In July of last year, the Drug Enforcement Administration in Ohio wanted to carry out surveillance on seven WhatsApp users. To do that, agents asked a judge to approve the use of surveillance tools known as "pen register and trap and trace" devices. While they wouldn't get the actual content of WhatsApp messages, they would get up-to-date information on what numbers those WhatsApp users were either messaging or calling, when, for how long and from what IP address. The latter part could also provide a rough geolocation of the user, hence the use of pen registers to both build up cases against suspects by showing, for instance, with whom drug dealers are communicating, and to assist in tracking down fugitives.
But in the investigators' application to have the surveillance device installed on WhatsApp systems, there was almost zero detail on just why the DEA wanted to spy on all those numbers, regardless of where they were based (four of the seven users had Mexican telephone numbers) and for a period of 60 days. That's because the government doesn't actually need to give a full explanation to a judge to get their approval for a pen register, thanks to a U.S. law that privacy experts say needs a drastic update so that federal agencies have to provide more detail on why they need to carry out surveillance using the surveillance tool. At a time when there's heightened concern about surveillance of encrypted apps like WhatsApp, in part thanks to the Pegasus Project revelations of global unchecked spyware use via Israeli provider NSO , pen registers represent a little-understood, potentially privacy-endangering surveillance method that the U.S. government uses frequently on Facebook and its hugely popular messaging tool.
In the Ohio pen register application, the government wrote explicitly that it only needs to provide three facts to get approval to use a pen register, none of which provide any background on the relevant investigation. They include: the identity of the attorney or the law enforcement officer making the application; the identity of the agency making the application; and a certification from the applicant that "the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by that agency." This explanation, cited word-for-word in other pen register applications across various states reviewed by Forbes , is based on the Pen Register Act within the Electronic Communications Privacy Act of 1986 . Under that law, courts have held that the Fourth Amendment, protecting Americans from unreasonable searches, does not apply to such surveillance, so there's no need for investigators to show "probable cause."
Critics say that the law is inadequate. "If that is all the government needs to inform the court, then what is the point of having a statutory standard in the first place? It is doing no work at all," says Jennifer Granick, surveillance and cybersecurity counsel at the American Civil Liberties Union (ACLU). "We knew that the certification standard was abysmally low, but I thought that at the very least the government was respectful enough to tell the court what is going on so that it could ask questions and exercise moral suasion. It's a short step between saying that you don't have to do anything beyond reciting boilerplate text, and actually refusing to do anything other than recite boilerplate text."
The government does sometimes provide more information on why it is going to use a pen register, but that typically happens when they are applying for more information from a telecom or internet company under different laws. In an investigation in Missouri, where police were looking for a fugitive charged with drug dealing, the government had the surveillance device used on a Facebook account of interest, but also asked the social media giant to provide subscriber information, like the user's name and address. For the latter, the government had to provide "specific and articulable facts" that proved the data being requested was relevant to the investigation, under another part of the Electronic Communications Privacy Act. Such "hybrid" orders that combine both the Pen Register Act and Stored Communications Act sections of the ECPA were last year deemed "inherently questionable" by the Electronic Frontier Foundation (EFF) "because they are not explicitly authorized by federal law."
However it applies to use them, the government can put pen traps on almost any technology that transmits some kind of message, from cellphone services to other social media apps like Snapchat and LinkedIn. That includes car Wi-Fi systems. A recent report in Forbes detailed the surveillance of a Dodge vehicle with a device that imitates a cellphone tower in order to identify and locate a target of interest. But before that, they put a pen register on the car's internal modem that provides the Wi-Fi. After they deployed all the snooping tech, the suspect was arrested.
Though the ACLU and other privacy-focused nonprofits have, for much of the last two decades, called for laws that force the government to provide full explanations and probable cause for pen registers mandatory, there's little sign of any desire for urgent change on Capitol Hill. But, given the government is increasingly using pen registers to track all kinds of modern technologies, ones that didn't exist when the 1986 law that determines their use was created, greater oversight of this much-used surveillance method could be incoming.
This story is part of The Wire IRL feature in my newsletter, The Wiretap, where I'll provide links to the full search warrants described above. Out every Monday, it's a mix of strange true crime and real-world surveillance, with all the relevant search warrants and court documents for you to pore over. There's also all the cybersecurity and privacy news you need to read. Sign up here .
- Why Should Ethnic-DASH-Americans Drop the Dash and Be Full Americans
- Is The Law of Attraction Just a Theory?
- Success & The Law of Large Numbers
- Four Ways to Become a Great Mother-in-law
- The Law of Sowing and Reaping - Tropical Finance
- Accepting Responsibility With the Law of Attraction
- The 7 Laws of Attraction
- Criminal Law and Elliot Spitzer - The Emperor Club Has No Clothes
- Law of Vibration - The Key To Understanding The Law of Attraction
- Laws Kill - Save the Next Terri Schiavo
- The Continuing Struggle of American Manufacturers
- What Happens When the Fed Runs Out of Money?
- Spy Surveillance Cameras - Improve Your Seller Reputation In Two Easy Steps
- The Wrong Ways to Use Your Spy Camera
- The Law of Attraction and the Key of Transmutation
- The Law of Attraction, Television & You
- How Hidden Spy Cameras Can Help With Home Security
- When The Fed Cuts Rates, Why Don't Mortgage Rates Go Down?
- 6 Reasons Spy Cameras Can Improve Your Life
- Lemon Law and Secret Warranties
How American Law Lets Feds Spy On WhatsApp Without Needing To Say Why have 1150 words, post on www.forbes.com at August 3, 2021. This is cached page on Business News. If you want remove this page, please contact us.