U.S. Tries to Make It Easier to Wiretap the Internet

WASHINGTON — Federal law enforcement and national security officials are preparing to seek sweeping new regulations for the Internet, arguing that their ability to wiretap criminal and terrorism suspects is “going dark” as people increasingly communicate online instead of by telephone.

Essentially, officials want Congress to require all services that enable communications — including encrypted e-mail transmitters like BlackBerry, social networking Web sites like Facebook and software that allows direct “peer to peer” messaging like Skype — to be technically capable of complying if served with a wiretap order. The mandate would include being able to intercept and unscramble encrypted messages.

The bill, which the Obama administration plans to submit to lawmakers next year, raises fresh questions about how to balance security needs with protecting privacy and fostering innovation. And because security services around the world face the same problem, it could set an example that is copied globally.

James X. Dempsey, vice president of the Center for Democracy and Technology, an Internet policy group, said the proposal had “huge implications” and challenged “fundamental elements of the Internet revolution” — including its decentralized design.

“They are really asking for the authority to redesign services that take advantage of the unique, and now pervasive, architecture of the Internet,” he said. “They basically want to turn back the clock and make Internet services function the way that the telephone system used to function.”

But law enforcement officials contend that imposing such a mandate is reasonable and necessary to prevent the erosion of their investigative powers.

“We’re talking about lawfully authorized intercepts,” said Valerie E. Caproni, general counsel for the Federal Bureau of Investigation. “We’re not talking expanding authority. We’re talking about preserving our ability to execute our existing authority in order to protect the public safety and national security.”

Investigators have been concerned for years that changing communications technology could damage their ability to conduct surveillance. In recent months, officials from the F.B.I., the Justice Department, the National Security Agency, the White House and other agencies have been meeting to develop a proposed solution.

There is not yet agreement on important elements, like how to word statutory language defining who counts as a communications service provider, according to several officials familiar with the deliberations.

But they want it to apply broadly, including to companies that operate from servers abroad, like Research in Motion, the Canadian maker of BlackBerry devices. In recent months, that company has come into conflict with the governments of Dubai and India over their inability to conduct surveillance of messages sent via its encrypted service.

In the United States, phone and broadband networks are already required to have interception capabilities, under a 1994 law called the Communications Assistance to Law Enforcement Act. It aimed to ensure that government surveillance abilities would remain intact during the evolution from a copper-wire phone system to digital networks and cellphones.

Often, investigators can intercept communications at a switch operated by the network company. But sometimes — like when the target uses a service that encrypts messages between his computer and its servers — they must instead serve the order on a service provider to get unscrambled versions.

Like phone companies, communication service providers are subject to wiretap orders. But the 1994 law does not apply to them. While some maintain interception capacities, others wait until they are served with orders to try to develop them.

The F.B.I.’s operational technologies division spent $9.75 million last year helping communication companies — including some subject to the 1994 law that had difficulties — do so. And its 2010 budget included $9 million for a “Going Dark Program” to bolster its electronic surveillance capabilities.

Beyond such costs, Ms. Caproni said, F.B.I. efforts to help retrofit services have a major shortcoming: the process can delay their ability to wiretap a suspect for months.

Moreover, some services encrypt messages between users, so that even the provider cannot unscramble them.

There is no public data about how often court-approved surveillance is frustrated because of a service’s technical design.

But as an example, one official said, an investigation into a drug cartel earlier this year was stymied because smugglers used peer-to-peer software, which is difficult to intercept because it is not routed through a central hub. Agents eventually installed surveillance equipment in a suspect’s office, but that tactic was “risky,” the official said, and the delay “prevented the interception of pertinent communications.”

Moreover, according to several other officials, after the failed Times Square bombing in May, investigators discovered that the suspect, Faisal Shahzad, had been communicating with a service that lacked prebuilt interception capacity. If he had aroused suspicion beforehand, there would have been a delay before he could have been wiretapped.

To counter such problems, officials are coalescing around several of the proposal’s likely requirements:

¶ Communications services that encrypt messages must have a way to unscramble them.

¶ Foreign-based providers that do business inside the United States must install a domestic office capable of performing intercepts.

¶ Developers of software that enables peer-to-peer communication must redesign their service to allow interception.

