making it easier for governments to track individual behavior. (By contrast, in 2006, Congressman Ed Markey of Massachusetts proposed legislation to forbid certain Internet companies, primarily search engines, from keeping logs that make Internet behavior traceable.[16] We’ll see how far that proposed rule gets.)
Encryption
The examples so far have involved regulations directed to code writers as a way indirectly to change behavior. But sometimes, the government is doubly indirect: Sometimes it creates market incentives as a way to change code writing, so that the code writing will indirectly change behavior. An example is the U.S. government’s failed attempt to secure Clipper as the standard for encryption technology.[17]
I have already sketched the Janus-faced nature of encryption: The same technology enables both confidentiality and identification. The government is concerned with the confidentiality part. Encryption allows individuals to make their conversations or data exchanges untranslatable except by someone with a key. How untranslatable is a matter of debate,[18] but we can put that debate aside for the moment, because, regardless, it is too untranslatable for the government’s liking. So the government sought to control the use of encryption technology by getting the Clipper chip accepted as a standard for encryption.
The mechanics of the Clipper chip are not easily summarized, but its aim was to encourage encryption technologies that left a back door open for the government.[19] A conversation could be encrypted so that others could not understand it, but the government would have the ability (in most cases with a court order) to decrypt the conversation using a special key.
The question for the government then was how it could spread the Clipper chip technology. At first, the Clinton administration thought that the best way was simply to ban all other encryption technology. This strategy proved very controversial, so the government then fixed on a different technique: It subsidized the development and deployment of the Clipper chip.[20]
The thinking was obvious: If the government could get industry to use Clipper by making Clipper the cheapest technology, then it could indirectly regulate the use of encryption. The market would do the regulation for the government.[21]
9.
Susan P. Crawford, "Someone to Watch Over Me: Social Policies for the Internet" 37 (Cardozo Law School Legal Studies Research Paper, No. 129, 2006).
10.
This is just what happened, Seventh Circuit Court of Appeals Chief Judge Richard Posner argues, when the Warren Court constitutionalized criminal procedure. To compensate for the increased difficulty in convicting a criminal, Congress radically increased criminal punishments. See Richard A. Posner, "The Cost of Rights: Implications for Central and Eastern Europe — and for the United States,"
11.
Initially, the CALEA requirements extended to "facilities based" VOIP services only, though the push more recently is to extend it to all VOIP services. See Daniel J. Solove, Marc Rotenberg, and Paul M. Schwartz,
12.
See Federal Communications Commission, Further Notice of Proposed Rulemaking, Released November, 5 1998, at p. 25 ("In the matter of: Communications Assistance for Law Enforcement Act") ("J-STD-025 includes a `location' parameter that would identify the location of a subject's `mobile terminal' whenever this information is reasonably available at the intercept access point and its delivery to law enforcement is legally authorized. Location information would be available to the LEA irrespective of whether a call content channel or a call data channel was employed."). The FBI's desire to gather this information was challenged by civil liberties groups and industry associations. See
13.
See Center for Democracy and Technology, "FBI Seeks to Impose Surveillance Man dates on Telephone System; Balanced Objectives of 1994 Law Frustrated: Status Report," March 4, 1999, available at http://www.cdt.org/digi_tele/status.html (cached: http://www.webcitation.org/5IwsaQrc7).
14.
Declan McCullagh, "ISP Snooping Gaining Support," CNET News, Apr. 14, 2006, available at http://news.com.com/ISP+snooping+gaining+support/2100-1028_3-6061187.html (cached: http://www.webcitation.org/5IwsfxhrA). On March 15, 2006, the European Parliament passed a directive concerning the obligations of publicly available communications services with respect to the retention of data. See Eur. Parl. Doc. (COD/2005/0182). Members of Congress have been mulling over similar legislation. See Anne Broache, "U.S. attorney general calls for `reasonable' data retention," CNET News, Apr. 20, 2006, available at http://news.com.com/U.S.+attorney+general+calls+for+reasonable+data+retention/2100-1030_3-6063185.html (cached: http://www.webcitation.org/5IwsiMJus).
15.
Directive on the Retention of Data Generated or Processed in Connection with the Provision of Publicly Available electronic Communications Services or of Public Communications Networks and Amending Directive 2002/58/EC, available at http://register.consilium.eu.int/pdf/en/05/st03/st03677.en05.pdf (cached: http://www.webcitation.org/5IwspCzlR).
16.
Declan McCullagh, "Bill Would Force Websites to Delete Personal Info," CNET News, Feb. 8, 2006, available at http://news.com.com/2100-1028_3-6036951.html (cached: http://www.webcitation.org/5IwssTqBR).
17.
For a good discussion of the Clipper controversy, see Laura J. Gurak,
18.
See Electronic Frontier Foundation (EFF),
19.
For a good summary of the Clipper scheme, see Baker and Hurst,
20.
See Richard Field, "1996: Survey of the Year's Developments in Electronic Cash Law and the Laws Affecting Electronic Banking in the United States," 46
21.
See A. Michael Froomkin, "It Came from Planet Clipper: The Battle over Crypto graphic Key `Escrow,'"