Providers that failed to comply would face fines or some other penalty. But the proposal is likely to direct companies to come up with their own way to meet the mandates. Writing any statute in “technologically neutral” terms would also help prevent it from becoming obsolete, officials said.

Even with such a law, some gaps could remain. It is not clear how it could compel compliance by overseas services that do no domestic business, or from a “freeware” application developed by volunteers.

In their battle with Research in Motion, countries like Dubai have sought leverage by threatening to block BlackBerry data from their networks. But Ms. Caproni said the F.B.I. did not support filtering the Internet in the United States.

Still, even a proposal that consists only of a legal mandate is likely to be controversial, said Michael A. Sussmann, a former Justice Department lawyer who advises communications providers.

“It would be an enormous change for newly covered companies,” he said. “Implementation would be a huge technology and security headache, and the investigative burden and costs will shift to providers.”

Several privacy and technology advocates argued that requiring interception capabilities would create holes that would inevitably be exploited by hackers.

Steven M. Bellovin, a Columbia University computer science professor, pointed to an episode in Greece: In 2005, it was discovered that hackers had taken advantage of a legally mandated wiretap function to spy on top officials’ phones, including the prime minister’s.

“I think it’s a disaster waiting to happen,” he said. “If they start building in all these back doors, they will be exploited.”

Susan Landau, a Radcliffe Institute of Advanced Study fellow and former Sun Microsystems engineer, argued that the proposal would raise costly impediments to innovation by small startups.

“Every engineer who is developing the wiretap system is an engineer who is not building in greater security, more features, or getting the product out faster,” she said.

Moreover, providers of services featuring user-to-user encryption are likely to object to watering it down. Similarly, in the late 1990s, encryption makers fought off a proposal to require them to include a back door enabling wiretapping, arguing it would cripple their products in the global market.

But law enforcement officials rejected such arguments. They said including an interception capability from the start was less likely to inadvertently create security holes than retrofitting it after receiving a wiretap order.

They also noted that critics predicted that the 1994 law would impede cellphone innovation, but that technology continued to improve. And their envisioned decryption mandate is modest, they contended, because service providers — not the government — would hold the key.

“No one should be promising their customers that they will thumb their nose at a U.S. court order,” Ms. Caproni said. “They can promise strong encryption. They just need to figure out how they can provide us plain text.”

Source: http://www.nytimes.com/2010/09/27/us/27wiretap.html

Judge: Bush overstepped wiretapping authority

A federal judge has rejected the Bush administration's justification for warrantless wiretapping of suspected terrorists and ruled that federal agents had eavesdropped illegally on a U.S.-based Islamic charity.

The ruling Wednesday by Chief U.S. District Judge Vaughn Walker of San Francisco focused on the surveillance of a single organization, the Al-Haramain Islamic Foundation - the only plaintiff in dozens of wiretapping lawsuits around the nation that had evidence its calls were intercepted.

But Walker's reasoning struck at the heart of the program President George W. Bush authorized after the terrorist attacks of Sept. 11, 2001, allowing agents to intercept phone calls and e-mails between Americans and suspected foreign terrorists without a warrant.

When Bush acknowledged the surveillance in December 2005, he claimed the power to override a 1978 law, passed in response to revelations of wiretapping of political dissidents, that required the government to obtain advance court approval for each act of eavesdropping.

Walker said Wednesday that Bush lacked that authority.

Under the argument advanced by the Bush administration, "executive branch officials may treat as optional ... a statute (the 1978 law) enacted specifically to rein in and create a judicial check for executive-branch abuses of surveillance authority," the judge said.

That "theory of unfettered executive-branch discretion" holds an "obvious potential for governmental abuse and overreaching," Walker said.

Al-Haramain's lawyer, Jon Eisenberg, said the decision amounted to a finding that the entire program was illegal.

"Inherent in what Walker has done in this case is a determination that President Bush's program of warrantless surveillance was unlawful," Eisenberg said. "Everybody has to follow the law, including the president."

The Bush administration said it ended the program in mid-2008 and allowed a special court, created by the 1978 law, to review the wiretaps. The administration did not disclose the scope of that review, and neither Bush nor President Obama has revealed the extent of any continuing surveillance.

The ruling was also a rebuff to Obama. Although he had criticized Bush's surveillance program while running for president, Obama's Justice Department has repeatedly sought to dismiss the Al-Haramain suit and fought any judicial review of the wiretapping program.

Secret evidence

The department argued that courts lacked the power to decide whether any alleged surveillance was legal because all evidence related to wiretapping was a secret whose disclosure would aid the nation's enemies. Department lawyers refused to tell Walker whether they thought the overall program was legal.

Walker described the Justice Department's arguments as "nit-picking" and "acrobatics." He said the government had spurned every offer to justify its conduct in closed-door proceedings that could have protected any state secrets.

The Obama administration now must decide whether to appeal the ruling and invite the first decision by a higher court on the validity of the surveillance program.

The Justice Department was noncommittal about an appeal and instead issued a statement stressing Attorney General Eric Holder's recent restrictions on government claims of secrecy. The new rules require a high-level Justice Department committee to review all such claims, with the attorney general having the last word.

Paper trail

Other lawsuits challenging the wiretapping program have stumbled over a judicial requirement that the plaintiffs show evidence they were wiretapped. But the government inadvertently sent a classified document in 2004 to Al-Haramain, a now-defunct charity that was based in Oregon, reportedly showing that two of its lawyers had been wiretapped.

Several months after the surveillance began, the government classified Al-Haramain as a terrorist organization, a description its leaders called false.

The group returned the document at the government's request and was barred from using it as evidence. But Walker said Al-Haramain had established - through public statements by an FBI official, other nonclassified evidence and the timing of its lawyers' phone calls and the terrorist designation - that it had been illegally wiretapped.

Eisenberg said his clients, Al-Haramain and the two lawyers, would ask for the damages the law allows - $20,200 each, or $100 for each day of illegal surveillance - plus punitive damages and attorneys' fees.

Source: http://articles.sfgate.com/2010-04-01/bay-area/20830512_1_wiretapping-warrantless-al-haramain-islamic-foundation

Bush signs new rules on government wiretapping

WASHINGTON - President Bush signed a bill Thursday that overhauls rules about government eavesdropping and grants immunity to telecommunications companies that helped the U.S. spy on Americans in suspected terrorism cases.

He called it "landmark legislation that is vital to the security of our people."

Bush signed the measure in a Rose Garden ceremony a day after the Senate sent it to him, following nearly a year of debate in the Democratic-led Congress over surveillance rules and the warrantless wiretapping program Bush initiated after the Sept. 11, 2001, terrorist attacks. It was a battle that pitted privacy and civil liberties concerns against the desire to prevent terrorist attacks and Democrats' fears of being portrayed as weak when it comes to protecting the country.

Its passage was a major victory for Bush, an unpopular lame-duck president who nevertheless has been able to prevail over Congress on most issues of national security and intelligence disputes.

Bush said the 9/11 attack "changed our country forever" and taught the intelligence community that it must know who America's enemies are talking to and what they are saying.

"In the aftermath of 9/11," Bush said, "few would have imagined that we would be standing here seven years later without another attack on American soil. The fact that the terrorists have failed to strike our shores again does not mean that our enemies have given up."

Even before Bush signed the legislation, the American Civil Liberties Union said it would challenge the new law in court.

The president said the bill gives the government anti-terror tools it needs without compromising Americans' civil liberties.

Bush was joined at the ceremony by Vice President Dick Cheney, Attorney General Michael Mukasey, Director of National Intelligence Mike McConnell and more than a dozen members of Congress.

The ACLU's lawsuit was filed on behalf of several civil rights groups. It wants a federal judge in New York to rule that the law is an unconstitutional violation of free speech and the right against unlawful search and seizure. It also asks that the judge permanently block intelligence officials from conducting surveillance under the law.

"The new law gives the government the power to conduct dragnet surveillance that has no connection to terrorism or criminal activity of any kind," said Jameel Jaffer, director of the ACLU's National Security Project, in a conference call to reporters.

"A law like this is fundamentally inconsistent with the Constitution and with the most basic democratic values," he said.

Roger Atwood, communications director for the Washington Office on Latin America, a human rights organization for the region, said the new law will impede the group's work.

"The mere suspicion that information provided to us, to our staff, will be accessed by the U.S. government can seriously affect WOLA's credibility and our effectiveness in Latin America in moving our work forward," Atwood said in the conference call.

Source: http://news.yahoo.com/s/ap/20080710/ap_on_go_pr_wh/terrorist_surveillance